2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nf_tables.h>
19 #include <linux/ipv6.h>
20 #include <linux/smp.h>
23 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
24 #include <net/netfilter/nf_tables.h>
25 #include <net/netfilter/nft_meta.h>
27 void nft_meta_get_eval(const struct nft_expr *expr,
28 struct nft_data data[NFT_REG_MAX + 1],
29 const struct nft_pktinfo *pkt)
31 const struct nft_meta *priv = nft_expr_priv(expr);
32 const struct sk_buff *skb = pkt->skb;
33 const struct net_device *in = pkt->in, *out = pkt->out;
34 struct nft_data *dest = &data[priv->dreg];
38 dest->data[0] = skb->len;
40 case NFT_META_PROTOCOL:
41 *(__be16 *)dest->data = skb->protocol;
43 case NFT_META_NFPROTO:
44 dest->data[0] = pkt->ops->pf;
46 case NFT_META_L4PROTO:
47 dest->data[0] = pkt->tprot;
49 case NFT_META_PRIORITY:
50 dest->data[0] = skb->priority;
53 dest->data[0] = skb->mark;
58 dest->data[0] = in->ifindex;
63 dest->data[0] = out->ifindex;
65 case NFT_META_IIFNAME:
68 strncpy((char *)dest->data, in->name, sizeof(dest->data));
70 case NFT_META_OIFNAME:
73 strncpy((char *)dest->data, out->name, sizeof(dest->data));
75 case NFT_META_IIFTYPE:
78 *(u16 *)dest->data = in->type;
80 case NFT_META_OIFTYPE:
83 *(u16 *)dest->data = out->type;
86 if (skb->sk == NULL || skb->sk->sk_state == TCP_TIME_WAIT)
89 read_lock_bh(&skb->sk->sk_callback_lock);
90 if (skb->sk->sk_socket == NULL ||
91 skb->sk->sk_socket->file == NULL) {
92 read_unlock_bh(&skb->sk->sk_callback_lock);
97 from_kuid_munged(&init_user_ns,
98 skb->sk->sk_socket->file->f_cred->fsuid);
99 read_unlock_bh(&skb->sk->sk_callback_lock);
102 if (skb->sk == NULL || skb->sk->sk_state == TCP_TIME_WAIT)
105 read_lock_bh(&skb->sk->sk_callback_lock);
106 if (skb->sk->sk_socket == NULL ||
107 skb->sk->sk_socket->file == NULL) {
108 read_unlock_bh(&skb->sk->sk_callback_lock);
112 from_kgid_munged(&init_user_ns,
113 skb->sk->sk_socket->file->f_cred->fsgid);
114 read_unlock_bh(&skb->sk->sk_callback_lock);
116 #ifdef CONFIG_IP_ROUTE_CLASSID
117 case NFT_META_RTCLASSID: {
118 const struct dst_entry *dst = skb_dst(skb);
122 dest->data[0] = dst->tclassid;
126 #ifdef CONFIG_NETWORK_SECMARK
127 case NFT_META_SECMARK:
128 dest->data[0] = skb->secmark;
131 case NFT_META_PKTTYPE:
132 if (skb->pkt_type != PACKET_LOOPBACK) {
133 dest->data[0] = skb->pkt_type;
137 switch (pkt->ops->pf) {
139 if (ipv4_is_multicast(ip_hdr(skb)->daddr))
140 dest->data[0] = PACKET_MULTICAST;
142 dest->data[0] = PACKET_BROADCAST;
145 if (ipv6_hdr(skb)->daddr.s6_addr[0] == 0xFF)
146 dest->data[0] = PACKET_MULTICAST;
148 dest->data[0] = PACKET_BROADCAST;
156 dest->data[0] = smp_processor_id();
158 case NFT_META_IIFGROUP:
161 dest->data[0] = in->group;
163 case NFT_META_OIFGROUP:
166 dest->data[0] = out->group;
175 data[NFT_REG_VERDICT].verdict = NFT_BREAK;
177 EXPORT_SYMBOL_GPL(nft_meta_get_eval);
179 void nft_meta_set_eval(const struct nft_expr *expr,
180 struct nft_data data[NFT_REG_MAX + 1],
181 const struct nft_pktinfo *pkt)
183 const struct nft_meta *meta = nft_expr_priv(expr);
184 struct sk_buff *skb = pkt->skb;
185 u32 value = data[meta->sreg].data[0];
191 case NFT_META_PRIORITY:
192 skb->priority = value;
194 case NFT_META_NFTRACE:
201 EXPORT_SYMBOL_GPL(nft_meta_set_eval);
203 const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
204 [NFTA_META_DREG] = { .type = NLA_U32 },
205 [NFTA_META_KEY] = { .type = NLA_U32 },
206 [NFTA_META_SREG] = { .type = NLA_U32 },
208 EXPORT_SYMBOL_GPL(nft_meta_policy);
210 int nft_meta_get_init(const struct nft_ctx *ctx,
211 const struct nft_expr *expr,
212 const struct nlattr * const tb[])
214 struct nft_meta *priv = nft_expr_priv(expr);
217 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
220 case NFT_META_PROTOCOL:
221 case NFT_META_NFPROTO:
222 case NFT_META_L4PROTO:
223 case NFT_META_PRIORITY:
227 case NFT_META_IIFNAME:
228 case NFT_META_OIFNAME:
229 case NFT_META_IIFTYPE:
230 case NFT_META_OIFTYPE:
233 #ifdef CONFIG_IP_ROUTE_CLASSID
234 case NFT_META_RTCLASSID:
236 #ifdef CONFIG_NETWORK_SECMARK
237 case NFT_META_SECMARK:
239 case NFT_META_PKTTYPE:
241 case NFT_META_IIFGROUP:
242 case NFT_META_OIFGROUP:
248 priv->dreg = ntohl(nla_get_be32(tb[NFTA_META_DREG]));
249 err = nft_validate_output_register(priv->dreg);
253 err = nft_validate_data_load(ctx, priv->dreg, NULL, NFT_DATA_VALUE);
259 EXPORT_SYMBOL_GPL(nft_meta_get_init);
261 int nft_meta_set_init(const struct nft_ctx *ctx,
262 const struct nft_expr *expr,
263 const struct nlattr * const tb[])
265 struct nft_meta *priv = nft_expr_priv(expr);
268 priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
271 case NFT_META_PRIORITY:
272 case NFT_META_NFTRACE:
278 priv->sreg = ntohl(nla_get_be32(tb[NFTA_META_SREG]));
279 err = nft_validate_input_register(priv->sreg);
285 EXPORT_SYMBOL_GPL(nft_meta_set_init);
287 int nft_meta_get_dump(struct sk_buff *skb,
288 const struct nft_expr *expr)
290 const struct nft_meta *priv = nft_expr_priv(expr);
292 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
293 goto nla_put_failure;
294 if (nla_put_be32(skb, NFTA_META_DREG, htonl(priv->dreg)))
295 goto nla_put_failure;
301 EXPORT_SYMBOL_GPL(nft_meta_get_dump);
303 int nft_meta_set_dump(struct sk_buff *skb,
304 const struct nft_expr *expr)
306 const struct nft_meta *priv = nft_expr_priv(expr);
308 if (nla_put_be32(skb, NFTA_META_KEY, htonl(priv->key)))
309 goto nla_put_failure;
310 if (nla_put_be32(skb, NFTA_META_SREG, htonl(priv->sreg)))
311 goto nla_put_failure;
318 EXPORT_SYMBOL_GPL(nft_meta_set_dump);
320 static struct nft_expr_type nft_meta_type;
321 static const struct nft_expr_ops nft_meta_get_ops = {
322 .type = &nft_meta_type,
323 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
324 .eval = nft_meta_get_eval,
325 .init = nft_meta_get_init,
326 .dump = nft_meta_get_dump,
329 static const struct nft_expr_ops nft_meta_set_ops = {
330 .type = &nft_meta_type,
331 .size = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
332 .eval = nft_meta_set_eval,
333 .init = nft_meta_set_init,
334 .dump = nft_meta_set_dump,
337 static const struct nft_expr_ops *
338 nft_meta_select_ops(const struct nft_ctx *ctx,
339 const struct nlattr * const tb[])
341 if (tb[NFTA_META_KEY] == NULL)
342 return ERR_PTR(-EINVAL);
344 if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
345 return ERR_PTR(-EINVAL);
347 if (tb[NFTA_META_DREG])
348 return &nft_meta_get_ops;
350 if (tb[NFTA_META_SREG])
351 return &nft_meta_set_ops;
353 return ERR_PTR(-EINVAL);
356 static struct nft_expr_type nft_meta_type __read_mostly = {
358 .select_ops = &nft_meta_select_ops,
359 .policy = nft_meta_policy,
360 .maxattr = NFTA_META_MAX,
361 .owner = THIS_MODULE,
364 static int __init nft_meta_module_init(void)
366 return nft_register_expr(&nft_meta_type);
369 static void __exit nft_meta_module_exit(void)
371 nft_unregister_expr(&nft_meta_type);
374 module_init(nft_meta_module_init);
375 module_exit(nft_meta_module_exit);
377 MODULE_LICENSE("GPL");
378 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
379 MODULE_ALIAS_NFT_EXPR("meta");