net/netfilter/nft_hash.c

   1 /*
   2  * Copyright (c) 2016 Laura Garcia <nevola@gmail.com>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  */
   9
  10 #include <linux/kernel.h>
  11 #include <linux/init.h>
  12 #include <linux/module.h>
  13 #include <linux/netlink.h>
  14 #include <linux/netfilter.h>
  15 #include <linux/netfilter/nf_tables.h>
  16 #include <net/netfilter/nf_tables.h>
  17 #include <net/netfilter/nf_tables_core.h>
  18 #include <linux/jhash.h>
  19
  20 struct nft_jhash {
  21         enum nft_registers      sreg:8;
  22         enum nft_registers      dreg:8;
  23         u8                      len;
  24         bool                    autogen_seed:1;
  25         u32                     modulus;
  26         u32                     seed;
  27         u32                     offset;
  28         struct nft_set          *map;
  29 };
  30
  31 static void nft_jhash_eval(const struct nft_expr *expr,
  32                            struct nft_regs *regs,
  33                            const struct nft_pktinfo *pkt)
  34 {
  35         struct nft_jhash *priv = nft_expr_priv(expr);
  36         const void *data = &regs->data[priv->sreg];
  37         u32 h;
  38
  39         h = reciprocal_scale(jhash(data, priv->len, priv->seed),
  40                              priv->modulus);
  41
  42         regs->data[priv->dreg] = h + priv->offset;
  43 }
  44
  45 static void nft_jhash_map_eval(const struct nft_expr *expr,
  46                                struct nft_regs *regs,
  47                                const struct nft_pktinfo *pkt)
  48 {
  49         struct nft_jhash *priv = nft_expr_priv(expr);
  50         const void *data = &regs->data[priv->sreg];
  51         const struct nft_set *map = priv->map;
  52         const struct nft_set_ext *ext;
  53         u32 result;
  54         bool found;
  55
  56         result = reciprocal_scale(jhash(data, priv->len, priv->seed),
  57                                         priv->modulus) + priv->offset;
  58
  59         found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
  60         if (!found)
  61                 return;
  62
  63         nft_data_copy(&regs->data[priv->dreg],
  64                       nft_set_ext_data(ext), map->dlen);
  65 }
  66
  67 struct nft_symhash {
  68         enum nft_registers      dreg:8;
  69         u32                     modulus;
  70         u32                     offset;
  71         struct nft_set          *map;
  72 };
  73
  74 static void nft_symhash_eval(const struct nft_expr *expr,
  75                              struct nft_regs *regs,
  76                              const struct nft_pktinfo *pkt)
  77 {
  78         struct nft_symhash *priv = nft_expr_priv(expr);
  79         struct sk_buff *skb = pkt->skb;
  80         u32 h;
  81
  82         h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus);
  83
  84         regs->data[priv->dreg] = h + priv->offset;
  85 }
  86
  87 static void nft_symhash_map_eval(const struct nft_expr *expr,
  88                                  struct nft_regs *regs,
  89                                  const struct nft_pktinfo *pkt)
  90 {
  91         struct nft_symhash *priv = nft_expr_priv(expr);
  92         struct sk_buff *skb = pkt->skb;
  93         const struct nft_set *map = priv->map;
  94         const struct nft_set_ext *ext;
  95         u32 result;
  96         bool found;
  97
  98         result = reciprocal_scale(__skb_get_hash_symmetric(skb),
  99                                   priv->modulus) + priv->offset;
 100
 101         found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
 102         if (!found)
 103                 return;
 104
 105         nft_data_copy(&regs->data[priv->dreg],
 106                       nft_set_ext_data(ext), map->dlen);
 107 }
 108
 109 static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
 110         [NFTA_HASH_SREG]        = { .type = NLA_U32 },
 111         [NFTA_HASH_DREG]        = { .type = NLA_U32 },
 112         [NFTA_HASH_LEN]         = { .type = NLA_U32 },
 113         [NFTA_HASH_MODULUS]     = { .type = NLA_U32 },
 114         [NFTA_HASH_SEED]        = { .type = NLA_U32 },
 115         [NFTA_HASH_OFFSET]      = { .type = NLA_U32 },
 116         [NFTA_HASH_TYPE]        = { .type = NLA_U32 },
 117         [NFTA_HASH_SET_NAME]    = { .type = NLA_STRING,
 118                                     .len = NFT_SET_MAXNAMELEN - 1 },
 119         [NFTA_HASH_SET_ID]      = { .type = NLA_U32 },
 120 };
 121
 122 static int nft_jhash_init(const struct nft_ctx *ctx,
 123                           const struct nft_expr *expr,
 124                           const struct nlattr * const tb[])
 125 {
 126         struct nft_jhash *priv = nft_expr_priv(expr);
 127         u32 len;
 128         int err;
 129
 130         if (!tb[NFTA_HASH_SREG] ||
 131             !tb[NFTA_HASH_DREG] ||
 132             !tb[NFTA_HASH_LEN]  ||
 133             !tb[NFTA_HASH_MODULUS])
 134                 return -EINVAL;
 135
 136         if (tb[NFTA_HASH_OFFSET])
 137                 priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
 138
 139         priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]);
 140         priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
 141
 142         err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
 143         if (err < 0)
 144                 return err;
 145         if (len == 0)
 146                 return -ERANGE;
 147
 148         priv->len = len;
 149
 150         priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
 151         if (priv->modulus < 1)
 152                 return -ERANGE;
 153
 154         if (priv->offset + priv->modulus - 1 < priv->offset)
 155                 return -EOVERFLOW;
 156
 157         if (tb[NFTA_HASH_SEED]) {
 158                 priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED]));
 159         } else {
 160                 priv->autogen_seed = true;
 161                 get_random_bytes(&priv->seed, sizeof(priv->seed));
 162         }
 163
 164         return nft_validate_register_load(priv->sreg, len) &&
 165                nft_validate_register_store(ctx, priv->dreg, NULL,
 166                                            NFT_DATA_VALUE, sizeof(u32));
 167 }
 168
 169 static int nft_jhash_map_init(const struct nft_ctx *ctx,
 170                               const struct nft_expr *expr,
 171                               const struct nlattr * const tb[])
 172 {
 173         struct nft_jhash *priv = nft_expr_priv(expr);
 174         u8 genmask = nft_genmask_next(ctx->net);
 175
 176         nft_jhash_init(ctx, expr, tb);
 177         priv->map = nft_set_lookup_global(ctx->net, ctx->table,
 178                                           tb[NFTA_HASH_SET_NAME],
 179                                           tb[NFTA_HASH_SET_ID], genmask);
 180         return PTR_ERR_OR_ZERO(priv->map);
 181 }
 182
 183 static int nft_symhash_init(const struct nft_ctx *ctx,
 184                             const struct nft_expr *expr,
 185                             const struct nlattr * const tb[])
 186 {
 187         struct nft_symhash *priv = nft_expr_priv(expr);
 188
 189         if (!tb[NFTA_HASH_DREG]    ||
 190             !tb[NFTA_HASH_MODULUS])
 191                 return -EINVAL;
 192
 193         if (tb[NFTA_HASH_OFFSET])
 194                 priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
 195
 196         priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
 197
 198         priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
 199         if (priv->modulus <= 1)
 200                 return -ERANGE;
 201
 202         if (priv->offset + priv->modulus - 1 < priv->offset)
 203                 return -EOVERFLOW;
 204
 205         return nft_validate_register_store(ctx, priv->dreg, NULL,
 206                                            NFT_DATA_VALUE, sizeof(u32));
 207 }
 208
 209 static int nft_symhash_map_init(const struct nft_ctx *ctx,
 210                                 const struct nft_expr *expr,
 211                                 const struct nlattr * const tb[])
 212 {
 213         struct nft_jhash *priv = nft_expr_priv(expr);
 214         u8 genmask = nft_genmask_next(ctx->net);
 215
 216         nft_symhash_init(ctx, expr, tb);
 217         priv->map = nft_set_lookup_global(ctx->net, ctx->table,
 218                                           tb[NFTA_HASH_SET_NAME],
 219                                           tb[NFTA_HASH_SET_ID], genmask);
 220         return PTR_ERR_OR_ZERO(priv->map);
 221 }
 222
 223 static int nft_jhash_dump(struct sk_buff *skb,
 224                           const struct nft_expr *expr)
 225 {
 226         const struct nft_jhash *priv = nft_expr_priv(expr);
 227
 228         if (nft_dump_register(skb, NFTA_HASH_SREG, priv->sreg))
 229                 goto nla_put_failure;
 230         if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg))
 231                 goto nla_put_failure;
 232         if (nla_put_be32(skb, NFTA_HASH_LEN, htonl(priv->len)))
 233                 goto nla_put_failure;
 234         if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
 235                 goto nla_put_failure;
 236         if (!priv->autogen_seed &&
 237             nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed)))
 238                 goto nla_put_failure;
 239         if (priv->offset != 0)
 240                 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
 241                         goto nla_put_failure;
 242         if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_JENKINS)))
 243                 goto nla_put_failure;
 244         return 0;
 245
 246 nla_put_failure:
 247         return -1;
 248 }
 249
 250 static int nft_jhash_map_dump(struct sk_buff *skb,
 251                                const struct nft_expr *expr)
 252 {
 253         const struct nft_jhash *priv = nft_expr_priv(expr);
 254
 255         if (nft_jhash_dump(skb, expr) ||
 256             nla_put_string(skb, NFTA_HASH_SET_NAME, priv->map->name))
 257                 return -1;
 258
 259         return 0;
 260 }
 261
 262 static int nft_symhash_dump(struct sk_buff *skb,
 263                             const struct nft_expr *expr)
 264 {
 265         const struct nft_symhash *priv = nft_expr_priv(expr);
 266
 267         if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg))
 268                 goto nla_put_failure;
 269         if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
 270                 goto nla_put_failure;
 271         if (priv->offset != 0)
 272                 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
 273                         goto nla_put_failure;
 274         if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_SYM)))
 275                 goto nla_put_failure;
 276         return 0;
 277
 278 nla_put_failure:
 279         return -1;
 280 }
 281
 282 static int nft_symhash_map_dump(struct sk_buff *skb,
 283                                 const struct nft_expr *expr)
 284 {
 285         const struct nft_symhash *priv = nft_expr_priv(expr);
 286
 287         if (nft_symhash_dump(skb, expr) ||
 288             nla_put_string(skb, NFTA_HASH_SET_NAME, priv->map->name))
 289                 return -1;
 290
 291         return 0;
 292 }
 293
 294 static struct nft_expr_type nft_hash_type;
 295 static const struct nft_expr_ops nft_jhash_ops = {
 296         .type           = &nft_hash_type,
 297         .size           = NFT_EXPR_SIZE(sizeof(struct nft_jhash)),
 298         .eval           = nft_jhash_eval,
 299         .init           = nft_jhash_init,
 300         .dump           = nft_jhash_dump,
 301 };
 302
 303 static const struct nft_expr_ops nft_jhash_map_ops = {
 304         .type           = &nft_hash_type,
 305         .size           = NFT_EXPR_SIZE(sizeof(struct nft_jhash)),
 306         .eval           = nft_jhash_map_eval,
 307         .init           = nft_jhash_map_init,
 308         .dump           = nft_jhash_map_dump,
 309 };
 310
 311 static const struct nft_expr_ops nft_symhash_ops = {
 312         .type           = &nft_hash_type,
 313         .size           = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
 314         .eval           = nft_symhash_eval,
 315         .init           = nft_symhash_init,
 316         .dump           = nft_symhash_dump,
 317 };
 318
 319 static const struct nft_expr_ops nft_symhash_map_ops = {
 320         .type           = &nft_hash_type,
 321         .size           = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
 322         .eval           = nft_symhash_map_eval,
 323         .init           = nft_symhash_map_init,
 324         .dump           = nft_symhash_map_dump,
 325 };
 326
 327 static const struct nft_expr_ops *
 328 nft_hash_select_ops(const struct nft_ctx *ctx,
 329                     const struct nlattr * const tb[])
 330 {
 331         u32 type;
 332
 333         if (!tb[NFTA_HASH_TYPE])
 334                 return &nft_jhash_ops;
 335
 336         type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE]));
 337         switch (type) {
 338         case NFT_HASH_SYM:
 339                 if (tb[NFTA_HASH_SET_NAME])
 340                         return &nft_symhash_map_ops;
 341                 return &nft_symhash_ops;
 342         case NFT_HASH_JENKINS:
 343                 if (tb[NFTA_HASH_SET_NAME])
 344                         return &nft_jhash_map_ops;
 345                 return &nft_jhash_ops;
 346         default:
 347                 break;
 348         }
 349         return ERR_PTR(-EOPNOTSUPP);
 350 }
 351
 352 static struct nft_expr_type nft_hash_type __read_mostly = {
 353         .name           = "hash",
 354         .select_ops     = nft_hash_select_ops,
 355         .policy         = nft_hash_policy,
 356         .maxattr        = NFTA_HASH_MAX,
 357         .owner          = THIS_MODULE,
 358 };
 359
 360 static int __init nft_hash_module_init(void)
 361 {
 362         return nft_register_expr(&nft_hash_type);
 363 }
 364
 365 static void __exit nft_hash_module_exit(void)
 366 {
 367         nft_unregister_expr(&nft_hash_type);
 368 }
 369
 370 module_init(nft_hash_module_init);
 371 module_exit(nft_hash_module_exit);
 372
 373 MODULE_LICENSE("GPL");
 374 MODULE_AUTHOR("Laura Garcia <nevola@gmail.com>");
 375 MODULE_ALIAS_NFT_EXPR("hash");