nft_range.c 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
  4. */
  5. #include <linux/kernel.h>
  6. #include <linux/init.h>
  7. #include <linux/module.h>
  8. #include <linux/netlink.h>
  9. #include <linux/netfilter.h>
  10. #include <linux/netfilter/nf_tables.h>
  11. #include <net/netfilter/nf_tables_core.h>
  12. #include <net/netfilter/nf_tables.h>
  13. struct nft_range_expr {
  14. struct nft_data data_from;
  15. struct nft_data data_to;
  16. enum nft_registers sreg:8;
  17. u8 len;
  18. enum nft_range_ops op:8;
  19. };
  20. void nft_range_eval(const struct nft_expr *expr,
  21. struct nft_regs *regs, const struct nft_pktinfo *pkt)
  22. {
  23. const struct nft_range_expr *priv = nft_expr_priv(expr);
  24. int d1, d2;
  25. d1 = memcmp(&regs->data[priv->sreg], &priv->data_from, priv->len);
  26. d2 = memcmp(&regs->data[priv->sreg], &priv->data_to, priv->len);
  27. switch (priv->op) {
  28. case NFT_RANGE_EQ:
  29. if (d1 < 0 || d2 > 0)
  30. regs->verdict.code = NFT_BREAK;
  31. break;
  32. case NFT_RANGE_NEQ:
  33. if (d1 >= 0 && d2 <= 0)
  34. regs->verdict.code = NFT_BREAK;
  35. break;
  36. }
  37. }
  38. static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = {
  39. [NFTA_RANGE_SREG] = { .type = NLA_U32 },
  40. [NFTA_RANGE_OP] = { .type = NLA_U32 },
  41. [NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED },
  42. [NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED },
  43. };
  44. static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
  45. const struct nlattr * const tb[])
  46. {
  47. struct nft_range_expr *priv = nft_expr_priv(expr);
  48. struct nft_data_desc desc_from, desc_to;
  49. int err;
  50. u32 op;
  51. if (!tb[NFTA_RANGE_SREG] ||
  52. !tb[NFTA_RANGE_OP] ||
  53. !tb[NFTA_RANGE_FROM_DATA] ||
  54. !tb[NFTA_RANGE_TO_DATA])
  55. return -EINVAL;
  56. err = nft_data_init(NULL, &priv->data_from, sizeof(priv->data_from),
  57. &desc_from, tb[NFTA_RANGE_FROM_DATA]);
  58. if (err < 0)
  59. return err;
  60. if (desc_from.type != NFT_DATA_VALUE) {
  61. err = -EINVAL;
  62. goto err1;
  63. }
  64. err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to),
  65. &desc_to, tb[NFTA_RANGE_TO_DATA]);
  66. if (err < 0)
  67. goto err1;
  68. if (desc_to.type != NFT_DATA_VALUE) {
  69. err = -EINVAL;
  70. goto err2;
  71. }
  72. if (desc_from.len != desc_to.len) {
  73. err = -EINVAL;
  74. goto err2;
  75. }
  76. priv->sreg = nft_parse_register(tb[NFTA_RANGE_SREG]);
  77. err = nft_validate_register_load(priv->sreg, desc_from.len);
  78. if (err < 0)
  79. goto err2;
  80. err = nft_parse_u32_check(tb[NFTA_RANGE_OP], U8_MAX, &op);
  81. if (err < 0)
  82. goto err2;
  83. switch (op) {
  84. case NFT_RANGE_EQ:
  85. case NFT_RANGE_NEQ:
  86. break;
  87. default:
  88. err = -EINVAL;
  89. goto err2;
  90. }
  91. priv->op = op;
  92. priv->len = desc_from.len;
  93. return 0;
  94. err2:
  95. nft_data_release(&priv->data_to, desc_to.type);
  96. err1:
  97. nft_data_release(&priv->data_from, desc_from.type);
  98. return err;
  99. }
  100. static int nft_range_dump(struct sk_buff *skb, const struct nft_expr *expr)
  101. {
  102. const struct nft_range_expr *priv = nft_expr_priv(expr);
  103. if (nft_dump_register(skb, NFTA_RANGE_SREG, priv->sreg))
  104. goto nla_put_failure;
  105. if (nla_put_be32(skb, NFTA_RANGE_OP, htonl(priv->op)))
  106. goto nla_put_failure;
  107. if (nft_data_dump(skb, NFTA_RANGE_FROM_DATA, &priv->data_from,
  108. NFT_DATA_VALUE, priv->len) < 0 ||
  109. nft_data_dump(skb, NFTA_RANGE_TO_DATA, &priv->data_to,
  110. NFT_DATA_VALUE, priv->len) < 0)
  111. goto nla_put_failure;
  112. return 0;
  113. nla_put_failure:
  114. return -1;
  115. }
  116. static const struct nft_expr_ops nft_range_ops = {
  117. .type = &nft_range_type,
  118. .size = NFT_EXPR_SIZE(sizeof(struct nft_range_expr)),
  119. .eval = nft_range_eval,
  120. .init = nft_range_init,
  121. .dump = nft_range_dump,
  122. };
  123. struct nft_expr_type nft_range_type __read_mostly = {
  124. .name = "range",
  125. .ops = &nft_range_ops,
  126. .policy = nft_range_policy,
  127. .maxattr = NFTA_RANGE_MAX,
  128. .owner = THIS_MODULE,
  129. };