net/flow_dissector: add connection tracking dissection

Retreives connection tracking zone, mark, label, and state from
a SKB.

Signed-off-by: Paul Blakey <paulb@mellanox.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 9d7a2c28ea35ce5019874446b6f74ef30134afca..d8af86d995d6fe0b7fe8afc3a21d7d8faac2d7ce 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1325,6 +1325,16 @@ void skb_flow_dissect_meta(const struct sk_buff *skb,
                           struct flow_dissector *flow_dissector,
                           void *target_container);
 
+/* Gets a skb connection tracking info, ctinfo map should be a
+ * a map of mapsize to translate enum ip_conntrack_info states
+ * to user states.
+ */
+void
+skb_flow_dissect_ct(const struct sk_buff *skb,
+                   struct flow_dissector *flow_dissector,
+                   void *target_container,
+                   u16 *ctinfo_map,
+                   size_t mapsize);
 void
 skb_flow_dissect_tunnel_info(const struct sk_buff *skb,
                             struct flow_dissector *flow_dissector,

diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index 02478e48fae496643f3a1493930ecfd0b1f66edc..90bd210be06075818a8ba3213006e16eb610c602 100644 (file)
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -208,6 +208,20 @@ struct flow_dissector_key_meta {
        int ingress_ifindex;
 };
 
+/**
+ * struct flow_dissector_key_ct:
+ * @ct_state: conntrack state after converting with map
+ * @ct_mark: conttrack mark
+ * @ct_zone: conntrack zone
+ * @ct_labels: conntrack labels
+ */
+struct flow_dissector_key_ct {
+       u16     ct_state;
+       u16     ct_zone;
+       u32     ct_mark;
+       u32     ct_labels[4];
+};
+
 enum flow_dissector_key_id {
        FLOW_DISSECTOR_KEY_CONTROL, /* struct flow_dissector_key_control */
        FLOW_DISSECTOR_KEY_BASIC, /* struct flow_dissector_key_basic */
@@ -234,6 +248,7 @@ enum flow_dissector_key_id {
        FLOW_DISSECTOR_KEY_ENC_IP, /* struct flow_dissector_key_ip */
        FLOW_DISSECTOR_KEY_ENC_OPTS, /* struct flow_dissector_key_enc_opts */
        FLOW_DISSECTOR_KEY_META, /* struct flow_dissector_key_meta */
+       FLOW_DISSECTOR_KEY_CT, /* struct flow_dissector_key_ct */
 
        FLOW_DISSECTOR_KEY_MAX,
 };

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 01ad60b5aa75e96c7f0dd2eedccf2b75d0b1daa2..3e6fedb57bc100e8ce002deddbade59371a73065 100644 (file)
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -27,6 +27,10 @@
 #include <scsi/fc/fc_fcoe.h>
 #include <uapi/linux/batadv_packet.h>
 #include <linux/bpf.h>
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_labels.h>
+#endif
 
 static DEFINE_MUTEX(flow_dissector_mutex);
 
@@ -231,6 +235,46 @@ skb_flow_dissect_set_enc_addr_type(enum flow_dissector_key_id type,
        ctrl->addr_type = type;
 }
 
+void
+skb_flow_dissect_ct(const struct sk_buff *skb,
+                   struct flow_dissector *flow_dissector,
+                   void *target_container,
+                   u16 *ctinfo_map,
+                   size_t mapsize)
+{
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+       struct flow_dissector_key_ct *key;
+       enum ip_conntrack_info ctinfo;
+       struct nf_conn_labels *cl;
+       struct nf_conn *ct;
+
+       if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_CT))
+               return;
+
+       ct = nf_ct_get(skb, &ctinfo);
+       if (!ct)
+               return;
+
+       key = skb_flow_dissector_target(flow_dissector,
+                                       FLOW_DISSECTOR_KEY_CT,
+                                       target_container);
+
+       if (ctinfo < mapsize)
+               key->ct_state = ctinfo_map[ctinfo];
+#if IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES)
+       key->ct_zone = ct->zone.id;
+#endif
+#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
+       key->ct_mark = ct->mark;
+#endif
+
+       cl = nf_ct_labels_find(ct);
+       if (cl)
+               memcpy(key->ct_labels, cl->bits, sizeof(key->ct_labels));
+#endif /* CONFIG_NF_CONNTRACK */
+}
+EXPORT_SYMBOL(skb_flow_dissect_ct);
+
 void
 skb_flow_dissect_tunnel_info(const struct sk_buff *skb,
                             struct flow_dissector *flow_dissector,