2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nf_tables.h>
17 #include <net/netfilter/nf_tables_core.h>
18 #include <net/netfilter/nf_tables.h>
20 static void nft_payload_eval(const struct nft_expr
*expr
,
21 struct nft_regs
*regs
,
22 const struct nft_pktinfo
*pkt
)
24 const struct nft_payload
*priv
= nft_expr_priv(expr
);
25 const struct sk_buff
*skb
= pkt
->skb
;
26 u32
*dest
= ®s
->data
[priv
->dreg
].data
[0];
30 case NFT_PAYLOAD_LL_HEADER
:
31 if (!skb_mac_header_was_set(skb
))
33 offset
= skb_mac_header(skb
) - skb
->data
;
35 case NFT_PAYLOAD_NETWORK_HEADER
:
36 offset
= skb_network_offset(skb
);
38 case NFT_PAYLOAD_TRANSPORT_HEADER
:
39 offset
= pkt
->xt
.thoff
;
44 offset
+= priv
->offset
;
46 if (skb_copy_bits(skb
, offset
, dest
, priv
->len
) < 0)
50 regs
->verdict
.code
= NFT_BREAK
;
53 static const struct nla_policy nft_payload_policy
[NFTA_PAYLOAD_MAX
+ 1] = {
54 [NFTA_PAYLOAD_DREG
] = { .type
= NLA_U32
},
55 [NFTA_PAYLOAD_BASE
] = { .type
= NLA_U32
},
56 [NFTA_PAYLOAD_OFFSET
] = { .type
= NLA_U32
},
57 [NFTA_PAYLOAD_LEN
] = { .type
= NLA_U32
},
60 static int nft_payload_init(const struct nft_ctx
*ctx
,
61 const struct nft_expr
*expr
,
62 const struct nlattr
* const tb
[])
64 struct nft_payload
*priv
= nft_expr_priv(expr
);
66 priv
->base
= ntohl(nla_get_be32(tb
[NFTA_PAYLOAD_BASE
]));
67 priv
->offset
= ntohl(nla_get_be32(tb
[NFTA_PAYLOAD_OFFSET
]));
68 priv
->len
= ntohl(nla_get_be32(tb
[NFTA_PAYLOAD_LEN
]));
69 priv
->dreg
= ntohl(nla_get_be32(tb
[NFTA_PAYLOAD_DREG
]));
71 return nft_validate_register_store(ctx
, priv
->dreg
, NULL
,
72 NFT_DATA_VALUE
, priv
->len
);
75 static int nft_payload_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
77 const struct nft_payload
*priv
= nft_expr_priv(expr
);
79 if (nla_put_be32(skb
, NFTA_PAYLOAD_DREG
, htonl(priv
->dreg
)) ||
80 nla_put_be32(skb
, NFTA_PAYLOAD_BASE
, htonl(priv
->base
)) ||
81 nla_put_be32(skb
, NFTA_PAYLOAD_OFFSET
, htonl(priv
->offset
)) ||
82 nla_put_be32(skb
, NFTA_PAYLOAD_LEN
, htonl(priv
->len
)))
90 static struct nft_expr_type nft_payload_type
;
91 static const struct nft_expr_ops nft_payload_ops
= {
92 .type
= &nft_payload_type
,
93 .size
= NFT_EXPR_SIZE(sizeof(struct nft_payload
)),
94 .eval
= nft_payload_eval
,
95 .init
= nft_payload_init
,
96 .dump
= nft_payload_dump
,
99 const struct nft_expr_ops nft_payload_fast_ops
= {
100 .type
= &nft_payload_type
,
101 .size
= NFT_EXPR_SIZE(sizeof(struct nft_payload
)),
102 .eval
= nft_payload_eval
,
103 .init
= nft_payload_init
,
104 .dump
= nft_payload_dump
,
107 static const struct nft_expr_ops
*
108 nft_payload_select_ops(const struct nft_ctx
*ctx
,
109 const struct nlattr
* const tb
[])
111 enum nft_payload_bases base
;
112 unsigned int offset
, len
;
114 if (tb
[NFTA_PAYLOAD_DREG
] == NULL
||
115 tb
[NFTA_PAYLOAD_BASE
] == NULL
||
116 tb
[NFTA_PAYLOAD_OFFSET
] == NULL
||
117 tb
[NFTA_PAYLOAD_LEN
] == NULL
)
118 return ERR_PTR(-EINVAL
);
120 base
= ntohl(nla_get_be32(tb
[NFTA_PAYLOAD_BASE
]));
122 case NFT_PAYLOAD_LL_HEADER
:
123 case NFT_PAYLOAD_NETWORK_HEADER
:
124 case NFT_PAYLOAD_TRANSPORT_HEADER
:
127 return ERR_PTR(-EOPNOTSUPP
);
130 offset
= ntohl(nla_get_be32(tb
[NFTA_PAYLOAD_OFFSET
]));
131 len
= ntohl(nla_get_be32(tb
[NFTA_PAYLOAD_LEN
]));
133 if (len
<= 4 && is_power_of_2(len
) && IS_ALIGNED(offset
, len
) &&
134 base
!= NFT_PAYLOAD_LL_HEADER
)
135 return &nft_payload_fast_ops
;
137 return &nft_payload_ops
;
140 static struct nft_expr_type nft_payload_type __read_mostly
= {
142 .select_ops
= nft_payload_select_ops
,
143 .policy
= nft_payload_policy
,
144 .maxattr
= NFTA_PAYLOAD_MAX
,
145 .owner
= THIS_MODULE
,
148 int __init
nft_payload_module_init(void)
150 return nft_register_expr(&nft_payload_type
);
153 void nft_payload_module_exit(void)
155 nft_unregister_expr(&nft_payload_type
);