Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/*
2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/kernel.h>
12#include <linux/init.h>
13#include <linux/module.h>
14#include <linux/netlink.h>
15#include <linux/netfilter.h>
16#include <linux/netfilter/nf_tables.h>
17#include <net/netfilter/nf_tables_core.h>
18#include <net/netfilter/nf_tables.h>
19
20struct nft_cmp_expr {
21 struct nft_data data;
22 enum nft_registers sreg:8;
23 u8 len;
24 enum nft_cmp_ops op:8;
25};
26
27void nft_cmp_eval(const struct nft_expr *expr,
28 struct nft_regs *regs,
29 const struct nft_pktinfo *pkt)
30{
31 const struct nft_cmp_expr *priv = nft_expr_priv(expr);
32 int d;
33
34 d = memcmp(®s->data[priv->sreg], &priv->data, priv->len);
35 switch (priv->op) {
36 case NFT_CMP_EQ:
37 if (d != 0)
38 goto mismatch;
39 break;
40 case NFT_CMP_NEQ:
41 if (d == 0)
42 goto mismatch;
43 break;
44 case NFT_CMP_LT:
45 if (d == 0)
46 goto mismatch;
47 /* fall through */
48 case NFT_CMP_LTE:
49 if (d > 0)
50 goto mismatch;
51 break;
52 case NFT_CMP_GT:
53 if (d == 0)
54 goto mismatch;
55 /* fall through */
56 case NFT_CMP_GTE:
57 if (d < 0)
58 goto mismatch;
59 break;
60 }
61 return;
62
63mismatch:
64 regs->verdict.code = NFT_BREAK;
65}
66
67static const struct nla_policy nft_cmp_policy[NFTA_CMP_MAX + 1] = {
68 [NFTA_CMP_SREG] = { .type = NLA_U32 },
69 [NFTA_CMP_OP] = { .type = NLA_U32 },
70 [NFTA_CMP_DATA] = { .type = NLA_NESTED },
71};
72
73static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
74 const struct nlattr * const tb[])
75{
76 struct nft_cmp_expr *priv = nft_expr_priv(expr);
77 struct nft_data_desc desc;
78 int err;
79
80 err = nft_data_init(NULL, &priv->data, sizeof(priv->data), &desc,
81 tb[NFTA_CMP_DATA]);
82 if (err < 0)
83 return err;
84
85 priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
86 err = nft_validate_register_load(priv->sreg, desc.len);
87 if (err < 0)
88 return err;
89
90 priv->op = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
91 priv->len = desc.len;
92 return 0;
93}
94
95static int nft_cmp_dump(struct sk_buff *skb, const struct nft_expr *expr)
96{
97 const struct nft_cmp_expr *priv = nft_expr_priv(expr);
98
99 if (nft_dump_register(skb, NFTA_CMP_SREG, priv->sreg))
100 goto nla_put_failure;
101 if (nla_put_be32(skb, NFTA_CMP_OP, htonl(priv->op)))
102 goto nla_put_failure;
103
104 if (nft_data_dump(skb, NFTA_CMP_DATA, &priv->data,
105 NFT_DATA_VALUE, priv->len) < 0)
106 goto nla_put_failure;
107 return 0;
108
109nla_put_failure:
110 return -1;
111}
112
113static const struct nft_expr_ops nft_cmp_ops = {
114 .type = &nft_cmp_type,
115 .size = NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr)),
116 .eval = nft_cmp_eval,
117 .init = nft_cmp_init,
118 .dump = nft_cmp_dump,
119};
120
121static int nft_cmp_fast_init(const struct nft_ctx *ctx,
122 const struct nft_expr *expr,
123 const struct nlattr * const tb[])
124{
125 struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
126 struct nft_data_desc desc;
127 struct nft_data data;
128 u32 mask;
129 int err;
130
131 err = nft_data_init(NULL, &data, sizeof(data), &desc,
132 tb[NFTA_CMP_DATA]);
133 if (err < 0)
134 return err;
135
136 priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
137 err = nft_validate_register_load(priv->sreg, desc.len);
138 if (err < 0)
139 return err;
140
141 desc.len *= BITS_PER_BYTE;
142 mask = nft_cmp_fast_mask(desc.len);
143
144 priv->data = data.data[0] & mask;
145 priv->len = desc.len;
146 return 0;
147}
148
149static int nft_cmp_fast_dump(struct sk_buff *skb, const struct nft_expr *expr)
150{
151 const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
152 struct nft_data data;
153
154 if (nft_dump_register(skb, NFTA_CMP_SREG, priv->sreg))
155 goto nla_put_failure;
156 if (nla_put_be32(skb, NFTA_CMP_OP, htonl(NFT_CMP_EQ)))
157 goto nla_put_failure;
158
159 data.data[0] = priv->data;
160 if (nft_data_dump(skb, NFTA_CMP_DATA, &data,
161 NFT_DATA_VALUE, priv->len / BITS_PER_BYTE) < 0)
162 goto nla_put_failure;
163 return 0;
164
165nla_put_failure:
166 return -1;
167}
168
169const struct nft_expr_ops nft_cmp_fast_ops = {
170 .type = &nft_cmp_type,
171 .size = NFT_EXPR_SIZE(sizeof(struct nft_cmp_fast_expr)),
172 .eval = NULL, /* inlined */
173 .init = nft_cmp_fast_init,
174 .dump = nft_cmp_fast_dump,
175};
176
177static const struct nft_expr_ops *
178nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
179{
180 struct nft_data_desc desc;
181 struct nft_data data;
182 enum nft_cmp_ops op;
183 int err;
184
185 if (tb[NFTA_CMP_SREG] == NULL ||
186 tb[NFTA_CMP_OP] == NULL ||
187 tb[NFTA_CMP_DATA] == NULL)
188 return ERR_PTR(-EINVAL);
189
190 op = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
191 switch (op) {
192 case NFT_CMP_EQ:
193 case NFT_CMP_NEQ:
194 case NFT_CMP_LT:
195 case NFT_CMP_LTE:
196 case NFT_CMP_GT:
197 case NFT_CMP_GTE:
198 break;
199 default:
200 return ERR_PTR(-EINVAL);
201 }
202
203 err = nft_data_init(NULL, &data, sizeof(data), &desc,
204 tb[NFTA_CMP_DATA]);
205 if (err < 0)
206 return ERR_PTR(err);
207
208 if (desc.type != NFT_DATA_VALUE) {
209 err = -EINVAL;
210 goto err1;
211 }
212
213 if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)
214 return &nft_cmp_fast_ops;
215
216 return &nft_cmp_ops;
217err1:
218 nft_data_release(&data, desc.type);
219 return ERR_PTR(-EINVAL);
220}
221
222struct nft_expr_type nft_cmp_type __read_mostly = {
223 .name = "cmp",
224 .select_ops = nft_cmp_select_ops,
225 .policy = nft_cmp_policy,
226 .maxattr = NFTA_CMP_MAX,
227 .owner = THIS_MODULE,
228};