1 /* 2 * Copyright (c) 2016 Laura Garcia <[email protected]> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/init.h> 12 #include <linux/module.h> 13 #include <linux/netlink.h> 14 #include <linux/netfilter.h> 15 #include <linux/netfilter/nf_tables.h> 16 #include <net/netfilter/nf_tables.h> 17 #include <net/netfilter/nf_tables_core.h> 18 #include <linux/jhash.h> 19 20 struct nft_hash { 21 enum nft_registers sreg:8; 22 enum nft_registers dreg:8; 23 u8 len; 24 bool autogen_seed:1; 25 u32 modulus; 26 u32 seed; 27 u32 offset; 28 }; 29 30 static void nft_hash_eval(const struct nft_expr *expr, 31 struct nft_regs *regs, 32 const struct nft_pktinfo *pkt) 33 { 34 struct nft_hash *priv = nft_expr_priv(expr); 35 const void *data = ®s->data[priv->sreg]; 36 u32 h; 37 38 h = reciprocal_scale(jhash(data, priv->len, priv->seed), priv->modulus); 39 regs->data[priv->dreg] = h + priv->offset; 40 } 41 42 static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = { 43 [NFTA_HASH_SREG] = { .type = NLA_U32 }, 44 [NFTA_HASH_DREG] = { .type = NLA_U32 }, 45 [NFTA_HASH_LEN] = { .type = NLA_U32 }, 46 [NFTA_HASH_MODULUS] = { .type = NLA_U32 }, 47 [NFTA_HASH_SEED] = { .type = NLA_U32 }, 48 [NFTA_HASH_OFFSET] = { .type = NLA_U32 }, 49 }; 50 51 static int nft_hash_init(const struct nft_ctx *ctx, 52 const struct nft_expr *expr, 53 const struct nlattr * const tb[]) 54 { 55 struct nft_hash *priv = nft_expr_priv(expr); 56 u32 len; 57 int err; 58 59 if (!tb[NFTA_HASH_SREG] || 60 !tb[NFTA_HASH_DREG] || 61 !tb[NFTA_HASH_LEN] || 62 !tb[NFTA_HASH_MODULUS]) 63 return -EINVAL; 64 65 if (tb[NFTA_HASH_OFFSET]) 66 priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET])); 67 68 priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]); 69 priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]); 70 71 err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len); 72 if (err < 0) 73 return err; 74 if (len == 0) 75 return -ERANGE; 76 77 priv->len = len; 78 79 priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); 80 if (priv->modulus <= 1) 81 return -ERANGE; 82 83 if (priv->offset + priv->modulus - 1 < priv->offset) 84 return -EOVERFLOW; 85 86 if (tb[NFTA_HASH_SEED]) { 87 priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED])); 88 } else { 89 priv->autogen_seed = true; 90 get_random_bytes(&priv->seed, sizeof(priv->seed)); 91 } 92 93 return nft_validate_register_load(priv->sreg, len) && 94 nft_validate_register_store(ctx, priv->dreg, NULL, 95 NFT_DATA_VALUE, sizeof(u32)); 96 } 97 98 static int nft_hash_dump(struct sk_buff *skb, 99 const struct nft_expr *expr) 100 { 101 const struct nft_hash *priv = nft_expr_priv(expr); 102 103 if (nft_dump_register(skb, NFTA_HASH_SREG, priv->sreg)) 104 goto nla_put_failure; 105 if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg)) 106 goto nla_put_failure; 107 if (nla_put_be32(skb, NFTA_HASH_LEN, htonl(priv->len))) 108 goto nla_put_failure; 109 if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus))) 110 goto nla_put_failure; 111 if (!priv->autogen_seed && 112 nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed))) 113 goto nla_put_failure; 114 if (priv->offset != 0) 115 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset))) 116 goto nla_put_failure; 117 return 0; 118 119 nla_put_failure: 120 return -1; 121 } 122 123 static struct nft_expr_type nft_hash_type; 124 static const struct nft_expr_ops nft_hash_ops = { 125 .type = &nft_hash_type, 126 .size = NFT_EXPR_SIZE(sizeof(struct nft_hash)), 127 .eval = nft_hash_eval, 128 .init = nft_hash_init, 129 .dump = nft_hash_dump, 130 }; 131 132 static struct nft_expr_type nft_hash_type __read_mostly = { 133 .name = "hash", 134 .ops = &nft_hash_ops, 135 .policy = nft_hash_policy, 136 .maxattr = NFTA_HASH_MAX, 137 .owner = THIS_MODULE, 138 }; 139 140 static int __init nft_hash_module_init(void) 141 { 142 return nft_register_expr(&nft_hash_type); 143 } 144 145 static void __exit nft_hash_module_exit(void) 146 { 147 nft_unregister_expr(&nft_hash_type); 148 } 149 150 module_init(nft_hash_module_init); 151 module_exit(nft_hash_module_exit); 152 153 MODULE_LICENSE("GPL"); 154 MODULE_AUTHOR("Laura Garcia <[email protected]>"); 155 MODULE_ALIAS_NFT_EXPR("hash"); 156