[deliverable/linux.git] / net / netfilter / nf_tables_core.c

/*
 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/list.h>
#include <linux/rculist.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_log.h>

enum nft_trace {
	NFT_TRACE_RULE,
	NFT_TRACE_RETURN,
	NFT_TRACE_POLICY,
};

static const char *const comments[] = {
	[NFT_TRACE_RULE]	= "rule",
	[NFT_TRACE_RETURN]	= "return",
	[NFT_TRACE_POLICY]	= "policy",
};

static struct nf_loginfo trace_loginfo = {
	.type = NF_LOG_TYPE_LOG,
	.u = {
		.log = {
			.level = LOGLEVEL_WARNING,
			.logflags = NF_LOG_MASK,
	        },
	},
};

static void __nft_trace_packet(const struct nft_pktinfo *pkt,
			       const struct nft_chain *chain,
			       int rulenum, enum nft_trace type)
{
	struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);

	nf_log_trace(net, pkt->pf, pkt->hook, pkt->skb, pkt->in,
		     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
		     chain->table->name, chain->name, comments[type],
		     rulenum);
}

static inline void nft_trace_packet(const struct nft_pktinfo *pkt,
				    const struct nft_chain *chain,
				    int rulenum, enum nft_trace type)
{
	if (unlikely(pkt->skb->nf_trace))
		__nft_trace_packet(pkt, chain, rulenum, type);
}

static void nft_cmp_fast_eval(const struct nft_expr *expr,
			      struct nft_regs *regs)
{
	const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
	u32 mask = nft_cmp_fast_mask(priv->len);

	if ((regs->data[priv->sreg] & mask) == priv->data)
		return;
	regs->verdict.code = NFT_BREAK;
}

static bool nft_payload_fast_eval(const struct nft_expr *expr,
				  struct nft_regs *regs,
				  const struct nft_pktinfo *pkt)
{
	const struct nft_payload *priv = nft_expr_priv(expr);
	const struct sk_buff *skb = pkt->skb;
	u32 *dest = &regs->data[priv->dreg];
	unsigned char *ptr;

	if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
		ptr = skb_network_header(skb);
	else
		ptr = skb_network_header(skb) + pkt->xt.thoff;

	ptr += priv->offset;

	if (unlikely(ptr + priv->len >= skb_tail_pointer(skb)))
		return false;

	*dest = 0;
	if (priv->len == 2)
		*(u16 *)dest = *(u16 *)ptr;
	else if (priv->len == 4)
		*(u32 *)dest = *(u32 *)ptr;
	else
		*(u8 *)dest = *(u8 *)ptr;
	return true;
}

struct nft_jumpstack {
	const struct nft_chain	*chain;
	const struct nft_rule	*rule;
	int			rulenum;
};

unsigned int
nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops)
{
	const struct nft_chain *chain = ops->priv, *basechain = chain;
	const struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
	const struct nft_rule *rule;
	const struct nft_expr *expr, *last;
	struct nft_regs regs;
	unsigned int stackptr = 0;
	struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
	struct nft_stats *stats;
	int rulenum;
	unsigned int gencursor = nft_genmask_cur(net);

do_chain:
	rulenum = 0;
	rule = list_entry(&chain->rules, struct nft_rule, list);
next_rule:
	regs.verdict.code = NFT_CONTINUE;
	list_for_each_entry_continue_rcu(rule, &chain->rules, list) {

		/* This rule is not active, skip. */
		if (unlikely(rule->genmask & (1 << gencursor)))
			continue;

		rulenum++;

		nft_rule_for_each_expr(expr, last, rule) {
			if (expr->ops == &nft_cmp_fast_ops)
				nft_cmp_fast_eval(expr, &regs);
			else if (expr->ops != &nft_payload_fast_ops ||
				 !nft_payload_fast_eval(expr, &regs, pkt))
				expr->ops->eval(expr, &regs, pkt);

			if (regs.verdict.code != NFT_CONTINUE)
				break;
		}

		switch (regs.verdict.code) {
		case NFT_BREAK:
			regs.verdict.code = NFT_CONTINUE;
			continue;
		case NFT_CONTINUE:
			nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
			continue;
		}
		break;
	}

	switch (regs.verdict.code & NF_VERDICT_MASK) {
	case NF_ACCEPT:
	case NF_DROP:
	case NF_QUEUE:
		nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
		return regs.verdict.code;
	}

	switch (regs.verdict.code) {
	case NFT_JUMP:
		BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
		jumpstack[stackptr].chain = chain;
		jumpstack[stackptr].rule  = rule;
		jumpstack[stackptr].rulenum = rulenum;
		stackptr++;
		/* fall through */
	case NFT_GOTO:
		nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);

		chain = regs.verdict.chain;
		goto do_chain;
	case NFT_CONTINUE:
		rulenum++;
		/* fall through */
	case NFT_RETURN:
		nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RETURN);
		break;
	default:
		WARN_ON(1);
	}

	if (stackptr > 0) {
		stackptr--;
		chain = jumpstack[stackptr].chain;
		rule  = jumpstack[stackptr].rule;
		rulenum = jumpstack[stackptr].rulenum;
		goto next_rule;
	}

	nft_trace_packet(pkt, basechain, -1, NFT_TRACE_POLICY);

	rcu_read_lock_bh();
	stats = this_cpu_ptr(rcu_dereference(nft_base_chain(basechain)->stats));
	u64_stats_update_begin(&stats->syncp);
	stats->pkts++;
	stats->bytes += pkt->skb->len;
	u64_stats_update_end(&stats->syncp);
	rcu_read_unlock_bh();

	return nft_base_chain(basechain)->policy;
}
EXPORT_SYMBOL_GPL(nft_do_chain);

int __init nf_tables_core_module_init(void)
{
	int err;

	err = nft_immediate_module_init();
	if (err < 0)
		goto err1;

	err = nft_cmp_module_init();
	if (err < 0)
		goto err2;

	err = nft_lookup_module_init();
	if (err < 0)
		goto err3;

	err = nft_bitwise_module_init();
	if (err < 0)
		goto err4;

	err = nft_byteorder_module_init();
	if (err < 0)
		goto err5;

	err = nft_payload_module_init();
	if (err < 0)
		goto err6;

	err = nft_dynset_module_init();
	if (err < 0)
		goto err7;

	return 0;

err7:
	nft_payload_module_exit();
err6:
	nft_byteorder_module_exit();
err5:
	nft_bitwise_module_exit();
err4:
	nft_lookup_module_exit();
err3:
	nft_cmp_module_exit();
err2:
	nft_immediate_module_exit();
err1:
	return err;
}

void nf_tables_core_module_exit(void)
{
	nft_dynset_module_exit();
	nft_payload_module_exit();
	nft_byteorder_module_exit();
	nft_bitwise_module_exit();
	nft_lookup_module_exit();
	nft_cmp_module_exit();
	nft_immediate_module_exit();
}
Commit	Line	Data
	1	/*
	2	* Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/module.h>
	13	#include <linux/init.h>
	14	#include <linux/list.h>
	15	#include <linux/rculist.h>
	16	#include <linux/skbuff.h>
	17	#include <linux/netlink.h>
	18	#include <linux/netfilter.h>
	19	#include <linux/netfilter/nfnetlink.h>
	20	#include <linux/netfilter/nf_tables.h>
	21	#include <net/netfilter/nf_tables_core.h>
	22	#include <net/netfilter/nf_tables.h>
	23	#include <net/netfilter/nf_log.h>
	24
	25	enum nft_trace {
	26	NFT_TRACE_RULE,
	27	NFT_TRACE_RETURN,
	28	NFT_TRACE_POLICY,
	29	};
	30
	31	static const char *const comments[] = {
	32	[NFT_TRACE_RULE] = "rule",
	33	[NFT_TRACE_RETURN] = "return",
	34	[NFT_TRACE_POLICY] = "policy",
	35	};
	36
	37	static struct nf_loginfo trace_loginfo = {
	38	.type = NF_LOG_TYPE_LOG,
	39	.u = {
	40	.log = {
	41	.level = LOGLEVEL_WARNING,
	42	.logflags = NF_LOG_MASK,
	43	},
	44	},
	45	};
	46
	47	static void __nft_trace_packet(const struct nft_pktinfo *pkt,
	48	const struct nft_chain *chain,
	49	int rulenum, enum nft_trace type)
	50	{
	51	struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
	52
	53	nf_log_trace(net, pkt->pf, pkt->hook, pkt->skb, pkt->in,
	54	pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
	55	chain->table->name, chain->name, comments[type],
	56	rulenum);
	57	}
	58
	59	static inline void nft_trace_packet(const struct nft_pktinfo *pkt,
	60	const struct nft_chain *chain,
	61	int rulenum, enum nft_trace type)
	62	{
	63	if (unlikely(pkt->skb->nf_trace))
	64	__nft_trace_packet(pkt, chain, rulenum, type);
	65	}
	66
	67	static void nft_cmp_fast_eval(const struct nft_expr *expr,
	68	struct nft_regs *regs)
	69	{
	70	const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
	71	u32 mask = nft_cmp_fast_mask(priv->len);
	72
	73	if ((regs->data[priv->sreg] & mask) == priv->data)
	74	return;
	75	regs->verdict.code = NFT_BREAK;
	76	}
	77
	78	static bool nft_payload_fast_eval(const struct nft_expr *expr,
	79	struct nft_regs *regs,
	80	const struct nft_pktinfo *pkt)
	81	{
	82	const struct nft_payload *priv = nft_expr_priv(expr);
	83	const struct sk_buff *skb = pkt->skb;
	84	u32 *dest = &regs->data[priv->dreg];
	85	unsigned char *ptr;
	86
	87	if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
	88	ptr = skb_network_header(skb);
	89	else
	90	ptr = skb_network_header(skb) + pkt->xt.thoff;
	91
	92	ptr += priv->offset;
	93
	94	if (unlikely(ptr + priv->len >= skb_tail_pointer(skb)))
	95	return false;
	96
	97	*dest = 0;
	98	if (priv->len == 2)
	99	(u16 )dest = (u16 )ptr;
	100	else if (priv->len == 4)
	101	(u32 )dest = (u32 )ptr;
	102	else
	103	(u8 )dest = (u8 )ptr;
	104	return true;
	105	}
	106
	107	struct nft_jumpstack {
	108	const struct nft_chain *chain;
	109	const struct nft_rule *rule;
	110	int rulenum;
	111	};
	112
	113	unsigned int
	114	nft_do_chain(struct nft_pktinfo pkt, const struct nf_hook_ops ops)
	115	{
	116	const struct nft_chain chain = ops->priv, basechain = chain;
	117	const struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
	118	const struct nft_rule *rule;
	119	const struct nft_expr expr, last;
	120	struct nft_regs regs;
	121	unsigned int stackptr = 0;
	122	struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
	123	struct nft_stats *stats;
	124	int rulenum;
	125	unsigned int gencursor = nft_genmask_cur(net);
	126
	127	do_chain:
	128	rulenum = 0;
	129	rule = list_entry(&chain->rules, struct nft_rule, list);
	130	next_rule:
	131	regs.verdict.code = NFT_CONTINUE;
	132	list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
	133
	134	/* This rule is not active, skip. */
	135	if (unlikely(rule->genmask & (1 << gencursor)))
	136	continue;
	137
	138	rulenum++;
	139
	140	nft_rule_for_each_expr(expr, last, rule) {
	141	if (expr->ops == &nft_cmp_fast_ops)
	142	nft_cmp_fast_eval(expr, &regs);
	143	else if (expr->ops != &nft_payload_fast_ops \|\|
	144	!nft_payload_fast_eval(expr, &regs, pkt))
	145	expr->ops->eval(expr, &regs, pkt);
	146
	147	if (regs.verdict.code != NFT_CONTINUE)
	148	break;
	149	}
	150
	151	switch (regs.verdict.code) {
	152	case NFT_BREAK:
	153	regs.verdict.code = NFT_CONTINUE;
	154	continue;
	155	case NFT_CONTINUE:
	156	nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
	157	continue;
	158	}
	159	break;
	160	}
	161
	162	switch (regs.verdict.code & NF_VERDICT_MASK) {
	163	case NF_ACCEPT:
	164	case NF_DROP:
	165	case NF_QUEUE:
	166	nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
	167	return regs.verdict.code;
	168	}
	169
	170	switch (regs.verdict.code) {
	171	case NFT_JUMP:
	172	BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
	173	jumpstack[stackptr].chain = chain;
	174	jumpstack[stackptr].rule = rule;
	175	jumpstack[stackptr].rulenum = rulenum;
	176	stackptr++;
	177	/* fall through */
	178	case NFT_GOTO:
	179	nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
	180
	181	chain = regs.verdict.chain;
	182	goto do_chain;
	183	case NFT_CONTINUE:
	184	rulenum++;
	185	/* fall through */
	186	case NFT_RETURN:
	187	nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RETURN);
	188	break;
	189	default:
	190	WARN_ON(1);
	191	}
	192
	193	if (stackptr > 0) {
	194	stackptr--;
	195	chain = jumpstack[stackptr].chain;
	196	rule = jumpstack[stackptr].rule;
	197	rulenum = jumpstack[stackptr].rulenum;
	198	goto next_rule;
	199	}
	200
	201	nft_trace_packet(pkt, basechain, -1, NFT_TRACE_POLICY);
	202
	203	rcu_read_lock_bh();
	204	stats = this_cpu_ptr(rcu_dereference(nft_base_chain(basechain)->stats));
	205	u64_stats_update_begin(&stats->syncp);
	206	stats->pkts++;
	207	stats->bytes += pkt->skb->len;
	208	u64_stats_update_end(&stats->syncp);
	209	rcu_read_unlock_bh();
	210
	211	return nft_base_chain(basechain)->policy;
	212	}
	213	EXPORT_SYMBOL_GPL(nft_do_chain);
	214
	215	int __init nf_tables_core_module_init(void)
	216	{
	217	int err;
	218
	219	err = nft_immediate_module_init();
	220	if (err < 0)
	221	goto err1;
	222
	223	err = nft_cmp_module_init();
	224	if (err < 0)
	225	goto err2;
	226
	227	err = nft_lookup_module_init();
	228	if (err < 0)
	229	goto err3;
	230
	231	err = nft_bitwise_module_init();
	232	if (err < 0)
	233	goto err4;
	234
	235	err = nft_byteorder_module_init();
	236	if (err < 0)
	237	goto err5;
	238
	239	err = nft_payload_module_init();
	240	if (err < 0)
	241	goto err6;
	242
	243	err = nft_dynset_module_init();
	244	if (err < 0)
	245	goto err7;
	246
	247	return 0;
	248
	249	err7:
	250	nft_payload_module_exit();
	251	err6:
	252	nft_byteorder_module_exit();
	253	err5:
	254	nft_bitwise_module_exit();
	255	err4:
	256	nft_lookup_module_exit();
	257	err3:
	258	nft_cmp_module_exit();
	259	err2:
	260	nft_immediate_module_exit();
	261	err1:
	262	return err;
	263	}
	264
	265	void nf_tables_core_module_exit(void)
	266	{
	267	nft_dynset_module_exit();
	268	nft_payload_module_exit();
	269	nft_byteorder_module_exit();
	270	nft_bitwise_module_exit();
	271	nft_lookup_module_exit();
	272	nft_cmp_module_exit();
	273	nft_immediate_module_exit();
	274	}