blob: c7f0ef73d9397a666223150cad18ea927e742ee2 [file] [log] [blame]
Thomas Gleixnerd2912cb2019-06-04 10:11:33 +02001// SPDX-License-Identifier: GPL-2.0-only
Patrick McHardy96518512013-10-14 11:00:02 +02002/*
Patrick McHardyef1f7df2013-10-10 11:41:20 +02003 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
Patrick McHardy96518512013-10-14 11:00:02 +02004 *
Patrick McHardy96518512013-10-14 11:00:02 +02005 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8#include <linux/kernel.h>
9#include <linux/init.h>
10#include <linux/module.h>
11#include <linux/netlink.h>
12#include <linux/netfilter.h>
13#include <linux/netfilter/nf_tables.h>
14#include <net/netfilter/nf_tables_core.h>
15#include <net/netfilter/nf_tables.h>
Pablo Neira Ayusoc9626a22019-07-09 23:00:43 +020016#include <net/netfilter/nf_tables_offload.h>
Patrick McHardy96518512013-10-14 11:00:02 +020017
Florian Westphal10870dd2019-01-08 17:35:34 +010018void nft_immediate_eval(const struct nft_expr *expr,
19 struct nft_regs *regs,
20 const struct nft_pktinfo *pkt)
Patrick McHardy96518512013-10-14 11:00:02 +020021{
22 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
23
Patrick McHardy49499c32015-04-11 02:27:37 +010024 nft_data_copy(&regs->data[priv->dreg], &priv->data, priv->dlen);
Patrick McHardy96518512013-10-14 11:00:02 +020025}
26
27static const struct nla_policy nft_immediate_policy[NFTA_IMMEDIATE_MAX + 1] = {
28 [NFTA_IMMEDIATE_DREG] = { .type = NLA_U32 },
29 [NFTA_IMMEDIATE_DATA] = { .type = NLA_NESTED },
30};
31
32static int nft_immediate_init(const struct nft_ctx *ctx,
33 const struct nft_expr *expr,
34 const struct nlattr * const tb[])
35{
36 struct nft_immediate_expr *priv = nft_expr_priv(expr);
37 struct nft_data_desc desc;
38 int err;
39
40 if (tb[NFTA_IMMEDIATE_DREG] == NULL ||
41 tb[NFTA_IMMEDIATE_DATA] == NULL)
42 return -EINVAL;
43
Patrick McHardyd0a11fc2015-04-11 02:27:38 +010044 err = nft_data_init(ctx, &priv->data, sizeof(priv->data), &desc,
45 tb[NFTA_IMMEDIATE_DATA]);
Patrick McHardy96518512013-10-14 11:00:02 +020046 if (err < 0)
47 return err;
Laura Garcia Liebana36b701f2016-09-14 15:00:02 +020048
Patrick McHardy96518512013-10-14 11:00:02 +020049 priv->dlen = desc.len;
50
Patrick McHardyb1c96ed2015-04-11 02:27:36 +010051 priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);
Patrick McHardy1ec10212015-04-11 02:27:27 +010052 err = nft_validate_register_store(ctx, priv->dreg, &priv->data,
53 desc.type, desc.len);
Patrick McHardy96518512013-10-14 11:00:02 +020054 if (err < 0)
55 goto err1;
56
57 return 0;
58
59err1:
Pablo Neira Ayuso59105442017-05-15 11:17:34 +010060 nft_data_release(&priv->data, desc.type);
Patrick McHardy96518512013-10-14 11:00:02 +020061 return err;
62}
63
Pablo Neira Ayusobb7b40a2018-05-08 02:43:57 +020064static void nft_immediate_activate(const struct nft_ctx *ctx,
65 const struct nft_expr *expr)
66{
67 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
68
69 return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
70}
71
72static void nft_immediate_deactivate(const struct nft_ctx *ctx,
Pablo Neira Ayusof6ac8582019-02-02 10:49:13 +010073 const struct nft_expr *expr,
74 enum nft_trans_phase phase)
Patrick McHardy96518512013-10-14 11:00:02 +020075{
76 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
Pablo Neira Ayuso59105442017-05-15 11:17:34 +010077
Pablo Neira Ayusof6ac8582019-02-02 10:49:13 +010078 if (phase == NFT_TRANS_COMMIT)
79 return;
80
Pablo Neira Ayuso59105442017-05-15 11:17:34 +010081 return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
Patrick McHardy96518512013-10-14 11:00:02 +020082}
83
84static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
85{
86 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
87
Patrick McHardyb1c96ed2015-04-11 02:27:36 +010088 if (nft_dump_register(skb, NFTA_IMMEDIATE_DREG, priv->dreg))
Patrick McHardy96518512013-10-14 11:00:02 +020089 goto nla_put_failure;
90
91 return nft_data_dump(skb, NFTA_IMMEDIATE_DATA, &priv->data,
92 nft_dreg_to_type(priv->dreg), priv->dlen);
93
94nla_put_failure:
95 return -1;
96}
97
Pablo Neira Ayuso0ca743a2013-10-14 00:06:06 +020098static int nft_immediate_validate(const struct nft_ctx *ctx,
99 const struct nft_expr *expr,
Pablo Neira Ayusoa654de82018-05-30 20:18:57 +0200100 const struct nft_data **d)
Patrick McHardy20a69342013-10-11 12:06:22 +0200101{
102 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
Taehee Yoo26b2f552018-07-13 01:38:08 +0900103 struct nft_ctx *pctx = (struct nft_ctx *)ctx;
Pablo Neira Ayusoa654de82018-05-30 20:18:57 +0200104 const struct nft_data *data;
105 int err;
Patrick McHardy20a69342013-10-11 12:06:22 +0200106
Pablo Neira Ayusoa654de82018-05-30 20:18:57 +0200107 if (priv->dreg != NFT_REG_VERDICT)
108 return 0;
109
110 data = &priv->data;
111
112 switch (data->verdict.code) {
113 case NFT_JUMP:
114 case NFT_GOTO:
Taehee Yoo26b2f552018-07-13 01:38:08 +0900115 pctx->level++;
Pablo Neira Ayusoa654de82018-05-30 20:18:57 +0200116 err = nft_chain_validate(ctx, data->verdict.chain);
117 if (err < 0)
118 return err;
Taehee Yoo26b2f552018-07-13 01:38:08 +0900119 pctx->level--;
Pablo Neira Ayusoa654de82018-05-30 20:18:57 +0200120 break;
121 default:
122 break;
123 }
Pablo Neira Ayuso0ca743a2013-10-14 00:06:06 +0200124
125 return 0;
Patrick McHardy20a69342013-10-11 12:06:22 +0200126}
127
Pablo Neira Ayuso43dd16e2019-08-01 14:09:26 +0200128static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
129 struct nft_flow_rule *flow,
130 const struct nft_immediate_expr *priv)
Pablo Neira Ayusoc9626a22019-07-09 23:00:43 +0200131{
Pablo Neira Ayusoc9626a22019-07-09 23:00:43 +0200132 struct flow_action_entry *entry;
133 const struct nft_data *data;
134
Pablo Neira Ayusoc9626a22019-07-09 23:00:43 +0200135 entry = &flow->rule->action.entries[ctx->num_actions++];
136
137 data = &priv->data;
138 switch (data->verdict.code) {
139 case NF_ACCEPT:
140 entry->id = FLOW_ACTION_ACCEPT;
141 break;
142 case NF_DROP:
143 entry->id = FLOW_ACTION_DROP;
144 break;
145 default:
146 return -EOPNOTSUPP;
147 }
148
149 return 0;
150}
151
Pablo Neira Ayuso43dd16e2019-08-01 14:09:26 +0200152static int nft_immediate_offload(struct nft_offload_ctx *ctx,
153 struct nft_flow_rule *flow,
154 const struct nft_expr *expr)
155{
156 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
157
158 if (priv->dreg == NFT_REG_VERDICT)
159 return nft_immediate_offload_verdict(ctx, flow, priv);
160
161 memcpy(&ctx->regs[priv->dreg].data, &priv->data, sizeof(priv->data));
162
163 return 0;
164}
165
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200166static const struct nft_expr_ops nft_imm_ops = {
167 .type = &nft_imm_type,
Patrick McHardy96518512013-10-14 11:00:02 +0200168 .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),
Patrick McHardy96518512013-10-14 11:00:02 +0200169 .eval = nft_immediate_eval,
170 .init = nft_immediate_init,
Pablo Neira Ayusobb7b40a2018-05-08 02:43:57 +0200171 .activate = nft_immediate_activate,
172 .deactivate = nft_immediate_deactivate,
Patrick McHardy96518512013-10-14 11:00:02 +0200173 .dump = nft_immediate_dump,
Pablo Neira Ayuso0ca743a2013-10-14 00:06:06 +0200174 .validate = nft_immediate_validate,
Pablo Neira Ayusoc9626a22019-07-09 23:00:43 +0200175 .offload = nft_immediate_offload,
176 .offload_flags = NFT_OFFLOAD_F_ACTION,
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200177};
178
Liping Zhang4e248772016-11-06 21:15:51 +0800179struct nft_expr_type nft_imm_type __read_mostly = {
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200180 .name = "immediate",
181 .ops = &nft_imm_ops,
Patrick McHardy96518512013-10-14 11:00:02 +0200182 .policy = nft_immediate_policy,
183 .maxattr = NFTA_IMMEDIATE_MAX,
Patrick McHardyef1f7df2013-10-10 11:41:20 +0200184 .owner = THIS_MODULE,
Patrick McHardy96518512013-10-14 11:00:02 +0200185};