1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 #include <linux/kernel.h>
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/netlink.h>
12 #include <linux/netfilter.h>
13 #include <linux/if_arp.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_tables_offload.h>
17 #include <net/netfilter/nf_tables.h>
21 enum nft_registers sreg
:8;
23 enum nft_cmp_ops op
:8;
26 void nft_cmp_eval(const struct nft_expr
*expr
,
27 struct nft_regs
*regs
,
28 const struct nft_pktinfo
*pkt
)
30 const struct nft_cmp_expr
*priv
= nft_expr_priv(expr
);
33 d
= memcmp(®s
->data
[priv
->sreg
], &priv
->data
, priv
->len
);
63 regs
->verdict
.code
= NFT_BREAK
;
66 static const struct nla_policy nft_cmp_policy
[NFTA_CMP_MAX
+ 1] = {
67 [NFTA_CMP_SREG
] = { .type
= NLA_U32
},
68 [NFTA_CMP_OP
] = { .type
= NLA_U32
},
69 [NFTA_CMP_DATA
] = { .type
= NLA_NESTED
},
72 static int nft_cmp_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
73 const struct nlattr
* const tb
[])
75 struct nft_cmp_expr
*priv
= nft_expr_priv(expr
);
76 struct nft_data_desc desc
;
79 err
= nft_data_init(NULL
, &priv
->data
, sizeof(priv
->data
), &desc
,
84 priv
->sreg
= nft_parse_register(tb
[NFTA_CMP_SREG
]);
85 err
= nft_validate_register_load(priv
->sreg
, desc
.len
);
89 priv
->op
= ntohl(nla_get_be32(tb
[NFTA_CMP_OP
]));
94 static int nft_cmp_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
96 const struct nft_cmp_expr
*priv
= nft_expr_priv(expr
);
98 if (nft_dump_register(skb
, NFTA_CMP_SREG
, priv
->sreg
))
100 if (nla_put_be32(skb
, NFTA_CMP_OP
, htonl(priv
->op
)))
101 goto nla_put_failure
;
103 if (nft_data_dump(skb
, NFTA_CMP_DATA
, &priv
->data
,
104 NFT_DATA_VALUE
, priv
->len
) < 0)
105 goto nla_put_failure
;
112 static int __nft_cmp_offload(struct nft_offload_ctx
*ctx
,
113 struct nft_flow_rule
*flow
,
114 const struct nft_cmp_expr
*priv
)
116 struct nft_offload_reg
*reg
= &ctx
->regs
[priv
->sreg
];
117 u8
*mask
= (u8
*)&flow
->match
.mask
;
118 u8
*key
= (u8
*)&flow
->match
.key
;
120 if (priv
->op
!= NFT_CMP_EQ
|| reg
->len
!= priv
->len
)
123 memcpy(key
+ reg
->offset
, &priv
->data
, priv
->len
);
124 memcpy(mask
+ reg
->offset
, ®
->mask
, priv
->len
);
126 flow
->match
.dissector
.used_keys
|= BIT(reg
->key
);
127 flow
->match
.dissector
.offset
[reg
->key
] = reg
->base_offset
;
129 if (reg
->key
== FLOW_DISSECTOR_KEY_META
&&
130 reg
->offset
== offsetof(struct nft_flow_key
, meta
.ingress_iftype
) &&
131 nft_reg_load16(priv
->data
.data
) != ARPHRD_ETHER
)
134 nft_offload_update_dependency(ctx
, &priv
->data
, priv
->len
);
139 static int nft_cmp_offload(struct nft_offload_ctx
*ctx
,
140 struct nft_flow_rule
*flow
,
141 const struct nft_expr
*expr
)
143 const struct nft_cmp_expr
*priv
= nft_expr_priv(expr
);
145 return __nft_cmp_offload(ctx
, flow
, priv
);
148 static const struct nft_expr_ops nft_cmp_ops
= {
149 .type
= &nft_cmp_type
,
150 .size
= NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr
)),
151 .eval
= nft_cmp_eval
,
152 .init
= nft_cmp_init
,
153 .dump
= nft_cmp_dump
,
154 .offload
= nft_cmp_offload
,
157 static int nft_cmp_fast_init(const struct nft_ctx
*ctx
,
158 const struct nft_expr
*expr
,
159 const struct nlattr
* const tb
[])
161 struct nft_cmp_fast_expr
*priv
= nft_expr_priv(expr
);
162 struct nft_data_desc desc
;
163 struct nft_data data
;
167 err
= nft_data_init(NULL
, &data
, sizeof(data
), &desc
,
172 priv
->sreg
= nft_parse_register(tb
[NFTA_CMP_SREG
]);
173 err
= nft_validate_register_load(priv
->sreg
, desc
.len
);
177 desc
.len
*= BITS_PER_BYTE
;
178 mask
= nft_cmp_fast_mask(desc
.len
);
180 priv
->data
= data
.data
[0] & mask
;
181 priv
->len
= desc
.len
;
185 static int nft_cmp_fast_offload(struct nft_offload_ctx
*ctx
,
186 struct nft_flow_rule
*flow
,
187 const struct nft_expr
*expr
)
189 const struct nft_cmp_fast_expr
*priv
= nft_expr_priv(expr
);
190 struct nft_cmp_expr cmp
= {
197 .len
= priv
->len
/ BITS_PER_BYTE
,
201 return __nft_cmp_offload(ctx
, flow
, &cmp
);
204 static int nft_cmp_fast_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
206 const struct nft_cmp_fast_expr
*priv
= nft_expr_priv(expr
);
207 struct nft_data data
;
209 if (nft_dump_register(skb
, NFTA_CMP_SREG
, priv
->sreg
))
210 goto nla_put_failure
;
211 if (nla_put_be32(skb
, NFTA_CMP_OP
, htonl(NFT_CMP_EQ
)))
212 goto nla_put_failure
;
214 data
.data
[0] = priv
->data
;
215 if (nft_data_dump(skb
, NFTA_CMP_DATA
, &data
,
216 NFT_DATA_VALUE
, priv
->len
/ BITS_PER_BYTE
) < 0)
217 goto nla_put_failure
;
224 const struct nft_expr_ops nft_cmp_fast_ops
= {
225 .type
= &nft_cmp_type
,
226 .size
= NFT_EXPR_SIZE(sizeof(struct nft_cmp_fast_expr
)),
227 .eval
= NULL
, /* inlined */
228 .init
= nft_cmp_fast_init
,
229 .dump
= nft_cmp_fast_dump
,
230 .offload
= nft_cmp_fast_offload
,
233 static const struct nft_expr_ops
*
234 nft_cmp_select_ops(const struct nft_ctx
*ctx
, const struct nlattr
* const tb
[])
236 struct nft_data_desc desc
;
237 struct nft_data data
;
241 if (tb
[NFTA_CMP_SREG
] == NULL
||
242 tb
[NFTA_CMP_OP
] == NULL
||
243 tb
[NFTA_CMP_DATA
] == NULL
)
244 return ERR_PTR(-EINVAL
);
246 op
= ntohl(nla_get_be32(tb
[NFTA_CMP_OP
]));
256 return ERR_PTR(-EINVAL
);
259 err
= nft_data_init(NULL
, &data
, sizeof(data
), &desc
,
264 if (desc
.type
!= NFT_DATA_VALUE
) {
269 if (desc
.len
<= sizeof(u32
) && op
== NFT_CMP_EQ
)
270 return &nft_cmp_fast_ops
;
274 nft_data_release(&data
, desc
.type
);
275 return ERR_PTR(-EINVAL
);
278 struct nft_expr_type nft_cmp_type __read_mostly
= {
280 .select_ops
= nft_cmp_select_ops
,
281 .policy
= nft_cmp_policy
,
282 .maxattr
= NFTA_CMP_MAX
,
283 .owner
= THIS_MODULE
,