]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nfnetlink_cthelper: Remove VLA usage
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
96518518
PM		 17#include <linux/netfilter.h>
18#include <linux/netfilter/nfnetlink.h>
19#include <linux/netfilter/nf_tables.h>
3b49e2e9 20#include <net/netfilter/nf_flow_table.h>
96518518
PM		 21#include <net/netfilter/nf_tables_core.h>
22#include <net/netfilter/nf_tables.h>
99633ab2 23#include <net/net_namespace.h>
96518518
PM		 24#include <net/sock.h>
25
96518518 26static LIST_HEAD(nf_tables_expressions);
e5009240 27static LIST_HEAD(nf_tables_objects);
3b49e2e9 28static LIST_HEAD(nf_tables_flowtables);
3ecbfd65 29static u64 table_handle;
96518518 30
7c95f6d8 31static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 32 struct net *net,
7c95f6d8
PNA		 33 const struct sk_buff *skb,
34 const struct nlmsghdr *nlh,
36596dad 35 u8 family,
7c95f6d8
PNA		 36 struct nft_table *table,
37 struct nft_chain *chain,
38 const struct nlattr * const *nla)
39{
633c9a84 40 ctx->net = net;
36596dad 41 ctx->family = family;
128ad332
PNA		 42 ctx->table = table;
43 ctx->chain = chain;
44 ctx->nla = nla;
45 ctx->portid = NETLINK_CB(skb).portid;
46 ctx->report = nlmsg_report(nlh);
47 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 48}
49
8411b644
PNA		 50static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
51 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 52{
53 struct nft_trans *trans;
54
8411b644 55 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 56 if (trans == NULL)
57 return NULL;
58
b380e5c7 59 trans->msg_type = msg_type;
1081d11b
PNA		 60 trans->ctx = *ctx;
61
62 return trans;
63}
64
8411b644
PNA		 65static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
66 int msg_type, u32 size)
67{
68 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
69}
70
1081d11b
PNA		 71static void nft_trans_destroy(struct nft_trans *trans)
72{
73 list_del(&trans->list);
74 kfree(trans);
75}
76
c974a3a3
PNA		 77static int nf_tables_register_hook(struct net *net,
78 const struct nft_table *table,
79 struct nft_chain *chain)
d8ee8f7c
PNA		 80{
81 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 82 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 83 return 0;
84
c974a3a3 85 return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
d8ee8f7c
PNA		 86}
87
c974a3a3
PNA		 88static void nf_tables_unregister_hook(struct net *net,
89 const struct nft_table *table,
90 struct nft_chain *chain)
c5598794 91{
d8ee8f7c 92 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 93 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 94 return;
95
c974a3a3 96 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
c5598794
AB		 97}
98
ee01d542
AB		 99static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
100{
101 struct nft_trans *trans;
102
103 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
104 if (trans == NULL)
105 return -ENOMEM;
106
107 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 108 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 109
110 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
111 return 0;
112}
113
114static int nft_deltable(struct nft_ctx *ctx)
115{
116 int err;
117
118 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
119 if (err < 0)
120 return err;
121
f2a6d766 122 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 123 return err;
124}
125
126static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
127{
128 struct nft_trans *trans;
129
130 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
131 if (trans == NULL)
132 return -ENOMEM;
133
134 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 135 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 136
137 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
138 return 0;
139}
140
141static int nft_delchain(struct nft_ctx *ctx)
142{
143 int err;
144
145 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
146 if (err < 0)
147 return err;
148
149 ctx->table->use--;
664b0f8c 150 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 151
152 return err;
153}
154
ee01d542
AB		 155static int
156nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
157{
158 /* You cannot delete the same rule twice */
889f7ee7
PNA		 159 if (nft_is_active_next(ctx->net, rule)) {
160 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 161 ctx->chain->use--;
162 return 0;
163 }
164 return -ENOENT;
165}
166
167static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
168 struct nft_rule *rule)
169{
170 struct nft_trans *trans;
171
172 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
173 if (trans == NULL)
174 return NULL;
175
1a94e38d
PNA		 176 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
177 nft_trans_rule_id(trans) =
178 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
179 }
ee01d542
AB		 180 nft_trans_rule(trans) = rule;
181 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
182
183 return trans;
184}
185
186static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
187{
188 struct nft_trans *trans;
189 int err;
190
191 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
192 if (trans == NULL)
193 return -ENOMEM;
194
195 err = nf_tables_delrule_deactivate(ctx, rule);
196 if (err < 0) {
197 nft_trans_destroy(trans);
198 return err;
199 }
200
201 return 0;
202}
203
204static int nft_delrule_by_chain(struct nft_ctx *ctx)
205{
206 struct nft_rule *rule;
207 int err;
208
209 list_for_each_entry(rule, &ctx->chain->rules, list) {
210 err = nft_delrule(ctx, rule);
211 if (err < 0)
212 return err;
213 }
214 return 0;
215}
216
ee01d542
AB		 217static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
218 struct nft_set *set)
219{
220 struct nft_trans *trans;
221
222 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
223 if (trans == NULL)
224 return -ENOMEM;
225
226 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
227 nft_trans_set_id(trans) =
228 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 229 nft_activate_next(ctx->net, set);
ee01d542
AB		 230 }
231 nft_trans_set(trans) = set;
232 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
233
234 return 0;
235}
236
237static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
238{
239 int err;
240
241 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
242 if (err < 0)
243 return err;
244
37a9cc52 245 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 246 ctx->table->use--;
247
248 return err;
249}
250
e5009240
PNA		 251static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
252 struct nft_object *obj)
253{
254 struct nft_trans *trans;
255
256 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
257 if (trans == NULL)
258 return -ENOMEM;
259
260 if (msg_type == NFT_MSG_NEWOBJ)
261 nft_activate_next(ctx->net, obj);
262
263 nft_trans_obj(trans) = obj;
264 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
265
266 return 0;
267}
268
269static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
270{
271 int err;
272
273 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
274 if (err < 0)
275 return err;
276
277 nft_deactivate_next(ctx->net, obj);
278 ctx->table->use--;
279
280 return err;
281}
282
3b49e2e9
PNA		 283static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
284 struct nft_flowtable *flowtable)
285{
286 struct nft_trans *trans;
287
288 trans = nft_trans_alloc(ctx, msg_type,
289 sizeof(struct nft_trans_flowtable));
290 if (trans == NULL)
291 return -ENOMEM;
292
293 if (msg_type == NFT_MSG_NEWFLOWTABLE)
294 nft_activate_next(ctx->net, flowtable);
295
296 nft_trans_flowtable(trans) = flowtable;
297 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
298
299 return 0;
300}
301
302static int nft_delflowtable(struct nft_ctx *ctx,
303 struct nft_flowtable *flowtable)
304{
305 int err;
306
307 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
308 if (err < 0)
309 return err;
310
311 nft_deactivate_next(ctx->net, flowtable);
312 ctx->table->use--;
313
314 return err;
315}
316
96518518
PM		 317/*
318 * Tables
319 */
320
36596dad 321static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 322 const struct nlattr *nla,
36596dad 323 u8 family, u8 genmask)
96518518
PM		 324{
325 struct nft_table *table;
326
36596dad 327 list_for_each_entry(table, &net->nft.tables, list) {
f2a6d766 328 if (!nla_strcmp(nla, table->name) &&
98319cb9 329 table->family == family &&
f2a6d766 330 nft_active_genmask(table, genmask))
96518518
PM		 331 return table;
332 }
333 return NULL;
334}
335
3ecbfd65
HS		 336static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
337 const struct nlattr *nla,
338 u8 genmask)
339{
340 struct nft_table *table;
341
342 list_for_each_entry(table, &net->nft.tables, list) {
343 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
344 nft_active_genmask(table, genmask))
345 return table;
346 }
347 return NULL;
348}
349
36596dad 350static struct nft_table *nf_tables_table_lookup(const struct net *net,
f2a6d766 351 const struct nlattr *nla,
36596dad 352 u8 family, u8 genmask)
96518518
PM		 353{
354 struct nft_table *table;
355
356 if (nla == NULL)
357 return ERR_PTR(-EINVAL);
358
36596dad 359 table = nft_table_lookup(net, nla, family, genmask);
96518518
PM		 360 if (table != NULL)
361 return table;
362
96518518
PM		 363 return ERR_PTR(-ENOENT);
364}
365
3ecbfd65
HS		 366static struct nft_table *nf_tables_table_lookup_byhandle(const struct net *net,
367 const struct nlattr *nla,
368 u8 genmask)
369{
370 struct nft_table *table;
371
372 if (nla == NULL)
373 return ERR_PTR(-EINVAL);
374
375 table = nft_table_lookup_byhandle(net, nla, genmask);
376 if (table != NULL)
377 return table;
378
379 return ERR_PTR(-ENOENT);
380}
381
96518518
PM		 382static inline u64 nf_tables_alloc_handle(struct nft_table *table)
383{
384 return ++table->hgenerator;
385}
386
d8297d4f 387static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 388
2a37d755 389static const struct nf_chain_type *
1ea26cca 390__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 391{
392 int i;
393
baae3e62 394 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 395 if (chain_type[family][i] != NULL &&
396 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 397 return chain_type[family][i];
9370761c 398 }
baae3e62 399 return NULL;
9370761c
PNA		 400}
401
2a37d755 402static const struct nf_chain_type *
1ea26cca 403nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload)
9370761c 404{
2a37d755 405 const struct nf_chain_type *type;
9370761c 406
1ea26cca 407 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 408 if (type != NULL)
409 return type;
9370761c 410#ifdef CONFIG_MODULES
93b0806f 411 if (autoload) {
9370761c 412 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1ea26cca 413 request_module("nft-chain-%u-%.*s", family,
2fec6bb6 414 nla_len(nla), (const char *)nla_data(nla));
9370761c 415 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1ea26cca 416 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 417 if (type != NULL)
418 return ERR_PTR(-EAGAIN);
9370761c
PNA		 419 }
420#endif
93b0806f 421 return ERR_PTR(-ENOENT);
9370761c
PNA		 422}
423
96518518 424static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 425 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
426 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 427 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 428 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 429};
430
84d7fce6
PNA		 431static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
432 u32 portid, u32 seq, int event, u32 flags,
433 int family, const struct nft_table *table)
96518518
PM		 434{
435 struct nlmsghdr *nlh;
436 struct nfgenmsg *nfmsg;
437
dedb67c4 438 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 439 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
440 if (nlh == NULL)
441 goto nla_put_failure;
442
443 nfmsg = nlmsg_data(nlh);
444 nfmsg->nfgen_family = family;
445 nfmsg->version = NFNETLINK_V0;
84d7fce6 446 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 447
9ddf6323 448 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 449 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 450 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
451 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
452 NFTA_TABLE_PAD))
96518518
PM		 453 goto nla_put_failure;
454
053c095a
JB		 455 nlmsg_end(skb, nlh);
456 return 0;
96518518
PM		 457
458nla_put_failure:
459 nlmsg_trim(skb, nlh);
460 return -1;
461}
462
25e94a99 463static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 464{
465 struct sk_buff *skb;
96518518
PM		 466 int err;
467
128ad332
PNA		 468 if (!ctx->report &&
469 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 470 return;
96518518 471
96518518
PM		 472 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
473 if (skb == NULL)
474 goto err;
475
84d7fce6 476 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 477 event, 0, ctx->family, ctx->table);
96518518
PM		 478 if (err < 0) {
479 kfree_skb(skb);
480 goto err;
481 }
482
25e94a99
PNA		 483 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
484 ctx->report, GFP_KERNEL);
485 return;
96518518 486err:
25e94a99 487 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 488}
489
490static int nf_tables_dump_tables(struct sk_buff *skb,
491 struct netlink_callback *cb)
492{
493 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 494 const struct nft_table *table;
495 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 496 struct net *net = sock_net(skb->sk);
96518518
PM		 497 int family = nfmsg->nfgen_family;
498
e688a7f8 499 rcu_read_lock();
38e029f1
PNA		 500 cb->seq = net->nft.base_seq;
501
36596dad 502 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 503 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 504 continue;
505
36596dad
PNA		 506 if (idx < s_idx)
507 goto cont;
508 if (idx > s_idx)
509 memset(&cb->args[1], 0,
510 sizeof(cb->args) - sizeof(cb->args[0]));
511 if (!nft_is_active(net, table))
512 continue;
513 if (nf_tables_fill_table_info(skb, net,
514 NETLINK_CB(cb->skb).portid,
515 cb->nlh->nlmsg_seq,
516 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 517 table->family, table) < 0)
36596dad
PNA		 518 goto done;
519
520 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 521cont:
36596dad 522 idx++;
96518518
PM		 523 }
524done:
e688a7f8 525 rcu_read_unlock();
96518518
PM		 526 cb->args[0] = idx;
527 return skb->len;
528}
529
7b8002a1
PNA		 530static int nf_tables_gettable(struct net *net, struct sock *nlsk,
531 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 532 const struct nlattr * const nla[],
533 struct netlink_ext_ack *extack)
96518518
PM		 534{
535 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 536 u8 genmask = nft_genmask_cur(net);
96518518
PM		 537 const struct nft_table *table;
538 struct sk_buff *skb2;
539 int family = nfmsg->nfgen_family;
540 int err;
541
542 if (nlh->nlmsg_flags & NLM_F_DUMP) {
543 struct netlink_dump_control c = {
544 .dump = nf_tables_dump_tables,
545 };
546 return netlink_dump_start(nlsk, skb, nlh, &c);
547 }
548
98319cb9 549 table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family,
36596dad 550 genmask);
96518518
PM		 551 if (IS_ERR(table))
552 return PTR_ERR(table);
553
554 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
555 if (!skb2)
556 return -ENOMEM;
557
84d7fce6 558 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 559 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
560 family, table);
561 if (err < 0)
562 goto err;
563
564 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
565
566err:
567 kfree_skb(skb2);
568 return err;
569}
570
c9c17211 571static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 572{
573 struct nft_chain *chain;
574 u32 i = 0;
575
576 list_for_each_entry(chain, &table->chains, list) {
577 if (!nft_is_active_next(net, chain))
578 continue;
f323d954 579 if (!nft_is_base_chain(chain))
10435c11
F		 580 continue;
581
582 if (cnt && i++ == cnt)
583 break;
584
c974a3a3 585 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 586 }
587}
588
c9c17211 589static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 590{
591 struct nft_chain *chain;
592 int err, i = 0;
593
594 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 595 if (!nft_is_active_next(net, chain))
596 continue;
f323d954 597 if (!nft_is_base_chain(chain))
d2012975
PNA		 598 continue;
599
c974a3a3 600 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 601 if (err < 0)
602 goto err;
603
604 i++;
605 }
606 return 0;
607err:
10435c11 608 if (i)
c9c17211 609 nft_table_disable(net, table, i);
9ddf6323
PNA		 610 return err;
611}
612
c9c17211 613static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 614{
c9c17211 615 nft_table_disable(net, table, 0);
9ddf6323
PNA		 616}
617
e1aaca93 618static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 619{
55dd6f93 620 struct nft_trans *trans;
e1aaca93 621 u32 flags;
55dd6f93 622 int ret = 0;
9ddf6323 623
e1aaca93
PNA		 624 if (!ctx->nla[NFTA_TABLE_FLAGS])
625 return 0;
9ddf6323 626
e1aaca93
PNA		 627 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
628 if (flags & ~NFT_TABLE_F_DORMANT)
629 return -EINVAL;
630
63283dd2
PNA		 631 if (flags == ctx->table->flags)
632 return 0;
633
55dd6f93
PNA		 634 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
635 sizeof(struct nft_trans_table));
636 if (trans == NULL)
637 return -ENOMEM;
9ddf6323 638
e1aaca93
PNA		 639 if ((flags & NFT_TABLE_F_DORMANT) &&
640 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 641 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 642 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
643 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 644 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 645 if (ret >= 0) {
e1aaca93 646 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 647 nft_trans_table_enable(trans) = true;
9ddf6323 648 }
9ddf6323 649 }
e1aaca93
PNA		 650 if (ret < 0)
651 goto err;
9ddf6323 652
55dd6f93
PNA		 653 nft_trans_table_update(trans) = true;
654 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
655 return 0;
9ddf6323 656err:
55dd6f93 657 nft_trans_destroy(trans);
9ddf6323
PNA		 658 return ret;
659}
660
633c9a84
PNA		 661static int nf_tables_newtable(struct net *net, struct sock *nlsk,
662 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 663 const struct nlattr * const nla[],
664 struct netlink_ext_ack *extack)
96518518
PM		 665{
666 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 667 u8 genmask = nft_genmask_next(net);
96518518 668 const struct nlattr *name;
96518518
PM		 669 struct nft_table *table;
670 int family = nfmsg->nfgen_family;
c5c1f975 671 u32 flags = 0;
e1aaca93 672 struct nft_ctx ctx;
55dd6f93 673 int err;
96518518 674
96518518 675 name = nla[NFTA_TABLE_NAME];
98319cb9 676 table = nf_tables_table_lookup(net, name, family, genmask);
96518518
PM		 677 if (IS_ERR(table)) {
678 if (PTR_ERR(table) != -ENOENT)
679 return PTR_ERR(table);
1a28ad74 680 } else {
96518518
PM		 681 if (nlh->nlmsg_flags & NLM_F_EXCL)
682 return -EEXIST;
683 if (nlh->nlmsg_flags & NLM_F_REPLACE)
684 return -EOPNOTSUPP;
e1aaca93 685
98319cb9 686 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 687 return nf_tables_updtable(&ctx);
96518518
PM		 688 }
689
c5c1f975
PM		 690 if (nla[NFTA_TABLE_FLAGS]) {
691 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
692 if (flags & ~NFT_TABLE_F_DORMANT)
693 return -EINVAL;
694 }
695
ffdb210e 696 err = -ENOMEM;
1cae565e 697 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 698 if (table == NULL)
98319cb9 699 goto err_kzalloc;
96518518 700
e46abbcc
PS		 701 table->name = nla_strdup(name, GFP_KERNEL);
702 if (table->name == NULL)
98319cb9 703 goto err_strdup;
e46abbcc 704
96518518 705 INIT_LIST_HEAD(&table->chains);
20a69341 706 INIT_LIST_HEAD(&table->sets);
e5009240 707 INIT_LIST_HEAD(&table->objects);
3b49e2e9 708 INIT_LIST_HEAD(&table->flowtables);
98319cb9 709 table->family = family;
c5c1f975 710 table->flags = flags;
3ecbfd65 711 table->handle = ++table_handle;
9ddf6323 712
98319cb9 713 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 714 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 715 if (err < 0)
98319cb9 716 goto err_trans;
ffdb210e 717
36596dad 718 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 719 return 0;
98319cb9 720err_trans:
e46abbcc 721 kfree(table->name);
98319cb9 722err_strdup:
ffdb210e 723 kfree(table);
98319cb9 724err_kzalloc:
ffdb210e 725 return err;
96518518
PM		 726}
727
b9ac12ef
AB		 728static int nft_flush_table(struct nft_ctx *ctx)
729{
3b49e2e9 730 struct nft_flowtable *flowtable, *nft;
b9ac12ef 731 struct nft_chain *chain, *nc;
e5009240 732 struct nft_object *obj, *ne;
b9ac12ef 733 struct nft_set *set, *ns;
3b49e2e9 734 int err;
b9ac12ef 735
a2f18db0 736 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 737 if (!nft_is_active_next(ctx->net, chain))
738 continue;
739
b9ac12ef
AB		 740 ctx->chain = chain;
741
742 err = nft_delrule_by_chain(ctx);
743 if (err < 0)
744 goto out;
b9ac12ef
AB		 745 }
746
747 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 748 if (!nft_is_active_next(ctx->net, set))
749 continue;
750
408070d6 751 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 752 !list_empty(&set->bindings))
753 continue;
754
755 err = nft_delset(ctx, set);
756 if (err < 0)
757 goto out;
758 }
759
3b49e2e9
PNA		 760 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
761 err = nft_delflowtable(ctx, flowtable);
762 if (err < 0)
763 goto out;
764 }
765
e5009240
PNA		 766 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
767 err = nft_delobj(ctx, obj);
768 if (err < 0)
769 goto out;
770 }
771
a2f18db0 772 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 773 if (!nft_is_active_next(ctx->net, chain))
774 continue;
775
a2f18db0
PNA		 776 ctx->chain = chain;
777
778 err = nft_delchain(ctx);
779 if (err < 0)
780 goto out;
781 }
782
b9ac12ef
AB		 783 err = nft_deltable(ctx);
784out:
785 return err;
786}
787
788static int nft_flush(struct nft_ctx *ctx, int family)
789{
b9ac12ef
AB		 790 struct nft_table *table, *nt;
791 const struct nlattr * const *nla = ctx->nla;
792 int err = 0;
793
36596dad 794 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 795 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 796 continue;
797
98319cb9 798 ctx->family = table->family;
f2a6d766 799
36596dad
PNA		 800 if (!nft_is_active_next(ctx->net, table))
801 continue;
b9ac12ef 802
36596dad
PNA		 803 if (nla[NFTA_TABLE_NAME] &&
804 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
805 continue;
b9ac12ef 806
36596dad
PNA		 807 ctx->table = table;
808
809 err = nft_flush_table(ctx);
810 if (err < 0)
811 goto out;
b9ac12ef
AB		 812 }
813out:
814 return err;
815}
816
633c9a84
PNA		 817static int nf_tables_deltable(struct net *net, struct sock *nlsk,
818 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 819 const struct nlattr * const nla[],
820 struct netlink_ext_ack *extack)
96518518
PM		 821{
822 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 823 u8 genmask = nft_genmask_next(net);
96518518 824 struct nft_table *table;
ee01d542 825 int family = nfmsg->nfgen_family;
55dd6f93 826 struct nft_ctx ctx;
96518518 827
36596dad 828 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 829 if (family == AF_UNSPEC ||
830 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 831 return nft_flush(&ctx, family);
832
3ecbfd65
HS		 833 if (nla[NFTA_TABLE_HANDLE])
834 table = nf_tables_table_lookup_byhandle(net,
835 nla[NFTA_TABLE_HANDLE],
836 genmask);
837 else
838 table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME],
839 family, genmask);
840
96518518
PM		 841 if (IS_ERR(table))
842 return PTR_ERR(table);
96518518 843
a8278400
PNA		 844 if (nlh->nlmsg_flags & NLM_F_NONREC &&
845 table->use > 0)
846 return -EBUSY;
847
98319cb9 848 ctx.family = family;
b9ac12ef 849 ctx.table = table;
55dd6f93 850
b9ac12ef 851 return nft_flush_table(&ctx);
96518518
PM		 852}
853
55dd6f93
PNA		 854static void nf_tables_table_destroy(struct nft_ctx *ctx)
855{
4fefee57
PNA		 856 BUG_ON(ctx->table->use > 0);
857
e46abbcc 858 kfree(ctx->table->name);
55dd6f93 859 kfree(ctx->table);
55dd6f93
PNA		 860}
861
2a37d755 862int nft_register_chain_type(const struct nf_chain_type *ctype)
96518518 863{
9370761c 864 int err = 0;
96518518 865
d8297d4f
FW		 866 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
867 return -EINVAL;
868
96518518 869 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c
PNA		 870 if (chain_type[ctype->family][ctype->type] != NULL) {
871 err = -EBUSY;
872 goto out;
96518518 873 }
9370761c
PNA		 874 chain_type[ctype->family][ctype->type] = ctype;
875out:
96518518
PM		 876 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
877 return err;
878}
9370761c 879EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 880
2a37d755 881void nft_unregister_chain_type(const struct nf_chain_type *ctype)
96518518 882{
96518518 883 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 884 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 885 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
886}
9370761c 887EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 888
889/*
890 * Chains
891 */
892
893static struct nft_chain *
664b0f8c
PNA		 894nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
895 u8 genmask)
96518518
PM		 896{
897 struct nft_chain *chain;
898
899 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 900 if (chain->handle == handle &&
901 nft_active_genmask(chain, genmask))
96518518
PM		 902 return chain;
903 }
904
905 return ERR_PTR(-ENOENT);
906}
907
908static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
664b0f8c
PNA		 909 const struct nlattr *nla,
910 u8 genmask)
96518518
PM		 911{
912 struct nft_chain *chain;
913
914 if (nla == NULL)
915 return ERR_PTR(-EINVAL);
916
917 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 918 if (!nla_strcmp(nla, chain->name) &&
919 nft_active_genmask(chain, genmask))
96518518
PM		 920 return chain;
921 }
922
923 return ERR_PTR(-ENOENT);
924}
925
926static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 927 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
928 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 929 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
930 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
931 .len = NFT_CHAIN_MAXNAMELEN - 1 },
932 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 933 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 934 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 935 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 936};
937
938static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
939 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
940 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 941 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
942 .len = IFNAMSIZ - 1 },
96518518
PM		 943};
944
0ca743a5
PNA		 945static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
946{
947 struct nft_stats *cpu_stats, total;
948 struct nlattr *nest;
ce355e20
ED		 949 unsigned int seq;
950 u64 pkts, bytes;
0ca743a5
PNA		 951 int cpu;
952
953 memset(&total, 0, sizeof(total));
954 for_each_possible_cpu(cpu) {
955 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 956 do {
957 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
958 pkts = cpu_stats->pkts;
959 bytes = cpu_stats->bytes;
960 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
961 total.pkts += pkts;
962 total.bytes += bytes;
0ca743a5
PNA		 963 }
964 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
965 if (nest == NULL)
966 goto nla_put_failure;
967
b46f6ded
ND		 968 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
969 NFTA_COUNTER_PAD) ||
970 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
971 NFTA_COUNTER_PAD))
0ca743a5
PNA		 972 goto nla_put_failure;
973
974 nla_nest_end(skb, nest);
975 return 0;
976
977nla_put_failure:
978 return -ENOSPC;
979}
980
84d7fce6
PNA		 981static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
982 u32 portid, u32 seq, int event, u32 flags,
983 int family, const struct nft_table *table,
96518518
PM		 984 const struct nft_chain *chain)
985{
986 struct nlmsghdr *nlh;
987 struct nfgenmsg *nfmsg;
988
dedb67c4 989 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 990 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
991 if (nlh == NULL)
992 goto nla_put_failure;
993
994 nfmsg = nlmsg_data(nlh);
995 nfmsg->nfgen_family = family;
996 nfmsg->version = NFNETLINK_V0;
84d7fce6 997 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 998
999 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1000 goto nla_put_failure;
b46f6ded
ND		 1001 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1002 NFTA_CHAIN_PAD))
96518518
PM		 1003 goto nla_put_failure;
1004 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1005 goto nla_put_failure;
1006
f323d954 1007 if (nft_is_base_chain(chain)) {
0ca743a5 1008 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1009 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1010 struct nlattr *nest;
1011
1012 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1013 if (nest == NULL)
1014 goto nla_put_failure;
1015 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1016 goto nla_put_failure;
1017 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1018 goto nla_put_failure;
2cbce139
PNA		 1019 if (basechain->dev_name[0] &&
1020 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1021 goto nla_put_failure;
96518518 1022 nla_nest_end(skb, nest);
9370761c 1023
0ca743a5
PNA		 1024 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1025 htonl(basechain->policy)))
1026 goto nla_put_failure;
1027
baae3e62
PM		 1028 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1029 goto nla_put_failure;
0ca743a5 1030
5f9bfe0e 1031 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
0ca743a5 1032 goto nla_put_failure;
96518518
PM		 1033 }
1034
0ca743a5
PNA		 1035 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1036 goto nla_put_failure;
1037
053c095a
JB		 1038 nlmsg_end(skb, nlh);
1039 return 0;
96518518
PM		 1040
1041nla_put_failure:
1042 nlmsg_trim(skb, nlh);
1043 return -1;
1044}
1045
25e94a99 1046static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1047{
1048 struct sk_buff *skb;
96518518
PM		 1049 int err;
1050
128ad332
PNA		 1051 if (!ctx->report &&
1052 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1053 return;
96518518 1054
96518518
PM		 1055 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1056 if (skb == NULL)
1057 goto err;
1058
84d7fce6 1059 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1060 event, 0, ctx->family, ctx->table,
35151d84 1061 ctx->chain);
96518518
PM		 1062 if (err < 0) {
1063 kfree_skb(skb);
1064 goto err;
1065 }
1066
25e94a99
PNA		 1067 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1068 ctx->report, GFP_KERNEL);
1069 return;
96518518 1070err:
25e94a99 1071 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1072}
1073
1074static int nf_tables_dump_chains(struct sk_buff *skb,
1075 struct netlink_callback *cb)
1076{
1077 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1078 const struct nft_table *table;
1079 const struct nft_chain *chain;
1080 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1081 struct net *net = sock_net(skb->sk);
96518518
PM		 1082 int family = nfmsg->nfgen_family;
1083
e688a7f8 1084 rcu_read_lock();
38e029f1
PNA		 1085 cb->seq = net->nft.base_seq;
1086
36596dad 1087 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1088 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1089 continue;
1090
36596dad
PNA		 1091 list_for_each_entry_rcu(chain, &table->chains, list) {
1092 if (idx < s_idx)
1093 goto cont;
1094 if (idx > s_idx)
1095 memset(&cb->args[1], 0,
1096 sizeof(cb->args) - sizeof(cb->args[0]));
1097 if (!nft_is_active(net, chain))
1098 continue;
1099 if (nf_tables_fill_chain_info(skb, net,
1100 NETLINK_CB(cb->skb).portid,
1101 cb->nlh->nlmsg_seq,
1102 NFT_MSG_NEWCHAIN,
1103 NLM_F_MULTI,
98319cb9 1104 table->family, table,
36596dad
PNA		 1105 chain) < 0)
1106 goto done;
38e029f1 1107
36596dad 1108 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1109cont:
36596dad 1110 idx++;
96518518
PM		 1111 }
1112 }
1113done:
e688a7f8 1114 rcu_read_unlock();
96518518
PM		 1115 cb->args[0] = idx;
1116 return skb->len;
1117}
1118
7b8002a1
PNA		 1119static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1120 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1121 const struct nlattr * const nla[],
1122 struct netlink_ext_ack *extack)
96518518
PM		 1123{
1124 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1125 u8 genmask = nft_genmask_cur(net);
96518518
PM		 1126 const struct nft_table *table;
1127 const struct nft_chain *chain;
1128 struct sk_buff *skb2;
1129 int family = nfmsg->nfgen_family;
1130 int err;
1131
1132 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1133 struct netlink_dump_control c = {
1134 .dump = nf_tables_dump_chains,
1135 };
1136 return netlink_dump_start(nlsk, skb, nlh, &c);
1137 }
1138
98319cb9 1139 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
36596dad 1140 genmask);
96518518
PM		 1141 if (IS_ERR(table))
1142 return PTR_ERR(table);
1143
664b0f8c 1144 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
96518518
PM		 1145 if (IS_ERR(chain))
1146 return PTR_ERR(chain);
1147
1148 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1149 if (!skb2)
1150 return -ENOMEM;
1151
84d7fce6 1152 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1153 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1154 family, table, chain);
1155 if (err < 0)
1156 goto err;
1157
1158 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1159
1160err:
1161 kfree_skb(skb2);
1162 return err;
1163}
1164
0ca743a5
PNA		 1165static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1166 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1167 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1168};
1169
ff3cd7b3 1170static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1171{
1172 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1173 struct nft_stats __percpu *newstats;
1174 struct nft_stats *stats;
1175 int err;
1176
fceb6435
JB		 1177 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1178 NULL);
0ca743a5 1179 if (err < 0)
ff3cd7b3 1180 return ERR_PTR(err);
0ca743a5
PNA		 1181
1182 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1183 return ERR_PTR(-EINVAL);
0ca743a5 1184
ce355e20 1185 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1186 if (newstats == NULL)
ff3cd7b3 1187 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1188
1189 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1190 * are not exposed to userspace.
1191 */
e8781f70 1192 preempt_disable();
0ca743a5
PNA		 1193 stats = this_cpu_ptr(newstats);
1194 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1195 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1196 preempt_enable();
0ca743a5 1197
ff3cd7b3
PNA		 1198 return newstats;
1199}
1200
1201static void nft_chain_stats_replace(struct nft_base_chain *chain,
1202 struct nft_stats __percpu *newstats)
1203{
0befd061
PNA		 1204 struct nft_stats __percpu *oldstats;
1205
b88825de
PNA		 1206 if (newstats == NULL)
1207 return;
1208
0ca743a5 1209 if (chain->stats) {
0befd061 1210 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
0ca743a5
PNA		 1211 rcu_assign_pointer(chain->stats, newstats);
1212 synchronize_rcu();
1213 free_percpu(oldstats);
1214 } else
1215 rcu_assign_pointer(chain->stats, newstats);
0ca743a5
PNA		 1216}
1217
91c7b38d
PNA		 1218static void nf_tables_chain_destroy(struct nft_chain *chain)
1219{
1220 BUG_ON(chain->use > 0);
1221
f323d954 1222 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1223 struct nft_base_chain *basechain = nft_base_chain(chain);
1224
1225 module_put(basechain->type->owner);
1226 free_percpu(basechain->stats);
9f08ea84
PNA		 1227 if (basechain->stats)
1228 static_branch_dec(&nft_counters_enabled);
c974a3a3
PNA		 1229 if (basechain->ops.dev != NULL)
1230 dev_put(basechain->ops.dev);
b7263e07 1231 kfree(chain->name);
2cbce139 1232 kfree(basechain);
91c7b38d 1233 } else {
b7263e07 1234 kfree(chain->name);
91c7b38d
PNA		 1235 kfree(chain);
1236 }
1237}
1238
508f8ccd
PNA		 1239struct nft_chain_hook {
1240 u32 num;
84ba7dd7 1241 s32 priority;
508f8ccd
PNA		 1242 const struct nf_chain_type *type;
1243 struct net_device *dev;
1244};
1245
1246static int nft_chain_parse_hook(struct net *net,
1247 const struct nlattr * const nla[],
36596dad
PNA		 1248 struct nft_chain_hook *hook, u8 family,
1249 bool create)
508f8ccd
PNA		 1250{
1251 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1252 const struct nf_chain_type *type;
1253 struct net_device *dev;
1254 int err;
1255
1256 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1257 nft_hook_policy, NULL);
508f8ccd
PNA		 1258 if (err < 0)
1259 return err;
1260
1261 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1262 ha[NFTA_HOOK_PRIORITY] == NULL)
1263 return -EINVAL;
1264
1265 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1266 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1267
36596dad 1268 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1269 if (nla[NFTA_CHAIN_TYPE]) {
1ea26cca 1270 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
36596dad 1271 family, create);
508f8ccd
PNA		 1272 if (IS_ERR(type))
1273 return PTR_ERR(type);
1274 }
1275 if (!(type->hook_mask & (1 << hook->num)))
1276 return -EOPNOTSUPP;
84ba7dd7
FW		 1277
1278 if (type->type == NFT_CHAIN_T_NAT &&
1279 hook->priority <= NF_IP_PRI_CONNTRACK)
1280 return -EOPNOTSUPP;
1281
508f8ccd
PNA		 1282 if (!try_module_get(type->owner))
1283 return -ENOENT;
1284
1285 hook->type = type;
1286
1287 hook->dev = NULL;
36596dad 1288 if (family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1289 char ifname[IFNAMSIZ];
1290
1291 if (!ha[NFTA_HOOK_DEV]) {
1292 module_put(type->owner);
1293 return -EOPNOTSUPP;
1294 }
1295
1296 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1297 dev = dev_get_by_name(net, ifname);
1298 if (!dev) {
1299 module_put(type->owner);
1300 return -ENOENT;
1301 }
1302 hook->dev = dev;
1303 } else if (ha[NFTA_HOOK_DEV]) {
1304 module_put(type->owner);
1305 return -EOPNOTSUPP;
1306 }
1307
1308 return 0;
1309}
1310
1311static void nft_chain_release_hook(struct nft_chain_hook *hook)
1312{
1313 module_put(hook->type->owner);
1314 if (hook->dev != NULL)
1315 dev_put(hook->dev);
1316}
1317
4035285f
PNA		 1318static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1319 u8 policy, bool create)
1320{
1321 const struct nlattr * const *nla = ctx->nla;
1322 struct nft_table *table = ctx->table;
4035285f
PNA		 1323 struct nft_base_chain *basechain;
1324 struct nft_stats __percpu *stats;
1325 struct net *net = ctx->net;
1326 struct nft_chain *chain;
4035285f
PNA		 1327 int err;
1328
1329 if (table->use == UINT_MAX)
1330 return -EOVERFLOW;
1331
1332 if (nla[NFTA_CHAIN_HOOK]) {
1333 struct nft_chain_hook hook;
1334 struct nf_hook_ops *ops;
4035285f 1335
36596dad 1336 err = nft_chain_parse_hook(net, nla, &hook, family, create);
4035285f
PNA		 1337 if (err < 0)
1338 return err;
1339
1340 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1341 if (basechain == NULL) {
1342 nft_chain_release_hook(&hook);
1343 return -ENOMEM;
1344 }
1345
1346 if (hook.dev != NULL)
1347 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1348
1349 if (nla[NFTA_CHAIN_COUNTERS]) {
1350 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1351 if (IS_ERR(stats)) {
1352 nft_chain_release_hook(&hook);
1353 kfree(basechain);
1354 return PTR_ERR(stats);
1355 }
1356 basechain->stats = stats;
1357 static_branch_inc(&nft_counters_enabled);
1358 }
1359
4035285f
PNA		 1360 basechain->type = hook.type;
1361 chain = &basechain->chain;
1362
c974a3a3
PNA		 1363 ops = &basechain->ops;
1364 ops->pf = family;
1365 ops->hooknum = hook.num;
1366 ops->priority = hook.priority;
1367 ops->priv = chain;
c2f9eafe 1368 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1369 ops->dev = hook.dev;
c974a3a3
PNA		 1370
1371 if (basechain->type->type == NFT_CHAIN_T_NAT)
1372 ops->nat_hook = true;
4035285f
PNA		 1373
1374 chain->flags |= NFT_BASE_CHAIN;
1375 basechain->policy = policy;
1376 } else {
1377 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1378 if (chain == NULL)
1379 return -ENOMEM;
1380 }
1381 INIT_LIST_HEAD(&chain->rules);
1382 chain->handle = nf_tables_alloc_handle(table);
1383 chain->table = table;
1384 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1385 if (!chain->name) {
1386 err = -ENOMEM;
1387 goto err1;
1388 }
1389
c974a3a3 1390 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1391 if (err < 0)
1392 goto err1;
1393
1394 ctx->chain = chain;
1395 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1396 if (err < 0)
1397 goto err2;
1398
1399 table->use++;
1400 list_add_tail_rcu(&chain->list, &table->chains);
1401
1402 return 0;
1403err2:
c974a3a3 1404 nf_tables_unregister_hook(net, table, chain);
4035285f
PNA		 1405err1:
1406 nf_tables_chain_destroy(chain);
1407
1408 return err;
1409}
1410
2c4a488a
PNA		 1411static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1412 bool create)
1413{
1414 const struct nlattr * const *nla = ctx->nla;
1415 struct nft_table *table = ctx->table;
1416 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1417 struct nft_base_chain *basechain;
1418 struct nft_stats *stats = NULL;
1419 struct nft_chain_hook hook;
1420 const struct nlattr *name;
1421 struct nf_hook_ops *ops;
1422 struct nft_trans *trans;
c974a3a3 1423 int err;
2c4a488a
PNA		 1424
1425 if (nla[NFTA_CHAIN_HOOK]) {
1426 if (!nft_is_base_chain(chain))
1427 return -EBUSY;
1428
36596dad 1429 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
2c4a488a
PNA		 1430 create);
1431 if (err < 0)
1432 return err;
1433
1434 basechain = nft_base_chain(chain);
1435 if (basechain->type != hook.type) {
1436 nft_chain_release_hook(&hook);
1437 return -EBUSY;
1438 }
1439
c974a3a3
PNA		 1440 ops = &basechain->ops;
1441 if (ops->hooknum != hook.num ||
1442 ops->priority != hook.priority ||
1443 ops->dev != hook.dev) {
1444 nft_chain_release_hook(&hook);
1445 return -EBUSY;
2c4a488a
PNA		 1446 }
1447 nft_chain_release_hook(&hook);
1448 }
1449
1450 if (nla[NFTA_CHAIN_HANDLE] &&
1451 nla[NFTA_CHAIN_NAME]) {
1452 struct nft_chain *chain2;
1453
1454 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
1455 genmask);
0d18779b
JC		 1456 if (!IS_ERR(chain2))
1457 return -EEXIST;
2c4a488a
PNA		 1458 }
1459
1460 if (nla[NFTA_CHAIN_COUNTERS]) {
1461 if (!nft_is_base_chain(chain))
1462 return -EOPNOTSUPP;
1463
1464 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1465 if (IS_ERR(stats))
1466 return PTR_ERR(stats);
1467 }
1468
1469 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1470 sizeof(struct nft_trans_chain));
1471 if (trans == NULL) {
1472 free_percpu(stats);
1473 return -ENOMEM;
1474 }
1475
1476 nft_trans_chain_stats(trans) = stats;
1477 nft_trans_chain_update(trans) = true;
1478
1479 if (nla[NFTA_CHAIN_POLICY])
1480 nft_trans_chain_policy(trans) = policy;
1481 else
1482 nft_trans_chain_policy(trans) = -1;
1483
1484 name = nla[NFTA_CHAIN_NAME];
1485 if (nla[NFTA_CHAIN_HANDLE] && name) {
1486 nft_trans_chain_name(trans) =
1487 nla_strdup(name, GFP_KERNEL);
1488 if (!nft_trans_chain_name(trans)) {
1489 kfree(trans);
1490 free_percpu(stats);
1491 return -ENOMEM;
1492 }
1493 }
1494 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1495
1496 return 0;
1497}
1498
633c9a84
PNA		 1499static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1500 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1501 const struct nlattr * const nla[],
1502 struct netlink_ext_ack *extack)
96518518
PM		 1503{
1504 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1505 const struct nlattr * uninitialized_var(name);
4035285f
PNA		 1506 u8 genmask = nft_genmask_next(net);
1507 int family = nfmsg->nfgen_family;
96518518
PM		 1508 struct nft_table *table;
1509 struct nft_chain *chain;
57de2a0c 1510 u8 policy = NF_ACCEPT;
4035285f 1511 struct nft_ctx ctx;
96518518 1512 u64 handle = 0;
96518518
PM		 1513 bool create;
1514
1515 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1516
98319cb9 1517 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
36596dad 1518 genmask);
96518518
PM		 1519 if (IS_ERR(table))
1520 return PTR_ERR(table);
1521
96518518
PM		 1522 chain = NULL;
1523 name = nla[NFTA_CHAIN_NAME];
1524
1525 if (nla[NFTA_CHAIN_HANDLE]) {
1526 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
664b0f8c 1527 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
96518518
PM		 1528 if (IS_ERR(chain))
1529 return PTR_ERR(chain);
1530 } else {
664b0f8c 1531 chain = nf_tables_chain_lookup(table, name, genmask);
96518518
PM		 1532 if (IS_ERR(chain)) {
1533 if (PTR_ERR(chain) != -ENOENT)
1534 return PTR_ERR(chain);
1535 chain = NULL;
1536 }
1537 }
1538
57de2a0c 1539 if (nla[NFTA_CHAIN_POLICY]) {
f323d954
PNA		 1540 if (chain != NULL &&
1541 !nft_is_base_chain(chain))
d6b6cb1d
PNA		 1542 return -EOPNOTSUPP;
1543
1544 if (chain == NULL &&
57de2a0c
PM		 1545 nla[NFTA_CHAIN_HOOK] == NULL)
1546 return -EOPNOTSUPP;
1547
8f46df18 1548 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1549 switch (policy) {
1550 case NF_DROP:
1551 case NF_ACCEPT:
1552 break;
1553 default:
1554 return -EINVAL;
1555 }
1556 }
1557
98319cb9 1558 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 1559
96518518
PM		 1560 if (chain != NULL) {
1561 if (nlh->nlmsg_flags & NLM_F_EXCL)
1562 return -EEXIST;
1563 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1564 return -EOPNOTSUPP;
1565
2c4a488a 1566 return nf_tables_updchain(&ctx, genmask, policy, create);
96518518
PM		 1567 }
1568
4035285f 1569 return nf_tables_addchain(&ctx, family, genmask, policy, create);
96518518
PM		 1570}
1571
633c9a84
PNA		 1572static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1573 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1574 const struct nlattr * const nla[],
1575 struct netlink_ext_ack *extack)
96518518
PM		 1576{
1577 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1578 u8 genmask = nft_genmask_next(net);
96518518
PM		 1579 struct nft_table *table;
1580 struct nft_chain *chain;
9dee1474 1581 struct nft_rule *rule;
96518518 1582 int family = nfmsg->nfgen_family;
91c7b38d 1583 struct nft_ctx ctx;
3ecbfd65 1584 u64 handle;
9dee1474
PNA		 1585 u32 use;
1586 int err;
96518518 1587
98319cb9 1588 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
36596dad 1589 genmask);
96518518
PM		 1590 if (IS_ERR(table))
1591 return PTR_ERR(table);
1592
3ecbfd65
HS		 1593 if (nla[NFTA_CHAIN_HANDLE]) {
1594 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1595 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
1596 } else {
1597 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1598 }
96518518
PM		 1599 if (IS_ERR(chain))
1600 return PTR_ERR(chain);
9dee1474
PNA		 1601
1602 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1603 chain->use > 0)
96518518
PM		 1604 return -EBUSY;
1605
98319cb9 1606 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 1607
9dee1474
PNA		 1608 use = chain->use;
1609 list_for_each_entry(rule, &chain->rules, list) {
1610 if (!nft_is_active_next(net, rule))
1611 continue;
1612 use--;
1613
1614 err = nft_delrule(&ctx, rule);
1615 if (err < 0)
1616 return err;
1617 }
1618
1619 /* There are rules and elements that are still holding references to us,
1620 * we cannot do a recursive removal in this case.
1621 */
1622 if (use > 0)
1623 return -EBUSY;
1624
ee01d542 1625 return nft_delchain(&ctx);
96518518
PM		 1626}
1627
96518518
PM		 1628/*
1629 * Expressions
1630 */
1631
1632/**
ef1f7df9
PM		 1633 * nft_register_expr - register nf_tables expr type
1634 * @ops: expr type
96518518 1635 *
ef1f7df9 1636 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1637 * success or a negative errno code otherwise.
1638 */
ef1f7df9 1639int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1640{
1641 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1642 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1643 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1644 else
e688a7f8 1645 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1646 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1647 return 0;
1648}
1649EXPORT_SYMBOL_GPL(nft_register_expr);
1650
1651/**
ef1f7df9
PM		 1652 * nft_unregister_expr - unregister nf_tables expr type
1653 * @ops: expr type
96518518 1654 *
ef1f7df9 1655 * Unregisters the expr typefor use with nf_tables.
96518518 1656 */
ef1f7df9 1657void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1658{
1659 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1660 list_del_rcu(&type->list);
96518518
PM		 1661 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1662}
1663EXPORT_SYMBOL_GPL(nft_unregister_expr);
1664
64d46806
PM		 1665static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1666 struct nlattr *nla)
96518518 1667{
ef1f7df9 1668 const struct nft_expr_type *type;
96518518 1669
ef1f7df9 1670 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1671 if (!nla_strcmp(nla, type->name) &&
1672 (!type->family || type->family == family))
ef1f7df9 1673 return type;
96518518
PM		 1674 }
1675 return NULL;
1676}
1677
64d46806
PM		 1678static const struct nft_expr_type *nft_expr_type_get(u8 family,
1679 struct nlattr *nla)
96518518 1680{
ef1f7df9 1681 const struct nft_expr_type *type;
96518518
PM		 1682
1683 if (nla == NULL)
1684 return ERR_PTR(-EINVAL);
1685
64d46806 1686 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1687 if (type != NULL && try_module_get(type->owner))
1688 return type;
96518518
PM		 1689
1690#ifdef CONFIG_MODULES
ef1f7df9 1691 if (type == NULL) {
64d46806
PM		 1692 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1693 request_module("nft-expr-%u-%.*s", family,
1694 nla_len(nla), (char *)nla_data(nla));
1695 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1696 if (__nft_expr_type_get(family, nla))
1697 return ERR_PTR(-EAGAIN);
1698
96518518
PM		 1699 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1700 request_module("nft-expr-%.*s",
1701 nla_len(nla), (char *)nla_data(nla));
1702 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1703 if (__nft_expr_type_get(family, nla))
96518518
PM		 1704 return ERR_PTR(-EAGAIN);
1705 }
1706#endif
1707 return ERR_PTR(-ENOENT);
1708}
1709
1710static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1711 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1712 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1713};
1714
1715static int nf_tables_fill_expr_info(struct sk_buff *skb,
1716 const struct nft_expr *expr)
1717{
ef1f7df9 1718 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1719 goto nla_put_failure;
1720
1721 if (expr->ops->dump) {
1722 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1723 if (data == NULL)
1724 goto nla_put_failure;
1725 if (expr->ops->dump(skb, expr) < 0)
1726 goto nla_put_failure;
1727 nla_nest_end(skb, data);
1728 }
1729
1730 return skb->len;
1731
1732nla_put_failure:
1733 return -1;
1734};
1735
0b2d8a7b
PM		 1736int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1737 const struct nft_expr *expr)
1738{
1739 struct nlattr *nest;
1740
1741 nest = nla_nest_start(skb, attr);
1742 if (!nest)
1743 goto nla_put_failure;
1744 if (nf_tables_fill_expr_info(skb, expr) < 0)
1745 goto nla_put_failure;
1746 nla_nest_end(skb, nest);
1747 return 0;
1748
1749nla_put_failure:
1750 return -1;
1751}
1752
96518518
PM		 1753struct nft_expr_info {
1754 const struct nft_expr_ops *ops;
ef1f7df9 1755 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1756};
1757
0ca743a5
PNA		 1758static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1759 const struct nlattr *nla,
96518518
PM		 1760 struct nft_expr_info *info)
1761{
ef1f7df9 1762 const struct nft_expr_type *type;
96518518 1763 const struct nft_expr_ops *ops;
ef1f7df9 1764 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1765 int err;
1766
fceb6435 1767 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 1768 if (err < 0)
1769 return err;
1770
36596dad 1771 type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1772 if (IS_ERR(type))
1773 return PTR_ERR(type);
1774
1775 if (tb[NFTA_EXPR_DATA]) {
1776 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 1777 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 1778 if (err < 0)
1779 goto err1;
1780 } else
1781 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1782
1783 if (type->select_ops != NULL) {
0ca743a5
PNA		 1784 ops = type->select_ops(ctx,
1785 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1786 if (IS_ERR(ops)) {
1787 err = PTR_ERR(ops);
1788 goto err1;
1789 }
1790 } else
1791 ops = type->ops;
1792
96518518
PM		 1793 info->ops = ops;
1794 return 0;
ef1f7df9
PM		 1795
1796err1:
1797 module_put(type->owner);
1798 return err;
96518518
PM		 1799}
1800
1801static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1802 const struct nft_expr_info *info,
96518518
PM		 1803 struct nft_expr *expr)
1804{
1805 const struct nft_expr_ops *ops = info->ops;
1806 int err;
1807
1808 expr->ops = ops;
1809 if (ops->init) {
ef1f7df9 1810 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1811 if (err < 0)
1812 goto err1;
1813 }
1814
c56e3956
LZ		 1815 if (ops->validate) {
1816 const struct nft_data *data = NULL;
1817
1818 err = ops->validate(ctx, expr, &data);
1819 if (err < 0)
1820 goto err2;
1821 }
1822
96518518
PM		 1823 return 0;
1824
c56e3956
LZ		 1825err2:
1826 if (ops->destroy)
1827 ops->destroy(ctx, expr);
96518518
PM		 1828err1:
1829 expr->ops = NULL;
1830 return err;
1831}
1832
62472bce
PM		 1833static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1834 struct nft_expr *expr)
96518518
PM		 1835{
1836 if (expr->ops->destroy)
62472bce 1837 expr->ops->destroy(ctx, expr);
ef1f7df9 1838 module_put(expr->ops->type->owner);
96518518
PM		 1839}
1840
0b2d8a7b
PM		 1841struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1842 const struct nlattr *nla)
1843{
1844 struct nft_expr_info info;
1845 struct nft_expr *expr;
1846 int err;
1847
1848 err = nf_tables_expr_parse(ctx, nla, &info);
1849 if (err < 0)
1850 goto err1;
1851
1852 err = -ENOMEM;
1853 expr = kzalloc(info.ops->size, GFP_KERNEL);
1854 if (expr == NULL)
1855 goto err2;
1856
1857 err = nf_tables_newexpr(ctx, &info, expr);
1858 if (err < 0)
6cafaf47 1859 goto err3;
0b2d8a7b
PM		 1860
1861 return expr;
6cafaf47
LZ		 1862err3:
1863 kfree(expr);
0b2d8a7b
PM		 1864err2:
1865 module_put(info.ops->type->owner);
1866err1:
1867 return ERR_PTR(err);
1868}
1869
1870void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1871{
1872 nf_tables_expr_destroy(ctx, expr);
1873 kfree(expr);
1874}
1875
96518518
PM		 1876/*
1877 * Rules
1878 */
1879
1880static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1881 u64 handle)
1882{
1883 struct nft_rule *rule;
1884
1885 // FIXME: this sucks
1886 list_for_each_entry(rule, &chain->rules, list) {
1887 if (handle == rule->handle)
1888 return rule;
1889 }
1890
1891 return ERR_PTR(-ENOENT);
1892}
1893
1894static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1895 const struct nlattr *nla)
1896{
1897 if (nla == NULL)
1898 return ERR_PTR(-EINVAL);
1899
1900 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1901}
1902
1903static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 1904 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1905 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1906 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1907 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1908 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1909 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1910 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1911 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1912 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1913 .len = NFT_USERDATA_MAXLEN },
96518518
PM		 1914};
1915
84d7fce6
PNA		 1916static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1917 u32 portid, u32 seq, int event,
1918 u32 flags, int family,
96518518
PM		 1919 const struct nft_table *table,
1920 const struct nft_chain *chain,
1921 const struct nft_rule *rule)
1922{
1923 struct nlmsghdr *nlh;
1924 struct nfgenmsg *nfmsg;
1925 const struct nft_expr *expr, *next;
1926 struct nlattr *list;
5e948466 1927 const struct nft_rule *prule;
dedb67c4 1928 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 1929
dedb67c4 1930 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 1931 if (nlh == NULL)
1932 goto nla_put_failure;
1933
1934 nfmsg = nlmsg_data(nlh);
1935 nfmsg->nfgen_family = family;
1936 nfmsg->version = NFNETLINK_V0;
84d7fce6 1937 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1938
1939 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1940 goto nla_put_failure;
1941 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1942 goto nla_put_failure;
b46f6ded
ND		 1943 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
1944 NFTA_RULE_PAD))
96518518
PM		 1945 goto nla_put_failure;
1946
5e948466 1947 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 1948 prule = list_prev_entry(rule, list);
5e948466 1949 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 1950 cpu_to_be64(prule->handle),
1951 NFTA_RULE_PAD))
5e948466
EL		 1952 goto nla_put_failure;
1953 }
1954
96518518
PM		 1955 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1956 if (list == NULL)
1957 goto nla_put_failure;
1958 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 1959 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 1960 goto nla_put_failure;
96518518
PM		 1961 }
1962 nla_nest_end(skb, list);
1963
86f1ec32
PM		 1964 if (rule->udata) {
1965 struct nft_userdata *udata = nft_userdata(rule);
1966 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
1967 udata->data) < 0)
1968 goto nla_put_failure;
1969 }
0768b3b3 1970
053c095a
JB		 1971 nlmsg_end(skb, nlh);
1972 return 0;
96518518
PM		 1973
1974nla_put_failure:
1975 nlmsg_trim(skb, nlh);
1976 return -1;
1977}
1978
25e94a99
PNA		 1979static void nf_tables_rule_notify(const struct nft_ctx *ctx,
1980 const struct nft_rule *rule, int event)
96518518
PM		 1981{
1982 struct sk_buff *skb;
96518518
PM		 1983 int err;
1984
128ad332
PNA		 1985 if (!ctx->report &&
1986 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1987 return;
96518518 1988
96518518
PM		 1989 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1990 if (skb == NULL)
1991 goto err;
1992
84d7fce6 1993 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1994 event, 0, ctx->family, ctx->table,
35151d84 1995 ctx->chain, rule);
96518518
PM		 1996 if (err < 0) {
1997 kfree_skb(skb);
1998 goto err;
1999 }
2000
25e94a99
PNA		 2001 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2002 ctx->report, GFP_KERNEL);
2003 return;
96518518 2004err:
25e94a99 2005 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2006}
2007
6e1f760e 2008struct nft_rule_dump_ctx {
e46abbcc 2009 char *table;
b7263e07 2010 char *chain;
6e1f760e
PNA		 2011};
2012
96518518
PM		 2013static int nf_tables_dump_rules(struct sk_buff *skb,
2014 struct netlink_callback *cb)
2015{
2016 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2017 const struct nft_rule_dump_ctx *ctx = cb->data;
96518518
PM		 2018 const struct nft_table *table;
2019 const struct nft_chain *chain;
2020 const struct nft_rule *rule;
2021 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 2022 struct net *net = sock_net(skb->sk);
96518518
PM		 2023 int family = nfmsg->nfgen_family;
2024
e688a7f8 2025 rcu_read_lock();
38e029f1
PNA		 2026 cb->seq = net->nft.base_seq;
2027
36596dad 2028 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2029 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2030 continue;
2031
2032 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2033 continue;
2034
36596dad
PNA		 2035 list_for_each_entry_rcu(chain, &table->chains, list) {
2036 if (ctx && ctx->chain &&
2037 strcmp(ctx->chain, chain->name) != 0)
6e1f760e
PNA		 2038 continue;
2039
36596dad
PNA		 2040 list_for_each_entry_rcu(rule, &chain->rules, list) {
2041 if (!nft_is_active(net, rule))
2042 goto cont;
2043 if (idx < s_idx)
2044 goto cont;
2045 if (idx > s_idx)
2046 memset(&cb->args[1], 0,
2047 sizeof(cb->args) - sizeof(cb->args[0]));
2048 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2049 cb->nlh->nlmsg_seq,
2050 NFT_MSG_NEWRULE,
2051 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 2052 table->family,
36596dad
PNA		 2053 table, chain, rule) < 0)
2054 goto done;
2055
2056 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 2057cont:
36596dad 2058 idx++;
96518518
PM		 2059 }
2060 }
2061 }
2062done:
e688a7f8
PNA		 2063 rcu_read_unlock();
2064
96518518
PM		 2065 cb->args[0] = idx;
2066 return skb->len;
2067}
2068
6e1f760e
PNA		 2069static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2070{
e46abbcc
PS		 2071 struct nft_rule_dump_ctx *ctx = cb->data;
2072
2073 if (ctx) {
2074 kfree(ctx->table);
b7263e07 2075 kfree(ctx->chain);
e46abbcc
PS		 2076 kfree(ctx);
2077 }
6e1f760e
PNA		 2078 return 0;
2079}
2080
7b8002a1
PNA		 2081static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2082 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2083 const struct nlattr * const nla[],
2084 struct netlink_ext_ack *extack)
96518518
PM		 2085{
2086 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2087 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2088 const struct nft_table *table;
2089 const struct nft_chain *chain;
2090 const struct nft_rule *rule;
2091 struct sk_buff *skb2;
2092 int family = nfmsg->nfgen_family;
2093 int err;
2094
2095 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2096 struct netlink_dump_control c = {
2097 .dump = nf_tables_dump_rules,
6e1f760e 2098 .done = nf_tables_dump_rules_done,
96518518 2099 };
6e1f760e
PNA		 2100
2101 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2102 struct nft_rule_dump_ctx *ctx;
2103
2104 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2105 if (!ctx)
2106 return -ENOMEM;
2107
e46abbcc
PS		 2108 if (nla[NFTA_RULE_TABLE]) {
2109 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2110 GFP_KERNEL);
2111 if (!ctx->table) {
2112 kfree(ctx);
2113 return -ENOMEM;
2114 }
2115 }
b7263e07
PS		 2116 if (nla[NFTA_RULE_CHAIN]) {
2117 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2118 GFP_KERNEL);
2119 if (!ctx->chain) {
2120 kfree(ctx->table);
2121 kfree(ctx);
2122 return -ENOMEM;
2123 }
2124 }
6e1f760e
PNA		 2125 c.data = ctx;
2126 }
2127
96518518
PM		 2128 return netlink_dump_start(nlsk, skb, nlh, &c);
2129 }
2130
98319cb9 2131 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
36596dad 2132 genmask);
96518518
PM		 2133 if (IS_ERR(table))
2134 return PTR_ERR(table);
2135
664b0f8c 2136 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2137 if (IS_ERR(chain))
2138 return PTR_ERR(chain);
2139
2140 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2141 if (IS_ERR(rule))
2142 return PTR_ERR(rule);
2143
2144 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2145 if (!skb2)
2146 return -ENOMEM;
2147
84d7fce6 2148 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2149 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2150 family, table, chain, rule);
2151 if (err < 0)
2152 goto err;
2153
2154 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2155
2156err:
2157 kfree_skb(skb2);
2158 return err;
2159}
2160
62472bce
PM		 2161static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2162 struct nft_rule *rule)
96518518 2163{
96518518
PM		 2164 struct nft_expr *expr;
2165
2166 /*
2167 * Careful: some expressions might not be initialized in case this
2168 * is called on error from nf_tables_newrule().
2169 */
2170 expr = nft_expr_first(rule);
3e38df13 2171 while (expr != nft_expr_last(rule) && expr->ops) {
62472bce 2172 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 2173 expr = nft_expr_next(expr);
2174 }
2175 kfree(rule);
2176}
2177
1081d11b
PNA		 2178#define NFT_RULE_MAXEXPRS 128
2179
2180static struct nft_expr_info *info;
2181
633c9a84
PNA		 2182static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2183 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2184 const struct nlattr * const nla[],
2185 struct netlink_ext_ack *extack)
96518518
PM		 2186{
2187 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2188 u8 genmask = nft_genmask_next(net);
98319cb9 2189 int family = nfmsg->nfgen_family;
96518518
PM		 2190 struct nft_table *table;
2191 struct nft_chain *chain;
2192 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2193 struct nft_userdata *udata;
1081d11b 2194 struct nft_trans *trans = NULL;
96518518
PM		 2195 struct nft_expr *expr;
2196 struct nft_ctx ctx;
2197 struct nlattr *tmp;
86f1ec32 2198 unsigned int size, i, n, ulen = 0, usize = 0;
96518518
PM		 2199 int err, rem;
2200 bool create;
5e948466 2201 u64 handle, pos_handle;
96518518
PM		 2202
2203 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2204
98319cb9 2205 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
36596dad 2206 genmask);
96518518
PM		 2207 if (IS_ERR(table))
2208 return PTR_ERR(table);
2209
664b0f8c 2210 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2211 if (IS_ERR(chain))
2212 return PTR_ERR(chain);
2213
2214 if (nla[NFTA_RULE_HANDLE]) {
2215 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2216 rule = __nf_tables_rule_lookup(chain, handle);
2217 if (IS_ERR(rule))
2218 return PTR_ERR(rule);
2219
2220 if (nlh->nlmsg_flags & NLM_F_EXCL)
2221 return -EEXIST;
2222 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2223 old_rule = rule;
2224 else
2225 return -EOPNOTSUPP;
2226 } else {
2227 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2228 return -EINVAL;
2229 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2230
2231 if (chain->use == UINT_MAX)
2232 return -EOVERFLOW;
96518518
PM		 2233 }
2234
5e948466
EL		 2235 if (nla[NFTA_RULE_POSITION]) {
2236 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2237 return -EOPNOTSUPP;
2238
2239 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2240 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
2241 if (IS_ERR(old_rule))
2242 return PTR_ERR(old_rule);
2243 }
2244
98319cb9 2245 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 2246
96518518
PM		 2247 n = 0;
2248 size = 0;
2249 if (nla[NFTA_RULE_EXPRESSIONS]) {
2250 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2251 err = -EINVAL;
2252 if (nla_type(tmp) != NFTA_LIST_ELEM)
2253 goto err1;
2254 if (n == NFT_RULE_MAXEXPRS)
2255 goto err1;
0ca743a5 2256 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2257 if (err < 0)
2258 goto err1;
2259 size += info[n].ops->size;
2260 n++;
2261 }
2262 }
9889840f
PM		 2263 /* Check for overflow of dlen field */
2264 err = -EFBIG;
2265 if (size >= 1 << 12)
2266 goto err1;
96518518 2267
86f1ec32 2268 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2269 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2270 if (ulen > 0)
2271 usize = sizeof(struct nft_userdata) + ulen;
2272 }
0768b3b3 2273
96518518 2274 err = -ENOMEM;
86f1ec32 2275 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2276 if (rule == NULL)
2277 goto err1;
2278
889f7ee7 2279 nft_activate_next(net, rule);
0628b123 2280
96518518
PM		 2281 rule->handle = handle;
2282 rule->dlen = size;
86f1ec32 2283 rule->udata = ulen ? 1 : 0;
0768b3b3 2284
86f1ec32
PM		 2285 if (ulen) {
2286 udata = nft_userdata(rule);
2287 udata->len = ulen - 1;
2288 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2289 }
96518518 2290
96518518
PM		 2291 expr = nft_expr_first(rule);
2292 for (i = 0; i < n; i++) {
2293 err = nf_tables_newexpr(&ctx, &info[i], expr);
2294 if (err < 0)
2295 goto err2;
ef1f7df9 2296 info[i].ops = NULL;
96518518
PM		 2297 expr = nft_expr_next(expr);
2298 }
2299
96518518 2300 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
889f7ee7 2301 if (nft_is_active_next(net, old_rule)) {
ac904ac8 2302 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
b380e5c7 2303 old_rule);
1081d11b 2304 if (trans == NULL) {
0628b123
PNA		 2305 err = -ENOMEM;
2306 goto err2;
2307 }
889f7ee7 2308 nft_deactivate_next(net, old_rule);
ac34b861 2309 chain->use--;
5bc5c307 2310 list_add_tail_rcu(&rule->list, &old_rule->list);
0628b123
PNA		 2311 } else {
2312 err = -ENOENT;
2313 goto err2;
2314 }
96518518 2315 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 2316 if (old_rule)
2317 list_add_rcu(&rule->list, &old_rule->list);
2318 else
2319 list_add_tail_rcu(&rule->list, &chain->rules);
2320 else {
2321 if (old_rule)
2322 list_add_tail_rcu(&rule->list, &old_rule->list);
2323 else
2324 list_add_rcu(&rule->list, &chain->rules);
2325 }
96518518 2326
b380e5c7 2327 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 2328 err = -ENOMEM;
2329 goto err3;
2330 }
4fefee57 2331 chain->use++;
96518518
PM		 2332 return 0;
2333
0628b123
PNA		 2334err3:
2335 list_del_rcu(&rule->list);
96518518 2336err2:
62472bce 2337 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 2338err1:
2339 for (i = 0; i < n; i++) {
2340 if (info[i].ops != NULL)
ef1f7df9 2341 module_put(info[i].ops->type->owner);
96518518
PM		 2342 }
2343 return err;
2344}
2345
1a94e38d
PNA		 2346static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2347 const struct nlattr *nla)
2348{
2349 u32 id = ntohl(nla_get_be32(nla));
2350 struct nft_trans *trans;
2351
2352 list_for_each_entry(trans, &net->nft.commit_list, list) {
2353 struct nft_rule *rule = nft_trans_rule(trans);
2354
2355 if (trans->msg_type == NFT_MSG_NEWRULE &&
2356 id == nft_trans_rule_id(trans))
2357 return rule;
2358 }
2359 return ERR_PTR(-ENOENT);
2360}
2361
633c9a84
PNA		 2362static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2363 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2364 const struct nlattr * const nla[],
2365 struct netlink_ext_ack *extack)
96518518
PM		 2366{
2367 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2368 u8 genmask = nft_genmask_next(net);
7c95f6d8 2369 struct nft_table *table;
cf9dc09d
PNA		 2370 struct nft_chain *chain = NULL;
2371 struct nft_rule *rule;
0628b123
PNA		 2372 int family = nfmsg->nfgen_family, err = 0;
2373 struct nft_ctx ctx;
96518518 2374
98319cb9 2375 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
36596dad 2376 genmask);
96518518
PM		 2377 if (IS_ERR(table))
2378 return PTR_ERR(table);
2379
cf9dc09d 2380 if (nla[NFTA_RULE_CHAIN]) {
664b0f8c
PNA		 2381 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN],
2382 genmask);
cf9dc09d
PNA		 2383 if (IS_ERR(chain))
2384 return PTR_ERR(chain);
2385 }
96518518 2386
98319cb9 2387 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 2388
cf9dc09d
PNA		 2389 if (chain) {
2390 if (nla[NFTA_RULE_HANDLE]) {
2391 rule = nf_tables_rule_lookup(chain,
2392 nla[NFTA_RULE_HANDLE]);
2393 if (IS_ERR(rule))
2394 return PTR_ERR(rule);
96518518 2395
1a94e38d
PNA		 2396 err = nft_delrule(&ctx, rule);
2397 } else if (nla[NFTA_RULE_ID]) {
2398 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2399 if (IS_ERR(rule))
2400 return PTR_ERR(rule);
2401
5e266fe7 2402 err = nft_delrule(&ctx, rule);
cf9dc09d 2403 } else {
ce24b721 2404 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2405 }
2406 } else {
2407 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2408 if (!nft_is_active_next(net, chain))
2409 continue;
2410
cf9dc09d 2411 ctx.chain = chain;
ce24b721 2412 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2413 if (err < 0)
2414 break;
2415 }
2416 }
2417
2418 return err;
2419}
2420
20a69341
PM		 2421/*
2422 * Sets
2423 */
2424
2b664957 2425static LIST_HEAD(nf_tables_set_types);
20a69341 2426
2b664957 2427int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2428{
2429 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2430 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2431 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2432 return 0;
2433}
2434EXPORT_SYMBOL_GPL(nft_register_set);
2435
2b664957 2436void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2437{
2438 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2439 list_del_rcu(&type->list);
20a69341
PM		 2440 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2441}
2442EXPORT_SYMBOL_GPL(nft_unregister_set);
2443
2b664957
PNA		 2444#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2445 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
2446
2447static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
2448{
2449 return (flags & ops->features) == (flags & NFT_SET_FEATURES);
2450}
2451
c50b960c
PM		 2452/*
2453 * Select a set implementation based on the data characteristics and the
2454 * given policy. The total memory use might not be known if no size is
2455 * given, in that case the amount of memory per element is used.
2456 */
2457static const struct nft_set_ops *
2b664957
PNA		 2458nft_select_set_ops(const struct nft_ctx *ctx,
2459 const struct nlattr * const nla[],
c50b960c
PM		 2460 const struct nft_set_desc *desc,
2461 enum nft_set_policies policy)
20a69341 2462{
c50b960c
PM		 2463 const struct nft_set_ops *ops, *bops;
2464 struct nft_set_estimate est, best;
2b664957
PNA		 2465 const struct nft_set_type *type;
2466 u32 flags = 0;
20a69341
PM		 2467
2468#ifdef CONFIG_MODULES
2b664957 2469 if (list_empty(&nf_tables_set_types)) {
20a69341
PM		 2470 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2471 request_module("nft-set");
2472 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2473 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2474 return ERR_PTR(-EAGAIN);
2475 }
2476#endif
2b664957
PNA		 2477 if (nla[NFTA_SET_FLAGS] != NULL)
2478 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2479
55af753c
PNA		 2480 bops = NULL;
2481 best.size = ~0;
2482 best.lookup = ~0;
0b5a7874 2483 best.space = ~0;
c50b960c 2484
2b664957
PNA		 2485 list_for_each_entry(type, &nf_tables_set_types, list) {
2486 if (!type->select_ops)
2487 ops = type->ops;
2488 else
2489 ops = type->select_ops(ctx, desc, flags);
2490 if (!ops)
2491 continue;
2492
2493 if (!nft_set_ops_candidate(ops, flags))
20a69341 2494 continue;
2b664957 2495 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2496 continue;
2497
2498 switch (policy) {
2499 case NFT_SET_POL_PERFORMANCE:
55af753c 2500 if (est.lookup < best.lookup)
c50b960c 2501 break;
644e334e
PNA		 2502 if (est.lookup == best.lookup &&
2503 est.space < best.space)
2504 break;
c50b960c
PM		 2505 continue;
2506 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2507 if (!desc->size) {
2508 if (est.space < best.space)
2509 break;
2510 if (est.space == best.space &&
2511 est.lookup < best.lookup)
2512 break;
2513 } else if (est.size < best.size) {
c50b960c 2514 break;
0b5a7874 2515 }
c50b960c
PM		 2516 continue;
2517 default:
2518 break;
2519 }
2520
2b664957 2521 if (!try_module_get(type->owner))
20a69341 2522 continue;
c50b960c 2523 if (bops != NULL)
2b664957 2524 module_put(bops->type->owner);
c50b960c
PM		 2525
2526 bops = ops;
2527 best = est;
20a69341
PM		 2528 }
2529
c50b960c
PM		 2530 if (bops != NULL)
2531 return bops;
2532
20a69341
PM		 2533 return ERR_PTR(-EOPNOTSUPP);
2534}
2535
2536static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2537 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2538 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2539 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2540 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2541 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2542 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2543 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2544 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2545 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2546 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2547 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2548 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2549 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2550 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2551 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2552 .len = NFT_USERDATA_MAXLEN },
8aeff920 2553 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 2554 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 2555};
2556
2557static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2558 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2559};
2560
633c9a84 2561static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2562 const struct sk_buff *skb,
2563 const struct nlmsghdr *nlh,
f2a6d766
PNA		 2564 const struct nlattr * const nla[],
2565 u8 genmask)
20a69341
PM		 2566{
2567 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 2568 int family = nfmsg->nfgen_family;
7c95f6d8 2569 struct nft_table *table = NULL;
20a69341 2570
20a69341 2571 if (nla[NFTA_SET_TABLE] != NULL) {
36596dad 2572 table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
98319cb9 2573 family, genmask);
20a69341
PM		 2574 if (IS_ERR(table))
2575 return PTR_ERR(table);
2576 }
2577
98319cb9 2578 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 2579 return 0;
2580}
2581
c7a72e3f
PNA		 2582static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2583 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2584{
2585 struct nft_set *set;
2586
2587 if (nla == NULL)
2588 return ERR_PTR(-EINVAL);
2589
2590 list_for_each_entry(set, &table->sets, list) {
37a9cc52
PNA		 2591 if (!nla_strcmp(nla, set->name) &&
2592 nft_active_genmask(set, genmask))
20a69341
PM		 2593 return set;
2594 }
2595 return ERR_PTR(-ENOENT);
2596}
2597
3ecbfd65
HS		 2598static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *table,
2599 const struct nlattr *nla, u8 genmask)
2600{
2601 struct nft_set *set;
2602
2603 if (nla == NULL)
2604 return ERR_PTR(-EINVAL);
2605
2606 list_for_each_entry(set, &table->sets, list) {
2607 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2608 nft_active_genmask(set, genmask))
2609 return set;
2610 }
2611 return ERR_PTR(-ENOENT);
2612}
2613
c7a72e3f
PNA		 2614static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2615 const struct nlattr *nla,
2616 u8 genmask)
958bee14
PNA		 2617{
2618 struct nft_trans *trans;
2619 u32 id = ntohl(nla_get_be32(nla));
2620
2621 list_for_each_entry(trans, &net->nft.commit_list, list) {
37a9cc52
PNA		 2622 struct nft_set *set = nft_trans_set(trans);
2623
958bee14 2624 if (trans->msg_type == NFT_MSG_NEWSET &&
37a9cc52
PNA		 2625 id == nft_trans_set_id(trans) &&
2626 nft_active_genmask(set, genmask))
2627 return set;
958bee14
PNA		 2628 }
2629 return ERR_PTR(-ENOENT);
2630}
c7a72e3f
PNA		 2631
2632struct nft_set *nft_set_lookup(const struct net *net,
2633 const struct nft_table *table,
2634 const struct nlattr *nla_set_name,
2635 const struct nlattr *nla_set_id,
2636 u8 genmask)
2637{
2638 struct nft_set *set;
2639
2640 set = nf_tables_set_lookup(table, nla_set_name, genmask);
2641 if (IS_ERR(set)) {
2642 if (!nla_set_id)
2643 return set;
2644
2645 set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
2646 }
2647 return set;
2648}
2649EXPORT_SYMBOL_GPL(nft_set_lookup);
958bee14 2650
20a69341
PM		 2651static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2652 const char *name)
2653{
2654 const struct nft_set *i;
2655 const char *p;
2656 unsigned long *inuse;
60eb1894 2657 unsigned int n = 0, min = 0;
20a69341 2658
38745490 2659 p = strchr(name, '%');
20a69341
PM		 2660 if (p != NULL) {
2661 if (p[1] != 'd' || strchr(p + 2, '%'))
2662 return -EINVAL;
2663
2664 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2665 if (inuse == NULL)
2666 return -ENOMEM;
60eb1894 2667cont:
20a69341 2668 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2669 int tmp;
2670
37a9cc52
PNA		 2671 if (!nft_is_active_next(ctx->net, set))
2672 continue;
14662917 2673 if (!sscanf(i->name, name, &tmp))
20a69341 2674 continue;
60eb1894 2675 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2676 continue;
14662917 2677
60eb1894 2678 set_bit(tmp - min, inuse);
20a69341
PM		 2679 }
2680
53b70287 2681 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2682 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2683 min += BITS_PER_BYTE * PAGE_SIZE;
2684 memset(inuse, 0, PAGE_SIZE);
2685 goto cont;
2686 }
20a69341
PM		 2687 free_page((unsigned long)inuse);
2688 }
2689
38745490
PS		 2690 set->name = kasprintf(GFP_KERNEL, name, min + n);
2691 if (!set->name)
2692 return -ENOMEM;
2693
20a69341 2694 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 2695 if (!nft_is_active_next(ctx->net, i))
2696 continue;
e63aaaa6
AY		 2697 if (!strcmp(set->name, i->name)) {
2698 kfree(set->name);
20a69341 2699 return -ENFILE;
e63aaaa6 2700 }
20a69341
PM		 2701 }
2702 return 0;
2703}
2704
2705static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2706 const struct nft_set *set, u16 event, u16 flags)
2707{
2708 struct nfgenmsg *nfmsg;
2709 struct nlmsghdr *nlh;
c50b960c 2710 struct nlattr *desc;
128ad332
PNA		 2711 u32 portid = ctx->portid;
2712 u32 seq = ctx->seq;
20a69341 2713
dedb67c4 2714 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 2715 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2716 flags);
2717 if (nlh == NULL)
2718 goto nla_put_failure;
2719
2720 nfmsg = nlmsg_data(nlh);
36596dad 2721 nfmsg->nfgen_family = ctx->family;
20a69341 2722 nfmsg->version = NFNETLINK_V0;
84d7fce6 2723 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 2724
2725 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2726 goto nla_put_failure;
2727 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2728 goto nla_put_failure;
3ecbfd65
HS		 2729 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
2730 NFTA_SET_PAD))
2731 goto nla_put_failure;
20a69341
PM		 2732 if (set->flags != 0)
2733 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2734 goto nla_put_failure;
2735
2736 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2737 goto nla_put_failure;
2738 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2739 goto nla_put_failure;
2740 if (set->flags & NFT_SET_MAP) {
2741 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2742 goto nla_put_failure;
2743 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2744 goto nla_put_failure;
2745 }
8aeff920
PNA		 2746 if (set->flags & NFT_SET_OBJECT &&
2747 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2748 goto nla_put_failure;
20a69341 2749
761da293 2750 if (set->timeout &&
d3e2a111
AP		 2751 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2752 cpu_to_be64(jiffies_to_msecs(set->timeout)),
b46f6ded 2753 NFTA_SET_PAD))
761da293
PM		 2754 goto nla_put_failure;
2755 if (set->gc_int &&
2756 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2757 goto nla_put_failure;
2758
9363dc4b
AB		 2759 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2760 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2761 goto nla_put_failure;
2762 }
2763
e6d8ecac
CFG		 2764 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2765 goto nla_put_failure;
2766
c50b960c
PM		 2767 desc = nla_nest_start(skb, NFTA_SET_DESC);
2768 if (desc == NULL)
2769 goto nla_put_failure;
2770 if (set->size &&
2771 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2772 goto nla_put_failure;
2773 nla_nest_end(skb, desc);
2774
053c095a
JB		 2775 nlmsg_end(skb, nlh);
2776 return 0;
20a69341
PM		 2777
2778nla_put_failure:
2779 nlmsg_trim(skb, nlh);
2780 return -1;
2781}
2782
25e94a99
PNA		 2783static void nf_tables_set_notify(const struct nft_ctx *ctx,
2784 const struct nft_set *set, int event,
2785 gfp_t gfp_flags)
20a69341
PM		 2786{
2787 struct sk_buff *skb;
128ad332 2788 u32 portid = ctx->portid;
20a69341
PM		 2789 int err;
2790
128ad332
PNA		 2791 if (!ctx->report &&
2792 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2793 return;
20a69341 2794
31f8441c 2795 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 2796 if (skb == NULL)
2797 goto err;
2798
2799 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2800 if (err < 0) {
2801 kfree_skb(skb);
2802 goto err;
2803 }
2804
25e94a99
PNA		 2805 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2806 gfp_flags);
2807 return;
20a69341 2808err:
25e94a99 2809 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 2810}
2811
5b96af77 2812static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 2813{
2814 const struct nft_set *set;
2815 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 2816 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2817 struct net *net = sock_net(skb->sk);
5b96af77 2818 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 2819
2820 if (cb->args[1])
2821 return skb->len;
2822
e688a7f8 2823 rcu_read_lock();
38e029f1
PNA		 2824 cb->seq = net->nft.base_seq;
2825
36596dad
PNA		 2826 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2827 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 2828 ctx->family != table->family)
36596dad
PNA		 2829 continue;
2830
2831 if (ctx->table && ctx->table != table)
5b96af77
PNA		 2832 continue;
2833
36596dad
PNA		 2834 if (cur_table) {
2835 if (cur_table != table)
c9c8e485
PNA		 2836 continue;
2837
36596dad 2838 cur_table = NULL;
c9c8e485 2839 }
36596dad
PNA		 2840 idx = 0;
2841 list_for_each_entry_rcu(set, &table->sets, list) {
2842 if (idx < s_idx)
2843 goto cont;
2844 if (!nft_is_active(net, set))
2845 goto cont;
5b96af77 2846
36596dad
PNA		 2847 ctx_set = *ctx;
2848 ctx_set.table = table;
98319cb9 2849 ctx_set.family = table->family;
c9c8e485 2850
36596dad
PNA		 2851 if (nf_tables_fill_set(skb, &ctx_set, set,
2852 NFT_MSG_NEWSET,
2853 NLM_F_MULTI) < 0) {
2854 cb->args[0] = idx;
2855 cb->args[2] = (unsigned long) table;
2856 goto done;
c9c8e485 2857 }
36596dad 2858 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 2859cont:
36596dad 2860 idx++;
c9c8e485 2861 }
36596dad
PNA		 2862 if (s_idx)
2863 s_idx = 0;
c9c8e485
PNA		 2864 }
2865 cb->args[1] = 1;
2866done:
e688a7f8 2867 rcu_read_unlock();
c9c8e485
PNA		 2868 return skb->len;
2869}
2870
5b96af77 2871static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 2872{
5b96af77
PNA		 2873 kfree(cb->data);
2874 return 0;
20a69341
PM		 2875}
2876
7b8002a1
PNA		 2877static int nf_tables_getset(struct net *net, struct sock *nlsk,
2878 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2879 const struct nlattr * const nla[],
2880 struct netlink_ext_ack *extack)
20a69341 2881{
f2a6d766 2882 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 2883 const struct nft_set *set;
2884 struct nft_ctx ctx;
2885 struct sk_buff *skb2;
c9c8e485 2886 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2887 int err;
2888
01cfa0a4 2889 /* Verify existence before starting dump */
f2a6d766 2890 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 2891 if (err < 0)
2892 return err;
2893
2894 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2895 struct netlink_dump_control c = {
2896 .dump = nf_tables_dump_sets,
5b96af77 2897 .done = nf_tables_dump_sets_done,
20a69341 2898 };
5b96af77
PNA		 2899 struct nft_ctx *ctx_dump;
2900
2901 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2902 if (ctx_dump == NULL)
2903 return -ENOMEM;
2904
2905 *ctx_dump = ctx;
2906 c.data = ctx_dump;
2907
20a69341
PM		 2908 return netlink_dump_start(nlsk, skb, nlh, &c);
2909 }
2910
c9c8e485
PNA		 2911 /* Only accept unspec with dump */
2912 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2913 return -EAFNOSUPPORT;
eaa2bcd6
PT		 2914 if (!nla[NFTA_SET_TABLE])
2915 return -EINVAL;
c9c8e485 2916
37a9cc52 2917 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 2918 if (IS_ERR(set))
2919 return PTR_ERR(set);
2920
2921 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2922 if (skb2 == NULL)
2923 return -ENOMEM;
2924
2925 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2926 if (err < 0)
2927 goto err;
2928
2929 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2930
2931err:
2932 kfree_skb(skb2);
2933 return err;
2934}
2935
c50b960c
PM		 2936static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2937 struct nft_set_desc *desc,
2938 const struct nlattr *nla)
2939{
2940 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2941 int err;
2942
fceb6435
JB		 2943 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
2944 nft_set_desc_policy, NULL);
c50b960c
PM		 2945 if (err < 0)
2946 return err;
2947
2948 if (da[NFTA_SET_DESC_SIZE] != NULL)
2949 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
2950
2951 return 0;
2952}
2953
633c9a84
PNA		 2954static int nf_tables_newset(struct net *net, struct sock *nlsk,
2955 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2956 const struct nlattr * const nla[],
2957 struct netlink_ext_ack *extack)
20a69341
PM		 2958{
2959 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2960 u8 genmask = nft_genmask_next(net);
98319cb9 2961 int family = nfmsg->nfgen_family;
20a69341 2962 const struct nft_set_ops *ops;
20a69341
PM		 2963 struct nft_table *table;
2964 struct nft_set *set;
2965 struct nft_ctx ctx;
38745490 2966 char *name;
20a69341
PM		 2967 unsigned int size;
2968 bool create;
761da293 2969 u64 timeout;
8aeff920 2970 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 2971 struct nft_set_desc desc;
e6d8ecac
CFG		 2972 unsigned char *udata;
2973 u16 udlen;
20a69341
PM		 2974 int err;
2975
2976 if (nla[NFTA_SET_TABLE] == NULL ||
2977 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 2978 nla[NFTA_SET_KEY_LEN] == NULL ||
2979 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 2980 return -EINVAL;
2981
c50b960c
PM		 2982 memset(&desc, 0, sizeof(desc));
2983
20a69341
PM		 2984 ktype = NFT_DATA_VALUE;
2985 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
2986 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
2987 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
2988 return -EINVAL;
2989 }
2990
c50b960c 2991 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 2992 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 2993 return -EINVAL;
2994
2995 flags = 0;
2996 if (nla[NFTA_SET_FLAGS] != NULL) {
2997 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2998 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 2999 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3000 NFT_SET_MAP | NFT_SET_EVAL |
3001 NFT_SET_OBJECT))
20a69341 3002 return -EINVAL;
8aeff920
PNA		 3003 /* Only one of these operations is supported */
3004 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3005 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3006 return -EOPNOTSUPP;
20a69341
PM		 3007 }
3008
3009 dtype = 0;
20a69341
PM		 3010 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3011 if (!(flags & NFT_SET_MAP))
3012 return -EINVAL;
3013
3014 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3015 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3016 dtype != NFT_DATA_VERDICT)
3017 return -EINVAL;
3018
3019 if (dtype != NFT_DATA_VERDICT) {
3020 if (nla[NFTA_SET_DATA_LEN] == NULL)
3021 return -EINVAL;
c50b960c 3022 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3023 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3024 return -EINVAL;
3025 } else
7d740264 3026 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3027 } else if (flags & NFT_SET_MAP)
3028 return -EINVAL;
3029
8aeff920
PNA		 3030 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3031 if (!(flags & NFT_SET_OBJECT))
3032 return -EINVAL;
3033
3034 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3035 if (objtype == NFT_OBJECT_UNSPEC ||
3036 objtype > NFT_OBJECT_MAX)
3037 return -EINVAL;
3038 } else if (flags & NFT_SET_OBJECT)
3039 return -EINVAL;
3040 else
3041 objtype = NFT_OBJECT_UNSPEC;
3042
761da293
PM		 3043 timeout = 0;
3044 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3045 if (!(flags & NFT_SET_TIMEOUT))
3046 return -EINVAL;
d3e2a111
AP		 3047 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3048 nla[NFTA_SET_TIMEOUT])));
761da293
PM		 3049 }
3050 gc_int = 0;
3051 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3052 if (!(flags & NFT_SET_TIMEOUT))
3053 return -EINVAL;
3054 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3055 }
3056
c50b960c
PM		 3057 policy = NFT_SET_POL_PERFORMANCE;
3058 if (nla[NFTA_SET_POLICY] != NULL)
3059 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3060
3061 if (nla[NFTA_SET_DESC] != NULL) {
3062 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3063 if (err < 0)
3064 return err;
3065 }
3066
20a69341
PM		 3067 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3068
98319cb9 3069 table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], family,
36596dad 3070 genmask);
20a69341
PM		 3071 if (IS_ERR(table))
3072 return PTR_ERR(table);
3073
98319cb9 3074 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3075
37a9cc52 3076 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3077 if (IS_ERR(set)) {
3078 if (PTR_ERR(set) != -ENOENT)
3079 return PTR_ERR(set);
1a28ad74 3080 } else {
20a69341
PM		 3081 if (nlh->nlmsg_flags & NLM_F_EXCL)
3082 return -EEXIST;
3083 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3084 return -EOPNOTSUPP;
3085 return 0;
3086 }
3087
3088 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3089 return -ENOENT;
3090
2b664957 3091 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3092 if (IS_ERR(ops))
3093 return PTR_ERR(ops);
3094
e6d8ecac
CFG		 3095 udlen = 0;
3096 if (nla[NFTA_SET_USERDATA])
3097 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3098
20a69341
PM		 3099 size = 0;
3100 if (ops->privsize != NULL)
347b408d 3101 size = ops->privsize(nla, &desc);
20a69341 3102
1ff75a3e
PNA		 3103 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3104 if (!set) {
3105 err = -ENOMEM;
20a69341 3106 goto err1;
1ff75a3e 3107 }
20a69341 3108
38745490
PS		 3109 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3110 if (!name) {
3111 err = -ENOMEM;
3112 goto err2;
3113 }
3114
20a69341 3115 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3116 kfree(name);
20a69341
PM		 3117 if (err < 0)
3118 goto err2;
3119
e6d8ecac
CFG		 3120 udata = NULL;
3121 if (udlen) {
3122 udata = set->data + size;
3123 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3124 }
3125
20a69341
PM		 3126 INIT_LIST_HEAD(&set->bindings);
3127 set->ops = ops;
3128 set->ktype = ktype;
c50b960c 3129 set->klen = desc.klen;
20a69341 3130 set->dtype = dtype;
8aeff920 3131 set->objtype = objtype;
c50b960c 3132 set->dlen = desc.dlen;
20a69341 3133 set->flags = flags;
c50b960c 3134 set->size = desc.size;
9363dc4b 3135 set->policy = policy;
e6d8ecac
CFG		 3136 set->udlen = udlen;
3137 set->udata = udata;
761da293
PM		 3138 set->timeout = timeout;
3139 set->gc_int = gc_int;
3ecbfd65 3140 set->handle = nf_tables_alloc_handle(table);
20a69341 3141
c50b960c 3142 err = ops->init(set, &desc, nla);
20a69341
PM		 3143 if (err < 0)
3144 goto err2;
3145
958bee14 3146 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3147 if (err < 0)
c17c3cdf 3148 goto err3;
20a69341 3149
e688a7f8 3150 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3151 table->use++;
20a69341
PM		 3152 return 0;
3153
c17c3cdf
LZ		 3154err3:
3155 ops->destroy(set);
20a69341 3156err2:
1ff75a3e 3157 kvfree(set);
20a69341 3158err1:
2b664957 3159 module_put(ops->type->owner);
20a69341
PM		 3160 return err;
3161}
3162
958bee14 3163static void nft_set_destroy(struct nft_set *set)
20a69341 3164{
20a69341 3165 set->ops->destroy(set);
2b664957 3166 module_put(set->ops->type->owner);
38745490 3167 kfree(set->name);
1ff75a3e 3168 kvfree(set);
20a69341
PM		 3169}
3170
958bee14
PNA		 3171static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3172{
e688a7f8 3173 list_del_rcu(&set->list);
31f8441c 3174 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
958bee14
PNA		 3175 nft_set_destroy(set);
3176}
3177
633c9a84
PNA		 3178static int nf_tables_delset(struct net *net, struct sock *nlsk,
3179 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3180 const struct nlattr * const nla[],
3181 struct netlink_ext_ack *extack)
20a69341 3182{
c9c8e485 3183 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3184 u8 genmask = nft_genmask_next(net);
20a69341
PM		 3185 struct nft_set *set;
3186 struct nft_ctx ctx;
3187 int err;
3188
ec2c9935
PM		 3189 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3190 return -EAFNOSUPPORT;
20a69341
PM		 3191 if (nla[NFTA_SET_TABLE] == NULL)
3192 return -EINVAL;
3193
f2a6d766 3194 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 3195 if (err < 0)
3196 return err;
3197
3ecbfd65
HS		 3198 if (nla[NFTA_SET_HANDLE])
3199 set = nf_tables_set_lookup_byhandle(ctx.table, nla[NFTA_SET_HANDLE], genmask);
3200 else
3201 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3202 if (IS_ERR(set))
3203 return PTR_ERR(set);
a8278400
PNA		 3204
3205 if (!list_empty(&set->bindings) ||
3206 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0))
20a69341
PM		 3207 return -EBUSY;
3208
ee01d542 3209 return nft_delset(&ctx, set);
20a69341
PM		 3210}
3211
3212static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3213 struct nft_set *set,
20a69341 3214 const struct nft_set_iter *iter,
de70185d 3215 struct nft_set_elem *elem)
20a69341 3216{
fe2811eb 3217 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3218 enum nft_registers dreg;
3219
3220 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3221 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3222 set->dtype == NFT_DATA_VERDICT ?
3223 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3224 set->dlen);
20a69341
PM		 3225}
3226
3227int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3228 struct nft_set_binding *binding)
3229{
3230 struct nft_set_binding *i;
3231 struct nft_set_iter iter;
3232
408070d6 3233 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3234 return -EBUSY;
3235
11113e19 3236 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3237 /* If the set is already bound to the same chain all
3238 * jumps are already validated for that chain.
3239 */
3240 list_for_each_entry(i, &set->bindings, list) {
a4684402 3241 if (i->flags & NFT_SET_MAP &&
11113e19 3242 i->chain == binding->chain)
20a69341
PM		 3243 goto bind;
3244 }
3245
8588ac09 3246 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3247 iter.skip = 0;
3248 iter.count = 0;
3249 iter.err = 0;
3250 iter.fn = nf_tables_bind_check_setelem;
3251
3252 set->ops->walk(ctx, set, &iter);
a02f4248 3253 if (iter.err < 0)
20a69341 3254 return iter.err;
20a69341
PM		 3255 }
3256bind:
3257 binding->chain = ctx->chain;
e688a7f8 3258 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3259 return 0;
3260}
63aea290 3261EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341
PM		 3262
3263void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3264 struct nft_set_binding *binding)
3265{
e688a7f8 3266 list_del_rcu(&binding->list);
20a69341 3267
408070d6 3268 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
37a9cc52 3269 nft_is_active(ctx->net, set))
20a69341
PM		 3270 nf_tables_set_destroy(ctx, set);
3271}
63aea290 3272EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3273
3ac4c07a
PM		 3274const struct nft_set_ext_type nft_set_ext_types[] = {
3275 [NFT_SET_EXT_KEY] = {
7d740264 3276 .align = __alignof__(u32),
3ac4c07a
PM		 3277 },
3278 [NFT_SET_EXT_DATA] = {
7d740264 3279 .align = __alignof__(u32),
3ac4c07a 3280 },
f25ad2e9
PM		 3281 [NFT_SET_EXT_EXPR] = {
3282 .align = __alignof__(struct nft_expr),
3283 },
8aeff920
PNA		 3284 [NFT_SET_EXT_OBJREF] = {
3285 .len = sizeof(struct nft_object *),
3286 .align = __alignof__(struct nft_object *),
3287 },
3ac4c07a
PM		 3288 [NFT_SET_EXT_FLAGS] = {
3289 .len = sizeof(u8),
3290 .align = __alignof__(u8),
3291 },
c3e1b005
PM		 3292 [NFT_SET_EXT_TIMEOUT] = {
3293 .len = sizeof(u64),
3294 .align = __alignof__(u64),
3295 },
3296 [NFT_SET_EXT_EXPIRATION] = {
3297 .len = sizeof(unsigned long),
3298 .align = __alignof__(unsigned long),
3299 },
68e942e8
PM		 3300 [NFT_SET_EXT_USERDATA] = {
3301 .len = sizeof(struct nft_userdata),
3302 .align = __alignof__(struct nft_userdata),
3303 },
3ac4c07a
PM		 3304};
3305EXPORT_SYMBOL_GPL(nft_set_ext_types);
3306
20a69341
PM		 3307/*
3308 * Set elements
3309 */
3310
3311static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3312 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3313 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3314 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3315 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3316 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3317 .len = NFT_USERDATA_MAXLEN },
20a69341
PM		 3318};
3319
3320static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3321 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3322 .len = NFT_TABLE_MAXNAMELEN - 1 },
3323 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3324 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3325 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3326 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3327};
3328
633c9a84 3329static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3330 const struct sk_buff *skb,
3331 const struct nlmsghdr *nlh,
f2a6d766
PNA		 3332 const struct nlattr * const nla[],
3333 u8 genmask)
20a69341
PM		 3334{
3335 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3336 int family = nfmsg->nfgen_family;
7c95f6d8 3337 struct nft_table *table;
20a69341 3338
36596dad 3339 table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
98319cb9 3340 family, genmask);
20a69341
PM		 3341 if (IS_ERR(table))
3342 return PTR_ERR(table);
3343
98319cb9 3344 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3345 return 0;
3346}
3347
3348static int nf_tables_fill_setelem(struct sk_buff *skb,
3349 const struct nft_set *set,
3350 const struct nft_set_elem *elem)
3351{
fe2811eb 3352 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3353 unsigned char *b = skb_tail_pointer(skb);
3354 struct nlattr *nest;
3355
3356 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3357 if (nest == NULL)
3358 goto nla_put_failure;
3359
fe2811eb
PM		 3360 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3361 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3362 goto nla_put_failure;
3363
fe2811eb
PM		 3364 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3365 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3366 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3367 set->dlen) < 0)
3368 goto nla_put_failure;
3369
f25ad2e9
PM		 3370 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3371 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3372 goto nla_put_failure;
3373
8aeff920
PNA		 3374 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3375 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3376 (*nft_set_ext_obj(ext))->name) < 0)
3377 goto nla_put_failure;
3378
fe2811eb
PM		 3379 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3380 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3381 htonl(*nft_set_ext_flags(ext))))
3382 goto nla_put_failure;
20a69341 3383
c3e1b005
PM		 3384 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3385 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
d3e2a111
AP		 3386 cpu_to_be64(jiffies_to_msecs(
3387 *nft_set_ext_timeout(ext))),
b46f6ded 3388 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3389 goto nla_put_failure;
3390
3391 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3392 unsigned long expires, now = jiffies;
3393
3394 expires = *nft_set_ext_expiration(ext);
3395 if (time_before(now, expires))
3396 expires -= now;
3397 else
3398 expires = 0;
3399
3400 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
b46f6ded
ND		 3401 cpu_to_be64(jiffies_to_msecs(expires)),
3402 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3403 goto nla_put_failure;
3404 }
3405
68e942e8
PM		 3406 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3407 struct nft_userdata *udata;
3408
3409 udata = nft_set_ext_userdata(ext);
3410 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3411 udata->len + 1, udata->data))
3412 goto nla_put_failure;
3413 }
3414
20a69341
PM		 3415 nla_nest_end(skb, nest);
3416 return 0;
3417
3418nla_put_failure:
3419 nlmsg_trim(skb, b);
3420 return -EMSGSIZE;
3421}
3422
3423struct nft_set_dump_args {
3424 const struct netlink_callback *cb;
3425 struct nft_set_iter iter;
3426 struct sk_buff *skb;
3427};
3428
3429static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3430 struct nft_set *set,
20a69341 3431 const struct nft_set_iter *iter,
de70185d 3432 struct nft_set_elem *elem)
20a69341
PM		 3433{
3434 struct nft_set_dump_args *args;
3435
3436 args = container_of(iter, struct nft_set_dump_args, iter);
3437 return nf_tables_fill_setelem(args->skb, set, elem);
3438}
3439
fa803605
LZ		 3440struct nft_set_dump_ctx {
3441 const struct nft_set *set;
3442 struct nft_ctx ctx;
3443};
3444
20a69341
PM		 3445static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3446{
fa803605 3447 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3448 struct net *net = sock_net(skb->sk);
fa803605 3449 struct nft_table *table;
de70185d 3450 struct nft_set *set;
20a69341 3451 struct nft_set_dump_args args;
fa803605 3452 bool set_found = false;
20a69341
PM		 3453 struct nfgenmsg *nfmsg;
3454 struct nlmsghdr *nlh;
3455 struct nlattr *nest;
3456 u32 portid, seq;
fa803605 3457 int event;
20a69341 3458
fa803605 3459 rcu_read_lock();
36596dad
PNA		 3460 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3461 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 3462 dump_ctx->ctx.family != table->family)
fa803605 3463 continue;
20a69341 3464
36596dad
PNA		 3465 if (table != dump_ctx->ctx.table)
3466 continue;
20a69341 3467
36596dad
PNA		 3468 list_for_each_entry_rcu(set, &table->sets, list) {
3469 if (set == dump_ctx->set) {
3470 set_found = true;
3471 break;
fa803605 3472 }
fa803605
LZ		 3473 }
3474 break;
3475 }
3476
3477 if (!set_found) {
3478 rcu_read_unlock();
3479 return -ENOENT;
3480 }
20a69341 3481
dedb67c4 3482 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3483 portid = NETLINK_CB(cb->skb).portid;
3484 seq = cb->nlh->nlmsg_seq;
3485
3486 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3487 NLM_F_MULTI);
3488 if (nlh == NULL)
3489 goto nla_put_failure;
3490
3491 nfmsg = nlmsg_data(nlh);
98319cb9 3492 nfmsg->nfgen_family = table->family;
20a69341 3493 nfmsg->version = NFNETLINK_V0;
fa803605 3494 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3495
fa803605 3496 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3497 goto nla_put_failure;
3498 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3499 goto nla_put_failure;
3500
3501 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3502 if (nest == NULL)
3503 goto nla_put_failure;
3504
8588ac09
PNA		 3505 args.cb = cb;
3506 args.skb = skb;
fa803605 3507 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3508 args.iter.skip = cb->args[0];
3509 args.iter.count = 0;
3510 args.iter.err = 0;
3511 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3512 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3513 rcu_read_unlock();
20a69341
PM		 3514
3515 nla_nest_end(skb, nest);
3516 nlmsg_end(skb, nlh);
3517
3518 if (args.iter.err && args.iter.err != -EMSGSIZE)
3519 return args.iter.err;
3520 if (args.iter.count == cb->args[0])
3521 return 0;
3522
3523 cb->args[0] = args.iter.count;
3524 return skb->len;
3525
3526nla_put_failure:
fa803605 3527 rcu_read_unlock();
20a69341
PM		 3528 return -ENOSPC;
3529}
3530
fa803605
LZ		 3531static int nf_tables_dump_set_done(struct netlink_callback *cb)
3532{
3533 kfree(cb->data);
3534 return 0;
3535}
3536
d60ce62f
AB		 3537static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3538 const struct nft_ctx *ctx, u32 seq,
3539 u32 portid, int event, u16 flags,
3540 const struct nft_set *set,
3541 const struct nft_set_elem *elem)
3542{
3543 struct nfgenmsg *nfmsg;
3544 struct nlmsghdr *nlh;
3545 struct nlattr *nest;
3546 int err;
3547
dedb67c4 3548 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 3549 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3550 flags);
3551 if (nlh == NULL)
3552 goto nla_put_failure;
3553
3554 nfmsg = nlmsg_data(nlh);
36596dad 3555 nfmsg->nfgen_family = ctx->family;
d60ce62f 3556 nfmsg->version = NFNETLINK_V0;
84d7fce6 3557 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 3558
3559 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3560 goto nla_put_failure;
3561 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3562 goto nla_put_failure;
3563
3564 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3565 if (nest == NULL)
3566 goto nla_put_failure;
3567
3568 err = nf_tables_fill_setelem(skb, set, elem);
3569 if (err < 0)
3570 goto nla_put_failure;
3571
3572 nla_nest_end(skb, nest);
3573
053c095a
JB		 3574 nlmsg_end(skb, nlh);
3575 return 0;
d60ce62f
AB		 3576
3577nla_put_failure:
3578 nlmsg_trim(skb, nlh);
3579 return -1;
3580}
3581
ba0e4d99
PNA		 3582static int nft_setelem_parse_flags(const struct nft_set *set,
3583 const struct nlattr *attr, u32 *flags)
3584{
3585 if (attr == NULL)
3586 return 0;
3587
3588 *flags = ntohl(nla_get_be32(attr));
3589 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3590 return -EINVAL;
3591 if (!(set->flags & NFT_SET_INTERVAL) &&
3592 *flags & NFT_SET_ELEM_INTERVAL_END)
3593 return -EINVAL;
3594
3595 return 0;
3596}
3597
3598static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3599 const struct nlattr *attr)
3600{
3601 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3602 const struct nft_set_ext *ext;
3603 struct nft_data_desc desc;
3604 struct nft_set_elem elem;
3605 struct sk_buff *skb;
3606 uint32_t flags = 0;
3607 void *priv;
3608 int err;
3609
3610 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3611 nft_set_elem_policy, NULL);
3612 if (err < 0)
3613 return err;
3614
3615 if (!nla[NFTA_SET_ELEM_KEY])
3616 return -EINVAL;
3617
3618 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3619 if (err < 0)
3620 return err;
3621
3622 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3623 nla[NFTA_SET_ELEM_KEY]);
3624 if (err < 0)
3625 return err;
3626
3627 err = -EINVAL;
3628 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3629 return err;
3630
3631 priv = set->ops->get(ctx->net, set, &elem, flags);
3632 if (IS_ERR(priv))
3633 return PTR_ERR(priv);
3634
3635 elem.priv = priv;
3636 ext = nft_set_elem_ext(set, &elem);
3637
3638 err = -ENOMEM;
3639 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3640 if (skb == NULL)
3641 goto err1;
3642
3643 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3644 NFT_MSG_NEWSETELEM, 0, set, &elem);
3645 if (err < 0)
3646 goto err2;
3647
3648 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3649 /* This avoids a loop in nfnetlink. */
3650 if (err < 0)
3651 goto err1;
3652
3653 return 0;
3654err2:
3655 kfree_skb(skb);
3656err1:
3657 /* this avoids a loop in nfnetlink. */
3658 return err == -EAGAIN ? -ENOBUFS : err;
3659}
3660
3661static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3662 struct sk_buff *skb, const struct nlmsghdr *nlh,
3663 const struct nlattr * const nla[],
3664 struct netlink_ext_ack *extack)
3665{
3666 u8 genmask = nft_genmask_cur(net);
3667 struct nft_set *set;
3668 struct nlattr *attr;
3669 struct nft_ctx ctx;
3670 int rem, err = 0;
3671
3672 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
3673 if (err < 0)
3674 return err;
3675
3676 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
3677 genmask);
3678 if (IS_ERR(set))
3679 return PTR_ERR(set);
3680
3681 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3682 struct netlink_dump_control c = {
3683 .dump = nf_tables_dump_set,
3684 .done = nf_tables_dump_set_done,
3685 };
3686 struct nft_set_dump_ctx *dump_ctx;
3687
3688 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3689 if (!dump_ctx)
3690 return -ENOMEM;
3691
3692 dump_ctx->set = set;
3693 dump_ctx->ctx = ctx;
3694
3695 c.data = dump_ctx;
3696 return netlink_dump_start(nlsk, skb, nlh, &c);
3697 }
3698
3699 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3700 return -EINVAL;
3701
3702 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3703 err = nft_get_set_elem(&ctx, set, attr);
3704 if (err < 0)
3705 break;
3706 }
3707
3708 return err;
3709}
3710
25e94a99
PNA		 3711static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3712 const struct nft_set *set,
3713 const struct nft_set_elem *elem,
3714 int event, u16 flags)
d60ce62f 3715{
128ad332
PNA		 3716 struct net *net = ctx->net;
3717 u32 portid = ctx->portid;
d60ce62f
AB		 3718 struct sk_buff *skb;
3719 int err;
3720
128ad332 3721 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 3722 return;
d60ce62f 3723
d60ce62f
AB		 3724 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3725 if (skb == NULL)
3726 goto err;
3727
3728 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3729 set, elem);
3730 if (err < 0) {
3731 kfree_skb(skb);
3732 goto err;
3733 }
3734
25e94a99
PNA		 3735 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3736 GFP_KERNEL);
3737 return;
d60ce62f 3738err:
25e94a99 3739 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 3740}
3741
60319eb1
PNA		 3742static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3743 int msg_type,
3744 struct nft_set *set)
3745{
3746 struct nft_trans *trans;
3747
3748 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3749 if (trans == NULL)
3750 return NULL;
3751
3752 nft_trans_elem_set(trans) = set;
3753 return trans;
3754}
3755
22fe54d5
PM		 3756void *nft_set_elem_init(const struct nft_set *set,
3757 const struct nft_set_ext_tmpl *tmpl,
49499c3e 3758 const u32 *key, const u32 *data,
22fe54d5 3759 u64 timeout, gfp_t gfp)
fe2811eb
PM		 3760{
3761 struct nft_set_ext *ext;
3762 void *elem;
3763
3764 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3765 if (elem == NULL)
3766 return NULL;
3767
3768 ext = nft_set_elem_ext(set, elem);
3769 nft_set_ext_init(ext, tmpl);
3770
3771 memcpy(nft_set_ext_key(ext), key, set->klen);
3772 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3773 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 3774 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3775 *nft_set_ext_expiration(ext) =
d3e2a111 3776 jiffies + timeout;
c3e1b005
PM		 3777 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3778 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 3779
3780 return elem;
3781}
3782
61f9e292
LZ		 3783void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3784 bool destroy_expr)
61edafbb
PM		 3785{
3786 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3787
59105446 3788 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 3789 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 3790 nft_data_release(nft_set_ext_data(ext), set->dtype);
61f9e292 3791 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
f25ad2e9 3792 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
8aeff920
PNA		 3793 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3794 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 3795 kfree(elem);
3796}
3797EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3798
59105446
PNA		 3799/* Only called from commit path, nft_set_elem_deactivate() already deals with
3800 * the refcounting from the preparation phase.
3801 */
3802static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3803{
3804 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3805
3806 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3807 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3808 kfree(elem);
3809}
3810
60319eb1 3811static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 3812 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 3813{
3814 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 3815 u8 genmask = nft_genmask_next(ctx->net);
20a69341 3816 struct nft_data_desc d1, d2;
fe2811eb 3817 struct nft_set_ext_tmpl tmpl;
c016c7e4 3818 struct nft_set_ext *ext, *ext2;
20a69341
PM		 3819 struct nft_set_elem elem;
3820 struct nft_set_binding *binding;
8aeff920 3821 struct nft_object *obj = NULL;
68e942e8 3822 struct nft_userdata *udata;
fe2811eb 3823 struct nft_data data;
20a69341 3824 enum nft_registers dreg;
60319eb1 3825 struct nft_trans *trans;
0e9091d6 3826 u32 flags = 0;
c3e1b005 3827 u64 timeout;
68e942e8 3828 u8 ulen;
20a69341
PM		 3829 int err;
3830
3831 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 3832 nft_set_elem_policy, NULL);
20a69341
PM		 3833 if (err < 0)
3834 return err;
3835
3836 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3837 return -EINVAL;
3838
fe2811eb
PM		 3839 nft_set_ext_prepare(&tmpl);
3840
0e9091d6
PNA		 3841 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3842 if (err < 0)
3843 return err;
3844 if (flags != 0)
3845 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 3846
3847 if (set->flags & NFT_SET_MAP) {
3848 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 3849 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 3850 return -EINVAL;
bd7fc645 3851 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 3852 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 3853 return -EINVAL;
20a69341
PM		 3854 } else {
3855 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3856 return -EINVAL;
3857 }
3858
c3e1b005
PM		 3859 timeout = 0;
3860 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3861 if (!(set->flags & NFT_SET_TIMEOUT))
3862 return -EINVAL;
d3e2a111
AP		 3863 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3864 nla[NFTA_SET_ELEM_TIMEOUT])));
c3e1b005
PM		 3865 } else if (set->flags & NFT_SET_TIMEOUT) {
3866 timeout = set->timeout;
3867 }
3868
7d740264 3869 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 3870 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 3871 if (err < 0)
3872 goto err1;
3873 err = -EINVAL;
3874 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3875 goto err2;
3876
7d740264 3877 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 3878 if (timeout > 0) {
3879 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
3880 if (timeout != set->timeout)
3881 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
3882 }
fe2811eb 3883
8aeff920
PNA		 3884 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
3885 if (!(set->flags & NFT_SET_OBJECT)) {
3886 err = -EINVAL;
3887 goto err2;
3888 }
3889 obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
3890 set->objtype, genmask);
3891 if (IS_ERR(obj)) {
3892 err = PTR_ERR(obj);
3893 goto err2;
3894 }
3895 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
3896 }
3897
20a69341 3898 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 3899 err = nft_data_init(ctx, &data, sizeof(data), &d2,
3900 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 3901 if (err < 0)
3902 goto err2;
3903
3904 err = -EINVAL;
3905 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3906 goto err3;
3907
3908 dreg = nft_type_to_reg(set->dtype);
3909 list_for_each_entry(binding, &set->bindings, list) {
3910 struct nft_ctx bind_ctx = {
58c78e10 3911 .net = ctx->net,
36596dad 3912 .family = ctx->family,
20a69341 3913 .table = ctx->table,
7c95f6d8 3914 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 3915 };
3916
11113e19
PM		 3917 if (!(binding->flags & NFT_SET_MAP))
3918 continue;
3919
1ec10212
PM		 3920 err = nft_validate_register_store(&bind_ctx, dreg,
3921 &data,
3922 d2.type, d2.len);
20a69341
PM		 3923 if (err < 0)
3924 goto err3;
3925 }
fe2811eb 3926
7d740264 3927 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 3928 }
3929
68e942e8
PM		 3930 /* The full maximum length of userdata can exceed the maximum
3931 * offset value (U8_MAX) for following extensions, therefor it
3932 * must be the last extension added.
3933 */
3934 ulen = 0;
3935 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
3936 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
3937 if (ulen > 0)
3938 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
3939 ulen);
3940 }
3941
fe2811eb 3942 err = -ENOMEM;
7d740264 3943 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 3944 timeout, GFP_KERNEL);
fe2811eb
PM		 3945 if (elem.priv == NULL)
3946 goto err3;
3947
3948 ext = nft_set_elem_ext(set, elem.priv);
3949 if (flags)
3950 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 3951 if (ulen > 0) {
3952 udata = nft_set_ext_userdata(ext);
3953 udata->len = ulen - 1;
3954 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
3955 }
8aeff920
PNA		 3956 if (obj) {
3957 *nft_set_ext_obj(ext) = obj;
3958 obj->use++;
3959 }
fe2811eb 3960
60319eb1
PNA		 3961 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
3962 if (trans == NULL)
fe2811eb 3963 goto err4;
60319eb1 3964
69086658 3965 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 3966 err = set->ops->insert(ctx->net, set, &elem, &ext2);
3967 if (err) {
3968 if (err == -EEXIST) {
9744a6fc
PNA		 3969 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
3970 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
3971 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
3972 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
3973 return -EBUSY;
8aeff920
PNA		 3974 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3975 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
3976 memcmp(nft_set_ext_data(ext),
3977 nft_set_ext_data(ext2), set->dlen) != 0) ||
3978 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3979 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
3980 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 3981 err = -EBUSY;
3982 else if (!(nlmsg_flags & NLM_F_EXCL))
3983 err = 0;
3984 }
fe2811eb 3985 goto err5;
c016c7e4 3986 }
20a69341 3987
35d0ac90
PNA		 3988 if (set->size &&
3989 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
3990 err = -ENFILE;
3991 goto err6;
3992 }
3993
60319eb1 3994 nft_trans_elem(trans) = elem;
46bbafce 3995 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 3996 return 0;
3997
35d0ac90 3998err6:
5cb82a38 3999 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4000err5:
60319eb1 4001 kfree(trans);
fe2811eb
PM		 4002err4:
4003 kfree(elem.priv);
20a69341
PM		 4004err3:
4005 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4006 nft_data_release(&data, d2.type);
20a69341 4007err2:
59105446 4008 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4009err1:
4010 return err;
4011}
4012
633c9a84
PNA		 4013static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4014 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4015 const struct nlattr * const nla[],
4016 struct netlink_ext_ack *extack)
20a69341 4017{
f2a6d766 4018 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4019 const struct nlattr *attr;
4020 struct nft_set *set;
4021 struct nft_ctx ctx;
60319eb1 4022 int rem, err = 0;
20a69341 4023
7d5570ca
PNA		 4024 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4025 return -EINVAL;
4026
f2a6d766 4027 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 4028 if (err < 0)
4029 return err;
4030
37a9cc52
PNA		 4031 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4032 genmask);
958bee14
PNA		 4033 if (IS_ERR(set)) {
4034 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
4035 set = nf_tables_set_lookup_byid(net,
37a9cc52
PNA		 4036 nla[NFTA_SET_ELEM_LIST_SET_ID],
4037 genmask);
958bee14
PNA		 4038 }
4039 if (IS_ERR(set))
4040 return PTR_ERR(set);
4041 }
4042
20a69341
PM		 4043 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4044 return -EBUSY;
4045
4046 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4047 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4048 if (err < 0)
60319eb1 4049 break;
20a69341 4050 }
60319eb1 4051 return err;
20a69341
PM		 4052}
4053
59105446
PNA		 4054/**
4055 * nft_data_hold - hold a nft_data item
4056 *
4057 * @data: struct nft_data to release
4058 * @type: type of data
4059 *
4060 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4061 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4062 * NFT_GOTO verdicts. This function must be called on active data objects
4063 * from the second phase of the commit protocol.
4064 */
4065static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4066{
4067 if (type == NFT_DATA_VERDICT) {
4068 switch (data->verdict.code) {
4069 case NFT_JUMP:
4070 case NFT_GOTO:
4071 data->verdict.chain->use++;
4072 break;
4073 }
4074 }
4075}
4076
4077static void nft_set_elem_activate(const struct net *net,
4078 const struct nft_set *set,
4079 struct nft_set_elem *elem)
4080{
4081 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4082
4083 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4084 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4085 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4086 (*nft_set_ext_obj(ext))->use++;
4087}
4088
4089static void nft_set_elem_deactivate(const struct net *net,
4090 const struct nft_set *set,
4091 struct nft_set_elem *elem)
4092{
4093 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4094
4095 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4096 nft_data_release(nft_set_ext_data(ext), set->dtype);
4097 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4098 (*nft_set_ext_obj(ext))->use--;
4099}
4100
60319eb1 4101static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4102 const struct nlattr *attr)
4103{
4104 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4105 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4106 struct nft_data_desc desc;
4107 struct nft_set_elem elem;
3971ca14 4108 struct nft_set_ext *ext;
60319eb1 4109 struct nft_trans *trans;
3971ca14
PNA		 4110 u32 flags = 0;
4111 void *priv;
20a69341
PM		 4112 int err;
4113
4114 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4115 nft_set_elem_policy, NULL);
20a69341
PM		 4116 if (err < 0)
4117 goto err1;
4118
4119 err = -EINVAL;
4120 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4121 goto err1;
4122
3971ca14
PNA		 4123 nft_set_ext_prepare(&tmpl);
4124
4125 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4126 if (err < 0)
4127 return err;
4128 if (flags != 0)
4129 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4130
7d740264 4131 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4132 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4133 if (err < 0)
4134 goto err1;
4135
4136 err = -EINVAL;
4137 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4138 goto err2;
4139
3971ca14
PNA		 4140 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4141
4142 err = -ENOMEM;
4143 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4144 GFP_KERNEL);
4145 if (elem.priv == NULL)
4146 goto err2;
4147
4148 ext = nft_set_elem_ext(set, elem.priv);
4149 if (flags)
4150 *nft_set_ext_flags(ext) = flags;
4151
60319eb1 4152 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4153 if (trans == NULL) {
4154 err = -ENOMEM;
3971ca14 4155 goto err3;
609ccf08 4156 }
20a69341 4157
42a55769 4158 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4159 if (priv == NULL) {
cc02e457 4160 err = -ENOENT;
3971ca14 4161 goto err4;
cc02e457 4162 }
3971ca14
PNA		 4163 kfree(elem.priv);
4164 elem.priv = priv;
cc02e457 4165
59105446
PNA		 4166 nft_set_elem_deactivate(ctx->net, set, &elem);
4167
60319eb1 4168 nft_trans_elem(trans) = elem;
46bbafce 4169 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4170 return 0;
cc02e457 4171
3971ca14 4172err4:
cc02e457 4173 kfree(trans);
3971ca14
PNA		 4174err3:
4175 kfree(elem.priv);
20a69341 4176err2:
59105446 4177 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4178err1:
4179 return err;
4180}
4181
8411b644 4182static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4183 struct nft_set *set,
8411b644 4184 const struct nft_set_iter *iter,
de70185d 4185 struct nft_set_elem *elem)
8411b644
PNA		 4186{
4187 struct nft_trans *trans;
4188 int err;
4189
4190 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4191 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4192 if (!trans)
4193 return -ENOMEM;
4194
1ba1c414 4195 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4196 err = -ENOENT;
4197 goto err1;
4198 }
b2c11e4b 4199 set->ndeact++;
8411b644 4200
de70185d
PNA		 4201 nft_trans_elem_set(trans) = set;
4202 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4203 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4204
4205 return 0;
4206err1:
4207 kfree(trans);
4208 return err;
4209}
4210
633c9a84
PNA		 4211static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4212 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4213 const struct nlattr * const nla[],
4214 struct netlink_ext_ack *extack)
20a69341 4215{
f2a6d766 4216 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4217 const struct nlattr *attr;
4218 struct nft_set *set;
4219 struct nft_ctx ctx;
60319eb1 4220 int rem, err = 0;
20a69341 4221
f2a6d766 4222 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 4223 if (err < 0)
4224 return err;
4225
37a9cc52
PNA		 4226 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4227 genmask);
20a69341
PM		 4228 if (IS_ERR(set))
4229 return PTR_ERR(set);
4230 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4231 return -EBUSY;
4232
8411b644 4233 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4234 struct nft_set_iter iter = {
4235 .genmask = genmask,
4236 .fn = nft_flush_set,
8411b644 4237 };
baa2d42c 4238 set->ops->walk(&ctx, set, &iter);
8411b644 4239
baa2d42c 4240 return iter.err;
8411b644
PNA		 4241 }
4242
20a69341
PM		 4243 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4244 err = nft_del_setelem(&ctx, set, attr);
4245 if (err < 0)
60319eb1 4246 break;
4fefee57 4247
3dd0673a 4248 set->ndeact++;
20a69341 4249 }
60319eb1 4250 return err;
20a69341
PM		 4251}
4252
cfed7e1b
PM		 4253void nft_set_gc_batch_release(struct rcu_head *rcu)
4254{
4255 struct nft_set_gc_batch *gcb;
4256 unsigned int i;
4257
4258 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4259 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4260 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4261 kfree(gcb);
4262}
4263EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4264
4265struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4266 gfp_t gfp)
4267{
4268 struct nft_set_gc_batch *gcb;
4269
4270 gcb = kzalloc(sizeof(*gcb), gfp);
4271 if (gcb == NULL)
4272 return gcb;
4273 gcb->head.set = set;
4274 return gcb;
4275}
4276EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4277
e5009240
PNA		 4278/*
4279 * Stateful objects
4280 */
4281
4282/**
4283 * nft_register_obj- register nf_tables stateful object type
4284 * @obj: object type
4285 *
4286 * Registers the object type for use with nf_tables. Returns zero on
4287 * success or a negative errno code otherwise.
4288 */
4289int nft_register_obj(struct nft_object_type *obj_type)
4290{
4291 if (obj_type->type == NFT_OBJECT_UNSPEC)
4292 return -EINVAL;
4293
4294 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4295 list_add_rcu(&obj_type->list, &nf_tables_objects);
4296 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4297 return 0;
4298}
4299EXPORT_SYMBOL_GPL(nft_register_obj);
4300
4301/**
4302 * nft_unregister_obj - unregister nf_tables object type
4303 * @obj: object type
4304 *
4305 * Unregisters the object type for use with nf_tables.
4306 */
4307void nft_unregister_obj(struct nft_object_type *obj_type)
4308{
4309 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4310 list_del_rcu(&obj_type->list);
4311 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4312}
4313EXPORT_SYMBOL_GPL(nft_unregister_obj);
4314
4315struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
4316 const struct nlattr *nla,
4317 u32 objtype, u8 genmask)
4318{
4319 struct nft_object *obj;
4320
4321 list_for_each_entry(obj, &table->objects, list) {
4322 if (!nla_strcmp(nla, obj->name) &&
dfc46034 4323 objtype == obj->ops->type->type &&
e5009240
PNA		 4324 nft_active_genmask(obj, genmask))
4325 return obj;
4326 }
4327 return ERR_PTR(-ENOENT);
4328}
4329EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
4330
ae0662f8 4331static struct nft_object *nf_tables_obj_lookup_byhandle(const struct nft_table *table,
4332 const struct nlattr *nla,
4333 u32 objtype, u8 genmask)
3ecbfd65
HS		 4334{
4335 struct nft_object *obj;
4336
4337 list_for_each_entry(obj, &table->objects, list) {
4338 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4339 objtype == obj->ops->type->type &&
4340 nft_active_genmask(obj, genmask))
4341 return obj;
4342 }
4343 return ERR_PTR(-ENOENT);
4344}
4345
e5009240 4346static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4347 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4348 .len = NFT_TABLE_MAXNAMELEN - 1 },
4349 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4350 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4351 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4352 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 4353 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 4354};
4355
84fba055
FW		 4356static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4357 const struct nft_object_type *type,
e5009240
PNA		 4358 const struct nlattr *attr)
4359{
4360 struct nlattr *tb[type->maxattr + 1];
dfc46034 4361 const struct nft_object_ops *ops;
e5009240
PNA		 4362 struct nft_object *obj;
4363 int err;
4364
4365 if (attr) {
fceb6435
JB		 4366 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4367 NULL);
e5009240
PNA		 4368 if (err < 0)
4369 goto err1;
4370 } else {
4371 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4372 }
4373
dfc46034
PBG		 4374 if (type->select_ops) {
4375 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4376 if (IS_ERR(ops)) {
4377 err = PTR_ERR(ops);
4378 goto err1;
4379 }
4380 } else {
4381 ops = type->ops;
4382 }
4383
e5009240 4384 err = -ENOMEM;
dfc46034 4385 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
e5009240
PNA		 4386 if (obj == NULL)
4387 goto err1;
4388
dfc46034 4389 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240
PNA		 4390 if (err < 0)
4391 goto err2;
4392
dfc46034
PBG		 4393 obj->ops = ops;
4394
e5009240
PNA		 4395 return obj;
4396err2:
4397 kfree(obj);
4398err1:
4399 return ERR_PTR(err);
4400}
4401
4402static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4403 struct nft_object *obj, bool reset)
e5009240
PNA		 4404{
4405 struct nlattr *nest;
4406
4407 nest = nla_nest_start(skb, attr);
4408 if (!nest)
4409 goto nla_put_failure;
dfc46034 4410 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 4411 goto nla_put_failure;
4412 nla_nest_end(skb, nest);
4413 return 0;
4414
4415nla_put_failure:
4416 return -1;
4417}
4418
4419static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4420{
4421 const struct nft_object_type *type;
4422
4423 list_for_each_entry(type, &nf_tables_objects, list) {
4424 if (objtype == type->type)
4425 return type;
4426 }
4427 return NULL;
4428}
4429
4430static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4431{
4432 const struct nft_object_type *type;
4433
4434 type = __nft_obj_type_get(objtype);
4435 if (type != NULL && try_module_get(type->owner))
4436 return type;
4437
4438#ifdef CONFIG_MODULES
4439 if (type == NULL) {
4440 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4441 request_module("nft-obj-%u", objtype);
4442 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4443 if (__nft_obj_type_get(objtype))
4444 return ERR_PTR(-EAGAIN);
4445 }
4446#endif
4447 return ERR_PTR(-ENOENT);
4448}
4449
4450static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4451 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4452 const struct nlattr * const nla[],
4453 struct netlink_ext_ack *extack)
e5009240
PNA		 4454{
4455 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4456 const struct nft_object_type *type;
4457 u8 genmask = nft_genmask_next(net);
4458 int family = nfmsg->nfgen_family;
e5009240
PNA		 4459 struct nft_table *table;
4460 struct nft_object *obj;
4461 struct nft_ctx ctx;
4462 u32 objtype;
4463 int err;
4464
4465 if (!nla[NFTA_OBJ_TYPE] ||
4466 !nla[NFTA_OBJ_NAME] ||
4467 !nla[NFTA_OBJ_DATA])
4468 return -EINVAL;
4469
98319cb9 4470 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
36596dad 4471 genmask);
e5009240
PNA		 4472 if (IS_ERR(table))
4473 return PTR_ERR(table);
4474
4475 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4476 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4477 if (IS_ERR(obj)) {
4478 err = PTR_ERR(obj);
4479 if (err != -ENOENT)
4480 return err;
4481
1a28ad74 4482 } else {
e5009240
PNA		 4483 if (nlh->nlmsg_flags & NLM_F_EXCL)
4484 return -EEXIST;
4485
4486 return 0;
4487 }
4488
98319cb9 4489 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 4490
4491 type = nft_obj_type_get(objtype);
4492 if (IS_ERR(type))
4493 return PTR_ERR(type);
4494
84fba055 4495 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 4496 if (IS_ERR(obj)) {
4497 err = PTR_ERR(obj);
4498 goto err1;
4499 }
18965317 4500 obj->table = table;
3ecbfd65
HS		 4501 obj->handle = nf_tables_alloc_handle(table);
4502
61509575
PS		 4503 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4504 if (!obj->name) {
4505 err = -ENOMEM;
4506 goto err2;
4507 }
e5009240
PNA		 4508
4509 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4510 if (err < 0)
61509575 4511 goto err3;
e5009240
PNA		 4512
4513 list_add_tail_rcu(&obj->list, &table->objects);
4514 table->use++;
4515 return 0;
61509575
PS		 4516err3:
4517 kfree(obj->name);
e5009240 4518err2:
dfc46034
PBG		 4519 if (obj->ops->destroy)
4520 obj->ops->destroy(obj);
e5009240
PNA		 4521 kfree(obj);
4522err1:
4523 module_put(type->owner);
4524 return err;
4525}
4526
4527static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4528 u32 portid, u32 seq, int event, u32 flags,
4529 int family, const struct nft_table *table,
43da04a5 4530 struct nft_object *obj, bool reset)
e5009240
PNA		 4531{
4532 struct nfgenmsg *nfmsg;
4533 struct nlmsghdr *nlh;
4534
dedb67c4 4535 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 4536 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4537 if (nlh == NULL)
4538 goto nla_put_failure;
4539
4540 nfmsg = nlmsg_data(nlh);
4541 nfmsg->nfgen_family = family;
4542 nfmsg->version = NFNETLINK_V0;
4543 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4544
4545 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4546 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
dfc46034 4547 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 4548 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 4549 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
4550 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
4551 NFTA_OBJ_PAD))
e5009240
PNA		 4552 goto nla_put_failure;
4553
4554 nlmsg_end(skb, nlh);
4555 return 0;
4556
4557nla_put_failure:
4558 nlmsg_trim(skb, nlh);
4559 return -1;
4560}
4561
a9fea2a3 4562struct nft_obj_filter {
e46abbcc 4563 char *table;
a9fea2a3
PNA		 4564 u32 type;
4565};
4566
e5009240
PNA		 4567static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4568{
4569 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 4570 const struct nft_table *table;
e5009240 4571 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 4572 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 4573 struct net *net = sock_net(skb->sk);
4574 int family = nfmsg->nfgen_family;
43da04a5
PNA		 4575 struct nft_object *obj;
4576 bool reset = false;
4577
4578 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4579 reset = true;
e5009240
PNA		 4580
4581 rcu_read_lock();
4582 cb->seq = net->nft.base_seq;
4583
36596dad 4584 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 4585 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 4586 continue;
4587
36596dad
PNA		 4588 list_for_each_entry_rcu(obj, &table->objects, list) {
4589 if (!nft_is_active(net, obj))
4590 goto cont;
4591 if (idx < s_idx)
4592 goto cont;
4593 if (idx > s_idx)
4594 memset(&cb->args[1], 0,
4595 sizeof(cb->args) - sizeof(cb->args[0]));
4596 if (filter && filter->table[0] &&
4597 strcmp(filter->table, table->name))
4598 goto cont;
4599 if (filter &&
4600 filter->type != NFT_OBJECT_UNSPEC &&
4601 obj->ops->type->type != filter->type)
4602 goto cont;
a9fea2a3 4603
36596dad
PNA		 4604 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4605 cb->nlh->nlmsg_seq,
4606 NFT_MSG_NEWOBJ,
4607 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 4608 table->family, table,
36596dad
PNA		 4609 obj, reset) < 0)
4610 goto done;
e5009240 4611
36596dad 4612 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 4613cont:
36596dad 4614 idx++;
e5009240
PNA		 4615 }
4616 }
4617done:
4618 rcu_read_unlock();
4619
4620 cb->args[0] = idx;
4621 return skb->len;
4622}
4623
a9fea2a3
PNA		 4624static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4625{
e46abbcc
PS		 4626 struct nft_obj_filter *filter = cb->data;
4627
8bea728d
HL		 4628 if (filter) {
4629 kfree(filter->table);
4630 kfree(filter);
4631 }
a9fea2a3
PNA		 4632
4633 return 0;
4634}
4635
4636static struct nft_obj_filter *
4637nft_obj_filter_alloc(const struct nlattr * const nla[])
4638{
4639 struct nft_obj_filter *filter;
4640
4641 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4642 if (!filter)
4643 return ERR_PTR(-ENOMEM);
4644
e46abbcc
PS		 4645 if (nla[NFTA_OBJ_TABLE]) {
4646 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL);
4647 if (!filter->table) {
4648 kfree(filter);
4649 return ERR_PTR(-ENOMEM);
4650 }
4651 }
a9fea2a3
PNA		 4652 if (nla[NFTA_OBJ_TYPE])
4653 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4654
4655 return filter;
4656}
4657
e5009240
PNA		 4658static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4659 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4660 const struct nlattr * const nla[],
4661 struct netlink_ext_ack *extack)
e5009240
PNA		 4662{
4663 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4664 u8 genmask = nft_genmask_cur(net);
4665 int family = nfmsg->nfgen_family;
e5009240
PNA		 4666 const struct nft_table *table;
4667 struct nft_object *obj;
4668 struct sk_buff *skb2;
43da04a5 4669 bool reset = false;
e5009240
PNA		 4670 u32 objtype;
4671 int err;
4672
4673 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4674 struct netlink_dump_control c = {
4675 .dump = nf_tables_dump_obj,
a9fea2a3 4676 .done = nf_tables_dump_obj_done,
e5009240 4677 };
a9fea2a3
PNA		 4678
4679 if (nla[NFTA_OBJ_TABLE] ||
4680 nla[NFTA_OBJ_TYPE]) {
4681 struct nft_obj_filter *filter;
4682
4683 filter = nft_obj_filter_alloc(nla);
4684 if (IS_ERR(filter))
4685 return -ENOMEM;
4686
4687 c.data = filter;
4688 }
e5009240
PNA		 4689 return netlink_dump_start(nlsk, skb, nlh, &c);
4690 }
4691
4692 if (!nla[NFTA_OBJ_NAME] ||
4693 !nla[NFTA_OBJ_TYPE])
4694 return -EINVAL;
4695
98319cb9 4696 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
36596dad 4697 genmask);
e5009240
PNA		 4698 if (IS_ERR(table))
4699 return PTR_ERR(table);
4700
4701 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4702 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4703 if (IS_ERR(obj))
4704 return PTR_ERR(obj);
4705
4706 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4707 if (!skb2)
4708 return -ENOMEM;
4709
43da04a5
PNA		 4710 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4711 reset = true;
4712
e5009240
PNA		 4713 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4714 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 4715 family, table, obj, reset);
e5009240
PNA		 4716 if (err < 0)
4717 goto err;
4718
4719 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4720err:
4721 kfree_skb(skb2);
4722 return err;
e5009240
PNA		 4723}
4724
4725static void nft_obj_destroy(struct nft_object *obj)
4726{
dfc46034
PBG		 4727 if (obj->ops->destroy)
4728 obj->ops->destroy(obj);
e5009240 4729
dfc46034 4730 module_put(obj->ops->type->owner);
61509575 4731 kfree(obj->name);
e5009240
PNA		 4732 kfree(obj);
4733}
4734
4735static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 4736 struct sk_buff *skb, const struct nlmsghdr *nlh,
4737 const struct nlattr * const nla[],
4738 struct netlink_ext_ack *extack)
e5009240
PNA		 4739{
4740 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4741 u8 genmask = nft_genmask_next(net);
4742 int family = nfmsg->nfgen_family;
e5009240
PNA		 4743 struct nft_table *table;
4744 struct nft_object *obj;
4745 struct nft_ctx ctx;
4746 u32 objtype;
4747
4748 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 4749 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 4750 return -EINVAL;
4751
98319cb9 4752 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
36596dad 4753 genmask);
e5009240
PNA		 4754 if (IS_ERR(table))
4755 return PTR_ERR(table);
4756
4757 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
3ecbfd65
HS		 4758 if (nla[NFTA_OBJ_HANDLE])
4759 obj = nf_tables_obj_lookup_byhandle(table, nla[NFTA_OBJ_HANDLE],
4760 objtype, genmask);
4761 else
4762 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME],
4763 objtype, genmask);
e5009240
PNA		 4764 if (IS_ERR(obj))
4765 return PTR_ERR(obj);
4766 if (obj->use > 0)
4767 return -EBUSY;
4768
98319cb9 4769 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 4770
4771 return nft_delobj(&ctx, obj);
4772}
4773
25e94a99
PNA		 4774void nft_obj_notify(struct net *net, struct nft_table *table,
4775 struct nft_object *obj, u32 portid, u32 seq, int event,
4776 int family, int report, gfp_t gfp)
e5009240
PNA		 4777{
4778 struct sk_buff *skb;
4779 int err;
4780
2599e989
PNA		 4781 if (!report &&
4782 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4783 return;
e5009240 4784
2599e989 4785 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 4786 if (skb == NULL)
4787 goto err;
4788
2599e989
PNA		 4789 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4790 table, obj, false);
e5009240
PNA		 4791 if (err < 0) {
4792 kfree_skb(skb);
4793 goto err;
4794 }
4795
25e94a99
PNA		 4796 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4797 return;
e5009240 4798err:
25e94a99 4799 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 4800}
2599e989
PNA		 4801EXPORT_SYMBOL_GPL(nft_obj_notify);
4802
25e94a99
PNA		 4803static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4804 struct nft_object *obj, int event)
2599e989 4805{
25e94a99 4806 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 4807 ctx->family, ctx->report, GFP_KERNEL);
2599e989 4808}
e5009240 4809
3b49e2e9
PNA		 4810/*
4811 * Flow tables
4812 */
4813void nft_register_flowtable_type(struct nf_flowtable_type *type)
4814{
4815 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4816 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
4817 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4818}
4819EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
4820
4821void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
4822{
4823 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4824 list_del_rcu(&type->list);
4825 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4826}
4827EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
4828
4829static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
4830 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
4831 .len = NFT_NAME_MAXLEN - 1 },
4832 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
4833 .len = NFT_NAME_MAXLEN - 1 },
4834 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 4835 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
3b49e2e9
PNA		 4836};
4837
4838struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
4839 const struct nlattr *nla,
4840 u8 genmask)
4841{
4842 struct nft_flowtable *flowtable;
4843
4844 list_for_each_entry(flowtable, &table->flowtables, list) {
4845 if (!nla_strcmp(nla, flowtable->name) &&
4846 nft_active_genmask(flowtable, genmask))
4847 return flowtable;
4848 }
4849 return ERR_PTR(-ENOENT);
4850}
4851EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
4852
ae0662f8 4853static struct nft_flowtable *
3ecbfd65
HS		 4854nf_tables_flowtable_lookup_byhandle(const struct nft_table *table,
4855 const struct nlattr *nla, u8 genmask)
4856{
4857 struct nft_flowtable *flowtable;
4858
4859 list_for_each_entry(flowtable, &table->flowtables, list) {
4860 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
4861 nft_active_genmask(flowtable, genmask))
4862 return flowtable;
4863 }
4864 return ERR_PTR(-ENOENT);
4865}
4866
3b49e2e9
PNA		 4867#define NFT_FLOWTABLE_DEVICE_MAX 8
4868
4869static int nf_tables_parse_devices(const struct nft_ctx *ctx,
4870 const struct nlattr *attr,
4871 struct net_device *dev_array[], int *len)
4872{
4873 const struct nlattr *tmp;
4874 struct net_device *dev;
4875 char ifname[IFNAMSIZ];
4876 int rem, n = 0, err;
4877
4878 nla_for_each_nested(tmp, attr, rem) {
4879 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
4880 err = -EINVAL;
4881 goto err1;
4882 }
4883
4884 nla_strlcpy(ifname, tmp, IFNAMSIZ);
4885 dev = dev_get_by_name(ctx->net, ifname);
4886 if (!dev) {
4887 err = -ENOENT;
4888 goto err1;
4889 }
4890
4891 dev_array[n++] = dev;
4892 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
4893 err = -EFBIG;
4894 goto err1;
4895 }
4896 }
4897 if (!len)
4898 return -EINVAL;
4899
4900 err = 0;
4901err1:
4902 *len = n;
4903 return err;
4904}
4905
4906static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
4907 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
4908 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
4909 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
4910};
4911
4912static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
4913 const struct nlattr *attr,
4914 struct nft_flowtable *flowtable)
4915{
4916 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
4917 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
4918 struct nf_hook_ops *ops;
4919 int hooknum, priority;
4920 int err, n = 0, i;
4921
4922 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
4923 nft_flowtable_hook_policy, NULL);
4924 if (err < 0)
4925 return err;
4926
4927 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
4928 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
4929 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
4930 return -EINVAL;
4931
4932 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 4933 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 4934 return -EINVAL;
4935
4936 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
4937
4938 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
4939 dev_array, &n);
4940 if (err < 0)
4941 goto err1;
4942
4943 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
4944 if (!ops) {
4945 err = -ENOMEM;
4946 goto err1;
4947 }
4948
0e839dfa
PNA		 4949 flowtable->hooknum = hooknum;
4950 flowtable->priority = priority;
3b49e2e9
PNA		 4951 flowtable->ops = ops;
4952 flowtable->ops_len = n;
4953
4954 for (i = 0; i < n; i++) {
4955 flowtable->ops[i].pf = NFPROTO_NETDEV;
4956 flowtable->ops[i].hooknum = hooknum;
4957 flowtable->ops[i].priority = priority;
4958 flowtable->ops[i].priv = &flowtable->data.rhashtable;
4959 flowtable->ops[i].hook = flowtable->data.type->hook;
4960 flowtable->ops[i].dev = dev_array[i];
4961 }
4962
4963 err = 0;
4964err1:
4965 for (i = 0; i < n; i++)
4966 dev_put(dev_array[i]);
4967
4968 return err;
4969}
4970
98319cb9 4971static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 4972{
4973 const struct nf_flowtable_type *type;
4974
4975 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 4976 if (family == type->family)
3b49e2e9
PNA		 4977 return type;
4978 }
4979 return NULL;
4980}
4981
98319cb9 4982static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 4983{
4984 const struct nf_flowtable_type *type;
4985
98319cb9 4986 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 4987 if (type != NULL && try_module_get(type->owner))
4988 return type;
4989
4990#ifdef CONFIG_MODULES
4991 if (type == NULL) {
4992 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
98319cb9 4993 request_module("nf-flowtable-%u", family);
3b49e2e9 4994 nfnl_lock(NFNL_SUBSYS_NFTABLES);
98319cb9 4995 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 4996 return ERR_PTR(-EAGAIN);
4997 }
4998#endif
4999 return ERR_PTR(-ENOENT);
5000}
5001
5002void nft_flow_table_iterate(struct net *net,
5003 void (*iter)(struct nf_flowtable *flowtable, void *data),
5004 void *data)
5005{
5006 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5007 const struct nft_table *table;
5008
c7f0030b
PNA		 5009 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5010 list_for_each_entry(table, &net->nft.tables, list) {
5011 list_for_each_entry(flowtable, &table->flowtables, list) {
dd4cbef7 5012 iter(&flowtable->data, data);
3b49e2e9
PNA		 5013 }
5014 }
c7f0030b 5015 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
3b49e2e9
PNA		 5016}
5017EXPORT_SYMBOL_GPL(nft_flow_table_iterate);
5018
5019static void nft_unregister_flowtable_net_hooks(struct net *net,
5020 struct nft_flowtable *flowtable)
5021{
5022 int i;
5023
5024 for (i = 0; i < flowtable->ops_len; i++) {
5025 if (!flowtable->ops[i].dev)
5026 continue;
5027
5028 nf_unregister_net_hook(net, &flowtable->ops[i]);
5029 }
5030}
5031
5032static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5033 struct sk_buff *skb,
5034 const struct nlmsghdr *nlh,
5035 const struct nlattr * const nla[],
5036 struct netlink_ext_ack *extack)
5037{
5038 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5039 const struct nf_flowtable_type *type;
5040 u8 genmask = nft_genmask_next(net);
5041 int family = nfmsg->nfgen_family;
5042 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5043 struct nft_table *table;
5044 struct nft_ctx ctx;
5045 int err, i, k;
5046
5047 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5048 !nla[NFTA_FLOWTABLE_NAME] ||
5049 !nla[NFTA_FLOWTABLE_HOOK])
5050 return -EINVAL;
5051
36596dad 5052 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
98319cb9 5053 family, genmask);
3b49e2e9
PNA		 5054 if (IS_ERR(table))
5055 return PTR_ERR(table);
5056
5057 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5058 genmask);
5059 if (IS_ERR(flowtable)) {
5060 err = PTR_ERR(flowtable);
5061 if (err != -ENOENT)
5062 return err;
5063 } else {
5064 if (nlh->nlmsg_flags & NLM_F_EXCL)
5065 return -EEXIST;
5066
5067 return 0;
5068 }
5069
98319cb9 5070 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5071
5072 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5073 if (!flowtable)
5074 return -ENOMEM;
5075
5076 flowtable->table = table;
3ecbfd65
HS		 5077 flowtable->handle = nf_tables_alloc_handle(table);
5078
3b49e2e9
PNA		 5079 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5080 if (!flowtable->name) {
5081 err = -ENOMEM;
5082 goto err1;
5083 }
5084
98319cb9 5085 type = nft_flowtable_type_get(family);
3b49e2e9
PNA		 5086 if (IS_ERR(type)) {
5087 err = PTR_ERR(type);
5088 goto err2;
5089 }
5090
5091 flowtable->data.type = type;
5092 err = rhashtable_init(&flowtable->data.rhashtable, type->params);
5093 if (err < 0)
5094 goto err3;
5095
5096 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5097 flowtable);
5098 if (err < 0)
5099 goto err3;
5100
5101 for (i = 0; i < flowtable->ops_len; i++) {
5102 err = nf_register_net_hook(net, &flowtable->ops[i]);
5103 if (err < 0)
5104 goto err4;
5105 }
5106
5107 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5108 if (err < 0)
5109 goto err5;
5110
5111 INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc);
5112 queue_delayed_work(system_power_efficient_wq,
5113 &flowtable->data.gc_work, HZ);
5114
5115 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5116 table->use++;
5117
5118 return 0;
5119err5:
5120 i = flowtable->ops_len;
5121err4:
5122 for (k = i - 1; k >= 0; k--)
5123 nf_unregister_net_hook(net, &flowtable->ops[i]);
5124
5125 kfree(flowtable->ops);
5126err3:
5127 module_put(type->owner);
5128err2:
5129 kfree(flowtable->name);
5130err1:
5131 kfree(flowtable);
5132 return err;
5133}
5134
5135static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5136 struct sk_buff *skb,
5137 const struct nlmsghdr *nlh,
5138 const struct nlattr * const nla[],
5139 struct netlink_ext_ack *extack)
5140{
5141 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5142 u8 genmask = nft_genmask_next(net);
5143 int family = nfmsg->nfgen_family;
5144 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5145 struct nft_table *table;
5146 struct nft_ctx ctx;
5147
36596dad 5148 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
98319cb9 5149 family, genmask);
3b49e2e9
PNA		 5150 if (IS_ERR(table))
5151 return PTR_ERR(table);
5152
3ecbfd65
HS		 5153 if (nla[NFTA_FLOWTABLE_HANDLE])
5154 flowtable = nf_tables_flowtable_lookup_byhandle(table,
5155 nla[NFTA_FLOWTABLE_HANDLE],
5156 genmask);
5157 else
5158 flowtable = nf_tables_flowtable_lookup(table,
5159 nla[NFTA_FLOWTABLE_NAME],
5160 genmask);
3b49e2e9
PNA		 5161 if (IS_ERR(flowtable))
5162 return PTR_ERR(flowtable);
5163 if (flowtable->use > 0)
5164 return -EBUSY;
5165
98319cb9 5166 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5167
5168 return nft_delflowtable(&ctx, flowtable);
5169}
5170
5171static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5172 u32 portid, u32 seq, int event,
5173 u32 flags, int family,
5174 struct nft_flowtable *flowtable)
5175{
5176 struct nlattr *nest, *nest_devs;
5177 struct nfgenmsg *nfmsg;
5178 struct nlmsghdr *nlh;
5179 int i;
5180
5181 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5182 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5183 if (nlh == NULL)
5184 goto nla_put_failure;
5185
5186 nfmsg = nlmsg_data(nlh);
5187 nfmsg->nfgen_family = family;
5188 nfmsg->version = NFNETLINK_V0;
5189 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5190
5191 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5192 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 5193 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5194 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5195 NFTA_FLOWTABLE_PAD))
3b49e2e9
PNA		 5196 goto nla_put_failure;
5197
5198 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5199 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5200 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5201 goto nla_put_failure;
5202
5203 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5204 if (!nest_devs)
5205 goto nla_put_failure;
5206
5207 for (i = 0; i < flowtable->ops_len; i++) {
5208 if (flowtable->ops[i].dev &&
5209 nla_put_string(skb, NFTA_DEVICE_NAME,
5210 flowtable->ops[i].dev->name))
5211 goto nla_put_failure;
5212 }
5213 nla_nest_end(skb, nest_devs);
5214 nla_nest_end(skb, nest);
5215
5216 nlmsg_end(skb, nlh);
5217 return 0;
5218
5219nla_put_failure:
5220 nlmsg_trim(skb, nlh);
5221 return -1;
5222}
5223
5224struct nft_flowtable_filter {
5225 char *table;
5226};
5227
5228static int nf_tables_dump_flowtable(struct sk_buff *skb,
5229 struct netlink_callback *cb)
5230{
5231 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5232 struct nft_flowtable_filter *filter = cb->data;
5233 unsigned int idx = 0, s_idx = cb->args[0];
5234 struct net *net = sock_net(skb->sk);
5235 int family = nfmsg->nfgen_family;
5236 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5237 const struct nft_table *table;
5238
5239 rcu_read_lock();
5240 cb->seq = net->nft.base_seq;
5241
36596dad 5242 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5243 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 5244 continue;
5245
36596dad
PNA		 5246 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5247 if (!nft_is_active(net, flowtable))
5248 goto cont;
5249 if (idx < s_idx)
5250 goto cont;
5251 if (idx > s_idx)
5252 memset(&cb->args[1], 0,
5253 sizeof(cb->args) - sizeof(cb->args[0]));
5254 if (filter && filter->table[0] &&
5255 strcmp(filter->table, table->name))
5256 goto cont;
3b49e2e9 5257
36596dad
PNA		 5258 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5259 cb->nlh->nlmsg_seq,
5260 NFT_MSG_NEWFLOWTABLE,
5261 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5262 table->family, flowtable) < 0)
36596dad 5263 goto done;
3b49e2e9 5264
36596dad 5265 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 5266cont:
36596dad 5267 idx++;
3b49e2e9
PNA		 5268 }
5269 }
5270done:
5271 rcu_read_unlock();
5272
5273 cb->args[0] = idx;
5274 return skb->len;
5275}
5276
5277static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
5278{
5279 struct nft_flowtable_filter *filter = cb->data;
5280
5281 if (!filter)
5282 return 0;
5283
5284 kfree(filter->table);
5285 kfree(filter);
5286
5287 return 0;
5288}
5289
5290static struct nft_flowtable_filter *
5291nft_flowtable_filter_alloc(const struct nlattr * const nla[])
5292{
5293 struct nft_flowtable_filter *filter;
5294
5295 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
5296 if (!filter)
5297 return ERR_PTR(-ENOMEM);
5298
5299 if (nla[NFTA_FLOWTABLE_TABLE]) {
5300 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5301 GFP_KERNEL);
5302 if (!filter->table) {
5303 kfree(filter);
5304 return ERR_PTR(-ENOMEM);
5305 }
5306 }
5307 return filter;
5308}
5309
5310static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5311 struct sk_buff *skb,
5312 const struct nlmsghdr *nlh,
5313 const struct nlattr * const nla[],
5314 struct netlink_ext_ack *extack)
5315{
5316 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5317 u8 genmask = nft_genmask_cur(net);
5318 int family = nfmsg->nfgen_family;
5319 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5320 const struct nft_table *table;
5321 struct sk_buff *skb2;
5322 int err;
5323
5324 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5325 struct netlink_dump_control c = {
5326 .dump = nf_tables_dump_flowtable,
5327 .done = nf_tables_dump_flowtable_done,
5328 };
5329
5330 if (nla[NFTA_FLOWTABLE_TABLE]) {
5331 struct nft_flowtable_filter *filter;
5332
5333 filter = nft_flowtable_filter_alloc(nla);
5334 if (IS_ERR(filter))
5335 return -ENOMEM;
5336
5337 c.data = filter;
5338 }
5339 return netlink_dump_start(nlsk, skb, nlh, &c);
5340 }
5341
5342 if (!nla[NFTA_FLOWTABLE_NAME])
5343 return -EINVAL;
5344
36596dad 5345 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
98319cb9 5346 family, genmask);
3b49e2e9
PNA		 5347 if (IS_ERR(table))
5348 return PTR_ERR(table);
5349
5350 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5351 genmask);
03a0120f 5352 if (IS_ERR(flowtable))
3b49e2e9
PNA		 5353 return PTR_ERR(flowtable);
5354
5355 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5356 if (!skb2)
5357 return -ENOMEM;
5358
5359 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5360 nlh->nlmsg_seq,
5361 NFT_MSG_NEWFLOWTABLE, 0, family,
5362 flowtable);
5363 if (err < 0)
5364 goto err;
5365
5366 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5367err:
5368 kfree_skb(skb2);
5369 return err;
5370}
5371
5372static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5373 struct nft_flowtable *flowtable,
5374 int event)
5375{
5376 struct sk_buff *skb;
5377 int err;
5378
5379 if (ctx->report &&
5380 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5381 return;
5382
5383 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5384 if (skb == NULL)
5385 goto err;
5386
5387 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5388 ctx->seq, event, 0,
36596dad 5389 ctx->family, flowtable);
3b49e2e9
PNA		 5390 if (err < 0) {
5391 kfree_skb(skb);
5392 goto err;
5393 }
5394
5395 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5396 ctx->report, GFP_KERNEL);
5397 return;
5398err:
5399 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5400}
5401
3b49e2e9
PNA		 5402static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5403{
5404 cancel_delayed_work_sync(&flowtable->data.gc_work);
5405 kfree(flowtable->name);
b408c5b0
PNA		 5406 flowtable->data.type->free(&flowtable->data);
5407 rhashtable_destroy(&flowtable->data.rhashtable);
3b49e2e9
PNA		 5408 module_put(flowtable->data.type->owner);
5409}
5410
84d7fce6
PNA		 5411static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5412 u32 portid, u32 seq)
5413{
5414 struct nlmsghdr *nlh;
5415 struct nfgenmsg *nfmsg;
784b4e61 5416 char buf[TASK_COMM_LEN];
dedb67c4 5417 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 5418
5419 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5420 if (nlh == NULL)
5421 goto nla_put_failure;
5422
5423 nfmsg = nlmsg_data(nlh);
5424 nfmsg->nfgen_family = AF_UNSPEC;
5425 nfmsg->version = NFNETLINK_V0;
5426 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5427
784b4e61
PS		 5428 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5429 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5430 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 5431 goto nla_put_failure;
5432
053c095a
JB		 5433 nlmsg_end(skb, nlh);
5434 return 0;
84d7fce6
PNA		 5435
5436nla_put_failure:
5437 nlmsg_trim(skb, nlh);
5438 return -EMSGSIZE;
5439}
5440
3b49e2e9
PNA		 5441static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5442 struct nft_flowtable *flowtable)
5443{
5444 int i;
5445
5446 for (i = 0; i < flowtable->ops_len; i++) {
5447 if (flowtable->ops[i].dev != dev)
5448 continue;
5449
5450 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
5451 flowtable->ops[i].dev = NULL;
5452 break;
5453 }
5454}
5455
5456static int nf_tables_flowtable_event(struct notifier_block *this,
5457 unsigned long event, void *ptr)
5458{
5459 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5460 struct nft_flowtable *flowtable;
5461 struct nft_table *table;
3b49e2e9
PNA		 5462
5463 if (event != NETDEV_UNREGISTER)
5464 return 0;
5465
5466 nfnl_lock(NFNL_SUBSYS_NFTABLES);
36596dad
PNA		 5467 list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
5468 list_for_each_entry(flowtable, &table->flowtables, list) {
5469 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 5470 }
5471 }
5472 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5473
5474 return NOTIFY_DONE;
5475}
5476
5477static struct notifier_block nf_tables_flowtable_notifier = {
5478 .notifier_call = nf_tables_flowtable_event,
5479};
5480
25e94a99
PNA		 5481static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5482 int event)
84d7fce6
PNA		 5483{
5484 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5485 struct sk_buff *skb2;
5486 int err;
5487
5488 if (nlmsg_report(nlh) &&
5489 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5490 return;
84d7fce6 5491
84d7fce6
PNA		 5492 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5493 if (skb2 == NULL)
5494 goto err;
5495
5496 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5497 nlh->nlmsg_seq);
5498 if (err < 0) {
5499 kfree_skb(skb2);
5500 goto err;
5501 }
5502
25e94a99
PNA		 5503 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5504 nlmsg_report(nlh), GFP_KERNEL);
5505 return;
84d7fce6 5506err:
25e94a99
PNA		 5507 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5508 -ENOBUFS);
84d7fce6
PNA		 5509}
5510
7b8002a1
PNA		 5511static int nf_tables_getgen(struct net *net, struct sock *nlsk,
5512 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5513 const struct nlattr * const nla[],
5514 struct netlink_ext_ack *extack)
84d7fce6 5515{
84d7fce6
PNA		 5516 struct sk_buff *skb2;
5517 int err;
5518
5519 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5520 if (skb2 == NULL)
5521 return -ENOMEM;
5522
5523 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5524 nlh->nlmsg_seq);
5525 if (err < 0)
5526 goto err;
5527
5528 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5529err:
5530 kfree_skb(skb2);
5531 return err;
5532}
5533
96518518
PM		 5534static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
5535 [NFT_MSG_NEWTABLE] = {
55dd6f93 5536 .call_batch = nf_tables_newtable,
96518518
PM		 5537 .attr_count = NFTA_TABLE_MAX,
5538 .policy = nft_table_policy,
5539 },
5540 [NFT_MSG_GETTABLE] = {
5541 .call = nf_tables_gettable,
5542 .attr_count = NFTA_TABLE_MAX,
5543 .policy = nft_table_policy,
5544 },
5545 [NFT_MSG_DELTABLE] = {
55dd6f93 5546 .call_batch = nf_tables_deltable,
96518518
PM		 5547 .attr_count = NFTA_TABLE_MAX,
5548 .policy = nft_table_policy,
5549 },
5550 [NFT_MSG_NEWCHAIN] = {
91c7b38d 5551 .call_batch = nf_tables_newchain,
96518518
PM		 5552 .attr_count = NFTA_CHAIN_MAX,
5553 .policy = nft_chain_policy,
5554 },
5555 [NFT_MSG_GETCHAIN] = {
5556 .call = nf_tables_getchain,
5557 .attr_count = NFTA_CHAIN_MAX,
5558 .policy = nft_chain_policy,
5559 },
5560 [NFT_MSG_DELCHAIN] = {
91c7b38d 5561 .call_batch = nf_tables_delchain,
96518518
PM		 5562 .attr_count = NFTA_CHAIN_MAX,
5563 .policy = nft_chain_policy,
5564 },
5565 [NFT_MSG_NEWRULE] = {
0628b123 5566 .call_batch = nf_tables_newrule,
96518518
PM		 5567 .attr_count = NFTA_RULE_MAX,
5568 .policy = nft_rule_policy,
5569 },
5570 [NFT_MSG_GETRULE] = {
5571 .call = nf_tables_getrule,
5572 .attr_count = NFTA_RULE_MAX,
5573 .policy = nft_rule_policy,
5574 },
5575 [NFT_MSG_DELRULE] = {
0628b123 5576 .call_batch = nf_tables_delrule,
96518518
PM		 5577 .attr_count = NFTA_RULE_MAX,
5578 .policy = nft_rule_policy,
5579 },
20a69341 5580 [NFT_MSG_NEWSET] = {
958bee14 5581 .call_batch = nf_tables_newset,
20a69341
PM		 5582 .attr_count = NFTA_SET_MAX,
5583 .policy = nft_set_policy,
5584 },
5585 [NFT_MSG_GETSET] = {
5586 .call = nf_tables_getset,
5587 .attr_count = NFTA_SET_MAX,
5588 .policy = nft_set_policy,
5589 },
5590 [NFT_MSG_DELSET] = {
958bee14 5591 .call_batch = nf_tables_delset,
20a69341
PM		 5592 .attr_count = NFTA_SET_MAX,
5593 .policy = nft_set_policy,
5594 },
5595 [NFT_MSG_NEWSETELEM] = {
958bee14 5596 .call_batch = nf_tables_newsetelem,
20a69341
PM		 5597 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5598 .policy = nft_set_elem_list_policy,
5599 },
5600 [NFT_MSG_GETSETELEM] = {
5601 .call = nf_tables_getsetelem,
5602 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5603 .policy = nft_set_elem_list_policy,
5604 },
5605 [NFT_MSG_DELSETELEM] = {
958bee14 5606 .call_batch = nf_tables_delsetelem,
20a69341
PM		 5607 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5608 .policy = nft_set_elem_list_policy,
5609 },
84d7fce6
PNA		 5610 [NFT_MSG_GETGEN] = {
5611 .call = nf_tables_getgen,
5612 },
e5009240
PNA		 5613 [NFT_MSG_NEWOBJ] = {
5614 .call_batch = nf_tables_newobj,
5615 .attr_count = NFTA_OBJ_MAX,
5616 .policy = nft_obj_policy,
5617 },
5618 [NFT_MSG_GETOBJ] = {
5619 .call = nf_tables_getobj,
5620 .attr_count = NFTA_OBJ_MAX,
5621 .policy = nft_obj_policy,
5622 },
5623 [NFT_MSG_DELOBJ] = {
5624 .call_batch = nf_tables_delobj,
5625 .attr_count = NFTA_OBJ_MAX,
5626 .policy = nft_obj_policy,
5627 },
43da04a5
PNA		 5628 [NFT_MSG_GETOBJ_RESET] = {
5629 .call = nf_tables_getobj,
5630 .attr_count = NFTA_OBJ_MAX,
5631 .policy = nft_obj_policy,
5632 },
3b49e2e9
PNA		 5633 [NFT_MSG_NEWFLOWTABLE] = {
5634 .call_batch = nf_tables_newflowtable,
5635 .attr_count = NFTA_FLOWTABLE_MAX,
5636 .policy = nft_flowtable_policy,
5637 },
5638 [NFT_MSG_GETFLOWTABLE] = {
5639 .call = nf_tables_getflowtable,
5640 .attr_count = NFTA_FLOWTABLE_MAX,
5641 .policy = nft_flowtable_policy,
5642 },
5643 [NFT_MSG_DELFLOWTABLE] = {
5644 .call_batch = nf_tables_delflowtable,
5645 .attr_count = NFTA_FLOWTABLE_MAX,
5646 .policy = nft_flowtable_policy,
5647 },
96518518
PM		 5648};
5649
91c7b38d
PNA		 5650static void nft_chain_commit_update(struct nft_trans *trans)
5651{
5652 struct nft_base_chain *basechain;
5653
b7263e07 5654 if (nft_trans_chain_name(trans))
91c7b38d
PNA		 5655 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
5656
f323d954 5657 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 5658 return;
5659
5660 basechain = nft_base_chain(trans->ctx.chain);
5661 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5662
5663 switch (nft_trans_chain_policy(trans)) {
5664 case NF_DROP:
5665 case NF_ACCEPT:
5666 basechain->policy = nft_trans_chain_policy(trans);
5667 break;
5668 }
5669}
5670
b326dd37 5671static void nf_tables_commit_release(struct nft_trans *trans)
c7c32e72 5672{
c7c32e72
PNA		 5673 switch (trans->msg_type) {
5674 case NFT_MSG_DELTABLE:
5675 nf_tables_table_destroy(&trans->ctx);
5676 break;
5677 case NFT_MSG_DELCHAIN:
5678 nf_tables_chain_destroy(trans->ctx.chain);
5679 break;
5680 case NFT_MSG_DELRULE:
5681 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5682 break;
5683 case NFT_MSG_DELSET:
5684 nft_set_destroy(nft_trans_set(trans));
5685 break;
61edafbb 5686 case NFT_MSG_DELSETELEM:
59105446
PNA		 5687 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
5688 nft_trans_elem(trans).priv);
61edafbb 5689 break;
e5009240
PNA		 5690 case NFT_MSG_DELOBJ:
5691 nft_obj_destroy(nft_trans_obj(trans));
5692 break;
3b49e2e9
PNA		 5693 case NFT_MSG_DELFLOWTABLE:
5694 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5695 break;
c7c32e72
PNA		 5696 }
5697 kfree(trans);
5698}
5699
5913beaf 5700static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 5701{
37082f93 5702 struct nft_trans *trans, *next;
a3716e70 5703 struct nft_trans_elem *te;
37082f93
PNA		 5704
5705 /* Bump generation counter, invalidate any dump in progress */
38e029f1 5706 while (++net->nft.base_seq == 0);
37082f93
PNA		 5707
5708 /* A new generation has just started */
ea4bd995 5709 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 5710
5711 /* Make sure all packets have left the previous generation before
5712 * purging old rules.
5713 */
5714 synchronize_rcu();
5715
5716 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 5717 switch (trans->msg_type) {
55dd6f93
PNA		 5718 case NFT_MSG_NEWTABLE:
5719 if (nft_trans_table_update(trans)) {
5720 if (!nft_trans_table_enable(trans)) {
664b0f8c 5721 nf_tables_table_disable(net,
55dd6f93
PNA		 5722 trans->ctx.table);
5723 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5724 }
5725 } else {
f2a6d766 5726 nft_clear(net, trans->ctx.table);
55dd6f93 5727 }
35151d84 5728 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 5729 nft_trans_destroy(trans);
5730 break;
5731 case NFT_MSG_DELTABLE:
f2a6d766 5732 list_del_rcu(&trans->ctx.table->list);
35151d84 5733 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 5734 break;
91c7b38d
PNA		 5735 case NFT_MSG_NEWCHAIN:
5736 if (nft_trans_chain_update(trans))
5737 nft_chain_commit_update(trans);
4fefee57 5738 else
664b0f8c 5739 nft_clear(net, trans->ctx.chain);
4fefee57 5740
35151d84 5741 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
91c7b38d
PNA		 5742 nft_trans_destroy(trans);
5743 break;
5744 case NFT_MSG_DELCHAIN:
664b0f8c 5745 list_del_rcu(&trans->ctx.chain->list);
35151d84 5746 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 5747 nf_tables_unregister_hook(trans->ctx.net,
5748 trans->ctx.table,
5749 trans->ctx.chain);
91c7b38d 5750 break;
b380e5c7 5751 case NFT_MSG_NEWRULE:
889f7ee7 5752 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 5753 nf_tables_rule_notify(&trans->ctx,
37082f93 5754 nft_trans_rule(trans),
35151d84 5755 NFT_MSG_NEWRULE);
37082f93 5756 nft_trans_destroy(trans);
b380e5c7
PNA		 5757 break;
5758 case NFT_MSG_DELRULE:
5759 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 5760 nf_tables_rule_notify(&trans->ctx,
5761 nft_trans_rule(trans),
5762 NFT_MSG_DELRULE);
b380e5c7 5763 break;
958bee14 5764 case NFT_MSG_NEWSET:
37a9cc52 5765 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 5766 /* This avoids hitting -EBUSY when deleting the table
5767 * from the transaction.
5768 */
408070d6 5769 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 5770 !list_empty(&nft_trans_set(trans)->bindings))
5771 trans->ctx.table->use--;
5772
958bee14 5773 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5774 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 5775 nft_trans_destroy(trans);
5776 break;
5777 case NFT_MSG_DELSET:
37a9cc52 5778 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 5779 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5780 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 5781 break;
60319eb1 5782 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 5783 te = (struct nft_trans_elem *)trans->data;
5784
42a55769 5785 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 5786 nf_tables_setelem_notify(&trans->ctx, te->set,
5787 &te->elem,
60319eb1
PNA		 5788 NFT_MSG_NEWSETELEM, 0);
5789 nft_trans_destroy(trans);
5790 break;
5791 case NFT_MSG_DELSETELEM:
a3716e70 5792 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5793
a3716e70
PNA		 5794 nf_tables_setelem_notify(&trans->ctx, te->set,
5795 &te->elem,
60319eb1 5796 NFT_MSG_DELSETELEM, 0);
5cb82a38 5797 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 5798 atomic_dec(&te->set->nelems);
5799 te->set->ndeact--;
60319eb1 5800 break;
e5009240
PNA		 5801 case NFT_MSG_NEWOBJ:
5802 nft_clear(net, nft_trans_obj(trans));
5803 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5804 NFT_MSG_NEWOBJ);
5805 nft_trans_destroy(trans);
5806 break;
5807 case NFT_MSG_DELOBJ:
5808 list_del_rcu(&nft_trans_obj(trans)->list);
5809 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5810 NFT_MSG_DELOBJ);
5811 break;
3b49e2e9
PNA		 5812 case NFT_MSG_NEWFLOWTABLE:
5813 nft_clear(net, nft_trans_flowtable(trans));
5814 nf_tables_flowtable_notify(&trans->ctx,
5815 nft_trans_flowtable(trans),
5816 NFT_MSG_NEWFLOWTABLE);
5817 nft_trans_destroy(trans);
5818 break;
5819 case NFT_MSG_DELFLOWTABLE:
5820 list_del_rcu(&nft_trans_flowtable(trans)->list);
5821 nf_tables_flowtable_notify(&trans->ctx,
5822 nft_trans_flowtable(trans),
5823 NFT_MSG_DELFLOWTABLE);
5824 nft_unregister_flowtable_net_hooks(net,
5825 nft_trans_flowtable(trans));
5826 break;
37082f93 5827 }
37082f93
PNA		 5828 }
5829
b326dd37
PNA		 5830 synchronize_rcu();
5831
37082f93 5832 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
c7c32e72 5833 list_del(&trans->list);
b326dd37 5834 nf_tables_commit_release(trans);
37082f93 5835 }
84d7fce6
PNA		 5836
5837 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
37082f93
PNA		 5838
5839 return 0;
5840}
5841
b326dd37 5842static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 5843{
c7c32e72
PNA		 5844 switch (trans->msg_type) {
5845 case NFT_MSG_NEWTABLE:
5846 nf_tables_table_destroy(&trans->ctx);
5847 break;
5848 case NFT_MSG_NEWCHAIN:
5849 nf_tables_chain_destroy(trans->ctx.chain);
5850 break;
5851 case NFT_MSG_NEWRULE:
5852 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5853 break;
5854 case NFT_MSG_NEWSET:
5855 nft_set_destroy(nft_trans_set(trans));
5856 break;
61edafbb
PM		 5857 case NFT_MSG_NEWSETELEM:
5858 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 5859 nft_trans_elem(trans).priv, true);
61edafbb 5860 break;
e5009240
PNA		 5861 case NFT_MSG_NEWOBJ:
5862 nft_obj_destroy(nft_trans_obj(trans));
5863 break;
3b49e2e9
PNA		 5864 case NFT_MSG_NEWFLOWTABLE:
5865 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5866 break;
c7c32e72
PNA		 5867 }
5868 kfree(trans);
5869}
5870
5913beaf 5871static int nf_tables_abort(struct net *net, struct sk_buff *skb)
37082f93 5872{
37082f93 5873 struct nft_trans *trans, *next;
02263db0 5874 struct nft_trans_elem *te;
37082f93 5875
a907e36d
XL		 5876 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
5877 list) {
b380e5c7 5878 switch (trans->msg_type) {
55dd6f93
PNA		 5879 case NFT_MSG_NEWTABLE:
5880 if (nft_trans_table_update(trans)) {
5881 if (nft_trans_table_enable(trans)) {
664b0f8c 5882 nf_tables_table_disable(net,
55dd6f93
PNA		 5883 trans->ctx.table);
5884 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5885 }
5886 nft_trans_destroy(trans);
5887 } else {
e688a7f8 5888 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 5889 }
5890 break;
5891 case NFT_MSG_DELTABLE:
f2a6d766 5892 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 5893 nft_trans_destroy(trans);
5894 break;
91c7b38d
PNA		 5895 case NFT_MSG_NEWCHAIN:
5896 if (nft_trans_chain_update(trans)) {
982f4051 5897 free_percpu(nft_trans_chain_stats(trans));
91c7b38d
PNA		 5898
5899 nft_trans_destroy(trans);
5900 } else {
4fefee57 5901 trans->ctx.table->use--;
e688a7f8 5902 list_del_rcu(&trans->ctx.chain->list);
c974a3a3
PNA		 5903 nf_tables_unregister_hook(trans->ctx.net,
5904 trans->ctx.table,
5905 trans->ctx.chain);
91c7b38d
PNA		 5906 }
5907 break;
5908 case NFT_MSG_DELCHAIN:
4fefee57 5909 trans->ctx.table->use++;
664b0f8c 5910 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 5911 nft_trans_destroy(trans);
5912 break;
b380e5c7 5913 case NFT_MSG_NEWRULE:
4fefee57 5914 trans->ctx.chain->use--;
b380e5c7
PNA		 5915 list_del_rcu(&nft_trans_rule(trans)->list);
5916 break;
5917 case NFT_MSG_DELRULE:
4fefee57 5918 trans->ctx.chain->use++;
889f7ee7 5919 nft_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 5920 nft_trans_destroy(trans);
b380e5c7 5921 break;
958bee14 5922 case NFT_MSG_NEWSET:
4fefee57 5923 trans->ctx.table->use--;
e688a7f8 5924 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 5925 break;
5926 case NFT_MSG_DELSET:
4fefee57 5927 trans->ctx.table->use++;
37a9cc52 5928 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 5929 nft_trans_destroy(trans);
5930 break;
60319eb1 5931 case NFT_MSG_NEWSETELEM:
02263db0 5932 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5933
5cb82a38 5934 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 5935 atomic_dec(&te->set->nelems);
60319eb1
PNA		 5936 break;
5937 case NFT_MSG_DELSETELEM:
cc02e457
PM		 5938 te = (struct nft_trans_elem *)trans->data;
5939
59105446 5940 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 5941 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 5942 te->set->ndeact--;
cc02e457 5943
e5009240
PNA		 5944 nft_trans_destroy(trans);
5945 break;
5946 case NFT_MSG_NEWOBJ:
5947 trans->ctx.table->use--;
5948 list_del_rcu(&nft_trans_obj(trans)->list);
5949 break;
5950 case NFT_MSG_DELOBJ:
5951 trans->ctx.table->use++;
5952 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 5953 nft_trans_destroy(trans);
5954 break;
3b49e2e9
PNA		 5955 case NFT_MSG_NEWFLOWTABLE:
5956 trans->ctx.table->use--;
5957 list_del_rcu(&nft_trans_flowtable(trans)->list);
5958 nft_unregister_flowtable_net_hooks(net,
5959 nft_trans_flowtable(trans));
5960 break;
5961 case NFT_MSG_DELFLOWTABLE:
5962 trans->ctx.table->use++;
5963 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
5964 nft_trans_destroy(trans);
5965 break;
37082f93 5966 }
37082f93
PNA		 5967 }
5968
b326dd37
PNA		 5969 synchronize_rcu();
5970
a1cee076
PNA		 5971 list_for_each_entry_safe_reverse(trans, next,
5972 &net->nft.commit_list, list) {
c7c32e72 5973 list_del(&trans->list);
b326dd37 5974 nf_tables_abort_release(trans);
37082f93
PNA		 5975 }
5976
5977 return 0;
5978}
5979
74e8bcd2
PNA		 5980static bool nf_tables_valid_genid(struct net *net, u32 genid)
5981{
5982 return net->nft.base_seq == genid;
5983}
5984
96518518
PM		 5985static const struct nfnetlink_subsystem nf_tables_subsys = {
5986 .name = "nf_tables",
5987 .subsys_id = NFNL_SUBSYS_NFTABLES,
5988 .cb_count = NFT_MSG_MAX,
5989 .cb = nf_tables_cb,
0628b123
PNA		 5990 .commit = nf_tables_commit,
5991 .abort = nf_tables_abort,
74e8bcd2 5992 .valid_genid = nf_tables_valid_genid,
96518518
PM		 5993};
5994
7210e4e3
PNA		 5995int nft_chain_validate_dependency(const struct nft_chain *chain,
5996 enum nft_chain_type type)
5997{
5998 const struct nft_base_chain *basechain;
5999
f323d954 6000 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6001 basechain = nft_base_chain(chain);
6002 if (basechain->type->type != type)
6003 return -EOPNOTSUPP;
6004 }
6005 return 0;
6006}
6007EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6008
75e8d06d
PNA		 6009int nft_chain_validate_hooks(const struct nft_chain *chain,
6010 unsigned int hook_flags)
6011{
6012 struct nft_base_chain *basechain;
6013
f323d954 6014 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6015 basechain = nft_base_chain(chain);
6016
c974a3a3 6017 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6018 return 0;
6019
6020 return -EOPNOTSUPP;
6021 }
6022
6023 return 0;
6024}
6025EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6026
20a69341
PM		 6027/*
6028 * Loop detection - walk through the ruleset beginning at the destination chain
6029 * of a new jump until either the source chain is reached (loop) or all
6030 * reachable chains have been traversed.
6031 *
6032 * The loop check is performed whenever a new jump verdict is added to an
6033 * expression or verdict map or a verdict map is bound to a new chain.
6034 */
6035
6036static int nf_tables_check_loops(const struct nft_ctx *ctx,
6037 const struct nft_chain *chain);
6038
6039static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6040 struct nft_set *set,
20a69341 6041 const struct nft_set_iter *iter,
de70185d 6042 struct nft_set_elem *elem)
20a69341 6043{
fe2811eb
PM		 6044 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6045 const struct nft_data *data;
6046
6047 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6048 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 6049 return 0;
6050
fe2811eb 6051 data = nft_set_ext_data(ext);
1ca2e170 6052 switch (data->verdict.code) {
20a69341
PM		 6053 case NFT_JUMP:
6054 case NFT_GOTO:
1ca2e170 6055 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6056 default:
6057 return 0;
6058 }
6059}
6060
6061static int nf_tables_check_loops(const struct nft_ctx *ctx,
6062 const struct nft_chain *chain)
6063{
6064 const struct nft_rule *rule;
6065 const struct nft_expr *expr, *last;
de70185d 6066 struct nft_set *set;
20a69341
PM		 6067 struct nft_set_binding *binding;
6068 struct nft_set_iter iter;
20a69341
PM		 6069
6070 if (ctx->chain == chain)
6071 return -ELOOP;
6072
6073 list_for_each_entry(rule, &chain->rules, list) {
6074 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 6075 const struct nft_data *data = NULL;
6076 int err;
6077
6078 if (!expr->ops->validate)
20a69341
PM		 6079 continue;
6080
0ca743a5
PNA		 6081 err = expr->ops->validate(ctx, expr, &data);
6082 if (err < 0)
6083 return err;
6084
20a69341 6085 if (data == NULL)
0ca743a5 6086 continue;
20a69341 6087
1ca2e170 6088 switch (data->verdict.code) {
20a69341
PM		 6089 case NFT_JUMP:
6090 case NFT_GOTO:
1ca2e170
PM		 6091 err = nf_tables_check_loops(ctx,
6092 data->verdict.chain);
20a69341
PM		 6093 if (err < 0)
6094 return err;
6095 default:
6096 break;
6097 }
6098 }
6099 }
6100
6101 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 6102 if (!nft_is_active_next(ctx->net, set))
6103 continue;
20a69341
PM		 6104 if (!(set->flags & NFT_SET_MAP) ||
6105 set->dtype != NFT_DATA_VERDICT)
6106 continue;
6107
6108 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 6109 if (!(binding->flags & NFT_SET_MAP) ||
6110 binding->chain != chain)
20a69341
PM		 6111 continue;
6112
8588ac09 6113 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 6114 iter.skip = 0;
6115 iter.count = 0;
6116 iter.err = 0;
6117 iter.fn = nf_tables_loop_check_setelem;
6118
6119 set->ops->walk(ctx, set, &iter);
6120 if (iter.err < 0)
6121 return iter.err;
6122 }
6123 }
6124
6125 return 0;
6126}
6127
36b701fa
LGL		 6128/**
6129 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6130 *
6131 * @attr: netlink attribute to fetch value from
6132 * @max: maximum value to be stored in dest
6133 * @dest: pointer to the variable
6134 *
6135 * Parse, check and store a given u32 netlink attribute into variable.
6136 * This function returns -ERANGE if the value goes over maximum value.
6137 * Otherwise a 0 is returned and the attribute value is stored in the
6138 * destination variable.
6139 */
f1d505bb 6140int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 6141{
09525a09 6142 u32 val;
36b701fa
LGL		 6143
6144 val = ntohl(nla_get_be32(attr));
6145 if (val > max)
6146 return -ERANGE;
6147
6148 *dest = val;
6149 return 0;
6150}
6151EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6152
49499c3e
PM		 6153/**
6154 * nft_parse_register - parse a register value from a netlink attribute
6155 *
6156 * @attr: netlink attribute
6157 *
6158 * Parse and translate a register value from a netlink attribute.
6159 * Registers used to be 128 bit wide, these register numbers will be
6160 * mapped to the corresponding 32 bit register numbers.
6161 */
b1c96ed3
PM		 6162unsigned int nft_parse_register(const struct nlattr *attr)
6163{
49499c3e
PM		 6164 unsigned int reg;
6165
6166 reg = ntohl(nla_get_be32(attr));
6167 switch (reg) {
6168 case NFT_REG_VERDICT...NFT_REG_4:
6169 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6170 default:
6171 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6172 }
b1c96ed3
PM		 6173}
6174EXPORT_SYMBOL_GPL(nft_parse_register);
6175
49499c3e
PM		 6176/**
6177 * nft_dump_register - dump a register value to a netlink attribute
6178 *
6179 * @skb: socket buffer
6180 * @attr: attribute number
6181 * @reg: register number
6182 *
6183 * Construct a netlink attribute containing the register number. For
6184 * compatibility reasons, register numbers being a multiple of 4 are
6185 * translated to the corresponding 128 bit register numbers.
6186 */
b1c96ed3
PM		 6187int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6188{
49499c3e
PM		 6189 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6190 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6191 else
6192 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6193
b1c96ed3
PM		 6194 return nla_put_be32(skb, attr, htonl(reg));
6195}
6196EXPORT_SYMBOL_GPL(nft_dump_register);
6197
96518518 6198/**
d07db988 6199 * nft_validate_register_load - validate a load from a register
96518518
PM		 6200 *
6201 * @reg: the register number
d07db988 6202 * @len: the length of the data
96518518
PM		 6203 *
6204 * Validate that the input register is one of the general purpose
d07db988 6205 * registers and that the length of the load is within the bounds.
96518518 6206 */
d07db988 6207int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 6208{
49499c3e 6209 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 6210 return -EINVAL;
d07db988
PM		 6211 if (len == 0)
6212 return -EINVAL;
49499c3e 6213 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 6214 return -ERANGE;
49499c3e 6215
96518518
PM		 6216 return 0;
6217}
d07db988 6218EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 6219
96518518 6220/**
1ec10212 6221 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 6222 *
6223 * @ctx: context of the expression performing the load
6224 * @reg: the destination register number
6225 * @data: the data to load
6226 * @type: the data type
45d9bcda 6227 * @len: the length of the data
96518518
PM		 6228 *
6229 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 6230 * the destination register and the length is within the bounds.
6231 * A value of NULL for the data means that its runtime gathered
58f40ab6 6232 * data.
96518518 6233 */
1ec10212
PM		 6234int nft_validate_register_store(const struct nft_ctx *ctx,
6235 enum nft_registers reg,
6236 const struct nft_data *data,
6237 enum nft_data_types type, unsigned int len)
96518518 6238{
20a69341
PM		 6239 int err;
6240
96518518
PM		 6241 switch (reg) {
6242 case NFT_REG_VERDICT:
58f40ab6 6243 if (type != NFT_DATA_VERDICT)
96518518 6244 return -EINVAL;
20a69341 6245
58f40ab6 6246 if (data != NULL &&
1ca2e170
PM		 6247 (data->verdict.code == NFT_GOTO ||
6248 data->verdict.code == NFT_JUMP)) {
6249 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6250 if (err < 0)
6251 return err;
6252
1ca2e170
PM		 6253 if (ctx->chain->level + 1 >
6254 data->verdict.chain->level) {
20a69341
PM		 6255 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
6256 return -EMLINK;
1ca2e170 6257 data->verdict.chain->level = ctx->chain->level + 1;
20a69341
PM		 6258 }
6259 }
6260
96518518
PM		 6261 return 0;
6262 default:
49499c3e 6263 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 6264 return -EINVAL;
45d9bcda
PM		 6265 if (len == 0)
6266 return -EINVAL;
49499c3e
PM		 6267 if (reg * NFT_REG32_SIZE + len >
6268 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 6269 return -ERANGE;
27e6d201 6270
96518518
PM		 6271 if (data != NULL && type != NFT_DATA_VALUE)
6272 return -EINVAL;
6273 return 0;
6274 }
6275}
1ec10212 6276EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 6277
6278static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
6279 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
6280 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
6281 .len = NFT_CHAIN_MAXNAMELEN - 1 },
6282};
6283
6284static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
6285 struct nft_data_desc *desc, const struct nlattr *nla)
6286{
664b0f8c 6287 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 6288 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
6289 struct nft_chain *chain;
6290 int err;
6291
fceb6435
JB		 6292 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
6293 NULL);
96518518
PM		 6294 if (err < 0)
6295 return err;
6296
6297 if (!tb[NFTA_VERDICT_CODE])
6298 return -EINVAL;
1ca2e170 6299 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 6300
1ca2e170 6301 switch (data->verdict.code) {
e0abdadc 6302 default:
1ca2e170 6303 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 6304 case NF_ACCEPT:
6305 case NF_DROP:
6306 case NF_QUEUE:
6307 break;
6308 default:
6309 return -EINVAL;
6310 }
6311 /* fall through */
96518518
PM		 6312 case NFT_CONTINUE:
6313 case NFT_BREAK:
6314 case NFT_RETURN:
96518518
PM		 6315 break;
6316 case NFT_JUMP:
6317 case NFT_GOTO:
6318 if (!tb[NFTA_VERDICT_CHAIN])
6319 return -EINVAL;
6320 chain = nf_tables_chain_lookup(ctx->table,
664b0f8c 6321 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 6322 if (IS_ERR(chain))
6323 return PTR_ERR(chain);
f323d954 6324 if (nft_is_base_chain(chain))
96518518
PM		 6325 return -EOPNOTSUPP;
6326
96518518 6327 chain->use++;
1ca2e170 6328 data->verdict.chain = chain;
96518518 6329 break;
96518518
PM		 6330 }
6331
4c4ed074 6332 desc->len = sizeof(data->verdict);
96518518
PM		 6333 desc->type = NFT_DATA_VERDICT;
6334 return 0;
6335}
6336
6337static void nft_verdict_uninit(const struct nft_data *data)
6338{
1ca2e170 6339 switch (data->verdict.code) {
96518518
PM		 6340 case NFT_JUMP:
6341 case NFT_GOTO:
1ca2e170 6342 data->verdict.chain->use--;
96518518
PM		 6343 break;
6344 }
6345}
6346
33d5a7b1 6347int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 6348{
6349 struct nlattr *nest;
6350
33d5a7b1 6351 nest = nla_nest_start(skb, type);
96518518
PM		 6352 if (!nest)
6353 goto nla_put_failure;
6354
33d5a7b1 6355 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 6356 goto nla_put_failure;
6357
33d5a7b1 6358 switch (v->code) {
96518518
PM		 6359 case NFT_JUMP:
6360 case NFT_GOTO:
1ca2e170 6361 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 6362 v->chain->name))
96518518
PM		 6363 goto nla_put_failure;
6364 }
6365 nla_nest_end(skb, nest);
6366 return 0;
6367
6368nla_put_failure:
6369 return -1;
6370}
6371
d0a11fc3
PM		 6372static int nft_value_init(const struct nft_ctx *ctx,
6373 struct nft_data *data, unsigned int size,
96518518
PM		 6374 struct nft_data_desc *desc, const struct nlattr *nla)
6375{
6376 unsigned int len;
6377
6378 len = nla_len(nla);
6379 if (len == 0)
6380 return -EINVAL;
d0a11fc3 6381 if (len > size)
96518518
PM		 6382 return -EOVERFLOW;
6383
d0a11fc3 6384 nla_memcpy(data->data, nla, len);
96518518
PM		 6385 desc->type = NFT_DATA_VALUE;
6386 desc->len = len;
6387 return 0;
6388}
6389
6390static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
6391 unsigned int len)
6392{
6393 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
6394}
6395
6396static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 6397 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 6398 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
6399};
6400
6401/**
6402 * nft_data_init - parse nf_tables data netlink attributes
6403 *
6404 * @ctx: context of the expression using the data
6405 * @data: destination struct nft_data
d0a11fc3 6406 * @size: maximum data length
96518518
PM		 6407 * @desc: data description
6408 * @nla: netlink attribute containing data
6409 *
6410 * Parse the netlink data attributes and initialize a struct nft_data.
6411 * The type and length of data are returned in the data description.
6412 *
6413 * The caller can indicate that it only wants to accept data of type
6414 * NFT_DATA_VALUE by passing NULL for the ctx argument.
6415 */
d0a11fc3
PM		 6416int nft_data_init(const struct nft_ctx *ctx,
6417 struct nft_data *data, unsigned int size,
96518518
PM		 6418 struct nft_data_desc *desc, const struct nlattr *nla)
6419{
6420 struct nlattr *tb[NFTA_DATA_MAX + 1];
6421 int err;
6422
fceb6435 6423 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 6424 if (err < 0)
6425 return err;
6426
6427 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 6428 return nft_value_init(ctx, data, size, desc,
6429 tb[NFTA_DATA_VALUE]);
96518518
PM		 6430 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
6431 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
6432 return -EINVAL;
6433}
6434EXPORT_SYMBOL_GPL(nft_data_init);
6435
6436/**
59105446 6437 * nft_data_release - release a nft_data item
96518518
PM		 6438 *
6439 * @data: struct nft_data to release
6440 * @type: type of data
6441 *
6442 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6443 * all others need to be released by calling this function.
6444 */
59105446 6445void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 6446{
960bd2c2 6447 if (type < NFT_DATA_VERDICT)
96518518 6448 return;
960bd2c2 6449 switch (type) {
96518518
PM		 6450 case NFT_DATA_VERDICT:
6451 return nft_verdict_uninit(data);
6452 default:
6453 WARN_ON(1);
6454 }
6455}
59105446 6456EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 6457
6458int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
6459 enum nft_data_types type, unsigned int len)
6460{
6461 struct nlattr *nest;
6462 int err;
6463
6464 nest = nla_nest_start(skb, attr);
6465 if (nest == NULL)
6466 return -1;
6467
6468 switch (type) {
6469 case NFT_DATA_VALUE:
6470 err = nft_value_dump(skb, data, len);
6471 break;
6472 case NFT_DATA_VERDICT:
33d5a7b1 6473 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 6474 break;
6475 default:
6476 err = -EINVAL;
6477 WARN_ON(1);
6478 }
6479
6480 nla_nest_end(skb, nest);
6481 return err;
6482}
6483EXPORT_SYMBOL_GPL(nft_data_dump);
6484
5ebe0b0e
PNA		 6485int __nft_release_basechain(struct nft_ctx *ctx)
6486{
6487 struct nft_rule *rule, *nr;
6488
f323d954 6489 BUG_ON(!nft_is_base_chain(ctx->chain));
5ebe0b0e 6490
c974a3a3 6491 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 6492 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6493 list_del(&rule->list);
6494 ctx->chain->use--;
6495 nf_tables_rule_destroy(ctx, rule);
6496 }
6497 list_del(&ctx->chain->list);
6498 ctx->table->use--;
6499 nf_tables_chain_destroy(ctx->chain);
6500
6501 return 0;
6502}
6503EXPORT_SYMBOL_GPL(__nft_release_basechain);
6504
98319cb9 6505static void __nft_release_tables(struct net *net)
df05ef87 6506{
3b49e2e9 6507 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 6508 struct nft_table *table, *nt;
6509 struct nft_chain *chain, *nc;
e5009240 6510 struct nft_object *obj, *ne;
df05ef87
PNA		 6511 struct nft_rule *rule, *nr;
6512 struct nft_set *set, *ns;
6513 struct nft_ctx ctx = {
6514 .net = net,
df05ef87
PNA		 6515 };
6516
36596dad 6517 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 6518 ctx.family = table->family;
dd4cbef7 6519
df05ef87 6520 list_for_each_entry(chain, &table->chains, list)
c974a3a3 6521 nf_tables_unregister_hook(net, table, chain);
3b49e2e9
PNA		 6522 list_for_each_entry(flowtable, &table->flowtables, list)
6523 nf_unregister_net_hooks(net, flowtable->ops,
6524 flowtable->ops_len);
df05ef87
PNA		 6525 /* No packets are walking on these chains anymore. */
6526 ctx.table = table;
6527 list_for_each_entry(chain, &table->chains, list) {
6528 ctx.chain = chain;
6529 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
6530 list_del(&rule->list);
6531 chain->use--;
6532 nf_tables_rule_destroy(&ctx, rule);
6533 }
6534 }
3b49e2e9
PNA		 6535 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
6536 list_del(&flowtable->list);
6537 table->use--;
6538 nf_tables_flowtable_destroy(flowtable);
6539 }
df05ef87
PNA		 6540 list_for_each_entry_safe(set, ns, &table->sets, list) {
6541 list_del(&set->list);
6542 table->use--;
6543 nft_set_destroy(set);
6544 }
e5009240
PNA		 6545 list_for_each_entry_safe(obj, ne, &table->objects, list) {
6546 list_del(&obj->list);
6547 table->use--;
6548 nft_obj_destroy(obj);
6549 }
df05ef87
PNA		 6550 list_for_each_entry_safe(chain, nc, &table->chains, list) {
6551 list_del(&chain->list);
6552 table->use--;
6553 nf_tables_chain_destroy(chain);
6554 }
6555 list_del(&table->list);
6556 nf_tables_table_destroy(&ctx);
6557 }
6558}
6559
dd4cbef7
PNA		 6560static int __net_init nf_tables_init_net(struct net *net)
6561{
6562 INIT_LIST_HEAD(&net->nft.tables);
6563 INIT_LIST_HEAD(&net->nft.commit_list);
6564 net->nft.base_seq = 1;
6565 return 0;
6566}
6567
6568static void __net_exit nf_tables_exit_net(struct net *net)
6569{
98319cb9 6570 __nft_release_tables(net);
dd4cbef7
PNA		 6571 WARN_ON_ONCE(!list_empty(&net->nft.tables));
6572 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
6573}
6574
99633ab2
PNA		 6575static struct pernet_operations nf_tables_net_ops = {
6576 .init = nf_tables_init_net,
613d0776 6577 .exit = nf_tables_exit_net,
99633ab2
PNA		 6578};
6579
96518518
PM		 6580static int __init nf_tables_module_init(void)
6581{
6582 int err;
6583
6584 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
6585 GFP_KERNEL);
6586 if (info == NULL) {
6587 err = -ENOMEM;
6588 goto err1;
6589 }
6590
6591 err = nf_tables_core_module_init();
6592 if (err < 0)
6593 goto err2;
6594
6595 err = nfnetlink_subsys_register(&nf_tables_subsys);
6596 if (err < 0)
6597 goto err3;
6598
3b49e2e9
PNA		 6599 register_netdevice_notifier(&nf_tables_flowtable_notifier);
6600
99633ab2 6601 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 6602err3:
6603 nf_tables_core_module_exit();
6604err2:
6605 kfree(info);
6606err1:
6607 return err;
6608}
6609
6610static void __exit nf_tables_module_exit(void)
6611{
99633ab2 6612 unregister_pernet_subsys(&nf_tables_net_ops);
96518518 6613 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 6614 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
1b1bc49c 6615 rcu_barrier();
96518518
PM		 6616 nf_tables_core_module_exit();
6617 kfree(info);
6618}
6619
6620module_init(nf_tables_module_init);
6621module_exit(nf_tables_module_exit);
6622
6623MODULE_LICENSE("GPL");
6624MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
6625MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror