1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2016 Laura Garcia <nevola@gmail.com> 4 */ 5 6 #include <linux/kernel.h> 7 #include <linux/init.h> 8 #include <linux/module.h> 9 #include <linux/netlink.h> 10 #include <linux/netfilter.h> 11 #include <linux/netfilter/nf_tables.h> 12 #include <linux/static_key.h> 13 #include <net/netfilter/nf_tables.h> 14 #include <net/netfilter/nf_tables_core.h> 15 16 static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state); 17 18 struct nft_ng_inc { 19 enum nft_registers dreg:8; 20 u32 modulus; 21 atomic_t counter; 22 u32 offset; 23 }; 24 25 static u32 nft_ng_inc_gen(struct nft_ng_inc *priv) 26 { 27 u32 nval, oval; 28 29 do { 30 oval = atomic_read(&priv->counter); 31 nval = (oval + 1 < priv->modulus) ? oval + 1 : 0; 32 } while (atomic_cmpxchg(&priv->counter, oval, nval) != oval); 33 34 return nval + priv->offset; 35 } 36 37 static void nft_ng_inc_eval(const struct nft_expr *expr, 38 struct nft_regs *regs, 39 const struct nft_pktinfo *pkt) 40 { 41 struct nft_ng_inc *priv = nft_expr_priv(expr); 42 43 regs->data[priv->dreg] = nft_ng_inc_gen(priv); 44 } 45 46 static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = { 47 [NFTA_NG_DREG] = { .type = NLA_U32 }, 48 [NFTA_NG_MODULUS] = { .type = NLA_U32 }, 49 [NFTA_NG_TYPE] = { .type = NLA_U32 }, 50 [NFTA_NG_OFFSET] = { .type = NLA_U32 }, 51 }; 52 53 static int nft_ng_inc_init(const struct nft_ctx *ctx, 54 const struct nft_expr *expr, 55 const struct nlattr * const tb[]) 56 { 57 struct nft_ng_inc *priv = nft_expr_priv(expr); 58 59 if (tb[NFTA_NG_OFFSET]) 60 priv->offset = ntohl(nla_get_be32(tb[NFTA_NG_OFFSET])); 61 62 priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS])); 63 if (priv->modulus == 0) 64 return -ERANGE; 65 66 if (priv->offset + priv->modulus - 1 < priv->offset) 67 return -EOVERFLOW; 68 69 priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]); 70 atomic_set(&priv->counter, priv->modulus - 1); 71 72 return nft_validate_register_store(ctx, priv->dreg, NULL, 73 NFT_DATA_VALUE, sizeof(u32)); 74 } 75 76 static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg, 77 u32 modulus, enum nft_ng_types type, u32 offset) 78 { 79 if (nft_dump_register(skb, NFTA_NG_DREG, dreg)) 80 goto nla_put_failure; 81 if (nla_put_be32(skb, NFTA_NG_MODULUS, htonl(modulus))) 82 goto nla_put_failure; 83 if (nla_put_be32(skb, NFTA_NG_TYPE, htonl(type))) 84 goto nla_put_failure; 85 if (nla_put_be32(skb, NFTA_NG_OFFSET, htonl(offset))) 86 goto nla_put_failure; 87 88 return 0; 89 90 nla_put_failure: 91 return -1; 92 } 93 94 static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr) 95 { 96 const struct nft_ng_inc *priv = nft_expr_priv(expr); 97 98 return nft_ng_dump(skb, priv->dreg, priv->modulus, NFT_NG_INCREMENTAL, 99 priv->offset); 100 } 101 102 struct nft_ng_random { 103 enum nft_registers dreg:8; 104 u32 modulus; 105 u32 offset; 106 }; 107 108 static u32 nft_ng_random_gen(struct nft_ng_random *priv) 109 { 110 struct rnd_state *state = this_cpu_ptr(&nft_numgen_prandom_state); 111 112 return reciprocal_scale(prandom_u32_state(state), priv->modulus) + 113 priv->offset; 114 } 115 116 static void nft_ng_random_eval(const struct nft_expr *expr, 117 struct nft_regs *regs, 118 const struct nft_pktinfo *pkt) 119 { 120 struct nft_ng_random *priv = nft_expr_priv(expr); 121 122 regs->data[priv->dreg] = nft_ng_random_gen(priv); 123 } 124 125 static int nft_ng_random_init(const struct nft_ctx *ctx, 126 const struct nft_expr *expr, 127 const struct nlattr * const tb[]) 128 { 129 struct nft_ng_random *priv = nft_expr_priv(expr); 130 131 if (tb[NFTA_NG_OFFSET]) 132 priv->offset = ntohl(nla_get_be32(tb[NFTA_NG_OFFSET])); 133 134 priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS])); 135 if (priv->modulus == 0) 136 return -ERANGE; 137 138 if (priv->offset + priv->modulus - 1 < priv->offset) 139 return -EOVERFLOW; 140 141 prandom_init_once(&nft_numgen_prandom_state); 142 143 priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]); 144 145 return nft_validate_register_store(ctx, priv->dreg, NULL, 146 NFT_DATA_VALUE, sizeof(u32)); 147 } 148 149 static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) 150 { 151 const struct nft_ng_random *priv = nft_expr_priv(expr); 152 153 return nft_ng_dump(skb, priv->dreg, priv->modulus, NFT_NG_RANDOM, 154 priv->offset); 155 } 156 157 static struct nft_expr_type nft_ng_type; 158 static const struct nft_expr_ops nft_ng_inc_ops = { 159 .type = &nft_ng_type, 160 .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)), 161 .eval = nft_ng_inc_eval, 162 .init = nft_ng_inc_init, 163 .dump = nft_ng_inc_dump, 164 }; 165 166 static const struct nft_expr_ops nft_ng_random_ops = { 167 .type = &nft_ng_type, 168 .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), 169 .eval = nft_ng_random_eval, 170 .init = nft_ng_random_init, 171 .dump = nft_ng_random_dump, 172 }; 173 174 static const struct nft_expr_ops * 175 nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) 176 { 177 u32 type; 178 179 if (!tb[NFTA_NG_DREG] || 180 !tb[NFTA_NG_MODULUS] || 181 !tb[NFTA_NG_TYPE]) 182 return ERR_PTR(-EINVAL); 183 184 type = ntohl(nla_get_be32(tb[NFTA_NG_TYPE])); 185 186 switch (type) { 187 case NFT_NG_INCREMENTAL: 188 return &nft_ng_inc_ops; 189 case NFT_NG_RANDOM: 190 return &nft_ng_random_ops; 191 } 192 193 return ERR_PTR(-EINVAL); 194 } 195 196 static struct nft_expr_type nft_ng_type __read_mostly = { 197 .name = "numgen", 198 .select_ops = nft_ng_select_ops, 199 .policy = nft_ng_policy, 200 .maxattr = NFTA_NG_MAX, 201 .owner = THIS_MODULE, 202 }; 203 204 static int __init nft_ng_module_init(void) 205 { 206 return nft_register_expr(&nft_ng_type); 207 } 208 209 static void __exit nft_ng_module_exit(void) 210 { 211 nft_unregister_expr(&nft_ng_type); 212 } 213 214 module_init(nft_ng_module_init); 215 module_exit(nft_ng_module_exit); 216 217 MODULE_LICENSE("GPL"); 218 MODULE_AUTHOR("Laura Garcia <nevola@gmail.com>"); 219 MODULE_ALIAS_NFT_EXPR("numgen"); 220 MODULE_DESCRIPTION("nftables number generator module"); 221