~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nft_cmp.c

Version: ~ [ linux-5.12-rc5 ] ~ [ linux-5.11.11 ] ~ [ linux-5.10.27 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.109 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.184 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.228 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.264 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.264 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  9  */
 10 
 11 #include <linux/kernel.h>
 12 #include <linux/init.h>
 13 #include <linux/module.h>
 14 #include <linux/netlink.h>
 15 #include <linux/netfilter.h>
 16 #include <linux/netfilter/nf_tables.h>
 17 #include <net/netfilter/nf_tables_core.h>
 18 #include <net/netfilter/nf_tables.h>
 19 
 20 struct nft_cmp_expr {
 21         struct nft_data         data;
 22         enum nft_registers      sreg:8;
 23         u8                      len;
 24         enum nft_cmp_ops        op:8;
 25 };
 26 
 27 static void nft_cmp_eval(const struct nft_expr *expr,
 28                          struct nft_regs *regs,
 29                          const struct nft_pktinfo *pkt)
 30 {
 31         const struct nft_cmp_expr *priv = nft_expr_priv(expr);
 32         int d;
 33 
 34         d = memcmp(&regs->data[priv->sreg], &priv->data, priv->len);
 35         switch (priv->op) {
 36         case NFT_CMP_EQ:
 37                 if (d != 0)
 38                         goto mismatch;
 39                 break;
 40         case NFT_CMP_NEQ:
 41                 if (d == 0)
 42                         goto mismatch;
 43                 break;
 44         case NFT_CMP_LT:
 45                 if (d == 0)
 46                         goto mismatch;
 47                 /* fall through */
 48         case NFT_CMP_LTE:
 49                 if (d > 0)
 50                         goto mismatch;
 51                 break;
 52         case NFT_CMP_GT:
 53                 if (d == 0)
 54                         goto mismatch;
 55                 /* fall through */
 56         case NFT_CMP_GTE:
 57                 if (d < 0)
 58                         goto mismatch;
 59                 break;
 60         }
 61         return;
 62 
 63 mismatch:
 64         regs->verdict.code = NFT_BREAK;
 65 }
 66 
 67 static const struct nla_policy nft_cmp_policy[NFTA_CMP_MAX + 1] = {
 68         [NFTA_CMP_SREG]         = { .type = NLA_U32 },
 69         [NFTA_CMP_OP]           = { .type = NLA_U32 },
 70         [NFTA_CMP_DATA]         = { .type = NLA_NESTED },
 71 };
 72 
 73 static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 74                         const struct nlattr * const tb[])
 75 {
 76         struct nft_cmp_expr *priv = nft_expr_priv(expr);
 77         struct nft_data_desc desc;
 78         int err;
 79 
 80         err = nft_data_init(NULL, &priv->data, sizeof(priv->data), &desc,
 81                             tb[NFTA_CMP_DATA]);
 82         if (err < 0)
 83                 return err;
 84 
 85         priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
 86         err = nft_validate_register_load(priv->sreg, desc.len);
 87         if (err < 0)
 88                 return err;
 89 
 90         priv->op  = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
 91         priv->len = desc.len;
 92         return 0;
 93 }
 94 
 95 static int nft_cmp_dump(struct sk_buff *skb, const struct nft_expr *expr)
 96 {
 97         const struct nft_cmp_expr *priv = nft_expr_priv(expr);
 98 
 99         if (nft_dump_register(skb, NFTA_CMP_SREG, priv->sreg))
100                 goto nla_put_failure;
101         if (nla_put_be32(skb, NFTA_CMP_OP, htonl(priv->op)))
102                 goto nla_put_failure;
103 
104         if (nft_data_dump(skb, NFTA_CMP_DATA, &priv->data,
105                           NFT_DATA_VALUE, priv->len) < 0)
106                 goto nla_put_failure;
107         return 0;
108 
109 nla_put_failure:
110         return -1;
111 }
112 
113 static const struct nft_expr_ops nft_cmp_ops = {
114         .type           = &nft_cmp_type,
115         .size           = NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr)),
116         .eval           = nft_cmp_eval,
117         .init           = nft_cmp_init,
118         .dump           = nft_cmp_dump,
119 };
120 
121 static int nft_cmp_fast_init(const struct nft_ctx *ctx,
122                              const struct nft_expr *expr,
123                              const struct nlattr * const tb[])
124 {
125         struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
126         struct nft_data_desc desc;
127         struct nft_data data;
128         u32 mask;
129         int err;
130 
131         err = nft_data_init(NULL, &data, sizeof(data), &desc,
132                             tb[NFTA_CMP_DATA]);
133         if (err < 0)
134                 return err;
135 
136         priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
137         err = nft_validate_register_load(priv->sreg, desc.len);
138         if (err < 0)
139                 return err;
140 
141         desc.len *= BITS_PER_BYTE;
142         mask = nft_cmp_fast_mask(desc.len);
143 
144         priv->data = data.data[0] & mask;
145         priv->len  = desc.len;
146         return 0;
147 }
148 
149 static int nft_cmp_fast_dump(struct sk_buff *skb, const struct nft_expr *expr)
150 {
151         const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
152         struct nft_data data;
153 
154         if (nft_dump_register(skb, NFTA_CMP_SREG, priv->sreg))
155                 goto nla_put_failure;
156         if (nla_put_be32(skb, NFTA_CMP_OP, htonl(NFT_CMP_EQ)))
157                 goto nla_put_failure;
158 
159         data.data[0] = priv->data;
160         if (nft_data_dump(skb, NFTA_CMP_DATA, &data,
161                           NFT_DATA_VALUE, priv->len / BITS_PER_BYTE) < 0)
162                 goto nla_put_failure;
163         return 0;
164 
165 nla_put_failure:
166         return -1;
167 }
168 
169 const struct nft_expr_ops nft_cmp_fast_ops = {
170         .type           = &nft_cmp_type,
171         .size           = NFT_EXPR_SIZE(sizeof(struct nft_cmp_fast_expr)),
172         .eval           = NULL, /* inlined */
173         .init           = nft_cmp_fast_init,
174         .dump           = nft_cmp_fast_dump,
175 };
176 
177 static const struct nft_expr_ops *
178 nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
179 {
180         struct nft_data_desc desc;
181         struct nft_data data;
182         enum nft_cmp_ops op;
183         int err;
184 
185         if (tb[NFTA_CMP_SREG] == NULL ||
186             tb[NFTA_CMP_OP] == NULL ||
187             tb[NFTA_CMP_DATA] == NULL)
188                 return ERR_PTR(-EINVAL);
189 
190         op = ntohl(nla_get_be32(tb[NFTA_CMP_OP]));
191         switch (op) {
192         case NFT_CMP_EQ:
193         case NFT_CMP_NEQ:
194         case NFT_CMP_LT:
195         case NFT_CMP_LTE:
196         case NFT_CMP_GT:
197         case NFT_CMP_GTE:
198                 break;
199         default:
200                 return ERR_PTR(-EINVAL);
201         }
202 
203         err = nft_data_init(NULL, &data, sizeof(data), &desc,
204                             tb[NFTA_CMP_DATA]);
205         if (err < 0)
206                 return ERR_PTR(err);
207 
208         if (desc.type != NFT_DATA_VALUE) {
209                 err = -EINVAL;
210                 goto err1;
211         }
212 
213         if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)
214                 return &nft_cmp_fast_ops;
215 
216         return &nft_cmp_ops;
217 err1:
218         nft_data_release(&data, desc.type);
219         return ERR_PTR(-EINVAL);
220 }
221 
222 struct nft_expr_type nft_cmp_type __read_mostly = {
223         .name           = "cmp",
224         .select_ops     = nft_cmp_select_ops,
225         .policy         = nft_cmp_policy,
226         .maxattr        = NFTA_CMP_MAX,
227         .owner          = THIS_MODULE,
228 };
229 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp