]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: Remove duplicated rcu_read_lock.
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
96518518
PM		 17#include <linux/netfilter.h>
18#include <linux/netfilter/nfnetlink.h>
19#include <linux/netfilter/nf_tables.h>
20#include <net/netfilter/nf_tables_core.h>
21#include <net/netfilter/nf_tables.h>
99633ab2 22#include <net/net_namespace.h>
96518518
PM		 23#include <net/sock.h>
24
96518518 25static LIST_HEAD(nf_tables_expressions);
e5009240 26static LIST_HEAD(nf_tables_objects);
96518518
PM		 27
28/**
29 * nft_register_afinfo - register nf_tables address family info
30 *
31 * @afi: address family info to register
32 *
33 * Register the address family for use with nf_tables. Returns zero on
34 * success or a negative errno code otherwise.
35 */
99633ab2 36int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 37{
38 INIT_LIST_HEAD(&afi->tables);
39 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 40 list_add_tail_rcu(&afi->list, &net->nft.af_info);
96518518
PM		 41 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
42 return 0;
43}
44EXPORT_SYMBOL_GPL(nft_register_afinfo);
45
df05ef87
PNA		 46static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi);
47
96518518
PM		 48/**
49 * nft_unregister_afinfo - unregister nf_tables address family info
50 *
51 * @afi: address family info to unregister
52 *
53 * Unregister the address family for use with nf_tables.
54 */
df05ef87 55void nft_unregister_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 56{
57 nfnl_lock(NFNL_SUBSYS_NFTABLES);
df05ef87 58 __nft_release_afinfo(net, afi);
e688a7f8 59 list_del_rcu(&afi->list);
96518518
PM		 60 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
61}
62EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
63
99633ab2 64static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
96518518
PM		 65{
66 struct nft_af_info *afi;
67
99633ab2 68 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 69 if (afi->family == family)
70 return afi;
71 }
72 return NULL;
73}
74
99633ab2
PNA		 75static struct nft_af_info *
76nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
96518518
PM		 77{
78 struct nft_af_info *afi;
79
99633ab2 80 afi = nft_afinfo_lookup(net, family);
96518518
PM		 81 if (afi != NULL)
82 return afi;
83#ifdef CONFIG_MODULES
84 if (autoload) {
85 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
86 request_module("nft-afinfo-%u", family);
87 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 88 afi = nft_afinfo_lookup(net, family);
96518518
PM		 89 if (afi != NULL)
90 return ERR_PTR(-EAGAIN);
91 }
92#endif
93 return ERR_PTR(-EAFNOSUPPORT);
94}
95
7c95f6d8 96static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 97 struct net *net,
7c95f6d8
PNA		 98 const struct sk_buff *skb,
99 const struct nlmsghdr *nlh,
100 struct nft_af_info *afi,
101 struct nft_table *table,
102 struct nft_chain *chain,
103 const struct nlattr * const *nla)
104{
633c9a84 105 ctx->net = net;
128ad332
PNA		 106 ctx->afi = afi;
107 ctx->table = table;
108 ctx->chain = chain;
109 ctx->nla = nla;
110 ctx->portid = NETLINK_CB(skb).portid;
111 ctx->report = nlmsg_report(nlh);
112 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 113}
114
8411b644
PNA		 115static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
116 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 117{
118 struct nft_trans *trans;
119
8411b644 120 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 121 if (trans == NULL)
122 return NULL;
123
b380e5c7 124 trans->msg_type = msg_type;
1081d11b
PNA		 125 trans->ctx = *ctx;
126
127 return trans;
128}
129
8411b644
PNA		 130static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
131 int msg_type, u32 size)
132{
133 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
134}
135
1081d11b
PNA		 136static void nft_trans_destroy(struct nft_trans *trans)
137{
138 list_del(&trans->list);
139 kfree(trans);
140}
141
82bec71d
PNA		 142static int nf_tables_register_hooks(struct net *net,
143 const struct nft_table *table,
d8ee8f7c
PNA		 144 struct nft_chain *chain,
145 unsigned int hook_nops)
146{
147 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 148 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 149 return 0;
150
82bec71d
PNA		 151 return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
152 hook_nops);
d8ee8f7c
PNA		 153}
154
82bec71d
PNA		 155static void nf_tables_unregister_hooks(struct net *net,
156 const struct nft_table *table,
d8ee8f7c 157 struct nft_chain *chain,
c5598794
AB		 158 unsigned int hook_nops)
159{
d8ee8f7c 160 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 161 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 162 return;
163
82bec71d 164 nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
c5598794
AB		 165}
166
ee01d542
AB		 167static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
168{
169 struct nft_trans *trans;
170
171 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
172 if (trans == NULL)
173 return -ENOMEM;
174
175 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 176 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 177
178 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
179 return 0;
180}
181
182static int nft_deltable(struct nft_ctx *ctx)
183{
184 int err;
185
186 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
187 if (err < 0)
188 return err;
189
f2a6d766 190 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 191 return err;
192}
193
194static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
195{
196 struct nft_trans *trans;
197
198 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
199 if (trans == NULL)
200 return -ENOMEM;
201
202 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 203 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 204
205 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
206 return 0;
207}
208
209static int nft_delchain(struct nft_ctx *ctx)
210{
211 int err;
212
213 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
214 if (err < 0)
215 return err;
216
217 ctx->table->use--;
664b0f8c 218 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 219
220 return err;
221}
222
ee01d542
AB		 223static int
224nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
225{
226 /* You cannot delete the same rule twice */
889f7ee7
PNA		 227 if (nft_is_active_next(ctx->net, rule)) {
228 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 229 ctx->chain->use--;
230 return 0;
231 }
232 return -ENOENT;
233}
234
235static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
236 struct nft_rule *rule)
237{
238 struct nft_trans *trans;
239
240 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
241 if (trans == NULL)
242 return NULL;
243
1a94e38d
PNA		 244 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
245 nft_trans_rule_id(trans) =
246 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
247 }
ee01d542
AB		 248 nft_trans_rule(trans) = rule;
249 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
250
251 return trans;
252}
253
254static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
255{
256 struct nft_trans *trans;
257 int err;
258
259 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
260 if (trans == NULL)
261 return -ENOMEM;
262
263 err = nf_tables_delrule_deactivate(ctx, rule);
264 if (err < 0) {
265 nft_trans_destroy(trans);
266 return err;
267 }
268
269 return 0;
270}
271
272static int nft_delrule_by_chain(struct nft_ctx *ctx)
273{
274 struct nft_rule *rule;
275 int err;
276
277 list_for_each_entry(rule, &ctx->chain->rules, list) {
278 err = nft_delrule(ctx, rule);
279 if (err < 0)
280 return err;
281 }
282 return 0;
283}
284
ee01d542
AB		 285static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
286 struct nft_set *set)
287{
288 struct nft_trans *trans;
289
290 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
291 if (trans == NULL)
292 return -ENOMEM;
293
294 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
295 nft_trans_set_id(trans) =
296 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 297 nft_activate_next(ctx->net, set);
ee01d542
AB		 298 }
299 nft_trans_set(trans) = set;
300 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
301
302 return 0;
303}
304
305static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
306{
307 int err;
308
309 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
310 if (err < 0)
311 return err;
312
37a9cc52 313 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 314 ctx->table->use--;
315
316 return err;
317}
318
e5009240
PNA		 319static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
320 struct nft_object *obj)
321{
322 struct nft_trans *trans;
323
324 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
325 if (trans == NULL)
326 return -ENOMEM;
327
328 if (msg_type == NFT_MSG_NEWOBJ)
329 nft_activate_next(ctx->net, obj);
330
331 nft_trans_obj(trans) = obj;
332 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
333
334 return 0;
335}
336
337static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
338{
339 int err;
340
341 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
342 if (err < 0)
343 return err;
344
345 nft_deactivate_next(ctx->net, obj);
346 ctx->table->use--;
347
348 return err;
349}
350
96518518
PM		 351/*
352 * Tables
353 */
354
355static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
f2a6d766
PNA		 356 const struct nlattr *nla,
357 u8 genmask)
96518518
PM		 358{
359 struct nft_table *table;
360
361 list_for_each_entry(table, &afi->tables, list) {
f2a6d766
PNA		 362 if (!nla_strcmp(nla, table->name) &&
363 nft_active_genmask(table, genmask))
96518518
PM		 364 return table;
365 }
366 return NULL;
367}
368
369static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
f2a6d766
PNA		 370 const struct nlattr *nla,
371 u8 genmask)
96518518
PM		 372{
373 struct nft_table *table;
374
375 if (nla == NULL)
376 return ERR_PTR(-EINVAL);
377
f2a6d766 378 table = nft_table_lookup(afi, nla, genmask);
96518518
PM		 379 if (table != NULL)
380 return table;
381
96518518
PM		 382 return ERR_PTR(-ENOENT);
383}
384
385static inline u64 nf_tables_alloc_handle(struct nft_table *table)
386{
387 return ++table->hgenerator;
388}
389
d8297d4f 390static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 391
2a37d755 392static const struct nf_chain_type *
baae3e62 393__nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
9370761c
PNA		 394{
395 int i;
396
baae3e62 397 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 398 if (chain_type[family][i] != NULL &&
399 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 400 return chain_type[family][i];
9370761c 401 }
baae3e62 402 return NULL;
9370761c
PNA		 403}
404
2a37d755 405static const struct nf_chain_type *
baae3e62
PM		 406nf_tables_chain_type_lookup(const struct nft_af_info *afi,
407 const struct nlattr *nla,
408 bool autoload)
9370761c 409{
2a37d755 410 const struct nf_chain_type *type;
9370761c
PNA		 411
412 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 413 if (type != NULL)
414 return type;
9370761c 415#ifdef CONFIG_MODULES
93b0806f 416 if (autoload) {
9370761c 417 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2fec6bb6
PNA		 418 request_module("nft-chain-%u-%.*s", afi->family,
419 nla_len(nla), (const char *)nla_data(nla));
9370761c
PNA		 420 nfnl_lock(NFNL_SUBSYS_NFTABLES);
421 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 422 if (type != NULL)
423 return ERR_PTR(-EAGAIN);
9370761c
PNA		 424 }
425#endif
93b0806f 426 return ERR_PTR(-ENOENT);
9370761c
PNA		 427}
428
96518518 429static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 430 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
431 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 432 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
96518518
PM		 433};
434
84d7fce6
PNA		 435static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
436 u32 portid, u32 seq, int event, u32 flags,
437 int family, const struct nft_table *table)
96518518
PM		 438{
439 struct nlmsghdr *nlh;
440 struct nfgenmsg *nfmsg;
441
dedb67c4 442 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 443 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
444 if (nlh == NULL)
445 goto nla_put_failure;
446
447 nfmsg = nlmsg_data(nlh);
448 nfmsg->nfgen_family = family;
449 nfmsg->version = NFNETLINK_V0;
84d7fce6 450 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 451
9ddf6323 452 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768
TB		 453 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
454 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
96518518
PM		 455 goto nla_put_failure;
456
053c095a
JB		 457 nlmsg_end(skb, nlh);
458 return 0;
96518518
PM		 459
460nla_put_failure:
461 nlmsg_trim(skb, nlh);
462 return -1;
463}
464
25e94a99 465static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 466{
467 struct sk_buff *skb;
96518518
PM		 468 int err;
469
128ad332
PNA		 470 if (!ctx->report &&
471 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 472 return;
96518518 473
96518518
PM		 474 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
475 if (skb == NULL)
476 goto err;
477
84d7fce6
PNA		 478 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
479 event, 0, ctx->afi->family, ctx->table);
96518518
PM		 480 if (err < 0) {
481 kfree_skb(skb);
482 goto err;
483 }
484
25e94a99
PNA		 485 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
486 ctx->report, GFP_KERNEL);
487 return;
96518518 488err:
25e94a99 489 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 490}
491
492static int nf_tables_dump_tables(struct sk_buff *skb,
493 struct netlink_callback *cb)
494{
495 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
496 const struct nft_af_info *afi;
497 const struct nft_table *table;
498 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 499 struct net *net = sock_net(skb->sk);
96518518
PM		 500 int family = nfmsg->nfgen_family;
501
e688a7f8 502 rcu_read_lock();
38e029f1
PNA		 503 cb->seq = net->nft.base_seq;
504
e688a7f8 505 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 506 if (family != NFPROTO_UNSPEC && family != afi->family)
507 continue;
508
e688a7f8 509 list_for_each_entry_rcu(table, &afi->tables, list) {
96518518
PM		 510 if (idx < s_idx)
511 goto cont;
512 if (idx > s_idx)
513 memset(&cb->args[1], 0,
514 sizeof(cb->args) - sizeof(cb->args[0]));
f2a6d766
PNA		 515 if (!nft_is_active(net, table))
516 continue;
84d7fce6 517 if (nf_tables_fill_table_info(skb, net,
96518518
PM		 518 NETLINK_CB(cb->skb).portid,
519 cb->nlh->nlmsg_seq,
520 NFT_MSG_NEWTABLE,
521 NLM_F_MULTI,
522 afi->family, table) < 0)
523 goto done;
38e029f1
PNA		 524
525 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 526cont:
527 idx++;
528 }
529 }
530done:
e688a7f8 531 rcu_read_unlock();
96518518
PM		 532 cb->args[0] = idx;
533 return skb->len;
534}
535
7b8002a1
PNA		 536static int nf_tables_gettable(struct net *net, struct sock *nlsk,
537 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 538 const struct nlattr * const nla[],
539 struct netlink_ext_ack *extack)
96518518
PM		 540{
541 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 542 u8 genmask = nft_genmask_cur(net);
96518518
PM		 543 const struct nft_af_info *afi;
544 const struct nft_table *table;
545 struct sk_buff *skb2;
546 int family = nfmsg->nfgen_family;
547 int err;
548
549 if (nlh->nlmsg_flags & NLM_F_DUMP) {
550 struct netlink_dump_control c = {
551 .dump = nf_tables_dump_tables,
552 };
553 return netlink_dump_start(nlsk, skb, nlh, &c);
554 }
555
99633ab2 556 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 557 if (IS_ERR(afi))
558 return PTR_ERR(afi);
559
f2a6d766 560 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
96518518
PM		 561 if (IS_ERR(table))
562 return PTR_ERR(table);
563
564 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
565 if (!skb2)
566 return -ENOMEM;
567
84d7fce6 568 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 569 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
570 family, table);
571 if (err < 0)
572 goto err;
573
574 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
575
576err:
577 kfree_skb(skb2);
578 return err;
579}
580
10435c11
F		 581static void _nf_tables_table_disable(struct net *net,
582 const struct nft_af_info *afi,
583 struct nft_table *table,
584 u32 cnt)
585{
586 struct nft_chain *chain;
587 u32 i = 0;
588
589 list_for_each_entry(chain, &table->chains, list) {
590 if (!nft_is_active_next(net, chain))
591 continue;
f323d954 592 if (!nft_is_base_chain(chain))
10435c11
F		 593 continue;
594
595 if (cnt && i++ == cnt)
596 break;
597
598 nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
599 afi->nops);
600 }
601}
602
664b0f8c
PNA		 603static int nf_tables_table_enable(struct net *net,
604 const struct nft_af_info *afi,
115a60b1 605 struct nft_table *table)
9ddf6323
PNA		 606{
607 struct nft_chain *chain;
608 int err, i = 0;
609
610 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 611 if (!nft_is_active_next(net, chain))
612 continue;
f323d954 613 if (!nft_is_base_chain(chain))
d2012975
PNA		 614 continue;
615
82bec71d
PNA		 616 err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
617 afi->nops);
9ddf6323
PNA		 618 if (err < 0)
619 goto err;
620
621 i++;
622 }
623 return 0;
624err:
10435c11
F		 625 if (i)
626 _nf_tables_table_disable(net, afi, table, i);
9ddf6323
PNA		 627 return err;
628}
629
664b0f8c
PNA		 630static void nf_tables_table_disable(struct net *net,
631 const struct nft_af_info *afi,
d8ee8f7c 632 struct nft_table *table)
9ddf6323 633{
10435c11 634 _nf_tables_table_disable(net, afi, table, 0);
9ddf6323
PNA		 635}
636
e1aaca93 637static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 638{
55dd6f93 639 struct nft_trans *trans;
e1aaca93 640 u32 flags;
55dd6f93 641 int ret = 0;
9ddf6323 642
e1aaca93
PNA		 643 if (!ctx->nla[NFTA_TABLE_FLAGS])
644 return 0;
9ddf6323 645
e1aaca93
PNA		 646 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
647 if (flags & ~NFT_TABLE_F_DORMANT)
648 return -EINVAL;
649
63283dd2
PNA		 650 if (flags == ctx->table->flags)
651 return 0;
652
55dd6f93
PNA		 653 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
654 sizeof(struct nft_trans_table));
655 if (trans == NULL)
656 return -ENOMEM;
9ddf6323 657
e1aaca93
PNA		 658 if ((flags & NFT_TABLE_F_DORMANT) &&
659 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 660 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 661 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
662 ctx->table->flags & NFT_TABLE_F_DORMANT) {
664b0f8c 663 ret = nf_tables_table_enable(ctx->net, ctx->afi, ctx->table);
55dd6f93 664 if (ret >= 0) {
e1aaca93 665 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 666 nft_trans_table_enable(trans) = true;
9ddf6323 667 }
9ddf6323 668 }
e1aaca93
PNA		 669 if (ret < 0)
670 goto err;
9ddf6323 671
55dd6f93
PNA		 672 nft_trans_table_update(trans) = true;
673 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
674 return 0;
9ddf6323 675err:
55dd6f93 676 nft_trans_destroy(trans);
9ddf6323
PNA		 677 return ret;
678}
679
633c9a84
PNA		 680static int nf_tables_newtable(struct net *net, struct sock *nlsk,
681 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 682 const struct nlattr * const nla[],
683 struct netlink_ext_ack *extack)
96518518
PM		 684{
685 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 686 u8 genmask = nft_genmask_next(net);
96518518
PM		 687 const struct nlattr *name;
688 struct nft_af_info *afi;
689 struct nft_table *table;
690 int family = nfmsg->nfgen_family;
c5c1f975 691 u32 flags = 0;
e1aaca93 692 struct nft_ctx ctx;
55dd6f93 693 int err;
96518518 694
99633ab2 695 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 696 if (IS_ERR(afi))
697 return PTR_ERR(afi);
698
699 name = nla[NFTA_TABLE_NAME];
f2a6d766 700 table = nf_tables_table_lookup(afi, name, genmask);
96518518
PM		 701 if (IS_ERR(table)) {
702 if (PTR_ERR(table) != -ENOENT)
703 return PTR_ERR(table);
1a28ad74 704 } else {
96518518
PM		 705 if (nlh->nlmsg_flags & NLM_F_EXCL)
706 return -EEXIST;
707 if (nlh->nlmsg_flags & NLM_F_REPLACE)
708 return -EOPNOTSUPP;
e1aaca93 709
633c9a84 710 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
e1aaca93 711 return nf_tables_updtable(&ctx);
96518518
PM		 712 }
713
c5c1f975
PM		 714 if (nla[NFTA_TABLE_FLAGS]) {
715 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
716 if (flags & ~NFT_TABLE_F_DORMANT)
717 return -EINVAL;
718 }
719
ebddf1a8 720 err = -EAFNOSUPPORT;
7047f9d0 721 if (!try_module_get(afi->owner))
ebddf1a8 722 goto err1;
7047f9d0 723
ffdb210e 724 err = -ENOMEM;
1cae565e 725 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 726 if (table == NULL)
ebddf1a8 727 goto err2;
96518518 728
1cae565e 729 nla_strlcpy(table->name, name, NFT_TABLE_MAXNAMELEN);
96518518 730 INIT_LIST_HEAD(&table->chains);
20a69341 731 INIT_LIST_HEAD(&table->sets);
e5009240 732 INIT_LIST_HEAD(&table->objects);
c5c1f975 733 table->flags = flags;
9ddf6323 734
633c9a84 735 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
55dd6f93 736 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 737 if (err < 0)
ebddf1a8 738 goto err3;
ffdb210e 739
e688a7f8 740 list_add_tail_rcu(&table->list, &afi->tables);
96518518 741 return 0;
ebddf1a8 742err3:
ffdb210e 743 kfree(table);
ebddf1a8 744err2:
ffdb210e 745 module_put(afi->owner);
ebddf1a8 746err1:
ffdb210e 747 return err;
96518518
PM		 748}
749
b9ac12ef
AB		 750static int nft_flush_table(struct nft_ctx *ctx)
751{
752 int err;
753 struct nft_chain *chain, *nc;
e5009240 754 struct nft_object *obj, *ne;
b9ac12ef
AB		 755 struct nft_set *set, *ns;
756
a2f18db0 757 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 758 if (!nft_is_active_next(ctx->net, chain))
759 continue;
760
b9ac12ef
AB		 761 ctx->chain = chain;
762
763 err = nft_delrule_by_chain(ctx);
764 if (err < 0)
765 goto out;
b9ac12ef
AB		 766 }
767
768 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 769 if (!nft_is_active_next(ctx->net, set))
770 continue;
771
b9ac12ef
AB		 772 if (set->flags & NFT_SET_ANONYMOUS &&
773 !list_empty(&set->bindings))
774 continue;
775
776 err = nft_delset(ctx, set);
777 if (err < 0)
778 goto out;
779 }
780
e5009240
PNA		 781 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
782 err = nft_delobj(ctx, obj);
783 if (err < 0)
784 goto out;
785 }
786
a2f18db0 787 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 788 if (!nft_is_active_next(ctx->net, chain))
789 continue;
790
a2f18db0
PNA		 791 ctx->chain = chain;
792
793 err = nft_delchain(ctx);
794 if (err < 0)
795 goto out;
796 }
797
b9ac12ef
AB		 798 err = nft_deltable(ctx);
799out:
800 return err;
801}
802
803static int nft_flush(struct nft_ctx *ctx, int family)
804{
805 struct nft_af_info *afi;
806 struct nft_table *table, *nt;
807 const struct nlattr * const *nla = ctx->nla;
808 int err = 0;
809
810 list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
811 if (family != AF_UNSPEC && afi->family != family)
812 continue;
813
814 ctx->afi = afi;
815 list_for_each_entry_safe(table, nt, &afi->tables, list) {
f2a6d766
PNA		 816 if (!nft_is_active_next(ctx->net, table))
817 continue;
818
b9ac12ef
AB		 819 if (nla[NFTA_TABLE_NAME] &&
820 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
821 continue;
822
823 ctx->table = table;
824
825 err = nft_flush_table(ctx);
826 if (err < 0)
827 goto out;
828 }
829 }
830out:
831 return err;
832}
833
633c9a84
PNA		 834static int nf_tables_deltable(struct net *net, struct sock *nlsk,
835 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 836 const struct nlattr * const nla[],
837 struct netlink_ext_ack *extack)
96518518
PM		 838{
839 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 840 u8 genmask = nft_genmask_next(net);
96518518
PM		 841 struct nft_af_info *afi;
842 struct nft_table *table;
ee01d542 843 int family = nfmsg->nfgen_family;
55dd6f93 844 struct nft_ctx ctx;
96518518 845
633c9a84 846 nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
b9ac12ef
AB		 847 if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
848 return nft_flush(&ctx, family);
849
99633ab2 850 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 851 if (IS_ERR(afi))
852 return PTR_ERR(afi);
853
f2a6d766 854 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
96518518
PM		 855 if (IS_ERR(table))
856 return PTR_ERR(table);
96518518 857
b9ac12ef
AB		 858 ctx.afi = afi;
859 ctx.table = table;
55dd6f93 860
b9ac12ef 861 return nft_flush_table(&ctx);
96518518
PM		 862}
863
55dd6f93
PNA		 864static void nf_tables_table_destroy(struct nft_ctx *ctx)
865{
4fefee57
PNA		 866 BUG_ON(ctx->table->use > 0);
867
55dd6f93
PNA		 868 kfree(ctx->table);
869 module_put(ctx->afi->owner);
870}
871
2a37d755 872int nft_register_chain_type(const struct nf_chain_type *ctype)
96518518 873{
9370761c 874 int err = 0;
96518518 875
d8297d4f
FW		 876 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
877 return -EINVAL;
878
96518518 879 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c
PNA		 880 if (chain_type[ctype->family][ctype->type] != NULL) {
881 err = -EBUSY;
882 goto out;
96518518 883 }
9370761c
PNA		 884 chain_type[ctype->family][ctype->type] = ctype;
885out:
96518518
PM		 886 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
887 return err;
888}
9370761c 889EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 890
2a37d755 891void nft_unregister_chain_type(const struct nf_chain_type *ctype)
96518518 892{
96518518 893 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 894 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 895 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
896}
9370761c 897EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 898
899/*
900 * Chains
901 */
902
903static struct nft_chain *
664b0f8c
PNA		 904nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
905 u8 genmask)
96518518
PM		 906{
907 struct nft_chain *chain;
908
909 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 910 if (chain->handle == handle &&
911 nft_active_genmask(chain, genmask))
96518518
PM		 912 return chain;
913 }
914
915 return ERR_PTR(-ENOENT);
916}
917
918static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
664b0f8c
PNA		 919 const struct nlattr *nla,
920 u8 genmask)
96518518
PM		 921{
922 struct nft_chain *chain;
923
924 if (nla == NULL)
925 return ERR_PTR(-EINVAL);
926
927 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 928 if (!nla_strcmp(nla, chain->name) &&
929 nft_active_genmask(chain, genmask))
96518518
PM		 930 return chain;
931 }
932
933 return ERR_PTR(-ENOENT);
934}
935
936static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 937 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
938 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 939 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
940 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
941 .len = NFT_CHAIN_MAXNAMELEN - 1 },
942 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 943 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 944 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 945 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 946};
947
948static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
949 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
950 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 951 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
952 .len = IFNAMSIZ - 1 },
96518518
PM		 953};
954
0ca743a5
PNA		 955static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
956{
957 struct nft_stats *cpu_stats, total;
958 struct nlattr *nest;
ce355e20
ED		 959 unsigned int seq;
960 u64 pkts, bytes;
0ca743a5
PNA		 961 int cpu;
962
963 memset(&total, 0, sizeof(total));
964 for_each_possible_cpu(cpu) {
965 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 966 do {
967 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
968 pkts = cpu_stats->pkts;
969 bytes = cpu_stats->bytes;
970 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
971 total.pkts += pkts;
972 total.bytes += bytes;
0ca743a5
PNA		 973 }
974 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
975 if (nest == NULL)
976 goto nla_put_failure;
977
b46f6ded
ND		 978 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
979 NFTA_COUNTER_PAD) ||
980 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
981 NFTA_COUNTER_PAD))
0ca743a5
PNA		 982 goto nla_put_failure;
983
984 nla_nest_end(skb, nest);
985 return 0;
986
987nla_put_failure:
988 return -ENOSPC;
989}
990
84d7fce6
PNA		 991static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
992 u32 portid, u32 seq, int event, u32 flags,
993 int family, const struct nft_table *table,
96518518
PM		 994 const struct nft_chain *chain)
995{
996 struct nlmsghdr *nlh;
997 struct nfgenmsg *nfmsg;
998
dedb67c4 999 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1000 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1001 if (nlh == NULL)
1002 goto nla_put_failure;
1003
1004 nfmsg = nlmsg_data(nlh);
1005 nfmsg->nfgen_family = family;
1006 nfmsg->version = NFNETLINK_V0;
84d7fce6 1007 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1008
1009 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1010 goto nla_put_failure;
b46f6ded
ND		 1011 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1012 NFTA_CHAIN_PAD))
96518518
PM		 1013 goto nla_put_failure;
1014 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1015 goto nla_put_failure;
1016
f323d954 1017 if (nft_is_base_chain(chain)) {
0ca743a5 1018 const struct nft_base_chain *basechain = nft_base_chain(chain);
115a60b1 1019 const struct nf_hook_ops *ops = &basechain->ops[0];
0ca743a5
PNA		 1020 struct nlattr *nest;
1021
1022 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1023 if (nest == NULL)
1024 goto nla_put_failure;
1025 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1026 goto nla_put_failure;
1027 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1028 goto nla_put_failure;
2cbce139
PNA		 1029 if (basechain->dev_name[0] &&
1030 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1031 goto nla_put_failure;
96518518 1032 nla_nest_end(skb, nest);
9370761c 1033
0ca743a5
PNA		 1034 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1035 htonl(basechain->policy)))
1036 goto nla_put_failure;
1037
baae3e62
PM		 1038 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1039 goto nla_put_failure;
0ca743a5
PNA		 1040
1041 if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
1042 goto nla_put_failure;
96518518
PM		 1043 }
1044
0ca743a5
PNA		 1045 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1046 goto nla_put_failure;
1047
053c095a
JB		 1048 nlmsg_end(skb, nlh);
1049 return 0;
96518518
PM		 1050
1051nla_put_failure:
1052 nlmsg_trim(skb, nlh);
1053 return -1;
1054}
1055
25e94a99 1056static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1057{
1058 struct sk_buff *skb;
96518518
PM		 1059 int err;
1060
128ad332
PNA		 1061 if (!ctx->report &&
1062 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1063 return;
96518518 1064
96518518
PM		 1065 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1066 if (skb == NULL)
1067 goto err;
1068
84d7fce6
PNA		 1069 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1070 event, 0, ctx->afi->family, ctx->table,
35151d84 1071 ctx->chain);
96518518
PM		 1072 if (err < 0) {
1073 kfree_skb(skb);
1074 goto err;
1075 }
1076
25e94a99
PNA		 1077 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1078 ctx->report, GFP_KERNEL);
1079 return;
96518518 1080err:
25e94a99 1081 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1082}
1083
1084static int nf_tables_dump_chains(struct sk_buff *skb,
1085 struct netlink_callback *cb)
1086{
1087 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1088 const struct nft_af_info *afi;
1089 const struct nft_table *table;
1090 const struct nft_chain *chain;
1091 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1092 struct net *net = sock_net(skb->sk);
96518518
PM		 1093 int family = nfmsg->nfgen_family;
1094
e688a7f8 1095 rcu_read_lock();
38e029f1
PNA		 1096 cb->seq = net->nft.base_seq;
1097
e688a7f8 1098 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 1099 if (family != NFPROTO_UNSPEC && family != afi->family)
1100 continue;
1101
e688a7f8
PNA		 1102 list_for_each_entry_rcu(table, &afi->tables, list) {
1103 list_for_each_entry_rcu(chain, &table->chains, list) {
96518518
PM		 1104 if (idx < s_idx)
1105 goto cont;
1106 if (idx > s_idx)
1107 memset(&cb->args[1], 0,
1108 sizeof(cb->args) - sizeof(cb->args[0]));
664b0f8c
PNA		 1109 if (!nft_is_active(net, chain))
1110 continue;
84d7fce6
PNA		 1111 if (nf_tables_fill_chain_info(skb, net,
1112 NETLINK_CB(cb->skb).portid,
96518518
PM		 1113 cb->nlh->nlmsg_seq,
1114 NFT_MSG_NEWCHAIN,
1115 NLM_F_MULTI,
1116 afi->family, table, chain) < 0)
1117 goto done;
38e029f1
PNA		 1118
1119 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 1120cont:
1121 idx++;
1122 }
1123 }
1124 }
1125done:
e688a7f8 1126 rcu_read_unlock();
96518518
PM		 1127 cb->args[0] = idx;
1128 return skb->len;
1129}
1130
7b8002a1
PNA		 1131static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1132 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1133 const struct nlattr * const nla[],
1134 struct netlink_ext_ack *extack)
96518518
PM		 1135{
1136 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1137 u8 genmask = nft_genmask_cur(net);
96518518
PM		 1138 const struct nft_af_info *afi;
1139 const struct nft_table *table;
1140 const struct nft_chain *chain;
1141 struct sk_buff *skb2;
1142 int family = nfmsg->nfgen_family;
1143 int err;
1144
1145 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1146 struct netlink_dump_control c = {
1147 .dump = nf_tables_dump_chains,
1148 };
1149 return netlink_dump_start(nlsk, skb, nlh, &c);
1150 }
1151
99633ab2 1152 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1153 if (IS_ERR(afi))
1154 return PTR_ERR(afi);
1155
f2a6d766 1156 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1157 if (IS_ERR(table))
1158 return PTR_ERR(table);
1159
664b0f8c 1160 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
96518518
PM		 1161 if (IS_ERR(chain))
1162 return PTR_ERR(chain);
1163
1164 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1165 if (!skb2)
1166 return -ENOMEM;
1167
84d7fce6 1168 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1169 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1170 family, table, chain);
1171 if (err < 0)
1172 goto err;
1173
1174 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1175
1176err:
1177 kfree_skb(skb2);
1178 return err;
1179}
1180
0ca743a5
PNA		 1181static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1182 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1183 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1184};
1185
ff3cd7b3 1186static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1187{
1188 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1189 struct nft_stats __percpu *newstats;
1190 struct nft_stats *stats;
1191 int err;
1192
fceb6435
JB		 1193 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1194 NULL);
0ca743a5 1195 if (err < 0)
ff3cd7b3 1196 return ERR_PTR(err);
0ca743a5
PNA		 1197
1198 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1199 return ERR_PTR(-EINVAL);
0ca743a5 1200
ce355e20 1201 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1202 if (newstats == NULL)
ff3cd7b3 1203 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1204
1205 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1206 * are not exposed to userspace.
1207 */
e8781f70 1208 preempt_disable();
0ca743a5
PNA		 1209 stats = this_cpu_ptr(newstats);
1210 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1211 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1212 preempt_enable();
0ca743a5 1213
ff3cd7b3
PNA		 1214 return newstats;
1215}
1216
1217static void nft_chain_stats_replace(struct nft_base_chain *chain,
1218 struct nft_stats __percpu *newstats)
1219{
b88825de
PNA		 1220 if (newstats == NULL)
1221 return;
1222
0ca743a5 1223 if (chain->stats) {
0ca743a5 1224 struct nft_stats __percpu *oldstats =
67a8fc27 1225 nft_dereference(chain->stats);
0ca743a5
PNA		 1226
1227 rcu_assign_pointer(chain->stats, newstats);
1228 synchronize_rcu();
1229 free_percpu(oldstats);
1230 } else
1231 rcu_assign_pointer(chain->stats, newstats);
0ca743a5
PNA		 1232}
1233
91c7b38d
PNA		 1234static void nf_tables_chain_destroy(struct nft_chain *chain)
1235{
1236 BUG_ON(chain->use > 0);
1237
f323d954 1238 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1239 struct nft_base_chain *basechain = nft_base_chain(chain);
1240
1241 module_put(basechain->type->owner);
1242 free_percpu(basechain->stats);
9f08ea84
PNA		 1243 if (basechain->stats)
1244 static_branch_dec(&nft_counters_enabled);
2cbce139
PNA		 1245 if (basechain->ops[0].dev != NULL)
1246 dev_put(basechain->ops[0].dev);
1247 kfree(basechain);
91c7b38d
PNA		 1248 } else {
1249 kfree(chain);
1250 }
1251}
1252
508f8ccd
PNA		 1253struct nft_chain_hook {
1254 u32 num;
1255 u32 priority;
1256 const struct nf_chain_type *type;
1257 struct net_device *dev;
1258};
1259
1260static int nft_chain_parse_hook(struct net *net,
1261 const struct nlattr * const nla[],
1262 struct nft_af_info *afi,
1263 struct nft_chain_hook *hook, bool create)
1264{
1265 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1266 const struct nf_chain_type *type;
1267 struct net_device *dev;
1268 int err;
1269
1270 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1271 nft_hook_policy, NULL);
508f8ccd
PNA		 1272 if (err < 0)
1273 return err;
1274
1275 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1276 ha[NFTA_HOOK_PRIORITY] == NULL)
1277 return -EINVAL;
1278
1279 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1280 if (hook->num >= afi->nhooks)
1281 return -EINVAL;
1282
1283 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1284
1285 type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
1286 if (nla[NFTA_CHAIN_TYPE]) {
1287 type = nf_tables_chain_type_lookup(afi, nla[NFTA_CHAIN_TYPE],
1288 create);
1289 if (IS_ERR(type))
1290 return PTR_ERR(type);
1291 }
1292 if (!(type->hook_mask & (1 << hook->num)))
1293 return -EOPNOTSUPP;
1294 if (!try_module_get(type->owner))
1295 return -ENOENT;
1296
1297 hook->type = type;
1298
1299 hook->dev = NULL;
1300 if (afi->flags & NFT_AF_NEEDS_DEV) {
1301 char ifname[IFNAMSIZ];
1302
1303 if (!ha[NFTA_HOOK_DEV]) {
1304 module_put(type->owner);
1305 return -EOPNOTSUPP;
1306 }
1307
1308 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1309 dev = dev_get_by_name(net, ifname);
1310 if (!dev) {
1311 module_put(type->owner);
1312 return -ENOENT;
1313 }
1314 hook->dev = dev;
1315 } else if (ha[NFTA_HOOK_DEV]) {
1316 module_put(type->owner);
1317 return -EOPNOTSUPP;
1318 }
1319
1320 return 0;
1321}
1322
1323static void nft_chain_release_hook(struct nft_chain_hook *hook)
1324{
1325 module_put(hook->type->owner);
1326 if (hook->dev != NULL)
1327 dev_put(hook->dev);
1328}
1329
633c9a84
PNA		 1330static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1331 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1332 const struct nlattr * const nla[],
1333 struct netlink_ext_ack *extack)
96518518
PM		 1334{
1335 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1336 const struct nlattr * uninitialized_var(name);
7c95f6d8 1337 struct nft_af_info *afi;
96518518
PM		 1338 struct nft_table *table;
1339 struct nft_chain *chain;
0ca743a5 1340 struct nft_base_chain *basechain = NULL;
f2a6d766 1341 u8 genmask = nft_genmask_next(net);
96518518 1342 int family = nfmsg->nfgen_family;
57de2a0c 1343 u8 policy = NF_ACCEPT;
96518518 1344 u64 handle = 0;
115a60b1 1345 unsigned int i;
ff3cd7b3 1346 struct nft_stats __percpu *stats;
96518518
PM		 1347 int err;
1348 bool create;
91c7b38d 1349 struct nft_ctx ctx;
96518518
PM		 1350
1351 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1352
99633ab2 1353 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 1354 if (IS_ERR(afi))
1355 return PTR_ERR(afi);
1356
f2a6d766 1357 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1358 if (IS_ERR(table))
1359 return PTR_ERR(table);
1360
96518518
PM		 1361 chain = NULL;
1362 name = nla[NFTA_CHAIN_NAME];
1363
1364 if (nla[NFTA_CHAIN_HANDLE]) {
1365 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
664b0f8c 1366 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
96518518
PM		 1367 if (IS_ERR(chain))
1368 return PTR_ERR(chain);
1369 } else {
664b0f8c 1370 chain = nf_tables_chain_lookup(table, name, genmask);
96518518
PM		 1371 if (IS_ERR(chain)) {
1372 if (PTR_ERR(chain) != -ENOENT)
1373 return PTR_ERR(chain);
1374 chain = NULL;
1375 }
1376 }
1377
57de2a0c 1378 if (nla[NFTA_CHAIN_POLICY]) {
f323d954
PNA		 1379 if (chain != NULL &&
1380 !nft_is_base_chain(chain))
d6b6cb1d
PNA		 1381 return -EOPNOTSUPP;
1382
1383 if (chain == NULL &&
57de2a0c
PM		 1384 nla[NFTA_CHAIN_HOOK] == NULL)
1385 return -EOPNOTSUPP;
1386
8f46df18 1387 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1388 switch (policy) {
1389 case NF_DROP:
1390 case NF_ACCEPT:
1391 break;
1392 default:
1393 return -EINVAL;
1394 }
1395 }
1396
96518518 1397 if (chain != NULL) {
91c7b38d
PNA		 1398 struct nft_stats *stats = NULL;
1399 struct nft_trans *trans;
1400
96518518
PM		 1401 if (nlh->nlmsg_flags & NLM_F_EXCL)
1402 return -EEXIST;
1403 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1404 return -EOPNOTSUPP;
1405
6133740d
PNA		 1406 if (nla[NFTA_CHAIN_HOOK]) {
1407 struct nft_base_chain *basechain;
1408 struct nft_chain_hook hook;
1409 struct nf_hook_ops *ops;
1410
f323d954 1411 if (!nft_is_base_chain(chain))
6133740d
PNA		 1412 return -EBUSY;
1413
1414 err = nft_chain_parse_hook(net, nla, afi, &hook,
1415 create);
1416 if (err < 0)
1417 return err;
1418
1419 basechain = nft_base_chain(chain);
1420 if (basechain->type != hook.type) {
1421 nft_chain_release_hook(&hook);
1422 return -EBUSY;
1423 }
1424
1425 for (i = 0; i < afi->nops; i++) {
1426 ops = &basechain->ops[i];
1427 if (ops->hooknum != hook.num ||
1428 ops->priority != hook.priority ||
1429 ops->dev != hook.dev) {
1430 nft_chain_release_hook(&hook);
1431 return -EBUSY;
1432 }
1433 }
1434 nft_chain_release_hook(&hook);
1435 }
1436
664b0f8c
PNA		 1437 if (nla[NFTA_CHAIN_HANDLE] && name) {
1438 struct nft_chain *chain2;
1439
1440 chain2 = nf_tables_chain_lookup(table,
1441 nla[NFTA_CHAIN_NAME],
1442 genmask);
1443 if (IS_ERR(chain2))
1444 return PTR_ERR(chain2);
1445 }
96518518 1446
0ca743a5 1447 if (nla[NFTA_CHAIN_COUNTERS]) {
f323d954 1448 if (!nft_is_base_chain(chain))
0ca743a5
PNA		 1449 return -EOPNOTSUPP;
1450
ff3cd7b3
PNA		 1451 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1452 if (IS_ERR(stats))
1453 return PTR_ERR(stats);
0ca743a5
PNA		 1454 }
1455
633c9a84 1456 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
91c7b38d
PNA		 1457 trans = nft_trans_alloc(&ctx, NFT_MSG_NEWCHAIN,
1458 sizeof(struct nft_trans_chain));
f5553c19
PNA		 1459 if (trans == NULL) {
1460 free_percpu(stats);
91c7b38d 1461 return -ENOMEM;
f5553c19 1462 }
4401a862 1463
91c7b38d
PNA		 1464 nft_trans_chain_stats(trans) = stats;
1465 nft_trans_chain_update(trans) = true;
4401a862 1466
91c7b38d
PNA		 1467 if (nla[NFTA_CHAIN_POLICY])
1468 nft_trans_chain_policy(trans) = policy;
1469 else
1470 nft_trans_chain_policy(trans) = -1;
96518518 1471
91c7b38d
PNA		 1472 if (nla[NFTA_CHAIN_HANDLE] && name) {
1473 nla_strlcpy(nft_trans_chain_name(trans), name,
1474 NFT_CHAIN_MAXNAMELEN);
1475 }
1476 list_add_tail(&trans->list, &net->nft.commit_list);
1477 return 0;
96518518
PM		 1478 }
1479
75820676
PM		 1480 if (table->use == UINT_MAX)
1481 return -EOVERFLOW;
1482
96518518 1483 if (nla[NFTA_CHAIN_HOOK]) {
508f8ccd 1484 struct nft_chain_hook hook;
96518518 1485 struct nf_hook_ops *ops;
9370761c 1486 nf_hookfn *hookfn;
96518518 1487
508f8ccd 1488 err = nft_chain_parse_hook(net, nla, afi, &hook, create);
96518518
PM		 1489 if (err < 0)
1490 return err;
2cbce139 1491
96518518 1492 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
f5553c19 1493 if (basechain == NULL) {
508f8ccd 1494 nft_chain_release_hook(&hook);
96518518 1495 return -ENOMEM;
f5553c19 1496 }
9370761c 1497
508f8ccd
PNA		 1498 if (hook.dev != NULL)
1499 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
2cbce139 1500
4401a862 1501 if (nla[NFTA_CHAIN_COUNTERS]) {
ff3cd7b3
PNA		 1502 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1503 if (IS_ERR(stats)) {
508f8ccd 1504 nft_chain_release_hook(&hook);
4401a862 1505 kfree(basechain);
ff3cd7b3 1506 return PTR_ERR(stats);
4401a862 1507 }
ff3cd7b3 1508 basechain->stats = stats;
9f08ea84 1509 static_branch_inc(&nft_counters_enabled);
4401a862
PM		 1510 }
1511
508f8ccd
PNA		 1512 hookfn = hook.type->hooks[hook.num];
1513 basechain->type = hook.type;
96518518
PM		 1514 chain = &basechain->chain;
1515
115a60b1
PM		 1516 for (i = 0; i < afi->nops; i++) {
1517 ops = &basechain->ops[i];
1518 ops->pf = family;
508f8ccd
PNA		 1519 ops->hooknum = hook.num;
1520 ops->priority = hook.priority;
115a60b1
PM		 1521 ops->priv = chain;
1522 ops->hook = afi->hooks[ops->hooknum];
508f8ccd 1523 ops->dev = hook.dev;
115a60b1
PM		 1524 if (hookfn)
1525 ops->hook = hookfn;
1526 if (afi->hook_ops_init)
1527 afi->hook_ops_init(ops, i);
1528 }
96518518
PM		 1529
1530 chain->flags |= NFT_BASE_CHAIN;
57de2a0c 1531 basechain->policy = policy;
96518518
PM		 1532 } else {
1533 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1534 if (chain == NULL)
1535 return -ENOMEM;
1536 }
1537
1538 INIT_LIST_HEAD(&chain->rules);
1539 chain->handle = nf_tables_alloc_handle(table);
b5bc89bf 1540 chain->table = table;
96518518
PM		 1541 nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
1542
82bec71d 1543 err = nf_tables_register_hooks(net, table, chain, afi->nops);
d8ee8f7c
PNA		 1544 if (err < 0)
1545 goto err1;
96518518 1546
633c9a84 1547 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
91c7b38d
PNA		 1548 err = nft_trans_chain_add(&ctx, NFT_MSG_NEWCHAIN);
1549 if (err < 0)
1550 goto err2;
96518518 1551
4fefee57 1552 table->use++;
e688a7f8 1553 list_add_tail_rcu(&chain->list, &table->chains);
91c7b38d
PNA		 1554 return 0;
1555err2:
82bec71d 1556 nf_tables_unregister_hooks(net, table, chain, afi->nops);
91c7b38d
PNA		 1557err1:
1558 nf_tables_chain_destroy(chain);
1559 return err;
96518518
PM		 1560}
1561
633c9a84
PNA		 1562static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1563 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1564 const struct nlattr * const nla[],
1565 struct netlink_ext_ack *extack)
96518518
PM		 1566{
1567 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1568 u8 genmask = nft_genmask_next(net);
7c95f6d8 1569 struct nft_af_info *afi;
96518518
PM		 1570 struct nft_table *table;
1571 struct nft_chain *chain;
1572 int family = nfmsg->nfgen_family;
91c7b38d 1573 struct nft_ctx ctx;
96518518 1574
99633ab2 1575 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1576 if (IS_ERR(afi))
1577 return PTR_ERR(afi);
1578
f2a6d766 1579 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1580 if (IS_ERR(table))
1581 return PTR_ERR(table);
1582
664b0f8c 1583 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
96518518
PM		 1584 if (IS_ERR(chain))
1585 return PTR_ERR(chain);
4fefee57 1586 if (chain->use > 0)
96518518
PM		 1587 return -EBUSY;
1588
633c9a84 1589 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0165d932 1590
ee01d542 1591 return nft_delchain(&ctx);
96518518
PM		 1592}
1593
96518518
PM		 1594/*
1595 * Expressions
1596 */
1597
1598/**
ef1f7df9
PM		 1599 * nft_register_expr - register nf_tables expr type
1600 * @ops: expr type
96518518 1601 *
ef1f7df9 1602 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1603 * success or a negative errno code otherwise.
1604 */
ef1f7df9 1605int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1606{
1607 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1608 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1609 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1610 else
e688a7f8 1611 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1612 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1613 return 0;
1614}
1615EXPORT_SYMBOL_GPL(nft_register_expr);
1616
1617/**
ef1f7df9
PM		 1618 * nft_unregister_expr - unregister nf_tables expr type
1619 * @ops: expr type
96518518 1620 *
ef1f7df9 1621 * Unregisters the expr typefor use with nf_tables.
96518518 1622 */
ef1f7df9 1623void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1624{
1625 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1626 list_del_rcu(&type->list);
96518518
PM		 1627 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1628}
1629EXPORT_SYMBOL_GPL(nft_unregister_expr);
1630
64d46806
PM		 1631static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1632 struct nlattr *nla)
96518518 1633{
ef1f7df9 1634 const struct nft_expr_type *type;
96518518 1635
ef1f7df9 1636 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1637 if (!nla_strcmp(nla, type->name) &&
1638 (!type->family || type->family == family))
ef1f7df9 1639 return type;
96518518
PM		 1640 }
1641 return NULL;
1642}
1643
64d46806
PM		 1644static const struct nft_expr_type *nft_expr_type_get(u8 family,
1645 struct nlattr *nla)
96518518 1646{
ef1f7df9 1647 const struct nft_expr_type *type;
96518518
PM		 1648
1649 if (nla == NULL)
1650 return ERR_PTR(-EINVAL);
1651
64d46806 1652 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1653 if (type != NULL && try_module_get(type->owner))
1654 return type;
96518518
PM		 1655
1656#ifdef CONFIG_MODULES
ef1f7df9 1657 if (type == NULL) {
64d46806
PM		 1658 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1659 request_module("nft-expr-%u-%.*s", family,
1660 nla_len(nla), (char *)nla_data(nla));
1661 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1662 if (__nft_expr_type_get(family, nla))
1663 return ERR_PTR(-EAGAIN);
1664
96518518
PM		 1665 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1666 request_module("nft-expr-%.*s",
1667 nla_len(nla), (char *)nla_data(nla));
1668 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1669 if (__nft_expr_type_get(family, nla))
96518518
PM		 1670 return ERR_PTR(-EAGAIN);
1671 }
1672#endif
1673 return ERR_PTR(-ENOENT);
1674}
1675
1676static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1677 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1678 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1679};
1680
1681static int nf_tables_fill_expr_info(struct sk_buff *skb,
1682 const struct nft_expr *expr)
1683{
ef1f7df9 1684 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1685 goto nla_put_failure;
1686
1687 if (expr->ops->dump) {
1688 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1689 if (data == NULL)
1690 goto nla_put_failure;
1691 if (expr->ops->dump(skb, expr) < 0)
1692 goto nla_put_failure;
1693 nla_nest_end(skb, data);
1694 }
1695
1696 return skb->len;
1697
1698nla_put_failure:
1699 return -1;
1700};
1701
0b2d8a7b
PM		 1702int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1703 const struct nft_expr *expr)
1704{
1705 struct nlattr *nest;
1706
1707 nest = nla_nest_start(skb, attr);
1708 if (!nest)
1709 goto nla_put_failure;
1710 if (nf_tables_fill_expr_info(skb, expr) < 0)
1711 goto nla_put_failure;
1712 nla_nest_end(skb, nest);
1713 return 0;
1714
1715nla_put_failure:
1716 return -1;
1717}
1718
96518518
PM		 1719struct nft_expr_info {
1720 const struct nft_expr_ops *ops;
ef1f7df9 1721 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1722};
1723
0ca743a5
PNA		 1724static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1725 const struct nlattr *nla,
96518518
PM		 1726 struct nft_expr_info *info)
1727{
ef1f7df9 1728 const struct nft_expr_type *type;
96518518 1729 const struct nft_expr_ops *ops;
ef1f7df9 1730 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1731 int err;
1732
fceb6435 1733 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 1734 if (err < 0)
1735 return err;
1736
64d46806 1737 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1738 if (IS_ERR(type))
1739 return PTR_ERR(type);
1740
1741 if (tb[NFTA_EXPR_DATA]) {
1742 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 1743 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 1744 if (err < 0)
1745 goto err1;
1746 } else
1747 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1748
1749 if (type->select_ops != NULL) {
0ca743a5
PNA		 1750 ops = type->select_ops(ctx,
1751 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1752 if (IS_ERR(ops)) {
1753 err = PTR_ERR(ops);
1754 goto err1;
1755 }
1756 } else
1757 ops = type->ops;
1758
96518518
PM		 1759 info->ops = ops;
1760 return 0;
ef1f7df9
PM		 1761
1762err1:
1763 module_put(type->owner);
1764 return err;
96518518
PM		 1765}
1766
1767static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1768 const struct nft_expr_info *info,
96518518
PM		 1769 struct nft_expr *expr)
1770{
1771 const struct nft_expr_ops *ops = info->ops;
1772 int err;
1773
1774 expr->ops = ops;
1775 if (ops->init) {
ef1f7df9 1776 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1777 if (err < 0)
1778 goto err1;
1779 }
1780
c56e3956
LZ		 1781 if (ops->validate) {
1782 const struct nft_data *data = NULL;
1783
1784 err = ops->validate(ctx, expr, &data);
1785 if (err < 0)
1786 goto err2;
1787 }
1788
96518518
PM		 1789 return 0;
1790
c56e3956
LZ		 1791err2:
1792 if (ops->destroy)
1793 ops->destroy(ctx, expr);
96518518
PM		 1794err1:
1795 expr->ops = NULL;
1796 return err;
1797}
1798
62472bce
PM		 1799static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1800 struct nft_expr *expr)
96518518
PM		 1801{
1802 if (expr->ops->destroy)
62472bce 1803 expr->ops->destroy(ctx, expr);
ef1f7df9 1804 module_put(expr->ops->type->owner);
96518518
PM		 1805}
1806
0b2d8a7b
PM		 1807struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1808 const struct nlattr *nla)
1809{
1810 struct nft_expr_info info;
1811 struct nft_expr *expr;
1812 int err;
1813
1814 err = nf_tables_expr_parse(ctx, nla, &info);
1815 if (err < 0)
1816 goto err1;
1817
1818 err = -ENOMEM;
1819 expr = kzalloc(info.ops->size, GFP_KERNEL);
1820 if (expr == NULL)
1821 goto err2;
1822
1823 err = nf_tables_newexpr(ctx, &info, expr);
1824 if (err < 0)
6cafaf47 1825 goto err3;
0b2d8a7b
PM		 1826
1827 return expr;
6cafaf47
LZ		 1828err3:
1829 kfree(expr);
0b2d8a7b
PM		 1830err2:
1831 module_put(info.ops->type->owner);
1832err1:
1833 return ERR_PTR(err);
1834}
1835
1836void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1837{
1838 nf_tables_expr_destroy(ctx, expr);
1839 kfree(expr);
1840}
1841
96518518
PM		 1842/*
1843 * Rules
1844 */
1845
1846static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1847 u64 handle)
1848{
1849 struct nft_rule *rule;
1850
1851 // FIXME: this sucks
1852 list_for_each_entry(rule, &chain->rules, list) {
1853 if (handle == rule->handle)
1854 return rule;
1855 }
1856
1857 return ERR_PTR(-ENOENT);
1858}
1859
1860static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1861 const struct nlattr *nla)
1862{
1863 if (nla == NULL)
1864 return ERR_PTR(-EINVAL);
1865
1866 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1867}
1868
1869static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 1870 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1871 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1872 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1873 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1874 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1875 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1876 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1877 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1878 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1879 .len = NFT_USERDATA_MAXLEN },
96518518
PM		 1880};
1881
84d7fce6
PNA		 1882static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1883 u32 portid, u32 seq, int event,
1884 u32 flags, int family,
96518518
PM		 1885 const struct nft_table *table,
1886 const struct nft_chain *chain,
1887 const struct nft_rule *rule)
1888{
1889 struct nlmsghdr *nlh;
1890 struct nfgenmsg *nfmsg;
1891 const struct nft_expr *expr, *next;
1892 struct nlattr *list;
5e948466 1893 const struct nft_rule *prule;
dedb67c4 1894 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 1895
dedb67c4 1896 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 1897 if (nlh == NULL)
1898 goto nla_put_failure;
1899
1900 nfmsg = nlmsg_data(nlh);
1901 nfmsg->nfgen_family = family;
1902 nfmsg->version = NFNETLINK_V0;
84d7fce6 1903 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1904
1905 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1906 goto nla_put_failure;
1907 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1908 goto nla_put_failure;
b46f6ded
ND		 1909 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
1910 NFTA_RULE_PAD))
96518518
PM		 1911 goto nla_put_failure;
1912
5e948466 1913 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 1914 prule = list_prev_entry(rule, list);
5e948466 1915 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 1916 cpu_to_be64(prule->handle),
1917 NFTA_RULE_PAD))
5e948466
EL		 1918 goto nla_put_failure;
1919 }
1920
96518518
PM		 1921 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1922 if (list == NULL)
1923 goto nla_put_failure;
1924 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 1925 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 1926 goto nla_put_failure;
96518518
PM		 1927 }
1928 nla_nest_end(skb, list);
1929
86f1ec32
PM		 1930 if (rule->udata) {
1931 struct nft_userdata *udata = nft_userdata(rule);
1932 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
1933 udata->data) < 0)
1934 goto nla_put_failure;
1935 }
0768b3b3 1936
053c095a
JB		 1937 nlmsg_end(skb, nlh);
1938 return 0;
96518518
PM		 1939
1940nla_put_failure:
1941 nlmsg_trim(skb, nlh);
1942 return -1;
1943}
1944
25e94a99
PNA		 1945static void nf_tables_rule_notify(const struct nft_ctx *ctx,
1946 const struct nft_rule *rule, int event)
96518518
PM		 1947{
1948 struct sk_buff *skb;
96518518
PM		 1949 int err;
1950
128ad332
PNA		 1951 if (!ctx->report &&
1952 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1953 return;
96518518 1954
96518518
PM		 1955 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1956 if (skb == NULL)
1957 goto err;
1958
84d7fce6
PNA		 1959 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
1960 event, 0, ctx->afi->family, ctx->table,
35151d84 1961 ctx->chain, rule);
96518518
PM		 1962 if (err < 0) {
1963 kfree_skb(skb);
1964 goto err;
1965 }
1966
25e94a99
PNA		 1967 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1968 ctx->report, GFP_KERNEL);
1969 return;
96518518 1970err:
25e94a99 1971 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1972}
1973
6e1f760e
PNA		 1974struct nft_rule_dump_ctx {
1975 char table[NFT_TABLE_MAXNAMELEN];
1976 char chain[NFT_CHAIN_MAXNAMELEN];
1977};
1978
96518518
PM		 1979static int nf_tables_dump_rules(struct sk_buff *skb,
1980 struct netlink_callback *cb)
1981{
1982 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 1983 const struct nft_rule_dump_ctx *ctx = cb->data;
96518518
PM		 1984 const struct nft_af_info *afi;
1985 const struct nft_table *table;
1986 const struct nft_chain *chain;
1987 const struct nft_rule *rule;
1988 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1989 struct net *net = sock_net(skb->sk);
96518518
PM		 1990 int family = nfmsg->nfgen_family;
1991
e688a7f8 1992 rcu_read_lock();
38e029f1
PNA		 1993 cb->seq = net->nft.base_seq;
1994
e688a7f8 1995 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 1996 if (family != NFPROTO_UNSPEC && family != afi->family)
1997 continue;
1998
e688a7f8 1999 list_for_each_entry_rcu(table, &afi->tables, list) {
6e1f760e
PNA		 2000 if (ctx && ctx->table[0] &&
2001 strcmp(ctx->table, table->name) != 0)
2002 continue;
2003
e688a7f8 2004 list_for_each_entry_rcu(chain, &table->chains, list) {
6e1f760e
PNA		 2005 if (ctx && ctx->chain[0] &&
2006 strcmp(ctx->chain, chain->name) != 0)
2007 continue;
2008
e688a7f8 2009 list_for_each_entry_rcu(rule, &chain->rules, list) {
889f7ee7 2010 if (!nft_is_active(net, rule))
0628b123 2011 goto cont;
96518518
PM		 2012 if (idx < s_idx)
2013 goto cont;
2014 if (idx > s_idx)
2015 memset(&cb->args[1], 0,
2016 sizeof(cb->args) - sizeof(cb->args[0]));
84d7fce6 2017 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
96518518
PM		 2018 cb->nlh->nlmsg_seq,
2019 NFT_MSG_NEWRULE,
2020 NLM_F_MULTI | NLM_F_APPEND,
2021 afi->family, table, chain, rule) < 0)
2022 goto done;
38e029f1
PNA		 2023
2024 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 2025cont:
2026 idx++;
2027 }
2028 }
2029 }
2030 }
2031done:
e688a7f8
PNA		 2032 rcu_read_unlock();
2033
96518518
PM		 2034 cb->args[0] = idx;
2035 return skb->len;
2036}
2037
6e1f760e
PNA		 2038static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2039{
2040 kfree(cb->data);
2041 return 0;
2042}
2043
7b8002a1
PNA		 2044static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2045 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2046 const struct nlattr * const nla[],
2047 struct netlink_ext_ack *extack)
96518518
PM		 2048{
2049 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2050 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2051 const struct nft_af_info *afi;
2052 const struct nft_table *table;
2053 const struct nft_chain *chain;
2054 const struct nft_rule *rule;
2055 struct sk_buff *skb2;
2056 int family = nfmsg->nfgen_family;
2057 int err;
2058
2059 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2060 struct netlink_dump_control c = {
2061 .dump = nf_tables_dump_rules,
6e1f760e 2062 .done = nf_tables_dump_rules_done,
96518518 2063 };
6e1f760e
PNA		 2064
2065 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2066 struct nft_rule_dump_ctx *ctx;
2067
2068 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2069 if (!ctx)
2070 return -ENOMEM;
2071
2072 if (nla[NFTA_RULE_TABLE])
2073 nla_strlcpy(ctx->table, nla[NFTA_RULE_TABLE],
2074 sizeof(ctx->table));
2075 if (nla[NFTA_RULE_CHAIN])
2076 nla_strlcpy(ctx->chain, nla[NFTA_RULE_CHAIN],
2077 sizeof(ctx->chain));
2078 c.data = ctx;
2079 }
2080
96518518
PM		 2081 return netlink_dump_start(nlsk, skb, nlh, &c);
2082 }
2083
99633ab2 2084 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 2085 if (IS_ERR(afi))
2086 return PTR_ERR(afi);
2087
f2a6d766 2088 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2089 if (IS_ERR(table))
2090 return PTR_ERR(table);
2091
664b0f8c 2092 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2093 if (IS_ERR(chain))
2094 return PTR_ERR(chain);
2095
2096 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2097 if (IS_ERR(rule))
2098 return PTR_ERR(rule);
2099
2100 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2101 if (!skb2)
2102 return -ENOMEM;
2103
84d7fce6 2104 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2105 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2106 family, table, chain, rule);
2107 if (err < 0)
2108 goto err;
2109
2110 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2111
2112err:
2113 kfree_skb(skb2);
2114 return err;
2115}
2116
62472bce
PM		 2117static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2118 struct nft_rule *rule)
96518518 2119{
96518518
PM		 2120 struct nft_expr *expr;
2121
2122 /*
2123 * Careful: some expressions might not be initialized in case this
2124 * is called on error from nf_tables_newrule().
2125 */
2126 expr = nft_expr_first(rule);
3e38df13 2127 while (expr != nft_expr_last(rule) && expr->ops) {
62472bce 2128 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 2129 expr = nft_expr_next(expr);
2130 }
2131 kfree(rule);
2132}
2133
1081d11b
PNA		 2134#define NFT_RULE_MAXEXPRS 128
2135
2136static struct nft_expr_info *info;
2137
633c9a84
PNA		 2138static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2139 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2140 const struct nlattr * const nla[],
2141 struct netlink_ext_ack *extack)
96518518
PM		 2142{
2143 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2144 u8 genmask = nft_genmask_next(net);
7c95f6d8 2145 struct nft_af_info *afi;
96518518
PM		 2146 struct nft_table *table;
2147 struct nft_chain *chain;
2148 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2149 struct nft_userdata *udata;
1081d11b 2150 struct nft_trans *trans = NULL;
96518518
PM		 2151 struct nft_expr *expr;
2152 struct nft_ctx ctx;
2153 struct nlattr *tmp;
86f1ec32 2154 unsigned int size, i, n, ulen = 0, usize = 0;
96518518
PM		 2155 int err, rem;
2156 bool create;
5e948466 2157 u64 handle, pos_handle;
96518518
PM		 2158
2159 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2160
99633ab2 2161 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
96518518
PM		 2162 if (IS_ERR(afi))
2163 return PTR_ERR(afi);
2164
f2a6d766 2165 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2166 if (IS_ERR(table))
2167 return PTR_ERR(table);
2168
664b0f8c 2169 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2170 if (IS_ERR(chain))
2171 return PTR_ERR(chain);
2172
2173 if (nla[NFTA_RULE_HANDLE]) {
2174 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2175 rule = __nf_tables_rule_lookup(chain, handle);
2176 if (IS_ERR(rule))
2177 return PTR_ERR(rule);
2178
2179 if (nlh->nlmsg_flags & NLM_F_EXCL)
2180 return -EEXIST;
2181 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2182 old_rule = rule;
2183 else
2184 return -EOPNOTSUPP;
2185 } else {
2186 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2187 return -EINVAL;
2188 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2189
2190 if (chain->use == UINT_MAX)
2191 return -EOVERFLOW;
96518518
PM		 2192 }
2193
5e948466
EL		 2194 if (nla[NFTA_RULE_POSITION]) {
2195 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2196 return -EOPNOTSUPP;
2197
2198 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2199 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
2200 if (IS_ERR(old_rule))
2201 return PTR_ERR(old_rule);
2202 }
2203
633c9a84 2204 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0ca743a5 2205
96518518
PM		 2206 n = 0;
2207 size = 0;
2208 if (nla[NFTA_RULE_EXPRESSIONS]) {
2209 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2210 err = -EINVAL;
2211 if (nla_type(tmp) != NFTA_LIST_ELEM)
2212 goto err1;
2213 if (n == NFT_RULE_MAXEXPRS)
2214 goto err1;
0ca743a5 2215 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2216 if (err < 0)
2217 goto err1;
2218 size += info[n].ops->size;
2219 n++;
2220 }
2221 }
9889840f
PM		 2222 /* Check for overflow of dlen field */
2223 err = -EFBIG;
2224 if (size >= 1 << 12)
2225 goto err1;
96518518 2226
86f1ec32 2227 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2228 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2229 if (ulen > 0)
2230 usize = sizeof(struct nft_userdata) + ulen;
2231 }
0768b3b3 2232
96518518 2233 err = -ENOMEM;
86f1ec32 2234 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2235 if (rule == NULL)
2236 goto err1;
2237
889f7ee7 2238 nft_activate_next(net, rule);
0628b123 2239
96518518
PM		 2240 rule->handle = handle;
2241 rule->dlen = size;
86f1ec32 2242 rule->udata = ulen ? 1 : 0;
0768b3b3 2243
86f1ec32
PM		 2244 if (ulen) {
2245 udata = nft_userdata(rule);
2246 udata->len = ulen - 1;
2247 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2248 }
96518518 2249
96518518
PM		 2250 expr = nft_expr_first(rule);
2251 for (i = 0; i < n; i++) {
2252 err = nf_tables_newexpr(&ctx, &info[i], expr);
2253 if (err < 0)
2254 goto err2;
ef1f7df9 2255 info[i].ops = NULL;
96518518
PM		 2256 expr = nft_expr_next(expr);
2257 }
2258
96518518 2259 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
889f7ee7 2260 if (nft_is_active_next(net, old_rule)) {
ac904ac8 2261 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
b380e5c7 2262 old_rule);
1081d11b 2263 if (trans == NULL) {
0628b123
PNA		 2264 err = -ENOMEM;
2265 goto err2;
2266 }
889f7ee7 2267 nft_deactivate_next(net, old_rule);
ac34b861 2268 chain->use--;
5bc5c307 2269 list_add_tail_rcu(&rule->list, &old_rule->list);
0628b123
PNA		 2270 } else {
2271 err = -ENOENT;
2272 goto err2;
2273 }
96518518 2274 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 2275 if (old_rule)
2276 list_add_rcu(&rule->list, &old_rule->list);
2277 else
2278 list_add_tail_rcu(&rule->list, &chain->rules);
2279 else {
2280 if (old_rule)
2281 list_add_tail_rcu(&rule->list, &old_rule->list);
2282 else
2283 list_add_rcu(&rule->list, &chain->rules);
2284 }
96518518 2285
b380e5c7 2286 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 2287 err = -ENOMEM;
2288 goto err3;
2289 }
4fefee57 2290 chain->use++;
96518518
PM		 2291 return 0;
2292
0628b123
PNA		 2293err3:
2294 list_del_rcu(&rule->list);
96518518 2295err2:
62472bce 2296 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 2297err1:
2298 for (i = 0; i < n; i++) {
2299 if (info[i].ops != NULL)
ef1f7df9 2300 module_put(info[i].ops->type->owner);
96518518
PM		 2301 }
2302 return err;
2303}
2304
1a94e38d
PNA		 2305static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2306 const struct nlattr *nla)
2307{
2308 u32 id = ntohl(nla_get_be32(nla));
2309 struct nft_trans *trans;
2310
2311 list_for_each_entry(trans, &net->nft.commit_list, list) {
2312 struct nft_rule *rule = nft_trans_rule(trans);
2313
2314 if (trans->msg_type == NFT_MSG_NEWRULE &&
2315 id == nft_trans_rule_id(trans))
2316 return rule;
2317 }
2318 return ERR_PTR(-ENOENT);
2319}
2320
633c9a84
PNA		 2321static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2322 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2323 const struct nlattr * const nla[],
2324 struct netlink_ext_ack *extack)
96518518
PM		 2325{
2326 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2327 u8 genmask = nft_genmask_next(net);
7c95f6d8 2328 struct nft_af_info *afi;
7c95f6d8 2329 struct nft_table *table;
cf9dc09d
PNA		 2330 struct nft_chain *chain = NULL;
2331 struct nft_rule *rule;
0628b123
PNA		 2332 int family = nfmsg->nfgen_family, err = 0;
2333 struct nft_ctx ctx;
96518518 2334
99633ab2 2335 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 2336 if (IS_ERR(afi))
2337 return PTR_ERR(afi);
2338
f2a6d766 2339 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2340 if (IS_ERR(table))
2341 return PTR_ERR(table);
2342
cf9dc09d 2343 if (nla[NFTA_RULE_CHAIN]) {
664b0f8c
PNA		 2344 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN],
2345 genmask);
cf9dc09d
PNA		 2346 if (IS_ERR(chain))
2347 return PTR_ERR(chain);
2348 }
96518518 2349
633c9a84 2350 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0628b123 2351
cf9dc09d
PNA		 2352 if (chain) {
2353 if (nla[NFTA_RULE_HANDLE]) {
2354 rule = nf_tables_rule_lookup(chain,
2355 nla[NFTA_RULE_HANDLE]);
2356 if (IS_ERR(rule))
2357 return PTR_ERR(rule);
96518518 2358
1a94e38d
PNA		 2359 err = nft_delrule(&ctx, rule);
2360 } else if (nla[NFTA_RULE_ID]) {
2361 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2362 if (IS_ERR(rule))
2363 return PTR_ERR(rule);
2364
5e266fe7 2365 err = nft_delrule(&ctx, rule);
cf9dc09d 2366 } else {
ce24b721 2367 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2368 }
2369 } else {
2370 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2371 if (!nft_is_active_next(net, chain))
2372 continue;
2373
cf9dc09d 2374 ctx.chain = chain;
ce24b721 2375 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2376 if (err < 0)
2377 break;
2378 }
2379 }
2380
2381 return err;
2382}
2383
20a69341
PM		 2384/*
2385 * Sets
2386 */
2387
2b664957 2388static LIST_HEAD(nf_tables_set_types);
20a69341 2389
2b664957 2390int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2391{
2392 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2393 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2394 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2395 return 0;
2396}
2397EXPORT_SYMBOL_GPL(nft_register_set);
2398
2b664957 2399void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2400{
2401 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2402 list_del_rcu(&type->list);
20a69341
PM		 2403 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2404}
2405EXPORT_SYMBOL_GPL(nft_unregister_set);
2406
2b664957
PNA		 2407#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2408 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
2409
2410static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
2411{
2412 return (flags & ops->features) == (flags & NFT_SET_FEATURES);
2413}
2414
c50b960c
PM		 2415/*
2416 * Select a set implementation based on the data characteristics and the
2417 * given policy. The total memory use might not be known if no size is
2418 * given, in that case the amount of memory per element is used.
2419 */
2420static const struct nft_set_ops *
2b664957
PNA		 2421nft_select_set_ops(const struct nft_ctx *ctx,
2422 const struct nlattr * const nla[],
c50b960c
PM		 2423 const struct nft_set_desc *desc,
2424 enum nft_set_policies policy)
20a69341 2425{
c50b960c
PM		 2426 const struct nft_set_ops *ops, *bops;
2427 struct nft_set_estimate est, best;
2b664957
PNA		 2428 const struct nft_set_type *type;
2429 u32 flags = 0;
20a69341
PM		 2430
2431#ifdef CONFIG_MODULES
2b664957 2432 if (list_empty(&nf_tables_set_types)) {
20a69341
PM		 2433 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2434 request_module("nft-set");
2435 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2436 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2437 return ERR_PTR(-EAGAIN);
2438 }
2439#endif
2b664957
PNA		 2440 if (nla[NFTA_SET_FLAGS] != NULL)
2441 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2442
55af753c
PNA		 2443 bops = NULL;
2444 best.size = ~0;
2445 best.lookup = ~0;
0b5a7874 2446 best.space = ~0;
c50b960c 2447
2b664957
PNA		 2448 list_for_each_entry(type, &nf_tables_set_types, list) {
2449 if (!type->select_ops)
2450 ops = type->ops;
2451 else
2452 ops = type->select_ops(ctx, desc, flags);
2453 if (!ops)
2454 continue;
2455
2456 if (!nft_set_ops_candidate(ops, flags))
20a69341 2457 continue;
2b664957 2458 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2459 continue;
2460
2461 switch (policy) {
2462 case NFT_SET_POL_PERFORMANCE:
55af753c 2463 if (est.lookup < best.lookup)
c50b960c 2464 break;
0b5a7874
PNA		 2465 if (est.lookup == best.lookup) {
2466 if (!desc->size) {
2467 if (est.space < best.space)
2468 break;
2469 } else if (est.size < best.size) {
2470 break;
2471 }
2472 }
c50b960c
PM		 2473 continue;
2474 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2475 if (!desc->size) {
2476 if (est.space < best.space)
2477 break;
2478 if (est.space == best.space &&
2479 est.lookup < best.lookup)
2480 break;
2481 } else if (est.size < best.size) {
c50b960c 2482 break;
0b5a7874 2483 }
c50b960c
PM		 2484 continue;
2485 default:
2486 break;
2487 }
2488
2b664957 2489 if (!try_module_get(type->owner))
20a69341 2490 continue;
c50b960c 2491 if (bops != NULL)
2b664957 2492 module_put(bops->type->owner);
c50b960c
PM		 2493
2494 bops = ops;
2495 best = est;
20a69341
PM		 2496 }
2497
c50b960c
PM		 2498 if (bops != NULL)
2499 return bops;
2500
20a69341
PM		 2501 return ERR_PTR(-EOPNOTSUPP);
2502}
2503
2504static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2505 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2506 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2507 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2508 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2509 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2510 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2511 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2512 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2513 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2514 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2515 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2516 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2517 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2518 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2519 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2520 .len = NFT_USERDATA_MAXLEN },
8aeff920 2521 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
c50b960c
PM		 2522};
2523
2524static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2525 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2526};
2527
633c9a84 2528static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2529 const struct sk_buff *skb,
2530 const struct nlmsghdr *nlh,
f2a6d766
PNA		 2531 const struct nlattr * const nla[],
2532 u8 genmask)
20a69341
PM		 2533{
2534 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 2535 struct nft_af_info *afi = NULL;
2536 struct nft_table *table = NULL;
20a69341 2537
c9c8e485
PNA		 2538 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
2539 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
2540 if (IS_ERR(afi))
2541 return PTR_ERR(afi);
2542 }
20a69341
PM		 2543
2544 if (nla[NFTA_SET_TABLE] != NULL) {
ec2c9935
PM		 2545 if (afi == NULL)
2546 return -EAFNOSUPPORT;
2547
f2a6d766
PNA		 2548 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE],
2549 genmask);
20a69341
PM		 2550 if (IS_ERR(table))
2551 return PTR_ERR(table);
2552 }
2553
633c9a84 2554 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2555 return 0;
2556}
2557
c7a72e3f
PNA		 2558static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2559 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2560{
2561 struct nft_set *set;
2562
2563 if (nla == NULL)
2564 return ERR_PTR(-EINVAL);
2565
2566 list_for_each_entry(set, &table->sets, list) {
37a9cc52
PNA		 2567 if (!nla_strcmp(nla, set->name) &&
2568 nft_active_genmask(set, genmask))
20a69341
PM		 2569 return set;
2570 }
2571 return ERR_PTR(-ENOENT);
2572}
2573
c7a72e3f
PNA		 2574static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2575 const struct nlattr *nla,
2576 u8 genmask)
958bee14
PNA		 2577{
2578 struct nft_trans *trans;
2579 u32 id = ntohl(nla_get_be32(nla));
2580
2581 list_for_each_entry(trans, &net->nft.commit_list, list) {
37a9cc52
PNA		 2582 struct nft_set *set = nft_trans_set(trans);
2583
958bee14 2584 if (trans->msg_type == NFT_MSG_NEWSET &&
37a9cc52
PNA		 2585 id == nft_trans_set_id(trans) &&
2586 nft_active_genmask(set, genmask))
2587 return set;
958bee14
PNA		 2588 }
2589 return ERR_PTR(-ENOENT);
2590}
c7a72e3f
PNA		 2591
2592struct nft_set *nft_set_lookup(const struct net *net,
2593 const struct nft_table *table,
2594 const struct nlattr *nla_set_name,
2595 const struct nlattr *nla_set_id,
2596 u8 genmask)
2597{
2598 struct nft_set *set;
2599
2600 set = nf_tables_set_lookup(table, nla_set_name, genmask);
2601 if (IS_ERR(set)) {
2602 if (!nla_set_id)
2603 return set;
2604
2605 set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
2606 }
2607 return set;
2608}
2609EXPORT_SYMBOL_GPL(nft_set_lookup);
958bee14 2610
20a69341
PM		 2611static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2612 const char *name)
2613{
2614 const struct nft_set *i;
2615 const char *p;
2616 unsigned long *inuse;
60eb1894 2617 unsigned int n = 0, min = 0;
20a69341 2618
cb39ad8b 2619 p = strnchr(name, NFT_SET_MAXNAMELEN, '%');
20a69341
PM		 2620 if (p != NULL) {
2621 if (p[1] != 'd' || strchr(p + 2, '%'))
2622 return -EINVAL;
2623
2624 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2625 if (inuse == NULL)
2626 return -ENOMEM;
60eb1894 2627cont:
20a69341 2628 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2629 int tmp;
2630
37a9cc52
PNA		 2631 if (!nft_is_active_next(ctx->net, set))
2632 continue;
14662917 2633 if (!sscanf(i->name, name, &tmp))
20a69341 2634 continue;
60eb1894 2635 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2636 continue;
14662917 2637
60eb1894 2638 set_bit(tmp - min, inuse);
20a69341
PM		 2639 }
2640
53b70287 2641 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2642 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2643 min += BITS_PER_BYTE * PAGE_SIZE;
2644 memset(inuse, 0, PAGE_SIZE);
2645 goto cont;
2646 }
20a69341
PM		 2647 free_page((unsigned long)inuse);
2648 }
2649
60eb1894 2650 snprintf(set->name, sizeof(set->name), name, min + n);
20a69341 2651 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 2652 if (!nft_is_active_next(ctx->net, i))
2653 continue;
20a69341
PM		 2654 if (!strcmp(set->name, i->name))
2655 return -ENFILE;
2656 }
2657 return 0;
2658}
2659
2660static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2661 const struct nft_set *set, u16 event, u16 flags)
2662{
2663 struct nfgenmsg *nfmsg;
2664 struct nlmsghdr *nlh;
c50b960c 2665 struct nlattr *desc;
128ad332
PNA		 2666 u32 portid = ctx->portid;
2667 u32 seq = ctx->seq;
20a69341 2668
dedb67c4 2669 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 2670 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2671 flags);
2672 if (nlh == NULL)
2673 goto nla_put_failure;
2674
2675 nfmsg = nlmsg_data(nlh);
2676 nfmsg->nfgen_family = ctx->afi->family;
2677 nfmsg->version = NFNETLINK_V0;
84d7fce6 2678 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 2679
2680 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2681 goto nla_put_failure;
2682 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2683 goto nla_put_failure;
2684 if (set->flags != 0)
2685 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2686 goto nla_put_failure;
2687
2688 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2689 goto nla_put_failure;
2690 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2691 goto nla_put_failure;
2692 if (set->flags & NFT_SET_MAP) {
2693 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2694 goto nla_put_failure;
2695 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2696 goto nla_put_failure;
2697 }
8aeff920
PNA		 2698 if (set->flags & NFT_SET_OBJECT &&
2699 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2700 goto nla_put_failure;
20a69341 2701
761da293 2702 if (set->timeout &&
d3e2a111
AP		 2703 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2704 cpu_to_be64(jiffies_to_msecs(set->timeout)),
b46f6ded 2705 NFTA_SET_PAD))
761da293
PM		 2706 goto nla_put_failure;
2707 if (set->gc_int &&
2708 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2709 goto nla_put_failure;
2710
9363dc4b
AB		 2711 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2712 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2713 goto nla_put_failure;
2714 }
2715
e6d8ecac
CFG		 2716 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2717 goto nla_put_failure;
2718
c50b960c
PM		 2719 desc = nla_nest_start(skb, NFTA_SET_DESC);
2720 if (desc == NULL)
2721 goto nla_put_failure;
2722 if (set->size &&
2723 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2724 goto nla_put_failure;
2725 nla_nest_end(skb, desc);
2726
053c095a
JB		 2727 nlmsg_end(skb, nlh);
2728 return 0;
20a69341
PM		 2729
2730nla_put_failure:
2731 nlmsg_trim(skb, nlh);
2732 return -1;
2733}
2734
25e94a99
PNA		 2735static void nf_tables_set_notify(const struct nft_ctx *ctx,
2736 const struct nft_set *set, int event,
2737 gfp_t gfp_flags)
20a69341
PM		 2738{
2739 struct sk_buff *skb;
128ad332 2740 u32 portid = ctx->portid;
20a69341
PM		 2741 int err;
2742
128ad332
PNA		 2743 if (!ctx->report &&
2744 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2745 return;
20a69341 2746
31f8441c 2747 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 2748 if (skb == NULL)
2749 goto err;
2750
2751 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2752 if (err < 0) {
2753 kfree_skb(skb);
2754 goto err;
2755 }
2756
25e94a99
PNA		 2757 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2758 gfp_flags);
2759 return;
20a69341 2760err:
25e94a99 2761 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 2762}
2763
5b96af77 2764static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 2765{
2766 const struct nft_set *set;
2767 unsigned int idx, s_idx = cb->args[0];
7c95f6d8 2768 struct nft_af_info *afi;
c9c8e485
PNA		 2769 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2770 struct net *net = sock_net(skb->sk);
2771 int cur_family = cb->args[3];
5b96af77 2772 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 2773
2774 if (cb->args[1])
2775 return skb->len;
2776
e688a7f8 2777 rcu_read_lock();
38e029f1
PNA		 2778 cb->seq = net->nft.base_seq;
2779
e688a7f8 2780 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
5b96af77
PNA		 2781 if (ctx->afi && ctx->afi != afi)
2782 continue;
2783
c9c8e485
PNA		 2784 if (cur_family) {
2785 if (afi->family != cur_family)
2786 continue;
2787
2788 cur_family = 0;
2789 }
e688a7f8 2790 list_for_each_entry_rcu(table, &afi->tables, list) {
5b96af77
PNA		 2791 if (ctx->table && ctx->table != table)
2792 continue;
2793
c9c8e485
PNA		 2794 if (cur_table) {
2795 if (cur_table != table)
2796 continue;
2797
2798 cur_table = NULL;
2799 }
c9c8e485 2800 idx = 0;
5b96af77 2801 list_for_each_entry_rcu(set, &table->sets, list) {
c9c8e485
PNA		 2802 if (idx < s_idx)
2803 goto cont;
37a9cc52
PNA		 2804 if (!nft_is_active(net, set))
2805 goto cont;
5b96af77
PNA		 2806
2807 ctx_set = *ctx;
2808 ctx_set.table = table;
2809 ctx_set.afi = afi;
2810 if (nf_tables_fill_set(skb, &ctx_set, set,
c9c8e485
PNA		 2811 NFT_MSG_NEWSET,
2812 NLM_F_MULTI) < 0) {
2813 cb->args[0] = idx;
2814 cb->args[2] = (unsigned long) table;
2815 cb->args[3] = afi->family;
2816 goto done;
2817 }
38e029f1 2818 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485
PNA		 2819cont:
2820 idx++;
2821 }
2822 if (s_idx)
2823 s_idx = 0;
2824 }
2825 }
2826 cb->args[1] = 1;
2827done:
e688a7f8 2828 rcu_read_unlock();
c9c8e485
PNA		 2829 return skb->len;
2830}
2831
5b96af77 2832static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 2833{
5b96af77
PNA		 2834 kfree(cb->data);
2835 return 0;
20a69341
PM		 2836}
2837
7b8002a1
PNA		 2838static int nf_tables_getset(struct net *net, struct sock *nlsk,
2839 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2840 const struct nlattr * const nla[],
2841 struct netlink_ext_ack *extack)
20a69341 2842{
f2a6d766 2843 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 2844 const struct nft_set *set;
2845 struct nft_ctx ctx;
2846 struct sk_buff *skb2;
c9c8e485 2847 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2848 int err;
2849
01cfa0a4 2850 /* Verify existence before starting dump */
f2a6d766 2851 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 2852 if (err < 0)
2853 return err;
2854
2855 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2856 struct netlink_dump_control c = {
2857 .dump = nf_tables_dump_sets,
5b96af77 2858 .done = nf_tables_dump_sets_done,
20a69341 2859 };
5b96af77
PNA		 2860 struct nft_ctx *ctx_dump;
2861
2862 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2863 if (ctx_dump == NULL)
2864 return -ENOMEM;
2865
2866 *ctx_dump = ctx;
2867 c.data = ctx_dump;
2868
20a69341
PM		 2869 return netlink_dump_start(nlsk, skb, nlh, &c);
2870 }
2871
c9c8e485
PNA		 2872 /* Only accept unspec with dump */
2873 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2874 return -EAFNOSUPPORT;
eaa2bcd6
PT		 2875 if (!nla[NFTA_SET_TABLE])
2876 return -EINVAL;
c9c8e485 2877
37a9cc52 2878 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 2879 if (IS_ERR(set))
2880 return PTR_ERR(set);
2881
2882 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2883 if (skb2 == NULL)
2884 return -ENOMEM;
2885
2886 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2887 if (err < 0)
2888 goto err;
2889
2890 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2891
2892err:
2893 kfree_skb(skb2);
2894 return err;
2895}
2896
c50b960c
PM		 2897static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2898 struct nft_set_desc *desc,
2899 const struct nlattr *nla)
2900{
2901 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2902 int err;
2903
fceb6435
JB		 2904 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
2905 nft_set_desc_policy, NULL);
c50b960c
PM		 2906 if (err < 0)
2907 return err;
2908
2909 if (da[NFTA_SET_DESC_SIZE] != NULL)
2910 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
2911
2912 return 0;
2913}
2914
633c9a84
PNA		 2915static int nf_tables_newset(struct net *net, struct sock *nlsk,
2916 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2917 const struct nlattr * const nla[],
2918 struct netlink_ext_ack *extack)
20a69341
PM		 2919{
2920 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2921 u8 genmask = nft_genmask_next(net);
20a69341 2922 const struct nft_set_ops *ops;
7c95f6d8 2923 struct nft_af_info *afi;
20a69341
PM		 2924 struct nft_table *table;
2925 struct nft_set *set;
2926 struct nft_ctx ctx;
cb39ad8b 2927 char name[NFT_SET_MAXNAMELEN];
20a69341
PM		 2928 unsigned int size;
2929 bool create;
761da293 2930 u64 timeout;
8aeff920 2931 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 2932 struct nft_set_desc desc;
e6d8ecac
CFG		 2933 unsigned char *udata;
2934 u16 udlen;
20a69341
PM		 2935 int err;
2936
2937 if (nla[NFTA_SET_TABLE] == NULL ||
2938 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 2939 nla[NFTA_SET_KEY_LEN] == NULL ||
2940 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 2941 return -EINVAL;
2942
c50b960c
PM		 2943 memset(&desc, 0, sizeof(desc));
2944
20a69341
PM		 2945 ktype = NFT_DATA_VALUE;
2946 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
2947 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
2948 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
2949 return -EINVAL;
2950 }
2951
c50b960c 2952 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 2953 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 2954 return -EINVAL;
2955
2956 flags = 0;
2957 if (nla[NFTA_SET_FLAGS] != NULL) {
2958 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2959 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 2960 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 2961 NFT_SET_MAP | NFT_SET_EVAL |
2962 NFT_SET_OBJECT))
20a69341 2963 return -EINVAL;
8aeff920
PNA		 2964 /* Only one of these operations is supported */
2965 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
2966 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 2967 return -EOPNOTSUPP;
20a69341
PM		 2968 }
2969
2970 dtype = 0;
20a69341
PM		 2971 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
2972 if (!(flags & NFT_SET_MAP))
2973 return -EINVAL;
2974
2975 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
2976 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
2977 dtype != NFT_DATA_VERDICT)
2978 return -EINVAL;
2979
2980 if (dtype != NFT_DATA_VERDICT) {
2981 if (nla[NFTA_SET_DATA_LEN] == NULL)
2982 return -EINVAL;
c50b960c 2983 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 2984 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 2985 return -EINVAL;
2986 } else
7d740264 2987 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 2988 } else if (flags & NFT_SET_MAP)
2989 return -EINVAL;
2990
8aeff920
PNA		 2991 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
2992 if (!(flags & NFT_SET_OBJECT))
2993 return -EINVAL;
2994
2995 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
2996 if (objtype == NFT_OBJECT_UNSPEC ||
2997 objtype > NFT_OBJECT_MAX)
2998 return -EINVAL;
2999 } else if (flags & NFT_SET_OBJECT)
3000 return -EINVAL;
3001 else
3002 objtype = NFT_OBJECT_UNSPEC;
3003
761da293
PM		 3004 timeout = 0;
3005 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3006 if (!(flags & NFT_SET_TIMEOUT))
3007 return -EINVAL;
d3e2a111
AP		 3008 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3009 nla[NFTA_SET_TIMEOUT])));
761da293
PM		 3010 }
3011 gc_int = 0;
3012 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3013 if (!(flags & NFT_SET_TIMEOUT))
3014 return -EINVAL;
3015 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3016 }
3017
c50b960c
PM		 3018 policy = NFT_SET_POL_PERFORMANCE;
3019 if (nla[NFTA_SET_POLICY] != NULL)
3020 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3021
3022 if (nla[NFTA_SET_DESC] != NULL) {
3023 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3024 if (err < 0)
3025 return err;
3026 }
3027
20a69341
PM		 3028 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3029
99633ab2 3030 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
20a69341
PM		 3031 if (IS_ERR(afi))
3032 return PTR_ERR(afi);
3033
f2a6d766 3034 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask);
20a69341
PM		 3035 if (IS_ERR(table))
3036 return PTR_ERR(table);
3037
633c9a84 3038 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341 3039
37a9cc52 3040 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3041 if (IS_ERR(set)) {
3042 if (PTR_ERR(set) != -ENOENT)
3043 return PTR_ERR(set);
1a28ad74 3044 } else {
20a69341
PM		 3045 if (nlh->nlmsg_flags & NLM_F_EXCL)
3046 return -EEXIST;
3047 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3048 return -EOPNOTSUPP;
3049 return 0;
3050 }
3051
3052 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3053 return -ENOENT;
3054
2b664957 3055 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3056 if (IS_ERR(ops))
3057 return PTR_ERR(ops);
3058
e6d8ecac
CFG		 3059 udlen = 0;
3060 if (nla[NFTA_SET_USERDATA])
3061 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3062
20a69341
PM		 3063 size = 0;
3064 if (ops->privsize != NULL)
347b408d 3065 size = ops->privsize(nla, &desc);
20a69341 3066
1ff75a3e
PNA		 3067 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3068 if (!set) {
3069 err = -ENOMEM;
20a69341 3070 goto err1;
1ff75a3e 3071 }
20a69341
PM		 3072
3073 nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name));
3074 err = nf_tables_set_alloc_name(&ctx, set, name);
3075 if (err < 0)
3076 goto err2;
3077
e6d8ecac
CFG		 3078 udata = NULL;
3079 if (udlen) {
3080 udata = set->data + size;
3081 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3082 }
3083
20a69341
PM		 3084 INIT_LIST_HEAD(&set->bindings);
3085 set->ops = ops;
3086 set->ktype = ktype;
c50b960c 3087 set->klen = desc.klen;
20a69341 3088 set->dtype = dtype;
8aeff920 3089 set->objtype = objtype;
c50b960c 3090 set->dlen = desc.dlen;
20a69341 3091 set->flags = flags;
c50b960c 3092 set->size = desc.size;
9363dc4b 3093 set->policy = policy;
e6d8ecac
CFG		 3094 set->udlen = udlen;
3095 set->udata = udata;
761da293
PM		 3096 set->timeout = timeout;
3097 set->gc_int = gc_int;
20a69341 3098
c50b960c 3099 err = ops->init(set, &desc, nla);
20a69341
PM		 3100 if (err < 0)
3101 goto err2;
3102
958bee14 3103 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3104 if (err < 0)
c17c3cdf 3105 goto err3;
20a69341 3106
e688a7f8 3107 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3108 table->use++;
20a69341
PM		 3109 return 0;
3110
c17c3cdf
LZ		 3111err3:
3112 ops->destroy(set);
20a69341 3113err2:
1ff75a3e 3114 kvfree(set);
20a69341 3115err1:
2b664957 3116 module_put(ops->type->owner);
20a69341
PM		 3117 return err;
3118}
3119
958bee14 3120static void nft_set_destroy(struct nft_set *set)
20a69341 3121{
20a69341 3122 set->ops->destroy(set);
2b664957 3123 module_put(set->ops->type->owner);
1ff75a3e 3124 kvfree(set);
20a69341
PM		 3125}
3126
958bee14
PNA		 3127static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3128{
e688a7f8 3129 list_del_rcu(&set->list);
31f8441c 3130 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
958bee14
PNA		 3131 nft_set_destroy(set);
3132}
3133
633c9a84
PNA		 3134static int nf_tables_delset(struct net *net, struct sock *nlsk,
3135 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3136 const struct nlattr * const nla[],
3137 struct netlink_ext_ack *extack)
20a69341 3138{
c9c8e485 3139 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3140 u8 genmask = nft_genmask_next(net);
20a69341
PM		 3141 struct nft_set *set;
3142 struct nft_ctx ctx;
3143 int err;
3144
ec2c9935
PM		 3145 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3146 return -EAFNOSUPPORT;
20a69341
PM		 3147 if (nla[NFTA_SET_TABLE] == NULL)
3148 return -EINVAL;
3149
f2a6d766 3150 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 3151 if (err < 0)
3152 return err;
3153
37a9cc52 3154 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3155 if (IS_ERR(set))
3156 return PTR_ERR(set);
3157 if (!list_empty(&set->bindings))
3158 return -EBUSY;
3159
ee01d542 3160 return nft_delset(&ctx, set);
20a69341
PM		 3161}
3162
3163static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3164 struct nft_set *set,
20a69341 3165 const struct nft_set_iter *iter,
de70185d 3166 struct nft_set_elem *elem)
20a69341 3167{
fe2811eb 3168 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3169 enum nft_registers dreg;
3170
3171 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3172 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3173 set->dtype == NFT_DATA_VERDICT ?
3174 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3175 set->dlen);
20a69341
PM		 3176}
3177
3178int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3179 struct nft_set_binding *binding)
3180{
3181 struct nft_set_binding *i;
3182 struct nft_set_iter iter;
3183
3184 if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
3185 return -EBUSY;
3186
11113e19 3187 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3188 /* If the set is already bound to the same chain all
3189 * jumps are already validated for that chain.
3190 */
3191 list_for_each_entry(i, &set->bindings, list) {
a4684402 3192 if (i->flags & NFT_SET_MAP &&
11113e19 3193 i->chain == binding->chain)
20a69341
PM		 3194 goto bind;
3195 }
3196
8588ac09 3197 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3198 iter.skip = 0;
3199 iter.count = 0;
3200 iter.err = 0;
3201 iter.fn = nf_tables_bind_check_setelem;
3202
3203 set->ops->walk(ctx, set, &iter);
a02f4248 3204 if (iter.err < 0)
20a69341 3205 return iter.err;
20a69341
PM		 3206 }
3207bind:
3208 binding->chain = ctx->chain;
e688a7f8 3209 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3210 return 0;
3211}
63aea290 3212EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341
PM		 3213
3214void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3215 struct nft_set_binding *binding)
3216{
e688a7f8 3217 list_del_rcu(&binding->list);
20a69341 3218
958bee14 3219 if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS &&
37a9cc52 3220 nft_is_active(ctx->net, set))
20a69341
PM		 3221 nf_tables_set_destroy(ctx, set);
3222}
63aea290 3223EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3224
3ac4c07a
PM		 3225const struct nft_set_ext_type nft_set_ext_types[] = {
3226 [NFT_SET_EXT_KEY] = {
7d740264 3227 .align = __alignof__(u32),
3ac4c07a
PM		 3228 },
3229 [NFT_SET_EXT_DATA] = {
7d740264 3230 .align = __alignof__(u32),
3ac4c07a 3231 },
f25ad2e9
PM		 3232 [NFT_SET_EXT_EXPR] = {
3233 .align = __alignof__(struct nft_expr),
3234 },
8aeff920
PNA		 3235 [NFT_SET_EXT_OBJREF] = {
3236 .len = sizeof(struct nft_object *),
3237 .align = __alignof__(struct nft_object *),
3238 },
3ac4c07a
PM		 3239 [NFT_SET_EXT_FLAGS] = {
3240 .len = sizeof(u8),
3241 .align = __alignof__(u8),
3242 },
c3e1b005
PM		 3243 [NFT_SET_EXT_TIMEOUT] = {
3244 .len = sizeof(u64),
3245 .align = __alignof__(u64),
3246 },
3247 [NFT_SET_EXT_EXPIRATION] = {
3248 .len = sizeof(unsigned long),
3249 .align = __alignof__(unsigned long),
3250 },
68e942e8
PM		 3251 [NFT_SET_EXT_USERDATA] = {
3252 .len = sizeof(struct nft_userdata),
3253 .align = __alignof__(struct nft_userdata),
3254 },
3ac4c07a
PM		 3255};
3256EXPORT_SYMBOL_GPL(nft_set_ext_types);
3257
20a69341
PM		 3258/*
3259 * Set elements
3260 */
3261
3262static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3263 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3264 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3265 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3266 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3267 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3268 .len = NFT_USERDATA_MAXLEN },
20a69341
PM		 3269};
3270
3271static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3272 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3273 .len = NFT_TABLE_MAXNAMELEN - 1 },
3274 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3275 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3276 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3277 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3278};
3279
633c9a84 3280static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3281 const struct sk_buff *skb,
3282 const struct nlmsghdr *nlh,
f2a6d766
PNA		 3283 const struct nlattr * const nla[],
3284 u8 genmask)
20a69341
PM		 3285{
3286 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 3287 struct nft_af_info *afi;
3288 struct nft_table *table;
20a69341 3289
99633ab2 3290 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
20a69341
PM		 3291 if (IS_ERR(afi))
3292 return PTR_ERR(afi);
3293
f2a6d766
PNA		 3294 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE],
3295 genmask);
20a69341
PM		 3296 if (IS_ERR(table))
3297 return PTR_ERR(table);
3298
633c9a84 3299 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 3300 return 0;
3301}
3302
3303static int nf_tables_fill_setelem(struct sk_buff *skb,
3304 const struct nft_set *set,
3305 const struct nft_set_elem *elem)
3306{
fe2811eb 3307 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3308 unsigned char *b = skb_tail_pointer(skb);
3309 struct nlattr *nest;
3310
3311 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3312 if (nest == NULL)
3313 goto nla_put_failure;
3314
fe2811eb
PM		 3315 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3316 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3317 goto nla_put_failure;
3318
fe2811eb
PM		 3319 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3320 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3321 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3322 set->dlen) < 0)
3323 goto nla_put_failure;
3324
f25ad2e9
PM		 3325 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3326 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3327 goto nla_put_failure;
3328
8aeff920
PNA		 3329 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3330 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3331 (*nft_set_ext_obj(ext))->name) < 0)
3332 goto nla_put_failure;
3333
fe2811eb
PM		 3334 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3335 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3336 htonl(*nft_set_ext_flags(ext))))
3337 goto nla_put_failure;
20a69341 3338
c3e1b005
PM		 3339 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3340 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
d3e2a111
AP		 3341 cpu_to_be64(jiffies_to_msecs(
3342 *nft_set_ext_timeout(ext))),
b46f6ded 3343 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3344 goto nla_put_failure;
3345
3346 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3347 unsigned long expires, now = jiffies;
3348
3349 expires = *nft_set_ext_expiration(ext);
3350 if (time_before(now, expires))
3351 expires -= now;
3352 else
3353 expires = 0;
3354
3355 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
b46f6ded
ND		 3356 cpu_to_be64(jiffies_to_msecs(expires)),
3357 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3358 goto nla_put_failure;
3359 }
3360
68e942e8
PM		 3361 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3362 struct nft_userdata *udata;
3363
3364 udata = nft_set_ext_userdata(ext);
3365 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3366 udata->len + 1, udata->data))
3367 goto nla_put_failure;
3368 }
3369
20a69341
PM		 3370 nla_nest_end(skb, nest);
3371 return 0;
3372
3373nla_put_failure:
3374 nlmsg_trim(skb, b);
3375 return -EMSGSIZE;
3376}
3377
3378struct nft_set_dump_args {
3379 const struct netlink_callback *cb;
3380 struct nft_set_iter iter;
3381 struct sk_buff *skb;
3382};
3383
3384static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3385 struct nft_set *set,
20a69341 3386 const struct nft_set_iter *iter,
de70185d 3387 struct nft_set_elem *elem)
20a69341
PM		 3388{
3389 struct nft_set_dump_args *args;
3390
3391 args = container_of(iter, struct nft_set_dump_args, iter);
3392 return nf_tables_fill_setelem(args->skb, set, elem);
3393}
3394
fa803605
LZ		 3395struct nft_set_dump_ctx {
3396 const struct nft_set *set;
3397 struct nft_ctx ctx;
3398};
3399
20a69341
PM		 3400static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3401{
fa803605 3402 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3403 struct net *net = sock_net(skb->sk);
fa803605
LZ		 3404 struct nft_af_info *afi;
3405 struct nft_table *table;
de70185d 3406 struct nft_set *set;
20a69341 3407 struct nft_set_dump_args args;
fa803605 3408 bool set_found = false;
20a69341
PM		 3409 struct nfgenmsg *nfmsg;
3410 struct nlmsghdr *nlh;
3411 struct nlattr *nest;
3412 u32 portid, seq;
fa803605 3413 int event;
20a69341 3414
fa803605
LZ		 3415 rcu_read_lock();
3416 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
3417 if (afi != dump_ctx->ctx.afi)
3418 continue;
20a69341 3419
fa803605
LZ		 3420 list_for_each_entry_rcu(table, &afi->tables, list) {
3421 if (table != dump_ctx->ctx.table)
3422 continue;
20a69341 3423
fa803605
LZ		 3424 list_for_each_entry_rcu(set, &table->sets, list) {
3425 if (set == dump_ctx->set) {
3426 set_found = true;
3427 break;
3428 }
3429 }
3430 break;
3431 }
3432 break;
3433 }
3434
3435 if (!set_found) {
3436 rcu_read_unlock();
3437 return -ENOENT;
3438 }
20a69341 3439
dedb67c4 3440 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3441 portid = NETLINK_CB(cb->skb).portid;
3442 seq = cb->nlh->nlmsg_seq;
3443
3444 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3445 NLM_F_MULTI);
3446 if (nlh == NULL)
3447 goto nla_put_failure;
3448
3449 nfmsg = nlmsg_data(nlh);
fa803605 3450 nfmsg->nfgen_family = afi->family;
20a69341 3451 nfmsg->version = NFNETLINK_V0;
fa803605 3452 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3453
fa803605 3454 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3455 goto nla_put_failure;
3456 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3457 goto nla_put_failure;
3458
3459 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3460 if (nest == NULL)
3461 goto nla_put_failure;
3462
8588ac09
PNA		 3463 args.cb = cb;
3464 args.skb = skb;
fa803605 3465 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3466 args.iter.skip = cb->args[0];
3467 args.iter.count = 0;
3468 args.iter.err = 0;
3469 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3470 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3471 rcu_read_unlock();
20a69341
PM		 3472
3473 nla_nest_end(skb, nest);
3474 nlmsg_end(skb, nlh);
3475
3476 if (args.iter.err && args.iter.err != -EMSGSIZE)
3477 return args.iter.err;
3478 if (args.iter.count == cb->args[0])
3479 return 0;
3480
3481 cb->args[0] = args.iter.count;
3482 return skb->len;
3483
3484nla_put_failure:
fa803605 3485 rcu_read_unlock();
20a69341
PM		 3486 return -ENOSPC;
3487}
3488
fa803605
LZ		 3489static int nf_tables_dump_set_done(struct netlink_callback *cb)
3490{
3491 kfree(cb->data);
3492 return 0;
3493}
3494
7b8002a1
PNA		 3495static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3496 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3497 const struct nlattr * const nla[],
3498 struct netlink_ext_ack *extack)
20a69341 3499{
f2a6d766 3500 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3501 const struct nft_set *set;
3502 struct nft_ctx ctx;
3503 int err;
3504
f2a6d766 3505 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 3506 if (err < 0)
3507 return err;
3508
37a9cc52
PNA		 3509 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
3510 genmask);
20a69341
PM		 3511 if (IS_ERR(set))
3512 return PTR_ERR(set);
3513
3514 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3515 struct netlink_dump_control c = {
3516 .dump = nf_tables_dump_set,
fa803605 3517 .done = nf_tables_dump_set_done,
20a69341 3518 };
fa803605
LZ		 3519 struct nft_set_dump_ctx *dump_ctx;
3520
3521 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3522 if (!dump_ctx)
3523 return -ENOMEM;
3524
3525 dump_ctx->set = set;
3526 dump_ctx->ctx = ctx;
3527
3528 c.data = dump_ctx;
20a69341
PM		 3529 return netlink_dump_start(nlsk, skb, nlh, &c);
3530 }
3531 return -EOPNOTSUPP;
3532}
3533
d60ce62f
AB		 3534static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3535 const struct nft_ctx *ctx, u32 seq,
3536 u32 portid, int event, u16 flags,
3537 const struct nft_set *set,
3538 const struct nft_set_elem *elem)
3539{
3540 struct nfgenmsg *nfmsg;
3541 struct nlmsghdr *nlh;
3542 struct nlattr *nest;
3543 int err;
3544
dedb67c4 3545 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 3546 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3547 flags);
3548 if (nlh == NULL)
3549 goto nla_put_failure;
3550
3551 nfmsg = nlmsg_data(nlh);
3552 nfmsg->nfgen_family = ctx->afi->family;
3553 nfmsg->version = NFNETLINK_V0;
84d7fce6 3554 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 3555
3556 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3557 goto nla_put_failure;
3558 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3559 goto nla_put_failure;
3560
3561 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3562 if (nest == NULL)
3563 goto nla_put_failure;
3564
3565 err = nf_tables_fill_setelem(skb, set, elem);
3566 if (err < 0)
3567 goto nla_put_failure;
3568
3569 nla_nest_end(skb, nest);
3570
053c095a
JB		 3571 nlmsg_end(skb, nlh);
3572 return 0;
d60ce62f
AB		 3573
3574nla_put_failure:
3575 nlmsg_trim(skb, nlh);
3576 return -1;
3577}
3578
25e94a99
PNA		 3579static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3580 const struct nft_set *set,
3581 const struct nft_set_elem *elem,
3582 int event, u16 flags)
d60ce62f 3583{
128ad332
PNA		 3584 struct net *net = ctx->net;
3585 u32 portid = ctx->portid;
d60ce62f
AB		 3586 struct sk_buff *skb;
3587 int err;
3588
128ad332 3589 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 3590 return;
d60ce62f 3591
d60ce62f
AB		 3592 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3593 if (skb == NULL)
3594 goto err;
3595
3596 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3597 set, elem);
3598 if (err < 0) {
3599 kfree_skb(skb);
3600 goto err;
3601 }
3602
25e94a99
PNA		 3603 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3604 GFP_KERNEL);
3605 return;
d60ce62f 3606err:
25e94a99 3607 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 3608}
3609
60319eb1
PNA		 3610static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3611 int msg_type,
3612 struct nft_set *set)
3613{
3614 struct nft_trans *trans;
3615
3616 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3617 if (trans == NULL)
3618 return NULL;
3619
3620 nft_trans_elem_set(trans) = set;
3621 return trans;
3622}
3623
22fe54d5
PM		 3624void *nft_set_elem_init(const struct nft_set *set,
3625 const struct nft_set_ext_tmpl *tmpl,
49499c3e 3626 const u32 *key, const u32 *data,
22fe54d5 3627 u64 timeout, gfp_t gfp)
fe2811eb
PM		 3628{
3629 struct nft_set_ext *ext;
3630 void *elem;
3631
3632 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3633 if (elem == NULL)
3634 return NULL;
3635
3636 ext = nft_set_elem_ext(set, elem);
3637 nft_set_ext_init(ext, tmpl);
3638
3639 memcpy(nft_set_ext_key(ext), key, set->klen);
3640 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3641 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 3642 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3643 *nft_set_ext_expiration(ext) =
d3e2a111 3644 jiffies + timeout;
c3e1b005
PM		 3645 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3646 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 3647
3648 return elem;
3649}
3650
61f9e292
LZ		 3651void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3652 bool destroy_expr)
61edafbb
PM		 3653{
3654 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3655
59105446 3656 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 3657 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 3658 nft_data_release(nft_set_ext_data(ext), set->dtype);
61f9e292 3659 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
f25ad2e9 3660 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
8aeff920
PNA		 3661 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3662 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 3663 kfree(elem);
3664}
3665EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3666
59105446
PNA		 3667/* Only called from commit path, nft_set_elem_deactivate() already deals with
3668 * the refcounting from the preparation phase.
3669 */
3670static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3671{
3672 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3673
3674 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3675 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3676 kfree(elem);
3677}
3678
0e9091d6
PNA		 3679static int nft_setelem_parse_flags(const struct nft_set *set,
3680 const struct nlattr *attr, u32 *flags)
3681{
3682 if (attr == NULL)
3683 return 0;
3684
3685 *flags = ntohl(nla_get_be32(attr));
3686 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3687 return -EINVAL;
3688 if (!(set->flags & NFT_SET_INTERVAL) &&
3689 *flags & NFT_SET_ELEM_INTERVAL_END)
3690 return -EINVAL;
3691
3692 return 0;
3693}
3694
60319eb1 3695static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 3696 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 3697{
3698 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 3699 u8 genmask = nft_genmask_next(ctx->net);
20a69341 3700 struct nft_data_desc d1, d2;
fe2811eb 3701 struct nft_set_ext_tmpl tmpl;
c016c7e4 3702 struct nft_set_ext *ext, *ext2;
20a69341
PM		 3703 struct nft_set_elem elem;
3704 struct nft_set_binding *binding;
8aeff920 3705 struct nft_object *obj = NULL;
68e942e8 3706 struct nft_userdata *udata;
fe2811eb 3707 struct nft_data data;
20a69341 3708 enum nft_registers dreg;
60319eb1 3709 struct nft_trans *trans;
0e9091d6 3710 u32 flags = 0;
c3e1b005 3711 u64 timeout;
68e942e8 3712 u8 ulen;
20a69341
PM		 3713 int err;
3714
3715 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 3716 nft_set_elem_policy, NULL);
20a69341
PM		 3717 if (err < 0)
3718 return err;
3719
3720 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3721 return -EINVAL;
3722
fe2811eb
PM		 3723 nft_set_ext_prepare(&tmpl);
3724
0e9091d6
PNA		 3725 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3726 if (err < 0)
3727 return err;
3728 if (flags != 0)
3729 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 3730
3731 if (set->flags & NFT_SET_MAP) {
3732 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 3733 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 3734 return -EINVAL;
bd7fc645 3735 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 3736 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 3737 return -EINVAL;
20a69341
PM		 3738 } else {
3739 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3740 return -EINVAL;
3741 }
3742
c3e1b005
PM		 3743 timeout = 0;
3744 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3745 if (!(set->flags & NFT_SET_TIMEOUT))
3746 return -EINVAL;
d3e2a111
AP		 3747 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3748 nla[NFTA_SET_ELEM_TIMEOUT])));
c3e1b005
PM		 3749 } else if (set->flags & NFT_SET_TIMEOUT) {
3750 timeout = set->timeout;
3751 }
3752
7d740264 3753 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 3754 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 3755 if (err < 0)
3756 goto err1;
3757 err = -EINVAL;
3758 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3759 goto err2;
3760
7d740264 3761 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 3762 if (timeout > 0) {
3763 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
3764 if (timeout != set->timeout)
3765 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
3766 }
fe2811eb 3767
8aeff920
PNA		 3768 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
3769 if (!(set->flags & NFT_SET_OBJECT)) {
3770 err = -EINVAL;
3771 goto err2;
3772 }
3773 obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
3774 set->objtype, genmask);
3775 if (IS_ERR(obj)) {
3776 err = PTR_ERR(obj);
3777 goto err2;
3778 }
3779 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
3780 }
3781
20a69341 3782 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 3783 err = nft_data_init(ctx, &data, sizeof(data), &d2,
3784 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 3785 if (err < 0)
3786 goto err2;
3787
3788 err = -EINVAL;
3789 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3790 goto err3;
3791
3792 dreg = nft_type_to_reg(set->dtype);
3793 list_for_each_entry(binding, &set->bindings, list) {
3794 struct nft_ctx bind_ctx = {
58c78e10 3795 .net = ctx->net,
20a69341
PM		 3796 .afi = ctx->afi,
3797 .table = ctx->table,
7c95f6d8 3798 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 3799 };
3800
11113e19
PM		 3801 if (!(binding->flags & NFT_SET_MAP))
3802 continue;
3803
1ec10212
PM		 3804 err = nft_validate_register_store(&bind_ctx, dreg,
3805 &data,
3806 d2.type, d2.len);
20a69341
PM		 3807 if (err < 0)
3808 goto err3;
3809 }
fe2811eb 3810
7d740264 3811 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 3812 }
3813
68e942e8
PM		 3814 /* The full maximum length of userdata can exceed the maximum
3815 * offset value (U8_MAX) for following extensions, therefor it
3816 * must be the last extension added.
3817 */
3818 ulen = 0;
3819 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
3820 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
3821 if (ulen > 0)
3822 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
3823 ulen);
3824 }
3825
fe2811eb 3826 err = -ENOMEM;
7d740264 3827 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 3828 timeout, GFP_KERNEL);
fe2811eb
PM		 3829 if (elem.priv == NULL)
3830 goto err3;
3831
3832 ext = nft_set_elem_ext(set, elem.priv);
3833 if (flags)
3834 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 3835 if (ulen > 0) {
3836 udata = nft_set_ext_userdata(ext);
3837 udata->len = ulen - 1;
3838 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
3839 }
8aeff920
PNA		 3840 if (obj) {
3841 *nft_set_ext_obj(ext) = obj;
3842 obj->use++;
3843 }
fe2811eb 3844
60319eb1
PNA		 3845 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
3846 if (trans == NULL)
fe2811eb 3847 goto err4;
60319eb1 3848
69086658 3849 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 3850 err = set->ops->insert(ctx->net, set, &elem, &ext2);
3851 if (err) {
3852 if (err == -EEXIST) {
9744a6fc
PNA		 3853 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
3854 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
3855 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
3856 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
3857 return -EBUSY;
8aeff920
PNA		 3858 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3859 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
3860 memcmp(nft_set_ext_data(ext),
3861 nft_set_ext_data(ext2), set->dlen) != 0) ||
3862 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3863 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
3864 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 3865 err = -EBUSY;
3866 else if (!(nlmsg_flags & NLM_F_EXCL))
3867 err = 0;
3868 }
fe2811eb 3869 goto err5;
c016c7e4 3870 }
20a69341 3871
35d0ac90
PNA		 3872 if (set->size &&
3873 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
3874 err = -ENFILE;
3875 goto err6;
3876 }
3877
60319eb1 3878 nft_trans_elem(trans) = elem;
46bbafce 3879 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 3880 return 0;
3881
35d0ac90 3882err6:
5cb82a38 3883 set->ops->remove(ctx->net, set, &elem);
fe2811eb 3884err5:
60319eb1 3885 kfree(trans);
fe2811eb
PM		 3886err4:
3887 kfree(elem.priv);
20a69341
PM		 3888err3:
3889 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 3890 nft_data_release(&data, d2.type);
20a69341 3891err2:
59105446 3892 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 3893err1:
3894 return err;
3895}
3896
633c9a84
PNA		 3897static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
3898 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3899 const struct nlattr * const nla[],
3900 struct netlink_ext_ack *extack)
20a69341 3901{
f2a6d766 3902 u8 genmask = nft_genmask_next(net);
20a69341
PM		 3903 const struct nlattr *attr;
3904 struct nft_set *set;
3905 struct nft_ctx ctx;
60319eb1 3906 int rem, err = 0;
20a69341 3907
7d5570ca
PNA		 3908 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
3909 return -EINVAL;
3910
f2a6d766 3911 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 3912 if (err < 0)
3913 return err;
3914
37a9cc52
PNA		 3915 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
3916 genmask);
958bee14
PNA		 3917 if (IS_ERR(set)) {
3918 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
3919 set = nf_tables_set_lookup_byid(net,
37a9cc52
PNA		 3920 nla[NFTA_SET_ELEM_LIST_SET_ID],
3921 genmask);
958bee14
PNA		 3922 }
3923 if (IS_ERR(set))
3924 return PTR_ERR(set);
3925 }
3926
20a69341
PM		 3927 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3928 return -EBUSY;
3929
3930 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 3931 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 3932 if (err < 0)
60319eb1 3933 break;
20a69341 3934 }
60319eb1 3935 return err;
20a69341
PM		 3936}
3937
59105446
PNA		 3938/**
3939 * nft_data_hold - hold a nft_data item
3940 *
3941 * @data: struct nft_data to release
3942 * @type: type of data
3943 *
3944 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
3945 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
3946 * NFT_GOTO verdicts. This function must be called on active data objects
3947 * from the second phase of the commit protocol.
3948 */
3949static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
3950{
3951 if (type == NFT_DATA_VERDICT) {
3952 switch (data->verdict.code) {
3953 case NFT_JUMP:
3954 case NFT_GOTO:
3955 data->verdict.chain->use++;
3956 break;
3957 }
3958 }
3959}
3960
3961static void nft_set_elem_activate(const struct net *net,
3962 const struct nft_set *set,
3963 struct nft_set_elem *elem)
3964{
3965 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3966
3967 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3968 nft_data_hold(nft_set_ext_data(ext), set->dtype);
3969 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3970 (*nft_set_ext_obj(ext))->use++;
3971}
3972
3973static void nft_set_elem_deactivate(const struct net *net,
3974 const struct nft_set *set,
3975 struct nft_set_elem *elem)
3976{
3977 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3978
3979 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3980 nft_data_release(nft_set_ext_data(ext), set->dtype);
3981 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3982 (*nft_set_ext_obj(ext))->use--;
3983}
3984
60319eb1 3985static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 3986 const struct nlattr *attr)
3987{
3988 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 3989 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 3990 struct nft_data_desc desc;
3991 struct nft_set_elem elem;
3971ca14 3992 struct nft_set_ext *ext;
60319eb1 3993 struct nft_trans *trans;
3971ca14
PNA		 3994 u32 flags = 0;
3995 void *priv;
20a69341
PM		 3996 int err;
3997
3998 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 3999 nft_set_elem_policy, NULL);
20a69341
PM		 4000 if (err < 0)
4001 goto err1;
4002
4003 err = -EINVAL;
4004 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4005 goto err1;
4006
3971ca14
PNA		 4007 nft_set_ext_prepare(&tmpl);
4008
4009 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4010 if (err < 0)
4011 return err;
4012 if (flags != 0)
4013 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4014
7d740264 4015 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4016 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4017 if (err < 0)
4018 goto err1;
4019
4020 err = -EINVAL;
4021 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4022 goto err2;
4023
3971ca14
PNA		 4024 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4025
4026 err = -ENOMEM;
4027 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4028 GFP_KERNEL);
4029 if (elem.priv == NULL)
4030 goto err2;
4031
4032 ext = nft_set_elem_ext(set, elem.priv);
4033 if (flags)
4034 *nft_set_ext_flags(ext) = flags;
4035
60319eb1 4036 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4037 if (trans == NULL) {
4038 err = -ENOMEM;
3971ca14 4039 goto err3;
609ccf08 4040 }
20a69341 4041
42a55769 4042 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4043 if (priv == NULL) {
cc02e457 4044 err = -ENOENT;
3971ca14 4045 goto err4;
cc02e457 4046 }
3971ca14
PNA		 4047 kfree(elem.priv);
4048 elem.priv = priv;
cc02e457 4049
59105446
PNA		 4050 nft_set_elem_deactivate(ctx->net, set, &elem);
4051
60319eb1 4052 nft_trans_elem(trans) = elem;
46bbafce 4053 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4054 return 0;
cc02e457 4055
3971ca14 4056err4:
cc02e457 4057 kfree(trans);
3971ca14
PNA		 4058err3:
4059 kfree(elem.priv);
20a69341 4060err2:
59105446 4061 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4062err1:
4063 return err;
4064}
4065
8411b644 4066static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4067 struct nft_set *set,
8411b644 4068 const struct nft_set_iter *iter,
de70185d 4069 struct nft_set_elem *elem)
8411b644
PNA		 4070{
4071 struct nft_trans *trans;
4072 int err;
4073
4074 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4075 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4076 if (!trans)
4077 return -ENOMEM;
4078
1ba1c414 4079 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4080 err = -ENOENT;
4081 goto err1;
4082 }
b2c11e4b 4083 set->ndeact++;
8411b644 4084
de70185d
PNA		 4085 nft_trans_elem_set(trans) = set;
4086 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4087 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4088
4089 return 0;
4090err1:
4091 kfree(trans);
4092 return err;
4093}
4094
633c9a84
PNA		 4095static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4096 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4097 const struct nlattr * const nla[],
4098 struct netlink_ext_ack *extack)
20a69341 4099{
f2a6d766 4100 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4101 const struct nlattr *attr;
4102 struct nft_set *set;
4103 struct nft_ctx ctx;
60319eb1 4104 int rem, err = 0;
20a69341 4105
f2a6d766 4106 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 4107 if (err < 0)
4108 return err;
4109
37a9cc52
PNA		 4110 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4111 genmask);
20a69341
PM		 4112 if (IS_ERR(set))
4113 return PTR_ERR(set);
4114 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4115 return -EBUSY;
4116
8411b644 4117 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4118 struct nft_set_iter iter = {
4119 .genmask = genmask,
4120 .fn = nft_flush_set,
8411b644 4121 };
baa2d42c 4122 set->ops->walk(&ctx, set, &iter);
8411b644 4123
baa2d42c 4124 return iter.err;
8411b644
PNA		 4125 }
4126
20a69341
PM		 4127 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4128 err = nft_del_setelem(&ctx, set, attr);
4129 if (err < 0)
60319eb1 4130 break;
4fefee57 4131
3dd0673a 4132 set->ndeact++;
20a69341 4133 }
60319eb1 4134 return err;
20a69341
PM		 4135}
4136
cfed7e1b
PM		 4137void nft_set_gc_batch_release(struct rcu_head *rcu)
4138{
4139 struct nft_set_gc_batch *gcb;
4140 unsigned int i;
4141
4142 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4143 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4144 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4145 kfree(gcb);
4146}
4147EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4148
4149struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4150 gfp_t gfp)
4151{
4152 struct nft_set_gc_batch *gcb;
4153
4154 gcb = kzalloc(sizeof(*gcb), gfp);
4155 if (gcb == NULL)
4156 return gcb;
4157 gcb->head.set = set;
4158 return gcb;
4159}
4160EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4161
e5009240
PNA		 4162/*
4163 * Stateful objects
4164 */
4165
4166/**
4167 * nft_register_obj- register nf_tables stateful object type
4168 * @obj: object type
4169 *
4170 * Registers the object type for use with nf_tables. Returns zero on
4171 * success or a negative errno code otherwise.
4172 */
4173int nft_register_obj(struct nft_object_type *obj_type)
4174{
4175 if (obj_type->type == NFT_OBJECT_UNSPEC)
4176 return -EINVAL;
4177
4178 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4179 list_add_rcu(&obj_type->list, &nf_tables_objects);
4180 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4181 return 0;
4182}
4183EXPORT_SYMBOL_GPL(nft_register_obj);
4184
4185/**
4186 * nft_unregister_obj - unregister nf_tables object type
4187 * @obj: object type
4188 *
4189 * Unregisters the object type for use with nf_tables.
4190 */
4191void nft_unregister_obj(struct nft_object_type *obj_type)
4192{
4193 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4194 list_del_rcu(&obj_type->list);
4195 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4196}
4197EXPORT_SYMBOL_GPL(nft_unregister_obj);
4198
4199struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
4200 const struct nlattr *nla,
4201 u32 objtype, u8 genmask)
4202{
4203 struct nft_object *obj;
4204
4205 list_for_each_entry(obj, &table->objects, list) {
4206 if (!nla_strcmp(nla, obj->name) &&
4207 objtype == obj->type->type &&
4208 nft_active_genmask(obj, genmask))
4209 return obj;
4210 }
4211 return ERR_PTR(-ENOENT);
4212}
4213EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
4214
4215static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4216 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4217 .len = NFT_TABLE_MAXNAMELEN - 1 },
4218 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4219 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4220 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4221 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4222};
4223
84fba055
FW		 4224static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4225 const struct nft_object_type *type,
e5009240
PNA		 4226 const struct nlattr *attr)
4227{
4228 struct nlattr *tb[type->maxattr + 1];
4229 struct nft_object *obj;
4230 int err;
4231
4232 if (attr) {
fceb6435
JB		 4233 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4234 NULL);
e5009240
PNA		 4235 if (err < 0)
4236 goto err1;
4237 } else {
4238 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4239 }
4240
4241 err = -ENOMEM;
4242 obj = kzalloc(sizeof(struct nft_object) + type->size, GFP_KERNEL);
4243 if (obj == NULL)
4244 goto err1;
4245
84fba055 4246 err = type->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240
PNA		 4247 if (err < 0)
4248 goto err2;
4249
4250 obj->type = type;
4251 return obj;
4252err2:
4253 kfree(obj);
4254err1:
4255 return ERR_PTR(err);
4256}
4257
4258static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4259 struct nft_object *obj, bool reset)
e5009240
PNA		 4260{
4261 struct nlattr *nest;
4262
4263 nest = nla_nest_start(skb, attr);
4264 if (!nest)
4265 goto nla_put_failure;
43da04a5 4266 if (obj->type->dump(skb, obj, reset) < 0)
e5009240
PNA		 4267 goto nla_put_failure;
4268 nla_nest_end(skb, nest);
4269 return 0;
4270
4271nla_put_failure:
4272 return -1;
4273}
4274
4275static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4276{
4277 const struct nft_object_type *type;
4278
4279 list_for_each_entry(type, &nf_tables_objects, list) {
4280 if (objtype == type->type)
4281 return type;
4282 }
4283 return NULL;
4284}
4285
4286static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4287{
4288 const struct nft_object_type *type;
4289
4290 type = __nft_obj_type_get(objtype);
4291 if (type != NULL && try_module_get(type->owner))
4292 return type;
4293
4294#ifdef CONFIG_MODULES
4295 if (type == NULL) {
4296 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4297 request_module("nft-obj-%u", objtype);
4298 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4299 if (__nft_obj_type_get(objtype))
4300 return ERR_PTR(-EAGAIN);
4301 }
4302#endif
4303 return ERR_PTR(-ENOENT);
4304}
4305
4306static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4307 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4308 const struct nlattr * const nla[],
4309 struct netlink_ext_ack *extack)
e5009240
PNA		 4310{
4311 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4312 const struct nft_object_type *type;
4313 u8 genmask = nft_genmask_next(net);
4314 int family = nfmsg->nfgen_family;
4315 struct nft_af_info *afi;
4316 struct nft_table *table;
4317 struct nft_object *obj;
4318 struct nft_ctx ctx;
4319 u32 objtype;
4320 int err;
4321
4322 if (!nla[NFTA_OBJ_TYPE] ||
4323 !nla[NFTA_OBJ_NAME] ||
4324 !nla[NFTA_OBJ_DATA])
4325 return -EINVAL;
4326
4327 afi = nf_tables_afinfo_lookup(net, family, true);
4328 if (IS_ERR(afi))
4329 return PTR_ERR(afi);
4330
4331 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4332 if (IS_ERR(table))
4333 return PTR_ERR(table);
4334
4335 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4336 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4337 if (IS_ERR(obj)) {
4338 err = PTR_ERR(obj);
4339 if (err != -ENOENT)
4340 return err;
4341
1a28ad74 4342 } else {
e5009240
PNA		 4343 if (nlh->nlmsg_flags & NLM_F_EXCL)
4344 return -EEXIST;
4345
4346 return 0;
4347 }
4348
4349 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4350
4351 type = nft_obj_type_get(objtype);
4352 if (IS_ERR(type))
4353 return PTR_ERR(type);
4354
84fba055 4355 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 4356 if (IS_ERR(obj)) {
4357 err = PTR_ERR(obj);
4358 goto err1;
4359 }
18965317 4360 obj->table = table;
e5009240
PNA		 4361 nla_strlcpy(obj->name, nla[NFTA_OBJ_NAME], NFT_OBJ_MAXNAMELEN);
4362
4363 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4364 if (err < 0)
4365 goto err2;
4366
4367 list_add_tail_rcu(&obj->list, &table->objects);
4368 table->use++;
4369 return 0;
4370err2:
4371 if (obj->type->destroy)
4372 obj->type->destroy(obj);
4373 kfree(obj);
4374err1:
4375 module_put(type->owner);
4376 return err;
4377}
4378
4379static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4380 u32 portid, u32 seq, int event, u32 flags,
4381 int family, const struct nft_table *table,
43da04a5 4382 struct nft_object *obj, bool reset)
e5009240
PNA		 4383{
4384 struct nfgenmsg *nfmsg;
4385 struct nlmsghdr *nlh;
4386
dedb67c4 4387 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 4388 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4389 if (nlh == NULL)
4390 goto nla_put_failure;
4391
4392 nfmsg = nlmsg_data(nlh);
4393 nfmsg->nfgen_family = family;
4394 nfmsg->version = NFNETLINK_V0;
4395 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4396
4397 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4398 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
4399 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->type->type)) ||
4400 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
43da04a5 4401 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset))
e5009240
PNA		 4402 goto nla_put_failure;
4403
4404 nlmsg_end(skb, nlh);
4405 return 0;
4406
4407nla_put_failure:
4408 nlmsg_trim(skb, nlh);
4409 return -1;
4410}
4411
a9fea2a3
PNA		 4412struct nft_obj_filter {
4413 char table[NFT_OBJ_MAXNAMELEN];
4414 u32 type;
4415};
4416
e5009240
PNA		 4417static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4418{
4419 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
4420 const struct nft_af_info *afi;
4421 const struct nft_table *table;
e5009240 4422 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 4423 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 4424 struct net *net = sock_net(skb->sk);
4425 int family = nfmsg->nfgen_family;
43da04a5
PNA		 4426 struct nft_object *obj;
4427 bool reset = false;
4428
4429 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4430 reset = true;
e5009240
PNA		 4431
4432 rcu_read_lock();
4433 cb->seq = net->nft.base_seq;
4434
4435 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
4436 if (family != NFPROTO_UNSPEC && family != afi->family)
4437 continue;
4438
4439 list_for_each_entry_rcu(table, &afi->tables, list) {
4440 list_for_each_entry_rcu(obj, &table->objects, list) {
4441 if (!nft_is_active(net, obj))
4442 goto cont;
4443 if (idx < s_idx)
4444 goto cont;
4445 if (idx > s_idx)
4446 memset(&cb->args[1], 0,
4447 sizeof(cb->args) - sizeof(cb->args[0]));
d21e540b 4448 if (filter && filter->table[0] &&
a9fea2a3
PNA		 4449 strcmp(filter->table, table->name))
4450 goto cont;
d21e540b
LZ		 4451 if (filter &&
4452 filter->type != NFT_OBJECT_UNSPEC &&
a9fea2a3
PNA		 4453 obj->type->type != filter->type)
4454 goto cont;
4455
e5009240
PNA		 4456 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4457 cb->nlh->nlmsg_seq,
4458 NFT_MSG_NEWOBJ,
4459 NLM_F_MULTI | NLM_F_APPEND,
43da04a5 4460 afi->family, table, obj, reset) < 0)
e5009240
PNA		 4461 goto done;
4462
4463 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4464cont:
4465 idx++;
4466 }
4467 }
4468 }
4469done:
4470 rcu_read_unlock();
4471
4472 cb->args[0] = idx;
4473 return skb->len;
4474}
4475
a9fea2a3
PNA		 4476static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4477{
4478 kfree(cb->data);
4479
4480 return 0;
4481}
4482
4483static struct nft_obj_filter *
4484nft_obj_filter_alloc(const struct nlattr * const nla[])
4485{
4486 struct nft_obj_filter *filter;
4487
4488 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4489 if (!filter)
4490 return ERR_PTR(-ENOMEM);
4491
4492 if (nla[NFTA_OBJ_TABLE])
4493 nla_strlcpy(filter->table, nla[NFTA_OBJ_TABLE],
4494 NFT_TABLE_MAXNAMELEN);
4495 if (nla[NFTA_OBJ_TYPE])
4496 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4497
4498 return filter;
4499}
4500
e5009240
PNA		 4501static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4502 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4503 const struct nlattr * const nla[],
4504 struct netlink_ext_ack *extack)
e5009240
PNA		 4505{
4506 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4507 u8 genmask = nft_genmask_cur(net);
4508 int family = nfmsg->nfgen_family;
4509 const struct nft_af_info *afi;
4510 const struct nft_table *table;
4511 struct nft_object *obj;
4512 struct sk_buff *skb2;
43da04a5 4513 bool reset = false;
e5009240
PNA		 4514 u32 objtype;
4515 int err;
4516
4517 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4518 struct netlink_dump_control c = {
4519 .dump = nf_tables_dump_obj,
a9fea2a3 4520 .done = nf_tables_dump_obj_done,
e5009240 4521 };
a9fea2a3
PNA		 4522
4523 if (nla[NFTA_OBJ_TABLE] ||
4524 nla[NFTA_OBJ_TYPE]) {
4525 struct nft_obj_filter *filter;
4526
4527 filter = nft_obj_filter_alloc(nla);
4528 if (IS_ERR(filter))
4529 return -ENOMEM;
4530
4531 c.data = filter;
4532 }
e5009240
PNA		 4533 return netlink_dump_start(nlsk, skb, nlh, &c);
4534 }
4535
4536 if (!nla[NFTA_OBJ_NAME] ||
4537 !nla[NFTA_OBJ_TYPE])
4538 return -EINVAL;
4539
4540 afi = nf_tables_afinfo_lookup(net, family, false);
4541 if (IS_ERR(afi))
4542 return PTR_ERR(afi);
4543
4544 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4545 if (IS_ERR(table))
4546 return PTR_ERR(table);
4547
4548 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4549 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4550 if (IS_ERR(obj))
4551 return PTR_ERR(obj);
4552
4553 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4554 if (!skb2)
4555 return -ENOMEM;
4556
43da04a5
PNA		 4557 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4558 reset = true;
4559
e5009240
PNA		 4560 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4561 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 4562 family, table, obj, reset);
e5009240
PNA		 4563 if (err < 0)
4564 goto err;
4565
4566 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4567err:
4568 kfree_skb(skb2);
4569 return err;
e5009240
PNA		 4570}
4571
4572static void nft_obj_destroy(struct nft_object *obj)
4573{
4574 if (obj->type->destroy)
4575 obj->type->destroy(obj);
4576
4577 module_put(obj->type->owner);
4578 kfree(obj);
4579}
4580
4581static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 4582 struct sk_buff *skb, const struct nlmsghdr *nlh,
4583 const struct nlattr * const nla[],
4584 struct netlink_ext_ack *extack)
e5009240
PNA		 4585{
4586 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4587 u8 genmask = nft_genmask_next(net);
4588 int family = nfmsg->nfgen_family;
4589 struct nft_af_info *afi;
4590 struct nft_table *table;
4591 struct nft_object *obj;
4592 struct nft_ctx ctx;
4593 u32 objtype;
4594
4595 if (!nla[NFTA_OBJ_TYPE] ||
4596 !nla[NFTA_OBJ_NAME])
4597 return -EINVAL;
4598
4599 afi = nf_tables_afinfo_lookup(net, family, true);
4600 if (IS_ERR(afi))
4601 return PTR_ERR(afi);
4602
4603 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4604 if (IS_ERR(table))
4605 return PTR_ERR(table);
4606
4607 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4608 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4609 if (IS_ERR(obj))
4610 return PTR_ERR(obj);
4611 if (obj->use > 0)
4612 return -EBUSY;
4613
4614 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4615
4616 return nft_delobj(&ctx, obj);
4617}
4618
25e94a99
PNA		 4619void nft_obj_notify(struct net *net, struct nft_table *table,
4620 struct nft_object *obj, u32 portid, u32 seq, int event,
4621 int family, int report, gfp_t gfp)
e5009240
PNA		 4622{
4623 struct sk_buff *skb;
4624 int err;
4625
2599e989
PNA		 4626 if (!report &&
4627 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4628 return;
e5009240 4629
2599e989 4630 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 4631 if (skb == NULL)
4632 goto err;
4633
2599e989
PNA		 4634 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4635 table, obj, false);
e5009240
PNA		 4636 if (err < 0) {
4637 kfree_skb(skb);
4638 goto err;
4639 }
4640
25e94a99
PNA		 4641 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4642 return;
e5009240 4643err:
25e94a99 4644 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 4645}
2599e989
PNA		 4646EXPORT_SYMBOL_GPL(nft_obj_notify);
4647
25e94a99
PNA		 4648static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4649 struct nft_object *obj, int event)
2599e989 4650{
25e94a99
PNA		 4651 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
4652 ctx->afi->family, ctx->report, GFP_KERNEL);
2599e989 4653}
e5009240 4654
84d7fce6
PNA		 4655static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
4656 u32 portid, u32 seq)
4657{
4658 struct nlmsghdr *nlh;
4659 struct nfgenmsg *nfmsg;
dedb67c4 4660 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 4661
4662 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
4663 if (nlh == NULL)
4664 goto nla_put_failure;
4665
4666 nfmsg = nlmsg_data(nlh);
4667 nfmsg->nfgen_family = AF_UNSPEC;
4668 nfmsg->version = NFNETLINK_V0;
4669 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4670
4671 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)))
4672 goto nla_put_failure;
4673
053c095a
JB		 4674 nlmsg_end(skb, nlh);
4675 return 0;
84d7fce6
PNA		 4676
4677nla_put_failure:
4678 nlmsg_trim(skb, nlh);
4679 return -EMSGSIZE;
4680}
4681
25e94a99
PNA		 4682static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
4683 int event)
84d7fce6
PNA		 4684{
4685 struct nlmsghdr *nlh = nlmsg_hdr(skb);
4686 struct sk_buff *skb2;
4687 int err;
4688
4689 if (nlmsg_report(nlh) &&
4690 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4691 return;
84d7fce6 4692
84d7fce6
PNA		 4693 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4694 if (skb2 == NULL)
4695 goto err;
4696
4697 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
4698 nlh->nlmsg_seq);
4699 if (err < 0) {
4700 kfree_skb(skb2);
4701 goto err;
4702 }
4703
25e94a99
PNA		 4704 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
4705 nlmsg_report(nlh), GFP_KERNEL);
4706 return;
84d7fce6 4707err:
25e94a99
PNA		 4708 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
4709 -ENOBUFS);
84d7fce6
PNA		 4710}
4711
7b8002a1
PNA		 4712static int nf_tables_getgen(struct net *net, struct sock *nlsk,
4713 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4714 const struct nlattr * const nla[],
4715 struct netlink_ext_ack *extack)
84d7fce6 4716{
84d7fce6
PNA		 4717 struct sk_buff *skb2;
4718 int err;
4719
4720 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4721 if (skb2 == NULL)
4722 return -ENOMEM;
4723
4724 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
4725 nlh->nlmsg_seq);
4726 if (err < 0)
4727 goto err;
4728
4729 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4730err:
4731 kfree_skb(skb2);
4732 return err;
4733}
4734
96518518
PM		 4735static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
4736 [NFT_MSG_NEWTABLE] = {
55dd6f93 4737 .call_batch = nf_tables_newtable,
96518518
PM		 4738 .attr_count = NFTA_TABLE_MAX,
4739 .policy = nft_table_policy,
4740 },
4741 [NFT_MSG_GETTABLE] = {
4742 .call = nf_tables_gettable,
4743 .attr_count = NFTA_TABLE_MAX,
4744 .policy = nft_table_policy,
4745 },
4746 [NFT_MSG_DELTABLE] = {
55dd6f93 4747 .call_batch = nf_tables_deltable,
96518518
PM		 4748 .attr_count = NFTA_TABLE_MAX,
4749 .policy = nft_table_policy,
4750 },
4751 [NFT_MSG_NEWCHAIN] = {
91c7b38d 4752 .call_batch = nf_tables_newchain,
96518518
PM		 4753 .attr_count = NFTA_CHAIN_MAX,
4754 .policy = nft_chain_policy,
4755 },
4756 [NFT_MSG_GETCHAIN] = {
4757 .call = nf_tables_getchain,
4758 .attr_count = NFTA_CHAIN_MAX,
4759 .policy = nft_chain_policy,
4760 },
4761 [NFT_MSG_DELCHAIN] = {
91c7b38d 4762 .call_batch = nf_tables_delchain,
96518518
PM		 4763 .attr_count = NFTA_CHAIN_MAX,
4764 .policy = nft_chain_policy,
4765 },
4766 [NFT_MSG_NEWRULE] = {
0628b123 4767 .call_batch = nf_tables_newrule,
96518518
PM		 4768 .attr_count = NFTA_RULE_MAX,
4769 .policy = nft_rule_policy,
4770 },
4771 [NFT_MSG_GETRULE] = {
4772 .call = nf_tables_getrule,
4773 .attr_count = NFTA_RULE_MAX,
4774 .policy = nft_rule_policy,
4775 },
4776 [NFT_MSG_DELRULE] = {
0628b123 4777 .call_batch = nf_tables_delrule,
96518518
PM		 4778 .attr_count = NFTA_RULE_MAX,
4779 .policy = nft_rule_policy,
4780 },
20a69341 4781 [NFT_MSG_NEWSET] = {
958bee14 4782 .call_batch = nf_tables_newset,
20a69341
PM		 4783 .attr_count = NFTA_SET_MAX,
4784 .policy = nft_set_policy,
4785 },
4786 [NFT_MSG_GETSET] = {
4787 .call = nf_tables_getset,
4788 .attr_count = NFTA_SET_MAX,
4789 .policy = nft_set_policy,
4790 },
4791 [NFT_MSG_DELSET] = {
958bee14 4792 .call_batch = nf_tables_delset,
20a69341
PM		 4793 .attr_count = NFTA_SET_MAX,
4794 .policy = nft_set_policy,
4795 },
4796 [NFT_MSG_NEWSETELEM] = {
958bee14 4797 .call_batch = nf_tables_newsetelem,
20a69341
PM		 4798 .attr_count = NFTA_SET_ELEM_LIST_MAX,
4799 .policy = nft_set_elem_list_policy,
4800 },
4801 [NFT_MSG_GETSETELEM] = {
4802 .call = nf_tables_getsetelem,
4803 .attr_count = NFTA_SET_ELEM_LIST_MAX,
4804 .policy = nft_set_elem_list_policy,
4805 },
4806 [NFT_MSG_DELSETELEM] = {
958bee14 4807 .call_batch = nf_tables_delsetelem,
20a69341
PM		 4808 .attr_count = NFTA_SET_ELEM_LIST_MAX,
4809 .policy = nft_set_elem_list_policy,
4810 },
84d7fce6
PNA		 4811 [NFT_MSG_GETGEN] = {
4812 .call = nf_tables_getgen,
4813 },
e5009240
PNA		 4814 [NFT_MSG_NEWOBJ] = {
4815 .call_batch = nf_tables_newobj,
4816 .attr_count = NFTA_OBJ_MAX,
4817 .policy = nft_obj_policy,
4818 },
4819 [NFT_MSG_GETOBJ] = {
4820 .call = nf_tables_getobj,
4821 .attr_count = NFTA_OBJ_MAX,
4822 .policy = nft_obj_policy,
4823 },
4824 [NFT_MSG_DELOBJ] = {
4825 .call_batch = nf_tables_delobj,
4826 .attr_count = NFTA_OBJ_MAX,
4827 .policy = nft_obj_policy,
4828 },
43da04a5
PNA		 4829 [NFT_MSG_GETOBJ_RESET] = {
4830 .call = nf_tables_getobj,
4831 .attr_count = NFTA_OBJ_MAX,
4832 .policy = nft_obj_policy,
4833 },
96518518
PM		 4834};
4835
91c7b38d
PNA		 4836static void nft_chain_commit_update(struct nft_trans *trans)
4837{
4838 struct nft_base_chain *basechain;
4839
4840 if (nft_trans_chain_name(trans)[0])
4841 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
4842
f323d954 4843 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 4844 return;
4845
4846 basechain = nft_base_chain(trans->ctx.chain);
4847 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
4848
4849 switch (nft_trans_chain_policy(trans)) {
4850 case NF_DROP:
4851 case NF_ACCEPT:
4852 basechain->policy = nft_trans_chain_policy(trans);
4853 break;
4854 }
4855}
4856
b326dd37 4857static void nf_tables_commit_release(struct nft_trans *trans)
c7c32e72 4858{
c7c32e72
PNA		 4859 switch (trans->msg_type) {
4860 case NFT_MSG_DELTABLE:
4861 nf_tables_table_destroy(&trans->ctx);
4862 break;
4863 case NFT_MSG_DELCHAIN:
4864 nf_tables_chain_destroy(trans->ctx.chain);
4865 break;
4866 case NFT_MSG_DELRULE:
4867 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
4868 break;
4869 case NFT_MSG_DELSET:
4870 nft_set_destroy(nft_trans_set(trans));
4871 break;
61edafbb 4872 case NFT_MSG_DELSETELEM:
59105446
PNA		 4873 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
4874 nft_trans_elem(trans).priv);
61edafbb 4875 break;
e5009240
PNA		 4876 case NFT_MSG_DELOBJ:
4877 nft_obj_destroy(nft_trans_obj(trans));
4878 break;
c7c32e72
PNA		 4879 }
4880 kfree(trans);
4881}
4882
5913beaf 4883static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 4884{
37082f93 4885 struct nft_trans *trans, *next;
a3716e70 4886 struct nft_trans_elem *te;
37082f93
PNA		 4887
4888 /* Bump generation counter, invalidate any dump in progress */
38e029f1 4889 while (++net->nft.base_seq == 0);
37082f93
PNA		 4890
4891 /* A new generation has just started */
ea4bd995 4892 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 4893
4894 /* Make sure all packets have left the previous generation before
4895 * purging old rules.
4896 */
4897 synchronize_rcu();
4898
4899 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 4900 switch (trans->msg_type) {
55dd6f93
PNA		 4901 case NFT_MSG_NEWTABLE:
4902 if (nft_trans_table_update(trans)) {
4903 if (!nft_trans_table_enable(trans)) {
664b0f8c
PNA		 4904 nf_tables_table_disable(net,
4905 trans->ctx.afi,
55dd6f93
PNA		 4906 trans->ctx.table);
4907 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
4908 }
4909 } else {
f2a6d766 4910 nft_clear(net, trans->ctx.table);
55dd6f93 4911 }
35151d84 4912 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 4913 nft_trans_destroy(trans);
4914 break;
4915 case NFT_MSG_DELTABLE:
f2a6d766 4916 list_del_rcu(&trans->ctx.table->list);
35151d84 4917 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 4918 break;
91c7b38d
PNA		 4919 case NFT_MSG_NEWCHAIN:
4920 if (nft_trans_chain_update(trans))
4921 nft_chain_commit_update(trans);
4fefee57 4922 else
664b0f8c 4923 nft_clear(net, trans->ctx.chain);
4fefee57 4924
35151d84 4925 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
91c7b38d
PNA		 4926 nft_trans_destroy(trans);
4927 break;
4928 case NFT_MSG_DELCHAIN:
664b0f8c 4929 list_del_rcu(&trans->ctx.chain->list);
35151d84 4930 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
82bec71d
PNA		 4931 nf_tables_unregister_hooks(trans->ctx.net,
4932 trans->ctx.table,
c5598794
AB		 4933 trans->ctx.chain,
4934 trans->ctx.afi->nops);
91c7b38d 4935 break;
b380e5c7 4936 case NFT_MSG_NEWRULE:
889f7ee7 4937 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 4938 nf_tables_rule_notify(&trans->ctx,
37082f93 4939 nft_trans_rule(trans),
35151d84 4940 NFT_MSG_NEWRULE);
37082f93 4941 nft_trans_destroy(trans);
b380e5c7
PNA		 4942 break;
4943 case NFT_MSG_DELRULE:
4944 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 4945 nf_tables_rule_notify(&trans->ctx,
4946 nft_trans_rule(trans),
4947 NFT_MSG_DELRULE);
b380e5c7 4948 break;
958bee14 4949 case NFT_MSG_NEWSET:
37a9cc52 4950 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 4951 /* This avoids hitting -EBUSY when deleting the table
4952 * from the transaction.
4953 */
4954 if (nft_trans_set(trans)->flags & NFT_SET_ANONYMOUS &&
4955 !list_empty(&nft_trans_set(trans)->bindings))
4956 trans->ctx.table->use--;
4957
958bee14 4958 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 4959 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 4960 nft_trans_destroy(trans);
4961 break;
4962 case NFT_MSG_DELSET:
37a9cc52 4963 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 4964 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 4965 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 4966 break;
60319eb1 4967 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 4968 te = (struct nft_trans_elem *)trans->data;
4969
42a55769 4970 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 4971 nf_tables_setelem_notify(&trans->ctx, te->set,
4972 &te->elem,
60319eb1
PNA		 4973 NFT_MSG_NEWSETELEM, 0);
4974 nft_trans_destroy(trans);
4975 break;
4976 case NFT_MSG_DELSETELEM:
a3716e70 4977 te = (struct nft_trans_elem *)trans->data;
fe2811eb 4978
a3716e70
PNA		 4979 nf_tables_setelem_notify(&trans->ctx, te->set,
4980 &te->elem,
60319eb1 4981 NFT_MSG_DELSETELEM, 0);
5cb82a38 4982 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 4983 atomic_dec(&te->set->nelems);
4984 te->set->ndeact--;
60319eb1 4985 break;
e5009240
PNA		 4986 case NFT_MSG_NEWOBJ:
4987 nft_clear(net, nft_trans_obj(trans));
4988 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
4989 NFT_MSG_NEWOBJ);
4990 nft_trans_destroy(trans);
4991 break;
4992 case NFT_MSG_DELOBJ:
4993 list_del_rcu(&nft_trans_obj(trans)->list);
4994 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
4995 NFT_MSG_DELOBJ);
4996 break;
37082f93 4997 }
37082f93
PNA		 4998 }
4999
b326dd37
PNA		 5000 synchronize_rcu();
5001
37082f93 5002 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
c7c32e72 5003 list_del(&trans->list);
b326dd37 5004 nf_tables_commit_release(trans);
37082f93 5005 }
84d7fce6
PNA		 5006
5007 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
37082f93
PNA		 5008
5009 return 0;
5010}
5011
b326dd37 5012static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 5013{
c7c32e72
PNA		 5014 switch (trans->msg_type) {
5015 case NFT_MSG_NEWTABLE:
5016 nf_tables_table_destroy(&trans->ctx);
5017 break;
5018 case NFT_MSG_NEWCHAIN:
5019 nf_tables_chain_destroy(trans->ctx.chain);
5020 break;
5021 case NFT_MSG_NEWRULE:
5022 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5023 break;
5024 case NFT_MSG_NEWSET:
5025 nft_set_destroy(nft_trans_set(trans));
5026 break;
61edafbb
PM		 5027 case NFT_MSG_NEWSETELEM:
5028 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 5029 nft_trans_elem(trans).priv, true);
61edafbb 5030 break;
e5009240
PNA		 5031 case NFT_MSG_NEWOBJ:
5032 nft_obj_destroy(nft_trans_obj(trans));
5033 break;
c7c32e72
PNA		 5034 }
5035 kfree(trans);
5036}
5037
5913beaf 5038static int nf_tables_abort(struct net *net, struct sk_buff *skb)
37082f93 5039{
37082f93 5040 struct nft_trans *trans, *next;
02263db0 5041 struct nft_trans_elem *te;
37082f93 5042
a907e36d
XL		 5043 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
5044 list) {
b380e5c7 5045 switch (trans->msg_type) {
55dd6f93
PNA		 5046 case NFT_MSG_NEWTABLE:
5047 if (nft_trans_table_update(trans)) {
5048 if (nft_trans_table_enable(trans)) {
664b0f8c
PNA		 5049 nf_tables_table_disable(net,
5050 trans->ctx.afi,
55dd6f93
PNA		 5051 trans->ctx.table);
5052 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5053 }
5054 nft_trans_destroy(trans);
5055 } else {
e688a7f8 5056 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 5057 }
5058 break;
5059 case NFT_MSG_DELTABLE:
f2a6d766 5060 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 5061 nft_trans_destroy(trans);
5062 break;
91c7b38d
PNA		 5063 case NFT_MSG_NEWCHAIN:
5064 if (nft_trans_chain_update(trans)) {
982f4051 5065 free_percpu(nft_trans_chain_stats(trans));
91c7b38d
PNA		 5066
5067 nft_trans_destroy(trans);
5068 } else {
4fefee57 5069 trans->ctx.table->use--;
e688a7f8 5070 list_del_rcu(&trans->ctx.chain->list);
82bec71d
PNA		 5071 nf_tables_unregister_hooks(trans->ctx.net,
5072 trans->ctx.table,
c5598794
AB		 5073 trans->ctx.chain,
5074 trans->ctx.afi->nops);
91c7b38d
PNA		 5075 }
5076 break;
5077 case NFT_MSG_DELCHAIN:
4fefee57 5078 trans->ctx.table->use++;
664b0f8c 5079 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 5080 nft_trans_destroy(trans);
5081 break;
b380e5c7 5082 case NFT_MSG_NEWRULE:
4fefee57 5083 trans->ctx.chain->use--;
b380e5c7
PNA		 5084 list_del_rcu(&nft_trans_rule(trans)->list);
5085 break;
5086 case NFT_MSG_DELRULE:
4fefee57 5087 trans->ctx.chain->use++;
889f7ee7 5088 nft_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 5089 nft_trans_destroy(trans);
b380e5c7 5090 break;
958bee14 5091 case NFT_MSG_NEWSET:
4fefee57 5092 trans->ctx.table->use--;
e688a7f8 5093 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 5094 break;
5095 case NFT_MSG_DELSET:
4fefee57 5096 trans->ctx.table->use++;
37a9cc52 5097 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 5098 nft_trans_destroy(trans);
5099 break;
60319eb1 5100 case NFT_MSG_NEWSETELEM:
02263db0 5101 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5102
5cb82a38 5103 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 5104 atomic_dec(&te->set->nelems);
60319eb1
PNA		 5105 break;
5106 case NFT_MSG_DELSETELEM:
cc02e457
PM		 5107 te = (struct nft_trans_elem *)trans->data;
5108
59105446 5109 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 5110 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 5111 te->set->ndeact--;
cc02e457 5112
e5009240
PNA		 5113 nft_trans_destroy(trans);
5114 break;
5115 case NFT_MSG_NEWOBJ:
5116 trans->ctx.table->use--;
5117 list_del_rcu(&nft_trans_obj(trans)->list);
5118 break;
5119 case NFT_MSG_DELOBJ:
5120 trans->ctx.table->use++;
5121 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 5122 nft_trans_destroy(trans);
5123 break;
37082f93 5124 }
37082f93
PNA		 5125 }
5126
b326dd37
PNA		 5127 synchronize_rcu();
5128
a1cee076
PNA		 5129 list_for_each_entry_safe_reverse(trans, next,
5130 &net->nft.commit_list, list) {
c7c32e72 5131 list_del(&trans->list);
b326dd37 5132 nf_tables_abort_release(trans);
37082f93
PNA		 5133 }
5134
5135 return 0;
5136}
5137
74e8bcd2
PNA		 5138static bool nf_tables_valid_genid(struct net *net, u32 genid)
5139{
5140 return net->nft.base_seq == genid;
5141}
5142
96518518
PM		 5143static const struct nfnetlink_subsystem nf_tables_subsys = {
5144 .name = "nf_tables",
5145 .subsys_id = NFNL_SUBSYS_NFTABLES,
5146 .cb_count = NFT_MSG_MAX,
5147 .cb = nf_tables_cb,
0628b123
PNA		 5148 .commit = nf_tables_commit,
5149 .abort = nf_tables_abort,
74e8bcd2 5150 .valid_genid = nf_tables_valid_genid,
96518518
PM		 5151};
5152
7210e4e3
PNA		 5153int nft_chain_validate_dependency(const struct nft_chain *chain,
5154 enum nft_chain_type type)
5155{
5156 const struct nft_base_chain *basechain;
5157
f323d954 5158 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 5159 basechain = nft_base_chain(chain);
5160 if (basechain->type->type != type)
5161 return -EOPNOTSUPP;
5162 }
5163 return 0;
5164}
5165EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
5166
75e8d06d
PNA		 5167int nft_chain_validate_hooks(const struct nft_chain *chain,
5168 unsigned int hook_flags)
5169{
5170 struct nft_base_chain *basechain;
5171
f323d954 5172 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 5173 basechain = nft_base_chain(chain);
5174
5175 if ((1 << basechain->ops[0].hooknum) & hook_flags)
5176 return 0;
5177
5178 return -EOPNOTSUPP;
5179 }
5180
5181 return 0;
5182}
5183EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
5184
20a69341
PM		 5185/*
5186 * Loop detection - walk through the ruleset beginning at the destination chain
5187 * of a new jump until either the source chain is reached (loop) or all
5188 * reachable chains have been traversed.
5189 *
5190 * The loop check is performed whenever a new jump verdict is added to an
5191 * expression or verdict map or a verdict map is bound to a new chain.
5192 */
5193
5194static int nf_tables_check_loops(const struct nft_ctx *ctx,
5195 const struct nft_chain *chain);
5196
5197static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 5198 struct nft_set *set,
20a69341 5199 const struct nft_set_iter *iter,
de70185d 5200 struct nft_set_elem *elem)
20a69341 5201{
fe2811eb
PM		 5202 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5203 const struct nft_data *data;
5204
5205 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
5206 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 5207 return 0;
5208
fe2811eb 5209 data = nft_set_ext_data(ext);
1ca2e170 5210 switch (data->verdict.code) {
20a69341
PM		 5211 case NFT_JUMP:
5212 case NFT_GOTO:
1ca2e170 5213 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 5214 default:
5215 return 0;
5216 }
5217}
5218
5219static int nf_tables_check_loops(const struct nft_ctx *ctx,
5220 const struct nft_chain *chain)
5221{
5222 const struct nft_rule *rule;
5223 const struct nft_expr *expr, *last;
de70185d 5224 struct nft_set *set;
20a69341
PM		 5225 struct nft_set_binding *binding;
5226 struct nft_set_iter iter;
20a69341
PM		 5227
5228 if (ctx->chain == chain)
5229 return -ELOOP;
5230
5231 list_for_each_entry(rule, &chain->rules, list) {
5232 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 5233 const struct nft_data *data = NULL;
5234 int err;
5235
5236 if (!expr->ops->validate)
20a69341
PM		 5237 continue;
5238
0ca743a5
PNA		 5239 err = expr->ops->validate(ctx, expr, &data);
5240 if (err < 0)
5241 return err;
5242
20a69341 5243 if (data == NULL)
0ca743a5 5244 continue;
20a69341 5245
1ca2e170 5246 switch (data->verdict.code) {
20a69341
PM		 5247 case NFT_JUMP:
5248 case NFT_GOTO:
1ca2e170
PM		 5249 err = nf_tables_check_loops(ctx,
5250 data->verdict.chain);
20a69341
PM		 5251 if (err < 0)
5252 return err;
5253 default:
5254 break;
5255 }
5256 }
5257 }
5258
5259 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 5260 if (!nft_is_active_next(ctx->net, set))
5261 continue;
20a69341
PM		 5262 if (!(set->flags & NFT_SET_MAP) ||
5263 set->dtype != NFT_DATA_VERDICT)
5264 continue;
5265
5266 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 5267 if (!(binding->flags & NFT_SET_MAP) ||
5268 binding->chain != chain)
20a69341
PM		 5269 continue;
5270
8588ac09 5271 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 5272 iter.skip = 0;
5273 iter.count = 0;
5274 iter.err = 0;
5275 iter.fn = nf_tables_loop_check_setelem;
5276
5277 set->ops->walk(ctx, set, &iter);
5278 if (iter.err < 0)
5279 return iter.err;
5280 }
5281 }
5282
5283 return 0;
5284}
5285
36b701fa
LGL		 5286/**
5287 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
5288 *
5289 * @attr: netlink attribute to fetch value from
5290 * @max: maximum value to be stored in dest
5291 * @dest: pointer to the variable
5292 *
5293 * Parse, check and store a given u32 netlink attribute into variable.
5294 * This function returns -ERANGE if the value goes over maximum value.
5295 * Otherwise a 0 is returned and the attribute value is stored in the
5296 * destination variable.
5297 */
f1d505bb 5298int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 5299{
09525a09 5300 u32 val;
36b701fa
LGL		 5301
5302 val = ntohl(nla_get_be32(attr));
5303 if (val > max)
5304 return -ERANGE;
5305
5306 *dest = val;
5307 return 0;
5308}
5309EXPORT_SYMBOL_GPL(nft_parse_u32_check);
5310
49499c3e
PM		 5311/**
5312 * nft_parse_register - parse a register value from a netlink attribute
5313 *
5314 * @attr: netlink attribute
5315 *
5316 * Parse and translate a register value from a netlink attribute.
5317 * Registers used to be 128 bit wide, these register numbers will be
5318 * mapped to the corresponding 32 bit register numbers.
5319 */
b1c96ed3
PM		 5320unsigned int nft_parse_register(const struct nlattr *attr)
5321{
49499c3e
PM		 5322 unsigned int reg;
5323
5324 reg = ntohl(nla_get_be32(attr));
5325 switch (reg) {
5326 case NFT_REG_VERDICT...NFT_REG_4:
5327 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
5328 default:
5329 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
5330 }
b1c96ed3
PM		 5331}
5332EXPORT_SYMBOL_GPL(nft_parse_register);
5333
49499c3e
PM		 5334/**
5335 * nft_dump_register - dump a register value to a netlink attribute
5336 *
5337 * @skb: socket buffer
5338 * @attr: attribute number
5339 * @reg: register number
5340 *
5341 * Construct a netlink attribute containing the register number. For
5342 * compatibility reasons, register numbers being a multiple of 4 are
5343 * translated to the corresponding 128 bit register numbers.
5344 */
b1c96ed3
PM		 5345int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
5346{
49499c3e
PM		 5347 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
5348 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
5349 else
5350 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
5351
b1c96ed3
PM		 5352 return nla_put_be32(skb, attr, htonl(reg));
5353}
5354EXPORT_SYMBOL_GPL(nft_dump_register);
5355
96518518 5356/**
d07db988 5357 * nft_validate_register_load - validate a load from a register
96518518
PM		 5358 *
5359 * @reg: the register number
d07db988 5360 * @len: the length of the data
96518518
PM		 5361 *
5362 * Validate that the input register is one of the general purpose
d07db988 5363 * registers and that the length of the load is within the bounds.
96518518 5364 */
d07db988 5365int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 5366{
49499c3e 5367 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 5368 return -EINVAL;
d07db988
PM		 5369 if (len == 0)
5370 return -EINVAL;
49499c3e 5371 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 5372 return -ERANGE;
49499c3e 5373
96518518
PM		 5374 return 0;
5375}
d07db988 5376EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 5377
96518518 5378/**
1ec10212 5379 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 5380 *
5381 * @ctx: context of the expression performing the load
5382 * @reg: the destination register number
5383 * @data: the data to load
5384 * @type: the data type
45d9bcda 5385 * @len: the length of the data
96518518
PM		 5386 *
5387 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 5388 * the destination register and the length is within the bounds.
5389 * A value of NULL for the data means that its runtime gathered
58f40ab6 5390 * data.
96518518 5391 */
1ec10212
PM		 5392int nft_validate_register_store(const struct nft_ctx *ctx,
5393 enum nft_registers reg,
5394 const struct nft_data *data,
5395 enum nft_data_types type, unsigned int len)
96518518 5396{
20a69341
PM		 5397 int err;
5398
96518518
PM		 5399 switch (reg) {
5400 case NFT_REG_VERDICT:
58f40ab6 5401 if (type != NFT_DATA_VERDICT)
96518518 5402 return -EINVAL;
20a69341 5403
58f40ab6 5404 if (data != NULL &&
1ca2e170
PM		 5405 (data->verdict.code == NFT_GOTO ||
5406 data->verdict.code == NFT_JUMP)) {
5407 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 5408 if (err < 0)
5409 return err;
5410
1ca2e170
PM		 5411 if (ctx->chain->level + 1 >
5412 data->verdict.chain->level) {
20a69341
PM		 5413 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
5414 return -EMLINK;
1ca2e170 5415 data->verdict.chain->level = ctx->chain->level + 1;
20a69341
PM		 5416 }
5417 }
5418
96518518
PM		 5419 return 0;
5420 default:
49499c3e 5421 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 5422 return -EINVAL;
45d9bcda
PM		 5423 if (len == 0)
5424 return -EINVAL;
49499c3e
PM		 5425 if (reg * NFT_REG32_SIZE + len >
5426 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 5427 return -ERANGE;
27e6d201 5428
96518518
PM		 5429 if (data != NULL && type != NFT_DATA_VALUE)
5430 return -EINVAL;
5431 return 0;
5432 }
5433}
1ec10212 5434EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 5435
5436static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
5437 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
5438 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
5439 .len = NFT_CHAIN_MAXNAMELEN - 1 },
5440};
5441
5442static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
5443 struct nft_data_desc *desc, const struct nlattr *nla)
5444{
664b0f8c 5445 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 5446 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
5447 struct nft_chain *chain;
5448 int err;
5449
fceb6435
JB		 5450 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
5451 NULL);
96518518
PM		 5452 if (err < 0)
5453 return err;
5454
5455 if (!tb[NFTA_VERDICT_CODE])
5456 return -EINVAL;
1ca2e170 5457 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 5458
1ca2e170 5459 switch (data->verdict.code) {
e0abdadc 5460 default:
1ca2e170 5461 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 5462 case NF_ACCEPT:
5463 case NF_DROP:
5464 case NF_QUEUE:
5465 break;
5466 default:
5467 return -EINVAL;
5468 }
5469 /* fall through */
96518518
PM		 5470 case NFT_CONTINUE:
5471 case NFT_BREAK:
5472 case NFT_RETURN:
96518518
PM		 5473 break;
5474 case NFT_JUMP:
5475 case NFT_GOTO:
5476 if (!tb[NFTA_VERDICT_CHAIN])
5477 return -EINVAL;
5478 chain = nf_tables_chain_lookup(ctx->table,
664b0f8c 5479 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 5480 if (IS_ERR(chain))
5481 return PTR_ERR(chain);
f323d954 5482 if (nft_is_base_chain(chain))
96518518
PM		 5483 return -EOPNOTSUPP;
5484
96518518 5485 chain->use++;
1ca2e170 5486 data->verdict.chain = chain;
96518518 5487 break;
96518518
PM		 5488 }
5489
4c4ed074 5490 desc->len = sizeof(data->verdict);
96518518
PM		 5491 desc->type = NFT_DATA_VERDICT;
5492 return 0;
5493}
5494
5495static void nft_verdict_uninit(const struct nft_data *data)
5496{
1ca2e170 5497 switch (data->verdict.code) {
96518518
PM		 5498 case NFT_JUMP:
5499 case NFT_GOTO:
1ca2e170 5500 data->verdict.chain->use--;
96518518
PM		 5501 break;
5502 }
5503}
5504
33d5a7b1 5505int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 5506{
5507 struct nlattr *nest;
5508
33d5a7b1 5509 nest = nla_nest_start(skb, type);
96518518
PM		 5510 if (!nest)
5511 goto nla_put_failure;
5512
33d5a7b1 5513 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 5514 goto nla_put_failure;
5515
33d5a7b1 5516 switch (v->code) {
96518518
PM		 5517 case NFT_JUMP:
5518 case NFT_GOTO:
1ca2e170 5519 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 5520 v->chain->name))
96518518
PM		 5521 goto nla_put_failure;
5522 }
5523 nla_nest_end(skb, nest);
5524 return 0;
5525
5526nla_put_failure:
5527 return -1;
5528}
5529
d0a11fc3
PM		 5530static int nft_value_init(const struct nft_ctx *ctx,
5531 struct nft_data *data, unsigned int size,
96518518
PM		 5532 struct nft_data_desc *desc, const struct nlattr *nla)
5533{
5534 unsigned int len;
5535
5536 len = nla_len(nla);
5537 if (len == 0)
5538 return -EINVAL;
d0a11fc3 5539 if (len > size)
96518518
PM		 5540 return -EOVERFLOW;
5541
d0a11fc3 5542 nla_memcpy(data->data, nla, len);
96518518
PM		 5543 desc->type = NFT_DATA_VALUE;
5544 desc->len = len;
5545 return 0;
5546}
5547
5548static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
5549 unsigned int len)
5550{
5551 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
5552}
5553
5554static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 5555 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 5556 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
5557};
5558
5559/**
5560 * nft_data_init - parse nf_tables data netlink attributes
5561 *
5562 * @ctx: context of the expression using the data
5563 * @data: destination struct nft_data
d0a11fc3 5564 * @size: maximum data length
96518518
PM		 5565 * @desc: data description
5566 * @nla: netlink attribute containing data
5567 *
5568 * Parse the netlink data attributes and initialize a struct nft_data.
5569 * The type and length of data are returned in the data description.
5570 *
5571 * The caller can indicate that it only wants to accept data of type
5572 * NFT_DATA_VALUE by passing NULL for the ctx argument.
5573 */
d0a11fc3
PM		 5574int nft_data_init(const struct nft_ctx *ctx,
5575 struct nft_data *data, unsigned int size,
96518518
PM		 5576 struct nft_data_desc *desc, const struct nlattr *nla)
5577{
5578 struct nlattr *tb[NFTA_DATA_MAX + 1];
5579 int err;
5580
fceb6435 5581 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 5582 if (err < 0)
5583 return err;
5584
5585 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 5586 return nft_value_init(ctx, data, size, desc,
5587 tb[NFTA_DATA_VALUE]);
96518518
PM		 5588 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
5589 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
5590 return -EINVAL;
5591}
5592EXPORT_SYMBOL_GPL(nft_data_init);
5593
5594/**
59105446 5595 * nft_data_release - release a nft_data item
96518518
PM		 5596 *
5597 * @data: struct nft_data to release
5598 * @type: type of data
5599 *
5600 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5601 * all others need to be released by calling this function.
5602 */
59105446 5603void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 5604{
960bd2c2 5605 if (type < NFT_DATA_VERDICT)
96518518 5606 return;
960bd2c2 5607 switch (type) {
96518518
PM		 5608 case NFT_DATA_VERDICT:
5609 return nft_verdict_uninit(data);
5610 default:
5611 WARN_ON(1);
5612 }
5613}
59105446 5614EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 5615
5616int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
5617 enum nft_data_types type, unsigned int len)
5618{
5619 struct nlattr *nest;
5620 int err;
5621
5622 nest = nla_nest_start(skb, attr);
5623 if (nest == NULL)
5624 return -1;
5625
5626 switch (type) {
5627 case NFT_DATA_VALUE:
5628 err = nft_value_dump(skb, data, len);
5629 break;
5630 case NFT_DATA_VERDICT:
33d5a7b1 5631 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 5632 break;
5633 default:
5634 err = -EINVAL;
5635 WARN_ON(1);
5636 }
5637
5638 nla_nest_end(skb, nest);
5639 return err;
5640}
5641EXPORT_SYMBOL_GPL(nft_data_dump);
5642
df05ef87 5643static int __net_init nf_tables_init_net(struct net *net)
99633ab2
PNA		 5644{
5645 INIT_LIST_HEAD(&net->nft.af_info);
0628b123 5646 INIT_LIST_HEAD(&net->nft.commit_list);
38e029f1 5647 net->nft.base_seq = 1;
99633ab2
PNA		 5648 return 0;
5649}
5650
5ebe0b0e
PNA		 5651int __nft_release_basechain(struct nft_ctx *ctx)
5652{
5653 struct nft_rule *rule, *nr;
5654
f323d954 5655 BUG_ON(!nft_is_base_chain(ctx->chain));
5ebe0b0e 5656
82bec71d 5657 nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
5ebe0b0e
PNA		 5658 ctx->afi->nops);
5659 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
5660 list_del(&rule->list);
5661 ctx->chain->use--;
5662 nf_tables_rule_destroy(ctx, rule);
5663 }
5664 list_del(&ctx->chain->list);
5665 ctx->table->use--;
5666 nf_tables_chain_destroy(ctx->chain);
5667
5668 return 0;
5669}
5670EXPORT_SYMBOL_GPL(__nft_release_basechain);
5671
df05ef87
PNA		 5672/* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */
5673static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
5674{
5675 struct nft_table *table, *nt;
5676 struct nft_chain *chain, *nc;
e5009240 5677 struct nft_object *obj, *ne;
df05ef87
PNA		 5678 struct nft_rule *rule, *nr;
5679 struct nft_set *set, *ns;
5680 struct nft_ctx ctx = {
5681 .net = net,
5682 .afi = afi,
5683 };
5684
5685 list_for_each_entry_safe(table, nt, &afi->tables, list) {
5686 list_for_each_entry(chain, &table->chains, list)
82bec71d
PNA		 5687 nf_tables_unregister_hooks(net, table, chain,
5688 afi->nops);
df05ef87
PNA		 5689 /* No packets are walking on these chains anymore. */
5690 ctx.table = table;
5691 list_for_each_entry(chain, &table->chains, list) {
5692 ctx.chain = chain;
5693 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
5694 list_del(&rule->list);
5695 chain->use--;
5696 nf_tables_rule_destroy(&ctx, rule);
5697 }
5698 }
5699 list_for_each_entry_safe(set, ns, &table->sets, list) {
5700 list_del(&set->list);
5701 table->use--;
5702 nft_set_destroy(set);
5703 }
e5009240
PNA		 5704 list_for_each_entry_safe(obj, ne, &table->objects, list) {
5705 list_del(&obj->list);
5706 table->use--;
5707 nft_obj_destroy(obj);
5708 }
df05ef87
PNA		 5709 list_for_each_entry_safe(chain, nc, &table->chains, list) {
5710 list_del(&chain->list);
5711 table->use--;
5712 nf_tables_chain_destroy(chain);
5713 }
5714 list_del(&table->list);
5715 nf_tables_table_destroy(&ctx);
5716 }
5717}
5718
99633ab2
PNA		 5719static struct pernet_operations nf_tables_net_ops = {
5720 .init = nf_tables_init_net,
5721};
5722
96518518
PM		 5723static int __init nf_tables_module_init(void)
5724{
5725 int err;
5726
5727 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
5728 GFP_KERNEL);
5729 if (info == NULL) {
5730 err = -ENOMEM;
5731 goto err1;
5732 }
5733
5734 err = nf_tables_core_module_init();
5735 if (err < 0)
5736 goto err2;
5737
5738 err = nfnetlink_subsys_register(&nf_tables_subsys);
5739 if (err < 0)
5740 goto err3;
5741
5742 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
99633ab2 5743 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 5744err3:
5745 nf_tables_core_module_exit();
5746err2:
5747 kfree(info);
5748err1:
5749 return err;
5750}
5751
5752static void __exit nf_tables_module_exit(void)
5753{
99633ab2 5754 unregister_pernet_subsys(&nf_tables_net_ops);
96518518 5755 nfnetlink_subsys_unregister(&nf_tables_subsys);
1b1bc49c 5756 rcu_barrier();
96518518
PM		 5757 nf_tables_core_module_exit();
5758 kfree(info);
5759}
5760
5761module_init(nf_tables_module_init);
5762module_exit(nf_tables_module_exit);
5763
5764MODULE_LICENSE("GPL");
5765MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
5766MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror