netfilter: nf_tables: store data in offload context registers

Store immediate data into offload context register. This allows follow up instructions to take it from the corresponding source register. This patch is required to support for payload mangling, although other instructions that take data from source register will benefit from this too.

Pablo Neira Ayuso committed 7 years ago

Commit 43dd16e1 parent bd8699e2 files · +18 −7Browse files

Unified · Split

2 files

include/net/netfilter/nf_tables_offload.h +1 −0
net/netfilter/nft_immediate.c +17 −7

include/net/netfilter/nf_tables_offload.h+1−0

@@ -9,6 +9,7 @@ struct nft_offload_reg { · 8 unmodified lines
9	9	u32 len;
10	10	u32 base_offset;
11	11	u32 offset;
	12	+ struct nft_data data;
12	13	struct nft_data mask;
13	14	};
14	15

net/netfilter/nft_immediate.c+17−7

@@ -125,17 +125,13 @@ static int nft_immediate_validate(const struct nft_ctx *ctx, · 124 unmodified lines
125	125	return 0;
126	126	}
127	127
128		−static int nft_immediate_offload(struct nft_offload_ctx *ctx,
129		− struct nft_flow_rule *flow,
130		− const struct nft_expr *expr)
	128	+static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
	129	+ struct nft_flow_rule *flow,
	130	+ const struct nft_immediate_expr *priv)
131	131	{
132		− const struct nft_immediate_expr *priv = nft_expr_priv(expr);
133	132	struct flow_action_entry *entry;
134	133	const struct nft_data *data;
135	134
136		− if (priv->dreg != NFT_REG_VERDICT)
137		− return -EOPNOTSUPP;
138		−
139	135	entry = &flow->rule->action.entries[ctx->num_actions++];
140	136
141	137	data = &priv->data;
@@ -153,6 +149,20 @@ static int nft_immediate_offload(struct nft_offload_ctx *ctx, · 11 unmodified lines
153	149	return 0;
154	150	}
155	151
	152	+static int nft_immediate_offload(struct nft_offload_ctx *ctx,
	153	+ struct nft_flow_rule *flow,
	154	+ const struct nft_expr *expr)
	155	+{
	156	+ const struct nft_immediate_expr *priv = nft_expr_priv(expr);
	157	+
	158	+ if (priv->dreg == NFT_REG_VERDICT)
	159	+ return nft_immediate_offload_verdict(ctx, flow, priv);
	160	+
	161	+ memcpy(&ctx->regs[priv->dreg].data, &priv->data, sizeof(priv->data));
	162	+
	163	+ return 0;
	164	+}
	165	+
156	166	static const struct nft_expr_ops nft_imm_ops = {
157	167	.type = &nft_imm_type,
158	168	.size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),