1 /* 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * Development of this code funded by Astaro AG (http://www.astaro.com/) 9 */ 10 11 #include <linux/kernel.h> 12 #include <linux/init.h> 13 #include <linux/module.h> 14 #include <linux/netlink.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter/nf_tables.h> 17 #include <net/netfilter/nf_tables_core.h> 18 #include <net/netfilter/nf_tables.h> 19 20 void nft_immediate_eval(const struct nft_expr *expr, 21 struct nft_regs *regs, 22 const struct nft_pktinfo *pkt) 23 { 24 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 25 26 nft_data_copy(®s->data[priv->dreg], &priv->data, priv->dlen); 27 } 28 29 static const struct nla_policy nft_immediate_policy[NFTA_IMMEDIATE_MAX + 1] = { 30 [NFTA_IMMEDIATE_DREG] = { .type = NLA_U32 }, 31 [NFTA_IMMEDIATE_DATA] = { .type = NLA_NESTED }, 32 }; 33 34 static int nft_immediate_init(const struct nft_ctx *ctx, 35 const struct nft_expr *expr, 36 const struct nlattr * const tb[]) 37 { 38 struct nft_immediate_expr *priv = nft_expr_priv(expr); 39 struct nft_data_desc desc; 40 int err; 41 42 if (tb[NFTA_IMMEDIATE_DREG] == NULL || 43 tb[NFTA_IMMEDIATE_DATA] == NULL) 44 return -EINVAL; 45 46 err = nft_data_init(ctx, &priv->data, sizeof(priv->data), &desc, 47 tb[NFTA_IMMEDIATE_DATA]); 48 if (err < 0) 49 return err; 50 51 priv->dlen = desc.len; 52 53 priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]); 54 err = nft_validate_register_store(ctx, priv->dreg, &priv->data, 55 desc.type, desc.len); 56 if (err < 0) 57 goto err1; 58 59 return 0; 60 61 err1: 62 nft_data_release(&priv->data, desc.type); 63 return err; 64 } 65 66 static void nft_immediate_activate(const struct nft_ctx *ctx, 67 const struct nft_expr *expr) 68 { 69 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 70 71 return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg)); 72 } 73 74 static void nft_immediate_deactivate(const struct nft_ctx *ctx, 75 const struct nft_expr *expr, 76 enum nft_trans_phase phase) 77 { 78 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 79 80 if (phase == NFT_TRANS_COMMIT) 81 return; 82 83 return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg)); 84 } 85 86 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr) 87 { 88 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 89 90 if (nft_dump_register(skb, NFTA_IMMEDIATE_DREG, priv->dreg)) 91 goto nla_put_failure; 92 93 return nft_data_dump(skb, NFTA_IMMEDIATE_DATA, &priv->data, 94 nft_dreg_to_type(priv->dreg), priv->dlen); 95 96 nla_put_failure: 97 return -1; 98 } 99 100 static int nft_immediate_validate(const struct nft_ctx *ctx, 101 const struct nft_expr *expr, 102 const struct nft_data **d) 103 { 104 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 105 struct nft_ctx *pctx = (struct nft_ctx *)ctx; 106 const struct nft_data *data; 107 int err; 108 109 if (priv->dreg != NFT_REG_VERDICT) 110 return 0; 111 112 data = &priv->data; 113 114 switch (data->verdict.code) { 115 case NFT_JUMP: 116 case NFT_GOTO: 117 pctx->level++; 118 err = nft_chain_validate(ctx, data->verdict.chain); 119 if (err < 0) 120 return err; 121 pctx->level--; 122 break; 123 default: 124 break; 125 } 126 127 return 0; 128 } 129 130 static const struct nft_expr_ops nft_imm_ops = { 131 .type = &nft_imm_type, 132 .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)), 133 .eval = nft_immediate_eval, 134 .init = nft_immediate_init, 135 .activate = nft_immediate_activate, 136 .deactivate = nft_immediate_deactivate, 137 .dump = nft_immediate_dump, 138 .validate = nft_immediate_validate, 139 }; 140 141 struct nft_expr_type nft_imm_type __read_mostly = { 142 .name = "immediate", 143 .ops = &nft_imm_ops, 144 .policy = nft_immediate_policy, 145 .maxattr = NFTA_IMMEDIATE_MAX, 146 .owner = THIS_MODULE, 147 }; 148