[mirror_ubuntu-bionic-kernel.git] / net / netfilter / nft_lookup.c

/*
 * Copyright (c) 2009 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/list.h>
#include <linux/rbtree.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h>

struct nft_lookup {
	struct nft_set			*set;
	enum nft_registers		sreg:8;
	enum nft_registers		dreg:8;
	bool				invert;
	struct nft_set_binding		binding;
};

static void nft_lookup_eval(const struct nft_expr *expr,
			    struct nft_regs *regs,
			    const struct nft_pktinfo *pkt)
{
	const struct nft_lookup *priv = nft_expr_priv(expr);
	const struct nft_set *set = priv->set;
	const struct nft_set_ext *ext;
	bool found;

	found = set->ops->lookup(nft_net(pkt), set, &regs->data[priv->sreg],
				 &ext) ^ priv->invert;
	if (!found) {
		regs->verdict.code = NFT_BREAK;
		return;
	}

	if (set->flags & NFT_SET_MAP)
		nft_data_copy(&regs->data[priv->dreg],
			      nft_set_ext_data(ext), set->dlen);

}

static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
	[NFTA_LOOKUP_SET]	= { .type = NLA_STRING,
				    .len = NFT_SET_MAXNAMELEN - 1 },
	[NFTA_LOOKUP_SET_ID]	= { .type = NLA_U32 },
	[NFTA_LOOKUP_SREG]	= { .type = NLA_U32 },
	[NFTA_LOOKUP_DREG]	= { .type = NLA_U32 },
	[NFTA_LOOKUP_FLAGS]	= { .type = NLA_U32 },
};

static int nft_lookup_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_lookup *priv = nft_expr_priv(expr);
	u8 genmask = nft_genmask_next(ctx->net);
	struct nft_set *set;
	u32 flags;
	int err;

	if (tb[NFTA_LOOKUP_SET] == NULL ||
	    tb[NFTA_LOOKUP_SREG] == NULL)
		return -EINVAL;

	set = nft_set_lookup(ctx->net, ctx->table, tb[NFTA_LOOKUP_SET],
			     tb[NFTA_LOOKUP_SET_ID], genmask);
	if (IS_ERR(set))
		return PTR_ERR(set);

	priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
	err = nft_validate_register_load(priv->sreg, set->klen);
	if (err < 0)
		return err;

	if (tb[NFTA_LOOKUP_FLAGS]) {
		flags = ntohl(nla_get_be32(tb[NFTA_LOOKUP_FLAGS]));

		if (flags & ~NFT_LOOKUP_F_INV)
			return -EINVAL;

		if (flags & NFT_LOOKUP_F_INV) {
			if (set->flags & NFT_SET_MAP)
				return -EINVAL;
			priv->invert = true;
		}
	}

	if (tb[NFTA_LOOKUP_DREG] != NULL) {
		if (priv->invert)
			return -EINVAL;
		if (!(set->flags & NFT_SET_MAP))
			return -EINVAL;

		priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]);
		err = nft_validate_register_store(ctx, priv->dreg, NULL,
						  set->dtype, set->dlen);
		if (err < 0)
			return err;
	} else if (set->flags & NFT_SET_MAP)
		return -EINVAL;

	priv->binding.flags = set->flags & NFT_SET_MAP;

	err = nf_tables_bind_set(ctx, set, &priv->binding);
	if (err < 0)
		return err;

	priv->set = set;
	return 0;
}

static void nft_lookup_destroy(const struct nft_ctx *ctx,
			       const struct nft_expr *expr)
{
	struct nft_lookup *priv = nft_expr_priv(expr);

	nf_tables_unbind_set(ctx, priv->set, &priv->binding);
}

static int nft_lookup_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_lookup *priv = nft_expr_priv(expr);
	u32 flags = priv->invert ? NFT_LOOKUP_F_INV : 0;

	if (nla_put_string(skb, NFTA_LOOKUP_SET, priv->set->name))
		goto nla_put_failure;
	if (nft_dump_register(skb, NFTA_LOOKUP_SREG, priv->sreg))
		goto nla_put_failure;
	if (priv->set->flags & NFT_SET_MAP)
		if (nft_dump_register(skb, NFTA_LOOKUP_DREG, priv->dreg))
			goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_LOOKUP_FLAGS, htonl(flags)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static const struct nft_expr_ops nft_lookup_ops = {
	.type		= &nft_lookup_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
	.eval		= nft_lookup_eval,
	.init		= nft_lookup_init,
	.destroy	= nft_lookup_destroy,
	.dump		= nft_lookup_dump,
};

struct nft_expr_type nft_lookup_type __read_mostly = {
	.name		= "lookup",
	.ops		= &nft_lookup_ops,
	.policy		= nft_lookup_policy,
	.maxattr	= NFTA_LOOKUP_MAX,
	.owner		= THIS_MODULE,
};
Commit	Line	Data
20a69341 PM	1	/*
	2	* Copyright (c) 2009 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/init.h>
	13	#include <linux/list.h>
	14	#include <linux/rbtree.h>
	15	#include <linux/netlink.h>
	16	#include <linux/netfilter.h>
	17	#include <linux/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_tables.h>
bd76ed36	19	#include <net/netfilter/nf_tables_core.h>
20a69341 PM	20
	21	struct nft_lookup {
	22	struct nft_set *set;
	23	enum nft_registers sreg:8;
	24	enum nft_registers dreg:8;
0071e184	25	bool invert;
20a69341 PM	26	struct nft_set_binding binding;
	27	};
	28
	29	static void nft_lookup_eval(const struct nft_expr *expr,
a55e22e9	30	struct nft_regs *regs,
20a69341 PM	31	const struct nft_pktinfo *pkt)
	32	{
	33	const struct nft_lookup *priv = nft_expr_priv(expr);
	34	const struct nft_set *set = priv->set;
b2832dd6	35	const struct nft_set_ext *ext;
0071e184	36	bool found;
20a69341	37
0e5a1c7e PNA	38	found = set->ops->lookup(nft_net(pkt), set, &regs->data[priv->sreg],
0e5a1c7e PNA	39	&ext) ^ priv->invert;
0071e184 AB	40	if (!found) {
0071e184 AB	41	regs->verdict.code = NFT_BREAK;
20a69341	42	return;
b2832dd6	43	}
0071e184	44
4004d5c3	45	if (set->flags & NFT_SET_MAP)
0071e184 AB	46	nft_data_copy(&regs->data[priv->dreg],
	47	nft_set_ext_data(ext), set->dlen);
	48
20a69341 PM	49	}
	50
	51	static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
b2fbd044 LZ	52	[NFTA_LOOKUP_SET] = { .type = NLA_STRING,
b2fbd044 LZ	53	.len = NFT_SET_MAXNAMELEN - 1 },
4c1017aa	54	[NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 },
20a69341 PM	55	[NFTA_LOOKUP_SREG] = { .type = NLA_U32 },
20a69341 PM	56	[NFTA_LOOKUP_DREG] = { .type = NLA_U32 },
0071e184	57	[NFTA_LOOKUP_FLAGS] = { .type = NLA_U32 },
20a69341 PM	58	};
	59
	60	static int nft_lookup_init(const struct nft_ctx *ctx,
	61	const struct nft_expr *expr,
	62	const struct nlattr * const tb[])
	63	{
	64	struct nft_lookup *priv = nft_expr_priv(expr);
37a9cc52	65	u8 genmask = nft_genmask_next(ctx->net);
20a69341	66	struct nft_set *set;
0071e184	67	u32 flags;
20a69341 PM	68	int err;
	69
	70	if (tb[NFTA_LOOKUP_SET] == NULL \|\|
	71	tb[NFTA_LOOKUP_SREG] == NULL)
	72	return -EINVAL;
	73
c7a72e3f PNA	74	set = nft_set_lookup(ctx->net, ctx->table, tb[NFTA_LOOKUP_SET],
	75	tb[NFTA_LOOKUP_SET_ID], genmask);
	76	if (IS_ERR(set))
	77	return PTR_ERR(set);
20a69341	78
b1c96ed3	79	priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
d07db988	80	err = nft_validate_register_load(priv->sreg, set->klen);
20a69341 PM	81	if (err < 0)
	82	return err;
	83
0071e184 AB	84	if (tb[NFTA_LOOKUP_FLAGS]) {
	85	flags = ntohl(nla_get_be32(tb[NFTA_LOOKUP_FLAGS]));
	86
	87	if (flags & ~NFT_LOOKUP_F_INV)
	88	return -EINVAL;
	89
	90	if (flags & NFT_LOOKUP_F_INV) {
	91	if (set->flags & NFT_SET_MAP)
	92	return -EINVAL;
	93	priv->invert = true;
	94	}
	95	}
	96
20a69341	97	if (tb[NFTA_LOOKUP_DREG] != NULL) {
0071e184 AB	98	if (priv->invert)
0071e184 AB	99	return -EINVAL;
20a69341 PM	100	if (!(set->flags & NFT_SET_MAP))
	101	return -EINVAL;
	102
b1c96ed3	103	priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]);
58f40ab6 PM	104	err = nft_validate_register_store(ctx, priv->dreg, NULL,
	105	set->dtype, set->dlen);
	106	if (err < 0)
	107	return err;
20a69341 PM	108	} else if (set->flags & NFT_SET_MAP)
	109	return -EINVAL;
	110
11113e19 PM	111	priv->binding.flags = set->flags & NFT_SET_MAP;
11113e19 PM	112
20a69341 PM	113	err = nf_tables_bind_set(ctx, set, &priv->binding);
	114	if (err < 0)
	115	return err;
	116
	117	priv->set = set;
	118	return 0;
	119	}
	120
62472bce PM	121	static void nft_lookup_destroy(const struct nft_ctx *ctx,
62472bce PM	122	const struct nft_expr *expr)
20a69341 PM	123	{
	124	struct nft_lookup *priv = nft_expr_priv(expr);
	125
ab9da5c1	126	nf_tables_unbind_set(ctx, priv->set, &priv->binding);
20a69341 PM	127	}
	128
	129	static int nft_lookup_dump(struct sk_buff skb, const struct nft_expr expr)
	130	{
	131	const struct nft_lookup *priv = nft_expr_priv(expr);
0071e184	132	u32 flags = priv->invert ? NFT_LOOKUP_F_INV : 0;
20a69341 PM	133
	134	if (nla_put_string(skb, NFTA_LOOKUP_SET, priv->set->name))
	135	goto nla_put_failure;
b1c96ed3	136	if (nft_dump_register(skb, NFTA_LOOKUP_SREG, priv->sreg))
20a69341 PM	137	goto nla_put_failure;
20a69341 PM	138	if (priv->set->flags & NFT_SET_MAP)
b1c96ed3	139	if (nft_dump_register(skb, NFTA_LOOKUP_DREG, priv->dreg))
20a69341	140	goto nla_put_failure;
0071e184 AB	141	if (nla_put_be32(skb, NFTA_LOOKUP_FLAGS, htonl(flags)))
0071e184 AB	142	goto nla_put_failure;
20a69341 PM	143	return 0;
	144
	145	nla_put_failure:
	146	return -1;
	147	}
	148
ef1f7df9 PM	149	static const struct nft_expr_ops nft_lookup_ops = {
ef1f7df9 PM	150	.type = &nft_lookup_type,
20a69341	151	.size = NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
20a69341 PM	152	.eval = nft_lookup_eval,
	153	.init = nft_lookup_init,
	154	.destroy = nft_lookup_destroy,
	155	.dump = nft_lookup_dump,
ef1f7df9 PM	156	};
ef1f7df9 PM	157
4e24877e	158	struct nft_expr_type nft_lookup_type __read_mostly = {
ef1f7df9 PM	159	.name = "lookup",
ef1f7df9 PM	160	.ops = &nft_lookup_ops,
20a69341 PM	161	.policy = nft_lookup_policy,
20a69341 PM	162	.maxattr = NFTA_LOOKUP_MAX,
ef1f7df9	163	.owner = THIS_MODULE,
20a69341	164	};