[linux-2.6-block.git] / net / netfilter / nft_lookup.c

/*
 * Copyright (c) 2009 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/list.h>
#include <linux/rbtree.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h>

struct nft_lookup {
	struct nft_set			*set;
	enum nft_registers		sreg:8;
	enum nft_registers		dreg:8;
	bool				invert;
	struct nft_set_binding		binding;
};

void nft_lookup_eval(const struct nft_expr *expr,
		     struct nft_regs *regs,
		     const struct nft_pktinfo *pkt)
{
	const struct nft_lookup *priv = nft_expr_priv(expr);
	const struct nft_set *set = priv->set;
	const struct nft_set_ext *ext;
	bool found;

	found = set->ops->lookup(nft_net(pkt), set, &regs->data[priv->sreg],
				 &ext) ^ priv->invert;
	if (!found) {
		regs->verdict.code = NFT_BREAK;
		return;
	}

	if (set->flags & NFT_SET_MAP)
		nft_data_copy(&regs->data[priv->dreg],
			      nft_set_ext_data(ext), set->dlen);

}

static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
	[NFTA_LOOKUP_SET]	= { .type = NLA_STRING,
				    .len = NFT_SET_MAXNAMELEN - 1 },
	[NFTA_LOOKUP_SET_ID]	= { .type = NLA_U32 },
	[NFTA_LOOKUP_SREG]	= { .type = NLA_U32 },
	[NFTA_LOOKUP_DREG]	= { .type = NLA_U32 },
	[NFTA_LOOKUP_FLAGS]	= { .type = NLA_U32 },
};

static int nft_lookup_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_lookup *priv = nft_expr_priv(expr);
	u8 genmask = nft_genmask_next(ctx->net);
	struct nft_set *set;
	u32 flags;
	int err;

	if (tb[NFTA_LOOKUP_SET] == NULL ||
	    tb[NFTA_LOOKUP_SREG] == NULL)
		return -EINVAL;

	set = nft_set_lookup_global(ctx->net, ctx->table, tb[NFTA_LOOKUP_SET],
				    tb[NFTA_LOOKUP_SET_ID], genmask);
	if (IS_ERR(set))
		return PTR_ERR(set);

	if (set->flags & NFT_SET_EVAL)
		return -EOPNOTSUPP;

	priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
	err = nft_validate_register_load(priv->sreg, set->klen);
	if (err < 0)
		return err;

	if (tb[NFTA_LOOKUP_FLAGS]) {
		flags = ntohl(nla_get_be32(tb[NFTA_LOOKUP_FLAGS]));

		if (flags & ~NFT_LOOKUP_F_INV)
			return -EINVAL;

		if (flags & NFT_LOOKUP_F_INV) {
			if (set->flags & NFT_SET_MAP)
				return -EINVAL;
			priv->invert = true;
		}
	}

	if (tb[NFTA_LOOKUP_DREG] != NULL) {
		if (priv->invert)
			return -EINVAL;
		if (!(set->flags & NFT_SET_MAP))
			return -EINVAL;

		priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]);
		err = nft_validate_register_store(ctx, priv->dreg, NULL,
						  set->dtype, set->dlen);
		if (err < 0)
			return err;
	} else if (set->flags & NFT_SET_MAP)
		return -EINVAL;

	priv->binding.flags = set->flags & NFT_SET_MAP;

	err = nf_tables_bind_set(ctx, set, &priv->binding);
	if (err < 0)
		return err;

	priv->set = set;
	return 0;
}

static void nft_lookup_activate(const struct nft_ctx *ctx,
				const struct nft_expr *expr)
{
	struct nft_lookup *priv = nft_expr_priv(expr);

	nf_tables_rebind_set(ctx, priv->set, &priv->binding);
}

static void nft_lookup_deactivate(const struct nft_ctx *ctx,
				  const struct nft_expr *expr)
{
	struct nft_lookup *priv = nft_expr_priv(expr);

	nf_tables_unbind_set(ctx, priv->set, &priv->binding);
}

static void nft_lookup_destroy(const struct nft_ctx *ctx,
			       const struct nft_expr *expr)
{
	struct nft_lookup *priv = nft_expr_priv(expr);

	nf_tables_destroy_set(ctx, priv->set);
}

static int nft_lookup_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_lookup *priv = nft_expr_priv(expr);
	u32 flags = priv->invert ? NFT_LOOKUP_F_INV : 0;

	if (nla_put_string(skb, NFTA_LOOKUP_SET, priv->set->name))
		goto nla_put_failure;
	if (nft_dump_register(skb, NFTA_LOOKUP_SREG, priv->sreg))
		goto nla_put_failure;
	if (priv->set->flags & NFT_SET_MAP)
		if (nft_dump_register(skb, NFTA_LOOKUP_DREG, priv->dreg))
			goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_LOOKUP_FLAGS, htonl(flags)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static int nft_lookup_validate_setelem(const struct nft_ctx *ctx,
				       struct nft_set *set,
				       const struct nft_set_iter *iter,
				       struct nft_set_elem *elem)
{
	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
	struct nft_ctx *pctx = (struct nft_ctx *)ctx;
	const struct nft_data *data;
	int err;

	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
	    *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
		return 0;

	data = nft_set_ext_data(ext);
	switch (data->verdict.code) {
	case NFT_JUMP:
	case NFT_GOTO:
		pctx->level++;
		err = nft_chain_validate(ctx, data->verdict.chain);
		if (err < 0)
			return err;
		pctx->level--;
		break;
	default:
		break;
	}

	return 0;
}

static int nft_lookup_validate(const struct nft_ctx *ctx,
			       const struct nft_expr *expr,
			       const struct nft_data **d)
{
	const struct nft_lookup *priv = nft_expr_priv(expr);
	struct nft_set_iter iter;

	if (!(priv->set->flags & NFT_SET_MAP) ||
	    priv->set->dtype != NFT_DATA_VERDICT)
		return 0;

	iter.genmask	= nft_genmask_next(ctx->net);
	iter.skip	= 0;
	iter.count	= 0;
	iter.err	= 0;
	iter.fn		= nft_lookup_validate_setelem;

	priv->set->ops->walk(ctx, priv->set, &iter);
	if (iter.err < 0)
		return iter.err;

	return 0;
}

static const struct nft_expr_ops nft_lookup_ops = {
	.type		= &nft_lookup_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
	.eval		= nft_lookup_eval,
	.init		= nft_lookup_init,
	.activate	= nft_lookup_activate,
	.deactivate	= nft_lookup_deactivate,
	.destroy	= nft_lookup_destroy,
	.dump		= nft_lookup_dump,
	.validate	= nft_lookup_validate,
};

struct nft_expr_type nft_lookup_type __read_mostly = {
	.name		= "lookup",
	.ops		= &nft_lookup_ops,
	.policy		= nft_lookup_policy,
	.maxattr	= NFTA_LOOKUP_MAX,
	.owner		= THIS_MODULE,
};
Commit	Line	Data
20a69341 PM	1	/*
	2	* Copyright (c) 2009 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/init.h>
	13	#include <linux/list.h>
	14	#include <linux/rbtree.h>
	15	#include <linux/netlink.h>
	16	#include <linux/netfilter.h>
	17	#include <linux/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_tables.h>
bd76ed36	19	#include <net/netfilter/nf_tables_core.h>
20a69341 PM	20
	21	struct nft_lookup {
	22	struct nft_set *set;
	23	enum nft_registers sreg:8;
	24	enum nft_registers dreg:8;
0071e184	25	bool invert;
20a69341 PM	26	struct nft_set_binding binding;
	27	};
	28
222440b4 FW	29	void nft_lookup_eval(const struct nft_expr *expr,
	30	struct nft_regs *regs,
	31	const struct nft_pktinfo *pkt)
20a69341 PM	32	{
	33	const struct nft_lookup *priv = nft_expr_priv(expr);
	34	const struct nft_set *set = priv->set;
b2832dd6	35	const struct nft_set_ext *ext;
0071e184	36	bool found;
20a69341	37
0e5a1c7e PNA	38	found = set->ops->lookup(nft_net(pkt), set, &regs->data[priv->sreg],
0e5a1c7e PNA	39	&ext) ^ priv->invert;
0071e184 AB	40	if (!found) {
0071e184 AB	41	regs->verdict.code = NFT_BREAK;
20a69341	42	return;
b2832dd6	43	}
0071e184	44
4004d5c3	45	if (set->flags & NFT_SET_MAP)
0071e184 AB	46	nft_data_copy(&regs->data[priv->dreg],
	47	nft_set_ext_data(ext), set->dlen);
	48
20a69341 PM	49	}
	50
	51	static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
b2fbd044 LZ	52	[NFTA_LOOKUP_SET] = { .type = NLA_STRING,
b2fbd044 LZ	53	.len = NFT_SET_MAXNAMELEN - 1 },
4c1017aa	54	[NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 },
20a69341 PM	55	[NFTA_LOOKUP_SREG] = { .type = NLA_U32 },
20a69341 PM	56	[NFTA_LOOKUP_DREG] = { .type = NLA_U32 },
0071e184	57	[NFTA_LOOKUP_FLAGS] = { .type = NLA_U32 },
20a69341 PM	58	};
	59
	60	static int nft_lookup_init(const struct nft_ctx *ctx,
	61	const struct nft_expr *expr,
	62	const struct nlattr * const tb[])
	63	{
	64	struct nft_lookup *priv = nft_expr_priv(expr);
37a9cc52	65	u8 genmask = nft_genmask_next(ctx->net);
20a69341	66	struct nft_set *set;
0071e184	67	u32 flags;
20a69341 PM	68	int err;
	69
	70	if (tb[NFTA_LOOKUP_SET] == NULL \|\|
	71	tb[NFTA_LOOKUP_SREG] == NULL)
	72	return -EINVAL;
	73
10659cba PNA	74	set = nft_set_lookup_global(ctx->net, ctx->table, tb[NFTA_LOOKUP_SET],
10659cba PNA	75	tb[NFTA_LOOKUP_SET_ID], genmask);
c7a72e3f PNA	76	if (IS_ERR(set))
c7a72e3f PNA	77	return PTR_ERR(set);
20a69341	78
7c6c6e95 PM	79	if (set->flags & NFT_SET_EVAL)
	80	return -EOPNOTSUPP;
	81
b1c96ed3	82	priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
d07db988	83	err = nft_validate_register_load(priv->sreg, set->klen);
20a69341 PM	84	if (err < 0)
	85	return err;
	86
0071e184 AB	87	if (tb[NFTA_LOOKUP_FLAGS]) {
	88	flags = ntohl(nla_get_be32(tb[NFTA_LOOKUP_FLAGS]));
	89
	90	if (flags & ~NFT_LOOKUP_F_INV)
	91	return -EINVAL;
	92
	93	if (flags & NFT_LOOKUP_F_INV) {
	94	if (set->flags & NFT_SET_MAP)
	95	return -EINVAL;
	96	priv->invert = true;
	97	}
	98	}
	99
20a69341	100	if (tb[NFTA_LOOKUP_DREG] != NULL) {
0071e184 AB	101	if (priv->invert)
0071e184 AB	102	return -EINVAL;
20a69341 PM	103	if (!(set->flags & NFT_SET_MAP))
	104	return -EINVAL;
	105
b1c96ed3	106	priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]);
58f40ab6 PM	107	err = nft_validate_register_store(ctx, priv->dreg, NULL,
	108	set->dtype, set->dlen);
	109	if (err < 0)
	110	return err;
20a69341 PM	111	} else if (set->flags & NFT_SET_MAP)
	112	return -EINVAL;
	113
11113e19 PM	114	priv->binding.flags = set->flags & NFT_SET_MAP;
11113e19 PM	115
20a69341 PM	116	err = nf_tables_bind_set(ctx, set, &priv->binding);
	117	if (err < 0)
	118	return err;
	119
	120	priv->set = set;
	121	return 0;
	122	}
	123
cd5125d8 FW	124	static void nft_lookup_activate(const struct nft_ctx *ctx,
	125	const struct nft_expr *expr)
	126	{
	127	struct nft_lookup *priv = nft_expr_priv(expr);
	128
	129	nf_tables_rebind_set(ctx, priv->set, &priv->binding);
	130	}
	131
	132	static void nft_lookup_deactivate(const struct nft_ctx *ctx,
	133	const struct nft_expr *expr)
	134	{
	135	struct nft_lookup *priv = nft_expr_priv(expr);
	136
	137	nf_tables_unbind_set(ctx, priv->set, &priv->binding);
	138	}
	139
62472bce PM	140	static void nft_lookup_destroy(const struct nft_ctx *ctx,
62472bce PM	141	const struct nft_expr *expr)
20a69341 PM	142	{
	143	struct nft_lookup *priv = nft_expr_priv(expr);
	144
cd5125d8	145	nf_tables_destroy_set(ctx, priv->set);
20a69341 PM	146	}
	147
	148	static int nft_lookup_dump(struct sk_buff skb, const struct nft_expr expr)
	149	{
	150	const struct nft_lookup *priv = nft_expr_priv(expr);
0071e184	151	u32 flags = priv->invert ? NFT_LOOKUP_F_INV : 0;
20a69341 PM	152
	153	if (nla_put_string(skb, NFTA_LOOKUP_SET, priv->set->name))
	154	goto nla_put_failure;
b1c96ed3	155	if (nft_dump_register(skb, NFTA_LOOKUP_SREG, priv->sreg))
20a69341 PM	156	goto nla_put_failure;
20a69341 PM	157	if (priv->set->flags & NFT_SET_MAP)
b1c96ed3	158	if (nft_dump_register(skb, NFTA_LOOKUP_DREG, priv->dreg))
20a69341	159	goto nla_put_failure;
0071e184 AB	160	if (nla_put_be32(skb, NFTA_LOOKUP_FLAGS, htonl(flags)))
0071e184 AB	161	goto nla_put_failure;
20a69341 PM	162	return 0;
	163
	164	nla_put_failure:
	165	return -1;
	166	}
	167
a654de8f PNA	168	static int nft_lookup_validate_setelem(const struct nft_ctx *ctx,
	169	struct nft_set *set,
	170	const struct nft_set_iter *iter,
	171	struct nft_set_elem *elem)
	172	{
	173	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
26b2f552	174	struct nft_ctx pctx = (struct nft_ctx )ctx;
a654de8f	175	const struct nft_data *data;
26b2f552	176	int err;
a654de8f PNA	177
	178	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
	179	*nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
	180	return 0;
	181
	182	data = nft_set_ext_data(ext);
	183	switch (data->verdict.code) {
	184	case NFT_JUMP:
	185	case NFT_GOTO:
26b2f552 TY	186	pctx->level++;
	187	err = nft_chain_validate(ctx, data->verdict.chain);
	188	if (err < 0)
	189	return err;
	190	pctx->level--;
	191	break;
a654de8f	192	default:
26b2f552	193	break;
a654de8f	194	}
26b2f552 TY	195
26b2f552 TY	196	return 0;
a654de8f PNA	197	}
	198
	199	static int nft_lookup_validate(const struct nft_ctx *ctx,
	200	const struct nft_expr *expr,
	201	const struct nft_data **d)
	202	{
	203	const struct nft_lookup *priv = nft_expr_priv(expr);
	204	struct nft_set_iter iter;
	205
	206	if (!(priv->set->flags & NFT_SET_MAP) \|\|
	207	priv->set->dtype != NFT_DATA_VERDICT)
	208	return 0;
	209
	210	iter.genmask = nft_genmask_next(ctx->net);
	211	iter.skip = 0;
	212	iter.count = 0;
	213	iter.err = 0;
	214	iter.fn = nft_lookup_validate_setelem;
	215
	216	priv->set->ops->walk(ctx, priv->set, &iter);
	217	if (iter.err < 0)
	218	return iter.err;
	219
	220	return 0;
	221	}
	222
ef1f7df9 PM	223	static const struct nft_expr_ops nft_lookup_ops = {
ef1f7df9 PM	224	.type = &nft_lookup_type,
20a69341	225	.size = NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
20a69341 PM	226	.eval = nft_lookup_eval,
20a69341 PM	227	.init = nft_lookup_init,
cd5125d8 FW	228	.activate = nft_lookup_activate,
cd5125d8 FW	229	.deactivate = nft_lookup_deactivate,
20a69341 PM	230	.destroy = nft_lookup_destroy,
20a69341 PM	231	.dump = nft_lookup_dump,
a654de8f	232	.validate = nft_lookup_validate,
ef1f7df9 PM	233	};
ef1f7df9 PM	234
4e24877e	235	struct nft_expr_type nft_lookup_type __read_mostly = {
ef1f7df9 PM	236	.name = "lookup",
ef1f7df9 PM	237	.ops = &nft_lookup_ops,
20a69341 PM	238	.policy = nft_lookup_policy,
20a69341 PM	239	.maxattr = NFTA_LOOKUP_MAX,
ef1f7df9	240	.owner = THIS_MODULE,
20a69341	241	};