1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (c) 2009 Patrick McHardy <kaber@trash.net>
4 *
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8#include <linux/kernel.h>
9#include <linux/init.h>
10#include <linux/list.h>
11#include <linux/rbtree.h>
12#include <linux/netlink.h>
13#include <linux/netfilter.h>
14#include <linux/netfilter/nf_tables.h>
15#include <net/netfilter/nf_tables.h>
16#include <net/netfilter/nf_tables_core.h>
17
18struct nft_lookup {
19 struct nft_set *set;
20 u8 sreg;
21 u8 dreg;
22 bool dreg_set;
23 bool invert;
24 struct nft_set_binding binding;
25};
26
27static const struct nft_set_ext *
28__nft_set_do_lookup(const struct net *net, const struct nft_set *set,
29 const u32 *key)
30{
31#ifdef CONFIG_MITIGATION_RETPOLINE
32 if (set->ops == &nft_set_hash_fast_type.ops)
33 return nft_hash_lookup_fast(net, set, key);
34 if (set->ops == &nft_set_hash_type.ops)
35 return nft_hash_lookup(net, set, key);
36
37 if (set->ops == &nft_set_rhash_type.ops)
38 return nft_rhash_lookup(net, set, key);
39
40 if (set->ops == &nft_set_bitmap_type.ops)
41 return nft_bitmap_lookup(net, set, key);
42
43 if (set->ops == &nft_set_pipapo_type.ops)
44 return nft_pipapo_lookup(net, set, key);
45#if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
46 if (set->ops == &nft_set_pipapo_avx2_type.ops)
47 return nft_pipapo_avx2_lookup(net, set, key);
48#endif
49
50 if (set->ops == &nft_set_rbtree_type.ops)
51 return nft_rbtree_lookup(net, set, key);
52
53 WARN_ON_ONCE(1);
54#endif
55 return set->ops->lookup(net, set, key);
56}
57
58static unsigned int nft_base_seq(const struct net *net)
59{
60 /* pairs with smp_store_release() in nf_tables_commit() */
61 return smp_load_acquire(&net->nft.base_seq);
62}
63
64static bool nft_lookup_should_retry(const struct net *net, unsigned int seq)
65{
66 return unlikely(seq != nft_base_seq(net));
67}
68
69const struct nft_set_ext *
70nft_set_do_lookup(const struct net *net, const struct nft_set *set,
71 const u32 *key)
72{
73 const struct nft_set_ext *ext;
74 unsigned int base_seq;
75
76 do {
77 base_seq = nft_base_seq(net);
78
79 ext = __nft_set_do_lookup(net, set, key);
80 if (ext)
81 break;
82 /* No match? There is a small chance that lookup was
83 * performed in the old generation, but nf_tables_commit()
84 * already unlinked a (matching) element.
85 *
86 * We need to repeat the lookup to make sure that we didn't
87 * miss a matching element in the new generation.
88 */
89 } while (nft_lookup_should_retry(net, seq: base_seq));
90
91 return ext;
92}
93EXPORT_SYMBOL_GPL(nft_set_do_lookup);
94
95void nft_lookup_eval(const struct nft_expr *expr,
96 struct nft_regs *regs,
97 const struct nft_pktinfo *pkt)
98{
99 const struct nft_lookup *priv = nft_expr_priv(expr);
100 const struct nft_set *set = priv->set;
101 const struct net *net = nft_net(pkt);
102 const struct nft_set_ext *ext;
103 bool found;
104
105 ext = nft_set_do_lookup(net, set, &regs->data[priv->sreg]);
106 found = !!ext ^ priv->invert;
107 if (!found) {
108 ext = nft_set_catchall_lookup(net, set);
109 if (!ext) {
110 regs->verdict.code = NFT_BREAK;
111 return;
112 }
113 }
114
115 if (ext) {
116 if (priv->dreg_set)
117 nft_data_copy(dst: &regs->data[priv->dreg],
118 src: nft_set_ext_data(ext), len: set->dlen);
119
120 nft_set_elem_update_expr(ext, regs, pkt);
121 }
122}
123
124static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {
125 [NFTA_LOOKUP_SET] = { .type = NLA_STRING,
126 .len = NFT_SET_MAXNAMELEN - 1 },
127 [NFTA_LOOKUP_SET_ID] = { .type = NLA_U32 },
128 [NFTA_LOOKUP_SREG] = { .type = NLA_U32 },
129 [NFTA_LOOKUP_DREG] = { .type = NLA_U32 },
130 [NFTA_LOOKUP_FLAGS] =
131 NLA_POLICY_MASK(NLA_BE32, NFT_LOOKUP_F_INV),
132};
133
134static int nft_lookup_init(const struct nft_ctx *ctx,
135 const struct nft_expr *expr,
136 const struct nlattr * const tb[])
137{
138 struct nft_lookup *priv = nft_expr_priv(expr);
139 u8 genmask = nft_genmask_next(net: ctx->net);
140 struct nft_set *set;
141 u32 flags;
142 int err;
143
144 if (tb[NFTA_LOOKUP_SET] == NULL ||
145 tb[NFTA_LOOKUP_SREG] == NULL)
146 return -EINVAL;
147
148 set = nft_set_lookup_global(net: ctx->net, table: ctx->table, nla_set_name: tb[NFTA_LOOKUP_SET],
149 nla_set_id: tb[NFTA_LOOKUP_SET_ID], genmask);
150 if (IS_ERR(ptr: set))
151 return PTR_ERR(ptr: set);
152
153 err = nft_parse_register_load(ctx, attr: tb[NFTA_LOOKUP_SREG], sreg: &priv->sreg,
154 len: set->klen);
155 if (err < 0)
156 return err;
157
158 if (tb[NFTA_LOOKUP_FLAGS]) {
159 flags = ntohl(nla_get_be32(tb[NFTA_LOOKUP_FLAGS]));
160
161 if (flags & NFT_LOOKUP_F_INV)
162 priv->invert = true;
163 }
164
165 if (tb[NFTA_LOOKUP_DREG] != NULL) {
166 if (priv->invert)
167 return -EINVAL;
168 if (!(set->flags & NFT_SET_MAP))
169 return -EINVAL;
170
171 err = nft_parse_register_store(ctx, attr: tb[NFTA_LOOKUP_DREG],
172 dreg: &priv->dreg, NULL,
173 type: nft_set_datatype(set),
174 len: set->dlen);
175 if (err < 0)
176 return err;
177 priv->dreg_set = true;
178 } else if (set->flags & NFT_SET_MAP) {
179 /* Map given, but user asks for lookup only (i.e. to
180 * ignore value assoicated with key).
181 *
182 * This makes no sense for anonymous maps since they are
183 * scoped to the rule, but for named sets this can be useful.
184 */
185 if (set->flags & NFT_SET_ANONYMOUS)
186 return -EINVAL;
187 }
188
189 priv->binding.flags = set->flags & NFT_SET_MAP;
190
191 err = nf_tables_bind_set(ctx, set, binding: &priv->binding);
192 if (err < 0)
193 return err;
194
195 priv->set = set;
196 return 0;
197}
198
199static void nft_lookup_deactivate(const struct nft_ctx *ctx,
200 const struct nft_expr *expr,
201 enum nft_trans_phase phase)
202{
203 struct nft_lookup *priv = nft_expr_priv(expr);
204
205 nf_tables_deactivate_set(ctx, set: priv->set, binding: &priv->binding, phase);
206}
207
208static void nft_lookup_activate(const struct nft_ctx *ctx,
209 const struct nft_expr *expr)
210{
211 struct nft_lookup *priv = nft_expr_priv(expr);
212
213 nf_tables_activate_set(ctx, set: priv->set);
214}
215
216static void nft_lookup_destroy(const struct nft_ctx *ctx,
217 const struct nft_expr *expr)
218{
219 struct nft_lookup *priv = nft_expr_priv(expr);
220
221 nf_tables_destroy_set(ctx, set: priv->set);
222}
223
224static int nft_lookup_dump(struct sk_buff *skb,
225 const struct nft_expr *expr, bool reset)
226{
227 const struct nft_lookup *priv = nft_expr_priv(expr);
228 u32 flags = priv->invert ? NFT_LOOKUP_F_INV : 0;
229
230 if (nla_put_string(skb, attrtype: NFTA_LOOKUP_SET, str: priv->set->name))
231 goto nla_put_failure;
232 if (nft_dump_register(skb, attr: NFTA_LOOKUP_SREG, reg: priv->sreg))
233 goto nla_put_failure;
234 if (priv->dreg_set)
235 if (nft_dump_register(skb, attr: NFTA_LOOKUP_DREG, reg: priv->dreg))
236 goto nla_put_failure;
237 if (nla_put_be32(skb, attrtype: NFTA_LOOKUP_FLAGS, htonl(flags)))
238 goto nla_put_failure;
239 return 0;
240
241nla_put_failure:
242 return -1;
243}
244
245static int nft_lookup_validate(const struct nft_ctx *ctx,
246 const struct nft_expr *expr)
247{
248 const struct nft_lookup *priv = nft_expr_priv(expr);
249 struct nft_set_iter iter = {
250 .genmask = nft_genmask_next(net: ctx->net),
251 .type = NFT_ITER_UPDATE,
252 .fn = nft_setelem_validate,
253 };
254
255 if (!(priv->set->flags & NFT_SET_MAP) ||
256 priv->set->dtype != NFT_DATA_VERDICT)
257 return 0;
258
259 priv->set->ops->walk(ctx, priv->set, &iter);
260 if (!iter.err)
261 iter.err = nft_set_catchall_validate(ctx, set: priv->set);
262
263 if (iter.err < 0)
264 return iter.err;
265
266 return 0;
267}
268
269static bool nft_lookup_reduce(struct nft_regs_track *track,
270 const struct nft_expr *expr)
271{
272 const struct nft_lookup *priv = nft_expr_priv(expr);
273
274 if (priv->set->flags & NFT_SET_MAP)
275 nft_reg_track_cancel(track, dreg: priv->dreg, len: priv->set->dlen);
276
277 return false;
278}
279
280static const struct nft_expr_ops nft_lookup_ops = {
281 .type = &nft_lookup_type,
282 .size = NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
283 .eval = nft_lookup_eval,
284 .init = nft_lookup_init,
285 .activate = nft_lookup_activate,
286 .deactivate = nft_lookup_deactivate,
287 .destroy = nft_lookup_destroy,
288 .dump = nft_lookup_dump,
289 .validate = nft_lookup_validate,
290 .reduce = nft_lookup_reduce,
291};
292
293struct nft_expr_type nft_lookup_type __read_mostly = {
294 .name = "lookup",
295 .ops = &nft_lookup_ops,
296 .policy = nft_lookup_policy,
297 .maxattr = NFTA_LOOKUP_MAX,
298 .owner = THIS_MODULE,
299};
300

source code of linux/net/netfilter/nft_lookup.c