From: Jeremy Sowden <jeremy@azazel.net>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Netfilter Devel <netfilter-devel@vger.kernel.org>
Subject: [PATCH nf-next v4 10/10] netfilter: bitwise: add support for shifts.
Date: Wed, 15 Jan 2020 21:32:16 +0000 [thread overview]
Message-ID: <20200115213216.77493-11-jeremy@azazel.net> (raw)
In-Reply-To: <20200115213216.77493-1-jeremy@azazel.net>
Hitherto nft_bitwise has only supported boolean operations: NOT, AND, OR
and XOR. Extend it to do shifts as well.
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
---
include/uapi/linux/netfilter/nf_tables.h | 9 ++-
net/netfilter/nft_bitwise.c | 75 ++++++++++++++++++++++++
2 files changed, 82 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 0277ebe30c5c..59455e7fec93 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -489,9 +489,13 @@ enum nft_immediate_attributes {
*
* @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
* XOR boolean operations
+ * @NFT_BITWISE_LSHIFT: left-shift operation
+ * @NFT_BITWISE_RSHIFT: right-shift operation
*/
enum nft_bitwise_ops {
NFT_BITWISE_BOOL,
+ NFT_BITWISE_LSHIFT,
+ NFT_BITWISE_RSHIFT,
};
/**
@@ -506,11 +510,12 @@ enum nft_bitwise_ops {
* @NFTA_BITWISE_DATA: argument for non-boolean operations
* (NLA_NESTED: nft_data_attributes)
*
- * The bitwise expression performs the following operation:
+ * The bitwise expression supports boolean and shift operations. It implements
+ * the boolean operations by performing the following operation:
*
* dreg = (sreg & mask) ^ xor
*
- * which allow to express all bitwise operations:
+ * with these mask and xor values:
*
* mask xor
* NOT: 1 1
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index ba1c0cd332c4..a0cba86d5ab4 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -34,6 +34,32 @@ static void nft_bitwise_eval_bool(u32 *dst, const u32 *src,
dst[i] = (src[i] & priv->mask.data[i]) ^ priv->xor.data[i];
}
+static void nft_bitwise_eval_lshift(u32 *dst, const u32 *src,
+ const struct nft_bitwise *priv)
+{
+ u32 shift = priv->data.data[0];
+ unsigned int i;
+ u32 carry = 0;
+
+ for (i = DIV_ROUND_UP(priv->len, sizeof(u32)); i > 0; i--) {
+ dst[i - 1] = (src[i - 1] << shift) | carry;
+ carry = src[i - 1] >> (BITS_PER_TYPE(u32) - shift);
+ }
+}
+
+static void nft_bitwise_eval_rshift(u32 *dst, const u32 *src,
+ const struct nft_bitwise *priv)
+{
+ u32 shift = priv->data.data[0];
+ unsigned int i;
+ u32 carry = 0;
+
+ for (i = 0; i < DIV_ROUND_UP(priv->len, sizeof(u32)); i++) {
+ dst[i] = carry | (src[i] >> shift);
+ carry = src[i] << (BITS_PER_TYPE(u32) - shift);
+ }
+}
+
void nft_bitwise_eval(const struct nft_expr *expr,
struct nft_regs *regs, const struct nft_pktinfo *pkt)
{
@@ -45,6 +71,12 @@ void nft_bitwise_eval(const struct nft_expr *expr,
case NFT_BITWISE_BOOL:
nft_bitwise_eval_bool(dst, src, priv);
break;
+ case NFT_BITWISE_LSHIFT:
+ nft_bitwise_eval_lshift(dst, src, priv);
+ break;
+ case NFT_BITWISE_RSHIFT:
+ nft_bitwise_eval_rshift(dst, src, priv);
+ break;
}
}
@@ -97,6 +129,32 @@ static int nft_bitwise_init_bool(struct nft_bitwise *priv,
return err;
}
+static int nft_bitwise_init_shift(struct nft_bitwise *priv,
+ const struct nlattr *const tb[])
+{
+ struct nft_data_desc d;
+ int err;
+
+ if (tb[NFTA_BITWISE_MASK] ||
+ tb[NFTA_BITWISE_XOR])
+ return -EINVAL;
+
+ if (!tb[NFTA_BITWISE_DATA])
+ return -EINVAL;
+
+ err = nft_data_init(NULL, &priv->data, sizeof(priv->data), &d,
+ tb[NFTA_BITWISE_DATA]);
+ if (err < 0)
+ return err;
+ if (d.type != NFT_DATA_VALUE || d.len > sizeof(u32) ||
+ priv->data.data[0] >= BITS_PER_TYPE(u32)) {
+ nft_data_release(&priv->data, d.type);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static int nft_bitwise_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
@@ -131,6 +189,8 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
priv->op = ntohl(nla_get_be32(tb[NFTA_BITWISE_OP]));
switch (priv->op) {
case NFT_BITWISE_BOOL:
+ case NFT_BITWISE_LSHIFT:
+ case NFT_BITWISE_RSHIFT:
break;
default:
return -EINVAL;
@@ -142,6 +202,9 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
switch(priv->op) {
case NFT_BITWISE_BOOL:
return nft_bitwise_init_bool(priv, tb);
+ case NFT_BITWISE_LSHIFT:
+ case NFT_BITWISE_RSHIFT:
+ return nft_bitwise_init_shift(priv, tb);
}
return -EINVAL;
@@ -161,6 +224,15 @@ static int nft_bitwise_dump_bool(struct sk_buff *skb,
return 0;
}
+static int nft_bitwise_dump_shift(struct sk_buff *skb,
+ const struct nft_bitwise *priv)
+{
+ if (nft_data_dump(skb, NFTA_BITWISE_DATA, &priv->data,
+ NFT_DATA_VALUE, sizeof(u32)) < 0)
+ return -1;
+ return 0;
+}
+
static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
const struct nft_bitwise *priv = nft_expr_priv(expr);
@@ -177,6 +249,9 @@ static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
switch (priv->op) {
case NFT_BITWISE_BOOL:
return nft_bitwise_dump_bool(skb, priv);
+ case NFT_BITWISE_LSHIFT:
+ case NFT_BITWISE_RSHIFT:
+ return nft_bitwise_dump_shift(skb, priv);
}
return -1;
--
2.24.1
next prev parent reply other threads:[~2020-01-15 21:57 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-15 21:32 [PATCH nf-next v4 00/10] netfilter: nft_bitwise: shift support Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 01/10] netfilter: nf_tables: white-space fixes Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 02/10] netfilter: bitwise: remove NULL comparisons from attribute checks Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 03/10] netfilter: bitwise: replace gotos with returns Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 04/10] netfilter: bitwise: add NFTA_BITWISE_OP attribute Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 05/10] netfilter: bitwise: add helper for initializing boolean operations Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 06/10] netfilter: bitwise: add helper for evaluating " Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 07/10] netfilter: bitwise: add helper for dumping " Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 08/10] netfilter: bitwise: only offload " Jeremy Sowden
2020-01-15 21:32 ` [PATCH nf-next v4 09/10] netfilter: bitwise: add NFTA_BITWISE_DATA attribute Jeremy Sowden
2020-01-15 21:32 ` Jeremy Sowden [this message]
2020-01-16 8:51 ` [PATCH nf-next v4 00/10] netfilter: nft_bitwise: shift support Jeremy Sowden
2020-01-16 11:22 ` Pablo Neira Ayuso
2020-01-16 11:28 ` Pablo Neira Ayuso
2020-01-16 11:41 ` Jeremy Sowden
2020-01-16 12:09 ` Pablo Neira Ayuso
2020-01-16 12:13 ` Jeremy Sowden
2020-01-16 14:48 ` Pablo Neira Ayuso
2020-01-16 14:59 ` Jeremy Sowden
2020-01-26 11:12 ` Pablo Neira Ayuso
2020-01-27 11:13 ` Jeremy Sowden
2020-01-28 10:00 ` Pablo Neira Ayuso
2020-01-28 11:31 ` Jeremy Sowden
2020-01-28 13:18 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200115213216.77493-11-jeremy@azazel.net \
--to=jeremy@azazel.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).