netfilter: nf_tables: merge exthdr expression into nft core
[sfrench/cifs-2.6.git] / net / netfilter / nf_tables_core.c
1 /*
2  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  *
8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
9  */
10
11 #include <linux/kernel.h>
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/list.h>
15 #include <linux/rculist.h>
16 #include <linux/skbuff.h>
17 #include <linux/netlink.h>
18 #include <linux/netfilter.h>
19 #include <linux/static_key.h>
20 #include <linux/netfilter/nfnetlink.h>
21 #include <linux/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_core.h>
23 #include <net/netfilter/nf_tables.h>
24 #include <net/netfilter/nf_log.h>
25
26 static const char *const comments[__NFT_TRACETYPE_MAX] = {
27         [NFT_TRACETYPE_POLICY]  = "policy",
28         [NFT_TRACETYPE_RETURN]  = "return",
29         [NFT_TRACETYPE_RULE]    = "rule",
30 };
31
32 static const struct nf_loginfo trace_loginfo = {
33         .type = NF_LOG_TYPE_LOG,
34         .u = {
35                 .log = {
36                         .level = LOGLEVEL_WARNING,
37                         .logflags = NF_LOG_DEFAULT_MASK,
38                 },
39         },
40 };
41
42 static noinline void __nft_trace_packet(struct nft_traceinfo *info,
43                                         const struct nft_chain *chain,
44                                         int rulenum, enum nft_trace_types type)
45 {
46         const struct nft_pktinfo *pkt = info->pkt;
47
48         if (!info->trace || !pkt->skb->nf_trace)
49                 return;
50
51         info->chain = chain;
52         info->type = type;
53
54         nft_trace_notify(info);
55
56         nf_log_trace(nft_net(pkt), nft_pf(pkt), nft_hook(pkt), pkt->skb,
57                      nft_in(pkt), nft_out(pkt), &trace_loginfo,
58                      "TRACE: %s:%s:%s:%u ",
59                      chain->table->name, chain->name, comments[type], rulenum);
60 }
61
62 static inline void nft_trace_packet(struct nft_traceinfo *info,
63                                     const struct nft_chain *chain,
64                                     const struct nft_rule *rule,
65                                     int rulenum,
66                                     enum nft_trace_types type)
67 {
68         if (static_branch_unlikely(&nft_trace_enabled)) {
69                 info->rule = rule;
70                 __nft_trace_packet(info, chain, rulenum, type);
71         }
72 }
73
74 static void nft_cmp_fast_eval(const struct nft_expr *expr,
75                               struct nft_regs *regs)
76 {
77         const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
78         u32 mask = nft_cmp_fast_mask(priv->len);
79
80         if ((regs->data[priv->sreg] & mask) == priv->data)
81                 return;
82         regs->verdict.code = NFT_BREAK;
83 }
84
85 static bool nft_payload_fast_eval(const struct nft_expr *expr,
86                                   struct nft_regs *regs,
87                                   const struct nft_pktinfo *pkt)
88 {
89         const struct nft_payload *priv = nft_expr_priv(expr);
90         const struct sk_buff *skb = pkt->skb;
91         u32 *dest = &regs->data[priv->dreg];
92         unsigned char *ptr;
93
94         if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
95                 ptr = skb_network_header(skb);
96         else {
97                 if (!pkt->tprot_set)
98                         return false;
99                 ptr = skb_network_header(skb) + pkt->xt.thoff;
100         }
101
102         ptr += priv->offset;
103
104         if (unlikely(ptr + priv->len > skb_tail_pointer(skb)))
105                 return false;
106
107         *dest = 0;
108         if (priv->len == 2)
109                 *(u16 *)dest = *(u16 *)ptr;
110         else if (priv->len == 4)
111                 *(u32 *)dest = *(u32 *)ptr;
112         else
113                 *(u8 *)dest = *(u8 *)ptr;
114         return true;
115 }
116
117 DEFINE_STATIC_KEY_FALSE(nft_counters_enabled);
118
119 static noinline void nft_update_chain_stats(const struct nft_chain *chain,
120                                             const struct nft_pktinfo *pkt)
121 {
122         struct nft_stats *stats;
123
124         local_bh_disable();
125         stats = this_cpu_ptr(rcu_dereference(nft_base_chain(chain)->stats));
126         u64_stats_update_begin(&stats->syncp);
127         stats->pkts++;
128         stats->bytes += pkt->skb->len;
129         u64_stats_update_end(&stats->syncp);
130         local_bh_enable();
131 }
132
133 struct nft_jumpstack {
134         const struct nft_chain  *chain;
135         const struct nft_rule   *rule;
136         int                     rulenum;
137 };
138
139 unsigned int
140 nft_do_chain(struct nft_pktinfo *pkt, void *priv)
141 {
142         const struct nft_chain *chain = priv, *basechain = chain;
143         const struct net *net = nft_net(pkt);
144         const struct nft_rule *rule;
145         const struct nft_expr *expr, *last;
146         struct nft_regs regs;
147         unsigned int stackptr = 0;
148         struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
149         int rulenum;
150         unsigned int gencursor = nft_genmask_cur(net);
151         struct nft_traceinfo info;
152
153         info.trace = false;
154         if (static_branch_unlikely(&nft_trace_enabled))
155                 nft_trace_init(&info, pkt, &regs.verdict, basechain);
156 do_chain:
157         rulenum = 0;
158         rule = list_entry(&chain->rules, struct nft_rule, list);
159 next_rule:
160         regs.verdict.code = NFT_CONTINUE;
161         list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
162
163                 /* This rule is not active, skip. */
164                 if (unlikely(rule->genmask & gencursor))
165                         continue;
166
167                 rulenum++;
168
169                 nft_rule_for_each_expr(expr, last, rule) {
170                         if (expr->ops == &nft_cmp_fast_ops)
171                                 nft_cmp_fast_eval(expr, &regs);
172                         else if (expr->ops != &nft_payload_fast_ops ||
173                                  !nft_payload_fast_eval(expr, &regs, pkt))
174                                 expr->ops->eval(expr, &regs, pkt);
175
176                         if (regs.verdict.code != NFT_CONTINUE)
177                                 break;
178                 }
179
180                 switch (regs.verdict.code) {
181                 case NFT_BREAK:
182                         regs.verdict.code = NFT_CONTINUE;
183                         continue;
184                 case NFT_CONTINUE:
185                         nft_trace_packet(&info, chain, rule,
186                                          rulenum, NFT_TRACETYPE_RULE);
187                         continue;
188                 }
189                 break;
190         }
191
192         switch (regs.verdict.code & NF_VERDICT_MASK) {
193         case NF_ACCEPT:
194         case NF_DROP:
195         case NF_QUEUE:
196         case NF_STOLEN:
197                 nft_trace_packet(&info, chain, rule,
198                                  rulenum, NFT_TRACETYPE_RULE);
199                 return regs.verdict.code;
200         }
201
202         switch (regs.verdict.code) {
203         case NFT_JUMP:
204                 BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
205                 jumpstack[stackptr].chain = chain;
206                 jumpstack[stackptr].rule  = rule;
207                 jumpstack[stackptr].rulenum = rulenum;
208                 stackptr++;
209                 /* fall through */
210         case NFT_GOTO:
211                 nft_trace_packet(&info, chain, rule,
212                                  rulenum, NFT_TRACETYPE_RULE);
213
214                 chain = regs.verdict.chain;
215                 goto do_chain;
216         case NFT_CONTINUE:
217                 rulenum++;
218                 /* fall through */
219         case NFT_RETURN:
220                 nft_trace_packet(&info, chain, rule,
221                                  rulenum, NFT_TRACETYPE_RETURN);
222                 break;
223         default:
224                 WARN_ON(1);
225         }
226
227         if (stackptr > 0) {
228                 stackptr--;
229                 chain = jumpstack[stackptr].chain;
230                 rule  = jumpstack[stackptr].rule;
231                 rulenum = jumpstack[stackptr].rulenum;
232                 goto next_rule;
233         }
234
235         nft_trace_packet(&info, basechain, NULL, -1,
236                          NFT_TRACETYPE_POLICY);
237
238         if (static_branch_unlikely(&nft_counters_enabled))
239                 nft_update_chain_stats(basechain, pkt);
240
241         return nft_base_chain(basechain)->policy;
242 }
243 EXPORT_SYMBOL_GPL(nft_do_chain);
244
245 static struct nft_expr_type *nft_basic_types[] = {
246         &nft_imm_type,
247         &nft_cmp_type,
248         &nft_lookup_type,
249         &nft_bitwise_type,
250         &nft_byteorder_type,
251         &nft_payload_type,
252         &nft_dynset_type,
253         &nft_range_type,
254         &nft_meta_type,
255         &nft_rt_type,
256         &nft_exthdr_type,
257 };
258
259 int __init nf_tables_core_module_init(void)
260 {
261         int err, i;
262
263         for (i = 0; i < ARRAY_SIZE(nft_basic_types); i++) {
264                 err = nft_register_expr(nft_basic_types[i]);
265                 if (err)
266                         goto err;
267         }
268
269         return 0;
270
271 err:
272         while (i-- > 0)
273                 nft_unregister_expr(nft_basic_types[i]);
274         return err;
275 }
276
277 void nf_tables_core_module_exit(void)
278 {
279         int i;
280
281         i = ARRAY_SIZE(nft_basic_types);
282         while (i-- > 0)
283                 nft_unregister_expr(nft_basic_types[i]);
284 }