]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
d2912cb1 1// SPDX-License-Identifier: GPL-2.0-only
96518518 2/*
20a69341 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518 4 *
96518518
PM		 5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8#include <linux/module.h>
9#include <linux/init.h>
10#include <linux/list.h>
11#include <linux/skbuff.h>
12#include <linux/netlink.h>
1ff75a3e 13#include <linux/vmalloc.h>
0eb71a9d 14#include <linux/rhashtable.h>
8e6cf365 15#include <linux/audit.h>
96518518
PM		 16#include <linux/netfilter.h>
17#include <linux/netfilter/nfnetlink.h>
18#include <linux/netfilter/nf_tables.h>
3b49e2e9 19#include <net/netfilter/nf_flow_table.h>
96518518
PM		 20#include <net/netfilter/nf_tables_core.h>
21#include <net/netfilter/nf_tables.h>
c9626a2c 22#include <net/netfilter/nf_tables_offload.h>
99633ab2 23#include <net/net_namespace.h>
96518518
PM		 24#include <net/sock.h>
25
9332d27d
FW		 26#define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
27
96518518 28static LIST_HEAD(nf_tables_expressions);
e5009240 29static LIST_HEAD(nf_tables_objects);
3b49e2e9 30static LIST_HEAD(nf_tables_flowtables);
0935d558
FW		 31static LIST_HEAD(nf_tables_destroy_list);
32static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
3ecbfd65 33static u64 table_handle;
96518518 34
a654de8f
PNA		 35enum {
36 NFT_VALIDATE_SKIP = 0,
37 NFT_VALIDATE_NEED,
38 NFT_VALIDATE_DO,
39};
40
4d44175a
FW		 41static struct rhltable nft_objname_ht;
42
1b2470e5
FW		 43static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
44static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
45static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
46
4d44175a
FW		 47static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
48static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
49static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
50
1b2470e5
FW		 51static const struct rhashtable_params nft_chain_ht_params = {
52 .head_offset = offsetof(struct nft_chain, rhlhead),
53 .key_offset = offsetof(struct nft_chain, name),
54 .hashfn = nft_chain_hash,
55 .obj_hashfn = nft_chain_hash_obj,
56 .obj_cmpfn = nft_chain_hash_cmp,
1b2470e5
FW		 57 .automatic_shrinking = true,
58};
59
4d44175a
FW		 60static const struct rhashtable_params nft_objname_ht_params = {
61 .head_offset = offsetof(struct nft_object, rhlhead),
62 .key_offset = offsetof(struct nft_object, key),
63 .hashfn = nft_objname_hash,
64 .obj_hashfn = nft_objname_hash_obj,
65 .obj_cmpfn = nft_objname_hash_cmp,
66 .automatic_shrinking = true,
67};
68
a654de8f
PNA		 69static void nft_validate_state_update(struct net *net, u8 new_validate_state)
70{
71 switch (net->nft.validate_state) {
72 case NFT_VALIDATE_SKIP:
73 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
74 break;
75 case NFT_VALIDATE_NEED:
76 break;
77 case NFT_VALIDATE_DO:
78 if (new_validate_state == NFT_VALIDATE_NEED)
79 return;
80 }
81
82 net->nft.validate_state = new_validate_state;
83}
0935d558
FW		 84static void nf_tables_trans_destroy_work(struct work_struct *w);
85static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
a654de8f 86
7c95f6d8 87static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 88 struct net *net,
7c95f6d8
PNA		 89 const struct sk_buff *skb,
90 const struct nlmsghdr *nlh,
36596dad 91 u8 family,
7c95f6d8
PNA		 92 struct nft_table *table,
93 struct nft_chain *chain,
94 const struct nlattr * const *nla)
95{
633c9a84 96 ctx->net = net;
36596dad 97 ctx->family = family;
26b2f552 98 ctx->level = 0;
128ad332
PNA		 99 ctx->table = table;
100 ctx->chain = chain;
101 ctx->nla = nla;
102 ctx->portid = NETLINK_CB(skb).portid;
103 ctx->report = nlmsg_report(nlh);
c9626a2c 104 ctx->flags = nlh->nlmsg_flags;
128ad332 105 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 106}
107
8411b644
PNA		 108static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
109 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 110{
111 struct nft_trans *trans;
112
8411b644 113 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 114 if (trans == NULL)
115 return NULL;
116
b380e5c7 117 trans->msg_type = msg_type;
1081d11b
PNA		 118 trans->ctx = *ctx;
119
120 return trans;
121}
122
8411b644
PNA		 123static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
124 int msg_type, u32 size)
125{
126 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
127}
128
1081d11b
PNA		 129static void nft_trans_destroy(struct nft_trans *trans)
130{
131 list_del(&trans->list);
132 kfree(trans);
133}
134
f6ac8585
PNA		 135static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
136{
137 struct net *net = ctx->net;
138 struct nft_trans *trans;
139
140 if (!nft_set_is_anonymous(set))
141 return;
142
143 list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
6a0a8d10
PNA		 144 switch (trans->msg_type) {
145 case NFT_MSG_NEWSET:
146 if (nft_trans_set(trans) == set)
147 nft_trans_set_bound(trans) = true;
148 break;
149 case NFT_MSG_NEWSETELEM:
150 if (nft_trans_elem_set(trans) == set)
151 nft_trans_elem_set_bound(trans) = true;
f6ac8585
PNA		 152 break;
153 }
154 }
155}
156
d54725cd
PNA		 157static int nft_netdev_register_hooks(struct net *net,
158 struct list_head *hook_list)
159{
160 struct nft_hook *hook;
161 int err, j;
162
163 j = 0;
164 list_for_each_entry(hook, hook_list, list) {
165 err = nf_register_net_hook(net, &hook->ops);
166 if (err < 0)
167 goto err_register;
168
169 j++;
170 }
171 return 0;
172
173err_register:
174 list_for_each_entry(hook, hook_list, list) {
175 if (j-- <= 0)
176 break;
177
178 nf_unregister_net_hook(net, &hook->ops);
179 }
180 return err;
181}
182
183static void nft_netdev_unregister_hooks(struct net *net,
184 struct list_head *hook_list)
185{
186 struct nft_hook *hook;
187
188 list_for_each_entry(hook, hook_list, list)
189 nf_unregister_net_hook(net, &hook->ops);
190}
191
c974a3a3
PNA		 192static int nf_tables_register_hook(struct net *net,
193 const struct nft_table *table,
194 struct nft_chain *chain)
d8ee8f7c 195{
d54725cd 196 struct nft_base_chain *basechain;
a37061a6 197 const struct nf_hook_ops *ops;
ae6153b5 198
d8ee8f7c 199 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 200 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 201 return 0;
202
4e25ceb8
FW		 203 basechain = nft_base_chain(chain);
204 ops = &basechain->ops;
ae6153b5 205
4e25ceb8
FW		 206 if (basechain->type->ops_register)
207 return basechain->type->ops_register(net, ops);
208
1e9451cb
FW		 209 if (table->family == NFPROTO_NETDEV)
210 return nft_netdev_register_hooks(net, &basechain->hook_list);
211
212 return nf_register_net_hook(net, &basechain->ops);
d8ee8f7c
PNA		 213}
214
c974a3a3
PNA		 215static void nf_tables_unregister_hook(struct net *net,
216 const struct nft_table *table,
217 struct nft_chain *chain)
c5598794 218{
d54725cd 219 struct nft_base_chain *basechain;
4e25ceb8
FW		 220 const struct nf_hook_ops *ops;
221
d8ee8f7c 222 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 223 !nft_is_base_chain(chain))
d8ee8f7c 224 return;
4e25ceb8
FW		 225 basechain = nft_base_chain(chain);
226 ops = &basechain->ops;
d8ee8f7c 227
4e25ceb8
FW		 228 if (basechain->type->ops_unregister)
229 return basechain->type->ops_unregister(net, ops);
230
1e9451cb
FW		 231 if (table->family == NFPROTO_NETDEV)
232 nft_netdev_unregister_hooks(net, &basechain->hook_list);
233 else
234 nf_unregister_net_hook(net, &basechain->ops);
c5598794
AB		 235}
236
ee01d542
AB		 237static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
238{
239 struct nft_trans *trans;
240
241 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
242 if (trans == NULL)
243 return -ENOMEM;
244
245 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 246 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 247
248 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
249 return 0;
250}
251
252static int nft_deltable(struct nft_ctx *ctx)
253{
254 int err;
255
256 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
257 if (err < 0)
258 return err;
259
f2a6d766 260 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 261 return err;
262}
263
66293c46 264static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
ee01d542
AB		 265{
266 struct nft_trans *trans;
267
268 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
269 if (trans == NULL)
66293c46 270 return ERR_PTR(-ENOMEM);
ee01d542 271
74cccc3d 272 if (msg_type == NFT_MSG_NEWCHAIN) {
664b0f8c 273 nft_activate_next(ctx->net, ctx->chain);
ee01d542 274
74cccc3d
PNA		 275 if (ctx->nla[NFTA_CHAIN_ID]) {
276 nft_trans_chain_id(trans) =
277 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID]));
278 }
279 }
280
ee01d542 281 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
66293c46 282 return trans;
ee01d542
AB		 283}
284
285static int nft_delchain(struct nft_ctx *ctx)
286{
66293c46 287 struct nft_trans *trans;
ee01d542 288
66293c46
FW		 289 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
290 if (IS_ERR(trans))
291 return PTR_ERR(trans);
ee01d542
AB		 292
293 ctx->table->use--;
664b0f8c 294 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542 295
66293c46 296 return 0;
ee01d542
AB		 297}
298
bb7b40ae
PNA		 299static void nft_rule_expr_activate(const struct nft_ctx *ctx,
300 struct nft_rule *rule)
301{
302 struct nft_expr *expr;
303
304 expr = nft_expr_first(rule);
305 while (expr != nft_expr_last(rule) && expr->ops) {
306 if (expr->ops->activate)
307 expr->ops->activate(ctx, expr);
308
309 expr = nft_expr_next(expr);
310 }
311}
312
313static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
f6ac8585
PNA		 314 struct nft_rule *rule,
315 enum nft_trans_phase phase)
bb7b40ae
PNA		 316{
317 struct nft_expr *expr;
318
319 expr = nft_expr_first(rule);
320 while (expr != nft_expr_last(rule) && expr->ops) {
321 if (expr->ops->deactivate)
f6ac8585 322 expr->ops->deactivate(ctx, expr, phase);
bb7b40ae
PNA		 323
324 expr = nft_expr_next(expr);
325 }
326}
327
ee01d542
AB		 328static int
329nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
330{
331 /* You cannot delete the same rule twice */
889f7ee7
PNA		 332 if (nft_is_active_next(ctx->net, rule)) {
333 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 334 ctx->chain->use--;
335 return 0;
336 }
337 return -ENOENT;
338}
339
340static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
341 struct nft_rule *rule)
342{
343 struct nft_trans *trans;
344
345 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
346 if (trans == NULL)
347 return NULL;
348
1a94e38d
PNA		 349 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
350 nft_trans_rule_id(trans) =
351 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
352 }
ee01d542
AB		 353 nft_trans_rule(trans) = rule;
354 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
355
356 return trans;
357}
358
359static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
360{
63b48c73 361 struct nft_flow_rule *flow;
ee01d542
AB		 362 struct nft_trans *trans;
363 int err;
364
365 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
366 if (trans == NULL)
367 return -ENOMEM;
368
63b48c73
PNA		 369 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
370 flow = nft_flow_rule_create(ctx->net, rule);
371 if (IS_ERR(flow)) {
372 nft_trans_destroy(trans);
373 return PTR_ERR(flow);
374 }
375
376 nft_trans_flow_rule(trans) = flow;
377 }
378
ee01d542
AB		 379 err = nf_tables_delrule_deactivate(ctx, rule);
380 if (err < 0) {
381 nft_trans_destroy(trans);
382 return err;
383 }
f6ac8585 384 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
ee01d542
AB		 385
386 return 0;
387}
388
389static int nft_delrule_by_chain(struct nft_ctx *ctx)
390{
391 struct nft_rule *rule;
392 int err;
393
394 list_for_each_entry(rule, &ctx->chain->rules, list) {
23b7ca4f
PNA		 395 if (!nft_is_active_next(ctx->net, rule))
396 continue;
397
ee01d542
AB		 398 err = nft_delrule(ctx, rule);
399 if (err < 0)
400 return err;
401 }
402 return 0;
403}
404
cd5125d8 405static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
ee01d542
AB		 406 struct nft_set *set)
407{
408 struct nft_trans *trans;
409
410 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
411 if (trans == NULL)
412 return -ENOMEM;
413
414 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
415 nft_trans_set_id(trans) =
416 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 417 nft_activate_next(ctx->net, set);
ee01d542
AB		 418 }
419 nft_trans_set(trans) = set;
420 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
421
422 return 0;
423}
424
cd5125d8 425static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
ee01d542
AB		 426{
427 int err;
428
429 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
430 if (err < 0)
431 return err;
432
37a9cc52 433 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 434 ctx->table->use--;
435
436 return err;
437}
438
e5009240
PNA		 439static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
440 struct nft_object *obj)
441{
442 struct nft_trans *trans;
443
444 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
445 if (trans == NULL)
446 return -ENOMEM;
447
448 if (msg_type == NFT_MSG_NEWOBJ)
449 nft_activate_next(ctx->net, obj);
450
451 nft_trans_obj(trans) = obj;
452 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
453
454 return 0;
455}
456
457static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
458{
459 int err;
460
461 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
462 if (err < 0)
463 return err;
464
465 nft_deactivate_next(ctx->net, obj);
466 ctx->table->use--;
467
468 return err;
469}
470
3b49e2e9
PNA		 471static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
472 struct nft_flowtable *flowtable)
473{
474 struct nft_trans *trans;
475
476 trans = nft_trans_alloc(ctx, msg_type,
477 sizeof(struct nft_trans_flowtable));
478 if (trans == NULL)
479 return -ENOMEM;
480
481 if (msg_type == NFT_MSG_NEWFLOWTABLE)
482 nft_activate_next(ctx->net, flowtable);
483
484 nft_trans_flowtable(trans) = flowtable;
485 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
486
487 return 0;
488}
489
490static int nft_delflowtable(struct nft_ctx *ctx,
491 struct nft_flowtable *flowtable)
492{
493 int err;
494
495 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
496 if (err < 0)
497 return err;
498
499 nft_deactivate_next(ctx->net, flowtable);
500 ctx->table->use--;
501
502 return err;
503}
504
96518518
PM		 505/*
506 * Tables
507 */
508
36596dad 509static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 510 const struct nlattr *nla,
36596dad 511 u8 family, u8 genmask)
96518518
PM		 512{
513 struct nft_table *table;
514
cac20fcd
PNA		 515 if (nla == NULL)
516 return ERR_PTR(-EINVAL);
517
0a6a9515
QC		 518 list_for_each_entry_rcu(table, &net->nft.tables, list,
519 lockdep_is_held(&net->nft.commit_mutex)) {
f2a6d766 520 if (!nla_strcmp(nla, table->name) &&
98319cb9 521 table->family == family &&
f2a6d766 522 nft_active_genmask(table, genmask))
96518518
PM		 523 return table;
524 }
cac20fcd
PNA		 525
526 return ERR_PTR(-ENOENT);
96518518
PM		 527}
528
3ecbfd65
HS		 529static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
530 const struct nlattr *nla,
531 u8 genmask)
532{
533 struct nft_table *table;
534
535 list_for_each_entry(table, &net->nft.tables, list) {
536 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
537 nft_active_genmask(table, genmask))
538 return table;
539 }
3ecbfd65
HS		 540
541 return ERR_PTR(-ENOENT);
542}
543
96518518
PM		 544static inline u64 nf_tables_alloc_handle(struct nft_table *table)
545{
546 return ++table->hgenerator;
547}
548
32537e91 549static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 550
82603549
PNA		 551static const struct nft_chain_type *
552__nft_chain_type_get(u8 family, enum nft_chain_types type)
553{
554 if (family >= NFPROTO_NUMPROTO ||
555 type >= NFT_CHAIN_T_MAX)
556 return NULL;
557
558 return chain_type[family][type];
559}
560
32537e91 561static const struct nft_chain_type *
1ea26cca 562__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c 563{
82603549 564 const struct nft_chain_type *type;
9370761c
PNA		 565 int i;
566
baae3e62 567 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
82603549
PNA		 568 type = __nft_chain_type_get(family, i);
569 if (!type)
570 continue;
571 if (!nla_strcmp(nla, type->name))
572 return type;
9370761c 573 }
baae3e62 574 return NULL;
9370761c
PNA		 575}
576
eb014de4
PNA		 577struct nft_module_request {
578 struct list_head list;
579 char module[MODULE_NAME_LEN];
580 bool done;
581};
582
452238e8 583#ifdef CONFIG_MODULES
eb014de4 584static int nft_request_module(struct net *net, const char *fmt, ...)
452238e8
FW		 585{
586 char module_name[MODULE_NAME_LEN];
eb014de4 587 struct nft_module_request *req;
452238e8
FW		 588 va_list args;
589 int ret;
590
452238e8
FW		 591 va_start(args, fmt);
592 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
593 va_end(args);
9332d27d 594 if (ret >= MODULE_NAME_LEN)
eb014de4 595 return 0;
452238e8 596
eb014de4
PNA		 597 list_for_each_entry(req, &net->nft.module_list, list) {
598 if (!strcmp(req->module, module_name)) {
599 if (req->done)
600 return 0;
ec7470b8 601
eb014de4
PNA		 602 /* A request to load this module already exists. */
603 return -EAGAIN;
604 }
605 }
606
607 req = kmalloc(sizeof(*req), GFP_KERNEL);
608 if (!req)
609 return -ENOMEM;
610
611 req->done = false;
612 strlcpy(req->module, module_name, MODULE_NAME_LEN);
613 list_add_tail(&req->list, &net->nft.module_list);
614
615 return -EAGAIN;
452238e8
FW		 616}
617#endif
618
f102d66b
FW		 619static void lockdep_nfnl_nft_mutex_not_held(void)
620{
621#ifdef CONFIG_PROVE_LOCKING
622 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
623#endif
624}
625
32537e91 626static const struct nft_chain_type *
452238e8
FW		 627nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
628 u8 family, bool autoload)
9370761c 629{
32537e91 630 const struct nft_chain_type *type;
9370761c 631
1ea26cca 632 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 633 if (type != NULL)
634 return type;
f102d66b
FW		 635
636 lockdep_nfnl_nft_mutex_not_held();
9370761c 637#ifdef CONFIG_MODULES
93b0806f 638 if (autoload) {
eb014de4
PNA		 639 if (nft_request_module(net, "nft-chain-%u-%.*s", family,
640 nla_len(nla),
641 (const char *)nla_data(nla)) == -EAGAIN)
93b0806f 642 return ERR_PTR(-EAGAIN);
9370761c
PNA		 643 }
644#endif
93b0806f 645 return ERR_PTR(-ENOENT);
9370761c
PNA		 646}
647
96518518 648static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 649 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
650 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 651 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 652 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 653};
654
84d7fce6
PNA		 655static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
656 u32 portid, u32 seq, int event, u32 flags,
657 int family, const struct nft_table *table)
96518518
PM		 658{
659 struct nlmsghdr *nlh;
660 struct nfgenmsg *nfmsg;
661
dedb67c4 662 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 663 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
664 if (nlh == NULL)
665 goto nla_put_failure;
666
667 nfmsg = nlmsg_data(nlh);
668 nfmsg->nfgen_family = family;
669 nfmsg->version = NFNETLINK_V0;
84d7fce6 670 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 671
9ddf6323 672 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 673 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 674 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
675 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
676 NFTA_TABLE_PAD))
96518518
PM		 677 goto nla_put_failure;
678
053c095a
JB		 679 nlmsg_end(skb, nlh);
680 return 0;
96518518
PM		 681
682nla_put_failure:
683 nlmsg_trim(skb, nlh);
684 return -1;
685}
686
25e94a99 687static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 688{
689 struct sk_buff *skb;
96518518 690 int err;
8e6cf365
RGB		 691 char *buf = kasprintf(GFP_KERNEL, "%s:%llu;?:0",
692 ctx->table->name, ctx->table->handle);
693
694 audit_log_nfcfg(buf,
695 ctx->family,
696 ctx->table->use,
697 event == NFT_MSG_NEWTABLE ?
698 AUDIT_NFT_OP_TABLE_REGISTER :
14224039
RGB		 699 AUDIT_NFT_OP_TABLE_UNREGISTER,
700 GFP_KERNEL);
8e6cf365 701 kfree(buf);
96518518 702
128ad332
PNA		 703 if (!ctx->report &&
704 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 705 return;
96518518 706
96518518
PM		 707 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
708 if (skb == NULL)
709 goto err;
710
84d7fce6 711 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 712 event, 0, ctx->family, ctx->table);
96518518
PM		 713 if (err < 0) {
714 kfree_skb(skb);
715 goto err;
716 }
717
25e94a99
PNA		 718 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
719 ctx->report, GFP_KERNEL);
720 return;
96518518 721err:
25e94a99 722 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 723}
724
725static int nf_tables_dump_tables(struct sk_buff *skb,
726 struct netlink_callback *cb)
727{
728 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 729 const struct nft_table *table;
730 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 731 struct net *net = sock_net(skb->sk);
96518518
PM		 732 int family = nfmsg->nfgen_family;
733
e688a7f8 734 rcu_read_lock();
38e029f1
PNA		 735 cb->seq = net->nft.base_seq;
736
36596dad 737 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 738 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 739 continue;
740
36596dad
PNA		 741 if (idx < s_idx)
742 goto cont;
743 if (idx > s_idx)
744 memset(&cb->args[1], 0,
745 sizeof(cb->args) - sizeof(cb->args[0]));
746 if (!nft_is_active(net, table))
747 continue;
748 if (nf_tables_fill_table_info(skb, net,
749 NETLINK_CB(cb->skb).portid,
750 cb->nlh->nlmsg_seq,
751 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 752 table->family, table) < 0)
36596dad
PNA		 753 goto done;
754
755 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 756cont:
36596dad 757 idx++;
96518518
PM		 758 }
759done:
e688a7f8 760 rcu_read_unlock();
96518518
PM		 761 cb->args[0] = idx;
762 return skb->len;
763}
764
d9adf22a
FW		 765static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
766 const struct nlmsghdr *nlh,
767 struct netlink_dump_control *c)
768{
769 int err;
770
771 if (!try_module_get(THIS_MODULE))
772 return -EINVAL;
773
774 rcu_read_unlock();
775 err = netlink_dump_start(nlsk, skb, nlh, c);
776 rcu_read_lock();
777 module_put(THIS_MODULE);
778
779 return err;
780}
781
782/* called with rcu_read_lock held */
7b8002a1
PNA		 783static int nf_tables_gettable(struct net *net, struct sock *nlsk,
784 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 785 const struct nlattr * const nla[],
786 struct netlink_ext_ack *extack)
96518518
PM		 787{
788 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 789 u8 genmask = nft_genmask_cur(net);
96518518
PM		 790 const struct nft_table *table;
791 struct sk_buff *skb2;
792 int family = nfmsg->nfgen_family;
793 int err;
794
795 if (nlh->nlmsg_flags & NLM_F_DUMP) {
796 struct netlink_dump_control c = {
797 .dump = nf_tables_dump_tables,
d9adf22a 798 .module = THIS_MODULE,
96518518 799 };
d9adf22a
FW		 800
801 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 802 }
803
cac20fcd 804 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 805 if (IS_ERR(table)) {
806 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 807 return PTR_ERR(table);
36dd1bcc 808 }
96518518 809
d9adf22a 810 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 811 if (!skb2)
812 return -ENOMEM;
813
84d7fce6 814 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 815 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
816 family, table);
817 if (err < 0)
818 goto err;
819
820 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
821
822err:
823 kfree_skb(skb2);
824 return err;
825}
826
c9c17211 827static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 828{
829 struct nft_chain *chain;
830 u32 i = 0;
831
832 list_for_each_entry(chain, &table->chains, list) {
833 if (!nft_is_active_next(net, chain))
834 continue;
f323d954 835 if (!nft_is_base_chain(chain))
10435c11
F		 836 continue;
837
838 if (cnt && i++ == cnt)
839 break;
840
1e9451cb 841 nf_tables_unregister_hook(net, table, chain);
10435c11
F		 842 }
843}
844
c9c17211 845static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 846{
847 struct nft_chain *chain;
848 int err, i = 0;
849
850 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 851 if (!nft_is_active_next(net, chain))
852 continue;
f323d954 853 if (!nft_is_base_chain(chain))
d2012975
PNA		 854 continue;
855
1e9451cb 856 err = nf_tables_register_hook(net, table, chain);
9ddf6323 857 if (err < 0)
d54725cd 858 goto err_register_hooks;
9ddf6323
PNA		 859
860 i++;
861 }
862 return 0;
d54725cd
PNA		 863
864err_register_hooks:
10435c11 865 if (i)
c9c17211 866 nft_table_disable(net, table, i);
9ddf6323
PNA		 867 return err;
868}
869
c9c17211 870static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 871{
c9c17211 872 nft_table_disable(net, table, 0);
9ddf6323
PNA		 873}
874
e1aaca93 875static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 876{
55dd6f93 877 struct nft_trans *trans;
e1aaca93 878 u32 flags;
55dd6f93 879 int ret = 0;
9ddf6323 880
e1aaca93
PNA		 881 if (!ctx->nla[NFTA_TABLE_FLAGS])
882 return 0;
9ddf6323 883
e1aaca93
PNA		 884 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
885 if (flags & ~NFT_TABLE_F_DORMANT)
886 return -EINVAL;
887
63283dd2
PNA		 888 if (flags == ctx->table->flags)
889 return 0;
890
55dd6f93
PNA		 891 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
892 sizeof(struct nft_trans_table));
893 if (trans == NULL)
894 return -ENOMEM;
9ddf6323 895
e1aaca93
PNA		 896 if ((flags & NFT_TABLE_F_DORMANT) &&
897 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 898 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 899 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
900 ctx->table->flags & NFT_TABLE_F_DORMANT) {
1e9451cb 901 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
c9c17211 902 ret = nf_tables_table_enable(ctx->net, ctx->table);
1e9451cb 903 if (ret >= 0)
55dd6f93 904 nft_trans_table_enable(trans) = true;
1e9451cb
FW		 905 else
906 ctx->table->flags |= NFT_TABLE_F_DORMANT;
9ddf6323 907 }
e1aaca93
PNA		 908 if (ret < 0)
909 goto err;
9ddf6323 910
55dd6f93
PNA		 911 nft_trans_table_update(trans) = true;
912 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
913 return 0;
9ddf6323 914err:
55dd6f93 915 nft_trans_destroy(trans);
9ddf6323
PNA		 916 return ret;
917}
918
1b2470e5
FW		 919static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
920{
921 const char *name = data;
922
923 return jhash(name, strlen(name), seed);
924}
925
926static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
927{
928 const struct nft_chain *chain = data;
929
930 return nft_chain_hash(chain->name, 0, seed);
931}
932
933static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
934 const void *ptr)
935{
936 const struct nft_chain *chain = ptr;
937 const char *name = arg->key;
938
939 return strcmp(chain->name, name);
940}
941
4d44175a
FW		 942static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
943{
944 const struct nft_object_hash_key *k = data;
945
946 seed ^= hash_ptr(k->table, 32);
947
948 return jhash(k->name, strlen(k->name), seed);
949}
950
951static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
952{
953 const struct nft_object *obj = data;
954
955 return nft_objname_hash(&obj->key, 0, seed);
956}
957
958static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
959 const void *ptr)
960{
961 const struct nft_object_hash_key *k = arg->key;
962 const struct nft_object *obj = ptr;
963
964 if (obj->key.table != k->table)
965 return -1;
966
967 return strcmp(obj->key.name, k->name);
968}
969
633c9a84
PNA		 970static int nf_tables_newtable(struct net *net, struct sock *nlsk,
971 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 972 const struct nlattr * const nla[],
973 struct netlink_ext_ack *extack)
96518518
PM		 974{
975 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 976 u8 genmask = nft_genmask_next(net);
96518518 977 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 978 const struct nlattr *attr;
979 struct nft_table *table;
c5c1f975 980 u32 flags = 0;
e1aaca93 981 struct nft_ctx ctx;
55dd6f93 982 int err;
96518518 983
f102d66b 984 lockdep_assert_held(&net->nft.commit_mutex);
36dd1bcc
PNA		 985 attr = nla[NFTA_TABLE_NAME];
986 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 987 if (IS_ERR(table)) {
988 if (PTR_ERR(table) != -ENOENT)
989 return PTR_ERR(table);
1a28ad74 990 } else {
36dd1bcc
PNA		 991 if (nlh->nlmsg_flags & NLM_F_EXCL) {
992 NL_SET_BAD_ATTR(extack, attr);
96518518 993 return -EEXIST;
36dd1bcc 994 }
96518518
PM		 995 if (nlh->nlmsg_flags & NLM_F_REPLACE)
996 return -EOPNOTSUPP;
e1aaca93 997
98319cb9 998 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 999 return nf_tables_updtable(&ctx);
96518518
PM		 1000 }
1001
c5c1f975
PM		 1002 if (nla[NFTA_TABLE_FLAGS]) {
1003 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
1004 if (flags & ~NFT_TABLE_F_DORMANT)
1005 return -EINVAL;
1006 }
1007
ffdb210e 1008 err = -ENOMEM;
1cae565e 1009 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 1010 if (table == NULL)
98319cb9 1011 goto err_kzalloc;
96518518 1012
36dd1bcc 1013 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 1014 if (table->name == NULL)
98319cb9 1015 goto err_strdup;
e46abbcc 1016
1b2470e5
FW		 1017 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
1018 if (err)
1019 goto err_chain_ht;
1020
96518518 1021 INIT_LIST_HEAD(&table->chains);
20a69341 1022 INIT_LIST_HEAD(&table->sets);
e5009240 1023 INIT_LIST_HEAD(&table->objects);
3b49e2e9 1024 INIT_LIST_HEAD(&table->flowtables);
98319cb9 1025 table->family = family;
c5c1f975 1026 table->flags = flags;
3ecbfd65 1027 table->handle = ++table_handle;
9ddf6323 1028
98319cb9 1029 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 1030 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 1031 if (err < 0)
98319cb9 1032 goto err_trans;
ffdb210e 1033
36596dad 1034 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 1035 return 0;
98319cb9 1036err_trans:
1b2470e5
FW		 1037 rhltable_destroy(&table->chains_ht);
1038err_chain_ht:
e46abbcc 1039 kfree(table->name);
98319cb9 1040err_strdup:
ffdb210e 1041 kfree(table);
98319cb9 1042err_kzalloc:
ffdb210e 1043 return err;
96518518
PM		 1044}
1045
b9ac12ef
AB		 1046static int nft_flush_table(struct nft_ctx *ctx)
1047{
3b49e2e9 1048 struct nft_flowtable *flowtable, *nft;
b9ac12ef 1049 struct nft_chain *chain, *nc;
e5009240 1050 struct nft_object *obj, *ne;
b9ac12ef 1051 struct nft_set *set, *ns;
3b49e2e9 1052 int err;
b9ac12ef 1053
a2f18db0 1054 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 1055 if (!nft_is_active_next(ctx->net, chain))
1056 continue;
1057
d0e2c7de
PNA		 1058 if (nft_chain_is_bound(chain))
1059 continue;
1060
b9ac12ef
AB		 1061 ctx->chain = chain;
1062
1063 err = nft_delrule_by_chain(ctx);
1064 if (err < 0)
1065 goto out;
b9ac12ef
AB		 1066 }
1067
1068 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 1069 if (!nft_is_active_next(ctx->net, set))
1070 continue;
1071
408070d6 1072 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 1073 !list_empty(&set->bindings))
1074 continue;
1075
1076 err = nft_delset(ctx, set);
1077 if (err < 0)
1078 goto out;
1079 }
1080
3b49e2e9 1081 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
335178d5
FW		 1082 if (!nft_is_active_next(ctx->net, flowtable))
1083 continue;
1084
3b49e2e9
PNA		 1085 err = nft_delflowtable(ctx, flowtable);
1086 if (err < 0)
1087 goto out;
1088 }
1089
e5009240 1090 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
335178d5
FW		 1091 if (!nft_is_active_next(ctx->net, obj))
1092 continue;
1093
e5009240
PNA		 1094 err = nft_delobj(ctx, obj);
1095 if (err < 0)
1096 goto out;
1097 }
1098
a2f18db0 1099 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 1100 if (!nft_is_active_next(ctx->net, chain))
1101 continue;
1102
d0e2c7de
PNA		 1103 if (nft_chain_is_bound(chain))
1104 continue;
1105
a2f18db0
PNA		 1106 ctx->chain = chain;
1107
1108 err = nft_delchain(ctx);
1109 if (err < 0)
1110 goto out;
1111 }
1112
b9ac12ef
AB		 1113 err = nft_deltable(ctx);
1114out:
1115 return err;
1116}
1117
1118static int nft_flush(struct nft_ctx *ctx, int family)
1119{
b9ac12ef
AB		 1120 struct nft_table *table, *nt;
1121 const struct nlattr * const *nla = ctx->nla;
1122 int err = 0;
1123
36596dad 1124 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 1125 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 1126 continue;
1127
98319cb9 1128 ctx->family = table->family;
f2a6d766 1129
36596dad
PNA		 1130 if (!nft_is_active_next(ctx->net, table))
1131 continue;
b9ac12ef 1132
36596dad
PNA		 1133 if (nla[NFTA_TABLE_NAME] &&
1134 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1135 continue;
b9ac12ef 1136
36596dad
PNA		 1137 ctx->table = table;
1138
1139 err = nft_flush_table(ctx);
1140 if (err < 0)
1141 goto out;
b9ac12ef
AB		 1142 }
1143out:
1144 return err;
1145}
1146
633c9a84
PNA		 1147static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1148 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1149 const struct nlattr * const nla[],
1150 struct netlink_ext_ack *extack)
96518518
PM		 1151{
1152 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1153 u8 genmask = nft_genmask_next(net);
ee01d542 1154 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 1155 const struct nlattr *attr;
1156 struct nft_table *table;
55dd6f93 1157 struct nft_ctx ctx;
96518518 1158
36596dad 1159 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 1160 if (family == AF_UNSPEC ||
1161 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 1162 return nft_flush(&ctx, family);
1163
36dd1bcc
PNA		 1164 if (nla[NFTA_TABLE_HANDLE]) {
1165 attr = nla[NFTA_TABLE_HANDLE];
1166 table = nft_table_lookup_byhandle(net, attr, genmask);
1167 } else {
1168 attr = nla[NFTA_TABLE_NAME];
1169 table = nft_table_lookup(net, attr, family, genmask);
1170 }
3ecbfd65 1171
36dd1bcc
PNA		 1172 if (IS_ERR(table)) {
1173 NL_SET_BAD_ATTR(extack, attr);
96518518 1174 return PTR_ERR(table);
36dd1bcc 1175 }
96518518 1176
a8278400
PNA		 1177 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1178 table->use > 0)
1179 return -EBUSY;
1180
98319cb9 1181 ctx.family = family;
b9ac12ef 1182 ctx.table = table;
55dd6f93 1183
b9ac12ef 1184 return nft_flush_table(&ctx);
96518518
PM		 1185}
1186
55dd6f93
PNA		 1187static void nf_tables_table_destroy(struct nft_ctx *ctx)
1188{
fa5950e4
FW		 1189 if (WARN_ON(ctx->table->use > 0))
1190 return;
4fefee57 1191
1b2470e5 1192 rhltable_destroy(&ctx->table->chains_ht);
e46abbcc 1193 kfree(ctx->table->name);
55dd6f93 1194 kfree(ctx->table);
55dd6f93
PNA		 1195}
1196
cc07eeb0 1197void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 1198{
96518518 1199 nfnl_lock(NFNL_SUBSYS_NFTABLES);
82603549 1200 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
cc07eeb0
PNA		 1201 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1202 return;
96518518 1203 }
9370761c 1204 chain_type[ctype->family][ctype->type] = ctype;
96518518 1205 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 1206}
9370761c 1207EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 1208
32537e91 1209void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 1210{
96518518 1211 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 1212 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 1213 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1214}
9370761c 1215EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 1216
1217/*
1218 * Chains
1219 */
1220
1221static struct nft_chain *
cac20fcd 1222nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 1223{
1224 struct nft_chain *chain;
1225
1226 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 1227 if (chain->handle == handle &&
1228 nft_active_genmask(chain, genmask))
96518518
PM		 1229 return chain;
1230 }
1231
1232 return ERR_PTR(-ENOENT);
1233}
1234
4d44175a 1235static bool lockdep_commit_lock_is_held(const struct net *net)
f102d66b
FW		 1236{
1237#ifdef CONFIG_PROVE_LOCKING
1238 return lockdep_is_held(&net->nft.commit_mutex);
1239#else
1240 return true;
1241#endif
1242}
1243
1244static struct nft_chain *nft_chain_lookup(struct net *net,
1245 struct nft_table *table,
cac20fcd 1246 const struct nlattr *nla, u8 genmask)
96518518 1247{
1b2470e5
FW		 1248 char search[NFT_CHAIN_MAXNAMELEN + 1];
1249 struct rhlist_head *tmp, *list;
96518518
PM		 1250 struct nft_chain *chain;
1251
1252 if (nla == NULL)
1253 return ERR_PTR(-EINVAL);
1254
1b2470e5 1255 nla_strlcpy(search, nla, sizeof(search));
96518518 1256
1b2470e5 1257 WARN_ON(!rcu_read_lock_held() &&
f102d66b 1258 !lockdep_commit_lock_is_held(net));
1b2470e5
FW		 1259
1260 chain = ERR_PTR(-ENOENT);
1261 rcu_read_lock();
1262 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1263 if (!list)
1264 goto out_unlock;
1265
1266 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1267 if (nft_active_genmask(chain, genmask))
1268 goto out_unlock;
1269 }
1270 chain = ERR_PTR(-ENOENT);
1271out_unlock:
1272 rcu_read_unlock();
1273 return chain;
96518518
PM		 1274}
1275
1276static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 1277 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1278 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1279 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1280 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1281 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1282 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 1283 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
9332d27d
FW		 1284 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING,
1285 .len = NFT_MODULE_AUTOLOAD_LIMIT },
0ca743a5 1286 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
c9626a2c 1287 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
74cccc3d 1288 [NFTA_CHAIN_ID] = { .type = NLA_U32 },
96518518
PM		 1289};
1290
1291static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1292 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1293 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1294 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1295 .len = IFNAMSIZ - 1 },
96518518
PM		 1296};
1297
0ca743a5
PNA		 1298static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1299{
1300 struct nft_stats *cpu_stats, total;
1301 struct nlattr *nest;
ce355e20
ED		 1302 unsigned int seq;
1303 u64 pkts, bytes;
0ca743a5
PNA		 1304 int cpu;
1305
edbd82c5
FW		 1306 if (!stats)
1307 return 0;
1308
0ca743a5
PNA		 1309 memset(&total, 0, sizeof(total));
1310 for_each_possible_cpu(cpu) {
1311 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1312 do {
1313 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1314 pkts = cpu_stats->pkts;
1315 bytes = cpu_stats->bytes;
1316 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1317 total.pkts += pkts;
1318 total.bytes += bytes;
0ca743a5 1319 }
ae0be8de 1320 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
0ca743a5
PNA		 1321 if (nest == NULL)
1322 goto nla_put_failure;
1323
b46f6ded
ND		 1324 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1325 NFTA_COUNTER_PAD) ||
1326 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1327 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1328 goto nla_put_failure;
1329
1330 nla_nest_end(skb, nest);
1331 return 0;
1332
1333nla_put_failure:
1334 return -ENOSPC;
1335}
1336
d54725cd
PNA		 1337static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
1338 const struct nft_base_chain *basechain)
1339{
1340 const struct nf_hook_ops *ops = &basechain->ops;
1341 struct nft_hook *hook, *first = NULL;
1342 struct nlattr *nest, *nest_devs;
1343 int n = 0;
1344
1345 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1346 if (nest == NULL)
1347 goto nla_put_failure;
1348 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1349 goto nla_put_failure;
1350 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1351 goto nla_put_failure;
1352
1353 if (family == NFPROTO_NETDEV) {
1354 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
1355 list_for_each_entry(hook, &basechain->hook_list, list) {
1356 if (!first)
1357 first = hook;
1358
1359 if (nla_put_string(skb, NFTA_DEVICE_NAME,
1360 hook->ops.dev->name))
1361 goto nla_put_failure;
1362 n++;
1363 }
1364 nla_nest_end(skb, nest_devs);
1365
1366 if (n == 1 &&
1367 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name))
1368 goto nla_put_failure;
1369 }
1370 nla_nest_end(skb, nest);
1371
1372 return 0;
1373nla_put_failure:
1374 return -1;
1375}
1376
84d7fce6
PNA		 1377static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1378 u32 portid, u32 seq, int event, u32 flags,
1379 int family, const struct nft_table *table,
96518518
PM		 1380 const struct nft_chain *chain)
1381{
1382 struct nlmsghdr *nlh;
1383 struct nfgenmsg *nfmsg;
1384
dedb67c4 1385 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1386 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1387 if (nlh == NULL)
1388 goto nla_put_failure;
1389
1390 nfmsg = nlmsg_data(nlh);
1391 nfmsg->nfgen_family = family;
1392 nfmsg->version = NFNETLINK_V0;
84d7fce6 1393 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1394
1395 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1396 goto nla_put_failure;
b46f6ded
ND		 1397 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1398 NFTA_CHAIN_PAD))
96518518
PM		 1399 goto nla_put_failure;
1400 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1401 goto nla_put_failure;
1402
f323d954 1403 if (nft_is_base_chain(chain)) {
0ca743a5 1404 const struct nft_base_chain *basechain = nft_base_chain(chain);
edbd82c5 1405 struct nft_stats __percpu *stats;
0ca743a5 1406
d54725cd 1407 if (nft_dump_basechain_hook(skb, family, basechain))
2cbce139 1408 goto nla_put_failure;
9370761c 1409
0ca743a5
PNA		 1410 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1411 htonl(basechain->policy)))
1412 goto nla_put_failure;
1413
baae3e62
PM		 1414 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1415 goto nla_put_failure;
0ca743a5 1416
edbd82c5
FW		 1417 stats = rcu_dereference_check(basechain->stats,
1418 lockdep_commit_lock_is_held(net));
1419 if (nft_dump_stats(skb, stats))
0ca743a5 1420 goto nla_put_failure;
96518518
PM		 1421 }
1422
d0e2c7de
PNA		 1423 if (chain->flags &&
1424 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags)))
1425 goto nla_put_failure;
1426
0ca743a5
PNA		 1427 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1428 goto nla_put_failure;
1429
053c095a
JB		 1430 nlmsg_end(skb, nlh);
1431 return 0;
96518518
PM		 1432
1433nla_put_failure:
1434 nlmsg_trim(skb, nlh);
1435 return -1;
1436}
1437
25e94a99 1438static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1439{
1440 struct sk_buff *skb;
96518518 1441 int err;
8e6cf365
RGB		 1442 char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
1443 ctx->table->name, ctx->table->handle,
1444 ctx->chain->name, ctx->chain->handle);
1445
1446 audit_log_nfcfg(buf,
1447 ctx->family,
1448 ctx->chain->use,
1449 event == NFT_MSG_NEWCHAIN ?
1450 AUDIT_NFT_OP_CHAIN_REGISTER :
14224039
RGB		 1451 AUDIT_NFT_OP_CHAIN_UNREGISTER,
1452 GFP_KERNEL);
8e6cf365 1453 kfree(buf);
96518518 1454
128ad332
PNA		 1455 if (!ctx->report &&
1456 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1457 return;
96518518 1458
96518518
PM		 1459 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1460 if (skb == NULL)
1461 goto err;
1462
84d7fce6 1463 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1464 event, 0, ctx->family, ctx->table,
35151d84 1465 ctx->chain);
96518518
PM		 1466 if (err < 0) {
1467 kfree_skb(skb);
1468 goto err;
1469 }
1470
25e94a99
PNA		 1471 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1472 ctx->report, GFP_KERNEL);
1473 return;
96518518 1474err:
25e94a99 1475 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1476}
1477
1478static int nf_tables_dump_chains(struct sk_buff *skb,
1479 struct netlink_callback *cb)
1480{
1481 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1482 const struct nft_table *table;
1483 const struct nft_chain *chain;
1484 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1485 struct net *net = sock_net(skb->sk);
96518518
PM		 1486 int family = nfmsg->nfgen_family;
1487
e688a7f8 1488 rcu_read_lock();
38e029f1
PNA		 1489 cb->seq = net->nft.base_seq;
1490
36596dad 1491 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1492 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1493 continue;
1494
36596dad
PNA		 1495 list_for_each_entry_rcu(chain, &table->chains, list) {
1496 if (idx < s_idx)
1497 goto cont;
1498 if (idx > s_idx)
1499 memset(&cb->args[1], 0,
1500 sizeof(cb->args) - sizeof(cb->args[0]));
1501 if (!nft_is_active(net, chain))
1502 continue;
1503 if (nf_tables_fill_chain_info(skb, net,
1504 NETLINK_CB(cb->skb).portid,
1505 cb->nlh->nlmsg_seq,
1506 NFT_MSG_NEWCHAIN,
1507 NLM_F_MULTI,
98319cb9 1508 table->family, table,
36596dad
PNA		 1509 chain) < 0)
1510 goto done;
38e029f1 1511
36596dad 1512 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1513cont:
36596dad 1514 idx++;
96518518
PM		 1515 }
1516 }
1517done:
e688a7f8 1518 rcu_read_unlock();
96518518
PM		 1519 cb->args[0] = idx;
1520 return skb->len;
1521}
1522
d9adf22a 1523/* called with rcu_read_lock held */
7b8002a1
PNA		 1524static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1525 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1526 const struct nlattr * const nla[],
1527 struct netlink_ext_ack *extack)
96518518
PM		 1528{
1529 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1530 u8 genmask = nft_genmask_cur(net);
96518518 1531 const struct nft_chain *chain;
1b2470e5 1532 struct nft_table *table;
96518518
PM		 1533 struct sk_buff *skb2;
1534 int family = nfmsg->nfgen_family;
1535 int err;
1536
1537 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1538 struct netlink_dump_control c = {
1539 .dump = nf_tables_dump_chains,
d9adf22a 1540 .module = THIS_MODULE,
96518518 1541 };
d9adf22a
FW		 1542
1543 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 1544 }
1545
cac20fcd 1546 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1547 if (IS_ERR(table)) {
1548 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1549 return PTR_ERR(table);
36dd1bcc 1550 }
96518518 1551
f102d66b 1552 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1553 if (IS_ERR(chain)) {
1554 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1555 return PTR_ERR(chain);
36dd1bcc 1556 }
96518518 1557
d9adf22a 1558 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 1559 if (!skb2)
1560 return -ENOMEM;
1561
84d7fce6 1562 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1563 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1564 family, table, chain);
1565 if (err < 0)
1566 goto err;
1567
1568 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1569
1570err:
1571 kfree_skb(skb2);
1572 return err;
1573}
1574
0ca743a5
PNA		 1575static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1576 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1577 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1578};
1579
ff3cd7b3 1580static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1581{
1582 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1583 struct nft_stats __percpu *newstats;
1584 struct nft_stats *stats;
1585 int err;
1586
8cb08174
JB		 1587 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1588 nft_counter_policy, NULL);
0ca743a5 1589 if (err < 0)
ff3cd7b3 1590 return ERR_PTR(err);
0ca743a5
PNA		 1591
1592 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1593 return ERR_PTR(-EINVAL);
0ca743a5 1594
ce355e20 1595 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1596 if (newstats == NULL)
ff3cd7b3 1597 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1598
1599 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1600 * are not exposed to userspace.
1601 */
e8781f70 1602 preempt_disable();
0ca743a5
PNA		 1603 stats = this_cpu_ptr(newstats);
1604 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1605 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1606 preempt_enable();
0ca743a5 1607
ff3cd7b3
PNA		 1608 return newstats;
1609}
1610
53315ac6 1611static void nft_chain_stats_replace(struct nft_trans *trans)
ff3cd7b3 1612{
53315ac6 1613 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
0befd061 1614
53315ac6 1615 if (!nft_trans_chain_stats(trans))
b88825de
PNA		 1616 return;
1617
b685b534
PM		 1618 nft_trans_chain_stats(trans) =
1619 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans),
1620 lockdep_commit_lock_is_held(trans->ctx.net));
53315ac6
FW		 1621
1622 if (!nft_trans_chain_stats(trans))
bbb8c61f 1623 static_branch_inc(&nft_counters_enabled);
0ca743a5
PNA		 1624}
1625
0cbc06b3
FW		 1626static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1627{
1628 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1629 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1630
1631 if (g0 != g1)
1632 kvfree(g1);
1633 kvfree(g0);
1634
1635 /* should be NULL either via abort or via successful commit */
1636 WARN_ON_ONCE(chain->rules_next);
1637 kvfree(chain->rules_next);
1638}
1639
d0e2c7de 1640void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1641{
43a605f2 1642 struct nft_chain *chain = ctx->chain;
d54725cd 1643 struct nft_hook *hook, *next;
43a605f2 1644
fa5950e4
FW		 1645 if (WARN_ON(chain->use > 0))
1646 return;
91c7b38d 1647
0cbc06b3
FW		 1648 /* no concurrent access possible anymore */
1649 nf_tables_chain_free_chain_rules(chain);
1650
f323d954 1651 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1652 struct nft_base_chain *basechain = nft_base_chain(chain);
1653
d54725cd
PNA		 1654 if (ctx->family == NFPROTO_NETDEV) {
1655 list_for_each_entry_safe(hook, next,
1656 &basechain->hook_list, list) {
1657 list_del_rcu(&hook->list);
1658 kfree_rcu(hook, rcu);
1659 }
1660 }
2cbce139 1661 module_put(basechain->type->owner);
4c05ec47 1662 if (rcu_access_pointer(basechain->stats)) {
9f08ea84 1663 static_branch_dec(&nft_counters_enabled);
4c05ec47
TY		 1664 free_percpu(rcu_dereference_raw(basechain->stats));
1665 }
b7263e07 1666 kfree(chain->name);
2cbce139 1667 kfree(basechain);
91c7b38d 1668 } else {
b7263e07 1669 kfree(chain->name);
91c7b38d
PNA		 1670 kfree(chain);
1671 }
1672}
1673
3f0465a9
PNA		 1674static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
1675 const struct nlattr *attr)
1676{
1677 struct net_device *dev;
1678 char ifname[IFNAMSIZ];
1679 struct nft_hook *hook;
1680 int err;
1681
1682 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1683 if (!hook) {
1684 err = -ENOMEM;
1685 goto err_hook_alloc;
1686 }
1687
1688 nla_strlcpy(ifname, attr, IFNAMSIZ);
1689 dev = __dev_get_by_name(net, ifname);
1690 if (!dev) {
1691 err = -ENOENT;
1692 goto err_hook_dev;
1693 }
1694 hook->ops.dev = dev;
abadb2f8 1695 hook->inactive = false;
3f0465a9
PNA		 1696
1697 return hook;
1698
1699err_hook_dev:
1700 kfree(hook);
1701err_hook_alloc:
1702 return ERR_PTR(err);
1703}
1704
abadb2f8
PNA		 1705static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,
1706 const struct nft_hook *this)
b75a3e83
PNA		 1707{
1708 struct nft_hook *hook;
1709
1710 list_for_each_entry(hook, hook_list, list) {
1711 if (this->ops.dev == hook->ops.dev)
abadb2f8 1712 return hook;
b75a3e83
PNA		 1713 }
1714
abadb2f8 1715 return NULL;
b75a3e83
PNA		 1716}
1717
3f0465a9
PNA		 1718static int nf_tables_parse_netdev_hooks(struct net *net,
1719 const struct nlattr *attr,
1720 struct list_head *hook_list)
1721{
1722 struct nft_hook *hook, *next;
1723 const struct nlattr *tmp;
1724 int rem, n = 0, err;
1725
1726 nla_for_each_nested(tmp, attr, rem) {
1727 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
1728 err = -EINVAL;
1729 goto err_hook;
1730 }
1731
1732 hook = nft_netdev_hook_alloc(net, tmp);
1733 if (IS_ERR(hook)) {
1734 err = PTR_ERR(hook);
1735 goto err_hook;
1736 }
b75a3e83 1737 if (nft_hook_list_find(hook_list, hook)) {
cd77e75b 1738 kfree(hook);
b75a3e83
PNA		 1739 err = -EEXIST;
1740 goto err_hook;
1741 }
3f0465a9
PNA		 1742 list_add_tail(&hook->list, hook_list);
1743 n++;
1744
cb662ac6 1745 if (n == NFT_NETDEVICE_MAX) {
3f0465a9
PNA		 1746 err = -EFBIG;
1747 goto err_hook;
1748 }
1749 }
3f0465a9
PNA		 1750
1751 return 0;
1752
1753err_hook:
1754 list_for_each_entry_safe(hook, next, hook_list, list) {
1755 list_del(&hook->list);
1756 kfree(hook);
1757 }
1758 return err;
1759}
1760
508f8ccd
PNA		 1761struct nft_chain_hook {
1762 u32 num;
84ba7dd7 1763 s32 priority;
32537e91 1764 const struct nft_chain_type *type;
d54725cd 1765 struct list_head list;
508f8ccd
PNA		 1766};
1767
d54725cd
PNA		 1768static int nft_chain_parse_netdev(struct net *net,
1769 struct nlattr *tb[],
1770 struct list_head *hook_list)
1771{
1772 struct nft_hook *hook;
1773 int err;
1774
1775 if (tb[NFTA_HOOK_DEV]) {
1776 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
1777 if (IS_ERR(hook))
1778 return PTR_ERR(hook);
1779
1780 list_add_tail(&hook->list, hook_list);
1781 } else if (tb[NFTA_HOOK_DEVS]) {
1782 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
1783 hook_list);
1784 if (err < 0)
1785 return err;
05abe445
PNA		 1786
1787 if (list_empty(hook_list))
1788 return -EINVAL;
d54725cd
PNA		 1789 } else {
1790 return -EINVAL;
1791 }
1792
1793 return 0;
1794}
1795
508f8ccd
PNA		 1796static int nft_chain_parse_hook(struct net *net,
1797 const struct nlattr * const nla[],
36596dad 1798 struct nft_chain_hook *hook, u8 family,
445509eb 1799 bool autoload)
508f8ccd
PNA		 1800{
1801 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1802 const struct nft_chain_type *type;
508f8ccd
PNA		 1803 int err;
1804
f102d66b
FW		 1805 lockdep_assert_held(&net->nft.commit_mutex);
1806 lockdep_nfnl_nft_mutex_not_held();
1807
8cb08174
JB		 1808 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
1809 nla[NFTA_CHAIN_HOOK],
1810 nft_hook_policy, NULL);
508f8ccd
PNA		 1811 if (err < 0)
1812 return err;
1813
1814 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1815 ha[NFTA_HOOK_PRIORITY] == NULL)
1816 return -EINVAL;
1817
1818 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1819 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1820
82603549
PNA		 1821 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
1822 if (!type)
1823 return -EOPNOTSUPP;
1824
508f8ccd 1825 if (nla[NFTA_CHAIN_TYPE]) {
452238e8 1826 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
445509eb 1827 family, autoload);
508f8ccd
PNA		 1828 if (IS_ERR(type))
1829 return PTR_ERR(type);
1830 }
33d1c018 1831 if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
508f8ccd 1832 return -EOPNOTSUPP;
84ba7dd7
FW		 1833
1834 if (type->type == NFT_CHAIN_T_NAT &&
1835 hook->priority <= NF_IP_PRI_CONNTRACK)
1836 return -EOPNOTSUPP;
1837
508f8ccd
PNA		 1838 if (!try_module_get(type->owner))
1839 return -ENOENT;
1840
1841 hook->type = type;
1842
d54725cd 1843 INIT_LIST_HEAD(&hook->list);
36596dad 1844 if (family == NFPROTO_NETDEV) {
d54725cd
PNA		 1845 err = nft_chain_parse_netdev(net, ha, &hook->list);
1846 if (err < 0) {
508f8ccd 1847 module_put(type->owner);
d54725cd 1848 return err;
508f8ccd 1849 }
d54725cd 1850 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) {
508f8ccd
PNA		 1851 module_put(type->owner);
1852 return -EOPNOTSUPP;
1853 }
1854
1855 return 0;
1856}
1857
1858static void nft_chain_release_hook(struct nft_chain_hook *hook)
1859{
d54725cd
PNA		 1860 struct nft_hook *h, *next;
1861
1862 list_for_each_entry_safe(h, next, &hook->list, list) {
1863 list_del(&h->list);
1864 kfree(h);
1865 }
508f8ccd 1866 module_put(hook->type->owner);
508f8ccd
PNA		 1867}
1868
0cbc06b3
FW		 1869struct nft_rules_old {
1870 struct rcu_head h;
1871 struct nft_rule **start;
1872};
1873
1874static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1875 unsigned int alloc)
1876{
1877 if (alloc > INT_MAX)
1878 return NULL;
1879
1880 alloc += 1; /* NULL, ends rules */
1881 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1882 return NULL;
1883
1884 alloc *= sizeof(struct nft_rule *);
1885 alloc += sizeof(struct nft_rules_old);
1886
1887 return kvmalloc(alloc, GFP_KERNEL);
1888}
1889
d54725cd
PNA		 1890static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family,
1891 const struct nft_chain_hook *hook,
1892 struct nft_chain *chain)
1893{
1894 ops->pf = family;
1895 ops->hooknum = hook->num;
1896 ops->priority = hook->priority;
1897 ops->priv = chain;
1898 ops->hook = hook->type->hooks[ops->hooknum];
1899}
1900
1901static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
1902 struct nft_chain_hook *hook, u32 flags)
1903{
1904 struct nft_chain *chain;
1905 struct nft_hook *h;
1906
1907 basechain->type = hook->type;
1908 INIT_LIST_HEAD(&basechain->hook_list);
1909 chain = &basechain->chain;
1910
1911 if (family == NFPROTO_NETDEV) {
1912 list_splice_init(&hook->list, &basechain->hook_list);
1913 list_for_each_entry(h, &basechain->hook_list, list)
1914 nft_basechain_hook_init(&h->ops, family, hook, chain);
1915
1916 basechain->ops.hooknum = hook->num;
1917 basechain->ops.priority = hook->priority;
1918 } else {
1919 nft_basechain_hook_init(&basechain->ops, family, hook, chain);
1920 }
1921
67c49de4 1922 chain->flags |= NFT_CHAIN_BASE | flags;
d54725cd
PNA		 1923 basechain->policy = NF_ACCEPT;
1924 if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
1925 nft_chain_offload_priority(basechain) < 0)
1926 return -EOPNOTSUPP;
1927
1928 flow_block_init(&basechain->flow_block);
1929
1930 return 0;
1931}
1932
04b7db41
PNA		 1933static int nft_chain_add(struct nft_table *table, struct nft_chain *chain)
1934{
1935 int err;
1936
1937 err = rhltable_insert_key(&table->chains_ht, chain->name,
1938 &chain->rhlhead, nft_chain_ht_params);
1939 if (err)
1940 return err;
1941
1942 list_add_tail_rcu(&chain->list, &table->chains);
1943
1944 return 0;
1945}
1946
d0e2c7de
PNA		 1947static u64 chain_id;
1948
4035285f 1949static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
c9626a2c 1950 u8 policy, u32 flags)
4035285f
PNA		 1951{
1952 const struct nlattr * const *nla = ctx->nla;
1953 struct nft_table *table = ctx->table;
4035285f
PNA		 1954 struct nft_base_chain *basechain;
1955 struct nft_stats __percpu *stats;
1956 struct net *net = ctx->net;
d0e2c7de 1957 char name[NFT_NAME_MAXLEN];
66293c46 1958 struct nft_trans *trans;
4035285f 1959 struct nft_chain *chain;
0cbc06b3 1960 struct nft_rule **rules;
4035285f
PNA		 1961 int err;
1962
1963 if (table->use == UINT_MAX)
1964 return -EOVERFLOW;
1965
1966 if (nla[NFTA_CHAIN_HOOK]) {
1967 struct nft_chain_hook hook;
4035285f 1968
d0e2c7de
PNA		 1969 if (flags & NFT_CHAIN_BINDING)
1970 return -EOPNOTSUPP;
1971
445509eb 1972 err = nft_chain_parse_hook(net, nla, &hook, family, true);
4035285f
PNA		 1973 if (err < 0)
1974 return err;
1975
1976 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1977 if (basechain == NULL) {
1978 nft_chain_release_hook(&hook);
1979 return -ENOMEM;
1980 }
d54725cd 1981 chain = &basechain->chain;
4035285f
PNA		 1982
1983 if (nla[NFTA_CHAIN_COUNTERS]) {
1984 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1985 if (IS_ERR(stats)) {
1986 nft_chain_release_hook(&hook);
1987 kfree(basechain);
1988 return PTR_ERR(stats);
1989 }
4c05ec47 1990 rcu_assign_pointer(basechain->stats, stats);
4035285f
PNA		 1991 static_branch_inc(&nft_counters_enabled);
1992 }
1993
d54725cd
PNA		 1994 err = nft_basechain_init(basechain, family, &hook, flags);
1995 if (err < 0) {
1996 nft_chain_release_hook(&hook);
1997 kfree(basechain);
1998 return err;
1999 }
4035285f 2000 } else {
d0e2c7de
PNA		 2001 if (flags & NFT_CHAIN_BASE)
2002 return -EINVAL;
2003 if (flags & NFT_CHAIN_HW_OFFLOAD)
2004 return -EOPNOTSUPP;
2005
4035285f
PNA		 2006 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
2007 if (chain == NULL)
2008 return -ENOMEM;
d0e2c7de
PNA		 2009
2010 chain->flags = flags;
4035285f 2011 }
43a605f2
PNA		 2012 ctx->chain = chain;
2013
4035285f
PNA		 2014 INIT_LIST_HEAD(&chain->rules);
2015 chain->handle = nf_tables_alloc_handle(table);
2016 chain->table = table;
d0e2c7de
PNA		 2017
2018 if (nla[NFTA_CHAIN_NAME]) {
2019 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2020 } else {
2021 if (!(flags & NFT_CHAIN_BINDING))
2022 return -EINVAL;
2023
2024 snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
2025 chain->name = kstrdup(name, GFP_KERNEL);
2026 }
2027
4035285f
PNA		 2028 if (!chain->name) {
2029 err = -ENOMEM;
2030 goto err1;
2031 }
2032
0cbc06b3
FW		 2033 rules = nf_tables_chain_alloc_rules(chain, 0);
2034 if (!rules) {
2035 err = -ENOMEM;
2036 goto err1;
2037 }
2038
2039 *rules = NULL;
2040 rcu_assign_pointer(chain->rules_gen_0, rules);
2041 rcu_assign_pointer(chain->rules_gen_1, rules);
2042
c974a3a3 2043 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 2044 if (err < 0)
2045 goto err1;
2046
66293c46
FW		 2047 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
2048 if (IS_ERR(trans)) {
2049 err = PTR_ERR(trans);
4035285f 2050 goto err2;
1b2470e5 2051 }
4035285f 2052
ad652f38 2053 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
66293c46
FW		 2054 if (nft_is_base_chain(chain))
2055 nft_trans_chain_policy(trans) = policy;
2056
04b7db41
PNA		 2057 err = nft_chain_add(table, chain);
2058 if (err < 0) {
2059 nft_trans_destroy(trans);
2060 goto err2;
2061 }
2062
4035285f 2063 table->use++;
4035285f
PNA		 2064
2065 return 0;
2066err2:
c974a3a3 2067 nf_tables_unregister_hook(net, table, chain);
4035285f 2068err1:
43a605f2 2069 nf_tables_chain_destroy(ctx);
4035285f
PNA		 2070
2071 return err;
2072}
2073
d54725cd
PNA		 2074static bool nft_hook_list_equal(struct list_head *hook_list1,
2075 struct list_head *hook_list2)
2076{
2077 struct nft_hook *hook;
2078 int n = 0, m = 0;
2079
2080 n = 0;
2081 list_for_each_entry(hook, hook_list2, list) {
2082 if (!nft_hook_list_find(hook_list1, hook))
2083 return false;
2084
2085 n++;
2086 }
2087 list_for_each_entry(hook, hook_list1, list)
2088 m++;
2089
2090 return n == m;
2091}
2092
c9626a2c
PNA		 2093static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
2094 u32 flags)
2c4a488a
PNA		 2095{
2096 const struct nlattr * const *nla = ctx->nla;
2097 struct nft_table *table = ctx->table;
2098 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 2099 struct nft_base_chain *basechain;
2100 struct nft_stats *stats = NULL;
2101 struct nft_chain_hook hook;
2c4a488a
PNA		 2102 struct nf_hook_ops *ops;
2103 struct nft_trans *trans;
c974a3a3 2104 int err;
2c4a488a 2105
c9626a2c
PNA		 2106 if (chain->flags ^ flags)
2107 return -EOPNOTSUPP;
2108
2c4a488a
PNA		 2109 if (nla[NFTA_CHAIN_HOOK]) {
2110 if (!nft_is_base_chain(chain))
77a92189 2111 return -EEXIST;
2c4a488a 2112
36596dad 2113 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
445509eb 2114 false);
2c4a488a
PNA		 2115 if (err < 0)
2116 return err;
2117
2118 basechain = nft_base_chain(chain);
2119 if (basechain->type != hook.type) {
2120 nft_chain_release_hook(&hook);
77a92189 2121 return -EEXIST;
2c4a488a
PNA		 2122 }
2123
d54725cd
PNA		 2124 if (ctx->family == NFPROTO_NETDEV) {
2125 if (!nft_hook_list_equal(&basechain->hook_list,
2126 &hook.list)) {
2127 nft_chain_release_hook(&hook);
77a92189 2128 return -EEXIST;
d54725cd
PNA		 2129 }
2130 } else {
2131 ops = &basechain->ops;
2132 if (ops->hooknum != hook.num ||
2133 ops->priority != hook.priority) {
2134 nft_chain_release_hook(&hook);
77a92189 2135 return -EEXIST;
d54725cd 2136 }
2c4a488a
PNA		 2137 }
2138 nft_chain_release_hook(&hook);
2139 }
2140
2141 if (nla[NFTA_CHAIN_HANDLE] &&
2142 nla[NFTA_CHAIN_NAME]) {
2143 struct nft_chain *chain2;
2144
f102d66b
FW		 2145 chain2 = nft_chain_lookup(ctx->net, table,
2146 nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 2147 if (!IS_ERR(chain2))
2148 return -EEXIST;
2c4a488a
PNA		 2149 }
2150
2151 if (nla[NFTA_CHAIN_COUNTERS]) {
2152 if (!nft_is_base_chain(chain))
2153 return -EOPNOTSUPP;
2154
2155 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2156 if (IS_ERR(stats))
2157 return PTR_ERR(stats);
2158 }
2159
c6cc94df 2160 err = -ENOMEM;
2c4a488a
PNA		 2161 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
2162 sizeof(struct nft_trans_chain));
c6cc94df
FW		 2163 if (trans == NULL)
2164 goto err;
2c4a488a
PNA		 2165
2166 nft_trans_chain_stats(trans) = stats;
2167 nft_trans_chain_update(trans) = true;
2168
2169 if (nla[NFTA_CHAIN_POLICY])
2170 nft_trans_chain_policy(trans) = policy;
2171 else
2172 nft_trans_chain_policy(trans) = -1;
2173
c6cc94df
FW		 2174 if (nla[NFTA_CHAIN_HANDLE] &&
2175 nla[NFTA_CHAIN_NAME]) {
2176 struct nft_trans *tmp;
2177 char *name;
2178
2179 err = -ENOMEM;
2180 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2181 if (!name)
2182 goto err;
2183
2184 err = -EEXIST;
2185 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
2186 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
2187 tmp->ctx.table == table &&
2188 nft_trans_chain_update(tmp) &&
2189 nft_trans_chain_name(tmp) &&
2190 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
2191 kfree(name);
2192 goto err;
2193 }
2c4a488a 2194 }
c6cc94df
FW		 2195
2196 nft_trans_chain_name(trans) = name;
2c4a488a
PNA		 2197 }
2198 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
2199
2200 return 0;
c6cc94df
FW		 2201err:
2202 free_percpu(stats);
2203 kfree(trans);
2204 return err;
2c4a488a
PNA		 2205}
2206
837830a4
PNA		 2207static struct nft_chain *nft_chain_lookup_byid(const struct net *net,
2208 const struct nlattr *nla)
2209{
2210 u32 id = ntohl(nla_get_be32(nla));
2211 struct nft_trans *trans;
2212
2213 list_for_each_entry(trans, &net->nft.commit_list, list) {
2214 struct nft_chain *chain = trans->ctx.chain;
2215
2216 if (trans->msg_type == NFT_MSG_NEWCHAIN &&
2217 id == nft_trans_chain_id(trans))
2218 return chain;
2219 }
2220 return ERR_PTR(-ENOENT);
2221}
2222
633c9a84
PNA		 2223static int nf_tables_newchain(struct net *net, struct sock *nlsk,
2224 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2225 const struct nlattr * const nla[],
2226 struct netlink_ext_ack *extack)
96518518
PM		 2227{
2228 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 2229 u8 genmask = nft_genmask_next(net);
2230 int family = nfmsg->nfgen_family;
74cccc3d 2231 struct nft_chain *chain = NULL;
36dd1bcc 2232 const struct nlattr *attr;
96518518 2233 struct nft_table *table;
57de2a0c 2234 u8 policy = NF_ACCEPT;
4035285f 2235 struct nft_ctx ctx;
96518518 2236 u64 handle = 0;
c9626a2c 2237 u32 flags = 0;
96518518 2238
f102d66b
FW		 2239 lockdep_assert_held(&net->nft.commit_mutex);
2240
cac20fcd 2241 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 2242 if (IS_ERR(table)) {
2243 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 2244 return PTR_ERR(table);
36dd1bcc 2245 }
96518518 2246
96518518 2247 chain = NULL;
36dd1bcc 2248 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 2249
2250 if (nla[NFTA_CHAIN_HANDLE]) {
2251 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 2252 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 2253 if (IS_ERR(chain)) {
2254 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 2255 return PTR_ERR(chain);
36dd1bcc
PNA		 2256 }
2257 attr = nla[NFTA_CHAIN_HANDLE];
74cccc3d 2258 } else if (nla[NFTA_CHAIN_NAME]) {
f102d66b 2259 chain = nft_chain_lookup(net, table, attr, genmask);
96518518 2260 if (IS_ERR(chain)) {
36dd1bcc
PNA		 2261 if (PTR_ERR(chain) != -ENOENT) {
2262 NL_SET_BAD_ATTR(extack, attr);
96518518 2263 return PTR_ERR(chain);
36dd1bcc 2264 }
96518518
PM		 2265 chain = NULL;
2266 }
74cccc3d
PNA		 2267 } else if (!nla[NFTA_CHAIN_ID]) {
2268 return -EINVAL;
96518518
PM		 2269 }
2270
57de2a0c 2271 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 2272 if (chain != NULL &&
36dd1bcc
PNA		 2273 !nft_is_base_chain(chain)) {
2274 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 2275 return -EOPNOTSUPP;
36dd1bcc 2276 }
d6b6cb1d
PNA		 2277
2278 if (chain == NULL &&
36dd1bcc
PNA		 2279 nla[NFTA_CHAIN_HOOK] == NULL) {
2280 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 2281 return -EOPNOTSUPP;
36dd1bcc 2282 }
57de2a0c 2283
8f46df18 2284 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 2285 switch (policy) {
2286 case NF_DROP:
2287 case NF_ACCEPT:
2288 break;
2289 default:
2290 return -EINVAL;
2291 }
2292 }
2293
c9626a2c
PNA		 2294 if (nla[NFTA_CHAIN_FLAGS])
2295 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
b717273d
FW		 2296 else if (chain)
2297 flags = chain->flags;
c9626a2c 2298
c1f79a2e
PNA		 2299 if (flags & ~NFT_CHAIN_FLAGS)
2300 return -EOPNOTSUPP;
2301
98319cb9 2302 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 2303
96518518 2304 if (chain != NULL) {
36dd1bcc
PNA		 2305 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2306 NL_SET_BAD_ATTR(extack, attr);
96518518 2307 return -EEXIST;
36dd1bcc 2308 }
96518518
PM		 2309 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2310 return -EOPNOTSUPP;
2311
67c49de4 2312 flags |= chain->flags & NFT_CHAIN_BASE;
c9626a2c 2313 return nf_tables_updchain(&ctx, genmask, policy, flags);
96518518
PM		 2314 }
2315
c9626a2c 2316 return nf_tables_addchain(&ctx, family, genmask, policy, flags);
96518518
PM		 2317}
2318
633c9a84
PNA		 2319static int nf_tables_delchain(struct net *net, struct sock *nlsk,
2320 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2321 const struct nlattr * const nla[],
2322 struct netlink_ext_ack *extack)
96518518
PM		 2323{
2324 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2325 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 2326 int family = nfmsg->nfgen_family;
2327 const struct nlattr *attr;
96518518
PM		 2328 struct nft_table *table;
2329 struct nft_chain *chain;
9dee1474 2330 struct nft_rule *rule;
91c7b38d 2331 struct nft_ctx ctx;
3ecbfd65 2332 u64 handle;
9dee1474
PNA		 2333 u32 use;
2334 int err;
96518518 2335
cac20fcd 2336 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 2337 if (IS_ERR(table)) {
2338 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 2339 return PTR_ERR(table);
36dd1bcc 2340 }
96518518 2341
3ecbfd65 2342 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 2343 attr = nla[NFTA_CHAIN_HANDLE];
2344 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 2345 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 2346 } else {
36dd1bcc 2347 attr = nla[NFTA_CHAIN_NAME];
f102d66b 2348 chain = nft_chain_lookup(net, table, attr, genmask);
3ecbfd65 2349 }
36dd1bcc
PNA		 2350 if (IS_ERR(chain)) {
2351 NL_SET_BAD_ATTR(extack, attr);
96518518 2352 return PTR_ERR(chain);
36dd1bcc 2353 }
9dee1474
PNA		 2354
2355 if (nlh->nlmsg_flags & NLM_F_NONREC &&
2356 chain->use > 0)
96518518
PM		 2357 return -EBUSY;
2358
98319cb9 2359 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 2360
9dee1474
PNA		 2361 use = chain->use;
2362 list_for_each_entry(rule, &chain->rules, list) {
2363 if (!nft_is_active_next(net, rule))
2364 continue;
2365 use--;
2366
2367 err = nft_delrule(&ctx, rule);
2368 if (err < 0)
2369 return err;
2370 }
2371
2372 /* There are rules and elements that are still holding references to us,
2373 * we cannot do a recursive removal in this case.
2374 */
36dd1bcc
PNA		 2375 if (use > 0) {
2376 NL_SET_BAD_ATTR(extack, attr);
9dee1474 2377 return -EBUSY;
36dd1bcc 2378 }
9dee1474 2379
ee01d542 2380 return nft_delchain(&ctx);
96518518
PM		 2381}
2382
96518518
PM		 2383/*
2384 * Expressions
2385 */
2386
2387/**
ef1f7df9 2388 * nft_register_expr - register nf_tables expr type
3db86c39 2389 * @type: expr type
96518518 2390 *
ef1f7df9 2391 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 2392 * success or a negative errno code otherwise.
2393 */
ef1f7df9 2394int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 2395{
2396 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 2397 if (type->family == NFPROTO_UNSPEC)
e688a7f8 2398 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 2399 else
e688a7f8 2400 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 2401 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2402 return 0;
2403}
2404EXPORT_SYMBOL_GPL(nft_register_expr);
2405
2406/**
ef1f7df9 2407 * nft_unregister_expr - unregister nf_tables expr type
3db86c39 2408 * @type: expr type
96518518 2409 *
ef1f7df9 2410 * Unregisters the expr typefor use with nf_tables.
96518518 2411 */
ef1f7df9 2412void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 2413{
2414 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 2415 list_del_rcu(&type->list);
96518518
PM		 2416 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2417}
2418EXPORT_SYMBOL_GPL(nft_unregister_expr);
2419
64d46806
PM		 2420static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2421 struct nlattr *nla)
96518518 2422{
9cff126f 2423 const struct nft_expr_type *type, *candidate = NULL;
96518518 2424
ef1f7df9 2425 list_for_each_entry(type, &nf_tables_expressions, list) {
9cff126f
PNA		 2426 if (!nla_strcmp(nla, type->name)) {
2427 if (!type->family && !candidate)
2428 candidate = type;
2429 else if (type->family == family)
2430 candidate = type;
2431 }
96518518 2432 }
9cff126f 2433 return candidate;
96518518
PM		 2434}
2435
b9c04ae7
PNA		 2436#ifdef CONFIG_MODULES
2437static int nft_expr_type_request_module(struct net *net, u8 family,
2438 struct nlattr *nla)
2439{
eb014de4
PNA		 2440 if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2441 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
b9c04ae7
PNA		 2442 return -EAGAIN;
2443
2444 return 0;
2445}
2446#endif
2447
452238e8
FW		 2448static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2449 u8 family,
64d46806 2450 struct nlattr *nla)
96518518 2451{
ef1f7df9 2452 const struct nft_expr_type *type;
96518518
PM		 2453
2454 if (nla == NULL)
2455 return ERR_PTR(-EINVAL);
2456
64d46806 2457 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 2458 if (type != NULL && try_module_get(type->owner))
2459 return type;
96518518 2460
f102d66b 2461 lockdep_nfnl_nft_mutex_not_held();
96518518 2462#ifdef CONFIG_MODULES
ef1f7df9 2463 if (type == NULL) {
b9c04ae7 2464 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
64d46806
PM		 2465 return ERR_PTR(-EAGAIN);
2466
eb014de4
PNA		 2467 if (nft_request_module(net, "nft-expr-%.*s",
2468 nla_len(nla),
2469 (char *)nla_data(nla)) == -EAGAIN)
96518518
PM		 2470 return ERR_PTR(-EAGAIN);
2471 }
2472#endif
2473 return ERR_PTR(-ENOENT);
2474}
2475
2476static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
9332d27d
FW		 2477 [NFTA_EXPR_NAME] = { .type = NLA_STRING,
2478 .len = NFT_MODULE_AUTOLOAD_LIMIT },
96518518
PM		 2479 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2480};
2481
2482static int nf_tables_fill_expr_info(struct sk_buff *skb,
2483 const struct nft_expr *expr)
2484{
ef1f7df9 2485 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 2486 goto nla_put_failure;
2487
2488 if (expr->ops->dump) {
ae0be8de
MK		 2489 struct nlattr *data = nla_nest_start_noflag(skb,
2490 NFTA_EXPR_DATA);
96518518
PM		 2491 if (data == NULL)
2492 goto nla_put_failure;
2493 if (expr->ops->dump(skb, expr) < 0)
2494 goto nla_put_failure;
2495 nla_nest_end(skb, data);
2496 }
2497
2498 return skb->len;
2499
2500nla_put_failure:
2501 return -1;
2502};
2503
0b2d8a7b
PM		 2504int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2505 const struct nft_expr *expr)
2506{
2507 struct nlattr *nest;
2508
ae0be8de 2509 nest = nla_nest_start_noflag(skb, attr);
0b2d8a7b
PM		 2510 if (!nest)
2511 goto nla_put_failure;
2512 if (nf_tables_fill_expr_info(skb, expr) < 0)
2513 goto nla_put_failure;
2514 nla_nest_end(skb, nest);
2515 return 0;
2516
2517nla_put_failure:
2518 return -1;
2519}
2520
96518518
PM		 2521struct nft_expr_info {
2522 const struct nft_expr_ops *ops;
83d9dcba 2523 const struct nlattr *attr;
ef1f7df9 2524 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 2525};
2526
0ca743a5
PNA		 2527static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2528 const struct nlattr *nla,
96518518
PM		 2529 struct nft_expr_info *info)
2530{
ef1f7df9 2531 const struct nft_expr_type *type;
96518518 2532 const struct nft_expr_ops *ops;
ef1f7df9 2533 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 2534 int err;
2535
8cb08174
JB		 2536 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2537 nft_expr_policy, NULL);
96518518
PM		 2538 if (err < 0)
2539 return err;
2540
452238e8 2541 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 2542 if (IS_ERR(type))
2543 return PTR_ERR(type);
2544
2545 if (tb[NFTA_EXPR_DATA]) {
8cb08174
JB		 2546 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2547 tb[NFTA_EXPR_DATA],
2548 type->policy, NULL);
ef1f7df9
PM		 2549 if (err < 0)
2550 goto err1;
2551 } else
2552 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2553
2554 if (type->select_ops != NULL) {
0ca743a5
PNA		 2555 ops = type->select_ops(ctx,
2556 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 2557 if (IS_ERR(ops)) {
2558 err = PTR_ERR(ops);
0ef1efd1
PNA		 2559#ifdef CONFIG_MODULES
2560 if (err == -EAGAIN)
eb014de4
PNA		 2561 if (nft_expr_type_request_module(ctx->net,
2562 ctx->family,
2563 tb[NFTA_EXPR_NAME]) != -EAGAIN)
2564 err = -ENOENT;
0ef1efd1 2565#endif
ef1f7df9
PM		 2566 goto err1;
2567 }
2568 } else
2569 ops = type->ops;
2570
83d9dcba 2571 info->attr = nla;
96518518 2572 info->ops = ops;
83d9dcba 2573
96518518 2574 return 0;
ef1f7df9
PM		 2575
2576err1:
2577 module_put(type->owner);
2578 return err;
96518518
PM		 2579}
2580
2581static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 2582 const struct nft_expr_info *info,
96518518
PM		 2583 struct nft_expr *expr)
2584{
2585 const struct nft_expr_ops *ops = info->ops;
2586 int err;
2587
2588 expr->ops = ops;
2589 if (ops->init) {
ef1f7df9 2590 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 2591 if (err < 0)
2592 goto err1;
2593 }
2594
96518518 2595 return 0;
96518518
PM		 2596err1:
2597 expr->ops = NULL;
2598 return err;
2599}
2600
62472bce
PM		 2601static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2602 struct nft_expr *expr)
96518518 2603{
3f3a390d
PNA		 2604 const struct nft_expr_type *type = expr->ops->type;
2605
96518518 2606 if (expr->ops->destroy)
62472bce 2607 expr->ops->destroy(ctx, expr);
3f3a390d 2608 module_put(type->owner);
96518518
PM		 2609}
2610
795a6d6b
PNA		 2611static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2612 const struct nlattr *nla)
0b2d8a7b
PM		 2613{
2614 struct nft_expr_info info;
2615 struct nft_expr *expr;
b8e20400 2616 struct module *owner;
0b2d8a7b
PM		 2617 int err;
2618
2619 err = nf_tables_expr_parse(ctx, nla, &info);
2620 if (err < 0)
2621 goto err1;
2622
2623 err = -ENOMEM;
2624 expr = kzalloc(info.ops->size, GFP_KERNEL);
2625 if (expr == NULL)
2626 goto err2;
2627
2628 err = nf_tables_newexpr(ctx, &info, expr);
2629 if (err < 0)
6cafaf47 2630 goto err3;
0b2d8a7b
PM		 2631
2632 return expr;
6cafaf47
LZ		 2633err3:
2634 kfree(expr);
0b2d8a7b 2635err2:
b8e20400
PNA		 2636 owner = info.ops->type->owner;
2637 if (info.ops->type->release_ops)
2638 info.ops->type->release_ops(info.ops);
2639
2640 module_put(owner);
0b2d8a7b
PM		 2641err1:
2642 return ERR_PTR(err);
2643}
2644
c604cc69
PNA		 2645int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
2646{
2647 int err;
2648
2649 if (src->ops->clone) {
2650 dst->ops = src->ops;
2651 err = src->ops->clone(dst, src);
2652 if (err < 0)
2653 return err;
2654 } else {
2655 memcpy(dst, src, src->ops->size);
2656 }
2657
2658 __module_get(src->ops->type->owner);
2659
2660 return 0;
2661}
2662
0b2d8a7b
PM		 2663void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2664{
2665 nf_tables_expr_destroy(ctx, expr);
2666 kfree(expr);
2667}
2668
96518518
PM		 2669/*
2670 * Rules
2671 */
2672
cac20fcd
PNA		 2673static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2674 u64 handle)
96518518
PM		 2675{
2676 struct nft_rule *rule;
2677
2678 // FIXME: this sucks
d9adf22a 2679 list_for_each_entry_rcu(rule, &chain->rules, list) {
96518518
PM		 2680 if (handle == rule->handle)
2681 return rule;
2682 }
2683
2684 return ERR_PTR(-ENOENT);
2685}
2686
cac20fcd
PNA		 2687static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2688 const struct nlattr *nla)
96518518
PM		 2689{
2690 if (nla == NULL)
2691 return ERR_PTR(-EINVAL);
2692
cac20fcd 2693 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 2694}
2695
2696static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 2697 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2698 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 2699 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2700 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2701 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2702 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 2703 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 2704 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 2705 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2706 .len = NFT_USERDATA_MAXLEN },
467697d2 2707 [NFTA_RULE_ID] = { .type = NLA_U32 },
0604628b 2708 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
837830a4 2709 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 },
96518518
PM		 2710};
2711
84d7fce6
PNA		 2712static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2713 u32 portid, u32 seq, int event,
2714 u32 flags, int family,
96518518
PM		 2715 const struct nft_table *table,
2716 const struct nft_chain *chain,
2c82c7e7
FW		 2717 const struct nft_rule *rule,
2718 const struct nft_rule *prule)
96518518
PM		 2719{
2720 struct nlmsghdr *nlh;
2721 struct nfgenmsg *nfmsg;
2722 const struct nft_expr *expr, *next;
2723 struct nlattr *list;
dedb67c4 2724 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 2725
dedb67c4 2726 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 2727 if (nlh == NULL)
2728 goto nla_put_failure;
2729
2730 nfmsg = nlmsg_data(nlh);
2731 nfmsg->nfgen_family = family;
2732 nfmsg->version = NFNETLINK_V0;
84d7fce6 2733 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2734
2735 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2736 goto nla_put_failure;
2737 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2738 goto nla_put_failure;
b46f6ded
ND		 2739 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2740 NFTA_RULE_PAD))
96518518
PM		 2741 goto nla_put_failure;
2742
2c82c7e7 2743 if (event != NFT_MSG_DELRULE && prule) {
5e948466 2744 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2745 cpu_to_be64(prule->handle),
2746 NFTA_RULE_PAD))
5e948466
EL		 2747 goto nla_put_failure;
2748 }
2749
ae0be8de 2750 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
96518518
PM		 2751 if (list == NULL)
2752 goto nla_put_failure;
2753 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2754 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2755 goto nla_put_failure;
96518518
PM		 2756 }
2757 nla_nest_end(skb, list);
2758
86f1ec32
PM		 2759 if (rule->udata) {
2760 struct nft_userdata *udata = nft_userdata(rule);
2761 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2762 udata->data) < 0)
2763 goto nla_put_failure;
2764 }
0768b3b3 2765
053c095a
JB		 2766 nlmsg_end(skb, nlh);
2767 return 0;
96518518
PM		 2768
2769nla_put_failure:
2770 nlmsg_trim(skb, nlh);
2771 return -1;
2772}
2773
25e94a99
PNA		 2774static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2775 const struct nft_rule *rule, int event)
96518518
PM		 2776{
2777 struct sk_buff *skb;
96518518 2778 int err;
8e6cf365
RGB		 2779 char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
2780 ctx->table->name, ctx->table->handle,
2781 ctx->chain->name, ctx->chain->handle);
2782
2783 audit_log_nfcfg(buf,
2784 ctx->family,
2785 rule->handle,
2786 event == NFT_MSG_NEWRULE ?
2787 AUDIT_NFT_OP_RULE_REGISTER :
14224039
RGB		 2788 AUDIT_NFT_OP_RULE_UNREGISTER,
2789 GFP_KERNEL);
8e6cf365 2790 kfree(buf);
96518518 2791
128ad332
PNA		 2792 if (!ctx->report &&
2793 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2794 return;
96518518 2795
96518518
PM		 2796 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2797 if (skb == NULL)
2798 goto err;
2799
84d7fce6 2800 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2801 event, 0, ctx->family, ctx->table,
2c82c7e7 2802 ctx->chain, rule, NULL);
96518518
PM		 2803 if (err < 0) {
2804 kfree_skb(skb);
2805 goto err;
2806 }
2807
25e94a99
PNA		 2808 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2809 ctx->report, GFP_KERNEL);
2810 return;
96518518 2811err:
25e94a99 2812 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2813}
2814
6e1f760e 2815struct nft_rule_dump_ctx {
e46abbcc 2816 char *table;
b7263e07 2817 char *chain;
6e1f760e
PNA		 2818};
2819
241faece
PS		 2820static int __nf_tables_dump_rules(struct sk_buff *skb,
2821 unsigned int *idx,
2822 struct netlink_callback *cb,
2823 const struct nft_table *table,
2824 const struct nft_chain *chain)
2825{
2826 struct net *net = sock_net(skb->sk);
2c82c7e7 2827 const struct nft_rule *rule, *prule;
241faece 2828 unsigned int s_idx = cb->args[0];
241faece 2829
2c82c7e7 2830 prule = NULL;
241faece
PS		 2831 list_for_each_entry_rcu(rule, &chain->rules, list) {
2832 if (!nft_is_active(net, rule))
2c82c7e7 2833 goto cont_skip;
241faece
PS		 2834 if (*idx < s_idx)
2835 goto cont;
2836 if (*idx > s_idx) {
2837 memset(&cb->args[1], 0,
2838 sizeof(cb->args) - sizeof(cb->args[0]));
2839 }
2840 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2841 cb->nlh->nlmsg_seq,
2842 NFT_MSG_NEWRULE,
2843 NLM_F_MULTI | NLM_F_APPEND,
2844 table->family,
2c82c7e7 2845 table, chain, rule, prule) < 0)
310529e6 2846 return 1;
241faece
PS		 2847
2848 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2849cont:
2c82c7e7
FW		 2850 prule = rule;
2851cont_skip:
241faece
PS		 2852 (*idx)++;
2853 }
310529e6 2854 return 0;
241faece
PS		 2855}
2856
96518518
PM		 2857static int nf_tables_dump_rules(struct sk_buff *skb,
2858 struct netlink_callback *cb)
2859{
2860 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2861 const struct nft_rule_dump_ctx *ctx = cb->data;
241faece 2862 struct nft_table *table;
96518518 2863 const struct nft_chain *chain;
241faece 2864 unsigned int idx = 0;
99633ab2 2865 struct net *net = sock_net(skb->sk);
96518518
PM		 2866 int family = nfmsg->nfgen_family;
2867
e688a7f8 2868 rcu_read_lock();
38e029f1
PNA		 2869 cb->seq = net->nft.base_seq;
2870
36596dad 2871 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2872 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2873 continue;
2874
2875 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2876 continue;
2877
715849ab 2878 if (ctx && ctx->table && ctx->chain) {
241faece 2879 struct rhlist_head *list, *tmp;
6e1f760e 2880
241faece
PS		 2881 list = rhltable_lookup(&table->chains_ht, ctx->chain,
2882 nft_chain_ht_params);
2883 if (!list)
2884 goto done;
2885
2886 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2887 if (!nft_is_active(net, chain))
2888 continue;
2889 __nf_tables_dump_rules(skb, &idx,
2890 cb, table, chain);
2891 break;
96518518 2892 }
241faece 2893 goto done;
96518518 2894 }
241faece
PS		 2895
2896 list_for_each_entry_rcu(chain, &table->chains, list) {
2897 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2898 goto done;
2899 }
2900
2901 if (ctx && ctx->table)
2902 break;
96518518
PM		 2903 }
2904done:
e688a7f8 2905 rcu_read_unlock();
310529e6
PS		 2906
2907 cb->args[0] = idx;
96518518
PM		 2908 return skb->len;
2909}
2910
90fd131a
FW		 2911static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2912{
2913 const struct nlattr * const *nla = cb->data;
2914 struct nft_rule_dump_ctx *ctx = NULL;
2915
2916 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2917 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2918 if (!ctx)
2919 return -ENOMEM;
2920
2921 if (nla[NFTA_RULE_TABLE]) {
2922 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2923 GFP_ATOMIC);
2924 if (!ctx->table) {
2925 kfree(ctx);
2926 return -ENOMEM;
2927 }
2928 }
2929 if (nla[NFTA_RULE_CHAIN]) {
2930 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2931 GFP_ATOMIC);
2932 if (!ctx->chain) {
2933 kfree(ctx->table);
2934 kfree(ctx);
2935 return -ENOMEM;
2936 }
2937 }
2938 }
2939
2940 cb->data = ctx;
2941 return 0;
2942}
2943
6e1f760e
PNA		 2944static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2945{
e46abbcc
PS		 2946 struct nft_rule_dump_ctx *ctx = cb->data;
2947
2948 if (ctx) {
2949 kfree(ctx->table);
b7263e07 2950 kfree(ctx->chain);
e46abbcc
PS		 2951 kfree(ctx);
2952 }
6e1f760e
PNA		 2953 return 0;
2954}
2955
d9adf22a 2956/* called with rcu_read_lock held */
7b8002a1
PNA		 2957static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2958 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2959 const struct nlattr * const nla[],
2960 struct netlink_ext_ack *extack)
96518518
PM		 2961{
2962 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2963 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2964 const struct nft_chain *chain;
2965 const struct nft_rule *rule;
1b2470e5 2966 struct nft_table *table;
96518518
PM		 2967 struct sk_buff *skb2;
2968 int family = nfmsg->nfgen_family;
2969 int err;
2970
2971 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2972 struct netlink_dump_control c = {
90fd131a 2973 .start= nf_tables_dump_rules_start,
96518518 2974 .dump = nf_tables_dump_rules,
6e1f760e 2975 .done = nf_tables_dump_rules_done,
d9adf22a 2976 .module = THIS_MODULE,
90fd131a 2977 .data = (void *)nla,
96518518 2978 };
6e1f760e 2979
d9adf22a 2980 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 2981 }
2982
cac20fcd 2983 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2984 if (IS_ERR(table)) {
2985 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2986 return PTR_ERR(table);
36dd1bcc 2987 }
96518518 2988
f102d66b 2989 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2990 if (IS_ERR(chain)) {
2991 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2992 return PTR_ERR(chain);
36dd1bcc 2993 }
96518518 2994
cac20fcd 2995 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2996 if (IS_ERR(rule)) {
2997 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2998 return PTR_ERR(rule);
36dd1bcc 2999 }
96518518 3000
d9adf22a 3001 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 3002 if (!skb2)
3003 return -ENOMEM;
3004
84d7fce6 3005 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518 3006 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2c82c7e7 3007 family, table, chain, rule, NULL);
96518518
PM		 3008 if (err < 0)
3009 goto err;
3010
3011 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3012
3013err:
3014 kfree_skb(skb2);
3015 return err;
3016}
3017
62472bce
PM		 3018static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
3019 struct nft_rule *rule)
96518518 3020{
29e38801 3021 struct nft_expr *expr, *next;
96518518
PM		 3022
3023 /*
3024 * Careful: some expressions might not be initialized in case this
3025 * is called on error from nf_tables_newrule().
3026 */
3027 expr = nft_expr_first(rule);
3e38df13 3028 while (expr != nft_expr_last(rule) && expr->ops) {
29e38801 3029 next = nft_expr_next(expr);
62472bce 3030 nf_tables_expr_destroy(ctx, expr);
29e38801 3031 expr = next;
96518518
PM		 3032 }
3033 kfree(rule);
3034}
3035
d0e2c7de 3036void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)
bb7b40ae 3037{
f6ac8585 3038 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
bb7b40ae
PNA		 3039 nf_tables_rule_destroy(ctx, rule);
3040}
3041
a654de8f
PNA		 3042int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
3043{
3044 struct nft_expr *expr, *last;
3045 const struct nft_data *data;
3046 struct nft_rule *rule;
3047 int err;
3048
26b2f552
TY		 3049 if (ctx->level == NFT_JUMP_STACK_SIZE)
3050 return -EMLINK;
3051
a654de8f
PNA		 3052 list_for_each_entry(rule, &chain->rules, list) {
3053 if (!nft_is_active_next(ctx->net, rule))
3054 continue;
3055
3056 nft_rule_for_each_expr(expr, last, rule) {
3057 if (!expr->ops->validate)
3058 continue;
3059
3060 err = expr->ops->validate(ctx, expr, &data);
3061 if (err < 0)
3062 return err;
3063 }
3064 }
3065
3066 return 0;
3067}
3068EXPORT_SYMBOL_GPL(nft_chain_validate);
3069
3070static int nft_table_validate(struct net *net, const struct nft_table *table)
3071{
3072 struct nft_chain *chain;
3073 struct nft_ctx ctx = {
3074 .net = net,
3075 .family = table->family,
3076 };
3077 int err;
3078
3079 list_for_each_entry(chain, &table->chains, list) {
3080 if (!nft_is_base_chain(chain))
3081 continue;
3082
3083 ctx.chain = chain;
3084 err = nft_chain_validate(&ctx, chain);
3085 if (err < 0)
3086 return err;
3087 }
3088
3089 return 0;
3090}
3091
75dd48e2
PS		 3092static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3093 const struct nlattr *nla);
3094
1081d11b
PNA		 3095#define NFT_RULE_MAXEXPRS 128
3096
633c9a84
PNA		 3097static int nf_tables_newrule(struct net *net, struct sock *nlsk,
3098 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3099 const struct nlattr * const nla[],
3100 struct netlink_ext_ack *extack)
96518518
PM		 3101{
3102 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3103 u8 genmask = nft_genmask_next(net);
2a43ecf9 3104 struct nft_expr_info *info = NULL;
98319cb9 3105 int family = nfmsg->nfgen_family;
c9626a2c 3106 struct nft_flow_rule *flow;
96518518
PM		 3107 struct nft_table *table;
3108 struct nft_chain *chain;
3109 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 3110 struct nft_userdata *udata;
1081d11b 3111 struct nft_trans *trans = NULL;
96518518
PM		 3112 struct nft_expr *expr;
3113 struct nft_ctx ctx;
3114 struct nlattr *tmp;
86f1ec32 3115 unsigned int size, i, n, ulen = 0, usize = 0;
96518518 3116 int err, rem;
5e948466 3117 u64 handle, pos_handle;
96518518 3118
f102d66b
FW		 3119 lockdep_assert_held(&net->nft.commit_mutex);
3120
cac20fcd 3121 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 3122 if (IS_ERR(table)) {
3123 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 3124 return PTR_ERR(table);
36dd1bcc 3125 }
96518518 3126
837830a4
PNA		 3127 if (nla[NFTA_RULE_CHAIN]) {
3128 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3129 genmask);
3130 if (IS_ERR(chain)) {
3131 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3132 return PTR_ERR(chain);
3133 }
d0e2c7de
PNA		 3134 if (nft_chain_is_bound(chain))
3135 return -EOPNOTSUPP;
3136
837830a4
PNA		 3137 } else if (nla[NFTA_RULE_CHAIN_ID]) {
3138 chain = nft_chain_lookup_byid(net, nla[NFTA_RULE_CHAIN_ID]);
3139 if (IS_ERR(chain)) {
3140 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);
3141 return PTR_ERR(chain);
3142 }
3143 } else {
3144 return -EINVAL;
36dd1bcc 3145 }
96518518
PM		 3146
3147 if (nla[NFTA_RULE_HANDLE]) {
3148 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 3149 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 3150 if (IS_ERR(rule)) {
3151 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 3152 return PTR_ERR(rule);
36dd1bcc 3153 }
96518518 3154
36dd1bcc
PNA		 3155 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3156 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 3157 return -EEXIST;
36dd1bcc 3158 }
96518518
PM		 3159 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3160 old_rule = rule;
3161 else
3162 return -EOPNOTSUPP;
3163 } else {
445509eb
PNA		 3164 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
3165 nlh->nlmsg_flags & NLM_F_REPLACE)
96518518
PM		 3166 return -EINVAL;
3167 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 3168
3169 if (chain->use == UINT_MAX)
3170 return -EOVERFLOW;
5e948466 3171
447750f2
FW		 3172 if (nla[NFTA_RULE_POSITION]) {
3173 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
3174 old_rule = __nft_rule_lookup(chain, pos_handle);
3175 if (IS_ERR(old_rule)) {
3176 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
3177 return PTR_ERR(old_rule);
3178 }
75dd48e2
PS		 3179 } else if (nla[NFTA_RULE_POSITION_ID]) {
3180 old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
3181 if (IS_ERR(old_rule)) {
3182 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
3183 return PTR_ERR(old_rule);
3184 }
36dd1bcc 3185 }
5e948466
EL		 3186 }
3187
98319cb9 3188 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 3189
96518518
PM		 3190 n = 0;
3191 size = 0;
3192 if (nla[NFTA_RULE_EXPRESSIONS]) {
2a43ecf9
FW		 3193 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
3194 sizeof(struct nft_expr_info),
3195 GFP_KERNEL);
3196 if (!info)
3197 return -ENOMEM;
3198
96518518
PM		 3199 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
3200 err = -EINVAL;
3201 if (nla_type(tmp) != NFTA_LIST_ELEM)
3202 goto err1;
3203 if (n == NFT_RULE_MAXEXPRS)
3204 goto err1;
0ca743a5 3205 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 3206 if (err < 0)
3207 goto err1;
3208 size += info[n].ops->size;
3209 n++;
3210 }
3211 }
9889840f
PM		 3212 /* Check for overflow of dlen field */
3213 err = -EFBIG;
3214 if (size >= 1 << 12)
3215 goto err1;
96518518 3216
86f1ec32 3217 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 3218 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 3219 if (ulen > 0)
3220 usize = sizeof(struct nft_userdata) + ulen;
3221 }
0768b3b3 3222
96518518 3223 err = -ENOMEM;
86f1ec32 3224 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 3225 if (rule == NULL)
3226 goto err1;
3227
889f7ee7 3228 nft_activate_next(net, rule);
0628b123 3229
96518518
PM		 3230 rule->handle = handle;
3231 rule->dlen = size;
86f1ec32 3232 rule->udata = ulen ? 1 : 0;
0768b3b3 3233
86f1ec32
PM		 3234 if (ulen) {
3235 udata = nft_userdata(rule);
3236 udata->len = ulen - 1;
3237 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
3238 }
96518518 3239
96518518
PM		 3240 expr = nft_expr_first(rule);
3241 for (i = 0; i < n; i++) {
3242 err = nf_tables_newexpr(&ctx, &info[i], expr);
83d9dcba
PNA		 3243 if (err < 0) {
3244 NL_SET_BAD_ATTR(extack, info[i].attr);
96518518 3245 goto err2;
83d9dcba 3246 }
a654de8f
PNA		 3247
3248 if (info[i].ops->validate)
3249 nft_validate_state_update(net, NFT_VALIDATE_NEED);
3250
ef1f7df9 3251 info[i].ops = NULL;
96518518
PM		 3252 expr = nft_expr_next(expr);
3253 }
3254
96518518 3255 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
ca089878 3256 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
569ccae6
FW		 3257 if (trans == NULL) {
3258 err = -ENOMEM;
3259 goto err2;
3260 }
ca089878
TY		 3261 err = nft_delrule(&ctx, old_rule);
3262 if (err < 0) {
3263 nft_trans_destroy(trans);
569ccae6
FW		 3264 goto err2;
3265 }
3266
3267 list_add_tail_rcu(&rule->list, &old_rule->list);
3268 } else {
c9626a2c
PNA		 3269 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3270 if (!trans) {
569ccae6
FW		 3271 err = -ENOMEM;
3272 goto err2;
3273 }
3274
3275 if (nlh->nlmsg_flags & NLM_F_APPEND) {
3276 if (old_rule)
3277 list_add_rcu(&rule->list, &old_rule->list);
3278 else
3279 list_add_tail_rcu(&rule->list, &chain->rules);
3280 } else {
3281 if (old_rule)
3282 list_add_tail_rcu(&rule->list, &old_rule->list);
3283 else
3284 list_add_rcu(&rule->list, &chain->rules);
3285 }
0628b123 3286 }
2a43ecf9 3287 kvfree(info);
4fefee57 3288 chain->use++;
96518518 3289
a654de8f
PNA		 3290 if (net->nft.validate_state == NFT_VALIDATE_DO)
3291 return nft_table_validate(net, table);
3292
c9626a2c 3293 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
be2861dc 3294 flow = nft_flow_rule_create(net, rule);
c9626a2c
PNA		 3295 if (IS_ERR(flow))
3296 return PTR_ERR(flow);
3297
3298 nft_trans_flow_rule(trans) = flow;
3299 }
3300
a654de8f 3301 return 0;
96518518 3302err2:
bb7b40ae 3303 nf_tables_rule_release(&ctx, rule);
96518518
PM		 3304err1:
3305 for (i = 0; i < n; i++) {
b25a31bf 3306 if (info[i].ops) {
ef1f7df9 3307 module_put(info[i].ops->type->owner);
b25a31bf
TY		 3308 if (info[i].ops->type->release_ops)
3309 info[i].ops->type->release_ops(info[i].ops);
3310 }
96518518 3311 }
2a43ecf9 3312 kvfree(info);
96518518
PM		 3313 return err;
3314}
3315
1a94e38d
PNA		 3316static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3317 const struct nlattr *nla)
3318{
3319 u32 id = ntohl(nla_get_be32(nla));
3320 struct nft_trans *trans;
3321
3322 list_for_each_entry(trans, &net->nft.commit_list, list) {
3323 struct nft_rule *rule = nft_trans_rule(trans);
3324
3325 if (trans->msg_type == NFT_MSG_NEWRULE &&
3326 id == nft_trans_rule_id(trans))
3327 return rule;
3328 }
3329 return ERR_PTR(-ENOENT);
3330}
3331
633c9a84
PNA		 3332static int nf_tables_delrule(struct net *net, struct sock *nlsk,
3333 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3334 const struct nlattr * const nla[],
3335 struct netlink_ext_ack *extack)
96518518
PM		 3336{
3337 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3338 u8 genmask = nft_genmask_next(net);
7c95f6d8 3339 struct nft_table *table;
cf9dc09d
PNA		 3340 struct nft_chain *chain = NULL;
3341 struct nft_rule *rule;
0628b123
PNA		 3342 int family = nfmsg->nfgen_family, err = 0;
3343 struct nft_ctx ctx;
96518518 3344
cac20fcd 3345 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 3346 if (IS_ERR(table)) {
3347 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 3348 return PTR_ERR(table);
36dd1bcc 3349 }
96518518 3350
cf9dc09d 3351 if (nla[NFTA_RULE_CHAIN]) {
f102d66b
FW		 3352 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3353 genmask);
36dd1bcc
PNA		 3354 if (IS_ERR(chain)) {
3355 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 3356 return PTR_ERR(chain);
36dd1bcc 3357 }
d0e2c7de
PNA		 3358 if (nft_chain_is_bound(chain))
3359 return -EOPNOTSUPP;
cf9dc09d 3360 }
96518518 3361
98319cb9 3362 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 3363
cf9dc09d
PNA		 3364 if (chain) {
3365 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 3366 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 3367 if (IS_ERR(rule)) {
3368 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 3369 return PTR_ERR(rule);
36dd1bcc 3370 }
96518518 3371
1a94e38d
PNA		 3372 err = nft_delrule(&ctx, rule);
3373 } else if (nla[NFTA_RULE_ID]) {
3374 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 3375 if (IS_ERR(rule)) {
3376 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 3377 return PTR_ERR(rule);
36dd1bcc 3378 }
1a94e38d 3379
5e266fe7 3380 err = nft_delrule(&ctx, rule);
cf9dc09d 3381 } else {
ce24b721 3382 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 3383 }
3384 } else {
3385 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 3386 if (!nft_is_active_next(net, chain))
3387 continue;
3388
cf9dc09d 3389 ctx.chain = chain;
ce24b721 3390 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 3391 if (err < 0)
3392 break;
3393 }
3394 }
3395
3396 return err;
3397}
3398
20a69341
PM		 3399/*
3400 * Sets
3401 */
e32a4dc6
FW		 3402static const struct nft_set_type *nft_set_types[] = {
3403 &nft_set_hash_fast_type,
3404 &nft_set_hash_type,
3405 &nft_set_rhash_type,
3406 &nft_set_bitmap_type,
3407 &nft_set_rbtree_type,
e6abef61 3408#if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
7400b063
SB		 3409 &nft_set_pipapo_avx2_type,
3410#endif
e32a4dc6
FW		 3411 &nft_set_pipapo_type,
3412};
20a69341 3413
2b664957 3414#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 3415 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3416 NFT_SET_EVAL)
2b664957 3417
71cc0873 3418static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 3419{
71cc0873 3420 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 3421}
3422
c50b960c
PM		 3423/*
3424 * Select a set implementation based on the data characteristics and the
3425 * given policy. The total memory use might not be known if no size is
3426 * given, in that case the amount of memory per element is used.
3427 */
3428static const struct nft_set_ops *
2b664957
PNA		 3429nft_select_set_ops(const struct nft_ctx *ctx,
3430 const struct nlattr * const nla[],
c50b960c
PM		 3431 const struct nft_set_desc *desc,
3432 enum nft_set_policies policy)
20a69341 3433{
c50b960c
PM		 3434 const struct nft_set_ops *ops, *bops;
3435 struct nft_set_estimate est, best;
2b664957
PNA		 3436 const struct nft_set_type *type;
3437 u32 flags = 0;
e32a4dc6 3438 int i;
20a69341 3439
f102d66b
FW		 3440 lockdep_assert_held(&ctx->net->nft.commit_mutex);
3441 lockdep_nfnl_nft_mutex_not_held();
e32a4dc6 3442
2b664957
PNA		 3443 if (nla[NFTA_SET_FLAGS] != NULL)
3444 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 3445
55af753c
PNA		 3446 bops = NULL;
3447 best.size = ~0;
3448 best.lookup = ~0;
0b5a7874 3449 best.space = ~0;
c50b960c 3450
e32a4dc6
FW		 3451 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) {
3452 type = nft_set_types[i];
71cc0873 3453 ops = &type->ops;
2b664957 3454
71cc0873 3455 if (!nft_set_ops_candidate(type, flags))
20a69341 3456 continue;
2b664957 3457 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 3458 continue;
3459
3460 switch (policy) {
3461 case NFT_SET_POL_PERFORMANCE:
55af753c 3462 if (est.lookup < best.lookup)
c50b960c 3463 break;
644e334e
PNA		 3464 if (est.lookup == best.lookup &&
3465 est.space < best.space)
3466 break;
c50b960c
PM		 3467 continue;
3468 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 3469 if (!desc->size) {
3470 if (est.space < best.space)
3471 break;
3472 if (est.space == best.space &&
3473 est.lookup < best.lookup)
3474 break;
4f2921ca 3475 } else if (est.size < best.size || !bops) {
c50b960c 3476 break;
0b5a7874 3477 }
c50b960c
PM		 3478 continue;
3479 default:
3480 break;
3481 }
3482
c50b960c
PM		 3483 bops = ops;
3484 best = est;
20a69341
PM		 3485 }
3486
c50b960c
PM		 3487 if (bops != NULL)
3488 return bops;
3489
20a69341
PM		 3490 return ERR_PTR(-EOPNOTSUPP);
3491}
3492
3493static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 3494 [NFTA_SET_TABLE] = { .type = NLA_STRING,
3495 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 3496 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 3497 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 3498 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
3499 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
3500 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
3501 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
3502 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 3503 [NFTA_SET_POLICY] = { .type = NLA_U32 },
3504 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 3505 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 3506 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
3507 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 3508 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
3509 .len = NFT_USERDATA_MAXLEN },
8aeff920 3510 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 3511 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
65038428 3512 [NFTA_SET_EXPR] = { .type = NLA_NESTED },
c50b960c
PM		 3513};
3514
3515static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3516 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
f3a2181e 3517 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED },
20a69341
PM		 3518};
3519
633c9a84 3520static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3521 const struct sk_buff *skb,
3522 const struct nlmsghdr *nlh,
f2a6d766 3523 const struct nlattr * const nla[],
36dd1bcc 3524 struct netlink_ext_ack *extack,
f2a6d766 3525 u8 genmask)
20a69341
PM		 3526{
3527 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3528 int family = nfmsg->nfgen_family;
7c95f6d8 3529 struct nft_table *table = NULL;
20a69341 3530
20a69341 3531 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 3532 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3533 genmask);
36dd1bcc
PNA		 3534 if (IS_ERR(table)) {
3535 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3536 return PTR_ERR(table);
36dd1bcc 3537 }
20a69341
PM		 3538 }
3539
98319cb9 3540 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3541 return 0;
3542}
3543
cac20fcd
PNA		 3544static struct nft_set *nft_set_lookup(const struct nft_table *table,
3545 const struct nlattr *nla, u8 genmask)
20a69341
PM		 3546{
3547 struct nft_set *set;
3548
3549 if (nla == NULL)
3550 return ERR_PTR(-EINVAL);
3551
d9adf22a 3552 list_for_each_entry_rcu(set, &table->sets, list) {
37a9cc52
PNA		 3553 if (!nla_strcmp(nla, set->name) &&
3554 nft_active_genmask(set, genmask))
20a69341
PM		 3555 return set;
3556 }
3557 return ERR_PTR(-ENOENT);
3558}
3559
cac20fcd
PNA		 3560static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3561 const struct nlattr *nla,
3562 u8 genmask)
3ecbfd65
HS		 3563{
3564 struct nft_set *set;
3565
3ecbfd65
HS		 3566 list_for_each_entry(set, &table->sets, list) {
3567 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3568 nft_active_genmask(set, genmask))
3569 return set;
3570 }
3571 return ERR_PTR(-ENOENT);
3572}
3573
cac20fcd
PNA		 3574static struct nft_set *nft_set_lookup_byid(const struct net *net,
3575 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 3576{
3577 struct nft_trans *trans;
3578 u32 id = ntohl(nla_get_be32(nla));
3579
3580 list_for_each_entry(trans, &net->nft.commit_list, list) {
9c7f96fd
AK		 3581 if (trans->msg_type == NFT_MSG_NEWSET) {
3582 struct nft_set *set = nft_trans_set(trans);
37a9cc52 3583
9c7f96fd
AK		 3584 if (id == nft_trans_set_id(trans) &&
3585 nft_active_genmask(set, genmask))
3586 return set;
3587 }
958bee14
PNA		 3588 }
3589 return ERR_PTR(-ENOENT);
3590}
c7a72e3f 3591
10659cba
PNA		 3592struct nft_set *nft_set_lookup_global(const struct net *net,
3593 const struct nft_table *table,
3594 const struct nlattr *nla_set_name,
3595 const struct nlattr *nla_set_id,
3596 u8 genmask)
c7a72e3f
PNA		 3597{
3598 struct nft_set *set;
3599
cac20fcd 3600 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 3601 if (IS_ERR(set)) {
3602 if (!nla_set_id)
3603 return set;
3604
cac20fcd 3605 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 3606 }
3607 return set;
3608}
10659cba 3609EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 3610
20a69341
PM		 3611static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3612 const char *name)
3613{
3614 const struct nft_set *i;
3615 const char *p;
3616 unsigned long *inuse;
60eb1894 3617 unsigned int n = 0, min = 0;
20a69341 3618
38745490 3619 p = strchr(name, '%');
20a69341
PM		 3620 if (p != NULL) {
3621 if (p[1] != 'd' || strchr(p + 2, '%'))
3622 return -EINVAL;
3623
3624 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3625 if (inuse == NULL)
3626 return -ENOMEM;
60eb1894 3627cont:
20a69341 3628 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 3629 int tmp;
3630
37a9cc52
PNA		 3631 if (!nft_is_active_next(ctx->net, set))
3632 continue;
14662917 3633 if (!sscanf(i->name, name, &tmp))
20a69341 3634 continue;
60eb1894 3635 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 3636 continue;
14662917 3637
60eb1894 3638 set_bit(tmp - min, inuse);
20a69341
PM		 3639 }
3640
53b70287 3641 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 3642 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3643 min += BITS_PER_BYTE * PAGE_SIZE;
3644 memset(inuse, 0, PAGE_SIZE);
3645 goto cont;
3646 }
20a69341
PM		 3647 free_page((unsigned long)inuse);
3648 }
3649
38745490
PS		 3650 set->name = kasprintf(GFP_KERNEL, name, min + n);
3651 if (!set->name)
3652 return -ENOMEM;
3653
20a69341 3654 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 3655 if (!nft_is_active_next(ctx->net, i))
3656 continue;
e63aaaa6
AY		 3657 if (!strcmp(set->name, i->name)) {
3658 kfree(set->name);
7fb6f78d 3659 set->name = NULL;
20a69341 3660 return -ENFILE;
e63aaaa6 3661 }
20a69341
PM		 3662 }
3663 return 0;
3664}
3665
8e1102d5
FW		 3666static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3667{
3668 u64 ms = be64_to_cpu(nla_get_be64(nla));
3669 u64 max = (u64)(~((u64)0));
3670
3671 max = div_u64(max, NSEC_PER_MSEC);
3672 if (ms >= max)
3673 return -ERANGE;
3674
3675 ms *= NSEC_PER_MSEC;
3676 *result = nsecs_to_jiffies64(ms);
3677 return 0;
3678}
3679
d6501de8 3680static __be64 nf_jiffies64_to_msecs(u64 input)
8e1102d5 3681{
3b15d09f 3682 return cpu_to_be64(jiffies64_to_msecs(input));
8e1102d5
FW		 3683}
3684
f3a2181e
SB		 3685static int nf_tables_fill_set_concat(struct sk_buff *skb,
3686 const struct nft_set *set)
3687{
3688 struct nlattr *concat, *field;
3689 int i;
3690
3691 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT);
3692 if (!concat)
3693 return -ENOMEM;
3694
3695 for (i = 0; i < set->field_count; i++) {
3696 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
3697 if (!field)
3698 return -ENOMEM;
3699
3700 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN,
3701 htonl(set->field_len[i])))
3702 return -ENOMEM;
3703
3704 nla_nest_end(skb, field);
3705 }
3706
3707 nla_nest_end(skb, concat);
3708
3709 return 0;
3710}
3711
20a69341
PM		 3712static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3713 const struct nft_set *set, u16 event, u16 flags)
3714{
3715 struct nfgenmsg *nfmsg;
3716 struct nlmsghdr *nlh;
128ad332 3717 u32 portid = ctx->portid;
65038428 3718 struct nlattr *nest;
128ad332 3719 u32 seq = ctx->seq;
20a69341 3720
dedb67c4 3721 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 3722 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3723 flags);
3724 if (nlh == NULL)
3725 goto nla_put_failure;
3726
3727 nfmsg = nlmsg_data(nlh);
36596dad 3728 nfmsg->nfgen_family = ctx->family;
20a69341 3729 nfmsg->version = NFNETLINK_V0;
84d7fce6 3730 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 3731
3732 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3733 goto nla_put_failure;
3734 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3735 goto nla_put_failure;
3ecbfd65
HS		 3736 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3737 NFTA_SET_PAD))
3738 goto nla_put_failure;
20a69341
PM		 3739 if (set->flags != 0)
3740 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3741 goto nla_put_failure;
3742
3743 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3744 goto nla_put_failure;
3745 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3746 goto nla_put_failure;
3747 if (set->flags & NFT_SET_MAP) {
3748 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3749 goto nla_put_failure;
3750 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3751 goto nla_put_failure;
3752 }
8aeff920
PNA		 3753 if (set->flags & NFT_SET_OBJECT &&
3754 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3755 goto nla_put_failure;
20a69341 3756
761da293 3757 if (set->timeout &&
d3e2a111 3758 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 3759 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 3760 NFTA_SET_PAD))
761da293
PM		 3761 goto nla_put_failure;
3762 if (set->gc_int &&
3763 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3764 goto nla_put_failure;
3765
9363dc4b
AB		 3766 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3767 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3768 goto nla_put_failure;
3769 }
3770
e6d8ecac
CFG		 3771 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3772 goto nla_put_failure;
3773
65038428
PNA		 3774 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC);
3775 if (!nest)
c50b960c
PM		 3776 goto nla_put_failure;
3777 if (set->size &&
3778 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3779 goto nla_put_failure;
f3a2181e
SB		 3780
3781 if (set->field_count > 1 &&
3782 nf_tables_fill_set_concat(skb, set))
3783 goto nla_put_failure;
3784
65038428
PNA		 3785 nla_nest_end(skb, nest);
3786
3787 if (set->expr) {
3788 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR);
3789 if (nf_tables_fill_expr_info(skb, set->expr) < 0)
3790 goto nla_put_failure;
3791
3792 nla_nest_end(skb, nest);
3793 }
c50b960c 3794
053c095a
JB		 3795 nlmsg_end(skb, nlh);
3796 return 0;
20a69341
PM		 3797
3798nla_put_failure:
3799 nlmsg_trim(skb, nlh);
3800 return -1;
3801}
3802
25e94a99
PNA		 3803static void nf_tables_set_notify(const struct nft_ctx *ctx,
3804 const struct nft_set *set, int event,
3805 gfp_t gfp_flags)
20a69341
PM		 3806{
3807 struct sk_buff *skb;
128ad332 3808 u32 portid = ctx->portid;
20a69341 3809 int err;
8e6cf365
RGB		 3810 char *buf = kasprintf(gfp_flags, "%s:%llu;%s:%llu",
3811 ctx->table->name, ctx->table->handle,
3812 set->name, set->handle);
3813
3814 audit_log_nfcfg(buf,
3815 ctx->family,
3816 set->field_count,
3817 event == NFT_MSG_NEWSET ?
3818 AUDIT_NFT_OP_SET_REGISTER :
14224039
RGB		 3819 AUDIT_NFT_OP_SET_UNREGISTER,
3820 gfp_flags);
8e6cf365 3821 kfree(buf);
20a69341 3822
128ad332
PNA		 3823 if (!ctx->report &&
3824 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 3825 return;
20a69341 3826
31f8441c 3827 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 3828 if (skb == NULL)
3829 goto err;
3830
3831 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3832 if (err < 0) {
3833 kfree_skb(skb);
3834 goto err;
3835 }
3836
25e94a99
PNA		 3837 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3838 gfp_flags);
3839 return;
20a69341 3840err:
25e94a99 3841 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 3842}
3843
5b96af77 3844static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 3845{
3846 const struct nft_set *set;
3847 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 3848 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3849 struct net *net = sock_net(skb->sk);
5b96af77 3850 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 3851
3852 if (cb->args[1])
3853 return skb->len;
3854
e688a7f8 3855 rcu_read_lock();
38e029f1
PNA		 3856 cb->seq = net->nft.base_seq;
3857
36596dad
PNA		 3858 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3859 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 3860 ctx->family != table->family)
36596dad
PNA		 3861 continue;
3862
3863 if (ctx->table && ctx->table != table)
5b96af77
PNA		 3864 continue;
3865
36596dad
PNA		 3866 if (cur_table) {
3867 if (cur_table != table)
c9c8e485
PNA		 3868 continue;
3869
36596dad 3870 cur_table = NULL;
c9c8e485 3871 }
36596dad
PNA		 3872 idx = 0;
3873 list_for_each_entry_rcu(set, &table->sets, list) {
3874 if (idx < s_idx)
3875 goto cont;
3876 if (!nft_is_active(net, set))
3877 goto cont;
5b96af77 3878
36596dad
PNA		 3879 ctx_set = *ctx;
3880 ctx_set.table = table;
98319cb9 3881 ctx_set.family = table->family;
c9c8e485 3882
36596dad
PNA		 3883 if (nf_tables_fill_set(skb, &ctx_set, set,
3884 NFT_MSG_NEWSET,
3885 NLM_F_MULTI) < 0) {
3886 cb->args[0] = idx;
3887 cb->args[2] = (unsigned long) table;
3888 goto done;
c9c8e485 3889 }
36596dad 3890 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 3891cont:
36596dad 3892 idx++;
c9c8e485 3893 }
36596dad
PNA		 3894 if (s_idx)
3895 s_idx = 0;
c9c8e485
PNA		 3896 }
3897 cb->args[1] = 1;
3898done:
e688a7f8 3899 rcu_read_unlock();
c9c8e485
PNA		 3900 return skb->len;
3901}
3902
90fd131a
FW		 3903static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3904{
3905 struct nft_ctx *ctx_dump = NULL;
3906
3907 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3908 if (ctx_dump == NULL)
3909 return -ENOMEM;
3910
3911 cb->data = ctx_dump;
3912 return 0;
3913}
3914
5b96af77 3915static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 3916{
5b96af77
PNA		 3917 kfree(cb->data);
3918 return 0;
20a69341
PM		 3919}
3920
d9adf22a 3921/* called with rcu_read_lock held */
7b8002a1
PNA		 3922static int nf_tables_getset(struct net *net, struct sock *nlsk,
3923 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3924 const struct nlattr * const nla[],
3925 struct netlink_ext_ack *extack)
20a69341 3926{
f2a6d766 3927 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3928 const struct nft_set *set;
3929 struct nft_ctx ctx;
3930 struct sk_buff *skb2;
c9c8e485 3931 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 3932 int err;
3933
01cfa0a4 3934 /* Verify existence before starting dump */
36dd1bcc
PNA		 3935 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3936 genmask);
20a69341
PM		 3937 if (err < 0)
3938 return err;
3939
3940 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3941 struct netlink_dump_control c = {
90fd131a 3942 .start = nf_tables_dump_sets_start,
20a69341 3943 .dump = nf_tables_dump_sets,
5b96af77 3944 .done = nf_tables_dump_sets_done,
90fd131a 3945 .data = &ctx,
d9adf22a 3946 .module = THIS_MODULE,
20a69341 3947 };
5b96af77 3948
d9adf22a 3949 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
20a69341
PM		 3950 }
3951
c9c8e485
PNA		 3952 /* Only accept unspec with dump */
3953 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3954 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3955 if (!nla[NFTA_SET_TABLE])
3956 return -EINVAL;
c9c8e485 3957
cac20fcd 3958 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3959 if (IS_ERR(set))
3960 return PTR_ERR(set);
3961
d9adf22a 3962 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
20a69341
PM		 3963 if (skb2 == NULL)
3964 return -ENOMEM;
3965
3966 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3967 if (err < 0)
3968 goto err;
3969
3970 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3971
3972err:
3973 kfree_skb(skb2);
3974 return err;
3975}
3976
f3a2181e
SB		 3977static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = {
3978 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 },
3979};
3980
3981static int nft_set_desc_concat_parse(const struct nlattr *attr,
3982 struct nft_set_desc *desc)
3983{
3984 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1];
3985 u32 len;
3986 int err;
3987
3988 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr,
3989 nft_concat_policy, NULL);
3990 if (err < 0)
3991 return err;
3992
3993 if (!tb[NFTA_SET_FIELD_LEN])
3994 return -EINVAL;
3995
3996 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN]));
3997
3998 if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT)
3999 return -E2BIG;
4000
4001 desc->field_len[desc->field_count++] = len;
4002
4003 return 0;
4004}
4005
4006static int nft_set_desc_concat(struct nft_set_desc *desc,
4007 const struct nlattr *nla)
4008{
4009 struct nlattr *attr;
4010 int rem, err;
4011
4012 nla_for_each_nested(attr, nla, rem) {
4013 if (nla_type(attr) != NFTA_LIST_ELEM)
4014 return -EINVAL;
4015
4016 err = nft_set_desc_concat_parse(attr, desc);
4017 if (err < 0)
4018 return err;
4019 }
4020
4021 return 0;
4022}
4023
f7e840ee 4024static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
c50b960c
PM		 4025 const struct nlattr *nla)
4026{
4027 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
4028 int err;
4029
8cb08174
JB		 4030 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
4031 nft_set_desc_policy, NULL);
c50b960c
PM		 4032 if (err < 0)
4033 return err;
4034
4035 if (da[NFTA_SET_DESC_SIZE] != NULL)
4036 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
f3a2181e
SB		 4037 if (da[NFTA_SET_DESC_CONCAT])
4038 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]);
c50b960c 4039
f3a2181e 4040 return err;
c50b960c
PM		 4041}
4042
633c9a84
PNA		 4043static int nf_tables_newset(struct net *net, struct sock *nlsk,
4044 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4045 const struct nlattr * const nla[],
4046 struct netlink_ext_ack *extack)
20a69341
PM		 4047{
4048 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 4049 u8 genmask = nft_genmask_next(net);
98319cb9 4050 int family = nfmsg->nfgen_family;
20a69341 4051 const struct nft_set_ops *ops;
65038428 4052 struct nft_expr *expr = NULL;
20a69341
PM		 4053 struct nft_table *table;
4054 struct nft_set *set;
4055 struct nft_ctx ctx;
38745490 4056 char *name;
4ef360dd 4057 u64 size;
761da293 4058 u64 timeout;
8aeff920 4059 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 4060 struct nft_set_desc desc;
e6d8ecac
CFG		 4061 unsigned char *udata;
4062 u16 udlen;
20a69341 4063 int err;
f3a2181e 4064 int i;
20a69341
PM		 4065
4066 if (nla[NFTA_SET_TABLE] == NULL ||
4067 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 4068 nla[NFTA_SET_KEY_LEN] == NULL ||
4069 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 4070 return -EINVAL;
4071
c50b960c
PM		 4072 memset(&desc, 0, sizeof(desc));
4073
20a69341
PM		 4074 ktype = NFT_DATA_VALUE;
4075 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
4076 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
4077 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
4078 return -EINVAL;
4079 }
4080
c50b960c 4081 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 4082 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 4083 return -EINVAL;
4084
4085 flags = 0;
4086 if (nla[NFTA_SET_FLAGS] != NULL) {
4087 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
4088 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 4089 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920 4090 NFT_SET_MAP | NFT_SET_EVAL |
ef516e86 4091 NFT_SET_OBJECT | NFT_SET_CONCAT))
d9583cdf 4092 return -EOPNOTSUPP;
8aeff920 4093 /* Only one of these operations is supported */
acab7131
FW		 4094 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
4095 (NFT_SET_MAP | NFT_SET_OBJECT))
4096 return -EOPNOTSUPP;
4097 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
4098 (NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 4099 return -EOPNOTSUPP;
20a69341
PM		 4100 }
4101
4102 dtype = 0;
20a69341
PM		 4103 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
4104 if (!(flags & NFT_SET_MAP))
4105 return -EINVAL;
4106
4107 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
4108 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
4109 dtype != NFT_DATA_VERDICT)
4110 return -EINVAL;
4111
4112 if (dtype != NFT_DATA_VERDICT) {
4113 if (nla[NFTA_SET_DATA_LEN] == NULL)
4114 return -EINVAL;
c50b960c 4115 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 4116 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 4117 return -EINVAL;
4118 } else
7d740264 4119 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 4120 } else if (flags & NFT_SET_MAP)
4121 return -EINVAL;
4122
8aeff920
PNA		 4123 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
4124 if (!(flags & NFT_SET_OBJECT))
4125 return -EINVAL;
4126
4127 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
4128 if (objtype == NFT_OBJECT_UNSPEC ||
4129 objtype > NFT_OBJECT_MAX)
d9583cdf 4130 return -EOPNOTSUPP;
8aeff920
PNA		 4131 } else if (flags & NFT_SET_OBJECT)
4132 return -EINVAL;
4133 else
4134 objtype = NFT_OBJECT_UNSPEC;
4135
761da293
PM		 4136 timeout = 0;
4137 if (nla[NFTA_SET_TIMEOUT] != NULL) {
4138 if (!(flags & NFT_SET_TIMEOUT))
4139 return -EINVAL;
8e1102d5
FW		 4140
4141 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
4142 if (err)
4143 return err;
761da293
PM		 4144 }
4145 gc_int = 0;
4146 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
4147 if (!(flags & NFT_SET_TIMEOUT))
4148 return -EINVAL;
4149 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
4150 }
4151
c50b960c
PM		 4152 policy = NFT_SET_POL_PERFORMANCE;
4153 if (nla[NFTA_SET_POLICY] != NULL)
4154 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
4155
4156 if (nla[NFTA_SET_DESC] != NULL) {
f7e840ee 4157 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
c50b960c
PM		 4158 if (err < 0)
4159 return err;
4160 }
4161
d56aab26
PNA		 4162 if (nla[NFTA_SET_EXPR])
4163 desc.expr = true;
4164
cac20fcd 4165 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 4166 if (IS_ERR(table)) {
4167 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 4168 return PTR_ERR(table);
36dd1bcc 4169 }
20a69341 4170
98319cb9 4171 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 4172
cac20fcd 4173 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 4174 if (IS_ERR(set)) {
36dd1bcc
PNA		 4175 if (PTR_ERR(set) != -ENOENT) {
4176 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 4177 return PTR_ERR(set);
36dd1bcc 4178 }
1a28ad74 4179 } else {
36dd1bcc
PNA		 4180 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4181 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 4182 return -EEXIST;
36dd1bcc 4183 }
20a69341
PM		 4184 if (nlh->nlmsg_flags & NLM_F_REPLACE)
4185 return -EOPNOTSUPP;
36dd1bcc 4186
20a69341
PM		 4187 return 0;
4188 }
4189
4190 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
4191 return -ENOENT;
4192
2b664957 4193 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 4194 if (IS_ERR(ops))
4195 return PTR_ERR(ops);
4196
e6d8ecac
CFG		 4197 udlen = 0;
4198 if (nla[NFTA_SET_USERDATA])
4199 udlen = nla_len(nla[NFTA_SET_USERDATA]);
4200
20a69341
PM		 4201 size = 0;
4202 if (ops->privsize != NULL)
347b408d 4203 size = ops->privsize(nla, &desc);
20a69341 4204
1ff75a3e 4205 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
24d19826
FW		 4206 if (!set)
4207 return -ENOMEM;
20a69341 4208
38745490
PS		 4209 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
4210 if (!name) {
4211 err = -ENOMEM;
65038428 4212 goto err_set_name;
38745490
PS		 4213 }
4214
20a69341 4215 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 4216 kfree(name);
20a69341 4217 if (err < 0)
65038428
PNA		 4218 goto err_set_alloc_name;
4219
4220 if (nla[NFTA_SET_EXPR]) {
4221 expr = nft_set_elem_expr_alloc(&ctx, set, nla[NFTA_SET_EXPR]);
4222 if (IS_ERR(expr)) {
4223 err = PTR_ERR(expr);
4224 goto err_set_alloc_name;
4225 }
4226 }
20a69341 4227
e6d8ecac
CFG		 4228 udata = NULL;
4229 if (udlen) {
4230 udata = set->data + size;
4231 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
4232 }
4233
20a69341 4234 INIT_LIST_HEAD(&set->bindings);
3453c927
PNA		 4235 set->table = table;
4236 write_pnet(&set->net, net);
20a69341
PM		 4237 set->ops = ops;
4238 set->ktype = ktype;
c50b960c 4239 set->klen = desc.klen;
20a69341 4240 set->dtype = dtype;
8aeff920 4241 set->objtype = objtype;
c50b960c 4242 set->dlen = desc.dlen;
65038428 4243 set->expr = expr;
20a69341 4244 set->flags = flags;
c50b960c 4245 set->size = desc.size;
9363dc4b 4246 set->policy = policy;
e6d8ecac
CFG		 4247 set->udlen = udlen;
4248 set->udata = udata;
761da293
PM		 4249 set->timeout = timeout;
4250 set->gc_int = gc_int;
3ecbfd65 4251 set->handle = nf_tables_alloc_handle(table);
20a69341 4252
f3a2181e
SB		 4253 set->field_count = desc.field_count;
4254 for (i = 0; i < desc.field_count; i++)
4255 set->field_len[i] = desc.field_len[i];
4256
c50b960c 4257 err = ops->init(set, &desc, nla);
20a69341 4258 if (err < 0)
65038428 4259 goto err_set_init;
20a69341 4260
958bee14 4261 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 4262 if (err < 0)
65038428 4263 goto err_set_trans;
20a69341 4264
e688a7f8 4265 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 4266 table->use++;
20a69341
PM		 4267 return 0;
4268
65038428 4269err_set_trans:
c17c3cdf 4270 ops->destroy(set);
65038428
PNA		 4271err_set_init:
4272 if (expr)
4273 nft_expr_destroy(&ctx, expr);
4274err_set_alloc_name:
2f6adf48 4275 kfree(set->name);
65038428 4276err_set_name:
1ff75a3e 4277 kvfree(set);
20a69341
PM		 4278 return err;
4279}
4280
0c2a85ed 4281static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
20a69341 4282{
273fe3f1
PNA		 4283 if (WARN_ON(set->use > 0))
4284 return;
4285
65038428
PNA		 4286 if (set->expr)
4287 nft_expr_destroy(ctx, set->expr);
4288
20a69341 4289 set->ops->destroy(set);
38745490 4290 kfree(set->name);
1ff75a3e 4291 kvfree(set);
20a69341
PM		 4292}
4293
633c9a84
PNA		 4294static int nf_tables_delset(struct net *net, struct sock *nlsk,
4295 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4296 const struct nlattr * const nla[],
4297 struct netlink_ext_ack *extack)
20a69341 4298{
c9c8e485 4299 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 4300 u8 genmask = nft_genmask_next(net);
36dd1bcc 4301 const struct nlattr *attr;
20a69341
PM		 4302 struct nft_set *set;
4303 struct nft_ctx ctx;
4304 int err;
4305
ec2c9935
PM		 4306 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4307 return -EAFNOSUPPORT;
20a69341
PM		 4308 if (nla[NFTA_SET_TABLE] == NULL)
4309 return -EINVAL;
4310
36dd1bcc
PNA		 4311 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
4312 genmask);
20a69341
PM		 4313 if (err < 0)
4314 return err;
4315
36dd1bcc
PNA		 4316 if (nla[NFTA_SET_HANDLE]) {
4317 attr = nla[NFTA_SET_HANDLE];
4318 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
4319 } else {
4320 attr = nla[NFTA_SET_NAME];
4321 set = nft_set_lookup(ctx.table, attr, genmask);
4322 }
a8278400 4323
36dd1bcc
PNA		 4324 if (IS_ERR(set)) {
4325 NL_SET_BAD_ATTR(extack, attr);
4326 return PTR_ERR(set);
4327 }
273fe3f1 4328 if (set->use ||
36dd1bcc
PNA		 4329 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
4330 NL_SET_BAD_ATTR(extack, attr);
20a69341 4331 return -EBUSY;
36dd1bcc 4332 }
20a69341 4333
ee01d542 4334 return nft_delset(&ctx, set);
20a69341
PM		 4335}
4336
4337static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 4338 struct nft_set *set,
20a69341 4339 const struct nft_set_iter *iter,
de70185d 4340 struct nft_set_elem *elem)
20a69341 4341{
fe2811eb 4342 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 4343 enum nft_registers dreg;
4344
4345 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 4346 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
4347 set->dtype == NFT_DATA_VERDICT ?
4348 NFT_DATA_VERDICT : NFT_DATA_VALUE,
4349 set->dlen);
20a69341
PM		 4350}
4351
4352int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
4353 struct nft_set_binding *binding)
4354{
4355 struct nft_set_binding *i;
4356 struct nft_set_iter iter;
4357
273fe3f1
PNA		 4358 if (set->use == UINT_MAX)
4359 return -EOVERFLOW;
4360
408070d6 4361 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 4362 return -EBUSY;
4363
11113e19 4364 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 4365 /* If the set is already bound to the same chain all
4366 * jumps are already validated for that chain.
4367 */
4368 list_for_each_entry(i, &set->bindings, list) {
a4684402 4369 if (i->flags & NFT_SET_MAP &&
11113e19 4370 i->chain == binding->chain)
20a69341
PM		 4371 goto bind;
4372 }
4373
8588ac09 4374 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 4375 iter.skip = 0;
4376 iter.count = 0;
4377 iter.err = 0;
4378 iter.fn = nf_tables_bind_check_setelem;
4379
4380 set->ops->walk(ctx, set, &iter);
a02f4248 4381 if (iter.err < 0)
20a69341 4382 return iter.err;
20a69341
PM		 4383 }
4384bind:
4385 binding->chain = ctx->chain;
e688a7f8 4386 list_add_tail_rcu(&binding->list, &set->bindings);
f6ac8585 4387 nft_set_trans_bind(ctx, set);
273fe3f1 4388 set->use++;
f6ac8585 4389
20a69341
PM		 4390 return 0;
4391}
63aea290 4392EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341 4393
3b0a081d
FW		 4394static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
4395 struct nft_set_binding *binding, bool event)
20a69341 4396{
e688a7f8 4397 list_del_rcu(&binding->list);
20a69341 4398
f6ac8585 4399 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
cd5125d8 4400 list_del_rcu(&set->list);
f6ac8585
PNA		 4401 if (event)
4402 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
4403 GFP_KERNEL);
4404 }
20a69341
PM		 4405}
4406
273fe3f1
PNA		 4407void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
4408 struct nft_set_binding *binding,
4409 enum nft_trans_phase phase)
4410{
4411 switch (phase) {
4412 case NFT_TRANS_PREPARE:
4413 set->use--;
4414 return;
4415 case NFT_TRANS_ABORT:
4416 case NFT_TRANS_RELEASE:
4417 set->use--;
954d8297 4418 fallthrough;
273fe3f1
PNA		 4419 default:
4420 nf_tables_unbind_set(ctx, set, binding,
4421 phase == NFT_TRANS_COMMIT);
4422 }
4423}
4424EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
4425
cd5125d8
FW		 4426void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
4427{
f6ac8585 4428 if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
0c2a85ed 4429 nft_set_destroy(ctx, set);
cd5125d8
FW		 4430}
4431EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
4432
3ac4c07a
PM		 4433const struct nft_set_ext_type nft_set_ext_types[] = {
4434 [NFT_SET_EXT_KEY] = {
7d740264 4435 .align = __alignof__(u32),
3ac4c07a
PM		 4436 },
4437 [NFT_SET_EXT_DATA] = {
7d740264 4438 .align = __alignof__(u32),
3ac4c07a 4439 },
f25ad2e9
PM		 4440 [NFT_SET_EXT_EXPR] = {
4441 .align = __alignof__(struct nft_expr),
4442 },
8aeff920
PNA		 4443 [NFT_SET_EXT_OBJREF] = {
4444 .len = sizeof(struct nft_object *),
4445 .align = __alignof__(struct nft_object *),
4446 },
3ac4c07a
PM		 4447 [NFT_SET_EXT_FLAGS] = {
4448 .len = sizeof(u8),
4449 .align = __alignof__(u8),
4450 },
c3e1b005
PM		 4451 [NFT_SET_EXT_TIMEOUT] = {
4452 .len = sizeof(u64),
4453 .align = __alignof__(u64),
4454 },
4455 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 4456 .len = sizeof(u64),
4457 .align = __alignof__(u64),
c3e1b005 4458 },
68e942e8
PM		 4459 [NFT_SET_EXT_USERDATA] = {
4460 .len = sizeof(struct nft_userdata),
4461 .align = __alignof__(struct nft_userdata),
4462 },
7b225d0b
PNA		 4463 [NFT_SET_EXT_KEY_END] = {
4464 .align = __alignof__(u32),
4465 },
3ac4c07a 4466};
3ac4c07a 4467
20a69341
PM		 4468/*
4469 * Set elements
4470 */
4471
4472static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
4473 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
4474 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
4475 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 4476 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
79ebb5bb 4477 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 },
68e942e8
PM		 4478 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
4479 .len = NFT_USERDATA_MAXLEN },
467697d2 4480 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
9332d27d
FW		 4481 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING,
4482 .len = NFT_OBJ_MAXNAMELEN - 1 },
7b225d0b 4483 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED },
20a69341
PM		 4484};
4485
4486static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 4487 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
4488 .len = NFT_TABLE_MAXNAMELEN - 1 },
4489 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
4490 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 4491 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 4492 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 4493};
4494
633c9a84 4495static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 4496 const struct sk_buff *skb,
4497 const struct nlmsghdr *nlh,
f2a6d766 4498 const struct nlattr * const nla[],
36dd1bcc 4499 struct netlink_ext_ack *extack,
f2a6d766 4500 u8 genmask)
20a69341
PM		 4501{
4502 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 4503 int family = nfmsg->nfgen_family;
7c95f6d8 4504 struct nft_table *table;
20a69341 4505
cac20fcd
PNA		 4506 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
4507 genmask);
36dd1bcc
PNA		 4508 if (IS_ERR(table)) {
4509 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 4510 return PTR_ERR(table);
36dd1bcc 4511 }
20a69341 4512
98319cb9 4513 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 4514 return 0;
4515}
4516
4517static int nf_tables_fill_setelem(struct sk_buff *skb,
4518 const struct nft_set *set,
4519 const struct nft_set_elem *elem)
4520{
fe2811eb 4521 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 4522 unsigned char *b = skb_tail_pointer(skb);
4523 struct nlattr *nest;
4524
ae0be8de 4525 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
20a69341
PM		 4526 if (nest == NULL)
4527 goto nla_put_failure;
4528
fe2811eb
PM		 4529 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4530 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 4531 goto nla_put_failure;
4532
7b225d0b
PNA		 4533 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) &&
4534 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext),
4535 NFT_DATA_VALUE, set->klen) < 0)
4536 goto nla_put_failure;
4537
fe2811eb
PM		 4538 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4539 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 4540 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4541 set->dlen) < 0)
4542 goto nla_put_failure;
4543
f25ad2e9
PM		 4544 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
4545 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
4546 goto nla_put_failure;
4547
8aeff920
PNA		 4548 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4549 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
d152159b 4550 (*nft_set_ext_obj(ext))->key.name) < 0)
8aeff920
PNA		 4551 goto nla_put_failure;
4552
fe2811eb
PM		 4553 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4554 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4555 htonl(*nft_set_ext_flags(ext))))
4556 goto nla_put_failure;
20a69341 4557
c3e1b005
PM		 4558 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4559 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 4560 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 4561 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 4562 goto nla_put_failure;
4563
4564 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 4565 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 4566
4567 expires = *nft_set_ext_expiration(ext);
8e1102d5 4568 if (time_before64(now, expires))
c3e1b005
PM		 4569 expires -= now;
4570 else
4571 expires = 0;
4572
4573 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 4574 nf_jiffies64_to_msecs(expires),
b46f6ded 4575 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 4576 goto nla_put_failure;
4577 }
4578
68e942e8
PM		 4579 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4580 struct nft_userdata *udata;
4581
4582 udata = nft_set_ext_userdata(ext);
4583 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4584 udata->len + 1, udata->data))
4585 goto nla_put_failure;
4586 }
4587
20a69341
PM		 4588 nla_nest_end(skb, nest);
4589 return 0;
4590
4591nla_put_failure:
4592 nlmsg_trim(skb, b);
4593 return -EMSGSIZE;
4594}
4595
4596struct nft_set_dump_args {
4597 const struct netlink_callback *cb;
4598 struct nft_set_iter iter;
4599 struct sk_buff *skb;
4600};
4601
4602static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 4603 struct nft_set *set,
20a69341 4604 const struct nft_set_iter *iter,
de70185d 4605 struct nft_set_elem *elem)
20a69341
PM		 4606{
4607 struct nft_set_dump_args *args;
4608
4609 args = container_of(iter, struct nft_set_dump_args, iter);
4610 return nf_tables_fill_setelem(args->skb, set, elem);
4611}
4612
fa803605
LZ		 4613struct nft_set_dump_ctx {
4614 const struct nft_set *set;
4615 struct nft_ctx ctx;
4616};
4617
20a69341
PM		 4618static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4619{
fa803605 4620 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 4621 struct net *net = sock_net(skb->sk);
fa803605 4622 struct nft_table *table;
de70185d 4623 struct nft_set *set;
20a69341 4624 struct nft_set_dump_args args;
fa803605 4625 bool set_found = false;
20a69341
PM		 4626 struct nfgenmsg *nfmsg;
4627 struct nlmsghdr *nlh;
4628 struct nlattr *nest;
4629 u32 portid, seq;
fa803605 4630 int event;
20a69341 4631
fa803605 4632 rcu_read_lock();
36596dad
PNA		 4633 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4634 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 4635 dump_ctx->ctx.family != table->family)
fa803605 4636 continue;
20a69341 4637
36596dad
PNA		 4638 if (table != dump_ctx->ctx.table)
4639 continue;
20a69341 4640
36596dad
PNA		 4641 list_for_each_entry_rcu(set, &table->sets, list) {
4642 if (set == dump_ctx->set) {
4643 set_found = true;
4644 break;
fa803605 4645 }
fa803605
LZ		 4646 }
4647 break;
4648 }
4649
4650 if (!set_found) {
4651 rcu_read_unlock();
4652 return -ENOENT;
4653 }
20a69341 4654
dedb67c4 4655 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 4656 portid = NETLINK_CB(cb->skb).portid;
4657 seq = cb->nlh->nlmsg_seq;
4658
4659 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4660 NLM_F_MULTI);
4661 if (nlh == NULL)
4662 goto nla_put_failure;
4663
4664 nfmsg = nlmsg_data(nlh);
98319cb9 4665 nfmsg->nfgen_family = table->family;
20a69341 4666 nfmsg->version = NFNETLINK_V0;
fa803605 4667 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 4668
fa803605 4669 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 4670 goto nla_put_failure;
4671 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4672 goto nla_put_failure;
4673
ae0be8de 4674 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
20a69341
PM		 4675 if (nest == NULL)
4676 goto nla_put_failure;
4677
8588ac09
PNA		 4678 args.cb = cb;
4679 args.skb = skb;
fa803605 4680 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 4681 args.iter.skip = cb->args[0];
4682 args.iter.count = 0;
4683 args.iter.err = 0;
4684 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 4685 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4686 rcu_read_unlock();
20a69341
PM		 4687
4688 nla_nest_end(skb, nest);
4689 nlmsg_end(skb, nlh);
4690
4691 if (args.iter.err && args.iter.err != -EMSGSIZE)
4692 return args.iter.err;
4693 if (args.iter.count == cb->args[0])
4694 return 0;
4695
4696 cb->args[0] = args.iter.count;
4697 return skb->len;
4698
4699nla_put_failure:
fa803605 4700 rcu_read_unlock();
20a69341
PM		 4701 return -ENOSPC;
4702}
4703
90fd131a
FW		 4704static int nf_tables_dump_set_start(struct netlink_callback *cb)
4705{
4706 struct nft_set_dump_ctx *dump_ctx = cb->data;
4707
4708 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4709
4710 return cb->data ? 0 : -ENOMEM;
4711}
4712
fa803605
LZ		 4713static int nf_tables_dump_set_done(struct netlink_callback *cb)
4714{
4715 kfree(cb->data);
4716 return 0;
4717}
4718
d60ce62f
AB		 4719static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4720 const struct nft_ctx *ctx, u32 seq,
4721 u32 portid, int event, u16 flags,
4722 const struct nft_set *set,
4723 const struct nft_set_elem *elem)
4724{
4725 struct nfgenmsg *nfmsg;
4726 struct nlmsghdr *nlh;
4727 struct nlattr *nest;
4728 int err;
4729
dedb67c4 4730 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 4731 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4732 flags);
4733 if (nlh == NULL)
4734 goto nla_put_failure;
4735
4736 nfmsg = nlmsg_data(nlh);
36596dad 4737 nfmsg->nfgen_family = ctx->family;
d60ce62f 4738 nfmsg->version = NFNETLINK_V0;
84d7fce6 4739 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 4740
4741 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4742 goto nla_put_failure;
4743 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4744 goto nla_put_failure;
4745
ae0be8de 4746 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
d60ce62f
AB		 4747 if (nest == NULL)
4748 goto nla_put_failure;
4749
4750 err = nf_tables_fill_setelem(skb, set, elem);
4751 if (err < 0)
4752 goto nla_put_failure;
4753
4754 nla_nest_end(skb, nest);
4755
053c095a
JB		 4756 nlmsg_end(skb, nlh);
4757 return 0;
d60ce62f
AB		 4758
4759nla_put_failure:
4760 nlmsg_trim(skb, nlh);
4761 return -1;
4762}
4763
ba0e4d99
PNA		 4764static int nft_setelem_parse_flags(const struct nft_set *set,
4765 const struct nlattr *attr, u32 *flags)
4766{
4767 if (attr == NULL)
4768 return 0;
4769
4770 *flags = ntohl(nla_get_be32(attr));
4771 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4772 return -EINVAL;
4773 if (!(set->flags & NFT_SET_INTERVAL) &&
4774 *flags & NFT_SET_ELEM_INTERVAL_END)
4775 return -EINVAL;
4776
4777 return 0;
4778}
4779
20a1452c
PNA		 4780static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
4781 struct nft_data *key, struct nlattr *attr)
4782{
4783 struct nft_data_desc desc;
4784 int err;
4785
4786 err = nft_data_init(ctx, key, NFT_DATA_VALUE_MAXLEN, &desc, attr);
4787 if (err < 0)
4788 return err;
4789
4790 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
4791 nft_data_release(key, desc.type);
4792 return -EINVAL;
4793 }
4794
4795 return 0;
4796}
4797
fdb9c405
PNA		 4798static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
4799 struct nft_data_desc *desc,
4800 struct nft_data *data,
4801 struct nlattr *attr)
4802{
4803 int err;
4804
4805 err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
4806 if (err < 0)
4807 return err;
4808
4809 if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) {
4810 nft_data_release(data, desc->type);
4811 return -EINVAL;
4812 }
4813
4814 return 0;
4815}
4816
ba0e4d99
PNA		 4817static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4818 const struct nlattr *attr)
4819{
4820 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
ba0e4d99
PNA		 4821 struct nft_set_elem elem;
4822 struct sk_buff *skb;
4823 uint32_t flags = 0;
4824 void *priv;
4825 int err;
4826
8cb08174
JB		 4827 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4828 nft_set_elem_policy, NULL);
ba0e4d99
PNA		 4829 if (err < 0)
4830 return err;
4831
4832 if (!nla[NFTA_SET_ELEM_KEY])
4833 return -EINVAL;
4834
4835 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4836 if (err < 0)
4837 return err;
4838
20a1452c
PNA		 4839 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
4840 nla[NFTA_SET_ELEM_KEY]);
ba0e4d99
PNA		 4841 if (err < 0)
4842 return err;
4843
7b225d0b
PNA		 4844 if (nla[NFTA_SET_ELEM_KEY_END]) {
4845 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
4846 nla[NFTA_SET_ELEM_KEY_END]);
4847 if (err < 0)
4848 return err;
4849 }
4850
ba0e4d99
PNA		 4851 priv = set->ops->get(ctx->net, set, &elem, flags);
4852 if (IS_ERR(priv))
4853 return PTR_ERR(priv);
4854
4855 elem.priv = priv;
ba0e4d99
PNA		 4856
4857 err = -ENOMEM;
d9adf22a 4858 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
ba0e4d99
PNA		 4859 if (skb == NULL)
4860 goto err1;
4861
4862 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4863 NFT_MSG_NEWSETELEM, 0, set, &elem);
4864 if (err < 0)
4865 goto err2;
4866
4867 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4868 /* This avoids a loop in nfnetlink. */
4869 if (err < 0)
4870 goto err1;
4871
4872 return 0;
4873err2:
4874 kfree_skb(skb);
4875err1:
4876 /* this avoids a loop in nfnetlink. */
4877 return err == -EAGAIN ? -ENOBUFS : err;
4878}
4879
d9adf22a 4880/* called with rcu_read_lock held */
ba0e4d99
PNA		 4881static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4882 struct sk_buff *skb, const struct nlmsghdr *nlh,
4883 const struct nlattr * const nla[],
4884 struct netlink_ext_ack *extack)
4885{
4886 u8 genmask = nft_genmask_cur(net);
4887 struct nft_set *set;
4888 struct nlattr *attr;
4889 struct nft_ctx ctx;
4890 int rem, err = 0;
4891
36dd1bcc
PNA		 4892 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4893 genmask);
ba0e4d99
PNA		 4894 if (err < 0)
4895 return err;
4896
cac20fcd 4897 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 4898 if (IS_ERR(set))
4899 return PTR_ERR(set);
4900
4901 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4902 struct netlink_dump_control c = {
90fd131a 4903 .start = nf_tables_dump_set_start,
ba0e4d99
PNA		 4904 .dump = nf_tables_dump_set,
4905 .done = nf_tables_dump_set_done,
d9adf22a 4906 .module = THIS_MODULE,
ba0e4d99 4907 };
90fd131a
FW		 4908 struct nft_set_dump_ctx dump_ctx = {
4909 .set = set,
4910 .ctx = ctx,
4911 };
ba0e4d99 4912
90fd131a 4913 c.data = &dump_ctx;
d9adf22a 4914 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
ba0e4d99
PNA		 4915 }
4916
4917 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4918 return -EINVAL;
4919
4920 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4921 err = nft_get_set_elem(&ctx, set, attr);
4922 if (err < 0)
4923 break;
4924 }
4925
4926 return err;
4927}
4928
25e94a99
PNA		 4929static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4930 const struct nft_set *set,
4931 const struct nft_set_elem *elem,
4932 int event, u16 flags)
d60ce62f 4933{
128ad332
PNA		 4934 struct net *net = ctx->net;
4935 u32 portid = ctx->portid;
d60ce62f
AB		 4936 struct sk_buff *skb;
4937 int err;
8e6cf365
RGB		 4938 char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
4939 ctx->table->name, ctx->table->handle,
4940 set->name, set->handle);
4941
4942 audit_log_nfcfg(buf,
4943 ctx->family,
4944 set->handle,
4945 event == NFT_MSG_NEWSETELEM ?
4946 AUDIT_NFT_OP_SETELEM_REGISTER :
14224039
RGB		 4947 AUDIT_NFT_OP_SETELEM_UNREGISTER,
4948 GFP_KERNEL);
8e6cf365 4949 kfree(buf);
d60ce62f 4950
128ad332 4951 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4952 return;
d60ce62f 4953
d60ce62f
AB		 4954 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4955 if (skb == NULL)
4956 goto err;
4957
4958 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4959 set, elem);
4960 if (err < 0) {
4961 kfree_skb(skb);
4962 goto err;
4963 }
4964
25e94a99
PNA		 4965 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4966 GFP_KERNEL);
4967 return;
d60ce62f 4968err:
25e94a99 4969 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 4970}
4971
60319eb1
PNA		 4972static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4973 int msg_type,
4974 struct nft_set *set)
4975{
4976 struct nft_trans *trans;
4977
4978 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4979 if (trans == NULL)
4980 return NULL;
4981
4982 nft_trans_elem_set(trans) = set;
4983 return trans;
4984}
4985
a7fc9368
PNA		 4986struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
4987 const struct nft_set *set,
4988 const struct nlattr *attr)
4989{
4990 struct nft_expr *expr;
4991 int err;
4992
4993 expr = nft_expr_init(ctx, attr);
4994 if (IS_ERR(expr))
4995 return expr;
4996
4997 err = -EOPNOTSUPP;
4998 if (!(expr->ops->type->flags & NFT_EXPR_STATEFUL))
4999 goto err_set_elem_expr;
5000
5001 if (expr->ops->type->flags & NFT_EXPR_GC) {
5002 if (set->flags & NFT_SET_TIMEOUT)
5003 goto err_set_elem_expr;
5004 if (!set->ops->gc_init)
5005 goto err_set_elem_expr;
5006 set->ops->gc_init(set);
5007 }
5008
5009 return expr;
5010
5011err_set_elem_expr:
5012 nft_expr_destroy(ctx, expr);
5013 return ERR_PTR(err);
5014}
5015
22fe54d5
PM		 5016void *nft_set_elem_init(const struct nft_set *set,
5017 const struct nft_set_ext_tmpl *tmpl,
7b225d0b
PNA		 5018 const u32 *key, const u32 *key_end,
5019 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp)
fe2811eb
PM		 5020{
5021 struct nft_set_ext *ext;
5022 void *elem;
5023
5024 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
5025 if (elem == NULL)
5026 return NULL;
5027
5028 ext = nft_set_elem_ext(set, elem);
5029 nft_set_ext_init(ext, tmpl);
5030
5031 memcpy(nft_set_ext_key(ext), key, set->klen);
7b225d0b
PNA		 5032 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
5033 memcpy(nft_set_ext_key_end(ext), key_end, set->klen);
fe2811eb
PM		 5034 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5035 memcpy(nft_set_ext_data(ext), data, set->dlen);
79ebb5bb
LGL		 5036 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
5037 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
5038 if (expiration == 0)
5039 *nft_set_ext_expiration(ext) += timeout;
5040 }
c3e1b005
PM		 5041 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
5042 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 5043
5044 return elem;
5045}
5046
475beb9c
PNA		 5047static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
5048 struct nft_expr *expr)
5049{
5050 if (expr->ops->destroy_clone) {
5051 expr->ops->destroy_clone(ctx, expr);
5052 module_put(expr->ops->type->owner);
5053 } else {
5054 nf_tables_expr_destroy(ctx, expr);
5055 }
5056}
5057
61f9e292
LZ		 5058void nft_set_elem_destroy(const struct nft_set *set, void *elem,
5059 bool destroy_expr)
61edafbb
PM		 5060{
5061 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3453c927
PNA		 5062 struct nft_ctx ctx = {
5063 .net = read_pnet(&set->net),
5064 .family = set->table->family,
5065 };
61edafbb 5066
59105446 5067 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 5068 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 5069 nft_data_release(nft_set_ext_data(ext), set->dtype);
475beb9c
PNA		 5070 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
5071 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext));
371ebcbb 5072
8aeff920
PNA		 5073 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5074 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 5075 kfree(elem);
5076}
5077EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
5078
59105446
PNA		 5079/* Only called from commit path, nft_set_elem_deactivate() already deals with
5080 * the refcounting from the preparation phase.
5081 */
3453c927
PNA		 5082static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
5083 const struct nft_set *set, void *elem)
59105446
PNA		 5084{
5085 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5086
5087 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
475beb9c
PNA		 5088 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));
5089
59105446
PNA		 5090 kfree(elem);
5091}
5092
60319eb1 5093static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 5094 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 5095{
5096 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 5097 u8 genmask = nft_genmask_next(ctx->net);
fe2811eb 5098 struct nft_set_ext_tmpl tmpl;
c016c7e4 5099 struct nft_set_ext *ext, *ext2;
20a69341
PM		 5100 struct nft_set_elem elem;
5101 struct nft_set_binding *binding;
8aeff920 5102 struct nft_object *obj = NULL;
40944452 5103 struct nft_expr *expr = NULL;
68e942e8 5104 struct nft_userdata *udata;
20a1452c 5105 struct nft_data_desc desc;
20a69341 5106 enum nft_registers dreg;
60319eb1 5107 struct nft_trans *trans;
0e9091d6 5108 u32 flags = 0;
c3e1b005 5109 u64 timeout;
79ebb5bb 5110 u64 expiration;
68e942e8 5111 u8 ulen;
20a69341
PM		 5112 int err;
5113
8cb08174
JB		 5114 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5115 nft_set_elem_policy, NULL);
20a69341
PM		 5116 if (err < 0)
5117 return err;
5118
5119 if (nla[NFTA_SET_ELEM_KEY] == NULL)
5120 return -EINVAL;
5121
fe2811eb
PM		 5122 nft_set_ext_prepare(&tmpl);
5123
0e9091d6
PNA		 5124 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5125 if (err < 0)
5126 return err;
5127 if (flags != 0)
5128 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 5129
5130 if (set->flags & NFT_SET_MAP) {
5131 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 5132 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341
PM		 5133 return -EINVAL;
5134 } else {
5135 if (nla[NFTA_SET_ELEM_DATA] != NULL)
5136 return -EINVAL;
5137 }
5138
bffc124b
PNA		 5139 if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
5140 (nla[NFTA_SET_ELEM_DATA] ||
5141 nla[NFTA_SET_ELEM_OBJREF] ||
5142 nla[NFTA_SET_ELEM_TIMEOUT] ||
5143 nla[NFTA_SET_ELEM_EXPIRATION] ||
5144 nla[NFTA_SET_ELEM_USERDATA] ||
5145 nla[NFTA_SET_ELEM_EXPR]))
5146 return -EINVAL;
5147
c3e1b005
PM		 5148 timeout = 0;
5149 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
5150 if (!(set->flags & NFT_SET_TIMEOUT))
5151 return -EINVAL;
8e1102d5
FW		 5152 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
5153 &timeout);
5154 if (err)
5155 return err;
c3e1b005
PM		 5156 } else if (set->flags & NFT_SET_TIMEOUT) {
5157 timeout = set->timeout;
5158 }
5159
79ebb5bb
LGL		 5160 expiration = 0;
5161 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
5162 if (!(set->flags & NFT_SET_TIMEOUT))
5163 return -EINVAL;
5164 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
5165 &expiration);
5166 if (err)
5167 return err;
5168 }
5169
40944452
PNA		 5170 if (nla[NFTA_SET_ELEM_EXPR] != NULL) {
5171 expr = nft_set_elem_expr_alloc(ctx, set,
5172 nla[NFTA_SET_ELEM_EXPR]);
5173 if (IS_ERR(expr))
5174 return PTR_ERR(expr);
65038428
PNA		 5175
5176 err = -EOPNOTSUPP;
5177 if (set->expr && set->expr->ops != expr->ops)
5178 goto err_set_elem_expr;
5179 } else if (set->expr) {
5180 expr = kzalloc(set->expr->ops->size, GFP_KERNEL);
5181 if (!expr)
5182 return -ENOMEM;
5183
5184 err = nft_expr_clone(expr, set->expr);
5185 if (err < 0)
5186 goto err_set_elem_expr;
40944452
PNA		 5187 }
5188
20a1452c
PNA		 5189 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5190 nla[NFTA_SET_ELEM_KEY]);
20a69341 5191 if (err < 0)
40944452 5192 goto err_set_elem_expr;
20a69341 5193
20a1452c 5194 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
7b225d0b
PNA		 5195
5196 if (nla[NFTA_SET_ELEM_KEY_END]) {
5197 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5198 nla[NFTA_SET_ELEM_KEY_END]);
5199 if (err < 0)
5200 goto err_parse_key;
5201
5202 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5203 }
5204
c3e1b005
PM		 5205 if (timeout > 0) {
5206 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
5207 if (timeout != set->timeout)
5208 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
5209 }
fe2811eb 5210
40944452
PNA		 5211 if (expr)
5212 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPR,
5213 expr->ops->size);
5214
8aeff920
PNA		 5215 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
5216 if (!(set->flags & NFT_SET_OBJECT)) {
5217 err = -EINVAL;
7b225d0b 5218 goto err_parse_key_end;
8aeff920 5219 }
4d44175a
FW		 5220 obj = nft_obj_lookup(ctx->net, ctx->table,
5221 nla[NFTA_SET_ELEM_OBJREF],
cac20fcd 5222 set->objtype, genmask);
8aeff920
PNA		 5223 if (IS_ERR(obj)) {
5224 err = PTR_ERR(obj);
7b225d0b 5225 goto err_parse_key_end;
8aeff920
PNA		 5226 }
5227 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
5228 }
5229
20a69341 5230 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
fdb9c405
PNA		 5231 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
5232 nla[NFTA_SET_ELEM_DATA]);
20a69341 5233 if (err < 0)
7b225d0b 5234 goto err_parse_key_end;
20a69341 5235
20a69341
PM		 5236 dreg = nft_type_to_reg(set->dtype);
5237 list_for_each_entry(binding, &set->bindings, list) {
5238 struct nft_ctx bind_ctx = {
58c78e10 5239 .net = ctx->net,
36596dad 5240 .family = ctx->family,
20a69341 5241 .table = ctx->table,
7c95f6d8 5242 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 5243 };
5244
11113e19
PM		 5245 if (!(binding->flags & NFT_SET_MAP))
5246 continue;
5247
1ec10212 5248 err = nft_validate_register_store(&bind_ctx, dreg,
fdb9c405 5249 &elem.data.val,
20a1452c 5250 desc.type, desc.len);
20a69341 5251 if (err < 0)
7b225d0b 5252 goto err_parse_data;
a654de8f 5253
20a1452c 5254 if (desc.type == NFT_DATA_VERDICT &&
fdb9c405
PNA		 5255 (elem.data.val.verdict.code == NFT_GOTO ||
5256 elem.data.val.verdict.code == NFT_JUMP))
a654de8f
PNA		 5257 nft_validate_state_update(ctx->net,
5258 NFT_VALIDATE_NEED);
20a69341 5259 }
fe2811eb 5260
20a1452c 5261 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len);
20a69341
PM		 5262 }
5263
68e942e8
PM		 5264 /* The full maximum length of userdata can exceed the maximum
5265 * offset value (U8_MAX) for following extensions, therefor it
5266 * must be the last extension added.
5267 */
5268 ulen = 0;
5269 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
5270 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
5271 if (ulen > 0)
5272 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
5273 ulen);
5274 }
5275
fe2811eb 5276 err = -ENOMEM;
7b225d0b 5277 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
fdb9c405 5278 elem.key_end.val.data, elem.data.val.data,
79ebb5bb 5279 timeout, expiration, GFP_KERNEL);
fe2811eb 5280 if (elem.priv == NULL)
7b225d0b 5281 goto err_parse_data;
fe2811eb
PM		 5282
5283 ext = nft_set_elem_ext(set, elem.priv);
5284 if (flags)
5285 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 5286 if (ulen > 0) {
5287 udata = nft_set_ext_userdata(ext);
5288 udata->len = ulen - 1;
5289 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
5290 }
8aeff920
PNA		 5291 if (obj) {
5292 *nft_set_ext_obj(ext) = obj;
5293 obj->use++;
5294 }
40944452
PNA		 5295 if (expr) {
5296 memcpy(nft_set_ext_expr(ext), expr, expr->ops->size);
5297 kfree(expr);
772f4e82 5298 expr = NULL;
40944452 5299 }
fe2811eb 5300
60319eb1
PNA		 5301 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
5302 if (trans == NULL)
7b225d0b 5303 goto err_trans;
60319eb1 5304
69086658 5305 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 5306 err = set->ops->insert(ctx->net, set, &elem, &ext2);
5307 if (err) {
5308 if (err == -EEXIST) {
9744a6fc
PNA		 5309 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
5310 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
5311 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
77a92189 5312 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
7b225d0b 5313 goto err_element_clash;
8aeff920
PNA		 5314 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
5315 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
5316 memcmp(nft_set_ext_data(ext),
5317 nft_set_ext_data(ext2), set->dlen) != 0) ||
5318 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
5319 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
5320 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
77a92189 5321 goto err_element_clash;
c016c7e4
PNA		 5322 else if (!(nlmsg_flags & NLM_F_EXCL))
5323 err = 0;
8c2d45b2
PNA		 5324 } else if (err == -ENOTEMPTY) {
5325 /* ENOTEMPTY reports overlapping between this element
5326 * and an existing one.
5327 */
5328 err = -EEXIST;
c016c7e4 5329 }
7b225d0b 5330 goto err_element_clash;
c016c7e4 5331 }
20a69341 5332
35d0ac90
PNA		 5333 if (set->size &&
5334 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
5335 err = -ENFILE;
7b225d0b 5336 goto err_set_full;
35d0ac90
PNA		 5337 }
5338
60319eb1 5339 nft_trans_elem(trans) = elem;
46bbafce 5340 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 5341 return 0;
5342
7b225d0b 5343err_set_full:
5cb82a38 5344 set->ops->remove(ctx->net, set, &elem);
7b225d0b 5345err_element_clash:
60319eb1 5346 kfree(trans);
7b225d0b 5347err_trans:
b91d9036
TY		 5348 if (obj)
5349 obj->use--;
475beb9c
PNA		 5350
5351 nf_tables_set_elem_destroy(ctx, set, elem.priv);
7b225d0b 5352err_parse_data:
20a69341 5353 if (nla[NFTA_SET_ELEM_DATA] != NULL)
fdb9c405 5354 nft_data_release(&elem.data.val, desc.type);
7b225d0b
PNA		 5355err_parse_key_end:
5356 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
5357err_parse_key:
20a1452c 5358 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
40944452
PNA		 5359err_set_elem_expr:
5360 if (expr != NULL)
5361 nft_expr_destroy(ctx, expr);
7b225d0b 5362
20a69341
PM		 5363 return err;
5364}
5365
633c9a84
PNA		 5366static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
5367 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5368 const struct nlattr * const nla[],
5369 struct netlink_ext_ack *extack)
20a69341 5370{
f2a6d766 5371 u8 genmask = nft_genmask_next(net);
20a69341
PM		 5372 const struct nlattr *attr;
5373 struct nft_set *set;
5374 struct nft_ctx ctx;
a654de8f 5375 int rem, err;
20a69341 5376
7d5570ca
PNA		 5377 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
5378 return -EINVAL;
5379
36dd1bcc
PNA		 5380 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5381 genmask);
20a69341
PM		 5382 if (err < 0)
5383 return err;
5384
a3073c17
PNA		 5385 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
5386 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
5387 if (IS_ERR(set))
5388 return PTR_ERR(set);
958bee14 5389
20a69341
PM		 5390 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5391 return -EBUSY;
5392
5393 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 5394 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 5395 if (err < 0)
a654de8f 5396 return err;
20a69341 5397 }
a654de8f
PNA		 5398
5399 if (net->nft.validate_state == NFT_VALIDATE_DO)
5400 return nft_table_validate(net, ctx.table);
5401
5402 return 0;
20a69341
PM		 5403}
5404
59105446
PNA		 5405/**
5406 * nft_data_hold - hold a nft_data item
5407 *
5408 * @data: struct nft_data to release
5409 * @type: type of data
5410 *
5411 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5412 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
5413 * NFT_GOTO verdicts. This function must be called on active data objects
5414 * from the second phase of the commit protocol.
5415 */
bb7b40ae 5416void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
59105446 5417{
d0e2c7de
PNA		 5418 struct nft_chain *chain;
5419 struct nft_rule *rule;
5420
59105446
PNA		 5421 if (type == NFT_DATA_VERDICT) {
5422 switch (data->verdict.code) {
5423 case NFT_JUMP:
5424 case NFT_GOTO:
d0e2c7de
PNA		 5425 chain = data->verdict.chain;
5426 chain->use++;
5427
5428 if (!nft_chain_is_bound(chain))
5429 break;
5430
5431 chain->table->use++;
5432 list_for_each_entry(rule, &chain->rules, list)
5433 chain->use++;
5434
5435 nft_chain_add(chain->table, chain);
59105446
PNA		 5436 break;
5437 }
5438 }
5439}
5440
5441static void nft_set_elem_activate(const struct net *net,
5442 const struct nft_set *set,
5443 struct nft_set_elem *elem)
5444{
5445 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5446
5447 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5448 nft_data_hold(nft_set_ext_data(ext), set->dtype);
5449 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5450 (*nft_set_ext_obj(ext))->use++;
5451}
5452
5453static void nft_set_elem_deactivate(const struct net *net,
5454 const struct nft_set *set,
5455 struct nft_set_elem *elem)
5456{
5457 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5458
5459 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5460 nft_data_release(nft_set_ext_data(ext), set->dtype);
5461 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5462 (*nft_set_ext_obj(ext))->use--;
5463}
5464
60319eb1 5465static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 5466 const struct nlattr *attr)
5467{
5468 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 5469 struct nft_set_ext_tmpl tmpl;
20a69341 5470 struct nft_set_elem elem;
3971ca14 5471 struct nft_set_ext *ext;
60319eb1 5472 struct nft_trans *trans;
3971ca14
PNA		 5473 u32 flags = 0;
5474 void *priv;
20a69341
PM		 5475 int err;
5476
8cb08174
JB		 5477 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5478 nft_set_elem_policy, NULL);
20a69341 5479 if (err < 0)
20a1452c 5480 return err;
20a69341 5481
20a69341 5482 if (nla[NFTA_SET_ELEM_KEY] == NULL)
20a1452c 5483 return -EINVAL;
20a69341 5484
3971ca14
PNA		 5485 nft_set_ext_prepare(&tmpl);
5486
5487 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5488 if (err < 0)
5489 return err;
5490 if (flags != 0)
5491 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5492
20a1452c
PNA		 5493 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5494 nla[NFTA_SET_ELEM_KEY]);
20a69341 5495 if (err < 0)
20a1452c 5496 return err;
20a69341 5497
20a1452c 5498 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
3971ca14 5499
7b225d0b
PNA		 5500 if (nla[NFTA_SET_ELEM_KEY_END]) {
5501 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5502 nla[NFTA_SET_ELEM_KEY_END]);
5503 if (err < 0)
5504 return err;
5505
5506 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5507 }
5508
3971ca14 5509 err = -ENOMEM;
7b225d0b
PNA		 5510 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5511 elem.key_end.val.data, NULL, 0, 0,
5512 GFP_KERNEL);
3971ca14 5513 if (elem.priv == NULL)
20a1452c 5514 goto fail_elem;
3971ca14
PNA		 5515
5516 ext = nft_set_elem_ext(set, elem.priv);
5517 if (flags)
5518 *nft_set_ext_flags(ext) = flags;
5519
60319eb1 5520 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
20a1452c
PNA		 5521 if (trans == NULL)
5522 goto fail_trans;
20a69341 5523
42a55769 5524 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 5525 if (priv == NULL) {
cc02e457 5526 err = -ENOENT;
20a1452c 5527 goto fail_ops;
cc02e457 5528 }
3971ca14
PNA		 5529 kfree(elem.priv);
5530 elem.priv = priv;
cc02e457 5531
59105446
PNA		 5532 nft_set_elem_deactivate(ctx->net, set, &elem);
5533
60319eb1 5534 nft_trans_elem(trans) = elem;
46bbafce 5535 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 5536 return 0;
cc02e457 5537
20a1452c 5538fail_ops:
cc02e457 5539 kfree(trans);
20a1452c 5540fail_trans:
3971ca14 5541 kfree(elem.priv);
20a1452c
PNA		 5542fail_elem:
5543 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
20a69341
PM		 5544 return err;
5545}
5546
8411b644 5547static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 5548 struct nft_set *set,
8411b644 5549 const struct nft_set_iter *iter,
de70185d 5550 struct nft_set_elem *elem)
8411b644
PNA		 5551{
5552 struct nft_trans *trans;
5553 int err;
5554
5555 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
5556 sizeof(struct nft_trans_elem), GFP_ATOMIC);
5557 if (!trans)
5558 return -ENOMEM;
5559
1ba1c414 5560 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 5561 err = -ENOENT;
5562 goto err1;
5563 }
b2c11e4b 5564 set->ndeact++;
8411b644 5565
7acfda53 5566 nft_set_elem_deactivate(ctx->net, set, elem);
de70185d
PNA		 5567 nft_trans_elem_set(trans) = set;
5568 nft_trans_elem(trans) = *elem;
8411b644
PNA		 5569 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5570
5571 return 0;
5572err1:
5573 kfree(trans);
5574 return err;
5575}
5576
633c9a84
PNA		 5577static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
5578 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5579 const struct nlattr * const nla[],
5580 struct netlink_ext_ack *extack)
20a69341 5581{
f2a6d766 5582 u8 genmask = nft_genmask_next(net);
20a69341
PM		 5583 const struct nlattr *attr;
5584 struct nft_set *set;
5585 struct nft_ctx ctx;
60319eb1 5586 int rem, err = 0;
20a69341 5587
36dd1bcc
PNA		 5588 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5589 genmask);
20a69341
PM		 5590 if (err < 0)
5591 return err;
5592
cac20fcd 5593 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 5594 if (IS_ERR(set))
5595 return PTR_ERR(set);
5596 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5597 return -EBUSY;
5598
8411b644 5599 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 5600 struct nft_set_iter iter = {
5601 .genmask = genmask,
5602 .fn = nft_flush_set,
8411b644 5603 };
baa2d42c 5604 set->ops->walk(&ctx, set, &iter);
8411b644 5605
baa2d42c 5606 return iter.err;
8411b644
PNA		 5607 }
5608
20a69341
PM		 5609 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5610 err = nft_del_setelem(&ctx, set, attr);
5611 if (err < 0)
60319eb1 5612 break;
4fefee57 5613
3dd0673a 5614 set->ndeact++;
20a69341 5615 }
60319eb1 5616 return err;
20a69341
PM		 5617}
5618
cfed7e1b
PM		 5619void nft_set_gc_batch_release(struct rcu_head *rcu)
5620{
5621 struct nft_set_gc_batch *gcb;
5622 unsigned int i;
5623
5624 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
5625 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 5626 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 5627 kfree(gcb);
5628}
cfed7e1b
PM		 5629
5630struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
5631 gfp_t gfp)
5632{
5633 struct nft_set_gc_batch *gcb;
5634
5635 gcb = kzalloc(sizeof(*gcb), gfp);
5636 if (gcb == NULL)
5637 return gcb;
5638 gcb->head.set = set;
5639 return gcb;
5640}
cfed7e1b 5641
e5009240
PNA		 5642/*
5643 * Stateful objects
5644 */
5645
5646/**
5647 * nft_register_obj- register nf_tables stateful object type
3db86c39 5648 * @obj_type: object type
e5009240
PNA		 5649 *
5650 * Registers the object type for use with nf_tables. Returns zero on
5651 * success or a negative errno code otherwise.
5652 */
5653int nft_register_obj(struct nft_object_type *obj_type)
5654{
5655 if (obj_type->type == NFT_OBJECT_UNSPEC)
5656 return -EINVAL;
5657
5658 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5659 list_add_rcu(&obj_type->list, &nf_tables_objects);
5660 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5661 return 0;
5662}
5663EXPORT_SYMBOL_GPL(nft_register_obj);
5664
5665/**
5666 * nft_unregister_obj - unregister nf_tables object type
3db86c39 5667 * @obj_type: object type
e5009240
PNA		 5668 *
5669 * Unregisters the object type for use with nf_tables.
5670 */
5671void nft_unregister_obj(struct nft_object_type *obj_type)
5672{
5673 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5674 list_del_rcu(&obj_type->list);
5675 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5676}
5677EXPORT_SYMBOL_GPL(nft_unregister_obj);
5678
4d44175a
FW		 5679struct nft_object *nft_obj_lookup(const struct net *net,
5680 const struct nft_table *table,
cac20fcd
PNA		 5681 const struct nlattr *nla, u32 objtype,
5682 u8 genmask)
e5009240 5683{
4d44175a
FW		 5684 struct nft_object_hash_key k = { .table = table };
5685 char search[NFT_OBJ_MAXNAMELEN];
5686 struct rhlist_head *tmp, *list;
e5009240
PNA		 5687 struct nft_object *obj;
5688
4d44175a
FW		 5689 nla_strlcpy(search, nla, sizeof(search));
5690 k.name = search;
5691
5692 WARN_ON_ONCE(!rcu_read_lock_held() &&
5693 !lockdep_commit_lock_is_held(net));
5694
5695 rcu_read_lock();
5696 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
5697 if (!list)
5698 goto out;
5699
5700 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
5701 if (objtype == obj->ops->type->type &&
5702 nft_active_genmask(obj, genmask)) {
5703 rcu_read_unlock();
e5009240 5704 return obj;
4d44175a 5705 }
e5009240 5706 }
4d44175a
FW		 5707out:
5708 rcu_read_unlock();
e5009240
PNA		 5709 return ERR_PTR(-ENOENT);
5710}
cac20fcd 5711EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 5712
cac20fcd
PNA		 5713static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
5714 const struct nlattr *nla,
5715 u32 objtype, u8 genmask)
3ecbfd65
HS		 5716{
5717 struct nft_object *obj;
5718
5719 list_for_each_entry(obj, &table->objects, list) {
5720 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
5721 objtype == obj->ops->type->type &&
5722 nft_active_genmask(obj, genmask))
5723 return obj;
5724 }
5725 return ERR_PTR(-ENOENT);
5726}
5727
e5009240 5728static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 5729 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
5730 .len = NFT_TABLE_MAXNAMELEN - 1 },
5731 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
5732 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 5733 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
5734 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 5735 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 5736};
5737
84fba055
FW		 5738static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
5739 const struct nft_object_type *type,
e5009240
PNA		 5740 const struct nlattr *attr)
5741{
5b4c6e38 5742 struct nlattr **tb;
dfc46034 5743 const struct nft_object_ops *ops;
e5009240 5744 struct nft_object *obj;
5b4c6e38
GS		 5745 int err = -ENOMEM;
5746
5747 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
5748 if (!tb)
5749 goto err1;
e5009240
PNA		 5750
5751 if (attr) {
8cb08174
JB		 5752 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
5753 type->policy, NULL);
e5009240 5754 if (err < 0)
5b4c6e38 5755 goto err2;
e5009240
PNA		 5756 } else {
5757 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
5758 }
5759
dfc46034
PBG		 5760 if (type->select_ops) {
5761 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
5762 if (IS_ERR(ops)) {
5763 err = PTR_ERR(ops);
5b4c6e38 5764 goto err2;
dfc46034
PBG		 5765 }
5766 } else {
5767 ops = type->ops;
5768 }
5769
e5009240 5770 err = -ENOMEM;
dfc46034 5771 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 5772 if (!obj)
5773 goto err2;
e5009240 5774
dfc46034 5775 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 5776 if (err < 0)
5b4c6e38 5777 goto err3;
e5009240 5778
dfc46034
PBG		 5779 obj->ops = ops;
5780
5b4c6e38 5781 kfree(tb);
e5009240 5782 return obj;
5b4c6e38 5783err3:
e5009240 5784 kfree(obj);
5b4c6e38
GS		 5785err2:
5786 kfree(tb);
e5009240
PNA		 5787err1:
5788 return ERR_PTR(err);
5789}
5790
5791static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 5792 struct nft_object *obj, bool reset)
e5009240
PNA		 5793{
5794 struct nlattr *nest;
5795
ae0be8de 5796 nest = nla_nest_start_noflag(skb, attr);
e5009240
PNA		 5797 if (!nest)
5798 goto nla_put_failure;
dfc46034 5799 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 5800 goto nla_put_failure;
5801 nla_nest_end(skb, nest);
5802 return 0;
5803
5804nla_put_failure:
5805 return -1;
5806}
5807
5808static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5809{
5810 const struct nft_object_type *type;
5811
5812 list_for_each_entry(type, &nf_tables_objects, list) {
5813 if (objtype == type->type)
5814 return type;
5815 }
5816 return NULL;
5817}
5818
452238e8
FW		 5819static const struct nft_object_type *
5820nft_obj_type_get(struct net *net, u32 objtype)
e5009240
PNA		 5821{
5822 const struct nft_object_type *type;
5823
5824 type = __nft_obj_type_get(objtype);
5825 if (type != NULL && try_module_get(type->owner))
5826 return type;
5827
f102d66b 5828 lockdep_nfnl_nft_mutex_not_held();
e5009240
PNA		 5829#ifdef CONFIG_MODULES
5830 if (type == NULL) {
eb014de4 5831 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
e5009240
PNA		 5832 return ERR_PTR(-EAGAIN);
5833 }
5834#endif
5835 return ERR_PTR(-ENOENT);
5836}
5837
d62d0ba9
FFM		 5838static int nf_tables_updobj(const struct nft_ctx *ctx,
5839 const struct nft_object_type *type,
5840 const struct nlattr *attr,
5841 struct nft_object *obj)
5842{
5843 struct nft_object *newobj;
5844 struct nft_trans *trans;
5845 int err;
5846
5847 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
5848 sizeof(struct nft_trans_obj));
5849 if (!trans)
5850 return -ENOMEM;
5851
5852 newobj = nft_obj_init(ctx, type, attr);
5853 if (IS_ERR(newobj)) {
5854 err = PTR_ERR(newobj);
b74ae961 5855 goto err_free_trans;
d62d0ba9
FFM		 5856 }
5857
5858 nft_trans_obj(trans) = obj;
5859 nft_trans_obj_update(trans) = true;
5860 nft_trans_obj_newobj(trans) = newobj;
5861 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5862
5863 return 0;
b74ae961
DC		 5864
5865err_free_trans:
d62d0ba9 5866 kfree(trans);
d62d0ba9
FFM		 5867 return err;
5868}
5869
e5009240
PNA		 5870static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5871 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5872 const struct nlattr * const nla[],
5873 struct netlink_ext_ack *extack)
e5009240
PNA		 5874{
5875 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5876 const struct nft_object_type *type;
5877 u8 genmask = nft_genmask_next(net);
5878 int family = nfmsg->nfgen_family;
e5009240
PNA		 5879 struct nft_table *table;
5880 struct nft_object *obj;
5881 struct nft_ctx ctx;
5882 u32 objtype;
5883 int err;
5884
5885 if (!nla[NFTA_OBJ_TYPE] ||
5886 !nla[NFTA_OBJ_NAME] ||
5887 !nla[NFTA_OBJ_DATA])
5888 return -EINVAL;
5889
cac20fcd 5890 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5891 if (IS_ERR(table)) {
5892 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5893 return PTR_ERR(table);
36dd1bcc 5894 }
e5009240
PNA		 5895
5896 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5897 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 5898 if (IS_ERR(obj)) {
5899 err = PTR_ERR(obj);
36dd1bcc
PNA		 5900 if (err != -ENOENT) {
5901 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5902 return err;
36dd1bcc 5903 }
1a28ad74 5904 } else {
36dd1bcc
PNA		 5905 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5906 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5907 return -EEXIST;
36dd1bcc 5908 }
d62d0ba9
FFM		 5909 if (nlh->nlmsg_flags & NLM_F_REPLACE)
5910 return -EOPNOTSUPP;
5911
fd57d0cb 5912 type = __nft_obj_type_get(objtype);
d62d0ba9
FFM		 5913 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5914
5915 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
e5009240
PNA		 5916 }
5917
98319cb9 5918 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240 5919
452238e8 5920 type = nft_obj_type_get(net, objtype);
e5009240
PNA		 5921 if (IS_ERR(type))
5922 return PTR_ERR(type);
5923
84fba055 5924 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 5925 if (IS_ERR(obj)) {
5926 err = PTR_ERR(obj);
5927 goto err1;
5928 }
d152159b 5929 obj->key.table = table;
3ecbfd65
HS		 5930 obj->handle = nf_tables_alloc_handle(table);
5931
d152159b
FW		 5932 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5933 if (!obj->key.name) {
61509575
PS		 5934 err = -ENOMEM;
5935 goto err2;
5936 }
e5009240
PNA		 5937
5938 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5939 if (err < 0)
61509575 5940 goto err3;
e5009240 5941
4d44175a
FW		 5942 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
5943 nft_objname_ht_params);
5944 if (err < 0)
5945 goto err4;
5946
e5009240
PNA		 5947 list_add_tail_rcu(&obj->list, &table->objects);
5948 table->use++;
5949 return 0;
4d44175a
FW		 5950err4:
5951 /* queued in transaction log */
5952 INIT_LIST_HEAD(&obj->list);
5953 return err;
61509575 5954err3:
d152159b 5955 kfree(obj->key.name);
e5009240 5956err2:
dfc46034 5957 if (obj->ops->destroy)
00bfb320 5958 obj->ops->destroy(&ctx, obj);
e5009240
PNA		 5959 kfree(obj);
5960err1:
5961 module_put(type->owner);
5962 return err;
5963}
5964
5965static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5966 u32 portid, u32 seq, int event, u32 flags,
5967 int family, const struct nft_table *table,
43da04a5 5968 struct nft_object *obj, bool reset)
e5009240
PNA		 5969{
5970 struct nfgenmsg *nfmsg;
5971 struct nlmsghdr *nlh;
5972
dedb67c4 5973 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 5974 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5975 if (nlh == NULL)
5976 goto nla_put_failure;
5977
5978 nfmsg = nlmsg_data(nlh);
5979 nfmsg->nfgen_family = family;
5980 nfmsg->version = NFNETLINK_V0;
5981 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5982
5983 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
d152159b 5984 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
dfc46034 5985 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 5986 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 5987 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5988 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5989 NFTA_OBJ_PAD))
e5009240
PNA		 5990 goto nla_put_failure;
5991
5992 nlmsg_end(skb, nlh);
5993 return 0;
5994
5995nla_put_failure:
5996 nlmsg_trim(skb, nlh);
5997 return -1;
5998}
5999
a9fea2a3 6000struct nft_obj_filter {
e46abbcc 6001 char *table;
a9fea2a3
PNA		 6002 u32 type;
6003};
6004
e5009240
PNA		 6005static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
6006{
6007 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 6008 const struct nft_table *table;
e5009240 6009 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 6010 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 6011 struct net *net = sock_net(skb->sk);
6012 int family = nfmsg->nfgen_family;
43da04a5
PNA		 6013 struct nft_object *obj;
6014 bool reset = false;
6015
6016 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6017 reset = true;
e5009240
PNA		 6018
6019 rcu_read_lock();
6020 cb->seq = net->nft.base_seq;
6021
36596dad 6022 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 6023 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 6024 continue;
6025
36596dad
PNA		 6026 list_for_each_entry_rcu(obj, &table->objects, list) {
6027 if (!nft_is_active(net, obj))
6028 goto cont;
6029 if (idx < s_idx)
6030 goto cont;
6031 if (idx > s_idx)
6032 memset(&cb->args[1], 0,
6033 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 6034 if (filter && filter->table &&
36596dad
PNA		 6035 strcmp(filter->table, table->name))
6036 goto cont;
6037 if (filter &&
6038 filter->type != NFT_OBJECT_UNSPEC &&
6039 obj->ops->type->type != filter->type)
6040 goto cont;
a9fea2a3 6041
8e6cf365 6042 if (reset) {
68df2ed5 6043 char *buf = kasprintf(GFP_ATOMIC,
8e6cf365
RGB		 6044 "%s:%llu;?:0",
6045 table->name,
6046 table->handle);
6047
6048 audit_log_nfcfg(buf,
6049 family,
6050 obj->handle,
14224039 6051 AUDIT_NFT_OP_OBJ_RESET,
68df2ed5 6052 GFP_ATOMIC);
8e6cf365
RGB		 6053 kfree(buf);
6054 }
6055
36596dad
PNA		 6056 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
6057 cb->nlh->nlmsg_seq,
6058 NFT_MSG_NEWOBJ,
6059 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 6060 table->family, table,
36596dad
PNA		 6061 obj, reset) < 0)
6062 goto done;
e5009240 6063
36596dad 6064 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 6065cont:
36596dad 6066 idx++;
e5009240
PNA		 6067 }
6068 }
6069done:
6070 rcu_read_unlock();
6071
6072 cb->args[0] = idx;
6073 return skb->len;
6074}
6075
90fd131a 6076static int nf_tables_dump_obj_start(struct netlink_callback *cb)
a9fea2a3 6077{
90fd131a
FW		 6078 const struct nlattr * const *nla = cb->data;
6079 struct nft_obj_filter *filter = NULL;
e46abbcc 6080
90fd131a
FW		 6081 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
6082 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6083 if (!filter)
6084 return -ENOMEM;
6085
6086 if (nla[NFTA_OBJ_TABLE]) {
6087 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
6088 if (!filter->table) {
6089 kfree(filter);
6090 return -ENOMEM;
6091 }
6092 }
6093
6094 if (nla[NFTA_OBJ_TYPE])
6095 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
8bea728d 6096 }
a9fea2a3 6097
90fd131a 6098 cb->data = filter;
a9fea2a3
PNA		 6099 return 0;
6100}
6101
90fd131a 6102static int nf_tables_dump_obj_done(struct netlink_callback *cb)
a9fea2a3 6103{
90fd131a 6104 struct nft_obj_filter *filter = cb->data;
a9fea2a3 6105
90fd131a
FW		 6106 if (filter) {
6107 kfree(filter->table);
6108 kfree(filter);
e46abbcc 6109 }
a9fea2a3 6110
90fd131a 6111 return 0;
a9fea2a3
PNA		 6112}
6113
d9adf22a 6114/* called with rcu_read_lock held */
e5009240
PNA		 6115static int nf_tables_getobj(struct net *net, struct sock *nlsk,
6116 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 6117 const struct nlattr * const nla[],
6118 struct netlink_ext_ack *extack)
e5009240
PNA		 6119{
6120 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6121 u8 genmask = nft_genmask_cur(net);
6122 int family = nfmsg->nfgen_family;
e5009240
PNA		 6123 const struct nft_table *table;
6124 struct nft_object *obj;
6125 struct sk_buff *skb2;
43da04a5 6126 bool reset = false;
e5009240
PNA		 6127 u32 objtype;
6128 int err;
6129
6130 if (nlh->nlmsg_flags & NLM_F_DUMP) {
6131 struct netlink_dump_control c = {
90fd131a 6132 .start = nf_tables_dump_obj_start,
e5009240 6133 .dump = nf_tables_dump_obj,
a9fea2a3 6134 .done = nf_tables_dump_obj_done,
d9adf22a 6135 .module = THIS_MODULE,
90fd131a 6136 .data = (void *)nla,
e5009240 6137 };
a9fea2a3 6138
d9adf22a 6139 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
e5009240
PNA		 6140 }
6141
6142 if (!nla[NFTA_OBJ_NAME] ||
6143 !nla[NFTA_OBJ_TYPE])
6144 return -EINVAL;
6145
cac20fcd 6146 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 6147 if (IS_ERR(table)) {
6148 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 6149 return PTR_ERR(table);
36dd1bcc 6150 }
e5009240
PNA		 6151
6152 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 6153 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 6154 if (IS_ERR(obj)) {
6155 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 6156 return PTR_ERR(obj);
36dd1bcc 6157 }
e5009240 6158
d9adf22a 6159 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
e5009240
PNA		 6160 if (!skb2)
6161 return -ENOMEM;
6162
43da04a5
PNA		 6163 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6164 reset = true;
6165
8e6cf365 6166 if (reset) {
14224039 6167 char *buf = kasprintf(GFP_ATOMIC, "%s:%llu;?:0",
8e6cf365
RGB		 6168 table->name, table->handle);
6169
6170 audit_log_nfcfg(buf,
6171 family,
6172 obj->handle,
14224039 6173 AUDIT_NFT_OP_OBJ_RESET,
68df2ed5 6174 GFP_ATOMIC);
8e6cf365
RGB		 6175 kfree(buf);
6176 }
6177
e5009240
PNA		 6178 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
6179 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 6180 family, table, obj, reset);
e5009240
PNA		 6181 if (err < 0)
6182 goto err;
6183
6184 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6185err:
6186 kfree_skb(skb2);
6187 return err;
e5009240
PNA		 6188}
6189
00bfb320 6190static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
e5009240 6191{
dfc46034 6192 if (obj->ops->destroy)
00bfb320 6193 obj->ops->destroy(ctx, obj);
e5009240 6194
dfc46034 6195 module_put(obj->ops->type->owner);
d152159b 6196 kfree(obj->key.name);
e5009240
PNA		 6197 kfree(obj);
6198}
6199
6200static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 6201 struct sk_buff *skb, const struct nlmsghdr *nlh,
6202 const struct nlattr * const nla[],
6203 struct netlink_ext_ack *extack)
e5009240
PNA		 6204{
6205 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6206 u8 genmask = nft_genmask_next(net);
6207 int family = nfmsg->nfgen_family;
36dd1bcc 6208 const struct nlattr *attr;
e5009240
PNA		 6209 struct nft_table *table;
6210 struct nft_object *obj;
6211 struct nft_ctx ctx;
6212 u32 objtype;
6213
6214 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 6215 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 6216 return -EINVAL;
6217
cac20fcd 6218 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 6219 if (IS_ERR(table)) {
6220 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 6221 return PTR_ERR(table);
36dd1bcc 6222 }
e5009240
PNA		 6223
6224 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 6225 if (nla[NFTA_OBJ_HANDLE]) {
6226 attr = nla[NFTA_OBJ_HANDLE];
6227 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
6228 } else {
6229 attr = nla[NFTA_OBJ_NAME];
4d44175a 6230 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
36dd1bcc
PNA		 6231 }
6232
6233 if (IS_ERR(obj)) {
6234 NL_SET_BAD_ATTR(extack, attr);
e5009240 6235 return PTR_ERR(obj);
36dd1bcc
PNA		 6236 }
6237 if (obj->use > 0) {
6238 NL_SET_BAD_ATTR(extack, attr);
e5009240 6239 return -EBUSY;
36dd1bcc 6240 }
e5009240 6241
98319cb9 6242 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 6243
6244 return nft_delobj(&ctx, obj);
6245}
6246
d152159b 6247void nft_obj_notify(struct net *net, const struct nft_table *table,
25e94a99
PNA		 6248 struct nft_object *obj, u32 portid, u32 seq, int event,
6249 int family, int report, gfp_t gfp)
e5009240
PNA		 6250{
6251 struct sk_buff *skb;
6252 int err;
14224039 6253 char *buf = kasprintf(gfp, "%s:%llu;?:0",
8e6cf365
RGB		 6254 table->name, table->handle);
6255
6256 audit_log_nfcfg(buf,
6257 family,
6258 obj->handle,
6259 event == NFT_MSG_NEWOBJ ?
6260 AUDIT_NFT_OP_OBJ_REGISTER :
14224039 6261 AUDIT_NFT_OP_OBJ_UNREGISTER,
68df2ed5 6262 gfp);
8e6cf365 6263 kfree(buf);
e5009240 6264
2599e989
PNA		 6265 if (!report &&
6266 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 6267 return;
e5009240 6268
2599e989 6269 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 6270 if (skb == NULL)
6271 goto err;
6272
2599e989
PNA		 6273 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
6274 table, obj, false);
e5009240
PNA		 6275 if (err < 0) {
6276 kfree_skb(skb);
6277 goto err;
6278 }
6279
25e94a99
PNA		 6280 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
6281 return;
e5009240 6282err:
25e94a99 6283 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 6284}
2599e989
PNA		 6285EXPORT_SYMBOL_GPL(nft_obj_notify);
6286
25e94a99
PNA		 6287static void nf_tables_obj_notify(const struct nft_ctx *ctx,
6288 struct nft_object *obj, int event)
2599e989 6289{
25e94a99 6290 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 6291 ctx->family, ctx->report, GFP_KERNEL);
2599e989 6292}
e5009240 6293
3b49e2e9
PNA		 6294/*
6295 * Flow tables
6296 */
6297void nft_register_flowtable_type(struct nf_flowtable_type *type)
6298{
6299 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6300 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
6301 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6302}
6303EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
6304
6305void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
6306{
6307 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6308 list_del_rcu(&type->list);
6309 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6310}
6311EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
6312
6313static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
6314 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
6315 .len = NFT_NAME_MAXLEN - 1 },
6316 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
6317 .len = NFT_NAME_MAXLEN - 1 },
6318 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 6319 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
8bb69f3b 6320 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 },
3b49e2e9
PNA		 6321};
6322
cac20fcd
PNA		 6323struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
6324 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 6325{
6326 struct nft_flowtable *flowtable;
6327
d9adf22a 6328 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
3b49e2e9
PNA		 6329 if (!nla_strcmp(nla, flowtable->name) &&
6330 nft_active_genmask(flowtable, genmask))
6331 return flowtable;
6332 }
6333 return ERR_PTR(-ENOENT);
6334}
cac20fcd 6335EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 6336
9b05b6e1
LGL		 6337void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
6338 struct nft_flowtable *flowtable,
6339 enum nft_trans_phase phase)
6340{
6341 switch (phase) {
6342 case NFT_TRANS_PREPARE:
6343 case NFT_TRANS_ABORT:
6344 case NFT_TRANS_RELEASE:
6345 flowtable->use--;
954d8297 6346 fallthrough;
9b05b6e1
LGL		 6347 default:
6348 return;
6349 }
6350}
6351EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
6352
ae0662f8 6353static struct nft_flowtable *
cac20fcd
PNA		 6354nft_flowtable_lookup_byhandle(const struct nft_table *table,
6355 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 6356{
6357 struct nft_flowtable *flowtable;
6358
6359 list_for_each_entry(flowtable, &table->flowtables, list) {
6360 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
6361 nft_active_genmask(flowtable, genmask))
6362 return flowtable;
6363 }
6364 return ERR_PTR(-ENOENT);
6365}
6366
d9246a53
PNA		 6367struct nft_flowtable_hook {
6368 u32 num;
6369 int priority;
6370 struct list_head list;
6371};
6372
3b49e2e9
PNA		 6373static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
6374 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
6375 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
6376 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
6377};
6378
d9246a53
PNA		 6379static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
6380 const struct nlattr *attr,
6381 struct nft_flowtable_hook *flowtable_hook,
5b6743fb 6382 struct nft_flowtable *flowtable, bool add)
3b49e2e9 6383{
3b49e2e9 6384 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
3f0465a9 6385 struct nft_hook *hook;
3b49e2e9 6386 int hooknum, priority;
3f0465a9 6387 int err;
3b49e2e9 6388
d9246a53
PNA		 6389 INIT_LIST_HEAD(&flowtable_hook->list);
6390
8cb08174
JB		 6391 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
6392 nft_flowtable_hook_policy, NULL);
3b49e2e9
PNA		 6393 if (err < 0)
6394 return err;
6395
5b6743fb
PNA		 6396 if (add) {
6397 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
6398 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY])
6399 return -EINVAL;
3b49e2e9 6400
5b6743fb
PNA		 6401 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6402 if (hooknum != NF_NETDEV_INGRESS)
6403 return -EOPNOTSUPP;
6404
6405 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6406
6407 flowtable_hook->priority = priority;
6408 flowtable_hook->num = hooknum;
6409 } else {
6410 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) {
6411 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6412 if (hooknum != flowtable->hooknum)
6413 return -EOPNOTSUPP;
6414 }
6415
6416 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
6417 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6418 if (priority != flowtable->data.priority)
6419 return -EOPNOTSUPP;
6420 }
3b49e2e9 6421
5b6743fb
PNA		 6422 flowtable_hook->priority = flowtable->data.priority;
6423 flowtable_hook->num = flowtable->hooknum;
6424 }
3b49e2e9 6425
05abe445
PNA		 6426 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
6427 err = nf_tables_parse_netdev_hooks(ctx->net,
6428 tb[NFTA_FLOWTABLE_HOOK_DEVS],
6429 &flowtable_hook->list);
6430 if (err < 0)
6431 return err;
6432 }
3b49e2e9 6433
d9246a53 6434 list_for_each_entry(hook, &flowtable_hook->list, list) {
3f0465a9 6435 hook->ops.pf = NFPROTO_NETDEV;
5b6743fb
PNA		 6436 hook->ops.hooknum = flowtable_hook->num;
6437 hook->ops.priority = flowtable_hook->priority;
6438 hook->ops.priv = &flowtable->data;
6439 hook->ops.hook = flowtable->data.type->hook;
3b49e2e9
PNA		 6440 }
6441
3b49e2e9
PNA		 6442 return err;
6443}
6444
98319cb9 6445static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 6446{
6447 const struct nf_flowtable_type *type;
6448
6449 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 6450 if (family == type->family)
3b49e2e9
PNA		 6451 return type;
6452 }
6453 return NULL;
6454}
6455
452238e8
FW		 6456static const struct nf_flowtable_type *
6457nft_flowtable_type_get(struct net *net, u8 family)
3b49e2e9
PNA		 6458{
6459 const struct nf_flowtable_type *type;
6460
98319cb9 6461 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 6462 if (type != NULL && try_module_get(type->owner))
6463 return type;
6464
f102d66b 6465 lockdep_nfnl_nft_mutex_not_held();
3b49e2e9
PNA		 6466#ifdef CONFIG_MODULES
6467 if (type == NULL) {
eb014de4 6468 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
3b49e2e9
PNA		 6469 return ERR_PTR(-EAGAIN);
6470 }
6471#endif
6472 return ERR_PTR(-ENOENT);
6473}
6474
5acab914 6475/* Only called from error and netdev event paths. */
ff4bf2f4
PNA		 6476static void nft_unregister_flowtable_hook(struct net *net,
6477 struct nft_flowtable *flowtable,
6478 struct nft_hook *hook)
6479{
6480 nf_unregister_net_hook(net, &hook->ops);
6481 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
6482 FLOW_BLOCK_UNBIND);
6483}
6484
3b49e2e9 6485static void nft_unregister_flowtable_net_hooks(struct net *net,
f9382669 6486 struct list_head *hook_list)
3b49e2e9 6487{
3f0465a9 6488 struct nft_hook *hook;
3b49e2e9 6489
f9382669 6490 list_for_each_entry(hook, hook_list, list)
5acab914 6491 nf_unregister_net_hook(net, &hook->ops);
3f0465a9
PNA		 6492}
6493
6494static int nft_register_flowtable_net_hooks(struct net *net,
6495 struct nft_table *table,
f9382669 6496 struct list_head *hook_list,
3f0465a9
PNA		 6497 struct nft_flowtable *flowtable)
6498{
6499 struct nft_hook *hook, *hook2, *next;
6500 struct nft_flowtable *ft;
6501 int err, i = 0;
6502
f9382669 6503 list_for_each_entry(hook, hook_list, list) {
3f0465a9
PNA		 6504 list_for_each_entry(ft, &table->flowtables, list) {
6505 list_for_each_entry(hook2, &ft->hook_list, list) {
6506 if (hook->ops.dev == hook2->ops.dev &&
6507 hook->ops.pf == hook2->ops.pf) {
77a92189 6508 err = -EEXIST;
3f0465a9
PNA		 6509 goto err_unregister_net_hooks;
6510 }
6511 }
6512 }
3b49e2e9 6513
d7c03a9f 6514 err = flowtable->data.type->setup(&flowtable->data,
6515 hook->ops.dev,
6516 FLOW_BLOCK_BIND);
3f0465a9
PNA		 6517 if (err < 0)
6518 goto err_unregister_net_hooks;
6519
d7c03a9f 6520 err = nf_register_net_hook(net, &hook->ops);
6521 if (err < 0) {
6522 flowtable->data.type->setup(&flowtable->data,
6523 hook->ops.dev,
6524 FLOW_BLOCK_UNBIND);
6525 goto err_unregister_net_hooks;
6526 }
6527
3f0465a9 6528 i++;
3b49e2e9 6529 }
3f0465a9
PNA		 6530
6531 return 0;
6532
6533err_unregister_net_hooks:
f9382669 6534 list_for_each_entry_safe(hook, next, hook_list, list) {
3f0465a9
PNA		 6535 if (i-- <= 0)
6536 break;
6537
ff4bf2f4 6538 nft_unregister_flowtable_hook(net, flowtable, hook);
3f0465a9
PNA		 6539 list_del_rcu(&hook->list);
6540 kfree_rcu(hook, rcu);
6541 }
6542
6543 return err;
3b49e2e9
PNA		 6544}
6545
389a2cbc
PNA		 6546static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
6547{
6548 struct nft_hook *hook, *next;
6549
6550 list_for_each_entry_safe(hook, next, hook_list, list) {
6551 list_del_rcu(&hook->list);
6552 kfree_rcu(hook, rcu);
6553 }
6554}
6555
78d9f48f
PNA		 6556static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
6557 struct nft_flowtable *flowtable)
6558{
6559 const struct nlattr * const *nla = ctx->nla;
6560 struct nft_flowtable_hook flowtable_hook;
6561 struct nft_hook *hook, *next;
6562 struct nft_trans *trans;
6563 bool unregister = false;
6564 int err;
6565
6566 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
5b6743fb 6567 &flowtable_hook, flowtable, false);
78d9f48f
PNA		 6568 if (err < 0)
6569 return err;
6570
6571 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
6572 if (nft_hook_list_find(&flowtable->hook_list, hook)) {
6573 list_del(&hook->list);
6574 kfree(hook);
6575 }
6576 }
6577
6578 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table,
6579 &flowtable_hook.list, flowtable);
6580 if (err < 0)
6581 goto err_flowtable_update_hook;
6582
6583 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE,
6584 sizeof(struct nft_trans_flowtable));
6585 if (!trans) {
6586 unregister = true;
6587 err = -ENOMEM;
6588 goto err_flowtable_update_hook;
6589 }
6590
6591 nft_trans_flowtable(trans) = flowtable;
6592 nft_trans_flowtable_update(trans) = true;
6593 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
6594 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans));
6595
6596 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
6597
6598 return 0;
6599
6600err_flowtable_update_hook:
6601 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
6602 if (unregister)
6603 nft_unregister_flowtable_hook(ctx->net, flowtable, hook);
6604 list_del_rcu(&hook->list);
6605 kfree_rcu(hook, rcu);
6606 }
6607
6608 return err;
6609
6610}
6611
3b49e2e9
PNA		 6612static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
6613 struct sk_buff *skb,
6614 const struct nlmsghdr *nlh,
6615 const struct nlattr * const nla[],
6616 struct netlink_ext_ack *extack)
6617{
6618 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
d9246a53 6619 struct nft_flowtable_hook flowtable_hook;
3b49e2e9
PNA		 6620 const struct nf_flowtable_type *type;
6621 u8 genmask = nft_genmask_next(net);
6622 int family = nfmsg->nfgen_family;
3f0465a9
PNA		 6623 struct nft_flowtable *flowtable;
6624 struct nft_hook *hook, *next;
3b49e2e9
PNA		 6625 struct nft_table *table;
6626 struct nft_ctx ctx;
3f0465a9 6627 int err;
3b49e2e9
PNA		 6628
6629 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6630 !nla[NFTA_FLOWTABLE_NAME] ||
6631 !nla[NFTA_FLOWTABLE_HOOK])
6632 return -EINVAL;
6633
cac20fcd
PNA		 6634 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6635 genmask);
36dd1bcc
PNA		 6636 if (IS_ERR(table)) {
6637 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 6638 return PTR_ERR(table);
36dd1bcc 6639 }
3b49e2e9 6640
cac20fcd
PNA		 6641 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6642 genmask);
3b49e2e9
PNA		 6643 if (IS_ERR(flowtable)) {
6644 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 6645 if (err != -ENOENT) {
6646 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 6647 return err;
36dd1bcc 6648 }
3b49e2e9 6649 } else {
36dd1bcc
PNA		 6650 if (nlh->nlmsg_flags & NLM_F_EXCL) {
6651 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 6652 return -EEXIST;
36dd1bcc 6653 }
3b49e2e9 6654
78d9f48f
PNA		 6655 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6656
6657 return nft_flowtable_update(&ctx, nlh, flowtable);
3b49e2e9
PNA		 6658 }
6659
98319cb9 6660 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 6661
6662 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
6663 if (!flowtable)
6664 return -ENOMEM;
6665
6666 flowtable->table = table;
3ecbfd65 6667 flowtable->handle = nf_tables_alloc_handle(table);
3f0465a9 6668 INIT_LIST_HEAD(&flowtable->hook_list);
3ecbfd65 6669
3b49e2e9
PNA		 6670 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
6671 if (!flowtable->name) {
6672 err = -ENOMEM;
6673 goto err1;
6674 }
6675
452238e8 6676 type = nft_flowtable_type_get(net, family);
3b49e2e9
PNA		 6677 if (IS_ERR(type)) {
6678 err = PTR_ERR(type);
6679 goto err2;
6680 }
6681
8bb69f3b
PNA		 6682 if (nla[NFTA_FLOWTABLE_FLAGS]) {
6683 flowtable->data.flags =
6684 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
cfbd1125 6685 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK)
8bb69f3b
PNA		 6686 goto err3;
6687 }
6688
6689 write_pnet(&flowtable->data.net, net);
3b49e2e9 6690 flowtable->data.type = type;
a268de77 6691 err = type->init(&flowtable->data);
3b49e2e9
PNA		 6692 if (err < 0)
6693 goto err3;
6694
d9246a53 6695 err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5b6743fb 6696 &flowtable_hook, flowtable, true);
3b49e2e9 6697 if (err < 0)
a268de77 6698 goto err4;
3b49e2e9 6699
d9246a53
PNA		 6700 list_splice(&flowtable_hook.list, &flowtable->hook_list);
6701 flowtable->data.priority = flowtable_hook.priority;
6702 flowtable->hooknum = flowtable_hook.num;
6703
f9382669
PNA		 6704 err = nft_register_flowtable_net_hooks(ctx.net, table,
6705 &flowtable->hook_list,
6706 flowtable);
2d285f26 6707 if (err < 0) {
389a2cbc 6708 nft_flowtable_hooks_destroy(&flowtable->hook_list);
3f0465a9 6709 goto err4;
2d285f26 6710 }
3b49e2e9
PNA		 6711
6712 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
6713 if (err < 0)
3f0465a9 6714 goto err5;
3b49e2e9
PNA		 6715
6716 list_add_tail_rcu(&flowtable->list, &table->flowtables);
6717 table->use++;
6718
6719 return 0;
a268de77 6720err5:
3f0465a9 6721 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
ff4bf2f4 6722 nft_unregister_flowtable_hook(net, flowtable, hook);
3f0465a9
PNA		 6723 list_del_rcu(&hook->list);
6724 kfree_rcu(hook, rcu);
6725 }
a268de77
FF		 6726err4:
6727 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 6728err3:
6729 module_put(type->owner);
6730err2:
6731 kfree(flowtable->name);
6732err1:
6733 kfree(flowtable);
6734 return err;
6735}
6736
3003055f
PNA		 6737static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook)
6738{
6739 struct nft_hook *this, *next;
6740
6741 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) {
6742 list_del(&this->list);
6743 kfree(this);
6744 }
6745}
6746
abadb2f8
PNA		 6747static int nft_delflowtable_hook(struct nft_ctx *ctx,
6748 struct nft_flowtable *flowtable)
6749{
6750 const struct nlattr * const *nla = ctx->nla;
6751 struct nft_flowtable_hook flowtable_hook;
3003055f 6752 struct nft_hook *this, *hook;
abadb2f8
PNA		 6753 struct nft_trans *trans;
6754 int err;
6755
6756 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
5b6743fb 6757 &flowtable_hook, flowtable, false);
abadb2f8
PNA		 6758 if (err < 0)
6759 return err;
6760
3003055f 6761 list_for_each_entry(this, &flowtable_hook.list, list) {
abadb2f8
PNA		 6762 hook = nft_hook_list_find(&flowtable->hook_list, this);
6763 if (!hook) {
6764 err = -ENOENT;
6765 goto err_flowtable_del_hook;
6766 }
6767 hook->inactive = true;
abadb2f8
PNA		 6768 }
6769
6770 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
6771 sizeof(struct nft_trans_flowtable));
3003055f
PNA		 6772 if (!trans) {
6773 err = -ENOMEM;
6774 goto err_flowtable_del_hook;
6775 }
abadb2f8
PNA		 6776
6777 nft_trans_flowtable(trans) = flowtable;
6778 nft_trans_flowtable_update(trans) = true;
6779 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
3003055f 6780 nft_flowtable_hook_release(&flowtable_hook);
abadb2f8
PNA		 6781
6782 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
6783
6784 return 0;
6785
6786err_flowtable_del_hook:
3003055f
PNA		 6787 list_for_each_entry(this, &flowtable_hook.list, list) {
6788 hook = nft_hook_list_find(&flowtable->hook_list, this);
6789 if (!hook)
6790 break;
6791
abadb2f8 6792 hook->inactive = false;
3003055f
PNA		 6793 }
6794 nft_flowtable_hook_release(&flowtable_hook);
abadb2f8
PNA		 6795
6796 return err;
6797}
6798
3b49e2e9
PNA		 6799static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
6800 struct sk_buff *skb,
6801 const struct nlmsghdr *nlh,
6802 const struct nlattr * const nla[],
6803 struct netlink_ext_ack *extack)
6804{
6805 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6806 u8 genmask = nft_genmask_next(net);
6807 int family = nfmsg->nfgen_family;
6808 struct nft_flowtable *flowtable;
36dd1bcc 6809 const struct nlattr *attr;
3b49e2e9
PNA		 6810 struct nft_table *table;
6811 struct nft_ctx ctx;
6812
e603ea4b
PNA		 6813 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6814 (!nla[NFTA_FLOWTABLE_NAME] &&
6815 !nla[NFTA_FLOWTABLE_HANDLE]))
6816 return -EINVAL;
6817
cac20fcd
PNA		 6818 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6819 genmask);
36dd1bcc
PNA		 6820 if (IS_ERR(table)) {
6821 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 6822 return PTR_ERR(table);
36dd1bcc 6823 }
3b49e2e9 6824
36dd1bcc
PNA		 6825 if (nla[NFTA_FLOWTABLE_HANDLE]) {
6826 attr = nla[NFTA_FLOWTABLE_HANDLE];
6827 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
6828 } else {
6829 attr = nla[NFTA_FLOWTABLE_NAME];
6830 flowtable = nft_flowtable_lookup(table, attr, genmask);
6831 }
6832
6833 if (IS_ERR(flowtable)) {
6834 NL_SET_BAD_ATTR(extack, attr);
6835 return PTR_ERR(flowtable);
6836 }
abadb2f8
PNA		 6837
6838 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6839
6840 if (nla[NFTA_FLOWTABLE_HOOK])
6841 return nft_delflowtable_hook(&ctx, flowtable);
6842
36dd1bcc
PNA		 6843 if (flowtable->use > 0) {
6844 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 6845 return -EBUSY;
36dd1bcc 6846 }
3b49e2e9 6847
3b49e2e9
PNA		 6848 return nft_delflowtable(&ctx, flowtable);
6849}
6850
6851static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
6852 u32 portid, u32 seq, int event,
6853 u32 flags, int family,
c42d8bda
PNA		 6854 struct nft_flowtable *flowtable,
6855 struct list_head *hook_list)
3b49e2e9
PNA		 6856{
6857 struct nlattr *nest, *nest_devs;
6858 struct nfgenmsg *nfmsg;
3f0465a9 6859 struct nft_hook *hook;
3b49e2e9 6860 struct nlmsghdr *nlh;
3b49e2e9
PNA		 6861
6862 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6863 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
6864 if (nlh == NULL)
6865 goto nla_put_failure;
6866
6867 nfmsg = nlmsg_data(nlh);
6868 nfmsg->nfgen_family = family;
6869 nfmsg->version = NFNETLINK_V0;
6870 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
6871
6872 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
6873 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 6874 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
6875 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
8bb69f3b
PNA		 6876 NFTA_FLOWTABLE_PAD) ||
6877 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags)))
3b49e2e9
PNA		 6878 goto nla_put_failure;
6879
ae0be8de 6880 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
eb895086
KL		 6881 if (!nest)
6882 goto nla_put_failure;
3b49e2e9 6883 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
71a8a63b 6884 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority)))
3b49e2e9
PNA		 6885 goto nla_put_failure;
6886
ae0be8de 6887 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
3b49e2e9
PNA		 6888 if (!nest_devs)
6889 goto nla_put_failure;
6890
c42d8bda 6891 list_for_each_entry_rcu(hook, hook_list, list) {
3f0465a9 6892 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))
3b49e2e9
PNA		 6893 goto nla_put_failure;
6894 }
6895 nla_nest_end(skb, nest_devs);
6896 nla_nest_end(skb, nest);
6897
6898 nlmsg_end(skb, nlh);
6899 return 0;
6900
6901nla_put_failure:
6902 nlmsg_trim(skb, nlh);
6903 return -1;
6904}
6905
6906struct nft_flowtable_filter {
6907 char *table;
6908};
6909
6910static int nf_tables_dump_flowtable(struct sk_buff *skb,
6911 struct netlink_callback *cb)
6912{
6913 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6914 struct nft_flowtable_filter *filter = cb->data;
6915 unsigned int idx = 0, s_idx = cb->args[0];
6916 struct net *net = sock_net(skb->sk);
6917 int family = nfmsg->nfgen_family;
6918 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 6919 const struct nft_table *table;
6920
6921 rcu_read_lock();
6922 cb->seq = net->nft.base_seq;
6923
36596dad 6924 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 6925 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 6926 continue;
6927
36596dad
PNA		 6928 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6929 if (!nft_is_active(net, flowtable))
6930 goto cont;
6931 if (idx < s_idx)
6932 goto cont;
6933 if (idx > s_idx)
6934 memset(&cb->args[1], 0,
6935 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 6936 if (filter && filter->table &&
36596dad
PNA		 6937 strcmp(filter->table, table->name))
6938 goto cont;
3b49e2e9 6939
36596dad
PNA		 6940 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
6941 cb->nlh->nlmsg_seq,
6942 NFT_MSG_NEWFLOWTABLE,
6943 NLM_F_MULTI | NLM_F_APPEND,
c42d8bda
PNA		 6944 table->family,
6945 flowtable,
6946 &flowtable->hook_list) < 0)
36596dad 6947 goto done;
3b49e2e9 6948
36596dad 6949 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 6950cont:
36596dad 6951 idx++;
3b49e2e9
PNA		 6952 }
6953 }
6954done:
6955 rcu_read_unlock();
6956
6957 cb->args[0] = idx;
6958 return skb->len;
6959}
6960
90fd131a 6961static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
3b49e2e9 6962{
90fd131a
FW		 6963 const struct nlattr * const *nla = cb->data;
6964 struct nft_flowtable_filter *filter = NULL;
3b49e2e9 6965
90fd131a
FW		 6966 if (nla[NFTA_FLOWTABLE_TABLE]) {
6967 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6968 if (!filter)
6969 return -ENOMEM;
3b49e2e9 6970
90fd131a
FW		 6971 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
6972 GFP_ATOMIC);
6973 if (!filter->table) {
6974 kfree(filter);
6975 return -ENOMEM;
6976 }
6977 }
3b49e2e9 6978
90fd131a 6979 cb->data = filter;
3b49e2e9
PNA		 6980 return 0;
6981}
6982
90fd131a 6983static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
3b49e2e9 6984{
90fd131a 6985 struct nft_flowtable_filter *filter = cb->data;
3b49e2e9 6986
3b49e2e9 6987 if (!filter)
90fd131a 6988 return 0;
3b49e2e9 6989
90fd131a
FW		 6990 kfree(filter->table);
6991 kfree(filter);
6992
6993 return 0;
3b49e2e9
PNA		 6994}
6995
d9adf22a 6996/* called with rcu_read_lock held */
3b49e2e9
PNA		 6997static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
6998 struct sk_buff *skb,
6999 const struct nlmsghdr *nlh,
7000 const struct nlattr * const nla[],
7001 struct netlink_ext_ack *extack)
7002{
7003 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7004 u8 genmask = nft_genmask_cur(net);
7005 int family = nfmsg->nfgen_family;
7006 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 7007 const struct nft_table *table;
7008 struct sk_buff *skb2;
7009 int err;
7010
7011 if (nlh->nlmsg_flags & NLM_F_DUMP) {
7012 struct netlink_dump_control c = {
90fd131a 7013 .start = nf_tables_dump_flowtable_start,
3b49e2e9
PNA		 7014 .dump = nf_tables_dump_flowtable,
7015 .done = nf_tables_dump_flowtable_done,
d9adf22a 7016 .module = THIS_MODULE,
90fd131a 7017 .data = (void *)nla,
3b49e2e9
PNA		 7018 };
7019
d9adf22a 7020 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3b49e2e9
PNA		 7021 }
7022
7023 if (!nla[NFTA_FLOWTABLE_NAME])
7024 return -EINVAL;
7025
cac20fcd
PNA		 7026 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7027 genmask);
3b49e2e9
PNA		 7028 if (IS_ERR(table))
7029 return PTR_ERR(table);
7030
cac20fcd
PNA		 7031 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
7032 genmask);
03a0120f 7033 if (IS_ERR(flowtable))
3b49e2e9
PNA		 7034 return PTR_ERR(flowtable);
7035
d9adf22a 7036 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3b49e2e9
PNA		 7037 if (!skb2)
7038 return -ENOMEM;
7039
7040 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
7041 nlh->nlmsg_seq,
7042 NFT_MSG_NEWFLOWTABLE, 0, family,
c42d8bda 7043 flowtable, &flowtable->hook_list);
3b49e2e9
PNA		 7044 if (err < 0)
7045 goto err;
7046
7047 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
7048err:
7049 kfree_skb(skb2);
7050 return err;
7051}
7052
7053static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
7054 struct nft_flowtable *flowtable,
c42d8bda 7055 struct list_head *hook_list,
3b49e2e9
PNA		 7056 int event)
7057{
7058 struct sk_buff *skb;
7059 int err;
8e6cf365
RGB		 7060 char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
7061 flowtable->table->name, flowtable->table->handle,
7062 flowtable->name, flowtable->handle);
7063
7064 audit_log_nfcfg(buf,
7065 ctx->family,
7066 flowtable->hooknum,
7067 event == NFT_MSG_NEWFLOWTABLE ?
7068 AUDIT_NFT_OP_FLOWTABLE_REGISTER :
14224039
RGB		 7069 AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
7070 GFP_KERNEL);
8e6cf365 7071 kfree(buf);
3b49e2e9
PNA		 7072
7073 if (ctx->report &&
7074 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
7075 return;
7076
7077 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7078 if (skb == NULL)
7079 goto err;
7080
7081 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
7082 ctx->seq, event, 0,
c42d8bda 7083 ctx->family, flowtable, hook_list);
3b49e2e9
PNA		 7084 if (err < 0) {
7085 kfree_skb(skb);
7086 goto err;
7087 }
7088
7089 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
7090 ctx->report, GFP_KERNEL);
7091 return;
7092err:
7093 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
7094}
7095
3b49e2e9
PNA		 7096static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
7097{
3f0465a9
PNA		 7098 struct nft_hook *hook, *next;
7099
5acab914 7100 flowtable->data.type->free(&flowtable->data);
3f0465a9 7101 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
5acab914
PNA		 7102 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
7103 FLOW_BLOCK_UNBIND);
3f0465a9
PNA		 7104 list_del_rcu(&hook->list);
7105 kfree(hook);
7106 }
3b49e2e9 7107 kfree(flowtable->name);
3b49e2e9 7108 module_put(flowtable->data.type->owner);
a12486eb 7109 kfree(flowtable);
3b49e2e9
PNA		 7110}
7111
84d7fce6
PNA		 7112static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
7113 u32 portid, u32 seq)
7114{
7115 struct nlmsghdr *nlh;
7116 struct nfgenmsg *nfmsg;
784b4e61 7117 char buf[TASK_COMM_LEN];
dedb67c4 7118 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 7119
7120 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
7121 if (nlh == NULL)
7122 goto nla_put_failure;
7123
7124 nfmsg = nlmsg_data(nlh);
7125 nfmsg->nfgen_family = AF_UNSPEC;
7126 nfmsg->version = NFNETLINK_V0;
7127 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
7128
784b4e61
PS		 7129 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
7130 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
7131 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 7132 goto nla_put_failure;
7133
053c095a
JB		 7134 nlmsg_end(skb, nlh);
7135 return 0;
84d7fce6
PNA		 7136
7137nla_put_failure:
7138 nlmsg_trim(skb, nlh);
7139 return -EMSGSIZE;
7140}
7141
3b49e2e9
PNA		 7142static void nft_flowtable_event(unsigned long event, struct net_device *dev,
7143 struct nft_flowtable *flowtable)
7144{
3f0465a9 7145 struct nft_hook *hook;
3b49e2e9 7146
3f0465a9
PNA		 7147 list_for_each_entry(hook, &flowtable->hook_list, list) {
7148 if (hook->ops.dev != dev)
3b49e2e9
PNA		 7149 continue;
7150
5acab914 7151 /* flow_offload_netdev_event() cleans up entries for us. */
ff4bf2f4 7152 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook);
3f0465a9
PNA		 7153 list_del_rcu(&hook->list);
7154 kfree_rcu(hook, rcu);
3b49e2e9
PNA		 7155 break;
7156 }
7157}
7158
7159static int nf_tables_flowtable_event(struct notifier_block *this,
7160 unsigned long event, void *ptr)
7161{
7162 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
7163 struct nft_flowtable *flowtable;
7164 struct nft_table *table;
0a2cf5ee 7165 struct net *net;
3b49e2e9
PNA		 7166
7167 if (event != NETDEV_UNREGISTER)
7168 return 0;
7169
6a48de01 7170 net = dev_net(dev);
9e619d87 7171 mutex_lock(&net->nft.commit_mutex);
0a2cf5ee 7172 list_for_each_entry(table, &net->nft.tables, list) {
36596dad
PNA		 7173 list_for_each_entry(flowtable, &table->flowtables, list) {
7174 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 7175 }
7176 }
9e619d87 7177 mutex_unlock(&net->nft.commit_mutex);
6a48de01 7178
3b49e2e9
PNA		 7179 return NOTIFY_DONE;
7180}
7181
7182static struct notifier_block nf_tables_flowtable_notifier = {
7183 .notifier_call = nf_tables_flowtable_event,
7184};
7185
25e94a99
PNA		 7186static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
7187 int event)
84d7fce6
PNA		 7188{
7189 struct nlmsghdr *nlh = nlmsg_hdr(skb);
7190 struct sk_buff *skb2;
7191 int err;
7192
8e6cf365 7193 audit_log_nfcfg("?:0;?:0", 0, net->nft.base_seq,
14224039 7194 AUDIT_NFT_OP_GEN_REGISTER, GFP_KERNEL);
8e6cf365 7195
84d7fce6
PNA		 7196 if (nlmsg_report(nlh) &&
7197 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 7198 return;
84d7fce6 7199
84d7fce6
PNA		 7200 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7201 if (skb2 == NULL)
7202 goto err;
7203
7204 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7205 nlh->nlmsg_seq);
7206 if (err < 0) {
7207 kfree_skb(skb2);
7208 goto err;
7209 }
7210
25e94a99
PNA		 7211 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7212 nlmsg_report(nlh), GFP_KERNEL);
7213 return;
84d7fce6 7214err:
25e94a99
PNA		 7215 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7216 -ENOBUFS);
84d7fce6
PNA		 7217}
7218
7b8002a1
PNA		 7219static int nf_tables_getgen(struct net *net, struct sock *nlsk,
7220 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 7221 const struct nlattr * const nla[],
7222 struct netlink_ext_ack *extack)
84d7fce6 7223{
84d7fce6
PNA		 7224 struct sk_buff *skb2;
7225 int err;
7226
d9adf22a 7227 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
84d7fce6
PNA		 7228 if (skb2 == NULL)
7229 return -ENOMEM;
7230
7231 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7232 nlh->nlmsg_seq);
7233 if (err < 0)
7234 goto err;
7235
7236 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
7237err:
7238 kfree_skb(skb2);
7239 return err;
7240}
7241
96518518
PM		 7242static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
7243 [NFT_MSG_NEWTABLE] = {
55dd6f93 7244 .call_batch = nf_tables_newtable,
96518518
PM		 7245 .attr_count = NFTA_TABLE_MAX,
7246 .policy = nft_table_policy,
7247 },
7248 [NFT_MSG_GETTABLE] = {
d9adf22a 7249 .call_rcu = nf_tables_gettable,
96518518
PM		 7250 .attr_count = NFTA_TABLE_MAX,
7251 .policy = nft_table_policy,
7252 },
7253 [NFT_MSG_DELTABLE] = {
55dd6f93 7254 .call_batch = nf_tables_deltable,
96518518
PM		 7255 .attr_count = NFTA_TABLE_MAX,
7256 .policy = nft_table_policy,
7257 },
7258 [NFT_MSG_NEWCHAIN] = {
91c7b38d 7259 .call_batch = nf_tables_newchain,
96518518
PM		 7260 .attr_count = NFTA_CHAIN_MAX,
7261 .policy = nft_chain_policy,
7262 },
7263 [NFT_MSG_GETCHAIN] = {
d9adf22a 7264 .call_rcu = nf_tables_getchain,
96518518
PM		 7265 .attr_count = NFTA_CHAIN_MAX,
7266 .policy = nft_chain_policy,
7267 },
7268 [NFT_MSG_DELCHAIN] = {
91c7b38d 7269 .call_batch = nf_tables_delchain,
96518518
PM		 7270 .attr_count = NFTA_CHAIN_MAX,
7271 .policy = nft_chain_policy,
7272 },
7273 [NFT_MSG_NEWRULE] = {
0628b123 7274 .call_batch = nf_tables_newrule,
96518518
PM		 7275 .attr_count = NFTA_RULE_MAX,
7276 .policy = nft_rule_policy,
7277 },
7278 [NFT_MSG_GETRULE] = {
d9adf22a 7279 .call_rcu = nf_tables_getrule,
96518518
PM		 7280 .attr_count = NFTA_RULE_MAX,
7281 .policy = nft_rule_policy,
7282 },
7283 [NFT_MSG_DELRULE] = {
0628b123 7284 .call_batch = nf_tables_delrule,
96518518
PM		 7285 .attr_count = NFTA_RULE_MAX,
7286 .policy = nft_rule_policy,
7287 },
20a69341 7288 [NFT_MSG_NEWSET] = {
958bee14 7289 .call_batch = nf_tables_newset,
20a69341
PM		 7290 .attr_count = NFTA_SET_MAX,
7291 .policy = nft_set_policy,
7292 },
7293 [NFT_MSG_GETSET] = {
d9adf22a 7294 .call_rcu = nf_tables_getset,
20a69341
PM		 7295 .attr_count = NFTA_SET_MAX,
7296 .policy = nft_set_policy,
7297 },
7298 [NFT_MSG_DELSET] = {
958bee14 7299 .call_batch = nf_tables_delset,
20a69341
PM		 7300 .attr_count = NFTA_SET_MAX,
7301 .policy = nft_set_policy,
7302 },
7303 [NFT_MSG_NEWSETELEM] = {
958bee14 7304 .call_batch = nf_tables_newsetelem,
20a69341
PM		 7305 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7306 .policy = nft_set_elem_list_policy,
7307 },
7308 [NFT_MSG_GETSETELEM] = {
d9adf22a 7309 .call_rcu = nf_tables_getsetelem,
20a69341
PM		 7310 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7311 .policy = nft_set_elem_list_policy,
7312 },
7313 [NFT_MSG_DELSETELEM] = {
958bee14 7314 .call_batch = nf_tables_delsetelem,
20a69341
PM		 7315 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7316 .policy = nft_set_elem_list_policy,
7317 },
84d7fce6 7318 [NFT_MSG_GETGEN] = {
d9adf22a 7319 .call_rcu = nf_tables_getgen,
84d7fce6 7320 },
e5009240
PNA		 7321 [NFT_MSG_NEWOBJ] = {
7322 .call_batch = nf_tables_newobj,
7323 .attr_count = NFTA_OBJ_MAX,
7324 .policy = nft_obj_policy,
7325 },
7326 [NFT_MSG_GETOBJ] = {
d9adf22a 7327 .call_rcu = nf_tables_getobj,
e5009240
PNA		 7328 .attr_count = NFTA_OBJ_MAX,
7329 .policy = nft_obj_policy,
7330 },
7331 [NFT_MSG_DELOBJ] = {
7332 .call_batch = nf_tables_delobj,
7333 .attr_count = NFTA_OBJ_MAX,
7334 .policy = nft_obj_policy,
7335 },
43da04a5 7336 [NFT_MSG_GETOBJ_RESET] = {
d9adf22a 7337 .call_rcu = nf_tables_getobj,
43da04a5
PNA		 7338 .attr_count = NFTA_OBJ_MAX,
7339 .policy = nft_obj_policy,
7340 },
3b49e2e9
PNA		 7341 [NFT_MSG_NEWFLOWTABLE] = {
7342 .call_batch = nf_tables_newflowtable,
7343 .attr_count = NFTA_FLOWTABLE_MAX,
7344 .policy = nft_flowtable_policy,
7345 },
7346 [NFT_MSG_GETFLOWTABLE] = {
d9adf22a 7347 .call_rcu = nf_tables_getflowtable,
3b49e2e9
PNA		 7348 .attr_count = NFTA_FLOWTABLE_MAX,
7349 .policy = nft_flowtable_policy,
7350 },
7351 [NFT_MSG_DELFLOWTABLE] = {
7352 .call_batch = nf_tables_delflowtable,
7353 .attr_count = NFTA_FLOWTABLE_MAX,
7354 .policy = nft_flowtable_policy,
7355 },
96518518
PM		 7356};
7357
a654de8f
PNA		 7358static int nf_tables_validate(struct net *net)
7359{
7360 struct nft_table *table;
7361
7362 switch (net->nft.validate_state) {
7363 case NFT_VALIDATE_SKIP:
7364 break;
7365 case NFT_VALIDATE_NEED:
7366 nft_validate_state_update(net, NFT_VALIDATE_DO);
954d8297 7367 fallthrough;
a654de8f
PNA		 7368 case NFT_VALIDATE_DO:
7369 list_for_each_entry(table, &net->nft.tables, list) {
7370 if (nft_table_validate(net, table) < 0)
7371 return -EAGAIN;
7372 }
7373 break;
7374 }
7375
7376 return 0;
7377}
7378
66293c46
FW		 7379/* a drop policy has to be deferred until all rules have been activated,
7380 * otherwise a large ruleset that contains a drop-policy base chain will
7381 * cause all packets to get dropped until the full transaction has been
7382 * processed.
7383 *
7384 * We defer the drop policy until the transaction has been finalized.
7385 */
7386static void nft_chain_commit_drop_policy(struct nft_trans *trans)
7387{
7388 struct nft_base_chain *basechain;
7389
7390 if (nft_trans_chain_policy(trans) != NF_DROP)
7391 return;
7392
7393 if (!nft_is_base_chain(trans->ctx.chain))
7394 return;
7395
7396 basechain = nft_base_chain(trans->ctx.chain);
7397 basechain->policy = NF_DROP;
7398}
7399
91c7b38d
PNA		 7400static void nft_chain_commit_update(struct nft_trans *trans)
7401{
7402 struct nft_base_chain *basechain;
7403
1b2470e5
FW		 7404 if (nft_trans_chain_name(trans)) {
7405 rhltable_remove(&trans->ctx.table->chains_ht,
7406 &trans->ctx.chain->rhlhead,
7407 nft_chain_ht_params);
d71efb59 7408 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
1b2470e5
FW		 7409 rhltable_insert_key(&trans->ctx.table->chains_ht,
7410 trans->ctx.chain->name,
7411 &trans->ctx.chain->rhlhead,
7412 nft_chain_ht_params);
7413 }
91c7b38d 7414
f323d954 7415 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 7416 return;
7417
53315ac6
FW		 7418 nft_chain_stats_replace(trans);
7419
91c7b38d 7420 basechain = nft_base_chain(trans->ctx.chain);
91c7b38d
PNA		 7421
7422 switch (nft_trans_chain_policy(trans)) {
7423 case NF_DROP:
7424 case NF_ACCEPT:
7425 basechain->policy = nft_trans_chain_policy(trans);
7426 break;
7427 }
7428}
7429
d62d0ba9
FFM		 7430static void nft_obj_commit_update(struct nft_trans *trans)
7431{
7432 struct nft_object *newobj;
7433 struct nft_object *obj;
7434
7435 obj = nft_trans_obj(trans);
7436 newobj = nft_trans_obj_newobj(trans);
7437
9fedd894
FFM		 7438 if (obj->ops->update)
7439 obj->ops->update(obj, newobj);
d62d0ba9
FFM		 7440
7441 kfree(newobj);
7442}
7443
2f99aa31 7444static void nft_commit_release(struct nft_trans *trans)
c7c32e72 7445{
c7c32e72
PNA		 7446 switch (trans->msg_type) {
7447 case NFT_MSG_DELTABLE:
7448 nf_tables_table_destroy(&trans->ctx);
7449 break;
9f8aac0b 7450 case NFT_MSG_NEWCHAIN:
53315ac6 7451 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b
FW		 7452 kfree(nft_trans_chain_name(trans));
7453 break;
c7c32e72 7454 case NFT_MSG_DELCHAIN:
43a605f2 7455 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 7456 break;
7457 case NFT_MSG_DELRULE:
7458 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
7459 break;
7460 case NFT_MSG_DELSET:
0c2a85ed 7461 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
c7c32e72 7462 break;
61edafbb 7463 case NFT_MSG_DELSETELEM:
3453c927
PNA		 7464 nf_tables_set_elem_destroy(&trans->ctx,
7465 nft_trans_elem_set(trans),
59105446 7466 nft_trans_elem(trans).priv);
61edafbb 7467 break;
e5009240 7468 case NFT_MSG_DELOBJ:
00bfb320 7469 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 7470 break;
3b49e2e9 7471 case NFT_MSG_DELFLOWTABLE:
abadb2f8
PNA		 7472 if (nft_trans_flowtable_update(trans))
7473 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
7474 else
7475 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
3b49e2e9 7476 break;
c7c32e72 7477 }
0935d558
FW		 7478
7479 if (trans->put_net)
7480 put_net(trans->ctx.net);
7481
c7c32e72
PNA		 7482 kfree(trans);
7483}
7484
0935d558 7485static void nf_tables_trans_destroy_work(struct work_struct *w)
2f99aa31
FW		 7486{
7487 struct nft_trans *trans, *next;
0935d558
FW		 7488 LIST_HEAD(head);
7489
7490 spin_lock(&nf_tables_destroy_list_lock);
7491 list_splice_init(&nf_tables_destroy_list, &head);
7492 spin_unlock(&nf_tables_destroy_list_lock);
2f99aa31 7493
0935d558 7494 if (list_empty(&head))
2f99aa31
FW		 7495 return;
7496
7497 synchronize_rcu();
7498
0935d558 7499 list_for_each_entry_safe(trans, next, &head, list) {
2f99aa31
FW		 7500 list_del(&trans->list);
7501 nft_commit_release(trans);
7502 }
7503}
7504
ffe8923f
FW		 7505void nf_tables_trans_destroy_flush_work(void)
7506{
7507 flush_work(&trans_destroy_work);
7508}
7509EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
7510
0cbc06b3
FW		 7511static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
7512{
7513 struct nft_rule *rule;
7514 unsigned int alloc = 0;
7515 int i;
7516
7517 /* already handled or inactive chain? */
7518 if (chain->rules_next || !nft_is_active_next(net, chain))
7519 return 0;
7520
7521 rule = list_entry(&chain->rules, struct nft_rule, list);
7522 i = 0;
7523
7524 list_for_each_entry_continue(rule, &chain->rules, list) {
7525 if (nft_is_active_next(net, rule))
7526 alloc++;
7527 }
7528
7529 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
7530 if (!chain->rules_next)
7531 return -ENOMEM;
7532
7533 list_for_each_entry_continue(rule, &chain->rules, list) {
7534 if (nft_is_active_next(net, rule))
7535 chain->rules_next[i++] = rule;
7536 }
7537
7538 chain->rules_next[i] = NULL;
7539 return 0;
7540}
7541
7542static void nf_tables_commit_chain_prepare_cancel(struct net *net)
7543{
7544 struct nft_trans *trans, *next;
7545
7546 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7547 struct nft_chain *chain = trans->ctx.chain;
7548
7549 if (trans->msg_type == NFT_MSG_NEWRULE ||
7550 trans->msg_type == NFT_MSG_DELRULE) {
7551 kvfree(chain->rules_next);
7552 chain->rules_next = NULL;
7553 }
7554 }
7555}
7556
7557static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
7558{
7559 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
7560
7561 kvfree(o->start);
7562}
7563
7564static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
7565{
7566 struct nft_rule **r = rules;
7567 struct nft_rules_old *old;
7568
7569 while (*r)
7570 r++;
7571
7572 r++; /* rcu_head is after end marker */
7573 old = (void *) r;
7574 old->start = rules;
7575
7576 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
7577}
7578
0fb39bbe 7579static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
0cbc06b3
FW		 7580{
7581 struct nft_rule **g0, **g1;
7582 bool next_genbit;
7583
7584 next_genbit = nft_gencursor_next(net);
7585
7586 g0 = rcu_dereference_protected(chain->rules_gen_0,
f102d66b 7587 lockdep_commit_lock_is_held(net));
0cbc06b3 7588 g1 = rcu_dereference_protected(chain->rules_gen_1,
f102d66b 7589 lockdep_commit_lock_is_held(net));
0cbc06b3
FW		 7590
7591 /* No changes to this chain? */
7592 if (chain->rules_next == NULL) {
7593 /* chain had no change in last or next generation */
7594 if (g0 == g1)
7595 return;
7596 /*
7597 * chain had no change in this generation; make sure next
7598 * one uses same rules as current generation.
7599 */
7600 if (next_genbit) {
7601 rcu_assign_pointer(chain->rules_gen_1, g0);
7602 nf_tables_commit_chain_free_rules_old(g1);
7603 } else {
7604 rcu_assign_pointer(chain->rules_gen_0, g1);
7605 nf_tables_commit_chain_free_rules_old(g0);
7606 }
7607
7608 return;
7609 }
7610
7611 if (next_genbit)
7612 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
7613 else
7614 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
7615
7616 chain->rules_next = NULL;
7617
7618 if (g0 == g1)
7619 return;
7620
7621 if (next_genbit)
7622 nf_tables_commit_chain_free_rules_old(g1);
7623 else
7624 nf_tables_commit_chain_free_rules_old(g0);
7625}
7626
d152159b
FW		 7627static void nft_obj_del(struct nft_object *obj)
7628{
4d44175a 7629 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
d152159b
FW		 7630 list_del_rcu(&obj->list);
7631}
7632
d0e2c7de 7633void nft_chain_del(struct nft_chain *chain)
1b2470e5
FW		 7634{
7635 struct nft_table *table = chain->table;
7636
7637 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
7638 nft_chain_ht_params));
7639 list_del_rcu(&chain->list);
7640}
7641
abadb2f8
PNA		 7642static void nft_flowtable_hooks_del(struct nft_flowtable *flowtable,
7643 struct list_head *hook_list)
7644{
7645 struct nft_hook *hook, *next;
7646
7647 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7648 if (hook->inactive)
7649 list_move(&hook->list, hook_list);
7650 }
7651}
7652
eb014de4
PNA		 7653static void nf_tables_module_autoload_cleanup(struct net *net)
7654{
7655 struct nft_module_request *req, *next;
7656
7657 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
7658 list_for_each_entry_safe(req, next, &net->nft.module_list, list) {
7659 WARN_ON_ONCE(!req->done);
7660 list_del(&req->list);
7661 kfree(req);
7662 }
7663}
7664
0935d558
FW		 7665static void nf_tables_commit_release(struct net *net)
7666{
7667 struct nft_trans *trans;
7668
7669 /* all side effects have to be made visible.
7670 * For example, if a chain named 'foo' has been deleted, a
7671 * new transaction must not find it anymore.
7672 *
7673 * Memory reclaim happens asynchronously from work queue
7674 * to prevent expensive synchronize_rcu() in commit phase.
7675 */
7676 if (list_empty(&net->nft.commit_list)) {
eb014de4 7677 nf_tables_module_autoload_cleanup(net);
0935d558
FW		 7678 mutex_unlock(&net->nft.commit_mutex);
7679 return;
7680 }
7681
7682 trans = list_last_entry(&net->nft.commit_list,
7683 struct nft_trans, list);
7684 get_net(trans->ctx.net);
7685 WARN_ON_ONCE(trans->put_net);
7686
7687 trans->put_net = true;
7688 spin_lock(&nf_tables_destroy_list_lock);
7689 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
7690 spin_unlock(&nf_tables_destroy_list_lock);
7691
eb014de4 7692 nf_tables_module_autoload_cleanup(net);
0935d558 7693 schedule_work(&trans_destroy_work);
ffe8923f
FW		 7694
7695 mutex_unlock(&net->nft.commit_mutex);
0935d558
FW		 7696}
7697
5913beaf 7698static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 7699{
37082f93 7700 struct nft_trans *trans, *next;
a3716e70 7701 struct nft_trans_elem *te;
0cbc06b3
FW		 7702 struct nft_chain *chain;
7703 struct nft_table *table;
c9626a2c 7704 int err;
37082f93 7705
b8b27498
FW		 7706 if (list_empty(&net->nft.commit_list)) {
7707 mutex_unlock(&net->nft.commit_mutex);
7708 return 0;
7709 }
7710
a654de8f
PNA		 7711 /* 0. Validate ruleset, otherwise roll back for error reporting. */
7712 if (nf_tables_validate(net) < 0)
7713 return -EAGAIN;
7714
c9626a2c
PNA		 7715 err = nft_flow_rule_offload_commit(net);
7716 if (err < 0)
7717 return err;
7718
0cbc06b3
FW		 7719 /* 1. Allocate space for next generation rules_gen_X[] */
7720 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7721 int ret;
37082f93 7722
0cbc06b3
FW		 7723 if (trans->msg_type == NFT_MSG_NEWRULE ||
7724 trans->msg_type == NFT_MSG_DELRULE) {
7725 chain = trans->ctx.chain;
7726
7727 ret = nf_tables_commit_chain_prepare(net, chain);
7728 if (ret < 0) {
7729 nf_tables_commit_chain_prepare_cancel(net);
7730 return ret;
7731 }
7732 }
7733 }
37082f93 7734
0cbc06b3
FW		 7735 /* step 2. Make rules_gen_X visible to packet path */
7736 list_for_each_entry(table, &net->nft.tables, list) {
0fb39bbe
FW		 7737 list_for_each_entry(chain, &table->chains, list)
7738 nf_tables_commit_chain(net, chain);
0cbc06b3
FW		 7739 }
7740
7741 /*
7742 * Bump generation counter, invalidate any dump in progress.
7743 * Cannot fail after this point.
37082f93 7744 */
0cbc06b3
FW		 7745 while (++net->nft.base_seq == 0);
7746
7747 /* step 3. Start new generation, rules_gen_X now in use. */
7748 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 7749
7750 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 7751 switch (trans->msg_type) {
55dd6f93
PNA		 7752 case NFT_MSG_NEWTABLE:
7753 if (nft_trans_table_update(trans)) {
7754 if (!nft_trans_table_enable(trans)) {
664b0f8c 7755 nf_tables_table_disable(net,
55dd6f93
PNA		 7756 trans->ctx.table);
7757 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7758 }
7759 } else {
f2a6d766 7760 nft_clear(net, trans->ctx.table);
55dd6f93 7761 }
35151d84 7762 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 7763 nft_trans_destroy(trans);
7764 break;
7765 case NFT_MSG_DELTABLE:
f2a6d766 7766 list_del_rcu(&trans->ctx.table->list);
35151d84 7767 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 7768 break;
91c7b38d 7769 case NFT_MSG_NEWCHAIN:
9f8aac0b 7770 if (nft_trans_chain_update(trans)) {
91c7b38d 7771 nft_chain_commit_update(trans);
9f8aac0b
FW		 7772 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7773 /* trans destroyed after rcu grace period */
7774 } else {
66293c46 7775 nft_chain_commit_drop_policy(trans);
664b0f8c 7776 nft_clear(net, trans->ctx.chain);
9f8aac0b
FW		 7777 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7778 nft_trans_destroy(trans);
7779 }
91c7b38d
PNA		 7780 break;
7781 case NFT_MSG_DELCHAIN:
1b2470e5 7782 nft_chain_del(trans->ctx.chain);
35151d84 7783 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 7784 nf_tables_unregister_hook(trans->ctx.net,
7785 trans->ctx.table,
7786 trans->ctx.chain);
91c7b38d 7787 break;
b380e5c7 7788 case NFT_MSG_NEWRULE:
889f7ee7 7789 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 7790 nf_tables_rule_notify(&trans->ctx,
37082f93 7791 nft_trans_rule(trans),
35151d84 7792 NFT_MSG_NEWRULE);
37082f93 7793 nft_trans_destroy(trans);
b380e5c7
PNA		 7794 break;
7795 case NFT_MSG_DELRULE:
7796 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 7797 nf_tables_rule_notify(&trans->ctx,
7798 nft_trans_rule(trans),
7799 NFT_MSG_DELRULE);
f6ac8585
PNA		 7800 nft_rule_expr_deactivate(&trans->ctx,
7801 nft_trans_rule(trans),
7802 NFT_TRANS_COMMIT);
b380e5c7 7803 break;
958bee14 7804 case NFT_MSG_NEWSET:
37a9cc52 7805 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 7806 /* This avoids hitting -EBUSY when deleting the table
7807 * from the transaction.
7808 */
408070d6 7809 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 7810 !list_empty(&nft_trans_set(trans)->bindings))
7811 trans->ctx.table->use--;
7812
958bee14 7813 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 7814 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 7815 nft_trans_destroy(trans);
7816 break;
7817 case NFT_MSG_DELSET:
37a9cc52 7818 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 7819 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 7820 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 7821 break;
60319eb1 7822 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 7823 te = (struct nft_trans_elem *)trans->data;
7824
42a55769 7825 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 7826 nf_tables_setelem_notify(&trans->ctx, te->set,
7827 &te->elem,
60319eb1
PNA		 7828 NFT_MSG_NEWSETELEM, 0);
7829 nft_trans_destroy(trans);
7830 break;
7831 case NFT_MSG_DELSETELEM:
a3716e70 7832 te = (struct nft_trans_elem *)trans->data;
fe2811eb 7833
a3716e70
PNA		 7834 nf_tables_setelem_notify(&trans->ctx, te->set,
7835 &te->elem,
60319eb1 7836 NFT_MSG_DELSETELEM, 0);
5cb82a38 7837 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 7838 atomic_dec(&te->set->nelems);
7839 te->set->ndeact--;
60319eb1 7840 break;
e5009240 7841 case NFT_MSG_NEWOBJ:
d62d0ba9
FFM		 7842 if (nft_trans_obj_update(trans)) {
7843 nft_obj_commit_update(trans);
7844 nf_tables_obj_notify(&trans->ctx,
7845 nft_trans_obj(trans),
7846 NFT_MSG_NEWOBJ);
7847 } else {
7848 nft_clear(net, nft_trans_obj(trans));
7849 nf_tables_obj_notify(&trans->ctx,
7850 nft_trans_obj(trans),
7851 NFT_MSG_NEWOBJ);
7852 nft_trans_destroy(trans);
7853 }
e5009240
PNA		 7854 break;
7855 case NFT_MSG_DELOBJ:
d152159b 7856 nft_obj_del(nft_trans_obj(trans));
e5009240
PNA		 7857 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
7858 NFT_MSG_DELOBJ);
7859 break;
3b49e2e9 7860 case NFT_MSG_NEWFLOWTABLE:
78d9f48f
PNA		 7861 if (nft_trans_flowtable_update(trans)) {
7862 nf_tables_flowtable_notify(&trans->ctx,
7863 nft_trans_flowtable(trans),
7864 &nft_trans_flowtable_hooks(trans),
7865 NFT_MSG_NEWFLOWTABLE);
7866 list_splice(&nft_trans_flowtable_hooks(trans),
7867 &nft_trans_flowtable(trans)->hook_list);
7868 } else {
7869 nft_clear(net, nft_trans_flowtable(trans));
7870 nf_tables_flowtable_notify(&trans->ctx,
7871 nft_trans_flowtable(trans),
7872 &nft_trans_flowtable(trans)->hook_list,
7873 NFT_MSG_NEWFLOWTABLE);
7874 }
3b49e2e9
PNA		 7875 nft_trans_destroy(trans);
7876 break;
7877 case NFT_MSG_DELFLOWTABLE:
abadb2f8
PNA		 7878 if (nft_trans_flowtable_update(trans)) {
7879 nft_flowtable_hooks_del(nft_trans_flowtable(trans),
7880 &nft_trans_flowtable_hooks(trans));
7881 nf_tables_flowtable_notify(&trans->ctx,
7882 nft_trans_flowtable(trans),
7883 &nft_trans_flowtable_hooks(trans),
7884 NFT_MSG_DELFLOWTABLE);
7885 nft_unregister_flowtable_net_hooks(net,
7886 &nft_trans_flowtable_hooks(trans));
7887 } else {
7888 list_del_rcu(&nft_trans_flowtable(trans)->list);
7889 nf_tables_flowtable_notify(&trans->ctx,
7890 nft_trans_flowtable(trans),
7891 &nft_trans_flowtable(trans)->hook_list,
7892 NFT_MSG_DELFLOWTABLE);
7893 nft_unregister_flowtable_net_hooks(net,
7894 &nft_trans_flowtable(trans)->hook_list);
7895 }
3b49e2e9 7896 break;
37082f93 7897 }
37082f93
PNA		 7898 }
7899
84d7fce6 7900 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
0935d558 7901 nf_tables_commit_release(net);
37082f93
PNA		 7902
7903 return 0;
7904}
7905
eb014de4
PNA		 7906static void nf_tables_module_autoload(struct net *net)
7907{
7908 struct nft_module_request *req, *next;
7909 LIST_HEAD(module_list);
7910
7911 list_splice_init(&net->nft.module_list, &module_list);
7912 mutex_unlock(&net->nft.commit_mutex);
7913 list_for_each_entry_safe(req, next, &module_list, list) {
1d305ba4
FW		 7914 request_module("%s", req->module);
7915 req->done = true;
eb014de4
PNA		 7916 }
7917 mutex_lock(&net->nft.commit_mutex);
7918 list_splice(&module_list, &net->nft.module_list);
7919}
7920
b326dd37 7921static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 7922{
c7c32e72
PNA		 7923 switch (trans->msg_type) {
7924 case NFT_MSG_NEWTABLE:
7925 nf_tables_table_destroy(&trans->ctx);
7926 break;
7927 case NFT_MSG_NEWCHAIN:
43a605f2 7928 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 7929 break;
7930 case NFT_MSG_NEWRULE:
7931 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
7932 break;
7933 case NFT_MSG_NEWSET:
0c2a85ed 7934 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
c7c32e72 7935 break;
61edafbb
PM		 7936 case NFT_MSG_NEWSETELEM:
7937 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 7938 nft_trans_elem(trans).priv, true);
61edafbb 7939 break;
e5009240 7940 case NFT_MSG_NEWOBJ:
00bfb320 7941 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 7942 break;
3b49e2e9 7943 case NFT_MSG_NEWFLOWTABLE:
78d9f48f
PNA		 7944 if (nft_trans_flowtable_update(trans))
7945 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
7946 else
7947 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
3b49e2e9 7948 break;
c7c32e72
PNA		 7949 }
7950 kfree(trans);
7951}
7952
eb014de4 7953static int __nf_tables_abort(struct net *net, bool autoload)
37082f93 7954{
37082f93 7955 struct nft_trans *trans, *next;
02263db0 7956 struct nft_trans_elem *te;
abadb2f8 7957 struct nft_hook *hook;
37082f93 7958
a907e36d
XL		 7959 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
7960 list) {
b380e5c7 7961 switch (trans->msg_type) {
55dd6f93
PNA		 7962 case NFT_MSG_NEWTABLE:
7963 if (nft_trans_table_update(trans)) {
7964 if (nft_trans_table_enable(trans)) {
664b0f8c 7965 nf_tables_table_disable(net,
55dd6f93
PNA		 7966 trans->ctx.table);
7967 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7968 }
7969 nft_trans_destroy(trans);
7970 } else {
e688a7f8 7971 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 7972 }
7973 break;
7974 case NFT_MSG_DELTABLE:
f2a6d766 7975 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 7976 nft_trans_destroy(trans);
7977 break;
91c7b38d
PNA		 7978 case NFT_MSG_NEWCHAIN:
7979 if (nft_trans_chain_update(trans)) {
982f4051 7980 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b 7981 kfree(nft_trans_chain_name(trans));
91c7b38d
PNA		 7982 nft_trans_destroy(trans);
7983 } else {
d0e2c7de
PNA		 7984 if (nft_chain_is_bound(trans->ctx.chain)) {
7985 nft_trans_destroy(trans);
7986 break;
7987 }
4fefee57 7988 trans->ctx.table->use--;
1b2470e5 7989 nft_chain_del(trans->ctx.chain);
c974a3a3
PNA		 7990 nf_tables_unregister_hook(trans->ctx.net,
7991 trans->ctx.table,
7992 trans->ctx.chain);
91c7b38d
PNA		 7993 }
7994 break;
7995 case NFT_MSG_DELCHAIN:
4fefee57 7996 trans->ctx.table->use++;
664b0f8c 7997 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 7998 nft_trans_destroy(trans);
7999 break;
b380e5c7 8000 case NFT_MSG_NEWRULE:
4fefee57 8001 trans->ctx.chain->use--;
b380e5c7 8002 list_del_rcu(&nft_trans_rule(trans)->list);
f6ac8585
PNA		 8003 nft_rule_expr_deactivate(&trans->ctx,
8004 nft_trans_rule(trans),
8005 NFT_TRANS_ABORT);
b380e5c7
PNA		 8006 break;
8007 case NFT_MSG_DELRULE:
4fefee57 8008 trans->ctx.chain->use++;
889f7ee7 8009 nft_clear(trans->ctx.net, nft_trans_rule(trans));
bb7b40ae 8010 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
37082f93 8011 nft_trans_destroy(trans);
b380e5c7 8012 break;
958bee14 8013 case NFT_MSG_NEWSET:
4fefee57 8014 trans->ctx.table->use--;
6a0a8d10 8015 if (nft_trans_set_bound(trans)) {
40ba1d9b
PNA		 8016 nft_trans_destroy(trans);
8017 break;
8018 }
8019 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 8020 break;
8021 case NFT_MSG_DELSET:
4fefee57 8022 trans->ctx.table->use++;
37a9cc52 8023 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 8024 nft_trans_destroy(trans);
8025 break;
60319eb1 8026 case NFT_MSG_NEWSETELEM:
6a0a8d10 8027 if (nft_trans_elem_set_bound(trans)) {
40ba1d9b
PNA		 8028 nft_trans_destroy(trans);
8029 break;
8030 }
02263db0 8031 te = (struct nft_trans_elem *)trans->data;
5cb82a38 8032 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 8033 atomic_dec(&te->set->nelems);
60319eb1
PNA		 8034 break;
8035 case NFT_MSG_DELSETELEM:
cc02e457
PM		 8036 te = (struct nft_trans_elem *)trans->data;
8037
59105446 8038 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 8039 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 8040 te->set->ndeact--;
cc02e457 8041
e5009240
PNA		 8042 nft_trans_destroy(trans);
8043 break;
8044 case NFT_MSG_NEWOBJ:
d62d0ba9
FFM		 8045 if (nft_trans_obj_update(trans)) {
8046 kfree(nft_trans_obj_newobj(trans));
8047 nft_trans_destroy(trans);
8048 } else {
8049 trans->ctx.table->use--;
8050 nft_obj_del(nft_trans_obj(trans));
8051 }
e5009240
PNA		 8052 break;
8053 case NFT_MSG_DELOBJ:
8054 trans->ctx.table->use++;
8055 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 8056 nft_trans_destroy(trans);
8057 break;
3b49e2e9 8058 case NFT_MSG_NEWFLOWTABLE:
78d9f48f
PNA		 8059 if (nft_trans_flowtable_update(trans)) {
8060 nft_unregister_flowtable_net_hooks(net,
8061 &nft_trans_flowtable_hooks(trans));
8062 } else {
8063 trans->ctx.table->use--;
8064 list_del_rcu(&nft_trans_flowtable(trans)->list);
8065 nft_unregister_flowtable_net_hooks(net,
8066 &nft_trans_flowtable(trans)->hook_list);
8067 }
3b49e2e9
PNA		 8068 break;
8069 case NFT_MSG_DELFLOWTABLE:
abadb2f8
PNA		 8070 if (nft_trans_flowtable_update(trans)) {
8071 list_for_each_entry(hook, &nft_trans_flowtable(trans)->hook_list, list)
8072 hook->inactive = false;
8073 } else {
8074 trans->ctx.table->use++;
8075 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
8076 }
3b49e2e9
PNA		 8077 nft_trans_destroy(trans);
8078 break;
37082f93 8079 }
37082f93
PNA		 8080 }
8081
b326dd37
PNA		 8082 synchronize_rcu();
8083
a1cee076
PNA		 8084 list_for_each_entry_safe_reverse(trans, next,
8085 &net->nft.commit_list, list) {
c7c32e72 8086 list_del(&trans->list);
b326dd37 8087 nf_tables_abort_release(trans);
37082f93
PNA		 8088 }
8089
eb014de4
PNA		 8090 if (autoload)
8091 nf_tables_module_autoload(net);
8092 else
8093 nf_tables_module_autoload_cleanup(net);
8094
37082f93
PNA		 8095 return 0;
8096}
8097
a654de8f
PNA		 8098static void nf_tables_cleanup(struct net *net)
8099{
8100 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
8101}
8102
eb014de4 8103static int nf_tables_abort(struct net *net, struct sk_buff *skb, bool autoload)
71ad00c5 8104{
eb014de4 8105 int ret = __nf_tables_abort(net, autoload);
f102d66b
FW		 8106
8107 mutex_unlock(&net->nft.commit_mutex);
8108
8109 return ret;
71ad00c5
FW		 8110}
8111
74e8bcd2
PNA		 8112static bool nf_tables_valid_genid(struct net *net, u32 genid)
8113{
f102d66b
FW		 8114 bool genid_ok;
8115
8116 mutex_lock(&net->nft.commit_mutex);
8117
8118 genid_ok = genid == 0 || net->nft.base_seq == genid;
8119 if (!genid_ok)
8120 mutex_unlock(&net->nft.commit_mutex);
8121
8122 /* else, commit mutex has to be released by commit or abort function */
8123 return genid_ok;
74e8bcd2
PNA		 8124}
8125
96518518
PM		 8126static const struct nfnetlink_subsystem nf_tables_subsys = {
8127 .name = "nf_tables",
8128 .subsys_id = NFNL_SUBSYS_NFTABLES,
8129 .cb_count = NFT_MSG_MAX,
8130 .cb = nf_tables_cb,
0628b123
PNA		 8131 .commit = nf_tables_commit,
8132 .abort = nf_tables_abort,
a654de8f 8133 .cleanup = nf_tables_cleanup,
74e8bcd2 8134 .valid_genid = nf_tables_valid_genid,
be2ab5b4 8135 .owner = THIS_MODULE,
96518518
PM		 8136};
8137
7210e4e3 8138int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 8139 enum nft_chain_types type)
7210e4e3
PNA		 8140{
8141 const struct nft_base_chain *basechain;
8142
f323d954 8143 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 8144 basechain = nft_base_chain(chain);
8145 if (basechain->type->type != type)
8146 return -EOPNOTSUPP;
8147 }
8148 return 0;
8149}
8150EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
8151
75e8d06d
PNA		 8152int nft_chain_validate_hooks(const struct nft_chain *chain,
8153 unsigned int hook_flags)
8154{
8155 struct nft_base_chain *basechain;
8156
f323d954 8157 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 8158 basechain = nft_base_chain(chain);
8159
c974a3a3 8160 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 8161 return 0;
8162
8163 return -EOPNOTSUPP;
8164 }
8165
8166 return 0;
8167}
8168EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
8169
20a69341
PM		 8170/*
8171 * Loop detection - walk through the ruleset beginning at the destination chain
8172 * of a new jump until either the source chain is reached (loop) or all
8173 * reachable chains have been traversed.
8174 *
8175 * The loop check is performed whenever a new jump verdict is added to an
8176 * expression or verdict map or a verdict map is bound to a new chain.
8177 */
8178
8179static int nf_tables_check_loops(const struct nft_ctx *ctx,
8180 const struct nft_chain *chain);
8181
8182static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 8183 struct nft_set *set,
20a69341 8184 const struct nft_set_iter *iter,
de70185d 8185 struct nft_set_elem *elem)
20a69341 8186{
fe2811eb
PM		 8187 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
8188 const struct nft_data *data;
8189
8190 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
8191 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 8192 return 0;
8193
fe2811eb 8194 data = nft_set_ext_data(ext);
1ca2e170 8195 switch (data->verdict.code) {
20a69341
PM		 8196 case NFT_JUMP:
8197 case NFT_GOTO:
1ca2e170 8198 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 8199 default:
8200 return 0;
8201 }
8202}
8203
8204static int nf_tables_check_loops(const struct nft_ctx *ctx,
8205 const struct nft_chain *chain)
8206{
8207 const struct nft_rule *rule;
8208 const struct nft_expr *expr, *last;
de70185d 8209 struct nft_set *set;
20a69341
PM		 8210 struct nft_set_binding *binding;
8211 struct nft_set_iter iter;
20a69341
PM		 8212
8213 if (ctx->chain == chain)
8214 return -ELOOP;
8215
8216 list_for_each_entry(rule, &chain->rules, list) {
8217 nft_rule_for_each_expr(expr, last, rule) {
a654de8f
PNA		 8218 struct nft_immediate_expr *priv;
8219 const struct nft_data *data;
0ca743a5
PNA		 8220 int err;
8221
a654de8f 8222 if (strcmp(expr->ops->type->name, "immediate"))
20a69341
PM		 8223 continue;
8224
a654de8f
PNA		 8225 priv = nft_expr_priv(expr);
8226 if (priv->dreg != NFT_REG_VERDICT)
0ca743a5 8227 continue;
20a69341 8228
a654de8f 8229 data = &priv->data;
1ca2e170 8230 switch (data->verdict.code) {
20a69341
PM		 8231 case NFT_JUMP:
8232 case NFT_GOTO:
1ca2e170
PM		 8233 err = nf_tables_check_loops(ctx,
8234 data->verdict.chain);
20a69341
PM		 8235 if (err < 0)
8236 return err;
8237 default:
8238 break;
8239 }
8240 }
8241 }
8242
8243 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 8244 if (!nft_is_active_next(ctx->net, set))
8245 continue;
20a69341
PM		 8246 if (!(set->flags & NFT_SET_MAP) ||
8247 set->dtype != NFT_DATA_VERDICT)
8248 continue;
8249
8250 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 8251 if (!(binding->flags & NFT_SET_MAP) ||
8252 binding->chain != chain)
20a69341
PM		 8253 continue;
8254
8588ac09 8255 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 8256 iter.skip = 0;
8257 iter.count = 0;
8258 iter.err = 0;
8259 iter.fn = nf_tables_loop_check_setelem;
8260
8261 set->ops->walk(ctx, set, &iter);
8262 if (iter.err < 0)
8263 return iter.err;
8264 }
8265 }
8266
8267 return 0;
8268}
8269
36b701fa
LGL		 8270/**
8271 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
8272 *
8273 * @attr: netlink attribute to fetch value from
8274 * @max: maximum value to be stored in dest
8275 * @dest: pointer to the variable
8276 *
8277 * Parse, check and store a given u32 netlink attribute into variable.
8278 * This function returns -ERANGE if the value goes over maximum value.
8279 * Otherwise a 0 is returned and the attribute value is stored in the
8280 * destination variable.
8281 */
f1d505bb 8282int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 8283{
09525a09 8284 u32 val;
36b701fa
LGL		 8285
8286 val = ntohl(nla_get_be32(attr));
8287 if (val > max)
8288 return -ERANGE;
8289
8290 *dest = val;
8291 return 0;
8292}
8293EXPORT_SYMBOL_GPL(nft_parse_u32_check);
8294
49499c3e
PM		 8295/**
8296 * nft_parse_register - parse a register value from a netlink attribute
8297 *
8298 * @attr: netlink attribute
8299 *
8300 * Parse and translate a register value from a netlink attribute.
8301 * Registers used to be 128 bit wide, these register numbers will be
8302 * mapped to the corresponding 32 bit register numbers.
8303 */
b1c96ed3
PM		 8304unsigned int nft_parse_register(const struct nlattr *attr)
8305{
49499c3e
PM		 8306 unsigned int reg;
8307
8308 reg = ntohl(nla_get_be32(attr));
8309 switch (reg) {
8310 case NFT_REG_VERDICT...NFT_REG_4:
8311 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
8312 default:
8313 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
8314 }
b1c96ed3
PM		 8315}
8316EXPORT_SYMBOL_GPL(nft_parse_register);
8317
49499c3e
PM		 8318/**
8319 * nft_dump_register - dump a register value to a netlink attribute
8320 *
8321 * @skb: socket buffer
8322 * @attr: attribute number
8323 * @reg: register number
8324 *
8325 * Construct a netlink attribute containing the register number. For
8326 * compatibility reasons, register numbers being a multiple of 4 are
8327 * translated to the corresponding 128 bit register numbers.
8328 */
b1c96ed3
PM		 8329int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
8330{
49499c3e
PM		 8331 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
8332 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
8333 else
8334 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
8335
b1c96ed3
PM		 8336 return nla_put_be32(skb, attr, htonl(reg));
8337}
8338EXPORT_SYMBOL_GPL(nft_dump_register);
8339
96518518 8340/**
d07db988 8341 * nft_validate_register_load - validate a load from a register
96518518
PM		 8342 *
8343 * @reg: the register number
d07db988 8344 * @len: the length of the data
96518518
PM		 8345 *
8346 * Validate that the input register is one of the general purpose
d07db988 8347 * registers and that the length of the load is within the bounds.
96518518 8348 */
d07db988 8349int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 8350{
49499c3e 8351 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 8352 return -EINVAL;
d07db988
PM		 8353 if (len == 0)
8354 return -EINVAL;
c593642c 8355 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data))
d07db988 8356 return -ERANGE;
49499c3e 8357
96518518
PM		 8358 return 0;
8359}
d07db988 8360EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 8361
96518518 8362/**
1ec10212 8363 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 8364 *
8365 * @ctx: context of the expression performing the load
8366 * @reg: the destination register number
8367 * @data: the data to load
8368 * @type: the data type
45d9bcda 8369 * @len: the length of the data
96518518
PM		 8370 *
8371 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 8372 * the destination register and the length is within the bounds.
8373 * A value of NULL for the data means that its runtime gathered
58f40ab6 8374 * data.
96518518 8375 */
1ec10212
PM		 8376int nft_validate_register_store(const struct nft_ctx *ctx,
8377 enum nft_registers reg,
8378 const struct nft_data *data,
8379 enum nft_data_types type, unsigned int len)
96518518 8380{
20a69341
PM		 8381 int err;
8382
96518518
PM		 8383 switch (reg) {
8384 case NFT_REG_VERDICT:
58f40ab6 8385 if (type != NFT_DATA_VERDICT)
96518518 8386 return -EINVAL;
20a69341 8387
58f40ab6 8388 if (data != NULL &&
1ca2e170
PM		 8389 (data->verdict.code == NFT_GOTO ||
8390 data->verdict.code == NFT_JUMP)) {
8391 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 8392 if (err < 0)
8393 return err;
20a69341
PM		 8394 }
8395
96518518
PM		 8396 return 0;
8397 default:
49499c3e 8398 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 8399 return -EINVAL;
45d9bcda
PM		 8400 if (len == 0)
8401 return -EINVAL;
49499c3e 8402 if (reg * NFT_REG32_SIZE + len >
c593642c 8403 sizeof_field(struct nft_regs, data))
45d9bcda 8404 return -ERANGE;
27e6d201 8405
96518518
PM		 8406 if (data != NULL && type != NFT_DATA_VALUE)
8407 return -EINVAL;
8408 return 0;
8409 }
8410}
1ec10212 8411EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 8412
8413static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
8414 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
8415 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
8416 .len = NFT_CHAIN_MAXNAMELEN - 1 },
51d70f18 8417 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 },
96518518
PM		 8418};
8419
8420static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
8421 struct nft_data_desc *desc, const struct nlattr *nla)
8422{
664b0f8c 8423 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 8424 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
8425 struct nft_chain *chain;
8426 int err;
8427
8cb08174
JB		 8428 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
8429 nft_verdict_policy, NULL);
96518518
PM		 8430 if (err < 0)
8431 return err;
8432
8433 if (!tb[NFTA_VERDICT_CODE])
8434 return -EINVAL;
1ca2e170 8435 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 8436
1ca2e170 8437 switch (data->verdict.code) {
e0abdadc 8438 default:
1ca2e170 8439 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 8440 case NF_ACCEPT:
8441 case NF_DROP:
8442 case NF_QUEUE:
8443 break;
8444 default:
8445 return -EINVAL;
8446 }
954d8297 8447 fallthrough;
96518518
PM		 8448 case NFT_CONTINUE:
8449 case NFT_BREAK:
8450 case NFT_RETURN:
96518518
PM		 8451 break;
8452 case NFT_JUMP:
8453 case NFT_GOTO:
51d70f18
PNA		 8454 if (tb[NFTA_VERDICT_CHAIN]) {
8455 chain = nft_chain_lookup(ctx->net, ctx->table,
8456 tb[NFTA_VERDICT_CHAIN],
8457 genmask);
8458 } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
8459 chain = nft_chain_lookup_byid(ctx->net,
8460 tb[NFTA_VERDICT_CHAIN_ID]);
8461 if (IS_ERR(chain))
8462 return PTR_ERR(chain);
8463 } else {
96518518 8464 return -EINVAL;
51d70f18
PNA		 8465 }
8466
96518518
PM		 8467 if (IS_ERR(chain))
8468 return PTR_ERR(chain);
f323d954 8469 if (nft_is_base_chain(chain))
96518518
PM		 8470 return -EOPNOTSUPP;
8471
96518518 8472 chain->use++;
1ca2e170 8473 data->verdict.chain = chain;
96518518 8474 break;
96518518
PM		 8475 }
8476
4c4ed074 8477 desc->len = sizeof(data->verdict);
96518518
PM		 8478 desc->type = NFT_DATA_VERDICT;
8479 return 0;
8480}
8481
8482static void nft_verdict_uninit(const struct nft_data *data)
8483{
d0e2c7de
PNA		 8484 struct nft_chain *chain;
8485 struct nft_rule *rule;
8486
1ca2e170 8487 switch (data->verdict.code) {
96518518
PM		 8488 case NFT_JUMP:
8489 case NFT_GOTO:
d0e2c7de
PNA		 8490 chain = data->verdict.chain;
8491 chain->use--;
8492
8493 if (!nft_chain_is_bound(chain))
8494 break;
8495
8496 chain->table->use--;
8497 list_for_each_entry(rule, &chain->rules, list)
8498 chain->use--;
8499
8500 nft_chain_del(chain);
96518518
PM		 8501 break;
8502 }
8503}
8504
33d5a7b1 8505int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 8506{
8507 struct nlattr *nest;
8508
ae0be8de 8509 nest = nla_nest_start_noflag(skb, type);
96518518
PM		 8510 if (!nest)
8511 goto nla_put_failure;
8512
33d5a7b1 8513 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 8514 goto nla_put_failure;
8515
33d5a7b1 8516 switch (v->code) {
96518518
PM		 8517 case NFT_JUMP:
8518 case NFT_GOTO:
1ca2e170 8519 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 8520 v->chain->name))
96518518
PM		 8521 goto nla_put_failure;
8522 }
8523 nla_nest_end(skb, nest);
8524 return 0;
8525
8526nla_put_failure:
8527 return -1;
8528}
8529
d0a11fc3
PM		 8530static int nft_value_init(const struct nft_ctx *ctx,
8531 struct nft_data *data, unsigned int size,
96518518
PM		 8532 struct nft_data_desc *desc, const struct nlattr *nla)
8533{
8534 unsigned int len;
8535
8536 len = nla_len(nla);
8537 if (len == 0)
8538 return -EINVAL;
d0a11fc3 8539 if (len > size)
96518518
PM		 8540 return -EOVERFLOW;
8541
d0a11fc3 8542 nla_memcpy(data->data, nla, len);
96518518
PM		 8543 desc->type = NFT_DATA_VALUE;
8544 desc->len = len;
8545 return 0;
8546}
8547
8548static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
8549 unsigned int len)
8550{
8551 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
8552}
8553
8554static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 8555 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 8556 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
8557};
8558
8559/**
8560 * nft_data_init - parse nf_tables data netlink attributes
8561 *
8562 * @ctx: context of the expression using the data
8563 * @data: destination struct nft_data
d0a11fc3 8564 * @size: maximum data length
96518518
PM		 8565 * @desc: data description
8566 * @nla: netlink attribute containing data
8567 *
8568 * Parse the netlink data attributes and initialize a struct nft_data.
8569 * The type and length of data are returned in the data description.
8570 *
8571 * The caller can indicate that it only wants to accept data of type
8572 * NFT_DATA_VALUE by passing NULL for the ctx argument.
8573 */
d0a11fc3
PM		 8574int nft_data_init(const struct nft_ctx *ctx,
8575 struct nft_data *data, unsigned int size,
96518518
PM		 8576 struct nft_data_desc *desc, const struct nlattr *nla)
8577{
8578 struct nlattr *tb[NFTA_DATA_MAX + 1];
8579 int err;
8580
8cb08174
JB		 8581 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
8582 nft_data_policy, NULL);
96518518
PM		 8583 if (err < 0)
8584 return err;
8585
8586 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 8587 return nft_value_init(ctx, data, size, desc,
8588 tb[NFTA_DATA_VALUE]);
96518518
PM		 8589 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
8590 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
8591 return -EINVAL;
8592}
8593EXPORT_SYMBOL_GPL(nft_data_init);
8594
8595/**
59105446 8596 * nft_data_release - release a nft_data item
96518518
PM		 8597 *
8598 * @data: struct nft_data to release
8599 * @type: type of data
8600 *
8601 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
8602 * all others need to be released by calling this function.
8603 */
59105446 8604void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 8605{
960bd2c2 8606 if (type < NFT_DATA_VERDICT)
96518518 8607 return;
960bd2c2 8608 switch (type) {
96518518
PM		 8609 case NFT_DATA_VERDICT:
8610 return nft_verdict_uninit(data);
8611 default:
8612 WARN_ON(1);
8613 }
8614}
59105446 8615EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 8616
8617int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
8618 enum nft_data_types type, unsigned int len)
8619{
8620 struct nlattr *nest;
8621 int err;
8622
ae0be8de 8623 nest = nla_nest_start_noflag(skb, attr);
96518518
PM		 8624 if (nest == NULL)
8625 return -1;
8626
8627 switch (type) {
8628 case NFT_DATA_VALUE:
8629 err = nft_value_dump(skb, data, len);
8630 break;
8631 case NFT_DATA_VERDICT:
33d5a7b1 8632 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 8633 break;
8634 default:
8635 err = -EINVAL;
8636 WARN_ON(1);
8637 }
8638
8639 nla_nest_end(skb, nest);
8640 return err;
8641}
8642EXPORT_SYMBOL_GPL(nft_data_dump);
8643
5ebe0b0e
PNA		 8644int __nft_release_basechain(struct nft_ctx *ctx)
8645{
8646 struct nft_rule *rule, *nr;
8647
fa5950e4
FW		 8648 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
8649 return 0;
5ebe0b0e 8650
c974a3a3 8651 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 8652 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
8653 list_del(&rule->list);
8654 ctx->chain->use--;
bb7b40ae 8655 nf_tables_rule_release(ctx, rule);
5ebe0b0e 8656 }
1b2470e5 8657 nft_chain_del(ctx->chain);
5ebe0b0e 8658 ctx->table->use--;
43a605f2 8659 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 8660
8661 return 0;
8662}
8663EXPORT_SYMBOL_GPL(__nft_release_basechain);
8664
98319cb9 8665static void __nft_release_tables(struct net *net)
df05ef87 8666{
3b49e2e9 8667 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 8668 struct nft_table *table, *nt;
8669 struct nft_chain *chain, *nc;
e5009240 8670 struct nft_object *obj, *ne;
df05ef87
PNA		 8671 struct nft_rule *rule, *nr;
8672 struct nft_set *set, *ns;
8673 struct nft_ctx ctx = {
8674 .net = net,
43a605f2 8675 .family = NFPROTO_NETDEV,
df05ef87
PNA		 8676 };
8677
36596dad 8678 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 8679 ctx.family = table->family;
dd4cbef7 8680
df05ef87 8681 list_for_each_entry(chain, &table->chains, list)
c974a3a3 8682 nf_tables_unregister_hook(net, table, chain);
df05ef87
PNA		 8683 /* No packets are walking on these chains anymore. */
8684 ctx.table = table;
8685 list_for_each_entry(chain, &table->chains, list) {
8686 ctx.chain = chain;
8687 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
8688 list_del(&rule->list);
8689 chain->use--;
bb7b40ae 8690 nf_tables_rule_release(&ctx, rule);
df05ef87
PNA		 8691 }
8692 }
3b49e2e9
PNA		 8693 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
8694 list_del(&flowtable->list);
8695 table->use--;
8696 nf_tables_flowtable_destroy(flowtable);
8697 }
df05ef87
PNA		 8698 list_for_each_entry_safe(set, ns, &table->sets, list) {
8699 list_del(&set->list);
8700 table->use--;
0c2a85ed 8701 nft_set_destroy(&ctx, set);
df05ef87 8702 }
e5009240 8703 list_for_each_entry_safe(obj, ne, &table->objects, list) {
d152159b 8704 nft_obj_del(obj);
e5009240 8705 table->use--;
00bfb320 8706 nft_obj_destroy(&ctx, obj);
e5009240 8707 }
df05ef87 8708 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 8709 ctx.chain = chain;
1b2470e5 8710 nft_chain_del(chain);
df05ef87 8711 table->use--;
43a605f2 8712 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 8713 }
8714 list_del(&table->list);
8715 nf_tables_table_destroy(&ctx);
8716 }
8717}
8718
dd4cbef7
PNA		 8719static int __net_init nf_tables_init_net(struct net *net)
8720{
8721 INIT_LIST_HEAD(&net->nft.tables);
8722 INIT_LIST_HEAD(&net->nft.commit_list);
eb014de4 8723 INIT_LIST_HEAD(&net->nft.module_list);
f102d66b 8724 mutex_init(&net->nft.commit_mutex);
dd4cbef7 8725 net->nft.base_seq = 1;
a654de8f
PNA		 8726 net->nft.validate_state = NFT_VALIDATE_SKIP;
8727
dd4cbef7
PNA		 8728 return 0;
8729}
8730
8731static void __net_exit nf_tables_exit_net(struct net *net)
8732{
f102d66b 8733 mutex_lock(&net->nft.commit_mutex);
71ad00c5 8734 if (!list_empty(&net->nft.commit_list))
eb014de4 8735 __nf_tables_abort(net, false);
98319cb9 8736 __nft_release_tables(net);
f102d66b 8737 mutex_unlock(&net->nft.commit_mutex);
dd4cbef7 8738 WARN_ON_ONCE(!list_empty(&net->nft.tables));
1d305ba4 8739 WARN_ON_ONCE(!list_empty(&net->nft.module_list));
dd4cbef7
PNA		 8740}
8741
99633ab2
PNA		 8742static struct pernet_operations nf_tables_net_ops = {
8743 .init = nf_tables_init_net,
613d0776 8744 .exit = nf_tables_exit_net,
99633ab2
PNA		 8745};
8746
96518518
PM		 8747static int __init nf_tables_module_init(void)
8748{
8749 int err;
8750
0935d558 8751 spin_lock_init(&nf_tables_destroy_list_lock);
d209df3e
FW		 8752 err = register_pernet_subsys(&nf_tables_net_ops);
8753 if (err < 0)
8754 return err;
8755
8756 err = nft_chain_filter_init();
8757 if (err < 0)
8758 goto err1;
02c7b25e 8759
96518518
PM		 8760 err = nf_tables_core_module_init();
8761 if (err < 0)
d209df3e 8762 goto err2;
96518518 8763
d209df3e 8764 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
96518518 8765 if (err < 0)
d209df3e 8766 goto err3;
96518518 8767
4d44175a
FW		 8768 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
8769 if (err < 0)
8770 goto err4;
8771
06d392cb 8772 err = nft_offload_init();
8773 if (err < 0)
8774 goto err5;
8775
d209df3e
FW		 8776 /* must be last */
8777 err = nfnetlink_subsys_register(&nf_tables_subsys);
8778 if (err < 0)
06d392cb 8779 goto err6;
3b49e2e9 8780
c1deb065 8781 nft_chain_route_init();
3474a2c6 8782
d209df3e 8783 return err;
06d392cb 8784err6:
8785 nft_offload_exit();
4d44175a
FW		 8786err5:
8787 rhltable_destroy(&nft_objname_ht);
d209df3e
FW		 8788err4:
8789 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
8790err3:
96518518 8791 nf_tables_core_module_exit();
d209df3e
FW		 8792err2:
8793 nft_chain_filter_fini();
8794err1:
8795 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 8796 return err;
8797}
8798
8799static void __exit nf_tables_module_exit(void)
8800{
8801 nfnetlink_subsys_unregister(&nf_tables_subsys);
06d392cb 8802 nft_offload_exit();
3b49e2e9 8803 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
0a2cf5ee 8804 nft_chain_filter_fini();
c1deb065 8805 nft_chain_route_fini();
71ad00c5 8806 unregister_pernet_subsys(&nf_tables_net_ops);
0935d558 8807 cancel_work_sync(&trans_destroy_work);
1b1bc49c 8808 rcu_barrier();
4d44175a 8809 rhltable_destroy(&nft_objname_ht);
96518518 8810 nf_tables_core_module_exit();
96518518
PM		 8811}
8812
8813module_init(nf_tables_module_init);
8814module_exit(nf_tables_module_exit);
8815
8816MODULE_LICENSE("GPL");
8817MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
8818MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror