[linux-block.git] / net / netfilter / nft_hash.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2016 Laura Garcia <nevola@gmail.com>
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h>
#include <linux/jhash.h>

struct nft_jhash {
	u8			sreg;
	u8			dreg;
	u8			len;
	bool			autogen_seed:1;
	u32			modulus;
	u32			seed;
	u32			offset;
};

static void nft_jhash_eval(const struct nft_expr *expr,
			   struct nft_regs *regs,
			   const struct nft_pktinfo *pkt)
{
	struct nft_jhash *priv = nft_expr_priv(expr);
	const void *data = &regs->data[priv->sreg];
	u32 h;

	h = reciprocal_scale(jhash(data, priv->len, priv->seed),
			     priv->modulus);

	regs->data[priv->dreg] = h + priv->offset;
}

struct nft_symhash {
	u8			dreg;
	u32			modulus;
	u32			offset;
};

static void nft_symhash_eval(const struct nft_expr *expr,
			     struct nft_regs *regs,
			     const struct nft_pktinfo *pkt)
{
	struct nft_symhash *priv = nft_expr_priv(expr);
	struct sk_buff *skb = pkt->skb;
	u32 h;

	h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus);

	regs->data[priv->dreg] = h + priv->offset;
}

static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
	[NFTA_HASH_SREG]	= { .type = NLA_U32 },
	[NFTA_HASH_DREG]	= { .type = NLA_U32 },
	[NFTA_HASH_LEN]		= { .type = NLA_U32 },
	[NFTA_HASH_MODULUS]	= { .type = NLA_U32 },
	[NFTA_HASH_SEED]	= { .type = NLA_U32 },
	[NFTA_HASH_OFFSET]	= { .type = NLA_U32 },
	[NFTA_HASH_TYPE]	= { .type = NLA_U32 },
};

static int nft_jhash_init(const struct nft_ctx *ctx,
			  const struct nft_expr *expr,
			  const struct nlattr * const tb[])
{
	struct nft_jhash *priv = nft_expr_priv(expr);
	u32 len;
	int err;

	if (!tb[NFTA_HASH_SREG] ||
	    !tb[NFTA_HASH_DREG] ||
	    !tb[NFTA_HASH_LEN]  ||
	    !tb[NFTA_HASH_MODULUS])
		return -EINVAL;

	if (tb[NFTA_HASH_OFFSET])
		priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));

	err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
	if (err < 0)
		return err;
	if (len == 0)
		return -ERANGE;

	priv->len = len;

	err = nft_parse_register_load(tb[NFTA_HASH_SREG], &priv->sreg, len);
	if (err < 0)
		return err;

	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
	if (priv->modulus < 1)
		return -ERANGE;

	if (priv->offset + priv->modulus - 1 < priv->offset)
		return -EOVERFLOW;

	if (tb[NFTA_HASH_SEED]) {
		priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED]));
	} else {
		priv->autogen_seed = true;
		get_random_bytes(&priv->seed, sizeof(priv->seed));
	}

	return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG], &priv->dreg,
					NULL, NFT_DATA_VALUE, sizeof(u32));
}

static int nft_symhash_init(const struct nft_ctx *ctx,
			    const struct nft_expr *expr,
			    const struct nlattr * const tb[])
{
	struct nft_symhash *priv = nft_expr_priv(expr);

	if (!tb[NFTA_HASH_DREG]    ||
	    !tb[NFTA_HASH_MODULUS])
		return -EINVAL;

	if (tb[NFTA_HASH_OFFSET])
		priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));

	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
	if (priv->modulus < 1)
		return -ERANGE;

	if (priv->offset + priv->modulus - 1 < priv->offset)
		return -EOVERFLOW;

	return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG],
					&priv->dreg, NULL, NFT_DATA_VALUE,
					sizeof(u32));
}

static int nft_jhash_dump(struct sk_buff *skb,
			  const struct nft_expr *expr, bool reset)
{
	const struct nft_jhash *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_HASH_SREG, priv->sreg))
		goto nla_put_failure;
	if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_HASH_LEN, htonl(priv->len)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
		goto nla_put_failure;
	if (!priv->autogen_seed &&
	    nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed)))
		goto nla_put_failure;
	if (priv->offset != 0)
		if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
			goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_JENKINS)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static bool nft_jhash_reduce(struct nft_regs_track *track,
			     const struct nft_expr *expr)
{
	const struct nft_jhash *priv = nft_expr_priv(expr);

	nft_reg_track_cancel(track, priv->dreg, sizeof(u32));

	return false;
}

static int nft_symhash_dump(struct sk_buff *skb,
			    const struct nft_expr *expr, bool reset)
{
	const struct nft_symhash *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
		goto nla_put_failure;
	if (priv->offset != 0)
		if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
			goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_SYM)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static bool nft_symhash_reduce(struct nft_regs_track *track,
			       const struct nft_expr *expr)
{
	struct nft_symhash *priv = nft_expr_priv(expr);
	struct nft_symhash *symhash;

	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
		nft_reg_track_update(track, expr, priv->dreg, sizeof(u32));
		return false;
	}

	symhash = nft_expr_priv(track->regs[priv->dreg].selector);
	if (priv->offset != symhash->offset ||
	    priv->modulus != symhash->modulus) {
		nft_reg_track_update(track, expr, priv->dreg, sizeof(u32));
		return false;
	}

	if (!track->regs[priv->dreg].bitwise)
		return true;

	return false;
}

static struct nft_expr_type nft_hash_type;
static const struct nft_expr_ops nft_jhash_ops = {
	.type		= &nft_hash_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_jhash)),
	.eval		= nft_jhash_eval,
	.init		= nft_jhash_init,
	.dump		= nft_jhash_dump,
	.reduce		= nft_jhash_reduce,
};

static const struct nft_expr_ops nft_symhash_ops = {
	.type		= &nft_hash_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
	.eval		= nft_symhash_eval,
	.init		= nft_symhash_init,
	.dump		= nft_symhash_dump,
	.reduce		= nft_symhash_reduce,
};

static const struct nft_expr_ops *
nft_hash_select_ops(const struct nft_ctx *ctx,
		    const struct nlattr * const tb[])
{
	u32 type;

	if (!tb[NFTA_HASH_TYPE])
		return &nft_jhash_ops;

	type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE]));
	switch (type) {
	case NFT_HASH_SYM:
		return &nft_symhash_ops;
	case NFT_HASH_JENKINS:
		return &nft_jhash_ops;
	default:
		break;
	}
	return ERR_PTR(-EOPNOTSUPP);
}

static struct nft_expr_type nft_hash_type __read_mostly = {
	.name		= "hash",
	.select_ops	= nft_hash_select_ops,
	.policy		= nft_hash_policy,
	.maxattr	= NFTA_HASH_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_hash_module_init(void)
{
	return nft_register_expr(&nft_hash_type);
}

static void __exit nft_hash_module_exit(void)
{
	nft_unregister_expr(&nft_hash_type);
}

module_init(nft_hash_module_init);
module_exit(nft_hash_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Laura Garcia <nevola@gmail.com>");
MODULE_ALIAS_NFT_EXPR("hash");
MODULE_DESCRIPTION("Netfilter nftables hash module");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
cb1b69b0 LGL	2	/*
cb1b69b0 LGL	3	* Copyright (c) 2016 Laura Garcia <nevola@gmail.com>
cb1b69b0 LGL	4	*/
	5
	6	#include <linux/kernel.h>
	7	#include <linux/init.h>
	8	#include <linux/module.h>
	9	#include <linux/netlink.h>
	10	#include <linux/netfilter.h>
	11	#include <linux/netfilter/nf_tables.h>
	12	#include <net/netfilter/nf_tables.h>
	13	#include <net/netfilter/nf_tables_core.h>
	14	#include <linux/jhash.h>
	15
511040ee	16	struct nft_jhash {
4f16d25c	17	u8 sreg;
345023b0	18	u8 dreg;
cb1b69b0	19	u8 len;
79e09ef9	20	bool autogen_seed:1;
cb1b69b0 LGL	21	u32 modulus;
cb1b69b0 LGL	22	u32 seed;
70ca767e	23	u32 offset;
cb1b69b0 LGL	24	};
cb1b69b0 LGL	25
511040ee LGL	26	static void nft_jhash_eval(const struct nft_expr *expr,
	27	struct nft_regs *regs,
	28	const struct nft_pktinfo *pkt)
cb1b69b0	29	{
511040ee	30	struct nft_jhash *priv = nft_expr_priv(expr);
cb1b69b0	31	const void *data = &regs->data[priv->sreg];
70ca767e	32	u32 h;
cb1b69b0	33
b9ccc07e LGL	34	h = reciprocal_scale(jhash(data, priv->len, priv->seed),
	35	priv->modulus);
	36
70ca767e	37	regs->data[priv->dreg] = h + priv->offset;
cb1b69b0 LGL	38	}
cb1b69b0 LGL	39
3206cade	40	struct nft_symhash {
345023b0	41	u8 dreg;
3206cade LGL	42	u32 modulus;
	43	u32 offset;
	44	};
	45
	46	static void nft_symhash_eval(const struct nft_expr *expr,
	47	struct nft_regs *regs,
	48	const struct nft_pktinfo *pkt)
	49	{
	50	struct nft_symhash *priv = nft_expr_priv(expr);
	51	struct sk_buff *skb = pkt->skb;
	52	u32 h;
	53
	54	h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus);
	55
	56	regs->data[priv->dreg] = h + priv->offset;
	57	}
	58
a5e57336	59	static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
cb1b69b0 LGL	60	[NFTA_HASH_SREG] = { .type = NLA_U32 },
	61	[NFTA_HASH_DREG] = { .type = NLA_U32 },
	62	[NFTA_HASH_LEN] = { .type = NLA_U32 },
	63	[NFTA_HASH_MODULUS] = { .type = NLA_U32 },
	64	[NFTA_HASH_SEED] = { .type = NLA_U32 },
5751e175	65	[NFTA_HASH_OFFSET] = { .type = NLA_U32 },
3206cade	66	[NFTA_HASH_TYPE] = { .type = NLA_U32 },
cb1b69b0 LGL	67	};
cb1b69b0 LGL	68
511040ee LGL	69	static int nft_jhash_init(const struct nft_ctx *ctx,
	70	const struct nft_expr *expr,
	71	const struct nlattr * const tb[])
cb1b69b0	72	{
511040ee	73	struct nft_jhash *priv = nft_expr_priv(expr);
cb1b69b0	74	u32 len;
abd66e9f	75	int err;
cb1b69b0 LGL	76
	77	if (!tb[NFTA_HASH_SREG] \|\|
	78	!tb[NFTA_HASH_DREG] \|\|
	79	!tb[NFTA_HASH_LEN] \|\|
cb1b69b0 LGL	80	!tb[NFTA_HASH_MODULUS])
	81	return -EINVAL;
	82
70ca767e LGL	83	if (tb[NFTA_HASH_OFFSET])
	84	priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
	85
abd66e9f LGL	86	err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
	87	if (err < 0)
	88	return err;
	89	if (len == 0)
cb1b69b0 LGL	90	return -ERANGE;
	91
	92	priv->len = len;
	93
4f16d25c PNA	94	err = nft_parse_register_load(tb[NFTA_HASH_SREG], &priv->sreg, len);
	95	if (err < 0)
	96	return err;
	97
cb1b69b0	98	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
75e72f05	99	if (priv->modulus < 1)
cb1b69b0 LGL	100	return -ERANGE;
cb1b69b0 LGL	101
14e2dee0	102	if (priv->offset + priv->modulus - 1 < priv->offset)
70ca767e LGL	103	return -EOVERFLOW;
70ca767e LGL	104
79e09ef9	105	if (tb[NFTA_HASH_SEED]) {
f86dab3a	106	priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED]));
79e09ef9 LZ	107	} else {
79e09ef9 LZ	108	priv->autogen_seed = true;
f86dab3a	109	get_random_bytes(&priv->seed, sizeof(priv->seed));
79e09ef9	110	}
cb1b69b0	111
345023b0 PNA	112	return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG], &priv->dreg,
345023b0 PNA	113	NULL, NFT_DATA_VALUE, sizeof(u32));
cb1b69b0 LGL	114	}
cb1b69b0 LGL	115
3206cade LGL	116	static int nft_symhash_init(const struct nft_ctx *ctx,
	117	const struct nft_expr *expr,
	118	const struct nlattr * const tb[])
	119	{
	120	struct nft_symhash *priv = nft_expr_priv(expr);
	121
	122	if (!tb[NFTA_HASH_DREG] \|\|
	123	!tb[NFTA_HASH_MODULUS])
	124	return -EINVAL;
	125
	126	if (tb[NFTA_HASH_OFFSET])
	127	priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
	128
3206cade	129	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
28b1d6ef	130	if (priv->modulus < 1)
3206cade LGL	131	return -ERANGE;
	132
	133	if (priv->offset + priv->modulus - 1 < priv->offset)
	134	return -EOVERFLOW;
	135
345023b0 PNA	136	return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG],
	137	&priv->dreg, NULL, NFT_DATA_VALUE,
	138	sizeof(u32));
3206cade LGL	139	}
3206cade LGL	140
511040ee	141	static int nft_jhash_dump(struct sk_buff *skb,
7d34aa3e	142	const struct nft_expr *expr, bool reset)
cb1b69b0	143	{
511040ee	144	const struct nft_jhash *priv = nft_expr_priv(expr);
cb1b69b0 LGL	145
	146	if (nft_dump_register(skb, NFTA_HASH_SREG, priv->sreg))
	147	goto nla_put_failure;
	148	if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg))
	149	goto nla_put_failure;
7073b16f	150	if (nla_put_be32(skb, NFTA_HASH_LEN, htonl(priv->len)))
cb1b69b0	151	goto nla_put_failure;
7073b16f	152	if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
cb1b69b0	153	goto nla_put_failure;
79e09ef9 LZ	154	if (!priv->autogen_seed &&
79e09ef9 LZ	155	nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed)))
cb1b69b0	156	goto nla_put_failure;
70ca767e LGL	157	if (priv->offset != 0)
	158	if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
	159	goto nla_put_failure;
3206cade LGL	160	if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_JENKINS)))
	161	goto nla_put_failure;
	162	return 0;
	163
	164	nla_put_failure:
	165	return -1;
	166	}
	167
5da03b56 PNA	168	static bool nft_jhash_reduce(struct nft_regs_track *track,
	169	const struct nft_expr *expr)
	170	{
	171	const struct nft_jhash *priv = nft_expr_priv(expr);
	172
	173	nft_reg_track_cancel(track, priv->dreg, sizeof(u32));
	174
	175	return false;
	176	}
	177
3206cade	178	static int nft_symhash_dump(struct sk_buff *skb,
7d34aa3e	179	const struct nft_expr *expr, bool reset)
3206cade LGL	180	{
	181	const struct nft_symhash *priv = nft_expr_priv(expr);
	182
	183	if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg))
	184	goto nla_put_failure;
	185	if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
	186	goto nla_put_failure;
	187	if (priv->offset != 0)
	188	if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
	189	goto nla_put_failure;
	190	if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_SYM)))
	191	goto nla_put_failure;
cb1b69b0 LGL	192	return 0;
	193
	194	nla_put_failure:
	195	return -1;
	196	}
	197
5da03b56 PNA	198	static bool nft_symhash_reduce(struct nft_regs_track *track,
	199	const struct nft_expr *expr)
	200	{
	201	struct nft_symhash *priv = nft_expr_priv(expr);
	202	struct nft_symhash *symhash;
	203
	204	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
	205	nft_reg_track_update(track, expr, priv->dreg, sizeof(u32));
	206	return false;
	207	}
	208
	209	symhash = nft_expr_priv(track->regs[priv->dreg].selector);
	210	if (priv->offset != symhash->offset \|\|
	211	priv->modulus != symhash->modulus) {
	212	nft_reg_track_update(track, expr, priv->dreg, sizeof(u32));
	213	return false;
	214	}
	215
	216	if (!track->regs[priv->dreg].bitwise)
	217	return true;
	218
	219	return false;
	220	}
	221
cb1b69b0	222	static struct nft_expr_type nft_hash_type;
511040ee	223	static const struct nft_expr_ops nft_jhash_ops = {
cb1b69b0	224	.type = &nft_hash_type,
511040ee LGL	225	.size = NFT_EXPR_SIZE(sizeof(struct nft_jhash)),
	226	.eval = nft_jhash_eval,
	227	.init = nft_jhash_init,
	228	.dump = nft_jhash_dump,
5da03b56	229	.reduce = nft_jhash_reduce,
cb1b69b0 LGL	230	};
cb1b69b0 LGL	231
3206cade LGL	232	static const struct nft_expr_ops nft_symhash_ops = {
	233	.type = &nft_hash_type,
	234	.size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
	235	.eval = nft_symhash_eval,
	236	.init = nft_symhash_init,
	237	.dump = nft_symhash_dump,
5da03b56	238	.reduce = nft_symhash_reduce,
3206cade LGL	239	};
	240
	241	static const struct nft_expr_ops *
	242	nft_hash_select_ops(const struct nft_ctx *ctx,
	243	const struct nlattr * const tb[])
	244	{
	245	u32 type;
	246
	247	if (!tb[NFTA_HASH_TYPE])
	248	return &nft_jhash_ops;
	249
	250	type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE]));
	251	switch (type) {
	252	case NFT_HASH_SYM:
	253	return &nft_symhash_ops;
	254	case NFT_HASH_JENKINS:
	255	return &nft_jhash_ops;
	256	default:
	257	break;
	258	}
	259	return ERR_PTR(-EOPNOTSUPP);
	260	}
	261
cb1b69b0 LGL	262	static struct nft_expr_type nft_hash_type __read_mostly = {
cb1b69b0 LGL	263	.name = "hash",
d4ef3835	264	.select_ops = nft_hash_select_ops,
cb1b69b0 LGL	265	.policy = nft_hash_policy,
	266	.maxattr = NFTA_HASH_MAX,
	267	.owner = THIS_MODULE,
	268	};
	269
	270	static int __init nft_hash_module_init(void)
	271	{
	272	return nft_register_expr(&nft_hash_type);
	273	}
	274
	275	static void __exit nft_hash_module_exit(void)
	276	{
	277	nft_unregister_expr(&nft_hash_type);
	278	}
	279
	280	module_init(nft_hash_module_init);
	281	module_exit(nft_hash_module_exit);
	282
	283	MODULE_LICENSE("GPL");
	284	MODULE_AUTHOR("Laura Garcia <nevola@gmail.com>");
	285	MODULE_ALIAS_NFT_EXPR("hash");
4cacc395	286	MODULE_DESCRIPTION("Netfilter nftables hash module");