Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c97d22e6 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add stateful object reference expression 



This new expression allows us to refer to existing stateful objects from
rules.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 173705d9

include/uapi/linux/netfilter/nf_tables.h

+14 −0
Original line number Diff line number Diff line
@@ -1137,6 +1137,20 @@ enum nft_fwd_attributes { 
};

#define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)



/**

 * enum nft_objref_attributes - nf_tables stateful object expression netlink attributes

 *

 * @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)

 * @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)

 */

enum nft_objref_attributes {

	NFTA_OBJREF_UNSPEC,

	NFTA_OBJREF_IMM_TYPE,

	NFTA_OBJREF_IMM_NAME,

	__NFTA_OBJREF_MAX

};

#define NFTA_OBJREF_MAX	(__NFTA_OBJREF_MAX - 1)



/**

 * enum nft_gen_attributes - nf_tables ruleset generation attributes

 *

net/netfilter/Kconfig

+6 −0
Original line number Diff line number Diff line
@@ -551,6 +551,12 @@ config NFT_NAT 
	  This option adds the "nat" expression that you can use to perform

	  typical Network Address Translation (NAT) packet transformations.



config NFT_OBJREF

	tristate "Netfilter nf_tables stateful object reference module"

	help

	  This option adds the "objref" expression that allows you to refer to

	  stateful objects, such as counters and quotas.



config NFT_QUEUE

	depends on NETFILTER_NETLINK_QUEUE

	tristate "Netfilter nf_tables queue module"

net/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -88,6 +88,7 @@ obj-$(CONFIG_NFT_NUMGEN) += nft_numgen.o 
obj-$(CONFIG_NFT_CT)		+= nft_ct.o

obj-$(CONFIG_NFT_LIMIT)		+= nft_limit.o

obj-$(CONFIG_NFT_NAT)		+= nft_nat.o

obj-$(CONFIG_NFT_OBJREF)	+= nft_objref.o

obj-$(CONFIG_NFT_QUEUE)		+= nft_queue.o

obj-$(CONFIG_NFT_QUOTA)		+= nft_quota.o

obj-$(CONFIG_NFT_REJECT) 	+= nft_reject.o

net/netfilter/nft_objref.c

0 → 100644
+112 −0
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2012-2016 Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * This program is free software; you can redistribute it and/or modify it

 * under the terms and conditions of the GNU General Public License,

 * version 2, as published by the Free Software Foundation.

 */



#include <linux/init.h>

#include <linux/module.h>

#include <linux/skbuff.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>



#define nft_objref_priv(expr)	*((struct nft_object **)nft_expr_priv(expr))



static void nft_objref_eval(const struct nft_expr *expr,

			    struct nft_regs *regs,

			    const struct nft_pktinfo *pkt)

{

	struct nft_object *obj = nft_objref_priv(expr);



	obj->type->eval(obj, regs, pkt);

}



static int nft_objref_init(const struct nft_ctx *ctx,

			   const struct nft_expr *expr,

			   const struct nlattr * const tb[])

{

	struct nft_object *obj = nft_objref_priv(expr);

	u8 genmask = nft_genmask_next(ctx->net);

	u32 objtype;



	if (!tb[NFTA_OBJREF_IMM_NAME] ||

	    !tb[NFTA_OBJREF_IMM_TYPE])

		return -EINVAL;



	objtype = ntohl(nla_get_be32(tb[NFTA_OBJREF_IMM_TYPE]));

	obj = nf_tables_obj_lookup(ctx->table, tb[NFTA_OBJREF_IMM_NAME], objtype,

				   genmask);

	if (IS_ERR(obj))

		return -ENOENT;



	nft_objref_priv(expr) = obj;

	obj->use++;



	return 0;

}



static int nft_objref_dump(struct sk_buff *skb, const struct nft_expr *expr)

{

	const struct nft_object *obj = nft_objref_priv(expr);



	if (nla_put_string(skb, NFTA_OBJREF_IMM_NAME, obj->name) ||

	    nla_put_be32(skb, NFTA_OBJREF_IMM_TYPE, htonl(obj->type->type)))

		goto nla_put_failure;



	return 0;



nla_put_failure:

	return -1;

}



static void nft_objref_destroy(const struct nft_ctx *ctx,

			       const struct nft_expr *expr)

{

	struct nft_object *obj = nft_objref_priv(expr);



	obj->use--;

}



static struct nft_expr_type nft_objref_type;

static const struct nft_expr_ops nft_objref_ops = {

	.type		= &nft_objref_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_object *)),

	.eval		= nft_objref_eval,

	.init		= nft_objref_init,

	.destroy	= nft_objref_destroy,

	.dump		= nft_objref_dump,

};



static const struct nla_policy nft_objref_policy[NFTA_OBJREF_MAX + 1] = {

	[NFTA_OBJREF_IMM_NAME]	= { .type = NLA_STRING },

	[NFTA_OBJREF_IMM_TYPE]	= { .type = NLA_U32 },

};



static struct nft_expr_type nft_objref_type __read_mostly = {

	.name		= "objref",

	.ops		= &nft_objref_ops,

	.policy		= nft_objref_policy,

	.maxattr	= NFTA_OBJREF_MAX,

	.owner		= THIS_MODULE,

};



static int __init nft_objref_module_init(void)

{

	return nft_register_expr(&nft_objref_type);

}



static void __exit nft_objref_module_exit(void)

{

	nft_unregister_expr(&nft_objref_type);

}



module_init(nft_objref_module_init);

module_exit(nft_objref_module_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");

MODULE_ALIAS_NFT_EXPR("objref");