From: Jeremy Sowden <jeremy@azazel.net>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Netfilter Devel <netfilter-devel@vger.kernel.org>
Subject: [PATCH nf-next v2 10/10] netfilter: bitwise: add support for shifts.
Date: Tue, 14 Jan 2020 21:29:18 +0000 [thread overview]
Message-ID: <20200114212918.134062-11-jeremy@azazel.net> (raw)
In-Reply-To: <20200114212918.134062-1-jeremy@azazel.net>
Hitherto nft_bitwise has only supported boolean operations: NOT, AND, OR
and XOR. Extend it to do shifts as well.
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
include/uapi/linux/netfilter/nf_tables.h | 9 +++-
net/netfilter/nft_bitwise.c | 68 ++++++++++++++++++++++++
2 files changed, 75 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 7cb85fd0d38e..b824ca44150a 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -489,9 +489,13 @@ enum nft_immediate_attributes {
*
* @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
* XOR boolean operations
+ * @NFT_BITWISE_LSHIFT: left-shift operation
+ * @NFT_BITWISE_RSHIFT: right-shift operation
*/
enum nft_bitwise_ops {
NFT_BITWISE_BOOL,
+ NFT_BITWISE_LSHIFT,
+ NFT_BITWISE_RSHIFT,
};
/**
@@ -505,11 +509,12 @@ enum nft_bitwise_ops {
* @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
* @NFTA_BITWISE_DATA: argument for non-boolean operations (NLA_U32)
*
- * The bitwise expression performs the following operation:
+ * The bitwise expression supports boolean and shift operations. It implements
+ * the boolean operations by performing the following operation:
*
* dreg = (sreg & mask) ^ xor
*
- * which allow to express all bitwise operations:
+ * with these mask and xor values:
*
* mask xor
* NOT: 1 1
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index 72abaa83a8ca..2f55037501fd 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -34,6 +34,30 @@ static void nft_bitwise_eval_bool(u32 *dst, const u32 *src,
dst[i] = (src[i] & priv->mask.data[i]) ^ priv->xor.data[i];
}
+static void nft_bitwise_eval_lshift(u32 *dst, const u32 *src,
+ const struct nft_bitwise *priv)
+{
+ unsigned int i;
+ u32 carry = 0;
+
+ for (i = DIV_ROUND_UP(priv->len, sizeof(u32)); i > 0; i--) {
+ dst[i - 1] = (src[i - 1] << priv->data) | carry;
+ carry = src[i - 1] >> (32 - priv->data);
+ }
+}
+
+static void nft_bitwise_eval_rshift(u32 *dst, const u32 *src,
+ const struct nft_bitwise *priv)
+{
+ unsigned int i;
+ u32 carry = 0;
+
+ for (i = 0; i < DIV_ROUND_UP(priv->len, sizeof(u32)); i++) {
+ dst[i] = carry | (src[i] >> priv->data);
+ carry = src[i] << (32 - priv->data);
+ }
+}
+
void nft_bitwise_eval(const struct nft_expr *expr,
struct nft_regs *regs, const struct nft_pktinfo *pkt)
{
@@ -45,6 +69,12 @@ void nft_bitwise_eval(const struct nft_expr *expr,
case NFT_BITWISE_BOOL:
nft_bitwise_eval_bool(dst, src, priv);
break;
+ case NFT_BITWISE_LSHIFT:
+ nft_bitwise_eval_lshift(dst, src, priv);
+ break;
+ case NFT_BITWISE_RSHIFT:
+ nft_bitwise_eval_rshift(dst, src, priv);
+ break;
}
}
@@ -97,6 +127,28 @@ static int nft_bitwise_init_bool(struct nft_bitwise *priv,
return err;
}
+static int nft_bitwise_init_shift(struct nft_bitwise *priv,
+ const struct nlattr *const tb[])
+{
+ u32 shift;
+ int err;
+
+ if (tb[NFTA_BITWISE_MASK] ||
+ tb[NFTA_BITWISE_XOR])
+ return -EINVAL;
+
+ if (!tb[NFTA_BITWISE_DATA])
+ return -EINVAL;
+
+ err = nft_parse_u32_check(tb[NFTA_BITWISE_DATA], U8_MAX,
+ &shift);
+ if (err < 0)
+ return err;
+
+ priv->data = shift;
+ return 0;
+}
+
static int nft_bitwise_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
@@ -131,6 +183,8 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
priv->op = ntohl(nla_get_be32(tb[NFTA_BITWISE_OP]));
switch (priv->op) {
case NFT_BITWISE_BOOL:
+ case NFT_BITWISE_LSHIFT:
+ case NFT_BITWISE_RSHIFT:
break;
default:
return -EINVAL;
@@ -142,6 +196,9 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
switch(priv->op) {
case NFT_BITWISE_BOOL:
return nft_bitwise_init_bool(priv, tb);
+ case NFT_BITWISE_LSHIFT:
+ case NFT_BITWISE_RSHIFT:
+ return nft_bitwise_init_shift(priv, tb);
}
return -EINVAL;
@@ -161,6 +218,14 @@ static int nft_bitwise_dump_bool(struct sk_buff *skb,
return 0;
}
+static int nft_bitwise_dump_shift(struct sk_buff *skb,
+ const struct nft_bitwise *priv)
+{
+ if (nla_put_be32(skb, NFTA_BITWISE_DATA, htonl(priv->data)))
+ return -1;
+ return 0;
+}
+
static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
const struct nft_bitwise *priv = nft_expr_priv(expr);
@@ -177,6 +242,9 @@ static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
switch (priv->op) {
case NFT_BITWISE_BOOL:
return nft_bitwise_dump_bool(skb, priv);
+ case NFT_BITWISE_LSHIFT:
+ case NFT_BITWISE_RSHIFT:
+ return nft_bitwise_dump_shift(skb, priv);
}
return -1;
--
2.24.1
next prev parent reply other threads:[~2020-01-14 21:40 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-14 21:29 [PATCH nf-next v2 00/10] netfilter: nft_bitwise: shift support Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 01/10] netfilter: nf_tables: white-space fixes Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 02/10] netfilter: bitwise: remove NULL comparisons from attribute checks Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 03/10] netfilter: bitwise: replace gotos with returns Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 04/10] netfilter: bitwise: add NFTA_BITWISE_OP netlink attribute Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 05/10] netfilter: bitwise: add helper for initializing boolean operations Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 06/10] netfilter: bitwise: add helper for evaluating " Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 07/10] netfilter: bitwise: add helper for dumping " Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 08/10] netfilter: bitwise: only offload " Jeremy Sowden
2020-01-14 21:29 ` [PATCH nf-next v2 09/10] netfilter: bitwise: add NFTA_BITWISE_DATA attribute Jeremy Sowden
2020-01-15 9:29 ` Pablo Neira Ayuso
2020-01-15 9:30 ` Jeremy Sowden
2020-01-14 21:29 ` Jeremy Sowden [this message]
2020-01-15 9:29 ` [PATCH nf-next v2 00/10] netfilter: nft_bitwise: shift support Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200114212918.134062-11-jeremy@azazel.net \
--to=jeremy@azazel.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).