Home | History | Annotate | Download | only in tc
      1 /*
      2  * f_flow.c		Flow filter
      3  *
      4  * 		This program is free software; you can redistribute it and/or
      5  * 		modify it under the terms of the GNU General Public License
      6  * 		as published by the Free Software Foundation; either version
      7  * 		2 of the License, or (at your option) any later version.
      8  *
      9  * Authors:	Patrick McHardy <kaber (at) trash.net>
     10  */
     11 #include <stdio.h>
     12 #include <stdlib.h>
     13 #include <unistd.h>
     14 #include <string.h>
     15 #include <errno.h>
     16 
     17 #include "utils.h"
     18 #include "tc_util.h"
     19 #include "m_ematch.h"
     20 
     21 static void explain(void)
     22 {
     23 	fprintf(stderr,
     24 "Usage: ... flow ...\n"
     25 "\n"
     26 " [mapping mode]: map key KEY [ OPS ] ...\n"
     27 " [hashing mode]: hash keys KEY-LIST ... [ perturb SECS ]\n"
     28 "\n"
     29 "                 [ divisor NUM ] [ baseclass ID ] [ match EMATCH_TREE ]\n"
     30 "                 [ police POLICE_SPEC ] [ action ACTION_SPEC ]\n"
     31 "\n"
     32 "KEY-LIST := [ KEY-LIST , ] KEY\n"
     33 "KEY      := [ src | dst | proto | proto-src | proto-dst | iif | priority | \n"
     34 "              mark | nfct | nfct-src | nfct-dst | nfct-proto-src | \n"
     35 "              nfct-proto-dst | rt-classid | sk-uid | sk-gid |\n"
     36 "              vlan-tag | rxhash ]\n"
     37 "OPS      := [ or NUM | and NUM | xor NUM | rshift NUM | addend NUM ]\n"
     38 "ID       := X:Y\n"
     39 	);
     40 }
     41 
     42 static const char *flow_keys[FLOW_KEY_MAX+1] = {
     43 	[FLOW_KEY_SRC]			= "src",
     44 	[FLOW_KEY_DST]			= "dst",
     45 	[FLOW_KEY_PROTO]		= "proto",
     46 	[FLOW_KEY_PROTO_SRC]		= "proto-src",
     47 	[FLOW_KEY_PROTO_DST]		= "proto-dst",
     48 	[FLOW_KEY_IIF]			= "iif",
     49 	[FLOW_KEY_PRIORITY]		= "priority",
     50 	[FLOW_KEY_MARK]			= "mark",
     51 	[FLOW_KEY_NFCT]			= "nfct",
     52 	[FLOW_KEY_NFCT_SRC]		= "nfct-src",
     53 	[FLOW_KEY_NFCT_DST]		= "nfct-dst",
     54 	[FLOW_KEY_NFCT_PROTO_SRC]	= "nfct-proto-src",
     55 	[FLOW_KEY_NFCT_PROTO_DST]	= "nfct-proto-dst",
     56 	[FLOW_KEY_RTCLASSID]		= "rt-classid",
     57 	[FLOW_KEY_SKUID]		= "sk-uid",
     58 	[FLOW_KEY_SKGID]		= "sk-gid",
     59 	[FLOW_KEY_VLAN_TAG]		= "vlan-tag",
     60 	[FLOW_KEY_RXHASH]		= "rxhash",
     61 };
     62 
     63 static int flow_parse_keys(__u32 *keys, __u32 *nkeys, char *argv)
     64 {
     65 	char *s, *sep;
     66 	unsigned int i;
     67 
     68 	*keys = 0;
     69 	*nkeys = 0;
     70 	s = argv;
     71 	while (s != NULL) {
     72 		sep = strchr(s, ',');
     73 		if (sep)
     74 			*sep = '\0';
     75 
     76 		for (i = 0; i <= FLOW_KEY_MAX; i++) {
     77 			if (matches(s, flow_keys[i]) == 0) {
     78 				*keys |= 1 << i;
     79 				(*nkeys)++;
     80 				break;
     81 			}
     82 		}
     83 		if (i > FLOW_KEY_MAX) {
     84 			fprintf(stderr, "Unknown flow key \"%s\"\n", s);
     85 			return -1;
     86 		}
     87 		s = sep ? sep + 1 : NULL;
     88 	}
     89 	return 0;
     90 }
     91 
     92 static void transfer_bitop(__u32 *mask, __u32 *xor, __u32 m, __u32 x)
     93 {
     94 	*xor = x ^ (*xor & m);
     95 	*mask &= m;
     96 }
     97 
     98 static int get_addend(__u32 *addend, char *argv, __u32 keys)
     99 {
    100 	inet_prefix addr;
    101 	int sign = 0;
    102 	__u32 tmp;
    103 
    104 	if (*argv == '-') {
    105 		sign = 1;
    106 		argv++;
    107 	}
    108 
    109 	if (get_u32(&tmp, argv, 0) == 0)
    110 		goto out;
    111 
    112 	if (keys & (FLOW_KEY_SRC | FLOW_KEY_DST |
    113 		    FLOW_KEY_NFCT_SRC | FLOW_KEY_NFCT_DST) &&
    114 	    get_addr(&addr, argv, AF_UNSPEC) == 0) {
    115 		switch (addr.family) {
    116 		case AF_INET:
    117 			tmp = ntohl(addr.data[0]);
    118 			goto out;
    119 		case AF_INET6:
    120 			tmp = ntohl(addr.data[3]);
    121 			goto out;
    122 		}
    123 	}
    124 
    125 	return -1;
    126 out:
    127 	if (sign)
    128 		tmp = -tmp;
    129 	*addend = tmp;
    130 	return 0;
    131 }
    132 
    133 static int flow_parse_opt(struct filter_util *fu, char *handle,
    134 			  int argc, char **argv, struct nlmsghdr *n)
    135 {
    136 	struct tc_police tp;
    137 	struct tcmsg *t = NLMSG_DATA(n);
    138 	struct rtattr *tail;
    139 	__u32 mask = ~0U, xor = 0;
    140 	__u32 keys = 0, nkeys = 0;
    141 	__u32 mode = FLOW_MODE_MAP;
    142 	__u32 tmp;
    143 
    144 	memset(&tp, 0, sizeof(tp));
    145 
    146 	if (handle) {
    147 		if (get_u32(&t->tcm_handle, handle, 0)) {
    148 			fprintf(stderr, "Illegal \"handle\"\n");
    149 			return -1;
    150 		}
    151 	}
    152 
    153 	tail = NLMSG_TAIL(n);
    154 	addattr_l(n, 4096, TCA_OPTIONS, NULL, 0);
    155 
    156 	while (argc > 0) {
    157 		if (matches(*argv, "map") == 0) {
    158 			mode = FLOW_MODE_MAP;
    159 		} else if (matches(*argv, "hash") == 0) {
    160 			mode = FLOW_MODE_HASH;
    161 		} else if (matches(*argv, "keys") == 0) {
    162 			NEXT_ARG();
    163 			if (flow_parse_keys(&keys, &nkeys, *argv))
    164 				return -1;
    165 			addattr32(n, 4096, TCA_FLOW_KEYS, keys);
    166 		} else if (matches(*argv, "and") == 0) {
    167 			NEXT_ARG();
    168 			if (get_u32(&tmp, *argv, 0)) {
    169 				fprintf(stderr, "Illegal \"mask\"\n");
    170 				return -1;
    171 			}
    172 			transfer_bitop(&mask, &xor, tmp, 0);
    173 		} else if (matches(*argv, "or") == 0) {
    174 			NEXT_ARG();
    175 			if (get_u32(&tmp, *argv, 0)) {
    176 				fprintf(stderr, "Illegal \"or\"\n");
    177 				return -1;
    178 			}
    179 			transfer_bitop(&mask, &xor, ~tmp, tmp);
    180 		} else if (matches(*argv, "xor") == 0) {
    181 			NEXT_ARG();
    182 			if (get_u32(&tmp, *argv, 0)) {
    183 				fprintf(stderr, "Illegal \"xor\"\n");
    184 				return -1;
    185 			}
    186 			transfer_bitop(&mask, &xor, ~0, tmp);
    187 		} else if (matches(*argv, "rshift") == 0) {
    188 			NEXT_ARG();
    189 			if (get_u32(&tmp, *argv, 0)) {
    190 				fprintf(stderr, "Illegal \"rshift\"\n");
    191 				return -1;
    192 			}
    193 			addattr32(n, 4096, TCA_FLOW_RSHIFT, tmp);
    194 		} else if (matches(*argv, "addend") == 0) {
    195 			NEXT_ARG();
    196 			if (get_addend(&tmp, *argv, keys)) {
    197 				fprintf(stderr, "Illegal \"addend\"\n");
    198 				return -1;
    199 			}
    200 			addattr32(n, 4096, TCA_FLOW_ADDEND, tmp);
    201 		} else if (matches(*argv, "divisor") == 0) {
    202 			NEXT_ARG();
    203 			if (get_u32(&tmp, *argv, 0)) {
    204 				fprintf(stderr, "Illegal \"divisor\"\n");
    205 				return -1;
    206 			}
    207 			addattr32(n, 4096, TCA_FLOW_DIVISOR, tmp);
    208 		} else if (matches(*argv, "baseclass") == 0) {
    209 			NEXT_ARG();
    210 			if (get_tc_classid(&tmp, *argv) || TC_H_MIN(tmp) == 0) {
    211 				fprintf(stderr, "Illegal \"baseclass\"\n");
    212 				return -1;
    213 			}
    214 			addattr32(n, 4096, TCA_FLOW_BASECLASS, tmp);
    215 		} else if (matches(*argv, "perturb") == 0) {
    216 			NEXT_ARG();
    217 			if (get_u32(&tmp, *argv, 0)) {
    218 				fprintf(stderr, "Illegal \"perturb\"\n");
    219 				return -1;
    220 			}
    221 			addattr32(n, 4096, TCA_FLOW_PERTURB, tmp);
    222 		} else if (matches(*argv, "police") == 0) {
    223 			NEXT_ARG();
    224 			if (parse_police(&argc, &argv, TCA_FLOW_POLICE, n)) {
    225 				fprintf(stderr, "Illegal \"police\"\n");
    226 				return -1;
    227 			}
    228 			continue;
    229 		} else if (matches(*argv, "action") == 0) {
    230 			NEXT_ARG();
    231 			if (parse_action(&argc, &argv, TCA_FLOW_ACT, n)) {
    232 				fprintf(stderr, "Illegal \"action\"\n");
    233 				return -1;
    234 			}
    235 			continue;
    236 		} else if (matches(*argv, "match") == 0) {
    237 			NEXT_ARG();
    238 			if (parse_ematch(&argc, &argv, TCA_FLOW_EMATCHES, n)) {
    239 				fprintf(stderr, "Illegal \"ematch\"\n");
    240 				return -1;
    241 			}
    242 			continue;
    243 		} else if (matches(*argv, "help") == 0) {
    244 			explain();
    245 			return -1;
    246 		} else {
    247 			fprintf(stderr, "What is \"%s\"?\n", *argv);
    248 			explain();
    249 			return -1;
    250 		}
    251 		argv++, argc--;
    252 	}
    253 
    254 	if (nkeys > 1 && mode != FLOW_MODE_HASH) {
    255 		fprintf(stderr, "Invalid mode \"map\" for multiple keys\n");
    256 		return -1;
    257 	}
    258 	addattr32(n, 4096, TCA_FLOW_MODE, mode);
    259 
    260 	if (mask != ~0 || xor != 0) {
    261 		addattr32(n, 4096, TCA_FLOW_MASK, mask);
    262 		addattr32(n, 4096, TCA_FLOW_XOR, xor);
    263 	}
    264 
    265 	tail->rta_len = (void *)NLMSG_TAIL(n) - (void *)tail;
    266 	return 0;
    267 }
    268 
    269 static int flow_print_opt(struct filter_util *fu, FILE *f, struct rtattr *opt,
    270 			  __u32 handle)
    271 {
    272 	struct rtattr *tb[TCA_FLOW_MAX+1];
    273 	SPRINT_BUF(b1);
    274 	unsigned int i;
    275 	__u32 mask = ~0, val = 0;
    276 
    277 	if (opt == NULL)
    278 		return -EINVAL;
    279 
    280 	parse_rtattr_nested(tb, TCA_FLOW_MAX, opt);
    281 
    282 	fprintf(f, "handle 0x%x ", handle);
    283 
    284 	if (tb[TCA_FLOW_MODE]) {
    285 		__u32 mode = rta_getattr_u32(tb[TCA_FLOW_MODE]);
    286 
    287 		switch (mode) {
    288 		case FLOW_MODE_MAP:
    289 			fprintf(f, "map ");
    290 			break;
    291 		case FLOW_MODE_HASH:
    292 			fprintf(f, "hash ");
    293 			break;
    294 		}
    295 	}
    296 
    297 	if (tb[TCA_FLOW_KEYS]) {
    298 		__u32 keymask = rta_getattr_u32(tb[TCA_FLOW_KEYS]);
    299 		char *sep = "";
    300 
    301 		fprintf(f, "keys ");
    302 		for (i = 0; i <= FLOW_KEY_MAX; i++) {
    303 			if (keymask & (1 << i)) {
    304 				fprintf(f, "%s%s", sep, flow_keys[i]);
    305 				sep = ",";
    306 			}
    307 		}
    308 		fprintf(f, " ");
    309 	}
    310 
    311 	if (tb[TCA_FLOW_MASK])
    312 		mask = rta_getattr_u32(tb[TCA_FLOW_MASK]);
    313 	if (tb[TCA_FLOW_XOR])
    314 		val = rta_getattr_u32(tb[TCA_FLOW_XOR]);
    315 
    316 	if (mask != ~0 || val != 0) {
    317 		__u32 or = (mask & val) ^ val;
    318 		__u32 xor = mask & val;
    319 
    320 		if (mask != ~0)
    321 			fprintf(f, "and 0x%.8x ", mask);
    322 		if (xor != 0)
    323 			fprintf(f, "xor 0x%.8x ", xor);
    324 		if (or != 0)
    325 			fprintf(f, "or 0x%.8x ", or);
    326 	}
    327 
    328 	if (tb[TCA_FLOW_RSHIFT])
    329 		fprintf(f, "rshift %u ",
    330 			rta_getattr_u32(tb[TCA_FLOW_RSHIFT]));
    331 	if (tb[TCA_FLOW_ADDEND])
    332 		fprintf(f, "addend 0x%x ",
    333 			rta_getattr_u32(tb[TCA_FLOW_ADDEND]));
    334 
    335 	if (tb[TCA_FLOW_DIVISOR])
    336 		fprintf(f, "divisor %u ",
    337 			rta_getattr_u32(tb[TCA_FLOW_DIVISOR]));
    338 	if (tb[TCA_FLOW_BASECLASS])
    339 		fprintf(f, "baseclass %s ",
    340 			sprint_tc_classid(rta_getattr_u32(tb[TCA_FLOW_BASECLASS]), b1));
    341 
    342 	if (tb[TCA_FLOW_PERTURB])
    343 		fprintf(f, "perturb %usec ",
    344 			rta_getattr_u32(tb[TCA_FLOW_PERTURB]));
    345 
    346 	if (tb[TCA_FLOW_EMATCHES])
    347 		print_ematch(f, tb[TCA_FLOW_EMATCHES]);
    348 	if (tb[TCA_FLOW_POLICE])
    349 		tc_print_police(f, tb[TCA_FLOW_POLICE]);
    350 	if (tb[TCA_FLOW_ACT]) {
    351 		fprintf(f, "\n");
    352 		tc_print_action(f, tb[TCA_FLOW_ACT]);
    353 	}
    354 	return 0;
    355 }
    356 
    357 struct filter_util flow_filter_util = {
    358 	.id		= "flow",
    359 	.parse_fopt	= flow_parse_opt,
    360 	.print_fopt	= flow_print_opt,
    361 };
    362