nft_immediate.c 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
  4. *
  5. * Development of this code funded by Astaro AG (http://www.astaro.com/)
  6. */
  7. #include <linux/kernel.h>
  8. #include <linux/init.h>
  9. #include <linux/module.h>
  10. #include <linux/netlink.h>
  11. #include <linux/netfilter.h>
  12. #include <linux/netfilter/nf_tables.h>
  13. #include <net/netfilter/nf_tables_core.h>
  14. #include <net/netfilter/nf_tables.h>
  15. #include <net/netfilter/nf_tables_offload.h>
  16. void nft_immediate_eval(const struct nft_expr *expr,
  17. struct nft_regs *regs,
  18. const struct nft_pktinfo *pkt)
  19. {
  20. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  21. nft_data_copy(&regs->data[priv->dreg], &priv->data, priv->dlen);
  22. }
  23. static const struct nla_policy nft_immediate_policy[NFTA_IMMEDIATE_MAX + 1] = {
  24. [NFTA_IMMEDIATE_DREG] = { .type = NLA_U32 },
  25. [NFTA_IMMEDIATE_DATA] = { .type = NLA_NESTED },
  26. };
  27. static int nft_immediate_init(const struct nft_ctx *ctx,
  28. const struct nft_expr *expr,
  29. const struct nlattr * const tb[])
  30. {
  31. struct nft_immediate_expr *priv = nft_expr_priv(expr);
  32. struct nft_data_desc desc;
  33. int err;
  34. if (tb[NFTA_IMMEDIATE_DREG] == NULL ||
  35. tb[NFTA_IMMEDIATE_DATA] == NULL)
  36. return -EINVAL;
  37. err = nft_data_init(ctx, &priv->data, sizeof(priv->data), &desc,
  38. tb[NFTA_IMMEDIATE_DATA]);
  39. if (err < 0)
  40. return err;
  41. priv->dlen = desc.len;
  42. priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);
  43. err = nft_validate_register_store(ctx, priv->dreg, &priv->data,
  44. desc.type, desc.len);
  45. if (err < 0)
  46. goto err1;
  47. if (priv->dreg == NFT_REG_VERDICT) {
  48. struct nft_chain *chain = priv->data.verdict.chain;
  49. switch (priv->data.verdict.code) {
  50. case NFT_JUMP:
  51. case NFT_GOTO:
  52. if (nft_chain_is_bound(chain)) {
  53. err = -EBUSY;
  54. goto err1;
  55. }
  56. chain->bound = true;
  57. break;
  58. default:
  59. break;
  60. }
  61. }
  62. return 0;
  63. err1:
  64. nft_data_release(&priv->data, desc.type);
  65. return err;
  66. }
  67. static void nft_immediate_activate(const struct nft_ctx *ctx,
  68. const struct nft_expr *expr)
  69. {
  70. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  71. return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
  72. }
  73. static void nft_immediate_deactivate(const struct nft_ctx *ctx,
  74. const struct nft_expr *expr,
  75. enum nft_trans_phase phase)
  76. {
  77. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  78. if (phase == NFT_TRANS_COMMIT)
  79. return;
  80. return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
  81. }
  82. static void nft_immediate_destroy(const struct nft_ctx *ctx,
  83. const struct nft_expr *expr)
  84. {
  85. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  86. const struct nft_data *data = &priv->data;
  87. struct nft_rule *rule, *n;
  88. struct nft_ctx chain_ctx;
  89. struct nft_chain *chain;
  90. if (priv->dreg != NFT_REG_VERDICT)
  91. return;
  92. switch (data->verdict.code) {
  93. case NFT_JUMP:
  94. case NFT_GOTO:
  95. chain = data->verdict.chain;
  96. if (!nft_chain_is_bound(chain))
  97. break;
  98. chain_ctx = *ctx;
  99. chain_ctx.chain = chain;
  100. list_for_each_entry_safe(rule, n, &chain->rules, list)
  101. nf_tables_rule_release(&chain_ctx, rule);
  102. nf_tables_chain_destroy(&chain_ctx);
  103. break;
  104. default:
  105. break;
  106. }
  107. }
  108. static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
  109. {
  110. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  111. if (nft_dump_register(skb, NFTA_IMMEDIATE_DREG, priv->dreg))
  112. goto nla_put_failure;
  113. return nft_data_dump(skb, NFTA_IMMEDIATE_DATA, &priv->data,
  114. nft_dreg_to_type(priv->dreg), priv->dlen);
  115. nla_put_failure:
  116. return -1;
  117. }
  118. static int nft_immediate_validate(const struct nft_ctx *ctx,
  119. const struct nft_expr *expr,
  120. const struct nft_data **d)
  121. {
  122. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  123. struct nft_ctx *pctx = (struct nft_ctx *)ctx;
  124. const struct nft_data *data;
  125. int err;
  126. if (priv->dreg != NFT_REG_VERDICT)
  127. return 0;
  128. data = &priv->data;
  129. switch (data->verdict.code) {
  130. case NFT_JUMP:
  131. case NFT_GOTO:
  132. pctx->level++;
  133. err = nft_chain_validate(ctx, data->verdict.chain);
  134. if (err < 0)
  135. return err;
  136. pctx->level--;
  137. break;
  138. default:
  139. break;
  140. }
  141. return 0;
  142. }
  143. static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
  144. struct nft_flow_rule *flow,
  145. const struct nft_immediate_expr *priv)
  146. {
  147. struct flow_action_entry *entry;
  148. const struct nft_data *data;
  149. entry = &flow->rule->action.entries[ctx->num_actions++];
  150. data = &priv->data;
  151. switch (data->verdict.code) {
  152. case NF_ACCEPT:
  153. entry->id = FLOW_ACTION_ACCEPT;
  154. break;
  155. case NF_DROP:
  156. entry->id = FLOW_ACTION_DROP;
  157. break;
  158. default:
  159. return -EOPNOTSUPP;
  160. }
  161. return 0;
  162. }
  163. static int nft_immediate_offload(struct nft_offload_ctx *ctx,
  164. struct nft_flow_rule *flow,
  165. const struct nft_expr *expr)
  166. {
  167. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  168. if (priv->dreg == NFT_REG_VERDICT)
  169. return nft_immediate_offload_verdict(ctx, flow, priv);
  170. memcpy(&ctx->regs[priv->dreg].data, &priv->data, sizeof(priv->data));
  171. return 0;
  172. }
  173. static bool nft_immediate_offload_action(const struct nft_expr *expr)
  174. {
  175. const struct nft_immediate_expr *priv = nft_expr_priv(expr);
  176. if (priv->dreg == NFT_REG_VERDICT)
  177. return true;
  178. return false;
  179. }
  180. static const struct nft_expr_ops nft_imm_ops = {
  181. .type = &nft_imm_type,
  182. .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),
  183. .eval = nft_immediate_eval,
  184. .init = nft_immediate_init,
  185. .activate = nft_immediate_activate,
  186. .deactivate = nft_immediate_deactivate,
  187. .destroy = nft_immediate_destroy,
  188. .dump = nft_immediate_dump,
  189. .validate = nft_immediate_validate,
  190. .offload = nft_immediate_offload,
  191. .offload_action = nft_immediate_offload_action,
  192. };
  193. struct nft_expr_type nft_imm_type __read_mostly = {
  194. .name = "immediate",
  195. .ops = &nft_imm_ops,
  196. .policy = nft_immediate_policy,
  197. .maxattr = NFTA_IMMEDIATE_MAX,
  198. .owner = THIS_MODULE,
  199. };