This source file includes following definitions.
- nft_cmp_eval
- nft_cmp_init
- nft_cmp_dump
- __nft_cmp_offload
- nft_cmp_offload
- nft_cmp_fast_init
- nft_cmp_fast_offload
- nft_cmp_fast_dump
- nft_cmp_select_ops
1
2
3
4
5
6
7
8 #include <linux/kernel.h>
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/netlink.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter/nf_tables.h>
14 #include <net/netfilter/nf_tables_core.h>
15 #include <net/netfilter/nf_tables_offload.h>
16 #include <net/netfilter/nf_tables.h>
17
18 struct nft_cmp_expr {
19 struct nft_data data;
20 enum nft_registers sreg:8;
21 u8 len;
22 enum nft_cmp_ops op:8;
23 };
24
25 void nft_cmp_eval(const struct nft_expr *expr,
26 struct nft_regs *regs,
27 const struct nft_pktinfo *pkt)
28 {
29 const struct nft_cmp_expr *priv = nft_expr_priv(expr);
30 int d;
31
32 d = memcmp(®s->data[priv->sreg], &priv->data, priv->len);
33 switch (priv->op) {
34 case NFT_CMP_EQ:
35 if (d != 0)
36 goto mismatch;
37 break;
38 case NFT_CMP_NEQ:
39 if (d == 0)
40 goto mismatch;
41 break;
42 case NFT_CMP_LT:
43 if (d == 0)
44 goto mismatch;
45
46 case NFT_CMP_LTE:
47 if (d > 0)
48 goto mismatch;
49 break;
50 case NFT_CMP_GT:
51 if (d == 0)
52 goto mismatch;
53
54 case NFT_CMP_GTE:
55 if (d < 0)
56 goto mismatch;
57 break;
58 }
59 return;
60
61 mismatch:
62 regs->verdict.code = NFT_BREAK;
63 }
64
65 static const struct nla_policy nft_cmp_policy[NFTA_CMP_MAX + 1] = {
66 [NFTA_CMP_SREG] = { .type = NLA_U32 },
67 [NFTA_CMP_OP] = { .type = NLA_U32 },
68 [NFTA_CMP_DATA] = { .type = NLA_NESTED },
69 };
70
71 static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
72 const struct nlattr * const tb[])
73 {
74 struct nft_cmp_expr *priv = nft_expr_priv(expr);
75 struct nft_data_desc desc;
76 int err;
77
78 err = nft_data_init(NULL, &priv->data, sizeof(priv->data), &desc,
79 tb[NFTA_CMP_DATA]);
80 if (err < 0)
81 return err;
82
83 if (desc.type != NFT_DATA_VALUE) {
84 err = -EINVAL;
85 nft_data_release(&priv->data, desc.type);
86 return err;
87 }
88
89 priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
90 err = nft_validate_register_load(priv->sreg, desc.len);
91 if (err < 0)
92 return err;
93
94 priv->op = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
95 priv->len = desc.len;
96 return 0;
97 }
98
99 static int nft_cmp_dump(struct sk_buff *skb, const struct nft_expr *expr)
100 {
101 const struct nft_cmp_expr *priv = nft_expr_priv(expr);
102
103 if (nft_dump_register(skb, NFTA_CMP_SREG, priv->sreg))
104 goto nla_put_failure;
105 if (nla_put_be32(skb, NFTA_CMP_OP, htonl(priv->op)))
106 goto nla_put_failure;
107
108 if (nft_data_dump(skb, NFTA_CMP_DATA, &priv->data,
109 NFT_DATA_VALUE, priv->len) < 0)
110 goto nla_put_failure;
111 return 0;
112
113 nla_put_failure:
114 return -1;
115 }
116
117 static int __nft_cmp_offload(struct nft_offload_ctx *ctx,
118 struct nft_flow_rule *flow,
119 const struct nft_cmp_expr *priv)
120 {
121 struct nft_offload_reg *reg = &ctx->regs[priv->sreg];
122 u8 *mask = (u8 *)&flow->match.mask;
123 u8 *key = (u8 *)&flow->match.key;
124
125 if (priv->op != NFT_CMP_EQ || reg->len != priv->len)
126 return -EOPNOTSUPP;
127
128 memcpy(key + reg->offset, &priv->data, priv->len);
129 memcpy(mask + reg->offset, ®->mask, priv->len);
130
131 flow->match.dissector.used_keys |= BIT(reg->key);
132 flow->match.dissector.offset[reg->key] = reg->base_offset;
133
134 nft_offload_update_dependency(ctx, &priv->data, priv->len);
135
136 return 0;
137 }
138
139 static int nft_cmp_offload(struct nft_offload_ctx *ctx,
140 struct nft_flow_rule *flow,
141 const struct nft_expr *expr)
142 {
143 const struct nft_cmp_expr *priv = nft_expr_priv(expr);
144
145 return __nft_cmp_offload(ctx, flow, priv);
146 }
147
148 static const struct nft_expr_ops nft_cmp_ops = {
149 .type = &nft_cmp_type,
150 .size = NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr)),
151 .eval = nft_cmp_eval,
152 .init = nft_cmp_init,
153 .dump = nft_cmp_dump,
154 .offload = nft_cmp_offload,
155 };
156
157 static int nft_cmp_fast_init(const struct nft_ctx *ctx,
158 const struct nft_expr *expr,
159 const struct nlattr * const tb[])
160 {
161 struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
162 struct nft_data_desc desc;
163 struct nft_data data;
164 u32 mask;
165 int err;
166
167 err = nft_data_init(NULL, &data, sizeof(data), &desc,
168 tb[NFTA_CMP_DATA]);
169 if (err < 0)
170 return err;
171
172 priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
173 err = nft_validate_register_load(priv->sreg, desc.len);
174 if (err < 0)
175 return err;
176
177 desc.len *= BITS_PER_BYTE;
178 mask = nft_cmp_fast_mask(desc.len);
179
180 priv->data = data.data[0] & mask;
181 priv->len = desc.len;
182 return 0;
183 }
184
185 static int nft_cmp_fast_offload(struct nft_offload_ctx *ctx,
186 struct nft_flow_rule *flow,
187 const struct nft_expr *expr)
188 {
189 const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
190 struct nft_cmp_expr cmp = {
191 .data = {
192 .data = {
193 [0] = priv->data,
194 },
195 },
196 .sreg = priv->sreg,
197 .len = priv->len / BITS_PER_BYTE,
198 .op = NFT_CMP_EQ,
199 };
200
201 return __nft_cmp_offload(ctx, flow, &cmp);
202 }
203
204 static int nft_cmp_fast_dump(struct sk_buff *skb, const struct nft_expr *expr)
205 {
206 const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
207 struct nft_data data;
208
209 if (nft_dump_register(skb, NFTA_CMP_SREG, priv->sreg))
210 goto nla_put_failure;
211 if (nla_put_be32(skb, NFTA_CMP_OP, htonl(NFT_CMP_EQ)))
212 goto nla_put_failure;
213
214 data.data[0] = priv->data;
215 if (nft_data_dump(skb, NFTA_CMP_DATA, &data,
216 NFT_DATA_VALUE, priv->len / BITS_PER_BYTE) < 0)
217 goto nla_put_failure;
218 return 0;
219
220 nla_put_failure:
221 return -1;
222 }
223
224 const struct nft_expr_ops nft_cmp_fast_ops = {
225 .type = &nft_cmp_type,
226 .size = NFT_EXPR_SIZE(sizeof(struct nft_cmp_fast_expr)),
227 .eval = NULL,
228 .init = nft_cmp_fast_init,
229 .dump = nft_cmp_fast_dump,
230 .offload = nft_cmp_fast_offload,
231 };
232
233 static const struct nft_expr_ops *
234 nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
235 {
236 struct nft_data_desc desc;
237 struct nft_data data;
238 enum nft_cmp_ops op;
239 int err;
240
241 if (tb[NFTA_CMP_SREG] == NULL ||
242 tb[NFTA_CMP_OP] == NULL ||
243 tb[NFTA_CMP_DATA] == NULL)
244 return ERR_PTR(-EINVAL);
245
246 op = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
247 switch (op) {
248 case NFT_CMP_EQ:
249 case NFT_CMP_NEQ:
250 case NFT_CMP_LT:
251 case NFT_CMP_LTE:
252 case NFT_CMP_GT:
253 case NFT_CMP_GTE:
254 break;
255 default:
256 return ERR_PTR(-EINVAL);
257 }
258
259 err = nft_data_init(NULL, &data, sizeof(data), &desc,
260 tb[NFTA_CMP_DATA]);
261 if (err < 0)
262 return ERR_PTR(err);
263
264 if (desc.type != NFT_DATA_VALUE) {
265 err = -EINVAL;
266 goto err1;
267 }
268
269 if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)
270 return &nft_cmp_fast_ops;
271
272 return &nft_cmp_ops;
273 err1:
274 nft_data_release(&data, desc.type);
275 return ERR_PTR(-EINVAL);
276 }
277
278 struct nft_expr_type nft_cmp_type __read_mostly = {
279 .name = "cmp",
280 .select_ops = nft_cmp_select_ops,
281 .policy = nft_cmp_policy,
282 .maxattr = NFTA_CMP_MAX,
283 .owner = THIS_MODULE,
284 };