1 /* 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * Development of this code funded by Astaro AG (http://www.astaro.com/) 9 */ 10 11 #include <linux/kernel.h> 12 #include <linux/init.h> 13 #include <linux/module.h> 14 #include <linux/netlink.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter/nf_tables.h> 17 #include <net/netfilter/nf_tables_core.h> 18 #include <net/netfilter/nf_tables.h> 19 20 struct nft_bitwise { 21 enum nft_registers sreg:8; 22 enum nft_registers dreg:8; 23 u8 len; 24 struct nft_data mask; 25 struct nft_data xor; 26 }; 27 28 void nft_bitwise_eval(const struct nft_expr *expr, 29 struct nft_regs *regs, const struct nft_pktinfo *pkt) 30 { 31 const struct nft_bitwise *priv = nft_expr_priv(expr); 32 const u32 *src = ®s->data[priv->sreg]; 33 u32 *dst = ®s->data[priv->dreg]; 34 unsigned int i; 35 36 for (i = 0; i < DIV_ROUND_UP(priv->len, 4); i++) 37 dst[i] = (src[i] & priv->mask.data[i]) ^ priv->xor.data[i]; 38 } 39 40 static const struct nla_policy nft_bitwise_policy[NFTA_BITWISE_MAX + 1] = { 41 [NFTA_BITWISE_SREG] = { .type = NLA_U32 }, 42 [NFTA_BITWISE_DREG] = { .type = NLA_U32 }, 43 [NFTA_BITWISE_LEN] = { .type = NLA_U32 }, 44 [NFTA_BITWISE_MASK] = { .type = NLA_NESTED }, 45 [NFTA_BITWISE_XOR] = { .type = NLA_NESTED }, 46 }; 47 48 static int nft_bitwise_init(const struct nft_ctx *ctx, 49 const struct nft_expr *expr, 50 const struct nlattr * const tb[]) 51 { 52 struct nft_bitwise *priv = nft_expr_priv(expr); 53 struct nft_data_desc d1, d2; 54 u32 len; 55 int err; 56 57 if (tb[NFTA_BITWISE_SREG] == NULL || 58 tb[NFTA_BITWISE_DREG] == NULL || 59 tb[NFTA_BITWISE_LEN] == NULL || 60 tb[NFTA_BITWISE_MASK] == NULL || 61 tb[NFTA_BITWISE_XOR] == NULL) 62 return -EINVAL; 63 64 err = nft_parse_u32_check(tb[NFTA_BITWISE_LEN], U8_MAX, &len); 65 if (err < 0) 66 return err; 67 68 priv->len = len; 69 70 priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]); 71 err = nft_validate_register_load(priv->sreg, priv->len); 72 if (err < 0) 73 return err; 74 75 priv->dreg = nft_parse_register(tb[NFTA_BITWISE_DREG]); 76 err = nft_validate_register_store(ctx, priv->dreg, NULL, 77 NFT_DATA_VALUE, priv->len); 78 if (err < 0) 79 return err; 80 81 err = nft_data_init(NULL, &priv->mask, sizeof(priv->mask), &d1, 82 tb[NFTA_BITWISE_MASK]); 83 if (err < 0) 84 return err; 85 if (d1.len != priv->len) { 86 err = -EINVAL; 87 goto err1; 88 } 89 90 err = nft_data_init(NULL, &priv->xor, sizeof(priv->xor), &d2, 91 tb[NFTA_BITWISE_XOR]); 92 if (err < 0) 93 goto err1; 94 if (d2.len != priv->len) { 95 err = -EINVAL; 96 goto err2; 97 } 98 99 return 0; 100 err2: 101 nft_data_release(&priv->xor, d2.type); 102 err1: 103 nft_data_release(&priv->mask, d1.type); 104 return err; 105 } 106 107 static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr) 108 { 109 const struct nft_bitwise *priv = nft_expr_priv(expr); 110 111 if (nft_dump_register(skb, NFTA_BITWISE_SREG, priv->sreg)) 112 goto nla_put_failure; 113 if (nft_dump_register(skb, NFTA_BITWISE_DREG, priv->dreg)) 114 goto nla_put_failure; 115 if (nla_put_be32(skb, NFTA_BITWISE_LEN, htonl(priv->len))) 116 goto nla_put_failure; 117 118 if (nft_data_dump(skb, NFTA_BITWISE_MASK, &priv->mask, 119 NFT_DATA_VALUE, priv->len) < 0) 120 goto nla_put_failure; 121 122 if (nft_data_dump(skb, NFTA_BITWISE_XOR, &priv->xor, 123 NFT_DATA_VALUE, priv->len) < 0) 124 goto nla_put_failure; 125 126 return 0; 127 128 nla_put_failure: 129 return -1; 130 } 131 132 static const struct nft_expr_ops nft_bitwise_ops = { 133 .type = &nft_bitwise_type, 134 .size = NFT_EXPR_SIZE(sizeof(struct nft_bitwise)), 135 .eval = nft_bitwise_eval, 136 .init = nft_bitwise_init, 137 .dump = nft_bitwise_dump, 138 }; 139 140 struct nft_expr_type nft_bitwise_type __read_mostly = { 141 .name = "bitwise", 142 .ops = &nft_bitwise_ops, 143 .policy = nft_bitwise_policy, 144 .maxattr = NFTA_BITWISE_MAX, 145 .owner = THIS_MODULE, 146 }; 147