Commit ef1f7df9 authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: expression ops overloading 



Split the expression ops into two parts and support overloading of
the runtime expression ops based on the requested function through
a ->select_ops() callback.

This can be used to provide optimized implementations, for instance
for loading small aligned amounts of data from the packet or inlining
frequently used operations into the main evaluation loop.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 20a69341

include/net/netfilter/nf_tables.h

+29 −13
Original line number Diff line number Diff line
@@ -222,25 +222,45 @@ extern int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 
extern void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,

				 struct nft_set_binding *binding);





/**

 *	struct nft_expr_ops - nf_tables expression operations

 *	struct nft_expr_type - nf_tables expression type

 *

 *	@eval: Expression evaluation function

 *	@init: initialization function

 *	@destroy: destruction function

 *	@dump: function to dump parameters

 *	@select_ops: function to select nft_expr_ops

 *	@ops: default ops, used when no select_ops functions is present

 *	@list: used internally

 *	@name: Identifier

 *	@owner: module reference

 *	@policy: netlink attribute policy

 *	@maxattr: highest netlink attribute number

 */

struct nft_expr_type {

	const struct nft_expr_ops	*(*select_ops)(const struct nlattr * const tb[]);

	const struct nft_expr_ops	*ops;

	struct list_head		list;

	const char			*name;

	struct module			*owner;

	const struct nla_policy		*policy;

	unsigned int			maxattr;

};



/**

 *	struct nft_expr_ops - nf_tables expression operations

 *

 *	@eval: Expression evaluation function

 *	@size: full expression size, including private data size

 *	@init: initialization function

 *	@destroy: destruction function

 *	@dump: function to dump parameters

 *	@type: expression type

 */

struct nft_expr;

struct nft_expr_ops {

	void				(*eval)(const struct nft_expr *expr,

						struct nft_data data[NFT_REG_MAX + 1],

						const struct nft_pktinfo *pkt);

	unsigned int			size;



	int				(*init)(const struct nft_ctx *ctx,

						const struct nft_expr *expr,

						const struct nlattr * const tb[]);
@@ -248,14 +268,10 @@ struct nft_expr_ops { 
	int				(*dump)(struct sk_buff *skb,

						const struct nft_expr *expr);

	const struct nft_data *		(*get_verdict)(const struct nft_expr *expr);

	struct list_head		list;

	const char			*name;

	struct module			*owner;

	const struct nla_policy		*policy;

	unsigned int			maxattr;

	unsigned int			size;

	const struct nft_expr_type	*type;

};



#define NFT_EXPR_MAXATTR		16

#define NFT_EXPR_SIZE(size)		(sizeof(struct nft_expr) + \

					 ALIGN(size, __alignof__(struct nft_expr)))
@@ -418,8 +434,8 @@ extern void nft_unregister_afinfo(struct nft_af_info *); 
extern int nft_register_table(struct nft_table *, int family);

extern void nft_unregister_table(struct nft_table *, int family);



extern int nft_register_expr(struct nft_expr_ops *);

extern void nft_unregister_expr(struct nft_expr_ops *);

extern int nft_register_expr(struct nft_expr_type *);

extern void nft_unregister_expr(struct nft_expr_type *);



#define MODULE_ALIAS_NFT_FAMILY(family)	\

	MODULE_ALIAS("nft-afinfo-" __stringify(family))

net/ipv4/netfilter/nf_table_nat_ipv4.c

+12 −6
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>

 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as
@@ -149,15 +149,21 @@ nla_put_failure: 
	return -1;

}



static struct nft_expr_ops nft_nat_ops __read_mostly = {

	.name		= "nat",

static struct nft_expr_type nft_nat_type;

static const struct nft_expr_ops nft_nat_ops = {

	.type		= &nft_nat_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_nat)),

	.owner		= THIS_MODULE,

	.eval		= nft_nat_eval,

	.init		= nft_nat_init,

	.dump		= nft_nat_dump,

};



static struct nft_expr_type nft_nat_type __read_mostly = {

	.name		= "nat",

	.ops		= &nft_nat_ops,

	.policy		= nft_nat_policy,

	.maxattr	= NFTA_NAT_MAX,

	.owner		= THIS_MODULE,

};



/*
@@ -382,7 +388,7 @@ static int __init nf_table_nat_init(void) 
	if (err < 0)

		goto err1;



	err = nft_register_expr(&nft_nat_ops);

	err = nft_register_expr(&nft_nat_type);

	if (err < 0)

		goto err2;
@@ -396,7 +402,7 @@ err1: 


static void __exit nf_table_nat_exit(void)

{

	nft_unregister_expr(&nft_nat_ops);

	nft_unregister_expr(&nft_nat_type);

	nft_unregister_table(&nf_table_nat_ipv4, AF_INET);

}

net/ipv4/netfilter/nft_reject_ipv4.c

+12 −6
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>

 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as
@@ -88,25 +88,31 @@ nla_put_failure: 
	return -1;

}



static struct nft_expr_ops reject_ops __read_mostly = {

	.name		= "reject",

static struct nft_expr_type nft_reject_type;

static const struct nft_expr_ops nft_reject_ops = {

	.type		= &nft_reject_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),

	.owner		= THIS_MODULE,

	.eval		= nft_reject_eval,

	.init		= nft_reject_init,

	.dump		= nft_reject_dump,

};



static struct nft_expr_type nft_reject_type __read_mostly = {

	.name		= "reject",

	.ops		= &nft_reject_ops,

	.policy		= nft_reject_policy,

	.maxattr	= NFTA_REJECT_MAX,

	.owner		= THIS_MODULE,

};



static int __init nft_reject_module_init(void)

{

	return nft_register_expr(&reject_ops);

	return nft_register_expr(&nft_reject_type);

}



static void __exit nft_reject_module_exit(void)

{

	nft_unregister_expr(&reject_ops);

	nft_unregister_expr(&nft_reject_type);

}



module_init(nft_reject_module_init);

net/netfilter/nf_tables_api.c

+57 −44
Original line number Diff line number Diff line
@@ -840,64 +840,64 @@ static void nft_ctx_init(struct nft_ctx *ctx, 
 */



/**

 *	nft_register_expr - register nf_tables expr operations

 *	@ops: expr operations

 *	nft_register_expr - register nf_tables expr type

 *	@ops: expr type

 *

 *	Registers the expr operations for use with nf_tables. Returns zero on

 *	Registers the expr type for use with nf_tables. Returns zero on

 *	success or a negative errno code otherwise.

 */

int nft_register_expr(struct nft_expr_ops *ops)

int nft_register_expr(struct nft_expr_type *type)

{

	nfnl_lock(NFNL_SUBSYS_NFTABLES);

	list_add_tail(&ops->list, &nf_tables_expressions);

	list_add_tail(&type->list, &nf_tables_expressions);

	nfnl_unlock(NFNL_SUBSYS_NFTABLES);

	return 0;

}

EXPORT_SYMBOL_GPL(nft_register_expr);



/**

 *	nft_unregister_expr - unregister nf_tables expr operations

 *	@ops: expr operations

 *	nft_unregister_expr - unregister nf_tables expr type

 *	@ops: expr type

 *

 * 	Unregisters the expr operations for use with nf_tables.

 * 	Unregisters the expr typefor use with nf_tables.

 */

void nft_unregister_expr(struct nft_expr_ops *ops)

void nft_unregister_expr(struct nft_expr_type *type)

{

	nfnl_lock(NFNL_SUBSYS_NFTABLES);

	list_del(&ops->list);

	list_del(&type->list);

	nfnl_unlock(NFNL_SUBSYS_NFTABLES);

}

EXPORT_SYMBOL_GPL(nft_unregister_expr);



static const struct nft_expr_ops *__nft_expr_ops_get(struct nlattr *nla)

static const struct nft_expr_type *__nft_expr_type_get(struct nlattr *nla)

{

	const struct nft_expr_ops *ops;

	const struct nft_expr_type *type;



	list_for_each_entry(ops, &nf_tables_expressions, list) {

		if (!nla_strcmp(nla, ops->name))

			return ops;

	list_for_each_entry(type, &nf_tables_expressions, list) {

		if (!nla_strcmp(nla, type->name))

			return type;

	}

	return NULL;

}



static const struct nft_expr_ops *nft_expr_ops_get(struct nlattr *nla)

static const struct nft_expr_type *nft_expr_type_get(struct nlattr *nla)

{

	const struct nft_expr_ops *ops;

	const struct nft_expr_type *type;



	if (nla == NULL)

		return ERR_PTR(-EINVAL);



	ops = __nft_expr_ops_get(nla);

	if (ops != NULL && try_module_get(ops->owner))

		return ops;

	type = __nft_expr_type_get(nla);

	if (type != NULL && try_module_get(type->owner))

		return type;



#ifdef CONFIG_MODULES

	if (ops == NULL) {

	if (type == NULL) {

		nfnl_unlock(NFNL_SUBSYS_NFTABLES);

		request_module("nft-expr-%.*s",

			       nla_len(nla), (char *)nla_data(nla));

		nfnl_lock(NFNL_SUBSYS_NFTABLES);

		if (__nft_expr_ops_get(nla))

		if (__nft_expr_type_get(nla))

			return ERR_PTR(-EAGAIN);

	}

#endif
@@ -912,7 +912,7 @@ static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 
static int nf_tables_fill_expr_info(struct sk_buff *skb,

				    const struct nft_expr *expr)

{

	if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->name))

	if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))

		goto nla_put_failure;



	if (expr->ops->dump) {
@@ -932,28 +932,52 @@ nla_put_failure: 


struct nft_expr_info {

	const struct nft_expr_ops	*ops;

	struct nlattr			*tb[NFTA_EXPR_MAX + 1];

	struct nlattr			*tb[NFT_EXPR_MAXATTR + 1];

};



static int nf_tables_expr_parse(const struct nlattr *nla,

				struct nft_expr_info *info)

{

	const struct nft_expr_type *type;

	const struct nft_expr_ops *ops;

	struct nlattr *tb[NFTA_EXPR_MAX + 1];

	int err;



	err = nla_parse_nested(info->tb, NFTA_EXPR_MAX, nla, nft_expr_policy);

	err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy);

	if (err < 0)

		return err;



	ops = nft_expr_ops_get(info->tb[NFTA_EXPR_NAME]);

	if (IS_ERR(ops))

		return PTR_ERR(ops);

	type = nft_expr_type_get(tb[NFTA_EXPR_NAME]);

	if (IS_ERR(type))

		return PTR_ERR(type);



	if (tb[NFTA_EXPR_DATA]) {

		err = nla_parse_nested(info->tb, type->maxattr,

				       tb[NFTA_EXPR_DATA], type->policy);

		if (err < 0)

			goto err1;

	} else

		memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));



	if (type->select_ops != NULL) {

		ops = type->select_ops((const struct nlattr * const *)info->tb);

		if (IS_ERR(ops)) {

			err = PTR_ERR(ops);

			goto err1;

		}

	} else

		ops = type->ops;



	info->ops = ops;

	return 0;



err1:

	module_put(type->owner);

	return err;

}



static int nf_tables_newexpr(const struct nft_ctx *ctx,

			     struct nft_expr_info *info,

			     const struct nft_expr_info *info,

			     struct nft_expr *expr)

{

	const struct nft_expr_ops *ops = info->ops;
@@ -961,23 +985,11 @@ static int nf_tables_newexpr(const struct nft_ctx *ctx, 


	expr->ops = ops;

	if (ops->init) {

		struct nlattr *ma[ops->maxattr + 1];



		if (info->tb[NFTA_EXPR_DATA]) {

			err = nla_parse_nested(ma, ops->maxattr,

					       info->tb[NFTA_EXPR_DATA],

					       ops->policy);

			if (err < 0)

				goto err1;

		} else

			memset(ma, 0, sizeof(ma[0]) * (ops->maxattr + 1));



		err = ops->init(ctx, expr, (const struct nlattr **)ma);

		err = ops->init(ctx, expr, (const struct nlattr **)info->tb);

		if (err < 0)

			goto err1;

	}



	info->ops = NULL;

	return 0;



err1:
@@ -989,7 +1001,7 @@ static void nf_tables_expr_destroy(struct nft_expr *expr) 
{

	if (expr->ops->destroy)

		expr->ops->destroy(expr);

	module_put(expr->ops->owner);

	module_put(expr->ops->type->owner);

}



/*
@@ -1313,6 +1325,7 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb, 
		err = nf_tables_newexpr(&ctx, &info[i], expr);

		if (err < 0)

			goto err2;

		info[i].ops = NULL;

		expr = nft_expr_next(expr);

	}
@@ -1341,7 +1354,7 @@ err2: 
err1:

	for (i = 0; i < n; i++) {

		if (info[i].ops != NULL)

			module_put(info[i].ops->owner);

			module_put(info[i].ops->type->owner);

	}

	return err;

}

net/netfilter/nft_bitwise.c

+12 −6
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>

 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as
@@ -118,23 +118,29 @@ nla_put_failure: 
	return -1;

}



static struct nft_expr_ops nft_bitwise_ops __read_mostly = {

	.name		= "bitwise",

static struct nft_expr_type nft_bitwise_type;

static const struct nft_expr_ops nft_bitwise_ops = {

	.type		= &nft_bitwise_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_bitwise)),

	.owner		= THIS_MODULE,

	.eval		= nft_bitwise_eval,

	.init		= nft_bitwise_init,

	.dump		= nft_bitwise_dump,

};



static struct nft_expr_type nft_bitwise_type __read_mostly = {

	.name		= "bitwise",

	.ops		= &nft_bitwise_ops,

	.policy		= nft_bitwise_policy,

	.maxattr	= NFTA_BITWISE_MAX,

	.owner		= THIS_MODULE,

};



int __init nft_bitwise_module_init(void)

{

	return nft_register_expr(&nft_bitwise_ops);

	return nft_register_expr(&nft_bitwise_type);

}



void nft_bitwise_module_exit(void)

{

	nft_unregister_expr(&nft_bitwise_ops);

	nft_unregister_expr(&nft_bitwise_type);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE