2 * Copyright (c) 2015 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
10 #include <linux/kernel.h>
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/netlink.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_tables.h>
17 #include <net/netfilter/nf_tables_core.h>
21 struct nft_set_ext_tmpl tmpl
;
22 enum nft_dynset_ops op
:8;
23 enum nft_registers sreg_key
:8;
24 enum nft_registers sreg_data
:8;
27 struct nft_expr
*expr
;
28 struct nft_set_binding binding
;
31 static void *nft_dynset_new(struct nft_set
*set
, const struct nft_expr
*expr
,
32 struct nft_regs
*regs
)
34 const struct nft_dynset
*priv
= nft_expr_priv(expr
);
35 struct nft_set_ext
*ext
;
39 if (set
->size
&& !atomic_add_unless(&set
->nelems
, 1, set
->size
))
42 timeout
= priv
->timeout
? : set
->timeout
;
43 elem
= nft_set_elem_init(set
, &priv
->tmpl
,
44 ®s
->data
[priv
->sreg_key
],
45 ®s
->data
[priv
->sreg_data
],
49 atomic_dec(&set
->nelems
);
53 ext
= nft_set_elem_ext(set
, elem
);
54 if (priv
->expr
!= NULL
&&
55 nft_expr_clone(nft_set_ext_expr(ext
), priv
->expr
) < 0)
61 static void nft_dynset_eval(const struct nft_expr
*expr
,
62 struct nft_regs
*regs
,
63 const struct nft_pktinfo
*pkt
)
65 const struct nft_dynset
*priv
= nft_expr_priv(expr
);
66 struct nft_set
*set
= priv
->set
;
67 const struct nft_set_ext
*ext
;
68 const struct nft_expr
*sexpr
;
71 if (set
->ops
->update(set
, ®s
->data
[priv
->sreg_key
], nft_dynset_new
,
74 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPR
))
75 sexpr
= nft_set_ext_expr(ext
);
77 if (priv
->op
== NFT_DYNSET_OP_UPDATE
&&
78 nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
79 timeout
= priv
->timeout
? : set
->timeout
;
80 *nft_set_ext_expiration(ext
) = jiffies
+ timeout
;
81 } else if (sexpr
== NULL
)
85 sexpr
->ops
->eval(sexpr
, regs
, pkt
);
88 regs
->verdict
.code
= NFT_BREAK
;
93 regs
->verdict
.code
= NFT_BREAK
;
96 static const struct nla_policy nft_dynset_policy
[NFTA_DYNSET_MAX
+ 1] = {
97 [NFTA_DYNSET_SET_NAME
] = { .type
= NLA_STRING
},
98 [NFTA_DYNSET_SET_ID
] = { .type
= NLA_U32
},
99 [NFTA_DYNSET_OP
] = { .type
= NLA_U32
},
100 [NFTA_DYNSET_SREG_KEY
] = { .type
= NLA_U32
},
101 [NFTA_DYNSET_SREG_DATA
] = { .type
= NLA_U32
},
102 [NFTA_DYNSET_TIMEOUT
] = { .type
= NLA_U64
},
103 [NFTA_DYNSET_EXPR
] = { .type
= NLA_NESTED
},
104 [NFTA_DYNSET_FLAGS
] = { .type
= NLA_U32
},
107 static int nft_dynset_init(const struct nft_ctx
*ctx
,
108 const struct nft_expr
*expr
,
109 const struct nlattr
* const tb
[])
111 struct nft_dynset
*priv
= nft_expr_priv(expr
);
112 u8 genmask
= nft_genmask_next(ctx
->net
);
117 if (tb
[NFTA_DYNSET_SET_NAME
] == NULL
||
118 tb
[NFTA_DYNSET_OP
] == NULL
||
119 tb
[NFTA_DYNSET_SREG_KEY
] == NULL
)
122 if (tb
[NFTA_DYNSET_FLAGS
]) {
123 u32 flags
= ntohl(nla_get_be32(tb
[NFTA_DYNSET_FLAGS
]));
125 if (flags
& ~NFT_DYNSET_F_INV
)
127 if (flags
& NFT_DYNSET_F_INV
)
131 set
= nf_tables_set_lookup(ctx
->table
, tb
[NFTA_DYNSET_SET_NAME
],
134 if (tb
[NFTA_DYNSET_SET_ID
])
135 set
= nf_tables_set_lookup_byid(ctx
->net
,
136 tb
[NFTA_DYNSET_SET_ID
],
142 if (set
->flags
& NFT_SET_CONSTANT
)
145 priv
->op
= ntohl(nla_get_be32(tb
[NFTA_DYNSET_OP
]));
147 case NFT_DYNSET_OP_ADD
:
149 case NFT_DYNSET_OP_UPDATE
:
150 if (!(set
->flags
& NFT_SET_TIMEOUT
))
158 if (tb
[NFTA_DYNSET_TIMEOUT
] != NULL
) {
159 if (!(set
->flags
& NFT_SET_TIMEOUT
))
161 timeout
= be64_to_cpu(nla_get_be64(tb
[NFTA_DYNSET_TIMEOUT
]));
164 priv
->sreg_key
= nft_parse_register(tb
[NFTA_DYNSET_SREG_KEY
]);
165 err
= nft_validate_register_load(priv
->sreg_key
, set
->klen
);;
169 if (tb
[NFTA_DYNSET_SREG_DATA
] != NULL
) {
170 if (!(set
->flags
& NFT_SET_MAP
))
172 if (set
->dtype
== NFT_DATA_VERDICT
)
175 priv
->sreg_data
= nft_parse_register(tb
[NFTA_DYNSET_SREG_DATA
]);
176 err
= nft_validate_register_load(priv
->sreg_data
, set
->dlen
);
179 } else if (set
->flags
& NFT_SET_MAP
)
182 if (tb
[NFTA_DYNSET_EXPR
] != NULL
) {
183 if (!(set
->flags
& NFT_SET_EVAL
))
185 if (!(set
->flags
& NFT_SET_ANONYMOUS
))
188 priv
->expr
= nft_expr_init(ctx
, tb
[NFTA_DYNSET_EXPR
]);
189 if (IS_ERR(priv
->expr
))
190 return PTR_ERR(priv
->expr
);
193 if (!(priv
->expr
->ops
->type
->flags
& NFT_EXPR_STATEFUL
))
195 } else if (set
->flags
& NFT_SET_EVAL
)
198 nft_set_ext_prepare(&priv
->tmpl
);
199 nft_set_ext_add_length(&priv
->tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
200 if (set
->flags
& NFT_SET_MAP
)
201 nft_set_ext_add_length(&priv
->tmpl
, NFT_SET_EXT_DATA
, set
->dlen
);
202 if (priv
->expr
!= NULL
)
203 nft_set_ext_add_length(&priv
->tmpl
, NFT_SET_EXT_EXPR
,
204 priv
->expr
->ops
->size
);
205 if (set
->flags
& NFT_SET_TIMEOUT
) {
206 if (timeout
|| set
->timeout
)
207 nft_set_ext_add(&priv
->tmpl
, NFT_SET_EXT_EXPIRATION
);
210 priv
->timeout
= timeout
;
212 err
= nf_tables_bind_set(ctx
, set
, &priv
->binding
);
220 if (priv
->expr
!= NULL
)
221 nft_expr_destroy(ctx
, priv
->expr
);
225 static void nft_dynset_destroy(const struct nft_ctx
*ctx
,
226 const struct nft_expr
*expr
)
228 struct nft_dynset
*priv
= nft_expr_priv(expr
);
230 nf_tables_unbind_set(ctx
, priv
->set
, &priv
->binding
);
231 if (priv
->expr
!= NULL
)
232 nft_expr_destroy(ctx
, priv
->expr
);
235 static int nft_dynset_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
237 const struct nft_dynset
*priv
= nft_expr_priv(expr
);
238 u32 flags
= priv
->invert
? NFT_DYNSET_F_INV
: 0;
240 if (nft_dump_register(skb
, NFTA_DYNSET_SREG_KEY
, priv
->sreg_key
))
241 goto nla_put_failure
;
242 if (priv
->set
->flags
& NFT_SET_MAP
&&
243 nft_dump_register(skb
, NFTA_DYNSET_SREG_DATA
, priv
->sreg_data
))
244 goto nla_put_failure
;
245 if (nla_put_be32(skb
, NFTA_DYNSET_OP
, htonl(priv
->op
)))
246 goto nla_put_failure
;
247 if (nla_put_string(skb
, NFTA_DYNSET_SET_NAME
, priv
->set
->name
))
248 goto nla_put_failure
;
249 if (nla_put_be64(skb
, NFTA_DYNSET_TIMEOUT
, cpu_to_be64(priv
->timeout
),
251 goto nla_put_failure
;
252 if (priv
->expr
&& nft_expr_dump(skb
, NFTA_DYNSET_EXPR
, priv
->expr
))
253 goto nla_put_failure
;
254 if (nla_put_be32(skb
, NFTA_DYNSET_FLAGS
, htonl(flags
)))
255 goto nla_put_failure
;
262 static struct nft_expr_type nft_dynset_type
;
263 static const struct nft_expr_ops nft_dynset_ops
= {
264 .type
= &nft_dynset_type
,
265 .size
= NFT_EXPR_SIZE(sizeof(struct nft_dynset
)),
266 .eval
= nft_dynset_eval
,
267 .init
= nft_dynset_init
,
268 .destroy
= nft_dynset_destroy
,
269 .dump
= nft_dynset_dump
,
272 static struct nft_expr_type nft_dynset_type __read_mostly
= {
274 .ops
= &nft_dynset_ops
,
275 .policy
= nft_dynset_policy
,
276 .maxattr
= NFTA_DYNSET_MAX
,
277 .owner
= THIS_MODULE
,
280 int __init
nft_dynset_module_init(void)
282 return nft_register_expr(&nft_dynset_type
);
285 void nft_dynset_module_exit(void)
287 nft_unregister_expr(&nft_dynset_type
);