Blame view
net/netfilter/nft_lookup.c
3.8 KB
20a69341f
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
/* * Copyright (c) 2009 Patrick McHardy <kaber@trash.net> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. * * Development of this code funded by Astaro AG (http://www.astaro.com/) */ #include <linux/kernel.h> #include <linux/init.h> #include <linux/list.h> #include <linux/rbtree.h> #include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/netfilter/nf_tables.h> #include <net/netfilter/nf_tables.h> |
bd76ed36b
|
19 |
#include <net/netfilter/nf_tables_core.h> |
20a69341f
|
20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 |
struct nft_lookup { struct nft_set *set; enum nft_registers sreg:8; enum nft_registers dreg:8; struct nft_set_binding binding; }; static void nft_lookup_eval(const struct nft_expr *expr, struct nft_data data[NFT_REG_MAX + 1], const struct nft_pktinfo *pkt) { const struct nft_lookup *priv = nft_expr_priv(expr); const struct nft_set *set = priv->set; if (set->ops->lookup(set, &data[priv->sreg], &data[priv->dreg])) return; data[NFT_REG_VERDICT].verdict = NFT_BREAK; } static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = { [NFTA_LOOKUP_SET] = { .type = NLA_STRING }, [NFTA_LOOKUP_SREG] = { .type = NLA_U32 }, [NFTA_LOOKUP_DREG] = { .type = NLA_U32 }, }; static int nft_lookup_init(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nlattr * const tb[]) { struct nft_lookup *priv = nft_expr_priv(expr); struct nft_set *set; int err; if (tb[NFTA_LOOKUP_SET] == NULL || tb[NFTA_LOOKUP_SREG] == NULL) return -EINVAL; set = nf_tables_set_lookup(ctx->table, tb[NFTA_LOOKUP_SET]); |
958bee14d
|
59 60 61 62 63 64 65 66 |
if (IS_ERR(set)) { if (tb[NFTA_LOOKUP_SET_ID]) { set = nf_tables_set_lookup_byid(ctx->net, tb[NFTA_LOOKUP_SET_ID]); } if (IS_ERR(set)) return PTR_ERR(set); } |
20a69341f
|
67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 |
priv->sreg = ntohl(nla_get_be32(tb[NFTA_LOOKUP_SREG])); err = nft_validate_input_register(priv->sreg); if (err < 0) return err; if (tb[NFTA_LOOKUP_DREG] != NULL) { if (!(set->flags & NFT_SET_MAP)) return -EINVAL; priv->dreg = ntohl(nla_get_be32(tb[NFTA_LOOKUP_DREG])); err = nft_validate_output_register(priv->dreg); if (err < 0) return err; if (priv->dreg == NFT_REG_VERDICT) { if (set->dtype != NFT_DATA_VERDICT) return -EINVAL; } else if (set->dtype == NFT_DATA_VERDICT) return -EINVAL; } else if (set->flags & NFT_SET_MAP) return -EINVAL; err = nf_tables_bind_set(ctx, set, &priv->binding); if (err < 0) return err; priv->set = set; return 0; } |
62472bcef
|
97 98 |
static void nft_lookup_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
20a69341f
|
99 100 |
{ struct nft_lookup *priv = nft_expr_priv(expr); |
ab9da5c19
|
101 |
nf_tables_unbind_set(ctx, priv->set, &priv->binding); |
20a69341f
|
102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 |
} static int nft_lookup_dump(struct sk_buff *skb, const struct nft_expr *expr) { const struct nft_lookup *priv = nft_expr_priv(expr); if (nla_put_string(skb, NFTA_LOOKUP_SET, priv->set->name)) goto nla_put_failure; if (nla_put_be32(skb, NFTA_LOOKUP_SREG, htonl(priv->sreg))) goto nla_put_failure; if (priv->set->flags & NFT_SET_MAP) if (nla_put_be32(skb, NFTA_LOOKUP_DREG, htonl(priv->dreg))) goto nla_put_failure; return 0; nla_put_failure: return -1; } |
ef1f7df91
|
120 121 122 |
static struct nft_expr_type nft_lookup_type; static const struct nft_expr_ops nft_lookup_ops = { .type = &nft_lookup_type, |
20a69341f
|
123 |
.size = NFT_EXPR_SIZE(sizeof(struct nft_lookup)), |
20a69341f
|
124 125 126 127 |
.eval = nft_lookup_eval, .init = nft_lookup_init, .destroy = nft_lookup_destroy, .dump = nft_lookup_dump, |
ef1f7df91
|
128 129 130 131 132 |
}; static struct nft_expr_type nft_lookup_type __read_mostly = { .name = "lookup", .ops = &nft_lookup_ops, |
20a69341f
|
133 134 |
.policy = nft_lookup_policy, .maxattr = NFTA_LOOKUP_MAX, |
ef1f7df91
|
135 |
.owner = THIS_MODULE, |
20a69341f
|
136 137 138 139 |
}; int __init nft_lookup_module_init(void) { |
ef1f7df91
|
140 |
return nft_register_expr(&nft_lookup_type); |
20a69341f
|
141 142 143 144 |
} void nft_lookup_module_exit(void) { |
ef1f7df91
|
145 |
nft_unregister_expr(&nft_lookup_type); |
20a69341f
|
146 |
} |