2 * Copyright (c) 2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/list.h>
14 #include <linux/rbtree.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_tables_core.h>
23 enum nft_registers sreg
:8;
24 enum nft_registers dreg
:8;
25 struct nft_set_binding binding
;
28 static void nft_lookup_eval(const struct nft_expr
*expr
,
29 struct nft_regs
*regs
,
30 const struct nft_pktinfo
*pkt
)
32 const struct nft_lookup
*priv
= nft_expr_priv(expr
);
33 const struct nft_set
*set
= priv
->set
;
34 const struct nft_set_ext
*ext
;
36 if (set
->ops
->lookup(set
, ®s
->data
[priv
->sreg
], &ext
)) {
37 if (set
->flags
& NFT_SET_MAP
)
38 nft_data_copy(®s
->data
[priv
->dreg
],
39 nft_set_ext_data(ext
));
42 regs
->verdict
.code
= NFT_BREAK
;
45 static const struct nla_policy nft_lookup_policy
[NFTA_LOOKUP_MAX
+ 1] = {
46 [NFTA_LOOKUP_SET
] = { .type
= NLA_STRING
},
47 [NFTA_LOOKUP_SET_ID
] = { .type
= NLA_U32
},
48 [NFTA_LOOKUP_SREG
] = { .type
= NLA_U32
},
49 [NFTA_LOOKUP_DREG
] = { .type
= NLA_U32
},
52 static int nft_lookup_init(const struct nft_ctx
*ctx
,
53 const struct nft_expr
*expr
,
54 const struct nlattr
* const tb
[])
56 struct nft_lookup
*priv
= nft_expr_priv(expr
);
60 if (tb
[NFTA_LOOKUP_SET
] == NULL
||
61 tb
[NFTA_LOOKUP_SREG
] == NULL
)
64 set
= nf_tables_set_lookup(ctx
->table
, tb
[NFTA_LOOKUP_SET
]);
66 if (tb
[NFTA_LOOKUP_SET_ID
]) {
67 set
= nf_tables_set_lookup_byid(ctx
->net
,
68 tb
[NFTA_LOOKUP_SET_ID
]);
74 priv
->sreg
= nft_parse_register(tb
[NFTA_LOOKUP_SREG
]);
75 err
= nft_validate_register_load(priv
->sreg
, set
->klen
);
79 if (tb
[NFTA_LOOKUP_DREG
] != NULL
) {
80 if (!(set
->flags
& NFT_SET_MAP
))
83 priv
->dreg
= nft_parse_register(tb
[NFTA_LOOKUP_DREG
]);
84 err
= nft_validate_register_store(ctx
, priv
->dreg
, NULL
,
85 set
->dtype
, set
->dlen
);
88 } else if (set
->flags
& NFT_SET_MAP
)
91 priv
->binding
.flags
= set
->flags
& NFT_SET_MAP
;
93 err
= nf_tables_bind_set(ctx
, set
, &priv
->binding
);
101 static void nft_lookup_destroy(const struct nft_ctx
*ctx
,
102 const struct nft_expr
*expr
)
104 struct nft_lookup
*priv
= nft_expr_priv(expr
);
106 nf_tables_unbind_set(ctx
, priv
->set
, &priv
->binding
);
109 static int nft_lookup_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
111 const struct nft_lookup
*priv
= nft_expr_priv(expr
);
113 if (nla_put_string(skb
, NFTA_LOOKUP_SET
, priv
->set
->name
))
114 goto nla_put_failure
;
115 if (nft_dump_register(skb
, NFTA_LOOKUP_SREG
, priv
->sreg
))
116 goto nla_put_failure
;
117 if (priv
->set
->flags
& NFT_SET_MAP
)
118 if (nft_dump_register(skb
, NFTA_LOOKUP_DREG
, priv
->dreg
))
119 goto nla_put_failure
;
126 static struct nft_expr_type nft_lookup_type
;
127 static const struct nft_expr_ops nft_lookup_ops
= {
128 .type
= &nft_lookup_type
,
129 .size
= NFT_EXPR_SIZE(sizeof(struct nft_lookup
)),
130 .eval
= nft_lookup_eval
,
131 .init
= nft_lookup_init
,
132 .destroy
= nft_lookup_destroy
,
133 .dump
= nft_lookup_dump
,
136 static struct nft_expr_type nft_lookup_type __read_mostly
= {
138 .ops
= &nft_lookup_ops
,
139 .policy
= nft_lookup_policy
,
140 .maxattr
= NFTA_LOOKUP_MAX
,
141 .owner
= THIS_MODULE
,
144 int __init
nft_lookup_module_init(void)
146 return nft_register_expr(&nft_lookup_type
);
149 void nft_lookup_module_exit(void)
151 nft_unregister_expr(&nft_lookup_type
);