1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/kernel.h> 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/rbtree.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables.h> 16 #include <net/netfilter/nf_tables_core.h> 17 18 struct nft_lookup { 19 struct nft_set *set; 20 u8 sreg; 21 u8 dreg; 22 bool dreg_set; 23 bool invert; 24 struct nft_set_binding binding; 25 }; 26 27 static const struct nft_set_ext * 28 __nft_set_do_lookup(const struct net *net, const struct nft_set *set, 29 const u32 *key) 30 { 31 #ifdef CONFIG_MITIGATION_RETPOLINE 32 if (set->ops == &nft_set_hash_fast_type.ops) 33 return nft_hash_lookup_fast(net, set, key); 34 if (set->ops == &nft_set_hash_type.ops) 35 return nft_hash_lookup(net, set, key); 36 37 if (set->ops == &nft_set_rhash_type.ops) 38 return nft_rhash_lookup(net, set, key); 39 40 if (set->ops == &nft_set_bitmap_type.ops) 41 return nft_bitmap_lookup(net, set, key); 42 43 if (set->ops == &nft_set_pipapo_type.ops) 44 return nft_pipapo_lookup(net, set, key); 45 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML) 46 if (set->ops == &nft_set_pipapo_avx2_type.ops) 47 return nft_pipapo_avx2_lookup(net, set, key); 48 #endif 49 50 if (set->ops == &nft_set_rbtree_type.ops) 51 return nft_rbtree_lookup(net, set, key); 52 53 WARN_ON_ONCE(1); 54 #endif 55 return set->ops->lookup(net, set, key); 56 } 57 58 static unsigned int nft_base_seq(const struct net *net) 59 { 60 /* pairs with smp_store_release() in nf_tables_commit() */ 61 return smp_load_acquire(&net->nft.base_seq); 62 } 63 64 static bool nft_lookup_should_retry(const struct net *net, unsigned int seq) 65 { 66 return unlikely(seq != nft_base_seq(net)); 67 } 68 69 const struct nft_set_ext * 70 nft_set_do_lookup(const struct net *net, const struct nft_set *set, 71 const u32 *key) 72 { 73 const struct nft_set_ext *ext; 74 unsigned int base_seq; 75 76 do { 77 base_seq = nft_base_seq(net); 78 79 ext = __nft_set_do_lookup(net, set, key); 80 if (ext) 81 break; 82 /* No match? There is a small chance that lookup was 83 * performed in the old generation, but nf_tables_commit() 84 * already unlinked a (matching) element. 85 * 86 * We need to repeat the lookup to make sure that we didn't 87 * miss a matching element in the new generation. 88 */ 89 } while (nft_lookup_should_retry(net, base_seq)); 90 91 return ext; 92 } 93 EXPORT_SYMBOL_GPL(nft_set_do_lookup); 94 95 void nft_lookup_eval(const struct nft_expr *expr, 96 struct nft_regs *regs, 97 const struct nft_pktinfo *pkt) 98 { 99 const struct nft_lookup *priv = nft_expr_priv(expr); 100 const struct nft_set *set = priv->set; 101 const struct net *net = nft_net(pkt); 102 const struct nft_set_ext *ext; 103 bool found; 104 105 ext = nft_set_do_lookup(net, set, ®s->data[priv->sreg]); 106 found = !!ext ^ priv->invert; 107 if (!found) { 108 ext = nft_set_catchall_lookup(net, set); 109 if (!ext) { 110 regs->verdict.code = NFT_BREAK; 111 return; 112 } 113 } 114 115 if (ext) { 116 if (priv->dreg_set) 117 nft_data_copy(®s->data[priv->dreg], 118 nft_set_ext_data(ext), set->dlen); 119 120 nft_set_elem_update_expr(ext, regs, pkt); 121 } 122 } 123 124 static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = { 125 [NFTA_LOOKUP_SET] = { .type = NLA_STRING, 126 .len = NFT_SET_MAXNAMELEN - 1 }, 127 [NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 }, 128 [NFTA_LOOKUP_SREG] = { .type = NLA_U32 }, 129 [NFTA_LOOKUP_DREG] = { .type = NLA_U32 }, 130 [NFTA_LOOKUP_FLAGS] = 131 NLA_POLICY_MASK(NLA_BE32, NFT_LOOKUP_F_INV), 132 }; 133 134 static int nft_lookup_init(const struct nft_ctx *ctx, 135 const struct nft_expr *expr, 136 const struct nlattr * const tb[]) 137 { 138 struct nft_lookup *priv = nft_expr_priv(expr); 139 u8 genmask = nft_genmask_next(ctx->net); 140 struct nft_set *set; 141 u32 flags; 142 int err; 143 144 if (tb[NFTA_LOOKUP_SET] == NULL || 145 tb[NFTA_LOOKUP_SREG] == NULL) 146 return -EINVAL; 147 148 set = nft_set_lookup_global(ctx->net, ctx->table, tb[NFTA_LOOKUP_SET], 149 tb[NFTA_LOOKUP_SET_ID], genmask); 150 if (IS_ERR(set)) 151 return PTR_ERR(set); 152 153 err = nft_parse_register_load(ctx, tb[NFTA_LOOKUP_SREG], &priv->sreg, 154 set->klen); 155 if (err < 0) 156 return err; 157 158 if (tb[NFTA_LOOKUP_FLAGS]) { 159 flags = ntohl(nla_get_be32(tb[NFTA_LOOKUP_FLAGS])); 160 161 if (flags & NFT_LOOKUP_F_INV) 162 priv->invert = true; 163 } 164 165 if (tb[NFTA_LOOKUP_DREG] != NULL) { 166 if (priv->invert) 167 return -EINVAL; 168 if (!(set->flags & NFT_SET_MAP)) 169 return -EINVAL; 170 171 err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG], 172 &priv->dreg, NULL, 173 nft_set_datatype(set), 174 set->dlen); 175 if (err < 0) 176 return err; 177 priv->dreg_set = true; 178 } else if (set->flags & NFT_SET_MAP) { 179 /* Map given, but user asks for lookup only (i.e. to 180 * ignore value assoicated with key). 181 * 182 * This makes no sense for anonymous maps since they are 183 * scoped to the rule, but for named sets this can be useful. 184 */ 185 if (set->flags & NFT_SET_ANONYMOUS) 186 return -EINVAL; 187 } 188 189 priv->binding.flags = set->flags & NFT_SET_MAP; 190 191 err = nf_tables_bind_set(ctx, set, &priv->binding); 192 if (err < 0) 193 return err; 194 195 priv->set = set; 196 return 0; 197 } 198 199 static void nft_lookup_deactivate(const struct nft_ctx *ctx, 200 const struct nft_expr *expr, 201 enum nft_trans_phase phase) 202 { 203 struct nft_lookup *priv = nft_expr_priv(expr); 204 205 nf_tables_deactivate_set(ctx, priv->set, &priv->binding, phase); 206 } 207 208 static void nft_lookup_activate(const struct nft_ctx *ctx, 209 const struct nft_expr *expr) 210 { 211 struct nft_lookup *priv = nft_expr_priv(expr); 212 213 nf_tables_activate_set(ctx, priv->set); 214 } 215 216 static void nft_lookup_destroy(const struct nft_ctx *ctx, 217 const struct nft_expr *expr) 218 { 219 struct nft_lookup *priv = nft_expr_priv(expr); 220 221 nf_tables_destroy_set(ctx, priv->set); 222 } 223 224 static int nft_lookup_dump(struct sk_buff *skb, 225 const struct nft_expr *expr, bool reset) 226 { 227 const struct nft_lookup *priv = nft_expr_priv(expr); 228 u32 flags = priv->invert ? NFT_LOOKUP_F_INV : 0; 229 230 if (nla_put_string(skb, NFTA_LOOKUP_SET, priv->set->name)) 231 goto nla_put_failure; 232 if (nft_dump_register(skb, NFTA_LOOKUP_SREG, priv->sreg)) 233 goto nla_put_failure; 234 if (priv->dreg_set) 235 if (nft_dump_register(skb, NFTA_LOOKUP_DREG, priv->dreg)) 236 goto nla_put_failure; 237 if (nla_put_be32(skb, NFTA_LOOKUP_FLAGS, htonl(flags))) 238 goto nla_put_failure; 239 return 0; 240 241 nla_put_failure: 242 return -1; 243 } 244 245 static int nft_lookup_validate(const struct nft_ctx *ctx, 246 const struct nft_expr *expr) 247 { 248 const struct nft_lookup *priv = nft_expr_priv(expr); 249 struct nft_set_iter iter = { 250 .genmask = nft_genmask_next(ctx->net), 251 .type = NFT_ITER_UPDATE, 252 .fn = nft_setelem_validate, 253 }; 254 255 if (!(priv->set->flags & NFT_SET_MAP) || 256 priv->set->dtype != NFT_DATA_VERDICT) 257 return 0; 258 259 priv->set->ops->walk(ctx, priv->set, &iter); 260 if (!iter.err) 261 iter.err = nft_set_catchall_validate(ctx, priv->set); 262 263 if (iter.err < 0) 264 return iter.err; 265 266 return 0; 267 } 268 269 static bool nft_lookup_reduce(struct nft_regs_track *track, 270 const struct nft_expr *expr) 271 { 272 const struct nft_lookup *priv = nft_expr_priv(expr); 273 274 if (priv->set->flags & NFT_SET_MAP) 275 nft_reg_track_cancel(track, priv->dreg, priv->set->dlen); 276 277 return false; 278 } 279 280 static const struct nft_expr_ops nft_lookup_ops = { 281 .type = &nft_lookup_type, 282 .size = NFT_EXPR_SIZE(sizeof(struct nft_lookup)), 283 .eval = nft_lookup_eval, 284 .init = nft_lookup_init, 285 .activate = nft_lookup_activate, 286 .deactivate = nft_lookup_deactivate, 287 .destroy = nft_lookup_destroy, 288 .dump = nft_lookup_dump, 289 .validate = nft_lookup_validate, 290 .reduce = nft_lookup_reduce, 291 }; 292 293 struct nft_expr_type nft_lookup_type __read_mostly = { 294 .name = "lookup", 295 .ops = &nft_lookup_ops, 296 .policy = nft_lookup_policy, 297 .maxattr = NFTA_LOOKUP_MAX, 298 .owner = THIS_MODULE, 299 }; 300