1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 #include <linux/kernel.h>
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/netlink.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter/nf_tables.h>
14 #include <net/netfilter/nf_tables_core.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_tables_offload.h>
18 void nft_immediate_eval(const struct nft_expr *expr,
19 struct nft_regs *regs,
20 const struct nft_pktinfo *pkt)
22 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
24 nft_data_copy(®s->data[priv->dreg], &priv->data, priv->dlen);
27 static const struct nla_policy nft_immediate_policy[NFTA_IMMEDIATE_MAX + 1] = {
28 [NFTA_IMMEDIATE_DREG] = { .type = NLA_U32 },
29 [NFTA_IMMEDIATE_DATA] = { .type = NLA_NESTED },
32 static int nft_immediate_init(const struct nft_ctx *ctx,
33 const struct nft_expr *expr,
34 const struct nlattr * const tb[])
36 struct nft_immediate_expr *priv = nft_expr_priv(expr);
37 struct nft_data_desc desc;
40 if (tb[NFTA_IMMEDIATE_DREG] == NULL ||
41 tb[NFTA_IMMEDIATE_DATA] == NULL)
44 err = nft_data_init(ctx, &priv->data, sizeof(priv->data), &desc,
45 tb[NFTA_IMMEDIATE_DATA]);
49 priv->dlen = desc.len;
51 priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);
52 err = nft_validate_register_store(ctx, priv->dreg, &priv->data,
60 nft_data_release(&priv->data, desc.type);
64 static void nft_immediate_activate(const struct nft_ctx *ctx,
65 const struct nft_expr *expr)
67 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
69 return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
72 static void nft_immediate_deactivate(const struct nft_ctx *ctx,
73 const struct nft_expr *expr,
74 enum nft_trans_phase phase)
76 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
78 if (phase == NFT_TRANS_COMMIT)
81 return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
84 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
86 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
88 if (nft_dump_register(skb, NFTA_IMMEDIATE_DREG, priv->dreg))
91 return nft_data_dump(skb, NFTA_IMMEDIATE_DATA, &priv->data,
92 nft_dreg_to_type(priv->dreg), priv->dlen);
98 static int nft_immediate_validate(const struct nft_ctx *ctx,
99 const struct nft_expr *expr,
100 const struct nft_data **d)
102 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
103 struct nft_ctx *pctx = (struct nft_ctx *)ctx;
104 const struct nft_data *data;
107 if (priv->dreg != NFT_REG_VERDICT)
112 switch (data->verdict.code) {
116 err = nft_chain_validate(ctx, data->verdict.chain);
128 static int nft_immediate_offload(struct nft_offload_ctx *ctx,
129 struct nft_flow_rule *flow,
130 const struct nft_expr *expr)
132 const struct nft_immediate_expr *priv = nft_expr_priv(expr);
133 struct flow_action_entry *entry;
134 const struct nft_data *data;
136 if (priv->dreg != NFT_REG_VERDICT)
139 entry = &flow->rule->action.entries[ctx->num_actions++];
142 switch (data->verdict.code) {
144 entry->id = FLOW_ACTION_ACCEPT;
147 entry->id = FLOW_ACTION_DROP;
156 static const struct nft_expr_ops nft_imm_ops = {
157 .type = &nft_imm_type,
158 .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)),
159 .eval = nft_immediate_eval,
160 .init = nft_immediate_init,
161 .activate = nft_immediate_activate,
162 .deactivate = nft_immediate_deactivate,
163 .dump = nft_immediate_dump,
164 .validate = nft_immediate_validate,
165 .offload = nft_immediate_offload,
166 .offload_flags = NFT_OFFLOAD_F_ACTION,
169 struct nft_expr_type nft_imm_type __read_mostly = {
172 .policy = nft_immediate_policy,
173 .maxattr = NFTA_IMMEDIATE_MAX,
174 .owner = THIS_MODULE,