History

netfilter: nf_tables: store data in offload context registers

Store immediate data into offload context register. This allows follow up instructions to take it from the corresponding source register. This patch is required to support for payload mangling, although other instructions that take data from source register will benefit from this too.

Pablo Neira Ayuso committed 7 years ago

Commit 43dd16e1 parent bd8699e2 files · +18 −7Browse files

Unified · Split

2 files
  1. include/net/netfilter/nf_tables_offload.h +1 −0
  2. net/netfilter/nft_immediate.c +17 −7
include/net/netfilter/nf_tables_offload.h+1−0
@@ -9,6 +9,7 @@ struct nft_offload_reg { · 8 unmodified lines
9 u32 len;9 u32 len;
10 u32 base_offset;10 u32 base_offset;
11 u32 offset;11 u32 offset;
12 struct nft_data data;
12 struct nft_data mask;13 struct nft_data mask;
13};14};
14 15
net/netfilter/nft_immediate.c+17−7
@@ -125,17 +125,13 @@ static int nft_immediate_validate(const struct nft_ctx *ctx, · 124 unmodified lines
125 return 0;125 return 0;
126}126}
127 127
128static int nft_immediate_offload(struct nft_offload_ctx *ctx,128static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
129 struct nft_flow_rule *flow,129 struct nft_flow_rule *flow,
130 const struct nft_expr *expr)130 const struct nft_immediate_expr *priv)
131{131{
132 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
133 struct flow_action_entry *entry;132 struct flow_action_entry *entry;
134 const struct nft_data *data;133 const struct nft_data *data;
135 134
136 if (priv->dreg != NFT_REG_VERDICT)
137 return -EOPNOTSUPP;
138
139 entry = &flow->rule->action.entries[ctx->num_actions++];135 entry = &flow->rule->action.entries[ctx->num_actions++];
140 136
141 data = &priv->data;137 data = &priv->data;
@@ -153,6 +149,20 @@ static int nft_immediate_offload(struct nft_offload_ctx *ctx, · 11 unmodified lines
153 return 0;149 return 0;
154}150}
155 151
152static int nft_immediate_offload(struct nft_offload_ctx *ctx,
153 struct nft_flow_rule *flow,
154 const struct nft_expr *expr)
155{
156 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
157
158 if (priv->dreg == NFT_REG_VERDICT)
159 return nft_immediate_offload_verdict(ctx, flow, priv);
160
161 memcpy(&ctx->regs[priv->dreg].data, &priv->data, sizeof(priv->data));
162
163 return 0;
164}
165
156static const struct nft_expr_ops nft_imm_ops = {166static const struct nft_expr_ops nft_imm_ops = {
157 .type = &nft_imm_type,167 .type = &nft_imm_type,
158 .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),168 .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),