Commit | Line | Data |
---|---|---|
91dbc6be LGL |
1 | /* |
2 | * Copyright (c) 2016 Laura Garcia <nevola@gmail.com> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | * | |
8 | */ | |
9 | ||
10 | #include <linux/kernel.h> | |
11 | #include <linux/init.h> | |
12 | #include <linux/module.h> | |
13 | #include <linux/netlink.h> | |
14 | #include <linux/netfilter.h> | |
15 | #include <linux/netfilter/nf_tables.h> | |
16 | #include <linux/static_key.h> | |
17 | #include <net/netfilter/nf_tables.h> | |
18 | #include <net/netfilter/nf_tables_core.h> | |
19 | ||
20 | static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state); | |
21 | ||
22 | struct nft_ng_inc { | |
23 | enum nft_registers dreg:8; | |
0d9932b2 | 24 | u32 modulus; |
91dbc6be | 25 | atomic_t counter; |
2b03bf73 | 26 | u32 offset; |
d734a288 | 27 | struct nft_set *map; |
91dbc6be LGL |
28 | }; |
29 | ||
d734a288 | 30 | static u32 nft_ng_inc_gen(struct nft_ng_inc *priv) |
91dbc6be | 31 | { |
91dbc6be LGL |
32 | u32 nval, oval; |
33 | ||
34 | do { | |
35 | oval = atomic_read(&priv->counter); | |
0d9932b2 | 36 | nval = (oval + 1 < priv->modulus) ? oval + 1 : 0; |
91dbc6be LGL |
37 | } while (atomic_cmpxchg(&priv->counter, oval, nval) != oval); |
38 | ||
d734a288 LGL |
39 | return nval + priv->offset; |
40 | } | |
41 | ||
42 | static void nft_ng_inc_eval(const struct nft_expr *expr, | |
43 | struct nft_regs *regs, | |
44 | const struct nft_pktinfo *pkt) | |
45 | { | |
46 | struct nft_ng_inc *priv = nft_expr_priv(expr); | |
47 | ||
48 | regs->data[priv->dreg] = nft_ng_inc_gen(priv); | |
49 | } | |
50 | ||
51 | static void nft_ng_inc_map_eval(const struct nft_expr *expr, | |
52 | struct nft_regs *regs, | |
53 | const struct nft_pktinfo *pkt) | |
54 | { | |
55 | struct nft_ng_inc *priv = nft_expr_priv(expr); | |
56 | const struct nft_set *map = priv->map; | |
57 | const struct nft_set_ext *ext; | |
58 | u32 result; | |
59 | bool found; | |
60 | ||
61 | result = nft_ng_inc_gen(priv); | |
62 | found = map->ops->lookup(nft_net(pkt), map, &result, &ext); | |
63 | ||
64 | if (!found) | |
65 | return; | |
66 | ||
67 | nft_data_copy(®s->data[priv->dreg], | |
68 | nft_set_ext_data(ext), map->dlen); | |
91dbc6be LGL |
69 | } |
70 | ||
71 | static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = { | |
72 | [NFTA_NG_DREG] = { .type = NLA_U32 }, | |
0d9932b2 | 73 | [NFTA_NG_MODULUS] = { .type = NLA_U32 }, |
91dbc6be | 74 | [NFTA_NG_TYPE] = { .type = NLA_U32 }, |
2b03bf73 | 75 | [NFTA_NG_OFFSET] = { .type = NLA_U32 }, |
d734a288 LGL |
76 | [NFTA_NG_SET_NAME] = { .type = NLA_STRING, |
77 | .len = NFT_SET_MAXNAMELEN - 1 }, | |
78 | [NFTA_NG_SET_ID] = { .type = NLA_U32 }, | |
91dbc6be LGL |
79 | }; |
80 | ||
81 | static int nft_ng_inc_init(const struct nft_ctx *ctx, | |
82 | const struct nft_expr *expr, | |
83 | const struct nlattr * const tb[]) | |
84 | { | |
85 | struct nft_ng_inc *priv = nft_expr_priv(expr); | |
86 | ||
2b03bf73 LGL |
87 | if (tb[NFTA_NG_OFFSET]) |
88 | priv->offset = ntohl(nla_get_be32(tb[NFTA_NG_OFFSET])); | |
89 | ||
0d9932b2 LGL |
90 | priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS])); |
91 | if (priv->modulus == 0) | |
91dbc6be LGL |
92 | return -ERANGE; |
93 | ||
2b03bf73 LGL |
94 | if (priv->offset + priv->modulus - 1 < priv->offset) |
95 | return -EOVERFLOW; | |
96 | ||
91dbc6be | 97 | priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]); |
0ecba4d9 | 98 | atomic_set(&priv->counter, priv->modulus - 1); |
91dbc6be LGL |
99 | |
100 | return nft_validate_register_store(ctx, priv->dreg, NULL, | |
101 | NFT_DATA_VALUE, sizeof(u32)); | |
102 | } | |
103 | ||
d734a288 LGL |
104 | static int nft_ng_inc_map_init(const struct nft_ctx *ctx, |
105 | const struct nft_expr *expr, | |
106 | const struct nlattr * const tb[]) | |
107 | { | |
108 | struct nft_ng_inc *priv = nft_expr_priv(expr); | |
109 | u8 genmask = nft_genmask_next(ctx->net); | |
110 | ||
111 | nft_ng_inc_init(ctx, expr, tb); | |
112 | ||
113 | priv->map = nft_set_lookup_global(ctx->net, ctx->table, | |
114 | tb[NFTA_NG_SET_NAME], | |
115 | tb[NFTA_NG_SET_ID], genmask); | |
116 | ||
7849958b | 117 | return PTR_ERR_OR_ZERO(priv->map); |
d734a288 LGL |
118 | } |
119 | ||
91dbc6be | 120 | static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg, |
2b03bf73 | 121 | u32 modulus, enum nft_ng_types type, u32 offset) |
91dbc6be LGL |
122 | { |
123 | if (nft_dump_register(skb, NFTA_NG_DREG, dreg)) | |
124 | goto nla_put_failure; | |
0d9932b2 | 125 | if (nla_put_be32(skb, NFTA_NG_MODULUS, htonl(modulus))) |
91dbc6be | 126 | goto nla_put_failure; |
7073b16f | 127 | if (nla_put_be32(skb, NFTA_NG_TYPE, htonl(type))) |
91dbc6be | 128 | goto nla_put_failure; |
2b03bf73 LGL |
129 | if (nla_put_be32(skb, NFTA_NG_OFFSET, htonl(offset))) |
130 | goto nla_put_failure; | |
91dbc6be LGL |
131 | |
132 | return 0; | |
133 | ||
134 | nla_put_failure: | |
135 | return -1; | |
136 | } | |
137 | ||
138 | static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr) | |
139 | { | |
140 | const struct nft_ng_inc *priv = nft_expr_priv(expr); | |
141 | ||
2b03bf73 LGL |
142 | return nft_ng_dump(skb, priv->dreg, priv->modulus, NFT_NG_INCREMENTAL, |
143 | priv->offset); | |
91dbc6be LGL |
144 | } |
145 | ||
d734a288 LGL |
146 | static int nft_ng_inc_map_dump(struct sk_buff *skb, |
147 | const struct nft_expr *expr) | |
148 | { | |
149 | const struct nft_ng_inc *priv = nft_expr_priv(expr); | |
150 | ||
151 | if (nft_ng_dump(skb, priv->dreg, priv->modulus, | |
152 | NFT_NG_INCREMENTAL, priv->offset) || | |
153 | nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name)) | |
154 | goto nla_put_failure; | |
155 | ||
156 | return 0; | |
157 | ||
158 | nla_put_failure: | |
159 | return -1; | |
160 | } | |
161 | ||
91dbc6be LGL |
162 | struct nft_ng_random { |
163 | enum nft_registers dreg:8; | |
0d9932b2 | 164 | u32 modulus; |
2b03bf73 | 165 | u32 offset; |
978d8f90 | 166 | struct nft_set *map; |
91dbc6be LGL |
167 | }; |
168 | ||
978d8f90 LGL |
169 | static u32 nft_ng_random_gen(struct nft_ng_random *priv) |
170 | { | |
171 | struct rnd_state *state = this_cpu_ptr(&nft_numgen_prandom_state); | |
172 | ||
173 | return reciprocal_scale(prandom_u32_state(state), priv->modulus) + | |
174 | priv->offset; | |
175 | } | |
176 | ||
91dbc6be LGL |
177 | static void nft_ng_random_eval(const struct nft_expr *expr, |
178 | struct nft_regs *regs, | |
179 | const struct nft_pktinfo *pkt) | |
180 | { | |
181 | struct nft_ng_random *priv = nft_expr_priv(expr); | |
91dbc6be | 182 | |
978d8f90 LGL |
183 | regs->data[priv->dreg] = nft_ng_random_gen(priv); |
184 | } | |
185 | ||
186 | static void nft_ng_random_map_eval(const struct nft_expr *expr, | |
187 | struct nft_regs *regs, | |
188 | const struct nft_pktinfo *pkt) | |
189 | { | |
190 | struct nft_ng_random *priv = nft_expr_priv(expr); | |
191 | const struct nft_set *map = priv->map; | |
192 | const struct nft_set_ext *ext; | |
193 | u32 result; | |
194 | bool found; | |
195 | ||
196 | result = nft_ng_random_gen(priv); | |
197 | found = map->ops->lookup(nft_net(pkt), map, &result, &ext); | |
198 | if (!found) | |
199 | return; | |
200 | ||
201 | nft_data_copy(®s->data[priv->dreg], | |
202 | nft_set_ext_data(ext), map->dlen); | |
91dbc6be LGL |
203 | } |
204 | ||
205 | static int nft_ng_random_init(const struct nft_ctx *ctx, | |
206 | const struct nft_expr *expr, | |
207 | const struct nlattr * const tb[]) | |
208 | { | |
209 | struct nft_ng_random *priv = nft_expr_priv(expr); | |
210 | ||
2b03bf73 LGL |
211 | if (tb[NFTA_NG_OFFSET]) |
212 | priv->offset = ntohl(nla_get_be32(tb[NFTA_NG_OFFSET])); | |
213 | ||
0d9932b2 LGL |
214 | priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS])); |
215 | if (priv->modulus == 0) | |
91dbc6be LGL |
216 | return -ERANGE; |
217 | ||
2b03bf73 LGL |
218 | if (priv->offset + priv->modulus - 1 < priv->offset) |
219 | return -EOVERFLOW; | |
220 | ||
91dbc6be LGL |
221 | prandom_init_once(&nft_numgen_prandom_state); |
222 | ||
223 | priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]); | |
224 | ||
225 | return nft_validate_register_store(ctx, priv->dreg, NULL, | |
226 | NFT_DATA_VALUE, sizeof(u32)); | |
227 | } | |
228 | ||
978d8f90 LGL |
229 | static int nft_ng_random_map_init(const struct nft_ctx *ctx, |
230 | const struct nft_expr *expr, | |
231 | const struct nlattr * const tb[]) | |
232 | { | |
233 | struct nft_ng_random *priv = nft_expr_priv(expr); | |
234 | u8 genmask = nft_genmask_next(ctx->net); | |
235 | ||
236 | nft_ng_random_init(ctx, expr, tb); | |
237 | priv->map = nft_set_lookup_global(ctx->net, ctx->table, | |
238 | tb[NFTA_NG_SET_NAME], | |
239 | tb[NFTA_NG_SET_ID], genmask); | |
978d8f90 | 240 | |
33b78aaa | 241 | return PTR_ERR_OR_ZERO(priv->map); |
978d8f90 LGL |
242 | } |
243 | ||
91dbc6be LGL |
244 | static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) |
245 | { | |
246 | const struct nft_ng_random *priv = nft_expr_priv(expr); | |
247 | ||
2b03bf73 LGL |
248 | return nft_ng_dump(skb, priv->dreg, priv->modulus, NFT_NG_RANDOM, |
249 | priv->offset); | |
91dbc6be LGL |
250 | } |
251 | ||
978d8f90 LGL |
252 | static int nft_ng_random_map_dump(struct sk_buff *skb, |
253 | const struct nft_expr *expr) | |
254 | { | |
255 | const struct nft_ng_random *priv = nft_expr_priv(expr); | |
256 | ||
257 | if (nft_ng_dump(skb, priv->dreg, priv->modulus, | |
258 | NFT_NG_RANDOM, priv->offset) || | |
259 | nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name)) | |
260 | goto nla_put_failure; | |
261 | ||
262 | return 0; | |
263 | ||
264 | nla_put_failure: | |
265 | return -1; | |
266 | } | |
267 | ||
91dbc6be LGL |
268 | static struct nft_expr_type nft_ng_type; |
269 | static const struct nft_expr_ops nft_ng_inc_ops = { | |
270 | .type = &nft_ng_type, | |
271 | .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)), | |
272 | .eval = nft_ng_inc_eval, | |
273 | .init = nft_ng_inc_init, | |
274 | .dump = nft_ng_inc_dump, | |
275 | }; | |
276 | ||
d734a288 LGL |
277 | static const struct nft_expr_ops nft_ng_inc_map_ops = { |
278 | .type = &nft_ng_type, | |
279 | .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)), | |
280 | .eval = nft_ng_inc_map_eval, | |
281 | .init = nft_ng_inc_map_init, | |
282 | .dump = nft_ng_inc_map_dump, | |
283 | }; | |
284 | ||
91dbc6be LGL |
285 | static const struct nft_expr_ops nft_ng_random_ops = { |
286 | .type = &nft_ng_type, | |
287 | .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), | |
288 | .eval = nft_ng_random_eval, | |
289 | .init = nft_ng_random_init, | |
290 | .dump = nft_ng_random_dump, | |
291 | }; | |
292 | ||
978d8f90 LGL |
293 | static const struct nft_expr_ops nft_ng_random_map_ops = { |
294 | .type = &nft_ng_type, | |
295 | .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), | |
296 | .eval = nft_ng_random_map_eval, | |
297 | .init = nft_ng_random_map_init, | |
298 | .dump = nft_ng_random_map_dump, | |
299 | }; | |
300 | ||
91dbc6be LGL |
301 | static const struct nft_expr_ops * |
302 | nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) | |
303 | { | |
304 | u32 type; | |
305 | ||
0d9932b2 LGL |
306 | if (!tb[NFTA_NG_DREG] || |
307 | !tb[NFTA_NG_MODULUS] || | |
91dbc6be LGL |
308 | !tb[NFTA_NG_TYPE]) |
309 | return ERR_PTR(-EINVAL); | |
310 | ||
311 | type = ntohl(nla_get_be32(tb[NFTA_NG_TYPE])); | |
312 | ||
313 | switch (type) { | |
314 | case NFT_NG_INCREMENTAL: | |
d734a288 LGL |
315 | if (tb[NFTA_NG_SET_NAME]) |
316 | return &nft_ng_inc_map_ops; | |
91dbc6be LGL |
317 | return &nft_ng_inc_ops; |
318 | case NFT_NG_RANDOM: | |
978d8f90 LGL |
319 | if (tb[NFTA_NG_SET_NAME]) |
320 | return &nft_ng_random_map_ops; | |
91dbc6be LGL |
321 | return &nft_ng_random_ops; |
322 | } | |
323 | ||
324 | return ERR_PTR(-EINVAL); | |
325 | } | |
326 | ||
327 | static struct nft_expr_type nft_ng_type __read_mostly = { | |
328 | .name = "numgen", | |
d4ef3835 | 329 | .select_ops = nft_ng_select_ops, |
91dbc6be LGL |
330 | .policy = nft_ng_policy, |
331 | .maxattr = NFTA_NG_MAX, | |
332 | .owner = THIS_MODULE, | |
333 | }; | |
334 | ||
335 | static int __init nft_ng_module_init(void) | |
336 | { | |
337 | return nft_register_expr(&nft_ng_type); | |
338 | } | |
339 | ||
340 | static void __exit nft_ng_module_exit(void) | |
341 | { | |
342 | nft_unregister_expr(&nft_ng_type); | |
343 | } | |
344 | ||
345 | module_init(nft_ng_module_init); | |
346 | module_exit(nft_ng_module_exit); | |
347 | ||
348 | MODULE_LICENSE("GPL"); | |
349 | MODULE_AUTHOR("Laura Garcia <nevola@gmail.com>"); | |
350 | MODULE_ALIAS_NFT_EXPR("numgen"); |