1 /* 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * Development of this code funded by Astaro AG (http://www.astaro.com/) 9 */ 10 11 #include <linux/kernel.h> 12 #include <linux/init.h> 13 #include <linux/module.h> 14 #include <linux/netlink.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter/nf_tables.h> 17 #include <net/netfilter/nf_tables_core.h> 18 #include <net/netfilter/nf_tables.h> 19 20 static void nft_immediate_eval(const struct nft_expr *expr, 21 struct nft_regs *regs, 22 const struct nft_pktinfo *pkt) 23 { 24 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 25 26 nft_data_copy(®s->data[priv->dreg], &priv->data, priv->dlen); 27 } 28 29 static const struct nla_policy nft_immediate_policy[NFTA_IMMEDIATE_MAX + 1] = { 30 [NFTA_IMMEDIATE_DREG] = { .type = NLA_U32 }, 31 [NFTA_IMMEDIATE_DATA] = { .type = NLA_NESTED }, 32 }; 33 34 static int nft_immediate_init(const struct nft_ctx *ctx, 35 const struct nft_expr *expr, 36 const struct nlattr * const tb[]) 37 { 38 struct nft_immediate_expr *priv = nft_expr_priv(expr); 39 struct nft_data_desc desc; 40 int err; 41 42 if (tb[NFTA_IMMEDIATE_DREG] == NULL || 43 tb[NFTA_IMMEDIATE_DATA] == NULL) 44 return -EINVAL; 45 46 err = nft_data_init(ctx, &priv->data, sizeof(priv->data), &desc, 47 tb[NFTA_IMMEDIATE_DATA]); 48 if (err < 0) 49 return err; 50 51 priv->dlen = desc.len; 52 53 priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]); 54 err = nft_validate_register_store(ctx, priv->dreg, &priv->data, 55 desc.type, desc.len); 56 if (err < 0) 57 goto err1; 58 59 return 0; 60 61 err1: 62 nft_data_release(&priv->data, desc.type); 63 return err; 64 } 65 66 static void nft_immediate_activate(const struct nft_ctx *ctx, 67 const struct nft_expr *expr) 68 { 69 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 70 71 return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg)); 72 } 73 74 static void nft_immediate_deactivate(const struct nft_ctx *ctx, 75 const struct nft_expr *expr) 76 { 77 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 78 79 return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg)); 80 } 81 82 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr) 83 { 84 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 85 86 if (nft_dump_register(skb, NFTA_IMMEDIATE_DREG, priv->dreg)) 87 goto nla_put_failure; 88 89 return nft_data_dump(skb, NFTA_IMMEDIATE_DATA, &priv->data, 90 nft_dreg_to_type(priv->dreg), priv->dlen); 91 92 nla_put_failure: 93 return -1; 94 } 95 96 static int nft_immediate_validate(const struct nft_ctx *ctx, 97 const struct nft_expr *expr, 98 const struct nft_data **d) 99 { 100 const struct nft_immediate_expr *priv = nft_expr_priv(expr); 101 struct nft_ctx *pctx = (struct nft_ctx *)ctx; 102 const struct nft_data *data; 103 int err; 104 105 if (priv->dreg != NFT_REG_VERDICT) 106 return 0; 107 108 data = &priv->data; 109 110 switch (data->verdict.code) { 111 case NFT_JUMP: 112 case NFT_GOTO: 113 pctx->level++; 114 err = nft_chain_validate(ctx, data->verdict.chain); 115 if (err < 0) 116 return err; 117 pctx->level--; 118 break; 119 default: 120 break; 121 } 122 123 return 0; 124 } 125 126 static const struct nft_expr_ops nft_imm_ops = { 127 .type = &nft_imm_type, 128 .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)), 129 .eval = nft_immediate_eval, 130 .init = nft_immediate_init, 131 .activate = nft_immediate_activate, 132 .deactivate = nft_immediate_deactivate, 133 .dump = nft_immediate_dump, 134 .validate = nft_immediate_validate, 135 }; 136 137 struct nft_expr_type nft_imm_type __read_mostly = { 138 .name = "immediate", 139 .ops = &nft_imm_ops, 140 .policy = nft_immediate_policy, 141 .maxattr = NFTA_IMMEDIATE_MAX, 142 .owner = THIS_MODULE, 143 }; 144