Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
0004  *
0005  * Development of this code funded by Astaro AG (http://www.astaro.com/)
0006  */
0007 
0008 #include <linux/kernel.h>
0009 #include <linux/init.h>
0010 #include <linux/module.h>
0011 #include <linux/netlink.h>
0012 #include <linux/netfilter.h>
0013 #include <linux/netfilter/nf_tables.h>
0014 #include <net/netfilter/nf_tables_core.h>
0015 #include <net/netfilter/nf_tables.h>
0016 #include <net/netfilter/nf_tables_offload.h>
0017 
0018 void nft_immediate_eval(const struct nft_expr *expr,
0019             struct nft_regs *regs,
0020             const struct nft_pktinfo *pkt)
0021 {
0022     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0023 
0024     nft_data_copy(&regs->data[priv->dreg], &priv->data, priv->dlen);
0025 }
0026 
0027 static const struct nla_policy nft_immediate_policy[NFTA_IMMEDIATE_MAX + 1] = {
0028     [NFTA_IMMEDIATE_DREG]   = { .type = NLA_U32 },
0029     [NFTA_IMMEDIATE_DATA]   = { .type = NLA_NESTED },
0030 };
0031 
0032 static enum nft_data_types nft_reg_to_type(const struct nlattr *nla)
0033 {
0034     enum nft_data_types type;
0035     u8 reg;
0036 
0037     reg = ntohl(nla_get_be32(nla));
0038     if (reg == NFT_REG_VERDICT)
0039         type = NFT_DATA_VERDICT;
0040     else
0041         type = NFT_DATA_VALUE;
0042 
0043     return type;
0044 }
0045 
0046 static int nft_immediate_init(const struct nft_ctx *ctx,
0047                   const struct nft_expr *expr,
0048                   const struct nlattr * const tb[])
0049 {
0050     struct nft_immediate_expr *priv = nft_expr_priv(expr);
0051     struct nft_data_desc desc = {
0052         .size   = sizeof(priv->data),
0053     };
0054     int err;
0055 
0056     if (tb[NFTA_IMMEDIATE_DREG] == NULL ||
0057         tb[NFTA_IMMEDIATE_DATA] == NULL)
0058         return -EINVAL;
0059 
0060     desc.type = nft_reg_to_type(tb[NFTA_IMMEDIATE_DREG]);
0061     err = nft_data_init(ctx, &priv->data, &desc, tb[NFTA_IMMEDIATE_DATA]);
0062     if (err < 0)
0063         return err;
0064 
0065     priv->dlen = desc.len;
0066 
0067     err = nft_parse_register_store(ctx, tb[NFTA_IMMEDIATE_DREG],
0068                        &priv->dreg, &priv->data, desc.type,
0069                        desc.len);
0070     if (err < 0)
0071         goto err1;
0072 
0073     if (priv->dreg == NFT_REG_VERDICT) {
0074         struct nft_chain *chain = priv->data.verdict.chain;
0075 
0076         switch (priv->data.verdict.code) {
0077         case NFT_JUMP:
0078         case NFT_GOTO:
0079             if (nft_chain_is_bound(chain)) {
0080                 err = -EBUSY;
0081                 goto err1;
0082             }
0083             chain->bound = true;
0084             break;
0085         default:
0086             break;
0087         }
0088     }
0089 
0090     return 0;
0091 
0092 err1:
0093     nft_data_release(&priv->data, desc.type);
0094     return err;
0095 }
0096 
0097 static void nft_immediate_activate(const struct nft_ctx *ctx,
0098                    const struct nft_expr *expr)
0099 {
0100     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0101 
0102     return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
0103 }
0104 
0105 static void nft_immediate_deactivate(const struct nft_ctx *ctx,
0106                      const struct nft_expr *expr,
0107                      enum nft_trans_phase phase)
0108 {
0109     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0110 
0111     if (phase == NFT_TRANS_COMMIT)
0112         return;
0113 
0114     return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
0115 }
0116 
0117 static void nft_immediate_destroy(const struct nft_ctx *ctx,
0118                   const struct nft_expr *expr)
0119 {
0120     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0121     const struct nft_data *data = &priv->data;
0122     struct nft_rule *rule, *n;
0123     struct nft_ctx chain_ctx;
0124     struct nft_chain *chain;
0125 
0126     if (priv->dreg != NFT_REG_VERDICT)
0127         return;
0128 
0129     switch (data->verdict.code) {
0130     case NFT_JUMP:
0131     case NFT_GOTO:
0132         chain = data->verdict.chain;
0133 
0134         if (!nft_chain_is_bound(chain))
0135             break;
0136 
0137         chain_ctx = *ctx;
0138         chain_ctx.chain = chain;
0139 
0140         list_for_each_entry_safe(rule, n, &chain->rules, list)
0141             nf_tables_rule_release(&chain_ctx, rule);
0142 
0143         nf_tables_chain_destroy(&chain_ctx);
0144         break;
0145     default:
0146         break;
0147     }
0148 }
0149 
0150 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
0151 {
0152     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0153 
0154     if (nft_dump_register(skb, NFTA_IMMEDIATE_DREG, priv->dreg))
0155         goto nla_put_failure;
0156 
0157     return nft_data_dump(skb, NFTA_IMMEDIATE_DATA, &priv->data,
0158                  nft_dreg_to_type(priv->dreg), priv->dlen);
0159 
0160 nla_put_failure:
0161     return -1;
0162 }
0163 
0164 static int nft_immediate_validate(const struct nft_ctx *ctx,
0165                   const struct nft_expr *expr,
0166                   const struct nft_data **d)
0167 {
0168     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0169     struct nft_ctx *pctx = (struct nft_ctx *)ctx;
0170     const struct nft_data *data;
0171     int err;
0172 
0173     if (priv->dreg != NFT_REG_VERDICT)
0174         return 0;
0175 
0176     data = &priv->data;
0177 
0178     switch (data->verdict.code) {
0179     case NFT_JUMP:
0180     case NFT_GOTO:
0181         pctx->level++;
0182         err = nft_chain_validate(ctx, data->verdict.chain);
0183         if (err < 0)
0184             return err;
0185         pctx->level--;
0186         break;
0187     default:
0188         break;
0189     }
0190 
0191     return 0;
0192 }
0193 
0194 static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
0195                      struct nft_flow_rule *flow,
0196                      const struct nft_immediate_expr *priv)
0197 {
0198     struct flow_action_entry *entry;
0199     const struct nft_data *data;
0200 
0201     entry = &flow->rule->action.entries[ctx->num_actions++];
0202 
0203     data = &priv->data;
0204     switch (data->verdict.code) {
0205     case NF_ACCEPT:
0206         entry->id = FLOW_ACTION_ACCEPT;
0207         break;
0208     case NF_DROP:
0209         entry->id = FLOW_ACTION_DROP;
0210         break;
0211     default:
0212         return -EOPNOTSUPP;
0213     }
0214 
0215     return 0;
0216 }
0217 
0218 static int nft_immediate_offload(struct nft_offload_ctx *ctx,
0219                  struct nft_flow_rule *flow,
0220                  const struct nft_expr *expr)
0221 {
0222     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0223 
0224     if (priv->dreg == NFT_REG_VERDICT)
0225         return nft_immediate_offload_verdict(ctx, flow, priv);
0226 
0227     memcpy(&ctx->regs[priv->dreg].data, &priv->data, sizeof(priv->data));
0228 
0229     return 0;
0230 }
0231 
0232 static bool nft_immediate_offload_action(const struct nft_expr *expr)
0233 {
0234     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0235 
0236     if (priv->dreg == NFT_REG_VERDICT)
0237         return true;
0238 
0239     return false;
0240 }
0241 
0242 static bool nft_immediate_reduce(struct nft_regs_track *track,
0243                  const struct nft_expr *expr)
0244 {
0245     const struct nft_immediate_expr *priv = nft_expr_priv(expr);
0246 
0247     if (priv->dreg != NFT_REG_VERDICT)
0248         nft_reg_track_cancel(track, priv->dreg, priv->dlen);
0249 
0250     return false;
0251 }
0252 
0253 static const struct nft_expr_ops nft_imm_ops = {
0254     .type       = &nft_imm_type,
0255     .size       = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),
0256     .eval       = nft_immediate_eval,
0257     .init       = nft_immediate_init,
0258     .activate   = nft_immediate_activate,
0259     .deactivate = nft_immediate_deactivate,
0260     .destroy    = nft_immediate_destroy,
0261     .dump       = nft_immediate_dump,
0262     .validate   = nft_immediate_validate,
0263     .reduce     = nft_immediate_reduce,
0264     .offload    = nft_immediate_offload,
0265     .offload_action = nft_immediate_offload_action,
0266 };
0267 
0268 struct nft_expr_type nft_imm_type __read_mostly = {
0269     .name       = "immediate",
0270     .ops        = &nft_imm_ops,
0271     .policy     = nft_immediate_policy,
0272     .maxattr    = NFTA_IMMEDIATE_MAX,
0273     .owner      = THIS_MODULE,
0274 };
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!