1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Copyright (c) 2016 Laura Garcia <nevola@gmail.com> |
4 | */ |
5 | |
6 | #include <linux/kernel.h> |
7 | #include <linux/init.h> |
8 | #include <linux/module.h> |
9 | #include <linux/netlink.h> |
10 | #include <linux/netfilter.h> |
11 | #include <linux/netfilter/nf_tables.h> |
12 | #include <net/netfilter/nf_tables.h> |
13 | #include <net/netfilter/nf_tables_core.h> |
14 | #include <linux/jhash.h> |
15 | |
16 | struct nft_jhash { |
17 | u8 sreg; |
18 | u8 dreg; |
19 | u8 len; |
20 | bool autogen_seed:1; |
21 | u32 modulus; |
22 | u32 seed; |
23 | u32 offset; |
24 | }; |
25 | |
26 | static void nft_jhash_eval(const struct nft_expr *expr, |
27 | struct nft_regs *regs, |
28 | const struct nft_pktinfo *pkt) |
29 | { |
30 | struct nft_jhash *priv = nft_expr_priv(expr); |
31 | const void *data = ®s->data[priv->sreg]; |
32 | u32 h; |
33 | |
34 | h = reciprocal_scale(val: jhash(key: data, length: priv->len, initval: priv->seed), |
35 | ep_ro: priv->modulus); |
36 | |
37 | regs->data[priv->dreg] = h + priv->offset; |
38 | } |
39 | |
40 | struct nft_symhash { |
41 | u8 dreg; |
42 | u32 modulus; |
43 | u32 offset; |
44 | }; |
45 | |
46 | static void nft_symhash_eval(const struct nft_expr *expr, |
47 | struct nft_regs *regs, |
48 | const struct nft_pktinfo *pkt) |
49 | { |
50 | struct nft_symhash *priv = nft_expr_priv(expr); |
51 | struct sk_buff *skb = pkt->skb; |
52 | u32 h; |
53 | |
54 | h = reciprocal_scale(val: __skb_get_hash_symmetric(skb), ep_ro: priv->modulus); |
55 | |
56 | regs->data[priv->dreg] = h + priv->offset; |
57 | } |
58 | |
59 | static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = { |
60 | [NFTA_HASH_SREG] = { .type = NLA_U32 }, |
61 | [NFTA_HASH_DREG] = { .type = NLA_U32 }, |
62 | [NFTA_HASH_LEN] = NLA_POLICY_MAX(NLA_BE32, 255), |
63 | [NFTA_HASH_MODULUS] = { .type = NLA_U32 }, |
64 | [NFTA_HASH_SEED] = { .type = NLA_U32 }, |
65 | [NFTA_HASH_OFFSET] = { .type = NLA_U32 }, |
66 | [NFTA_HASH_TYPE] = { .type = NLA_U32 }, |
67 | }; |
68 | |
69 | static int nft_jhash_init(const struct nft_ctx *ctx, |
70 | const struct nft_expr *expr, |
71 | const struct nlattr * const tb[]) |
72 | { |
73 | struct nft_jhash *priv = nft_expr_priv(expr); |
74 | u32 len; |
75 | int err; |
76 | |
77 | if (!tb[NFTA_HASH_SREG] || |
78 | !tb[NFTA_HASH_DREG] || |
79 | !tb[NFTA_HASH_LEN] || |
80 | !tb[NFTA_HASH_MODULUS]) |
81 | return -EINVAL; |
82 | |
83 | if (tb[NFTA_HASH_OFFSET]) |
84 | priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET])); |
85 | |
86 | err = nft_parse_u32_check(attr: tb[NFTA_HASH_LEN], U8_MAX, dest: &len); |
87 | if (err < 0) |
88 | return err; |
89 | if (len == 0) |
90 | return -ERANGE; |
91 | |
92 | priv->len = len; |
93 | |
94 | err = nft_parse_register_load(attr: tb[NFTA_HASH_SREG], sreg: &priv->sreg, len); |
95 | if (err < 0) |
96 | return err; |
97 | |
98 | priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); |
99 | if (priv->modulus < 1) |
100 | return -ERANGE; |
101 | |
102 | if (priv->offset + priv->modulus - 1 < priv->offset) |
103 | return -EOVERFLOW; |
104 | |
105 | if (tb[NFTA_HASH_SEED]) { |
106 | priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED])); |
107 | } else { |
108 | priv->autogen_seed = true; |
109 | get_random_bytes(buf: &priv->seed, len: sizeof(priv->seed)); |
110 | } |
111 | |
112 | return nft_parse_register_store(ctx, attr: tb[NFTA_HASH_DREG], dreg: &priv->dreg, |
113 | NULL, type: NFT_DATA_VALUE, len: sizeof(u32)); |
114 | } |
115 | |
116 | static int nft_symhash_init(const struct nft_ctx *ctx, |
117 | const struct nft_expr *expr, |
118 | const struct nlattr * const tb[]) |
119 | { |
120 | struct nft_symhash *priv = nft_expr_priv(expr); |
121 | |
122 | if (!tb[NFTA_HASH_DREG] || |
123 | !tb[NFTA_HASH_MODULUS]) |
124 | return -EINVAL; |
125 | |
126 | if (tb[NFTA_HASH_OFFSET]) |
127 | priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET])); |
128 | |
129 | priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); |
130 | if (priv->modulus < 1) |
131 | return -ERANGE; |
132 | |
133 | if (priv->offset + priv->modulus - 1 < priv->offset) |
134 | return -EOVERFLOW; |
135 | |
136 | return nft_parse_register_store(ctx, attr: tb[NFTA_HASH_DREG], |
137 | dreg: &priv->dreg, NULL, type: NFT_DATA_VALUE, |
138 | len: sizeof(u32)); |
139 | } |
140 | |
141 | static int nft_jhash_dump(struct sk_buff *skb, |
142 | const struct nft_expr *expr, bool reset) |
143 | { |
144 | const struct nft_jhash *priv = nft_expr_priv(expr); |
145 | |
146 | if (nft_dump_register(skb, attr: NFTA_HASH_SREG, reg: priv->sreg)) |
147 | goto nla_put_failure; |
148 | if (nft_dump_register(skb, attr: NFTA_HASH_DREG, reg: priv->dreg)) |
149 | goto nla_put_failure; |
150 | if (nla_put_be32(skb, attrtype: NFTA_HASH_LEN, htonl(priv->len))) |
151 | goto nla_put_failure; |
152 | if (nla_put_be32(skb, attrtype: NFTA_HASH_MODULUS, htonl(priv->modulus))) |
153 | goto nla_put_failure; |
154 | if (!priv->autogen_seed && |
155 | nla_put_be32(skb, attrtype: NFTA_HASH_SEED, htonl(priv->seed))) |
156 | goto nla_put_failure; |
157 | if (priv->offset != 0) |
158 | if (nla_put_be32(skb, attrtype: NFTA_HASH_OFFSET, htonl(priv->offset))) |
159 | goto nla_put_failure; |
160 | if (nla_put_be32(skb, attrtype: NFTA_HASH_TYPE, htonl(NFT_HASH_JENKINS))) |
161 | goto nla_put_failure; |
162 | return 0; |
163 | |
164 | nla_put_failure: |
165 | return -1; |
166 | } |
167 | |
168 | static bool nft_jhash_reduce(struct nft_regs_track *track, |
169 | const struct nft_expr *expr) |
170 | { |
171 | const struct nft_jhash *priv = nft_expr_priv(expr); |
172 | |
173 | nft_reg_track_cancel(track, dreg: priv->dreg, len: sizeof(u32)); |
174 | |
175 | return false; |
176 | } |
177 | |
178 | static int nft_symhash_dump(struct sk_buff *skb, |
179 | const struct nft_expr *expr, bool reset) |
180 | { |
181 | const struct nft_symhash *priv = nft_expr_priv(expr); |
182 | |
183 | if (nft_dump_register(skb, attr: NFTA_HASH_DREG, reg: priv->dreg)) |
184 | goto nla_put_failure; |
185 | if (nla_put_be32(skb, attrtype: NFTA_HASH_MODULUS, htonl(priv->modulus))) |
186 | goto nla_put_failure; |
187 | if (priv->offset != 0) |
188 | if (nla_put_be32(skb, attrtype: NFTA_HASH_OFFSET, htonl(priv->offset))) |
189 | goto nla_put_failure; |
190 | if (nla_put_be32(skb, attrtype: NFTA_HASH_TYPE, htonl(NFT_HASH_SYM))) |
191 | goto nla_put_failure; |
192 | return 0; |
193 | |
194 | nla_put_failure: |
195 | return -1; |
196 | } |
197 | |
198 | static bool nft_symhash_reduce(struct nft_regs_track *track, |
199 | const struct nft_expr *expr) |
200 | { |
201 | struct nft_symhash *priv = nft_expr_priv(expr); |
202 | struct nft_symhash *symhash; |
203 | |
204 | if (!nft_reg_track_cmp(track, expr, dreg: priv->dreg)) { |
205 | nft_reg_track_update(track, expr, dreg: priv->dreg, len: sizeof(u32)); |
206 | return false; |
207 | } |
208 | |
209 | symhash = nft_expr_priv(expr: track->regs[priv->dreg].selector); |
210 | if (priv->offset != symhash->offset || |
211 | priv->modulus != symhash->modulus) { |
212 | nft_reg_track_update(track, expr, dreg: priv->dreg, len: sizeof(u32)); |
213 | return false; |
214 | } |
215 | |
216 | if (!track->regs[priv->dreg].bitwise) |
217 | return true; |
218 | |
219 | return false; |
220 | } |
221 | |
222 | static struct nft_expr_type nft_hash_type; |
223 | static const struct nft_expr_ops nft_jhash_ops = { |
224 | .type = &nft_hash_type, |
225 | .size = NFT_EXPR_SIZE(sizeof(struct nft_jhash)), |
226 | .eval = nft_jhash_eval, |
227 | .init = nft_jhash_init, |
228 | .dump = nft_jhash_dump, |
229 | .reduce = nft_jhash_reduce, |
230 | }; |
231 | |
232 | static const struct nft_expr_ops nft_symhash_ops = { |
233 | .type = &nft_hash_type, |
234 | .size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)), |
235 | .eval = nft_symhash_eval, |
236 | .init = nft_symhash_init, |
237 | .dump = nft_symhash_dump, |
238 | .reduce = nft_symhash_reduce, |
239 | }; |
240 | |
241 | static const struct nft_expr_ops * |
242 | nft_hash_select_ops(const struct nft_ctx *ctx, |
243 | const struct nlattr * const tb[]) |
244 | { |
245 | u32 type; |
246 | |
247 | if (!tb[NFTA_HASH_TYPE]) |
248 | return &nft_jhash_ops; |
249 | |
250 | type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE])); |
251 | switch (type) { |
252 | case NFT_HASH_SYM: |
253 | return &nft_symhash_ops; |
254 | case NFT_HASH_JENKINS: |
255 | return &nft_jhash_ops; |
256 | default: |
257 | break; |
258 | } |
259 | return ERR_PTR(error: -EOPNOTSUPP); |
260 | } |
261 | |
262 | static struct nft_expr_type nft_hash_type __read_mostly = { |
263 | .name = "hash" , |
264 | .select_ops = nft_hash_select_ops, |
265 | .policy = nft_hash_policy, |
266 | .maxattr = NFTA_HASH_MAX, |
267 | .owner = THIS_MODULE, |
268 | }; |
269 | |
270 | static int __init nft_hash_module_init(void) |
271 | { |
272 | return nft_register_expr(&nft_hash_type); |
273 | } |
274 | |
275 | static void __exit nft_hash_module_exit(void) |
276 | { |
277 | nft_unregister_expr(&nft_hash_type); |
278 | } |
279 | |
280 | module_init(nft_hash_module_init); |
281 | module_exit(nft_hash_module_exit); |
282 | |
283 | MODULE_LICENSE("GPL" ); |
284 | MODULE_AUTHOR("Laura Garcia <nevola@gmail.com>" ); |
285 | MODULE_ALIAS_NFT_EXPR("hash" ); |
286 | MODULE_DESCRIPTION("Netfilter nftables hash module" ); |
287 | |