1/*
  2 * Copyright (c) 2012-2016 Pablo Neira Ayuso <pablo@netfilter.org>
  3 *
  4 * This program is free software; you can redistribute it and/or modify it
  5 * under the terms and conditions of the GNU General Public License,
  6 * version 2, as published by the Free Software Foundation.
  7 */
  8
  9#include <linux/init.h>
 10#include <linux/module.h>
 11#include <linux/skbuff.h>
 12#include <linux/netlink.h>
 13#include <linux/netfilter.h>
 14#include <linux/netfilter/nf_tables.h>
 15#include <net/netfilter/nf_tables.h>
 16
 17#define nft_objref_priv(expr)	*((struct nft_object **)nft_expr_priv(expr))
 18
 19static void nft_objref_eval(const struct nft_expr *expr,
 20			    struct nft_regs *regs,
 21			    const struct nft_pktinfo *pkt)
 22{
 23	struct nft_object *obj = nft_objref_priv(expr);
 24
 25	obj->type->eval(obj, regs, pkt);
 26}
 27
 28static int nft_objref_init(const struct nft_ctx *ctx,
 29			   const struct nft_expr *expr,
 30			   const struct nlattr * const tb[])
 31{
 32	struct nft_object *obj = nft_objref_priv(expr);
 33	u8 genmask = nft_genmask_next(ctx->net);
 34	u32 objtype;
 35
 36	if (!tb[NFTA_OBJREF_IMM_NAME] ||
 37	    !tb[NFTA_OBJREF_IMM_TYPE])
 38		return -EINVAL;
 39
 40	objtype = ntohl(nla_get_be32(tb[NFTA_OBJREF_IMM_TYPE]));
 41	obj = nf_tables_obj_lookup(ctx->table, tb[NFTA_OBJREF_IMM_NAME], objtype,
 42				   genmask);
 43	if (IS_ERR(obj))
 44		return -ENOENT;
 45
 46	nft_objref_priv(expr) = obj;
 47	obj->use++;
 48
 49	return 0;
 50}
 51
 52static int nft_objref_dump(struct sk_buff *skb, const struct nft_expr *expr)
 53{
 54	const struct nft_object *obj = nft_objref_priv(expr);
 55
 56	if (nla_put_string(skb, NFTA_OBJREF_IMM_NAME, obj->name) ||
 57	    nla_put_be32(skb, NFTA_OBJREF_IMM_TYPE, htonl(obj->type->type)))
 58		goto nla_put_failure;
 59
 60	return 0;
 61
 62nla_put_failure:
 63	return -1;
 64}
 65
 66static void nft_objref_destroy(const struct nft_ctx *ctx,
 67			       const struct nft_expr *expr)
 68{
 69	struct nft_object *obj = nft_objref_priv(expr);
 70
 71	obj->use--;
 72}
 73
 74static struct nft_expr_type nft_objref_type;
 75static const struct nft_expr_ops nft_objref_ops = {
 76	.type		= &nft_objref_type,
 77	.size		= NFT_EXPR_SIZE(sizeof(struct nft_object *)),
 78	.eval		= nft_objref_eval,
 79	.init		= nft_objref_init,
 80	.destroy	= nft_objref_destroy,
 81	.dump		= nft_objref_dump,
 82};
 83
 84struct nft_objref_map {
 85	struct nft_set		*set;
 86	enum nft_registers	sreg:8;
 87	struct nft_set_binding	binding;
 88};
 89
 90static void nft_objref_map_eval(const struct nft_expr *expr,
 91				struct nft_regs *regs,
 92				const struct nft_pktinfo *pkt)
 93{
 94	struct nft_objref_map *priv = nft_expr_priv(expr);
 95	const struct nft_set *set = priv->set;
 96	const struct nft_set_ext *ext;
 97	struct nft_object *obj;
 98	bool found;
 99
100	found = set->ops->lookup(nft_net(pkt), set, &regs->data[priv->sreg],
101				 &ext);
102	if (!found) {
103		regs->verdict.code = NFT_BREAK;
104		return;
105	}
106	obj = *nft_set_ext_obj(ext);
107	obj->type->eval(obj, regs, pkt);
108}
109
110static int nft_objref_map_init(const struct nft_ctx *ctx,
111			       const struct nft_expr *expr,
112			       const struct nlattr * const tb[])
113{
114	struct nft_objref_map *priv = nft_expr_priv(expr);
115	u8 genmask = nft_genmask_next(ctx->net);
116	struct nft_set *set;
117	int err;
118
119	set = nf_tables_set_lookup(ctx->table, tb[NFTA_OBJREF_SET_NAME], genmask);
120	if (IS_ERR(set)) {
121		if (tb[NFTA_OBJREF_SET_ID]) {
122			set = nf_tables_set_lookup_byid(ctx->net,
123							tb[NFTA_OBJREF_SET_ID],
124							genmask);
125		}
126		if (IS_ERR(set))
127			return PTR_ERR(set);
128	}
129
130	if (!(set->flags & NFT_SET_OBJECT))
131		return -EINVAL;
132
133	priv->sreg = nft_parse_register(tb[NFTA_OBJREF_SET_SREG]);
134	err = nft_validate_register_load(priv->sreg, set->klen);
135	if (err < 0)
136		return err;
137
138	priv->binding.flags = set->flags & NFT_SET_OBJECT;
139
140	err = nf_tables_bind_set(ctx, set, &priv->binding);
141	if (err < 0)
142		return err;
143
144	priv->set = set;
145	return 0;
146}
147
148static int nft_objref_map_dump(struct sk_buff *skb, const struct nft_expr *expr)
149{
150	const struct nft_objref_map *priv = nft_expr_priv(expr);
151
152	if (nft_dump_register(skb, NFTA_OBJREF_SET_SREG, priv->sreg) ||
153	    nla_put_string(skb, NFTA_OBJREF_SET_NAME, priv->set->name))
154		goto nla_put_failure;
155
156	return 0;
157
158nla_put_failure:
159	return -1;
160}
161
162static void nft_objref_map_destroy(const struct nft_ctx *ctx,
163				   const struct nft_expr *expr)
164{
165	struct nft_objref_map *priv = nft_expr_priv(expr);
166
167	nf_tables_unbind_set(ctx, priv->set, &priv->binding);
168}
169
170static struct nft_expr_type nft_objref_type;
171static const struct nft_expr_ops nft_objref_map_ops = {
172	.type		= &nft_objref_type,
173	.size		= NFT_EXPR_SIZE(sizeof(struct nft_objref_map)),
174	.eval		= nft_objref_map_eval,
175	.init		= nft_objref_map_init,
176	.destroy	= nft_objref_map_destroy,
177	.dump		= nft_objref_map_dump,
178};
179
180static const struct nft_expr_ops *
181nft_objref_select_ops(const struct nft_ctx *ctx,
182                      const struct nlattr * const tb[])
183{
184	if (tb[NFTA_OBJREF_SET_SREG] &&
185	    (tb[NFTA_OBJREF_SET_NAME] ||
186	     tb[NFTA_OBJREF_SET_ID]))
187		return &nft_objref_map_ops;
188	else if (tb[NFTA_OBJREF_IMM_NAME] &&
189		 tb[NFTA_OBJREF_IMM_TYPE])
190		return &nft_objref_ops;
191
192	return ERR_PTR(-EOPNOTSUPP);
193}
194
195static const struct nla_policy nft_objref_policy[NFTA_OBJREF_MAX + 1] = {
196	[NFTA_OBJREF_IMM_NAME]	= { .type = NLA_STRING,
197				    .len = NFT_OBJ_MAXNAMELEN - 1 },
198	[NFTA_OBJREF_IMM_TYPE]	= { .type = NLA_U32 },
199	[NFTA_OBJREF_SET_SREG]	= { .type = NLA_U32 },
200	[NFTA_OBJREF_SET_NAME]	= { .type = NLA_STRING,
201				    .len = NFT_SET_MAXNAMELEN - 1 },
202	[NFTA_OBJREF_SET_ID]	= { .type = NLA_U32 },
203};
204
205static struct nft_expr_type nft_objref_type __read_mostly = {
206	.name		= "objref",
207	.select_ops	= nft_objref_select_ops,
208	.policy		= nft_objref_policy,
209	.maxattr	= NFTA_OBJREF_MAX,
210	.owner		= THIS_MODULE,
211};
212
213static int __init nft_objref_module_init(void)
214{
215	return nft_register_expr(&nft_objref_type);
216}
217
218static void __exit nft_objref_module_exit(void)
219{
220	nft_unregister_expr(&nft_objref_type);
221}
222
223module_init(nft_objref_module_init);
224module_exit(nft_objref_module_exit);
225
226MODULE_LICENSE("GPL");
227MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
228MODULE_ALIAS_NFT_EXPR("objref");