cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

nft_dup_netdev.c (2964B)

      1// SPDX-License-Identifier: GPL-2.0-only
      2/*
      3 * Copyright (c) 2015 Pablo Neira Ayuso <pablo@netfilter.org>
      4 */
      5
      6#include <linux/kernel.h>
      7#include <linux/init.h>
      8#include <linux/module.h>
      9#include <linux/netlink.h>
     10#include <linux/netfilter.h>
     11#include <linux/netfilter/nf_tables.h>
     12#include <net/netfilter/nf_tables.h>
     13#include <net/netfilter/nf_tables_offload.h>
     14#include <net/netfilter/nf_dup_netdev.h>
     15
     16struct nft_dup_netdev {
     17	u8	sreg_dev;
     18};
     19
     20static void nft_dup_netdev_eval(const struct nft_expr *expr,
     21				struct nft_regs *regs,
     22				const struct nft_pktinfo *pkt)
     23{
     24	struct nft_dup_netdev *priv = nft_expr_priv(expr);
     25	int oif = regs->data[priv->sreg_dev];
     26
     27	nf_dup_netdev_egress(pkt, oif);
     28}
     29
     30static const struct nla_policy nft_dup_netdev_policy[NFTA_DUP_MAX + 1] = {
     31	[NFTA_DUP_SREG_DEV]	= { .type = NLA_U32 },
     32};
     33
     34static int nft_dup_netdev_init(const struct nft_ctx *ctx,
     35			       const struct nft_expr *expr,
     36			       const struct nlattr * const tb[])
     37{
     38	struct nft_dup_netdev *priv = nft_expr_priv(expr);
     39
     40	if (tb[NFTA_DUP_SREG_DEV] == NULL)
     41		return -EINVAL;
     42
     43	return nft_parse_register_load(tb[NFTA_DUP_SREG_DEV], &priv->sreg_dev,
     44				       sizeof(int));
     45}
     46
     47static int nft_dup_netdev_dump(struct sk_buff *skb, const struct nft_expr *expr)
     48{
     49	struct nft_dup_netdev *priv = nft_expr_priv(expr);
     50
     51	if (nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
     52		goto nla_put_failure;
     53
     54	return 0;
     55
     56nla_put_failure:
     57	return -1;
     58}
     59
     60static int nft_dup_netdev_offload(struct nft_offload_ctx *ctx,
     61				  struct nft_flow_rule *flow,
     62				  const struct nft_expr *expr)
     63{
     64	const struct nft_dup_netdev *priv = nft_expr_priv(expr);
     65	int oif = ctx->regs[priv->sreg_dev].data.data[0];
     66
     67	return nft_fwd_dup_netdev_offload(ctx, flow, FLOW_ACTION_MIRRED, oif);
     68}
     69
     70static bool nft_dup_netdev_offload_action(const struct nft_expr *expr)
     71{
     72	return true;
     73}
     74
     75static struct nft_expr_type nft_dup_netdev_type;
     76static const struct nft_expr_ops nft_dup_netdev_ops = {
     77	.type		= &nft_dup_netdev_type,
     78	.size		= NFT_EXPR_SIZE(sizeof(struct nft_dup_netdev)),
     79	.eval		= nft_dup_netdev_eval,
     80	.init		= nft_dup_netdev_init,
     81	.dump		= nft_dup_netdev_dump,
     82	.reduce		= NFT_REDUCE_READONLY,
     83	.offload	= nft_dup_netdev_offload,
     84	.offload_action	= nft_dup_netdev_offload_action,
     85};
     86
     87static struct nft_expr_type nft_dup_netdev_type __read_mostly = {
     88	.family		= NFPROTO_NETDEV,
     89	.name		= "dup",
     90	.ops		= &nft_dup_netdev_ops,
     91	.policy		= nft_dup_netdev_policy,
     92	.maxattr	= NFTA_DUP_MAX,
     93	.owner		= THIS_MODULE,
     94};
     95
     96static int __init nft_dup_netdev_module_init(void)
     97{
     98	return nft_register_expr(&nft_dup_netdev_type);
     99}
    100
    101static void __exit nft_dup_netdev_module_exit(void)
    102{
    103	nft_unregister_expr(&nft_dup_netdev_type);
    104}
    105
    106module_init(nft_dup_netdev_module_init);
    107module_exit(nft_dup_netdev_module_exit);
    108
    109MODULE_LICENSE("GPL");
    110MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
    111MODULE_ALIAS_NFT_AF_EXPR(5, "dup");
    112MODULE_DESCRIPTION("nftables netdev packet duplication support");