10f3cd9b3SPablo Neira Ayuso /* 20f3cd9b3SPablo Neira Ayuso * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org> 30f3cd9b3SPablo Neira Ayuso * 40f3cd9b3SPablo Neira Ayuso * This program is free software; you can redistribute it and/or modify 50f3cd9b3SPablo Neira Ayuso * it under the terms of the GNU General Public License version 2 as 60f3cd9b3SPablo Neira Ayuso * published by the Free Software Foundation. 70f3cd9b3SPablo Neira Ayuso */ 80f3cd9b3SPablo Neira Ayuso 90f3cd9b3SPablo Neira Ayuso #include <linux/kernel.h> 100f3cd9b3SPablo Neira Ayuso #include <linux/init.h> 110f3cd9b3SPablo Neira Ayuso #include <linux/module.h> 120f3cd9b3SPablo Neira Ayuso #include <linux/netlink.h> 130f3cd9b3SPablo Neira Ayuso #include <linux/netfilter.h> 140f3cd9b3SPablo Neira Ayuso #include <linux/netfilter/nf_tables.h> 150f3cd9b3SPablo Neira Ayuso #include <net/netfilter/nf_tables_core.h> 160f3cd9b3SPablo Neira Ayuso #include <net/netfilter/nf_tables.h> 170f3cd9b3SPablo Neira Ayuso 180f3cd9b3SPablo Neira Ayuso struct nft_range_expr { 190f3cd9b3SPablo Neira Ayuso struct nft_data data_from; 200f3cd9b3SPablo Neira Ayuso struct nft_data data_to; 210f3cd9b3SPablo Neira Ayuso enum nft_registers sreg:8; 220f3cd9b3SPablo Neira Ayuso u8 len; 230f3cd9b3SPablo Neira Ayuso enum nft_range_ops op:8; 240f3cd9b3SPablo Neira Ayuso }; 250f3cd9b3SPablo Neira Ayuso 260f3cd9b3SPablo Neira Ayuso static void nft_range_eval(const struct nft_expr *expr, 270f3cd9b3SPablo Neira Ayuso struct nft_regs *regs, 280f3cd9b3SPablo Neira Ayuso const struct nft_pktinfo *pkt) 290f3cd9b3SPablo Neira Ayuso { 300f3cd9b3SPablo Neira Ayuso const struct nft_range_expr *priv = nft_expr_priv(expr); 310f3cd9b3SPablo Neira Ayuso bool mismatch; 320f3cd9b3SPablo Neira Ayuso int d1, d2; 330f3cd9b3SPablo Neira Ayuso 340f3cd9b3SPablo Neira Ayuso d1 = memcmp(®s->data[priv->sreg], &priv->data_from, priv->len); 350f3cd9b3SPablo Neira Ayuso d2 = memcmp(®s->data[priv->sreg], &priv->data_to, priv->len); 360f3cd9b3SPablo Neira Ayuso switch (priv->op) { 370f3cd9b3SPablo Neira Ayuso case NFT_RANGE_EQ: 380f3cd9b3SPablo Neira Ayuso mismatch = (d1 < 0 || d2 > 0); 390f3cd9b3SPablo Neira Ayuso break; 400f3cd9b3SPablo Neira Ayuso case NFT_RANGE_NEQ: 410f3cd9b3SPablo Neira Ayuso mismatch = (d1 >= 0 && d2 <= 0); 420f3cd9b3SPablo Neira Ayuso break; 430f3cd9b3SPablo Neira Ayuso } 440f3cd9b3SPablo Neira Ayuso 450f3cd9b3SPablo Neira Ayuso if (mismatch) 460f3cd9b3SPablo Neira Ayuso regs->verdict.code = NFT_BREAK; 470f3cd9b3SPablo Neira Ayuso } 480f3cd9b3SPablo Neira Ayuso 490f3cd9b3SPablo Neira Ayuso static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = { 500f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_SREG] = { .type = NLA_U32 }, 510f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_OP] = { .type = NLA_U32 }, 520f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED }, 530f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED }, 540f3cd9b3SPablo Neira Ayuso }; 550f3cd9b3SPablo Neira Ayuso 560f3cd9b3SPablo Neira Ayuso static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 570f3cd9b3SPablo Neira Ayuso const struct nlattr * const tb[]) 580f3cd9b3SPablo Neira Ayuso { 590f3cd9b3SPablo Neira Ayuso struct nft_range_expr *priv = nft_expr_priv(expr); 600f3cd9b3SPablo Neira Ayuso struct nft_data_desc desc_from, desc_to; 610f3cd9b3SPablo Neira Ayuso int err; 620f3cd9b3SPablo Neira Ayuso 630f3cd9b3SPablo Neira Ayuso err = nft_data_init(NULL, &priv->data_from, sizeof(priv->data_from), 640f3cd9b3SPablo Neira Ayuso &desc_from, tb[NFTA_RANGE_FROM_DATA]); 650f3cd9b3SPablo Neira Ayuso if (err < 0) 660f3cd9b3SPablo Neira Ayuso return err; 670f3cd9b3SPablo Neira Ayuso 680f3cd9b3SPablo Neira Ayuso err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to), 690f3cd9b3SPablo Neira Ayuso &desc_to, tb[NFTA_RANGE_TO_DATA]); 700f3cd9b3SPablo Neira Ayuso if (err < 0) 710f3cd9b3SPablo Neira Ayuso goto err1; 720f3cd9b3SPablo Neira Ayuso 730f3cd9b3SPablo Neira Ayuso if (desc_from.len != desc_to.len) { 740f3cd9b3SPablo Neira Ayuso err = -EINVAL; 750f3cd9b3SPablo Neira Ayuso goto err2; 760f3cd9b3SPablo Neira Ayuso } 770f3cd9b3SPablo Neira Ayuso 780f3cd9b3SPablo Neira Ayuso priv->sreg = nft_parse_register(tb[NFTA_RANGE_SREG]); 790f3cd9b3SPablo Neira Ayuso err = nft_validate_register_load(priv->sreg, desc_from.len); 800f3cd9b3SPablo Neira Ayuso if (err < 0) 810f3cd9b3SPablo Neira Ayuso goto err2; 820f3cd9b3SPablo Neira Ayuso 830f3cd9b3SPablo Neira Ayuso priv->op = ntohl(nla_get_be32(tb[NFTA_RANGE_OP])); 840f3cd9b3SPablo Neira Ayuso priv->len = desc_from.len; 850f3cd9b3SPablo Neira Ayuso return 0; 860f3cd9b3SPablo Neira Ayuso err2: 870f3cd9b3SPablo Neira Ayuso nft_data_uninit(&priv->data_to, desc_to.type); 880f3cd9b3SPablo Neira Ayuso err1: 890f3cd9b3SPablo Neira Ayuso nft_data_uninit(&priv->data_from, desc_from.type); 900f3cd9b3SPablo Neira Ayuso return err; 910f3cd9b3SPablo Neira Ayuso } 920f3cd9b3SPablo Neira Ayuso 930f3cd9b3SPablo Neira Ayuso static int nft_range_dump(struct sk_buff *skb, const struct nft_expr *expr) 940f3cd9b3SPablo Neira Ayuso { 950f3cd9b3SPablo Neira Ayuso const struct nft_range_expr *priv = nft_expr_priv(expr); 960f3cd9b3SPablo Neira Ayuso 970f3cd9b3SPablo Neira Ayuso if (nft_dump_register(skb, NFTA_RANGE_SREG, priv->sreg)) 980f3cd9b3SPablo Neira Ayuso goto nla_put_failure; 990f3cd9b3SPablo Neira Ayuso if (nla_put_be32(skb, NFTA_RANGE_OP, htonl(priv->op))) 1000f3cd9b3SPablo Neira Ayuso goto nla_put_failure; 1010f3cd9b3SPablo Neira Ayuso 1020f3cd9b3SPablo Neira Ayuso if (nft_data_dump(skb, NFTA_RANGE_FROM_DATA, &priv->data_from, 1030f3cd9b3SPablo Neira Ayuso NFT_DATA_VALUE, priv->len) < 0 || 1040f3cd9b3SPablo Neira Ayuso nft_data_dump(skb, NFTA_RANGE_TO_DATA, &priv->data_to, 1050f3cd9b3SPablo Neira Ayuso NFT_DATA_VALUE, priv->len) < 0) 1060f3cd9b3SPablo Neira Ayuso goto nla_put_failure; 1070f3cd9b3SPablo Neira Ayuso return 0; 1080f3cd9b3SPablo Neira Ayuso 1090f3cd9b3SPablo Neira Ayuso nla_put_failure: 1100f3cd9b3SPablo Neira Ayuso return -1; 1110f3cd9b3SPablo Neira Ayuso } 1120f3cd9b3SPablo Neira Ayuso 1130f3cd9b3SPablo Neira Ayuso static struct nft_expr_type nft_range_type; 1140f3cd9b3SPablo Neira Ayuso static const struct nft_expr_ops nft_range_ops = { 1150f3cd9b3SPablo Neira Ayuso .type = &nft_range_type, 1160f3cd9b3SPablo Neira Ayuso .size = NFT_EXPR_SIZE(sizeof(struct nft_range_expr)), 1170f3cd9b3SPablo Neira Ayuso .eval = nft_range_eval, 1180f3cd9b3SPablo Neira Ayuso .init = nft_range_init, 1190f3cd9b3SPablo Neira Ayuso .dump = nft_range_dump, 1200f3cd9b3SPablo Neira Ayuso }; 1210f3cd9b3SPablo Neira Ayuso 1220f3cd9b3SPablo Neira Ayuso static struct nft_expr_type nft_range_type __read_mostly = { 1230f3cd9b3SPablo Neira Ayuso .name = "range", 1240f3cd9b3SPablo Neira Ayuso .ops = &nft_range_ops, 1250f3cd9b3SPablo Neira Ayuso .policy = nft_range_policy, 1260f3cd9b3SPablo Neira Ayuso .maxattr = NFTA_RANGE_MAX, 1270f3cd9b3SPablo Neira Ayuso .owner = THIS_MODULE, 1280f3cd9b3SPablo Neira Ayuso }; 1290f3cd9b3SPablo Neira Ayuso 1300f3cd9b3SPablo Neira Ayuso int __init nft_range_module_init(void) 1310f3cd9b3SPablo Neira Ayuso { 1320f3cd9b3SPablo Neira Ayuso return nft_register_expr(&nft_range_type); 1330f3cd9b3SPablo Neira Ayuso } 1340f3cd9b3SPablo Neira Ayuso 1350f3cd9b3SPablo Neira Ayuso void nft_range_module_exit(void) 1360f3cd9b3SPablo Neira Ayuso { 1370f3cd9b3SPablo Neira Ayuso nft_unregister_expr(&nft_range_type); 1380f3cd9b3SPablo Neira Ayuso } 139