1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only 20f3cd9b3SPablo Neira Ayuso /* 30f3cd9b3SPablo Neira Ayuso * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org> 40f3cd9b3SPablo Neira Ayuso */ 50f3cd9b3SPablo Neira Ayuso 60f3cd9b3SPablo Neira Ayuso #include <linux/kernel.h> 70f3cd9b3SPablo Neira Ayuso #include <linux/init.h> 80f3cd9b3SPablo Neira Ayuso #include <linux/module.h> 90f3cd9b3SPablo Neira Ayuso #include <linux/netlink.h> 100f3cd9b3SPablo Neira Ayuso #include <linux/netfilter.h> 110f3cd9b3SPablo Neira Ayuso #include <linux/netfilter/nf_tables.h> 120f3cd9b3SPablo Neira Ayuso #include <net/netfilter/nf_tables_core.h> 130f3cd9b3SPablo Neira Ayuso #include <net/netfilter/nf_tables.h> 140f3cd9b3SPablo Neira Ayuso 150f3cd9b3SPablo Neira Ayuso struct nft_range_expr { 160f3cd9b3SPablo Neira Ayuso struct nft_data data_from; 170f3cd9b3SPablo Neira Ayuso struct nft_data data_to; 180f3cd9b3SPablo Neira Ayuso enum nft_registers sreg:8; 190f3cd9b3SPablo Neira Ayuso u8 len; 200f3cd9b3SPablo Neira Ayuso enum nft_range_ops op:8; 210f3cd9b3SPablo Neira Ayuso }; 220f3cd9b3SPablo Neira Ayuso 2310870dd8SFlorian Westphal void nft_range_eval(const struct nft_expr *expr, 2410870dd8SFlorian Westphal struct nft_regs *regs, const struct nft_pktinfo *pkt) 250f3cd9b3SPablo Neira Ayuso { 260f3cd9b3SPablo Neira Ayuso const struct nft_range_expr *priv = nft_expr_priv(expr); 270f3cd9b3SPablo Neira Ayuso int d1, d2; 280f3cd9b3SPablo Neira Ayuso 290f3cd9b3SPablo Neira Ayuso d1 = memcmp(®s->data[priv->sreg], &priv->data_from, priv->len); 300f3cd9b3SPablo Neira Ayuso d2 = memcmp(®s->data[priv->sreg], &priv->data_to, priv->len); 310f3cd9b3SPablo Neira Ayuso switch (priv->op) { 320f3cd9b3SPablo Neira Ayuso case NFT_RANGE_EQ: 33d2e4d593SArnd Bergmann if (d1 < 0 || d2 > 0) 34d2e4d593SArnd Bergmann regs->verdict.code = NFT_BREAK; 350f3cd9b3SPablo Neira Ayuso break; 360f3cd9b3SPablo Neira Ayuso case NFT_RANGE_NEQ: 37d2e4d593SArnd Bergmann if (d1 >= 0 && d2 <= 0) 38d2e4d593SArnd Bergmann regs->verdict.code = NFT_BREAK; 390f3cd9b3SPablo Neira Ayuso break; 400f3cd9b3SPablo Neira Ayuso } 410f3cd9b3SPablo Neira Ayuso } 420f3cd9b3SPablo Neira Ayuso 430f3cd9b3SPablo Neira Ayuso static const struct nla_policy nft_range_policy[NFTA_RANGE_MAX + 1] = { 440f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_SREG] = { .type = NLA_U32 }, 450f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_OP] = { .type = NLA_U32 }, 460f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_FROM_DATA] = { .type = NLA_NESTED }, 470f3cd9b3SPablo Neira Ayuso [NFTA_RANGE_TO_DATA] = { .type = NLA_NESTED }, 480f3cd9b3SPablo Neira Ayuso }; 490f3cd9b3SPablo Neira Ayuso 500f3cd9b3SPablo Neira Ayuso static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 510f3cd9b3SPablo Neira Ayuso const struct nlattr * const tb[]) 520f3cd9b3SPablo Neira Ayuso { 530f3cd9b3SPablo Neira Ayuso struct nft_range_expr *priv = nft_expr_priv(expr); 540f3cd9b3SPablo Neira Ayuso struct nft_data_desc desc_from, desc_to; 550f3cd9b3SPablo Neira Ayuso int err; 56ccca6607SPablo Neira Ayuso u32 op; 570f3cd9b3SPablo Neira Ayuso 5849cdc4c7SLiping Zhang if (!tb[NFTA_RANGE_SREG] || 5949cdc4c7SLiping Zhang !tb[NFTA_RANGE_OP] || 6049cdc4c7SLiping Zhang !tb[NFTA_RANGE_FROM_DATA] || 6149cdc4c7SLiping Zhang !tb[NFTA_RANGE_TO_DATA]) 6249cdc4c7SLiping Zhang return -EINVAL; 6349cdc4c7SLiping Zhang 640f3cd9b3SPablo Neira Ayuso err = nft_data_init(NULL, &priv->data_from, sizeof(priv->data_from), 650f3cd9b3SPablo Neira Ayuso &desc_from, tb[NFTA_RANGE_FROM_DATA]); 660f3cd9b3SPablo Neira Ayuso if (err < 0) 670f3cd9b3SPablo Neira Ayuso return err; 680f3cd9b3SPablo Neira Ayuso 690f3cd9b3SPablo Neira Ayuso err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to), 700f3cd9b3SPablo Neira Ayuso &desc_to, tb[NFTA_RANGE_TO_DATA]); 710f3cd9b3SPablo Neira Ayuso if (err < 0) 720f3cd9b3SPablo Neira Ayuso goto err1; 730f3cd9b3SPablo Neira Ayuso 740f3cd9b3SPablo Neira Ayuso if (desc_from.len != desc_to.len) { 750f3cd9b3SPablo Neira Ayuso err = -EINVAL; 760f3cd9b3SPablo Neira Ayuso goto err2; 770f3cd9b3SPablo Neira Ayuso } 780f3cd9b3SPablo Neira Ayuso 790f3cd9b3SPablo Neira Ayuso priv->sreg = nft_parse_register(tb[NFTA_RANGE_SREG]); 800f3cd9b3SPablo Neira Ayuso err = nft_validate_register_load(priv->sreg, desc_from.len); 810f3cd9b3SPablo Neira Ayuso if (err < 0) 820f3cd9b3SPablo Neira Ayuso goto err2; 830f3cd9b3SPablo Neira Ayuso 84ccca6607SPablo Neira Ayuso err = nft_parse_u32_check(tb[NFTA_RANGE_OP], U8_MAX, &op); 85ccca6607SPablo Neira Ayuso if (err < 0) 86ccca6607SPablo Neira Ayuso goto err2; 87ccca6607SPablo Neira Ayuso 88ccca6607SPablo Neira Ayuso switch (op) { 89ccca6607SPablo Neira Ayuso case NFT_RANGE_EQ: 90ccca6607SPablo Neira Ayuso case NFT_RANGE_NEQ: 91ccca6607SPablo Neira Ayuso break; 92ccca6607SPablo Neira Ayuso default: 93ccca6607SPablo Neira Ayuso err = -EINVAL; 94ccca6607SPablo Neira Ayuso goto err2; 95ccca6607SPablo Neira Ayuso } 96ccca6607SPablo Neira Ayuso 97ccca6607SPablo Neira Ayuso priv->op = op; 980f3cd9b3SPablo Neira Ayuso priv->len = desc_from.len; 990f3cd9b3SPablo Neira Ayuso return 0; 1000f3cd9b3SPablo Neira Ayuso err2: 10159105446SPablo Neira Ayuso nft_data_release(&priv->data_to, desc_to.type); 1020f3cd9b3SPablo Neira Ayuso err1: 10359105446SPablo Neira Ayuso nft_data_release(&priv->data_from, desc_from.type); 1040f3cd9b3SPablo Neira Ayuso return err; 1050f3cd9b3SPablo Neira Ayuso } 1060f3cd9b3SPablo Neira Ayuso 1070f3cd9b3SPablo Neira Ayuso static int nft_range_dump(struct sk_buff *skb, const struct nft_expr *expr) 1080f3cd9b3SPablo Neira Ayuso { 1090f3cd9b3SPablo Neira Ayuso const struct nft_range_expr *priv = nft_expr_priv(expr); 1100f3cd9b3SPablo Neira Ayuso 1110f3cd9b3SPablo Neira Ayuso if (nft_dump_register(skb, NFTA_RANGE_SREG, priv->sreg)) 1120f3cd9b3SPablo Neira Ayuso goto nla_put_failure; 1130f3cd9b3SPablo Neira Ayuso if (nla_put_be32(skb, NFTA_RANGE_OP, htonl(priv->op))) 1140f3cd9b3SPablo Neira Ayuso goto nla_put_failure; 1150f3cd9b3SPablo Neira Ayuso 1160f3cd9b3SPablo Neira Ayuso if (nft_data_dump(skb, NFTA_RANGE_FROM_DATA, &priv->data_from, 1170f3cd9b3SPablo Neira Ayuso NFT_DATA_VALUE, priv->len) < 0 || 1180f3cd9b3SPablo Neira Ayuso nft_data_dump(skb, NFTA_RANGE_TO_DATA, &priv->data_to, 1190f3cd9b3SPablo Neira Ayuso NFT_DATA_VALUE, priv->len) < 0) 1200f3cd9b3SPablo Neira Ayuso goto nla_put_failure; 1210f3cd9b3SPablo Neira Ayuso return 0; 1220f3cd9b3SPablo Neira Ayuso 1230f3cd9b3SPablo Neira Ayuso nla_put_failure: 1240f3cd9b3SPablo Neira Ayuso return -1; 1250f3cd9b3SPablo Neira Ayuso } 1260f3cd9b3SPablo Neira Ayuso 1270f3cd9b3SPablo Neira Ayuso static const struct nft_expr_ops nft_range_ops = { 1280f3cd9b3SPablo Neira Ayuso .type = &nft_range_type, 1290f3cd9b3SPablo Neira Ayuso .size = NFT_EXPR_SIZE(sizeof(struct nft_range_expr)), 1300f3cd9b3SPablo Neira Ayuso .eval = nft_range_eval, 1310f3cd9b3SPablo Neira Ayuso .init = nft_range_init, 1320f3cd9b3SPablo Neira Ayuso .dump = nft_range_dump, 1330f3cd9b3SPablo Neira Ayuso }; 1340f3cd9b3SPablo Neira Ayuso 1354e24877eSLiping Zhang struct nft_expr_type nft_range_type __read_mostly = { 1360f3cd9b3SPablo Neira Ayuso .name = "range", 1370f3cd9b3SPablo Neira Ayuso .ops = &nft_range_ops, 1380f3cd9b3SPablo Neira Ayuso .policy = nft_range_policy, 1390f3cd9b3SPablo Neira Ayuso .maxattr = NFTA_RANGE_MAX, 1400f3cd9b3SPablo Neira Ayuso .owner = THIS_MODULE, 1410f3cd9b3SPablo Neira Ayuso }; 142