]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_tables: initial support for extended ACK reporting
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
96518518
PM		 17#include <linux/netfilter.h>
18#include <linux/netfilter/nfnetlink.h>
19#include <linux/netfilter/nf_tables.h>
3b49e2e9 20#include <net/netfilter/nf_flow_table.h>
96518518
PM		 21#include <net/netfilter/nf_tables_core.h>
22#include <net/netfilter/nf_tables.h>
99633ab2 23#include <net/net_namespace.h>
96518518
PM		 24#include <net/sock.h>
25
96518518 26static LIST_HEAD(nf_tables_expressions);
e5009240 27static LIST_HEAD(nf_tables_objects);
3b49e2e9 28static LIST_HEAD(nf_tables_flowtables);
3ecbfd65 29static u64 table_handle;
96518518 30
7c95f6d8 31static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 32 struct net *net,
7c95f6d8
PNA		 33 const struct sk_buff *skb,
34 const struct nlmsghdr *nlh,
36596dad 35 u8 family,
7c95f6d8
PNA		 36 struct nft_table *table,
37 struct nft_chain *chain,
38 const struct nlattr * const *nla)
39{
633c9a84 40 ctx->net = net;
36596dad 41 ctx->family = family;
128ad332
PNA		 42 ctx->table = table;
43 ctx->chain = chain;
44 ctx->nla = nla;
45 ctx->portid = NETLINK_CB(skb).portid;
46 ctx->report = nlmsg_report(nlh);
47 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 48}
49
8411b644
PNA		 50static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
51 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 52{
53 struct nft_trans *trans;
54
8411b644 55 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 56 if (trans == NULL)
57 return NULL;
58
b380e5c7 59 trans->msg_type = msg_type;
1081d11b
PNA		 60 trans->ctx = *ctx;
61
62 return trans;
63}
64
8411b644
PNA		 65static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
66 int msg_type, u32 size)
67{
68 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
69}
70
1081d11b
PNA		 71static void nft_trans_destroy(struct nft_trans *trans)
72{
73 list_del(&trans->list);
74 kfree(trans);
75}
76
ae6153b5
FW		 77/* removal requests are queued in the commit_list, but not acted upon
78 * until after all new rules are in place.
79 *
80 * Therefore, nf_register_net_hook(net, &nat_hook) runs before pending
81 * nf_unregister_net_hook().
82 *
83 * nf_register_net_hook thus fails if a nat hook is already in place
84 * even if the conflicting hook is about to be removed.
85 *
86 * If collision is detected, search commit_log for DELCHAIN matching
87 * the new nat hooknum; if we find one collision is temporary:
88 *
89 * Either transaction is aborted (new/colliding hook is removed), or
90 * transaction is committed (old hook is removed).
91 */
92static bool nf_tables_allow_nat_conflict(const struct net *net,
93 const struct nf_hook_ops *ops)
94{
95 const struct nft_trans *trans;
96 bool ret = false;
97
98 if (!ops->nat_hook)
99 return false;
100
101 list_for_each_entry(trans, &net->nft.commit_list, list) {
102 const struct nf_hook_ops *pending_ops;
103 const struct nft_chain *pending;
104
105 if (trans->msg_type != NFT_MSG_NEWCHAIN &&
106 trans->msg_type != NFT_MSG_DELCHAIN)
107 continue;
108
109 pending = trans->ctx.chain;
110 if (!nft_is_base_chain(pending))
111 continue;
112
113 pending_ops = &nft_base_chain(pending)->ops;
114 if (pending_ops->nat_hook &&
115 pending_ops->pf == ops->pf &&
116 pending_ops->hooknum == ops->hooknum) {
117 /* other hook registration already pending? */
118 if (trans->msg_type == NFT_MSG_NEWCHAIN)
119 return false;
120
121 ret = true;
122 }
123 }
124
125 return ret;
126}
127
c974a3a3
PNA		 128static int nf_tables_register_hook(struct net *net,
129 const struct nft_table *table,
130 struct nft_chain *chain)
d8ee8f7c 131{
ae6153b5
FW		 132 struct nf_hook_ops *ops;
133 int ret;
134
d8ee8f7c 135 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 136 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 137 return 0;
138
ae6153b5
FW		 139 ops = &nft_base_chain(chain)->ops;
140 ret = nf_register_net_hook(net, ops);
141 if (ret == -EBUSY && nf_tables_allow_nat_conflict(net, ops)) {
142 ops->nat_hook = false;
143 ret = nf_register_net_hook(net, ops);
144 ops->nat_hook = true;
145 }
146
147 return ret;
d8ee8f7c
PNA		 148}
149
c974a3a3
PNA		 150static void nf_tables_unregister_hook(struct net *net,
151 const struct nft_table *table,
152 struct nft_chain *chain)
c5598794 153{
d8ee8f7c 154 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 155 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 156 return;
157
c974a3a3 158 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
c5598794
AB		 159}
160
ee01d542
AB		 161static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
162{
163 struct nft_trans *trans;
164
165 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
166 if (trans == NULL)
167 return -ENOMEM;
168
169 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 170 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 171
172 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
173 return 0;
174}
175
176static int nft_deltable(struct nft_ctx *ctx)
177{
178 int err;
179
180 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
181 if (err < 0)
182 return err;
183
f2a6d766 184 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 185 return err;
186}
187
188static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
189{
190 struct nft_trans *trans;
191
192 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
193 if (trans == NULL)
194 return -ENOMEM;
195
196 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 197 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 198
199 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
200 return 0;
201}
202
203static int nft_delchain(struct nft_ctx *ctx)
204{
205 int err;
206
207 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
208 if (err < 0)
209 return err;
210
211 ctx->table->use--;
664b0f8c 212 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 213
214 return err;
215}
216
ee01d542
AB		 217static int
218nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
219{
220 /* You cannot delete the same rule twice */
889f7ee7
PNA		 221 if (nft_is_active_next(ctx->net, rule)) {
222 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 223 ctx->chain->use--;
224 return 0;
225 }
226 return -ENOENT;
227}
228
229static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
230 struct nft_rule *rule)
231{
232 struct nft_trans *trans;
233
234 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
235 if (trans == NULL)
236 return NULL;
237
1a94e38d
PNA		 238 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
239 nft_trans_rule_id(trans) =
240 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
241 }
ee01d542
AB		 242 nft_trans_rule(trans) = rule;
243 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
244
245 return trans;
246}
247
248static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
249{
250 struct nft_trans *trans;
251 int err;
252
253 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
254 if (trans == NULL)
255 return -ENOMEM;
256
257 err = nf_tables_delrule_deactivate(ctx, rule);
258 if (err < 0) {
259 nft_trans_destroy(trans);
260 return err;
261 }
262
263 return 0;
264}
265
266static int nft_delrule_by_chain(struct nft_ctx *ctx)
267{
268 struct nft_rule *rule;
269 int err;
270
271 list_for_each_entry(rule, &ctx->chain->rules, list) {
272 err = nft_delrule(ctx, rule);
273 if (err < 0)
274 return err;
275 }
276 return 0;
277}
278
ee01d542
AB		 279static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
280 struct nft_set *set)
281{
282 struct nft_trans *trans;
283
284 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
285 if (trans == NULL)
286 return -ENOMEM;
287
288 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
289 nft_trans_set_id(trans) =
290 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 291 nft_activate_next(ctx->net, set);
ee01d542
AB		 292 }
293 nft_trans_set(trans) = set;
294 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
295
296 return 0;
297}
298
299static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
300{
301 int err;
302
303 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
304 if (err < 0)
305 return err;
306
37a9cc52 307 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 308 ctx->table->use--;
309
310 return err;
311}
312
e5009240
PNA		 313static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
314 struct nft_object *obj)
315{
316 struct nft_trans *trans;
317
318 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
319 if (trans == NULL)
320 return -ENOMEM;
321
322 if (msg_type == NFT_MSG_NEWOBJ)
323 nft_activate_next(ctx->net, obj);
324
325 nft_trans_obj(trans) = obj;
326 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
327
328 return 0;
329}
330
331static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
332{
333 int err;
334
335 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
336 if (err < 0)
337 return err;
338
339 nft_deactivate_next(ctx->net, obj);
340 ctx->table->use--;
341
342 return err;
343}
344
3b49e2e9
PNA		 345static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
346 struct nft_flowtable *flowtable)
347{
348 struct nft_trans *trans;
349
350 trans = nft_trans_alloc(ctx, msg_type,
351 sizeof(struct nft_trans_flowtable));
352 if (trans == NULL)
353 return -ENOMEM;
354
355 if (msg_type == NFT_MSG_NEWFLOWTABLE)
356 nft_activate_next(ctx->net, flowtable);
357
358 nft_trans_flowtable(trans) = flowtable;
359 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
360
361 return 0;
362}
363
364static int nft_delflowtable(struct nft_ctx *ctx,
365 struct nft_flowtable *flowtable)
366{
367 int err;
368
369 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
370 if (err < 0)
371 return err;
372
373 nft_deactivate_next(ctx->net, flowtable);
374 ctx->table->use--;
375
376 return err;
377}
378
96518518
PM		 379/*
380 * Tables
381 */
382
36596dad 383static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 384 const struct nlattr *nla,
36596dad 385 u8 family, u8 genmask)
96518518
PM		 386{
387 struct nft_table *table;
388
cac20fcd
PNA		 389 if (nla == NULL)
390 return ERR_PTR(-EINVAL);
391
36596dad 392 list_for_each_entry(table, &net->nft.tables, list) {
f2a6d766 393 if (!nla_strcmp(nla, table->name) &&
98319cb9 394 table->family == family &&
f2a6d766 395 nft_active_genmask(table, genmask))
96518518
PM		 396 return table;
397 }
cac20fcd
PNA		 398
399 return ERR_PTR(-ENOENT);
96518518
PM		 400}
401
3ecbfd65
HS		 402static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
403 const struct nlattr *nla,
404 u8 genmask)
405{
406 struct nft_table *table;
407
408 list_for_each_entry(table, &net->nft.tables, list) {
409 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
410 nft_active_genmask(table, genmask))
411 return table;
412 }
3ecbfd65
HS		 413
414 return ERR_PTR(-ENOENT);
415}
416
96518518
PM		 417static inline u64 nf_tables_alloc_handle(struct nft_table *table)
418{
419 return ++table->hgenerator;
420}
421
32537e91 422static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 423
32537e91 424static const struct nft_chain_type *
1ea26cca 425__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 426{
427 int i;
428
baae3e62 429 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 430 if (chain_type[family][i] != NULL &&
431 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 432 return chain_type[family][i];
9370761c 433 }
baae3e62 434 return NULL;
9370761c
PNA		 435}
436
32537e91 437static const struct nft_chain_type *
1ea26cca 438nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload)
9370761c 439{
32537e91 440 const struct nft_chain_type *type;
9370761c 441
1ea26cca 442 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 443 if (type != NULL)
444 return type;
9370761c 445#ifdef CONFIG_MODULES
93b0806f 446 if (autoload) {
9370761c 447 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1ea26cca 448 request_module("nft-chain-%u-%.*s", family,
2fec6bb6 449 nla_len(nla), (const char *)nla_data(nla));
9370761c 450 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1ea26cca 451 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 452 if (type != NULL)
453 return ERR_PTR(-EAGAIN);
9370761c
PNA		 454 }
455#endif
93b0806f 456 return ERR_PTR(-ENOENT);
9370761c
PNA		 457}
458
96518518 459static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 460 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
461 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 462 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 463 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 464};
465
84d7fce6
PNA		 466static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
467 u32 portid, u32 seq, int event, u32 flags,
468 int family, const struct nft_table *table)
96518518
PM		 469{
470 struct nlmsghdr *nlh;
471 struct nfgenmsg *nfmsg;
472
dedb67c4 473 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 474 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
475 if (nlh == NULL)
476 goto nla_put_failure;
477
478 nfmsg = nlmsg_data(nlh);
479 nfmsg->nfgen_family = family;
480 nfmsg->version = NFNETLINK_V0;
84d7fce6 481 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 482
9ddf6323 483 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 484 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 485 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
486 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
487 NFTA_TABLE_PAD))
96518518
PM		 488 goto nla_put_failure;
489
053c095a
JB		 490 nlmsg_end(skb, nlh);
491 return 0;
96518518
PM		 492
493nla_put_failure:
494 nlmsg_trim(skb, nlh);
495 return -1;
496}
497
25e94a99 498static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 499{
500 struct sk_buff *skb;
96518518
PM		 501 int err;
502
128ad332
PNA		 503 if (!ctx->report &&
504 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 505 return;
96518518 506
96518518
PM		 507 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
508 if (skb == NULL)
509 goto err;
510
84d7fce6 511 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 512 event, 0, ctx->family, ctx->table);
96518518
PM		 513 if (err < 0) {
514 kfree_skb(skb);
515 goto err;
516 }
517
25e94a99
PNA		 518 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
519 ctx->report, GFP_KERNEL);
520 return;
96518518 521err:
25e94a99 522 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 523}
524
525static int nf_tables_dump_tables(struct sk_buff *skb,
526 struct netlink_callback *cb)
527{
528 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 529 const struct nft_table *table;
530 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 531 struct net *net = sock_net(skb->sk);
96518518
PM		 532 int family = nfmsg->nfgen_family;
533
e688a7f8 534 rcu_read_lock();
38e029f1
PNA		 535 cb->seq = net->nft.base_seq;
536
36596dad 537 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 538 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 539 continue;
540
36596dad
PNA		 541 if (idx < s_idx)
542 goto cont;
543 if (idx > s_idx)
544 memset(&cb->args[1], 0,
545 sizeof(cb->args) - sizeof(cb->args[0]));
546 if (!nft_is_active(net, table))
547 continue;
548 if (nf_tables_fill_table_info(skb, net,
549 NETLINK_CB(cb->skb).portid,
550 cb->nlh->nlmsg_seq,
551 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 552 table->family, table) < 0)
36596dad
PNA		 553 goto done;
554
555 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 556cont:
36596dad 557 idx++;
96518518
PM		 558 }
559done:
e688a7f8 560 rcu_read_unlock();
96518518
PM		 561 cb->args[0] = idx;
562 return skb->len;
563}
564
7b8002a1
PNA		 565static int nf_tables_gettable(struct net *net, struct sock *nlsk,
566 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 567 const struct nlattr * const nla[],
568 struct netlink_ext_ack *extack)
96518518
PM		 569{
570 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 571 u8 genmask = nft_genmask_cur(net);
96518518
PM		 572 const struct nft_table *table;
573 struct sk_buff *skb2;
574 int family = nfmsg->nfgen_family;
575 int err;
576
577 if (nlh->nlmsg_flags & NLM_F_DUMP) {
578 struct netlink_dump_control c = {
579 .dump = nf_tables_dump_tables,
580 };
581 return netlink_dump_start(nlsk, skb, nlh, &c);
582 }
583
cac20fcd 584 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 585 if (IS_ERR(table)) {
586 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 587 return PTR_ERR(table);
36dd1bcc 588 }
96518518
PM		 589
590 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
591 if (!skb2)
592 return -ENOMEM;
593
84d7fce6 594 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 595 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
596 family, table);
597 if (err < 0)
598 goto err;
599
600 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
601
602err:
603 kfree_skb(skb2);
604 return err;
605}
606
c9c17211 607static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 608{
609 struct nft_chain *chain;
610 u32 i = 0;
611
612 list_for_each_entry(chain, &table->chains, list) {
613 if (!nft_is_active_next(net, chain))
614 continue;
f323d954 615 if (!nft_is_base_chain(chain))
10435c11
F		 616 continue;
617
618 if (cnt && i++ == cnt)
619 break;
620
c974a3a3 621 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 622 }
623}
624
c9c17211 625static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 626{
627 struct nft_chain *chain;
628 int err, i = 0;
629
630 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 631 if (!nft_is_active_next(net, chain))
632 continue;
f323d954 633 if (!nft_is_base_chain(chain))
d2012975
PNA		 634 continue;
635
c974a3a3 636 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 637 if (err < 0)
638 goto err;
639
640 i++;
641 }
642 return 0;
643err:
10435c11 644 if (i)
c9c17211 645 nft_table_disable(net, table, i);
9ddf6323
PNA		 646 return err;
647}
648
c9c17211 649static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 650{
c9c17211 651 nft_table_disable(net, table, 0);
9ddf6323
PNA		 652}
653
e1aaca93 654static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 655{
55dd6f93 656 struct nft_trans *trans;
e1aaca93 657 u32 flags;
55dd6f93 658 int ret = 0;
9ddf6323 659
e1aaca93
PNA		 660 if (!ctx->nla[NFTA_TABLE_FLAGS])
661 return 0;
9ddf6323 662
e1aaca93
PNA		 663 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
664 if (flags & ~NFT_TABLE_F_DORMANT)
665 return -EINVAL;
666
63283dd2
PNA		 667 if (flags == ctx->table->flags)
668 return 0;
669
55dd6f93
PNA		 670 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
671 sizeof(struct nft_trans_table));
672 if (trans == NULL)
673 return -ENOMEM;
9ddf6323 674
e1aaca93
PNA		 675 if ((flags & NFT_TABLE_F_DORMANT) &&
676 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 677 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 678 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
679 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 680 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 681 if (ret >= 0) {
e1aaca93 682 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 683 nft_trans_table_enable(trans) = true;
9ddf6323 684 }
9ddf6323 685 }
e1aaca93
PNA		 686 if (ret < 0)
687 goto err;
9ddf6323 688
55dd6f93
PNA		 689 nft_trans_table_update(trans) = true;
690 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
691 return 0;
9ddf6323 692err:
55dd6f93 693 nft_trans_destroy(trans);
9ddf6323
PNA		 694 return ret;
695}
696
633c9a84
PNA		 697static int nf_tables_newtable(struct net *net, struct sock *nlsk,
698 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 699 const struct nlattr * const nla[],
700 struct netlink_ext_ack *extack)
96518518
PM		 701{
702 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 703 u8 genmask = nft_genmask_next(net);
96518518 704 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 705 const struct nlattr *attr;
706 struct nft_table *table;
c5c1f975 707 u32 flags = 0;
e1aaca93 708 struct nft_ctx ctx;
55dd6f93 709 int err;
96518518 710
36dd1bcc
PNA		 711 attr = nla[NFTA_TABLE_NAME];
712 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 713 if (IS_ERR(table)) {
714 if (PTR_ERR(table) != -ENOENT)
715 return PTR_ERR(table);
1a28ad74 716 } else {
36dd1bcc
PNA		 717 if (nlh->nlmsg_flags & NLM_F_EXCL) {
718 NL_SET_BAD_ATTR(extack, attr);
96518518 719 return -EEXIST;
36dd1bcc 720 }
96518518
PM		 721 if (nlh->nlmsg_flags & NLM_F_REPLACE)
722 return -EOPNOTSUPP;
e1aaca93 723
98319cb9 724 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 725 return nf_tables_updtable(&ctx);
96518518
PM		 726 }
727
c5c1f975
PM		 728 if (nla[NFTA_TABLE_FLAGS]) {
729 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
730 if (flags & ~NFT_TABLE_F_DORMANT)
731 return -EINVAL;
732 }
733
ffdb210e 734 err = -ENOMEM;
1cae565e 735 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 736 if (table == NULL)
98319cb9 737 goto err_kzalloc;
96518518 738
36dd1bcc 739 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 740 if (table->name == NULL)
98319cb9 741 goto err_strdup;
e46abbcc 742
96518518 743 INIT_LIST_HEAD(&table->chains);
20a69341 744 INIT_LIST_HEAD(&table->sets);
e5009240 745 INIT_LIST_HEAD(&table->objects);
3b49e2e9 746 INIT_LIST_HEAD(&table->flowtables);
98319cb9 747 table->family = family;
c5c1f975 748 table->flags = flags;
3ecbfd65 749 table->handle = ++table_handle;
9ddf6323 750
98319cb9 751 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 752 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 753 if (err < 0)
98319cb9 754 goto err_trans;
ffdb210e 755
36596dad 756 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 757 return 0;
98319cb9 758err_trans:
e46abbcc 759 kfree(table->name);
98319cb9 760err_strdup:
ffdb210e 761 kfree(table);
98319cb9 762err_kzalloc:
ffdb210e 763 return err;
96518518
PM		 764}
765
b9ac12ef
AB		 766static int nft_flush_table(struct nft_ctx *ctx)
767{
3b49e2e9 768 struct nft_flowtable *flowtable, *nft;
b9ac12ef 769 struct nft_chain *chain, *nc;
e5009240 770 struct nft_object *obj, *ne;
b9ac12ef 771 struct nft_set *set, *ns;
3b49e2e9 772 int err;
b9ac12ef 773
a2f18db0 774 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 775 if (!nft_is_active_next(ctx->net, chain))
776 continue;
777
b9ac12ef
AB		 778 ctx->chain = chain;
779
780 err = nft_delrule_by_chain(ctx);
781 if (err < 0)
782 goto out;
b9ac12ef
AB		 783 }
784
785 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 786 if (!nft_is_active_next(ctx->net, set))
787 continue;
788
408070d6 789 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 790 !list_empty(&set->bindings))
791 continue;
792
793 err = nft_delset(ctx, set);
794 if (err < 0)
795 goto out;
796 }
797
3b49e2e9
PNA		 798 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
799 err = nft_delflowtable(ctx, flowtable);
800 if (err < 0)
801 goto out;
802 }
803
e5009240
PNA		 804 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
805 err = nft_delobj(ctx, obj);
806 if (err < 0)
807 goto out;
808 }
809
a2f18db0 810 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 811 if (!nft_is_active_next(ctx->net, chain))
812 continue;
813
a2f18db0
PNA		 814 ctx->chain = chain;
815
816 err = nft_delchain(ctx);
817 if (err < 0)
818 goto out;
819 }
820
b9ac12ef
AB		 821 err = nft_deltable(ctx);
822out:
823 return err;
824}
825
826static int nft_flush(struct nft_ctx *ctx, int family)
827{
b9ac12ef
AB		 828 struct nft_table *table, *nt;
829 const struct nlattr * const *nla = ctx->nla;
830 int err = 0;
831
36596dad 832 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 833 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 834 continue;
835
98319cb9 836 ctx->family = table->family;
f2a6d766 837
36596dad
PNA		 838 if (!nft_is_active_next(ctx->net, table))
839 continue;
b9ac12ef 840
36596dad
PNA		 841 if (nla[NFTA_TABLE_NAME] &&
842 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
843 continue;
b9ac12ef 844
36596dad
PNA		 845 ctx->table = table;
846
847 err = nft_flush_table(ctx);
848 if (err < 0)
849 goto out;
b9ac12ef
AB		 850 }
851out:
852 return err;
853}
854
633c9a84
PNA		 855static int nf_tables_deltable(struct net *net, struct sock *nlsk,
856 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 857 const struct nlattr * const nla[],
858 struct netlink_ext_ack *extack)
96518518
PM		 859{
860 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 861 u8 genmask = nft_genmask_next(net);
ee01d542 862 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 863 const struct nlattr *attr;
864 struct nft_table *table;
55dd6f93 865 struct nft_ctx ctx;
96518518 866
36596dad 867 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 868 if (family == AF_UNSPEC ||
869 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 870 return nft_flush(&ctx, family);
871
36dd1bcc
PNA		 872 if (nla[NFTA_TABLE_HANDLE]) {
873 attr = nla[NFTA_TABLE_HANDLE];
874 table = nft_table_lookup_byhandle(net, attr, genmask);
875 } else {
876 attr = nla[NFTA_TABLE_NAME];
877 table = nft_table_lookup(net, attr, family, genmask);
878 }
3ecbfd65 879
36dd1bcc
PNA		 880 if (IS_ERR(table)) {
881 NL_SET_BAD_ATTR(extack, attr);
96518518 882 return PTR_ERR(table);
36dd1bcc 883 }
96518518 884
a8278400
PNA		 885 if (nlh->nlmsg_flags & NLM_F_NONREC &&
886 table->use > 0)
887 return -EBUSY;
888
98319cb9 889 ctx.family = family;
b9ac12ef 890 ctx.table = table;
55dd6f93 891
b9ac12ef 892 return nft_flush_table(&ctx);
96518518
PM		 893}
894
55dd6f93
PNA		 895static void nf_tables_table_destroy(struct nft_ctx *ctx)
896{
4fefee57
PNA		 897 BUG_ON(ctx->table->use > 0);
898
e46abbcc 899 kfree(ctx->table->name);
55dd6f93 900 kfree(ctx->table);
55dd6f93
PNA		 901}
902
cc07eeb0 903void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 904{
d8297d4f 905 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
cc07eeb0 906 return;
d8297d4f 907
96518518 908 nfnl_lock(NFNL_SUBSYS_NFTABLES);
cc07eeb0
PNA		 909 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
910 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
911 return;
96518518 912 }
9370761c 913 chain_type[ctype->family][ctype->type] = ctype;
96518518 914 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 915}
9370761c 916EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 917
32537e91 918void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 919{
96518518 920 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 921 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 922 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
923}
9370761c 924EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 925
926/*
927 * Chains
928 */
929
930static struct nft_chain *
cac20fcd 931nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 932{
933 struct nft_chain *chain;
934
935 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 936 if (chain->handle == handle &&
937 nft_active_genmask(chain, genmask))
96518518
PM		 938 return chain;
939 }
940
941 return ERR_PTR(-ENOENT);
942}
943
cac20fcd
PNA		 944static struct nft_chain *nft_chain_lookup(const struct nft_table *table,
945 const struct nlattr *nla, u8 genmask)
96518518
PM		 946{
947 struct nft_chain *chain;
948
949 if (nla == NULL)
950 return ERR_PTR(-EINVAL);
951
952 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 953 if (!nla_strcmp(nla, chain->name) &&
954 nft_active_genmask(chain, genmask))
96518518
PM		 955 return chain;
956 }
957
958 return ERR_PTR(-ENOENT);
959}
960
961static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 962 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
963 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 964 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
965 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
966 .len = NFT_CHAIN_MAXNAMELEN - 1 },
967 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 968 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 969 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 970 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 971};
972
973static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
974 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
975 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 976 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
977 .len = IFNAMSIZ - 1 },
96518518
PM		 978};
979
0ca743a5
PNA		 980static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
981{
982 struct nft_stats *cpu_stats, total;
983 struct nlattr *nest;
ce355e20
ED		 984 unsigned int seq;
985 u64 pkts, bytes;
0ca743a5
PNA		 986 int cpu;
987
988 memset(&total, 0, sizeof(total));
989 for_each_possible_cpu(cpu) {
990 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 991 do {
992 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
993 pkts = cpu_stats->pkts;
994 bytes = cpu_stats->bytes;
995 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
996 total.pkts += pkts;
997 total.bytes += bytes;
0ca743a5
PNA		 998 }
999 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1000 if (nest == NULL)
1001 goto nla_put_failure;
1002
b46f6ded
ND		 1003 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1004 NFTA_COUNTER_PAD) ||
1005 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1006 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1007 goto nla_put_failure;
1008
1009 nla_nest_end(skb, nest);
1010 return 0;
1011
1012nla_put_failure:
1013 return -ENOSPC;
1014}
1015
84d7fce6
PNA		 1016static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1017 u32 portid, u32 seq, int event, u32 flags,
1018 int family, const struct nft_table *table,
96518518
PM		 1019 const struct nft_chain *chain)
1020{
1021 struct nlmsghdr *nlh;
1022 struct nfgenmsg *nfmsg;
1023
dedb67c4 1024 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1025 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1026 if (nlh == NULL)
1027 goto nla_put_failure;
1028
1029 nfmsg = nlmsg_data(nlh);
1030 nfmsg->nfgen_family = family;
1031 nfmsg->version = NFNETLINK_V0;
84d7fce6 1032 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1033
1034 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1035 goto nla_put_failure;
b46f6ded
ND		 1036 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1037 NFTA_CHAIN_PAD))
96518518
PM		 1038 goto nla_put_failure;
1039 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1040 goto nla_put_failure;
1041
f323d954 1042 if (nft_is_base_chain(chain)) {
0ca743a5 1043 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1044 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1045 struct nlattr *nest;
1046
1047 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1048 if (nest == NULL)
1049 goto nla_put_failure;
1050 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1051 goto nla_put_failure;
1052 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1053 goto nla_put_failure;
2cbce139
PNA		 1054 if (basechain->dev_name[0] &&
1055 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1056 goto nla_put_failure;
96518518 1057 nla_nest_end(skb, nest);
9370761c 1058
0ca743a5
PNA		 1059 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1060 htonl(basechain->policy)))
1061 goto nla_put_failure;
1062
baae3e62
PM		 1063 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1064 goto nla_put_failure;
0ca743a5 1065
5f9bfe0e 1066 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
0ca743a5 1067 goto nla_put_failure;
96518518
PM		 1068 }
1069
0ca743a5
PNA		 1070 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1071 goto nla_put_failure;
1072
053c095a
JB		 1073 nlmsg_end(skb, nlh);
1074 return 0;
96518518
PM		 1075
1076nla_put_failure:
1077 nlmsg_trim(skb, nlh);
1078 return -1;
1079}
1080
25e94a99 1081static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1082{
1083 struct sk_buff *skb;
96518518
PM		 1084 int err;
1085
128ad332
PNA		 1086 if (!ctx->report &&
1087 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1088 return;
96518518 1089
96518518
PM		 1090 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1091 if (skb == NULL)
1092 goto err;
1093
84d7fce6 1094 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1095 event, 0, ctx->family, ctx->table,
35151d84 1096 ctx->chain);
96518518
PM		 1097 if (err < 0) {
1098 kfree_skb(skb);
1099 goto err;
1100 }
1101
25e94a99
PNA		 1102 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1103 ctx->report, GFP_KERNEL);
1104 return;
96518518 1105err:
25e94a99 1106 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1107}
1108
1109static int nf_tables_dump_chains(struct sk_buff *skb,
1110 struct netlink_callback *cb)
1111{
1112 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1113 const struct nft_table *table;
1114 const struct nft_chain *chain;
1115 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1116 struct net *net = sock_net(skb->sk);
96518518
PM		 1117 int family = nfmsg->nfgen_family;
1118
e688a7f8 1119 rcu_read_lock();
38e029f1
PNA		 1120 cb->seq = net->nft.base_seq;
1121
36596dad 1122 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1123 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1124 continue;
1125
36596dad
PNA		 1126 list_for_each_entry_rcu(chain, &table->chains, list) {
1127 if (idx < s_idx)
1128 goto cont;
1129 if (idx > s_idx)
1130 memset(&cb->args[1], 0,
1131 sizeof(cb->args) - sizeof(cb->args[0]));
1132 if (!nft_is_active(net, chain))
1133 continue;
1134 if (nf_tables_fill_chain_info(skb, net,
1135 NETLINK_CB(cb->skb).portid,
1136 cb->nlh->nlmsg_seq,
1137 NFT_MSG_NEWCHAIN,
1138 NLM_F_MULTI,
98319cb9 1139 table->family, table,
36596dad
PNA		 1140 chain) < 0)
1141 goto done;
38e029f1 1142
36596dad 1143 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1144cont:
36596dad 1145 idx++;
96518518
PM		 1146 }
1147 }
1148done:
e688a7f8 1149 rcu_read_unlock();
96518518
PM		 1150 cb->args[0] = idx;
1151 return skb->len;
1152}
1153
7b8002a1
PNA		 1154static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1155 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1156 const struct nlattr * const nla[],
1157 struct netlink_ext_ack *extack)
96518518
PM		 1158{
1159 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1160 u8 genmask = nft_genmask_cur(net);
96518518
PM		 1161 const struct nft_table *table;
1162 const struct nft_chain *chain;
1163 struct sk_buff *skb2;
1164 int family = nfmsg->nfgen_family;
1165 int err;
1166
1167 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1168 struct netlink_dump_control c = {
1169 .dump = nf_tables_dump_chains,
1170 };
1171 return netlink_dump_start(nlsk, skb, nlh, &c);
1172 }
1173
cac20fcd 1174 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1175 if (IS_ERR(table)) {
1176 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1177 return PTR_ERR(table);
36dd1bcc 1178 }
96518518 1179
cac20fcd 1180 chain = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1181 if (IS_ERR(chain)) {
1182 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1183 return PTR_ERR(chain);
36dd1bcc 1184 }
96518518
PM		 1185
1186 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1187 if (!skb2)
1188 return -ENOMEM;
1189
84d7fce6 1190 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1191 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1192 family, table, chain);
1193 if (err < 0)
1194 goto err;
1195
1196 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1197
1198err:
1199 kfree_skb(skb2);
1200 return err;
1201}
1202
0ca743a5
PNA		 1203static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1204 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1205 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1206};
1207
ff3cd7b3 1208static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1209{
1210 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1211 struct nft_stats __percpu *newstats;
1212 struct nft_stats *stats;
1213 int err;
1214
fceb6435
JB		 1215 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1216 NULL);
0ca743a5 1217 if (err < 0)
ff3cd7b3 1218 return ERR_PTR(err);
0ca743a5
PNA		 1219
1220 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1221 return ERR_PTR(-EINVAL);
0ca743a5 1222
ce355e20 1223 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1224 if (newstats == NULL)
ff3cd7b3 1225 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1226
1227 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1228 * are not exposed to userspace.
1229 */
e8781f70 1230 preempt_disable();
0ca743a5
PNA		 1231 stats = this_cpu_ptr(newstats);
1232 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1233 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1234 preempt_enable();
0ca743a5 1235
ff3cd7b3
PNA		 1236 return newstats;
1237}
1238
1239static void nft_chain_stats_replace(struct nft_base_chain *chain,
1240 struct nft_stats __percpu *newstats)
1241{
0befd061
PNA		 1242 struct nft_stats __percpu *oldstats;
1243
b88825de
PNA		 1244 if (newstats == NULL)
1245 return;
1246
0ca743a5 1247 if (chain->stats) {
0befd061 1248 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
0ca743a5
PNA		 1249 rcu_assign_pointer(chain->stats, newstats);
1250 synchronize_rcu();
1251 free_percpu(oldstats);
1252 } else
1253 rcu_assign_pointer(chain->stats, newstats);
0ca743a5
PNA		 1254}
1255
43a605f2 1256static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1257{
43a605f2
PNA		 1258 struct nft_chain *chain = ctx->chain;
1259
91c7b38d
PNA		 1260 BUG_ON(chain->use > 0);
1261
f323d954 1262 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1263 struct nft_base_chain *basechain = nft_base_chain(chain);
1264
43a605f2
PNA		 1265 if (basechain->type->free)
1266 basechain->type->free(ctx);
2cbce139
PNA		 1267 module_put(basechain->type->owner);
1268 free_percpu(basechain->stats);
9f08ea84
PNA		 1269 if (basechain->stats)
1270 static_branch_dec(&nft_counters_enabled);
b7263e07 1271 kfree(chain->name);
2cbce139 1272 kfree(basechain);
91c7b38d 1273 } else {
b7263e07 1274 kfree(chain->name);
91c7b38d
PNA		 1275 kfree(chain);
1276 }
1277}
1278
508f8ccd
PNA		 1279struct nft_chain_hook {
1280 u32 num;
84ba7dd7 1281 s32 priority;
32537e91 1282 const struct nft_chain_type *type;
508f8ccd
PNA		 1283 struct net_device *dev;
1284};
1285
1286static int nft_chain_parse_hook(struct net *net,
1287 const struct nlattr * const nla[],
36596dad
PNA		 1288 struct nft_chain_hook *hook, u8 family,
1289 bool create)
508f8ccd
PNA		 1290{
1291 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1292 const struct nft_chain_type *type;
508f8ccd
PNA		 1293 struct net_device *dev;
1294 int err;
1295
1296 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1297 nft_hook_policy, NULL);
508f8ccd
PNA		 1298 if (err < 0)
1299 return err;
1300
1301 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1302 ha[NFTA_HOOK_PRIORITY] == NULL)
1303 return -EINVAL;
1304
1305 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1306 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1307
36596dad 1308 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1309 if (nla[NFTA_CHAIN_TYPE]) {
1ea26cca 1310 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
36596dad 1311 family, create);
508f8ccd
PNA		 1312 if (IS_ERR(type))
1313 return PTR_ERR(type);
1314 }
1315 if (!(type->hook_mask & (1 << hook->num)))
1316 return -EOPNOTSUPP;
84ba7dd7
FW		 1317
1318 if (type->type == NFT_CHAIN_T_NAT &&
1319 hook->priority <= NF_IP_PRI_CONNTRACK)
1320 return -EOPNOTSUPP;
1321
508f8ccd
PNA		 1322 if (!try_module_get(type->owner))
1323 return -ENOENT;
1324
1325 hook->type = type;
1326
1327 hook->dev = NULL;
36596dad 1328 if (family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1329 char ifname[IFNAMSIZ];
1330
1331 if (!ha[NFTA_HOOK_DEV]) {
1332 module_put(type->owner);
1333 return -EOPNOTSUPP;
1334 }
1335
1336 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
90d2723c 1337 dev = __dev_get_by_name(net, ifname);
508f8ccd
PNA		 1338 if (!dev) {
1339 module_put(type->owner);
1340 return -ENOENT;
1341 }
1342 hook->dev = dev;
1343 } else if (ha[NFTA_HOOK_DEV]) {
1344 module_put(type->owner);
1345 return -EOPNOTSUPP;
1346 }
1347
1348 return 0;
1349}
1350
1351static void nft_chain_release_hook(struct nft_chain_hook *hook)
1352{
1353 module_put(hook->type->owner);
508f8ccd
PNA		 1354}
1355
4035285f
PNA		 1356static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1357 u8 policy, bool create)
1358{
1359 const struct nlattr * const *nla = ctx->nla;
1360 struct nft_table *table = ctx->table;
4035285f
PNA		 1361 struct nft_base_chain *basechain;
1362 struct nft_stats __percpu *stats;
1363 struct net *net = ctx->net;
1364 struct nft_chain *chain;
4035285f
PNA		 1365 int err;
1366
1367 if (table->use == UINT_MAX)
1368 return -EOVERFLOW;
1369
1370 if (nla[NFTA_CHAIN_HOOK]) {
1371 struct nft_chain_hook hook;
1372 struct nf_hook_ops *ops;
4035285f 1373
36596dad 1374 err = nft_chain_parse_hook(net, nla, &hook, family, create);
4035285f
PNA		 1375 if (err < 0)
1376 return err;
1377
1378 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1379 if (basechain == NULL) {
1380 nft_chain_release_hook(&hook);
1381 return -ENOMEM;
1382 }
1383
1384 if (hook.dev != NULL)
1385 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1386
1387 if (nla[NFTA_CHAIN_COUNTERS]) {
1388 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1389 if (IS_ERR(stats)) {
1390 nft_chain_release_hook(&hook);
1391 kfree(basechain);
1392 return PTR_ERR(stats);
1393 }
1394 basechain->stats = stats;
1395 static_branch_inc(&nft_counters_enabled);
1396 }
1397
4035285f 1398 basechain->type = hook.type;
43a605f2
PNA		 1399 if (basechain->type->init)
1400 basechain->type->init(ctx);
1401
4035285f
PNA		 1402 chain = &basechain->chain;
1403
c974a3a3
PNA		 1404 ops = &basechain->ops;
1405 ops->pf = family;
1406 ops->hooknum = hook.num;
1407 ops->priority = hook.priority;
1408 ops->priv = chain;
c2f9eafe 1409 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1410 ops->dev = hook.dev;
c974a3a3
PNA		 1411
1412 if (basechain->type->type == NFT_CHAIN_T_NAT)
1413 ops->nat_hook = true;
4035285f
PNA		 1414
1415 chain->flags |= NFT_BASE_CHAIN;
1416 basechain->policy = policy;
1417 } else {
1418 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1419 if (chain == NULL)
1420 return -ENOMEM;
1421 }
43a605f2
PNA		 1422 ctx->chain = chain;
1423
4035285f
PNA		 1424 INIT_LIST_HEAD(&chain->rules);
1425 chain->handle = nf_tables_alloc_handle(table);
1426 chain->table = table;
1427 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1428 if (!chain->name) {
1429 err = -ENOMEM;
1430 goto err1;
1431 }
1432
c974a3a3 1433 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1434 if (err < 0)
1435 goto err1;
1436
4035285f
PNA		 1437 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1438 if (err < 0)
1439 goto err2;
1440
1441 table->use++;
1442 list_add_tail_rcu(&chain->list, &table->chains);
1443
1444 return 0;
1445err2:
c974a3a3 1446 nf_tables_unregister_hook(net, table, chain);
4035285f 1447err1:
43a605f2 1448 nf_tables_chain_destroy(ctx);
4035285f
PNA		 1449
1450 return err;
1451}
1452
2c4a488a
PNA		 1453static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1454 bool create)
1455{
1456 const struct nlattr * const *nla = ctx->nla;
1457 struct nft_table *table = ctx->table;
1458 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1459 struct nft_base_chain *basechain;
1460 struct nft_stats *stats = NULL;
1461 struct nft_chain_hook hook;
1462 const struct nlattr *name;
1463 struct nf_hook_ops *ops;
1464 struct nft_trans *trans;
c974a3a3 1465 int err;
2c4a488a
PNA		 1466
1467 if (nla[NFTA_CHAIN_HOOK]) {
1468 if (!nft_is_base_chain(chain))
1469 return -EBUSY;
1470
36596dad 1471 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
2c4a488a
PNA		 1472 create);
1473 if (err < 0)
1474 return err;
1475
1476 basechain = nft_base_chain(chain);
1477 if (basechain->type != hook.type) {
1478 nft_chain_release_hook(&hook);
1479 return -EBUSY;
1480 }
1481
c974a3a3
PNA		 1482 ops = &basechain->ops;
1483 if (ops->hooknum != hook.num ||
1484 ops->priority != hook.priority ||
1485 ops->dev != hook.dev) {
1486 nft_chain_release_hook(&hook);
1487 return -EBUSY;
2c4a488a
PNA		 1488 }
1489 nft_chain_release_hook(&hook);
1490 }
1491
1492 if (nla[NFTA_CHAIN_HANDLE] &&
1493 nla[NFTA_CHAIN_NAME]) {
1494 struct nft_chain *chain2;
1495
cac20fcd 1496 chain2 = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 1497 if (!IS_ERR(chain2))
1498 return -EEXIST;
2c4a488a
PNA		 1499 }
1500
1501 if (nla[NFTA_CHAIN_COUNTERS]) {
1502 if (!nft_is_base_chain(chain))
1503 return -EOPNOTSUPP;
1504
1505 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1506 if (IS_ERR(stats))
1507 return PTR_ERR(stats);
1508 }
1509
1510 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1511 sizeof(struct nft_trans_chain));
1512 if (trans == NULL) {
1513 free_percpu(stats);
1514 return -ENOMEM;
1515 }
1516
1517 nft_trans_chain_stats(trans) = stats;
1518 nft_trans_chain_update(trans) = true;
1519
1520 if (nla[NFTA_CHAIN_POLICY])
1521 nft_trans_chain_policy(trans) = policy;
1522 else
1523 nft_trans_chain_policy(trans) = -1;
1524
1525 name = nla[NFTA_CHAIN_NAME];
1526 if (nla[NFTA_CHAIN_HANDLE] && name) {
1527 nft_trans_chain_name(trans) =
1528 nla_strdup(name, GFP_KERNEL);
1529 if (!nft_trans_chain_name(trans)) {
1530 kfree(trans);
1531 free_percpu(stats);
1532 return -ENOMEM;
1533 }
1534 }
1535 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1536
1537 return 0;
1538}
1539
633c9a84
PNA		 1540static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1541 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1542 const struct nlattr * const nla[],
1543 struct netlink_ext_ack *extack)
96518518
PM		 1544{
1545 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 1546 u8 genmask = nft_genmask_next(net);
1547 int family = nfmsg->nfgen_family;
36dd1bcc 1548 const struct nlattr *attr;
96518518
PM		 1549 struct nft_table *table;
1550 struct nft_chain *chain;
57de2a0c 1551 u8 policy = NF_ACCEPT;
4035285f 1552 struct nft_ctx ctx;
96518518 1553 u64 handle = 0;
96518518
PM		 1554 bool create;
1555
1556 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1557
cac20fcd 1558 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1559 if (IS_ERR(table)) {
1560 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1561 return PTR_ERR(table);
36dd1bcc 1562 }
96518518 1563
96518518 1564 chain = NULL;
36dd1bcc 1565 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 1566
1567 if (nla[NFTA_CHAIN_HANDLE]) {
1568 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 1569 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 1570 if (IS_ERR(chain)) {
1571 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 1572 return PTR_ERR(chain);
36dd1bcc
PNA		 1573 }
1574 attr = nla[NFTA_CHAIN_HANDLE];
96518518 1575 } else {
36dd1bcc 1576 chain = nft_chain_lookup(table, attr, genmask);
96518518 1577 if (IS_ERR(chain)) {
36dd1bcc
PNA		 1578 if (PTR_ERR(chain) != -ENOENT) {
1579 NL_SET_BAD_ATTR(extack, attr);
96518518 1580 return PTR_ERR(chain);
36dd1bcc 1581 }
96518518
PM		 1582 chain = NULL;
1583 }
1584 }
1585
57de2a0c 1586 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 1587 if (chain != NULL &&
36dd1bcc
PNA		 1588 !nft_is_base_chain(chain)) {
1589 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 1590 return -EOPNOTSUPP;
36dd1bcc 1591 }
d6b6cb1d
PNA		 1592
1593 if (chain == NULL &&
36dd1bcc
PNA		 1594 nla[NFTA_CHAIN_HOOK] == NULL) {
1595 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 1596 return -EOPNOTSUPP;
36dd1bcc 1597 }
57de2a0c 1598
8f46df18 1599 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1600 switch (policy) {
1601 case NF_DROP:
1602 case NF_ACCEPT:
1603 break;
1604 default:
1605 return -EINVAL;
1606 }
1607 }
1608
98319cb9 1609 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 1610
96518518 1611 if (chain != NULL) {
36dd1bcc
PNA		 1612 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1613 NL_SET_BAD_ATTR(extack, attr);
96518518 1614 return -EEXIST;
36dd1bcc 1615 }
96518518
PM		 1616 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1617 return -EOPNOTSUPP;
1618
2c4a488a 1619 return nf_tables_updchain(&ctx, genmask, policy, create);
96518518
PM		 1620 }
1621
4035285f 1622 return nf_tables_addchain(&ctx, family, genmask, policy, create);
96518518
PM		 1623}
1624
633c9a84
PNA		 1625static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1626 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1627 const struct nlattr * const nla[],
1628 struct netlink_ext_ack *extack)
96518518
PM		 1629{
1630 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1631 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 1632 int family = nfmsg->nfgen_family;
1633 const struct nlattr *attr;
96518518
PM		 1634 struct nft_table *table;
1635 struct nft_chain *chain;
9dee1474 1636 struct nft_rule *rule;
91c7b38d 1637 struct nft_ctx ctx;
3ecbfd65 1638 u64 handle;
9dee1474
PNA		 1639 u32 use;
1640 int err;
96518518 1641
cac20fcd 1642 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1643 if (IS_ERR(table)) {
1644 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1645 return PTR_ERR(table);
36dd1bcc 1646 }
96518518 1647
3ecbfd65 1648 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 1649 attr = nla[NFTA_CHAIN_HANDLE];
1650 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 1651 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 1652 } else {
36dd1bcc
PNA		 1653 attr = nla[NFTA_CHAIN_NAME];
1654 chain = nft_chain_lookup(table, attr, genmask);
3ecbfd65 1655 }
36dd1bcc
PNA		 1656 if (IS_ERR(chain)) {
1657 NL_SET_BAD_ATTR(extack, attr);
96518518 1658 return PTR_ERR(chain);
36dd1bcc 1659 }
9dee1474
PNA		 1660
1661 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1662 chain->use > 0)
96518518
PM		 1663 return -EBUSY;
1664
98319cb9 1665 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 1666
9dee1474
PNA		 1667 use = chain->use;
1668 list_for_each_entry(rule, &chain->rules, list) {
1669 if (!nft_is_active_next(net, rule))
1670 continue;
1671 use--;
1672
1673 err = nft_delrule(&ctx, rule);
1674 if (err < 0)
1675 return err;
1676 }
1677
1678 /* There are rules and elements that are still holding references to us,
1679 * we cannot do a recursive removal in this case.
1680 */
36dd1bcc
PNA		 1681 if (use > 0) {
1682 NL_SET_BAD_ATTR(extack, attr);
9dee1474 1683 return -EBUSY;
36dd1bcc 1684 }
9dee1474 1685
ee01d542 1686 return nft_delchain(&ctx);
96518518
PM		 1687}
1688
96518518
PM		 1689/*
1690 * Expressions
1691 */
1692
1693/**
ef1f7df9
PM		 1694 * nft_register_expr - register nf_tables expr type
1695 * @ops: expr type
96518518 1696 *
ef1f7df9 1697 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1698 * success or a negative errno code otherwise.
1699 */
ef1f7df9 1700int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1701{
1702 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1703 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1704 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1705 else
e688a7f8 1706 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1707 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1708 return 0;
1709}
1710EXPORT_SYMBOL_GPL(nft_register_expr);
1711
1712/**
ef1f7df9
PM		 1713 * nft_unregister_expr - unregister nf_tables expr type
1714 * @ops: expr type
96518518 1715 *
ef1f7df9 1716 * Unregisters the expr typefor use with nf_tables.
96518518 1717 */
ef1f7df9 1718void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1719{
1720 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1721 list_del_rcu(&type->list);
96518518
PM		 1722 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1723}
1724EXPORT_SYMBOL_GPL(nft_unregister_expr);
1725
64d46806
PM		 1726static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1727 struct nlattr *nla)
96518518 1728{
ef1f7df9 1729 const struct nft_expr_type *type;
96518518 1730
ef1f7df9 1731 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1732 if (!nla_strcmp(nla, type->name) &&
1733 (!type->family || type->family == family))
ef1f7df9 1734 return type;
96518518
PM		 1735 }
1736 return NULL;
1737}
1738
64d46806
PM		 1739static const struct nft_expr_type *nft_expr_type_get(u8 family,
1740 struct nlattr *nla)
96518518 1741{
ef1f7df9 1742 const struct nft_expr_type *type;
96518518
PM		 1743
1744 if (nla == NULL)
1745 return ERR_PTR(-EINVAL);
1746
64d46806 1747 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1748 if (type != NULL && try_module_get(type->owner))
1749 return type;
96518518
PM		 1750
1751#ifdef CONFIG_MODULES
ef1f7df9 1752 if (type == NULL) {
64d46806
PM		 1753 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1754 request_module("nft-expr-%u-%.*s", family,
1755 nla_len(nla), (char *)nla_data(nla));
1756 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1757 if (__nft_expr_type_get(family, nla))
1758 return ERR_PTR(-EAGAIN);
1759
96518518
PM		 1760 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1761 request_module("nft-expr-%.*s",
1762 nla_len(nla), (char *)nla_data(nla));
1763 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1764 if (__nft_expr_type_get(family, nla))
96518518
PM		 1765 return ERR_PTR(-EAGAIN);
1766 }
1767#endif
1768 return ERR_PTR(-ENOENT);
1769}
1770
1771static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1772 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1773 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1774};
1775
1776static int nf_tables_fill_expr_info(struct sk_buff *skb,
1777 const struct nft_expr *expr)
1778{
ef1f7df9 1779 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1780 goto nla_put_failure;
1781
1782 if (expr->ops->dump) {
1783 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1784 if (data == NULL)
1785 goto nla_put_failure;
1786 if (expr->ops->dump(skb, expr) < 0)
1787 goto nla_put_failure;
1788 nla_nest_end(skb, data);
1789 }
1790
1791 return skb->len;
1792
1793nla_put_failure:
1794 return -1;
1795};
1796
0b2d8a7b
PM		 1797int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1798 const struct nft_expr *expr)
1799{
1800 struct nlattr *nest;
1801
1802 nest = nla_nest_start(skb, attr);
1803 if (!nest)
1804 goto nla_put_failure;
1805 if (nf_tables_fill_expr_info(skb, expr) < 0)
1806 goto nla_put_failure;
1807 nla_nest_end(skb, nest);
1808 return 0;
1809
1810nla_put_failure:
1811 return -1;
1812}
1813
96518518
PM		 1814struct nft_expr_info {
1815 const struct nft_expr_ops *ops;
ef1f7df9 1816 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1817};
1818
0ca743a5
PNA		 1819static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1820 const struct nlattr *nla,
96518518
PM		 1821 struct nft_expr_info *info)
1822{
ef1f7df9 1823 const struct nft_expr_type *type;
96518518 1824 const struct nft_expr_ops *ops;
ef1f7df9 1825 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1826 int err;
1827
fceb6435 1828 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 1829 if (err < 0)
1830 return err;
1831
36596dad 1832 type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1833 if (IS_ERR(type))
1834 return PTR_ERR(type);
1835
1836 if (tb[NFTA_EXPR_DATA]) {
1837 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 1838 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 1839 if (err < 0)
1840 goto err1;
1841 } else
1842 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1843
1844 if (type->select_ops != NULL) {
0ca743a5
PNA		 1845 ops = type->select_ops(ctx,
1846 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1847 if (IS_ERR(ops)) {
1848 err = PTR_ERR(ops);
1849 goto err1;
1850 }
1851 } else
1852 ops = type->ops;
1853
96518518
PM		 1854 info->ops = ops;
1855 return 0;
ef1f7df9
PM		 1856
1857err1:
1858 module_put(type->owner);
1859 return err;
96518518
PM		 1860}
1861
1862static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1863 const struct nft_expr_info *info,
96518518
PM		 1864 struct nft_expr *expr)
1865{
1866 const struct nft_expr_ops *ops = info->ops;
1867 int err;
1868
1869 expr->ops = ops;
1870 if (ops->init) {
ef1f7df9 1871 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1872 if (err < 0)
1873 goto err1;
1874 }
1875
c56e3956
LZ		 1876 if (ops->validate) {
1877 const struct nft_data *data = NULL;
1878
1879 err = ops->validate(ctx, expr, &data);
1880 if (err < 0)
1881 goto err2;
1882 }
1883
96518518
PM		 1884 return 0;
1885
c56e3956
LZ		 1886err2:
1887 if (ops->destroy)
1888 ops->destroy(ctx, expr);
96518518
PM		 1889err1:
1890 expr->ops = NULL;
1891 return err;
1892}
1893
62472bce
PM		 1894static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1895 struct nft_expr *expr)
96518518
PM		 1896{
1897 if (expr->ops->destroy)
62472bce 1898 expr->ops->destroy(ctx, expr);
ef1f7df9 1899 module_put(expr->ops->type->owner);
96518518
PM		 1900}
1901
0b2d8a7b
PM		 1902struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1903 const struct nlattr *nla)
1904{
1905 struct nft_expr_info info;
1906 struct nft_expr *expr;
1907 int err;
1908
1909 err = nf_tables_expr_parse(ctx, nla, &info);
1910 if (err < 0)
1911 goto err1;
1912
1913 err = -ENOMEM;
1914 expr = kzalloc(info.ops->size, GFP_KERNEL);
1915 if (expr == NULL)
1916 goto err2;
1917
1918 err = nf_tables_newexpr(ctx, &info, expr);
1919 if (err < 0)
6cafaf47 1920 goto err3;
0b2d8a7b
PM		 1921
1922 return expr;
6cafaf47
LZ		 1923err3:
1924 kfree(expr);
0b2d8a7b
PM		 1925err2:
1926 module_put(info.ops->type->owner);
1927err1:
1928 return ERR_PTR(err);
1929}
1930
1931void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1932{
1933 nf_tables_expr_destroy(ctx, expr);
1934 kfree(expr);
1935}
1936
96518518
PM		 1937/*
1938 * Rules
1939 */
1940
cac20fcd
PNA		 1941static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
1942 u64 handle)
96518518
PM		 1943{
1944 struct nft_rule *rule;
1945
1946 // FIXME: this sucks
1947 list_for_each_entry(rule, &chain->rules, list) {
1948 if (handle == rule->handle)
1949 return rule;
1950 }
1951
1952 return ERR_PTR(-ENOENT);
1953}
1954
cac20fcd
PNA		 1955static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
1956 const struct nlattr *nla)
96518518
PM		 1957{
1958 if (nla == NULL)
1959 return ERR_PTR(-EINVAL);
1960
cac20fcd 1961 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 1962}
1963
1964static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 1965 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1966 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1967 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1968 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1969 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1970 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1971 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1972 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1973 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1974 .len = NFT_USERDATA_MAXLEN },
467697d2 1975 [NFTA_RULE_ID] = { .type = NLA_U32 },
96518518
PM		 1976};
1977
84d7fce6
PNA		 1978static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1979 u32 portid, u32 seq, int event,
1980 u32 flags, int family,
96518518
PM		 1981 const struct nft_table *table,
1982 const struct nft_chain *chain,
1983 const struct nft_rule *rule)
1984{
1985 struct nlmsghdr *nlh;
1986 struct nfgenmsg *nfmsg;
1987 const struct nft_expr *expr, *next;
1988 struct nlattr *list;
5e948466 1989 const struct nft_rule *prule;
dedb67c4 1990 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 1991
dedb67c4 1992 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 1993 if (nlh == NULL)
1994 goto nla_put_failure;
1995
1996 nfmsg = nlmsg_data(nlh);
1997 nfmsg->nfgen_family = family;
1998 nfmsg->version = NFNETLINK_V0;
84d7fce6 1999 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2000
2001 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2002 goto nla_put_failure;
2003 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2004 goto nla_put_failure;
b46f6ded
ND		 2005 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2006 NFTA_RULE_PAD))
96518518
PM		 2007 goto nla_put_failure;
2008
5e948466 2009 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 2010 prule = list_prev_entry(rule, list);
5e948466 2011 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2012 cpu_to_be64(prule->handle),
2013 NFTA_RULE_PAD))
5e948466
EL		 2014 goto nla_put_failure;
2015 }
2016
96518518
PM		 2017 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2018 if (list == NULL)
2019 goto nla_put_failure;
2020 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2021 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2022 goto nla_put_failure;
96518518
PM		 2023 }
2024 nla_nest_end(skb, list);
2025
86f1ec32
PM		 2026 if (rule->udata) {
2027 struct nft_userdata *udata = nft_userdata(rule);
2028 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2029 udata->data) < 0)
2030 goto nla_put_failure;
2031 }
0768b3b3 2032
053c095a
JB		 2033 nlmsg_end(skb, nlh);
2034 return 0;
96518518
PM		 2035
2036nla_put_failure:
2037 nlmsg_trim(skb, nlh);
2038 return -1;
2039}
2040
25e94a99
PNA		 2041static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2042 const struct nft_rule *rule, int event)
96518518
PM		 2043{
2044 struct sk_buff *skb;
96518518
PM		 2045 int err;
2046
128ad332
PNA		 2047 if (!ctx->report &&
2048 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2049 return;
96518518 2050
96518518
PM		 2051 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2052 if (skb == NULL)
2053 goto err;
2054
84d7fce6 2055 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2056 event, 0, ctx->family, ctx->table,
35151d84 2057 ctx->chain, rule);
96518518
PM		 2058 if (err < 0) {
2059 kfree_skb(skb);
2060 goto err;
2061 }
2062
25e94a99
PNA		 2063 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2064 ctx->report, GFP_KERNEL);
2065 return;
96518518 2066err:
25e94a99 2067 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2068}
2069
6e1f760e 2070struct nft_rule_dump_ctx {
e46abbcc 2071 char *table;
b7263e07 2072 char *chain;
6e1f760e
PNA		 2073};
2074
96518518
PM		 2075static int nf_tables_dump_rules(struct sk_buff *skb,
2076 struct netlink_callback *cb)
2077{
2078 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2079 const struct nft_rule_dump_ctx *ctx = cb->data;
96518518
PM		 2080 const struct nft_table *table;
2081 const struct nft_chain *chain;
2082 const struct nft_rule *rule;
2083 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 2084 struct net *net = sock_net(skb->sk);
96518518
PM		 2085 int family = nfmsg->nfgen_family;
2086
e688a7f8 2087 rcu_read_lock();
38e029f1
PNA		 2088 cb->seq = net->nft.base_seq;
2089
36596dad 2090 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2091 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2092 continue;
2093
2094 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2095 continue;
2096
36596dad
PNA		 2097 list_for_each_entry_rcu(chain, &table->chains, list) {
2098 if (ctx && ctx->chain &&
2099 strcmp(ctx->chain, chain->name) != 0)
6e1f760e
PNA		 2100 continue;
2101
36596dad
PNA		 2102 list_for_each_entry_rcu(rule, &chain->rules, list) {
2103 if (!nft_is_active(net, rule))
2104 goto cont;
2105 if (idx < s_idx)
2106 goto cont;
2107 if (idx > s_idx)
2108 memset(&cb->args[1], 0,
2109 sizeof(cb->args) - sizeof(cb->args[0]));
2110 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2111 cb->nlh->nlmsg_seq,
2112 NFT_MSG_NEWRULE,
2113 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 2114 table->family,
36596dad
PNA		 2115 table, chain, rule) < 0)
2116 goto done;
2117
2118 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 2119cont:
36596dad 2120 idx++;
96518518
PM		 2121 }
2122 }
2123 }
2124done:
e688a7f8
PNA		 2125 rcu_read_unlock();
2126
96518518
PM		 2127 cb->args[0] = idx;
2128 return skb->len;
2129}
2130
6e1f760e
PNA		 2131static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2132{
e46abbcc
PS		 2133 struct nft_rule_dump_ctx *ctx = cb->data;
2134
2135 if (ctx) {
2136 kfree(ctx->table);
b7263e07 2137 kfree(ctx->chain);
e46abbcc
PS		 2138 kfree(ctx);
2139 }
6e1f760e
PNA		 2140 return 0;
2141}
2142
7b8002a1
PNA		 2143static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2144 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2145 const struct nlattr * const nla[],
2146 struct netlink_ext_ack *extack)
96518518
PM		 2147{
2148 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2149 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2150 const struct nft_table *table;
2151 const struct nft_chain *chain;
2152 const struct nft_rule *rule;
2153 struct sk_buff *skb2;
2154 int family = nfmsg->nfgen_family;
2155 int err;
2156
2157 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2158 struct netlink_dump_control c = {
2159 .dump = nf_tables_dump_rules,
6e1f760e 2160 .done = nf_tables_dump_rules_done,
96518518 2161 };
6e1f760e
PNA		 2162
2163 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2164 struct nft_rule_dump_ctx *ctx;
2165
2166 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2167 if (!ctx)
2168 return -ENOMEM;
2169
e46abbcc
PS		 2170 if (nla[NFTA_RULE_TABLE]) {
2171 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2172 GFP_KERNEL);
2173 if (!ctx->table) {
2174 kfree(ctx);
2175 return -ENOMEM;
2176 }
2177 }
b7263e07
PS		 2178 if (nla[NFTA_RULE_CHAIN]) {
2179 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2180 GFP_KERNEL);
2181 if (!ctx->chain) {
2182 kfree(ctx->table);
2183 kfree(ctx);
2184 return -ENOMEM;
2185 }
2186 }
6e1f760e
PNA		 2187 c.data = ctx;
2188 }
2189
96518518
PM		 2190 return netlink_dump_start(nlsk, skb, nlh, &c);
2191 }
2192
cac20fcd 2193 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2194 if (IS_ERR(table)) {
2195 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2196 return PTR_ERR(table);
36dd1bcc 2197 }
96518518 2198
cac20fcd 2199 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2200 if (IS_ERR(chain)) {
2201 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2202 return PTR_ERR(chain);
36dd1bcc 2203 }
96518518 2204
cac20fcd 2205 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2206 if (IS_ERR(rule)) {
2207 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2208 return PTR_ERR(rule);
36dd1bcc 2209 }
96518518
PM		 2210
2211 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2212 if (!skb2)
2213 return -ENOMEM;
2214
84d7fce6 2215 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2216 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2217 family, table, chain, rule);
2218 if (err < 0)
2219 goto err;
2220
2221 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2222
2223err:
2224 kfree_skb(skb2);
2225 return err;
2226}
2227
62472bce
PM		 2228static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2229 struct nft_rule *rule)
96518518 2230{
96518518
PM		 2231 struct nft_expr *expr;
2232
2233 /*
2234 * Careful: some expressions might not be initialized in case this
2235 * is called on error from nf_tables_newrule().
2236 */
2237 expr = nft_expr_first(rule);
3e38df13 2238 while (expr != nft_expr_last(rule) && expr->ops) {
62472bce 2239 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 2240 expr = nft_expr_next(expr);
2241 }
2242 kfree(rule);
2243}
2244
1081d11b
PNA		 2245#define NFT_RULE_MAXEXPRS 128
2246
2247static struct nft_expr_info *info;
2248
633c9a84
PNA		 2249static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2250 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2251 const struct nlattr * const nla[],
2252 struct netlink_ext_ack *extack)
96518518
PM		 2253{
2254 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2255 u8 genmask = nft_genmask_next(net);
98319cb9 2256 int family = nfmsg->nfgen_family;
96518518
PM		 2257 struct nft_table *table;
2258 struct nft_chain *chain;
2259 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2260 struct nft_userdata *udata;
1081d11b 2261 struct nft_trans *trans = NULL;
96518518
PM		 2262 struct nft_expr *expr;
2263 struct nft_ctx ctx;
2264 struct nlattr *tmp;
86f1ec32 2265 unsigned int size, i, n, ulen = 0, usize = 0;
96518518
PM		 2266 int err, rem;
2267 bool create;
5e948466 2268 u64 handle, pos_handle;
96518518
PM		 2269
2270 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2271
cac20fcd 2272 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2273 if (IS_ERR(table)) {
2274 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2275 return PTR_ERR(table);
36dd1bcc 2276 }
96518518 2277
cac20fcd 2278 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2279 if (IS_ERR(chain)) {
2280 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2281 return PTR_ERR(chain);
36dd1bcc 2282 }
96518518
PM		 2283
2284 if (nla[NFTA_RULE_HANDLE]) {
2285 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 2286 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 2287 if (IS_ERR(rule)) {
2288 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2289 return PTR_ERR(rule);
36dd1bcc 2290 }
96518518 2291
36dd1bcc
PNA		 2292 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2293 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2294 return -EEXIST;
36dd1bcc 2295 }
96518518
PM		 2296 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2297 old_rule = rule;
2298 else
2299 return -EOPNOTSUPP;
2300 } else {
2301 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2302 return -EINVAL;
2303 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2304
2305 if (chain->use == UINT_MAX)
2306 return -EOVERFLOW;
96518518
PM		 2307 }
2308
5e948466
EL		 2309 if (nla[NFTA_RULE_POSITION]) {
2310 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2311 return -EOPNOTSUPP;
2312
2313 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
cac20fcd 2314 old_rule = __nft_rule_lookup(chain, pos_handle);
36dd1bcc
PNA		 2315 if (IS_ERR(old_rule)) {
2316 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
5e948466 2317 return PTR_ERR(old_rule);
36dd1bcc 2318 }
5e948466
EL		 2319 }
2320
98319cb9 2321 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 2322
96518518
PM		 2323 n = 0;
2324 size = 0;
2325 if (nla[NFTA_RULE_EXPRESSIONS]) {
2326 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2327 err = -EINVAL;
2328 if (nla_type(tmp) != NFTA_LIST_ELEM)
2329 goto err1;
2330 if (n == NFT_RULE_MAXEXPRS)
2331 goto err1;
0ca743a5 2332 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2333 if (err < 0)
2334 goto err1;
2335 size += info[n].ops->size;
2336 n++;
2337 }
2338 }
9889840f
PM		 2339 /* Check for overflow of dlen field */
2340 err = -EFBIG;
2341 if (size >= 1 << 12)
2342 goto err1;
96518518 2343
86f1ec32 2344 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2345 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2346 if (ulen > 0)
2347 usize = sizeof(struct nft_userdata) + ulen;
2348 }
0768b3b3 2349
96518518 2350 err = -ENOMEM;
86f1ec32 2351 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2352 if (rule == NULL)
2353 goto err1;
2354
889f7ee7 2355 nft_activate_next(net, rule);
0628b123 2356
96518518
PM		 2357 rule->handle = handle;
2358 rule->dlen = size;
86f1ec32 2359 rule->udata = ulen ? 1 : 0;
0768b3b3 2360
86f1ec32
PM		 2361 if (ulen) {
2362 udata = nft_userdata(rule);
2363 udata->len = ulen - 1;
2364 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2365 }
96518518 2366
96518518
PM		 2367 expr = nft_expr_first(rule);
2368 for (i = 0; i < n; i++) {
2369 err = nf_tables_newexpr(&ctx, &info[i], expr);
2370 if (err < 0)
2371 goto err2;
ef1f7df9 2372 info[i].ops = NULL;
96518518
PM		 2373 expr = nft_expr_next(expr);
2374 }
2375
96518518 2376 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
889f7ee7 2377 if (nft_is_active_next(net, old_rule)) {
ac904ac8 2378 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
b380e5c7 2379 old_rule);
1081d11b 2380 if (trans == NULL) {
0628b123
PNA		 2381 err = -ENOMEM;
2382 goto err2;
2383 }
889f7ee7 2384 nft_deactivate_next(net, old_rule);
ac34b861 2385 chain->use--;
5bc5c307 2386 list_add_tail_rcu(&rule->list, &old_rule->list);
0628b123
PNA		 2387 } else {
2388 err = -ENOENT;
2389 goto err2;
2390 }
96518518 2391 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 2392 if (old_rule)
2393 list_add_rcu(&rule->list, &old_rule->list);
2394 else
2395 list_add_tail_rcu(&rule->list, &chain->rules);
2396 else {
2397 if (old_rule)
2398 list_add_tail_rcu(&rule->list, &old_rule->list);
2399 else
2400 list_add_rcu(&rule->list, &chain->rules);
2401 }
96518518 2402
b380e5c7 2403 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 2404 err = -ENOMEM;
2405 goto err3;
2406 }
4fefee57 2407 chain->use++;
96518518
PM		 2408 return 0;
2409
0628b123
PNA		 2410err3:
2411 list_del_rcu(&rule->list);
96518518 2412err2:
62472bce 2413 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 2414err1:
2415 for (i = 0; i < n; i++) {
2416 if (info[i].ops != NULL)
ef1f7df9 2417 module_put(info[i].ops->type->owner);
96518518
PM		 2418 }
2419 return err;
2420}
2421
1a94e38d
PNA		 2422static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2423 const struct nlattr *nla)
2424{
2425 u32 id = ntohl(nla_get_be32(nla));
2426 struct nft_trans *trans;
2427
2428 list_for_each_entry(trans, &net->nft.commit_list, list) {
2429 struct nft_rule *rule = nft_trans_rule(trans);
2430
2431 if (trans->msg_type == NFT_MSG_NEWRULE &&
2432 id == nft_trans_rule_id(trans))
2433 return rule;
2434 }
2435 return ERR_PTR(-ENOENT);
2436}
2437
633c9a84
PNA		 2438static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2439 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2440 const struct nlattr * const nla[],
2441 struct netlink_ext_ack *extack)
96518518
PM		 2442{
2443 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2444 u8 genmask = nft_genmask_next(net);
7c95f6d8 2445 struct nft_table *table;
cf9dc09d
PNA		 2446 struct nft_chain *chain = NULL;
2447 struct nft_rule *rule;
0628b123
PNA		 2448 int family = nfmsg->nfgen_family, err = 0;
2449 struct nft_ctx ctx;
96518518 2450
cac20fcd 2451 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2452 if (IS_ERR(table)) {
2453 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2454 return PTR_ERR(table);
36dd1bcc 2455 }
96518518 2456
cf9dc09d 2457 if (nla[NFTA_RULE_CHAIN]) {
cac20fcd 2458 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2459 if (IS_ERR(chain)) {
2460 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 2461 return PTR_ERR(chain);
36dd1bcc 2462 }
cf9dc09d 2463 }
96518518 2464
98319cb9 2465 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 2466
cf9dc09d
PNA		 2467 if (chain) {
2468 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 2469 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2470 if (IS_ERR(rule)) {
2471 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 2472 return PTR_ERR(rule);
36dd1bcc 2473 }
96518518 2474
1a94e38d
PNA		 2475 err = nft_delrule(&ctx, rule);
2476 } else if (nla[NFTA_RULE_ID]) {
2477 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 2478 if (IS_ERR(rule)) {
2479 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 2480 return PTR_ERR(rule);
36dd1bcc 2481 }
1a94e38d 2482
5e266fe7 2483 err = nft_delrule(&ctx, rule);
cf9dc09d 2484 } else {
ce24b721 2485 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2486 }
2487 } else {
2488 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2489 if (!nft_is_active_next(net, chain))
2490 continue;
2491
cf9dc09d 2492 ctx.chain = chain;
ce24b721 2493 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2494 if (err < 0)
2495 break;
2496 }
2497 }
2498
2499 return err;
2500}
2501
20a69341
PM		 2502/*
2503 * Sets
2504 */
2505
2b664957 2506static LIST_HEAD(nf_tables_set_types);
20a69341 2507
2b664957 2508int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2509{
2510 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2511 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2512 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2513 return 0;
2514}
2515EXPORT_SYMBOL_GPL(nft_register_set);
2516
2b664957 2517void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2518{
2519 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2520 list_del_rcu(&type->list);
20a69341
PM		 2521 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2522}
2523EXPORT_SYMBOL_GPL(nft_unregister_set);
2524
2b664957
PNA		 2525#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2526 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
2527
2528static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
2529{
4f2921ca
FW		 2530 if ((flags & NFT_SET_EVAL) && !ops->update)
2531 return false;
2532
2b664957
PNA		 2533 return (flags & ops->features) == (flags & NFT_SET_FEATURES);
2534}
2535
c50b960c
PM		 2536/*
2537 * Select a set implementation based on the data characteristics and the
2538 * given policy. The total memory use might not be known if no size is
2539 * given, in that case the amount of memory per element is used.
2540 */
2541static const struct nft_set_ops *
2b664957
PNA		 2542nft_select_set_ops(const struct nft_ctx *ctx,
2543 const struct nlattr * const nla[],
c50b960c
PM		 2544 const struct nft_set_desc *desc,
2545 enum nft_set_policies policy)
20a69341 2546{
c50b960c
PM		 2547 const struct nft_set_ops *ops, *bops;
2548 struct nft_set_estimate est, best;
2b664957
PNA		 2549 const struct nft_set_type *type;
2550 u32 flags = 0;
20a69341
PM		 2551
2552#ifdef CONFIG_MODULES
2b664957 2553 if (list_empty(&nf_tables_set_types)) {
20a69341
PM		 2554 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2555 request_module("nft-set");
2556 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2557 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2558 return ERR_PTR(-EAGAIN);
2559 }
2560#endif
2b664957
PNA		 2561 if (nla[NFTA_SET_FLAGS] != NULL)
2562 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2563
55af753c
PNA		 2564 bops = NULL;
2565 best.size = ~0;
2566 best.lookup = ~0;
0b5a7874 2567 best.space = ~0;
c50b960c 2568
2b664957
PNA		 2569 list_for_each_entry(type, &nf_tables_set_types, list) {
2570 if (!type->select_ops)
2571 ops = type->ops;
2572 else
2573 ops = type->select_ops(ctx, desc, flags);
2574 if (!ops)
2575 continue;
2576
2577 if (!nft_set_ops_candidate(ops, flags))
20a69341 2578 continue;
2b664957 2579 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2580 continue;
2581
2582 switch (policy) {
2583 case NFT_SET_POL_PERFORMANCE:
55af753c 2584 if (est.lookup < best.lookup)
c50b960c 2585 break;
644e334e
PNA		 2586 if (est.lookup == best.lookup &&
2587 est.space < best.space)
2588 break;
c50b960c
PM		 2589 continue;
2590 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2591 if (!desc->size) {
2592 if (est.space < best.space)
2593 break;
2594 if (est.space == best.space &&
2595 est.lookup < best.lookup)
2596 break;
4f2921ca 2597 } else if (est.size < best.size || !bops) {
c50b960c 2598 break;
0b5a7874 2599 }
c50b960c
PM		 2600 continue;
2601 default:
2602 break;
2603 }
2604
2b664957 2605 if (!try_module_get(type->owner))
20a69341 2606 continue;
c50b960c 2607 if (bops != NULL)
2b664957 2608 module_put(bops->type->owner);
c50b960c
PM		 2609
2610 bops = ops;
2611 best = est;
20a69341
PM		 2612 }
2613
c50b960c
PM		 2614 if (bops != NULL)
2615 return bops;
2616
20a69341
PM		 2617 return ERR_PTR(-EOPNOTSUPP);
2618}
2619
2620static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2621 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2622 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2623 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2624 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2625 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2626 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2627 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2628 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2629 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2630 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2631 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2632 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2633 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2634 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2635 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2636 .len = NFT_USERDATA_MAXLEN },
8aeff920 2637 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 2638 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 2639};
2640
2641static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2642 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2643};
2644
633c9a84 2645static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2646 const struct sk_buff *skb,
2647 const struct nlmsghdr *nlh,
f2a6d766 2648 const struct nlattr * const nla[],
36dd1bcc 2649 struct netlink_ext_ack *extack,
f2a6d766 2650 u8 genmask)
20a69341
PM		 2651{
2652 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 2653 int family = nfmsg->nfgen_family;
7c95f6d8 2654 struct nft_table *table = NULL;
20a69341 2655
20a69341 2656 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 2657 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
2658 genmask);
36dd1bcc
PNA		 2659 if (IS_ERR(table)) {
2660 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 2661 return PTR_ERR(table);
36dd1bcc 2662 }
20a69341
PM		 2663 }
2664
98319cb9 2665 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 2666 return 0;
2667}
2668
cac20fcd
PNA		 2669static struct nft_set *nft_set_lookup(const struct nft_table *table,
2670 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2671{
2672 struct nft_set *set;
2673
2674 if (nla == NULL)
2675 return ERR_PTR(-EINVAL);
2676
2677 list_for_each_entry(set, &table->sets, list) {
37a9cc52
PNA		 2678 if (!nla_strcmp(nla, set->name) &&
2679 nft_active_genmask(set, genmask))
20a69341
PM		 2680 return set;
2681 }
2682 return ERR_PTR(-ENOENT);
2683}
2684
cac20fcd
PNA		 2685static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
2686 const struct nlattr *nla,
2687 u8 genmask)
3ecbfd65
HS		 2688{
2689 struct nft_set *set;
2690
3ecbfd65
HS		 2691 list_for_each_entry(set, &table->sets, list) {
2692 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2693 nft_active_genmask(set, genmask))
2694 return set;
2695 }
2696 return ERR_PTR(-ENOENT);
2697}
2698
cac20fcd
PNA		 2699static struct nft_set *nft_set_lookup_byid(const struct net *net,
2700 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 2701{
2702 struct nft_trans *trans;
2703 u32 id = ntohl(nla_get_be32(nla));
2704
2705 list_for_each_entry(trans, &net->nft.commit_list, list) {
37a9cc52
PNA		 2706 struct nft_set *set = nft_trans_set(trans);
2707
958bee14 2708 if (trans->msg_type == NFT_MSG_NEWSET &&
37a9cc52
PNA		 2709 id == nft_trans_set_id(trans) &&
2710 nft_active_genmask(set, genmask))
2711 return set;
958bee14
PNA		 2712 }
2713 return ERR_PTR(-ENOENT);
2714}
c7a72e3f 2715
10659cba
PNA		 2716struct nft_set *nft_set_lookup_global(const struct net *net,
2717 const struct nft_table *table,
2718 const struct nlattr *nla_set_name,
2719 const struct nlattr *nla_set_id,
2720 u8 genmask)
c7a72e3f
PNA		 2721{
2722 struct nft_set *set;
2723
cac20fcd 2724 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 2725 if (IS_ERR(set)) {
2726 if (!nla_set_id)
2727 return set;
2728
cac20fcd 2729 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 2730 }
2731 return set;
2732}
10659cba 2733EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 2734
20a69341
PM		 2735static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2736 const char *name)
2737{
2738 const struct nft_set *i;
2739 const char *p;
2740 unsigned long *inuse;
60eb1894 2741 unsigned int n = 0, min = 0;
20a69341 2742
38745490 2743 p = strchr(name, '%');
20a69341
PM		 2744 if (p != NULL) {
2745 if (p[1] != 'd' || strchr(p + 2, '%'))
2746 return -EINVAL;
2747
2748 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2749 if (inuse == NULL)
2750 return -ENOMEM;
60eb1894 2751cont:
20a69341 2752 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2753 int tmp;
2754
37a9cc52
PNA		 2755 if (!nft_is_active_next(ctx->net, set))
2756 continue;
14662917 2757 if (!sscanf(i->name, name, &tmp))
20a69341 2758 continue;
60eb1894 2759 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2760 continue;
14662917 2761
60eb1894 2762 set_bit(tmp - min, inuse);
20a69341
PM		 2763 }
2764
53b70287 2765 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2766 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2767 min += BITS_PER_BYTE * PAGE_SIZE;
2768 memset(inuse, 0, PAGE_SIZE);
2769 goto cont;
2770 }
20a69341
PM		 2771 free_page((unsigned long)inuse);
2772 }
2773
38745490
PS		 2774 set->name = kasprintf(GFP_KERNEL, name, min + n);
2775 if (!set->name)
2776 return -ENOMEM;
2777
20a69341 2778 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 2779 if (!nft_is_active_next(ctx->net, i))
2780 continue;
e63aaaa6
AY		 2781 if (!strcmp(set->name, i->name)) {
2782 kfree(set->name);
20a69341 2783 return -ENFILE;
e63aaaa6 2784 }
20a69341
PM		 2785 }
2786 return 0;
2787}
2788
2789static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2790 const struct nft_set *set, u16 event, u16 flags)
2791{
2792 struct nfgenmsg *nfmsg;
2793 struct nlmsghdr *nlh;
c50b960c 2794 struct nlattr *desc;
128ad332
PNA		 2795 u32 portid = ctx->portid;
2796 u32 seq = ctx->seq;
20a69341 2797
dedb67c4 2798 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 2799 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2800 flags);
2801 if (nlh == NULL)
2802 goto nla_put_failure;
2803
2804 nfmsg = nlmsg_data(nlh);
36596dad 2805 nfmsg->nfgen_family = ctx->family;
20a69341 2806 nfmsg->version = NFNETLINK_V0;
84d7fce6 2807 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 2808
2809 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2810 goto nla_put_failure;
2811 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2812 goto nla_put_failure;
3ecbfd65
HS		 2813 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
2814 NFTA_SET_PAD))
2815 goto nla_put_failure;
20a69341
PM		 2816 if (set->flags != 0)
2817 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2818 goto nla_put_failure;
2819
2820 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2821 goto nla_put_failure;
2822 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2823 goto nla_put_failure;
2824 if (set->flags & NFT_SET_MAP) {
2825 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2826 goto nla_put_failure;
2827 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2828 goto nla_put_failure;
2829 }
8aeff920
PNA		 2830 if (set->flags & NFT_SET_OBJECT &&
2831 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2832 goto nla_put_failure;
20a69341 2833
761da293 2834 if (set->timeout &&
d3e2a111
AP		 2835 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2836 cpu_to_be64(jiffies_to_msecs(set->timeout)),
b46f6ded 2837 NFTA_SET_PAD))
761da293
PM		 2838 goto nla_put_failure;
2839 if (set->gc_int &&
2840 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2841 goto nla_put_failure;
2842
9363dc4b
AB		 2843 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2844 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2845 goto nla_put_failure;
2846 }
2847
e6d8ecac
CFG		 2848 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2849 goto nla_put_failure;
2850
c50b960c
PM		 2851 desc = nla_nest_start(skb, NFTA_SET_DESC);
2852 if (desc == NULL)
2853 goto nla_put_failure;
2854 if (set->size &&
2855 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2856 goto nla_put_failure;
2857 nla_nest_end(skb, desc);
2858
053c095a
JB		 2859 nlmsg_end(skb, nlh);
2860 return 0;
20a69341
PM		 2861
2862nla_put_failure:
2863 nlmsg_trim(skb, nlh);
2864 return -1;
2865}
2866
25e94a99
PNA		 2867static void nf_tables_set_notify(const struct nft_ctx *ctx,
2868 const struct nft_set *set, int event,
2869 gfp_t gfp_flags)
20a69341
PM		 2870{
2871 struct sk_buff *skb;
128ad332 2872 u32 portid = ctx->portid;
20a69341
PM		 2873 int err;
2874
128ad332
PNA		 2875 if (!ctx->report &&
2876 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2877 return;
20a69341 2878
31f8441c 2879 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 2880 if (skb == NULL)
2881 goto err;
2882
2883 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2884 if (err < 0) {
2885 kfree_skb(skb);
2886 goto err;
2887 }
2888
25e94a99
PNA		 2889 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2890 gfp_flags);
2891 return;
20a69341 2892err:
25e94a99 2893 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 2894}
2895
5b96af77 2896static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 2897{
2898 const struct nft_set *set;
2899 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 2900 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2901 struct net *net = sock_net(skb->sk);
5b96af77 2902 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 2903
2904 if (cb->args[1])
2905 return skb->len;
2906
e688a7f8 2907 rcu_read_lock();
38e029f1
PNA		 2908 cb->seq = net->nft.base_seq;
2909
36596dad
PNA		 2910 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2911 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 2912 ctx->family != table->family)
36596dad
PNA		 2913 continue;
2914
2915 if (ctx->table && ctx->table != table)
5b96af77
PNA		 2916 continue;
2917
36596dad
PNA		 2918 if (cur_table) {
2919 if (cur_table != table)
c9c8e485
PNA		 2920 continue;
2921
36596dad 2922 cur_table = NULL;
c9c8e485 2923 }
36596dad
PNA		 2924 idx = 0;
2925 list_for_each_entry_rcu(set, &table->sets, list) {
2926 if (idx < s_idx)
2927 goto cont;
2928 if (!nft_is_active(net, set))
2929 goto cont;
5b96af77 2930
36596dad
PNA		 2931 ctx_set = *ctx;
2932 ctx_set.table = table;
98319cb9 2933 ctx_set.family = table->family;
c9c8e485 2934
36596dad
PNA		 2935 if (nf_tables_fill_set(skb, &ctx_set, set,
2936 NFT_MSG_NEWSET,
2937 NLM_F_MULTI) < 0) {
2938 cb->args[0] = idx;
2939 cb->args[2] = (unsigned long) table;
2940 goto done;
c9c8e485 2941 }
36596dad 2942 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 2943cont:
36596dad 2944 idx++;
c9c8e485 2945 }
36596dad
PNA		 2946 if (s_idx)
2947 s_idx = 0;
c9c8e485
PNA		 2948 }
2949 cb->args[1] = 1;
2950done:
e688a7f8 2951 rcu_read_unlock();
c9c8e485
PNA		 2952 return skb->len;
2953}
2954
5b96af77 2955static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 2956{
5b96af77
PNA		 2957 kfree(cb->data);
2958 return 0;
20a69341
PM		 2959}
2960
7b8002a1
PNA		 2961static int nf_tables_getset(struct net *net, struct sock *nlsk,
2962 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2963 const struct nlattr * const nla[],
2964 struct netlink_ext_ack *extack)
20a69341 2965{
f2a6d766 2966 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 2967 const struct nft_set *set;
2968 struct nft_ctx ctx;
2969 struct sk_buff *skb2;
c9c8e485 2970 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2971 int err;
2972
01cfa0a4 2973 /* Verify existence before starting dump */
36dd1bcc
PNA		 2974 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
2975 genmask);
20a69341
PM		 2976 if (err < 0)
2977 return err;
2978
2979 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2980 struct netlink_dump_control c = {
2981 .dump = nf_tables_dump_sets,
5b96af77 2982 .done = nf_tables_dump_sets_done,
20a69341 2983 };
5b96af77
PNA		 2984 struct nft_ctx *ctx_dump;
2985
2986 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2987 if (ctx_dump == NULL)
2988 return -ENOMEM;
2989
2990 *ctx_dump = ctx;
2991 c.data = ctx_dump;
2992
20a69341
PM		 2993 return netlink_dump_start(nlsk, skb, nlh, &c);
2994 }
2995
c9c8e485
PNA		 2996 /* Only accept unspec with dump */
2997 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2998 return -EAFNOSUPPORT;
eaa2bcd6
PT		 2999 if (!nla[NFTA_SET_TABLE])
3000 return -EINVAL;
c9c8e485 3001
cac20fcd 3002 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3003 if (IS_ERR(set))
3004 return PTR_ERR(set);
3005
3006 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
3007 if (skb2 == NULL)
3008 return -ENOMEM;
3009
3010 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3011 if (err < 0)
3012 goto err;
3013
3014 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3015
3016err:
3017 kfree_skb(skb2);
3018 return err;
3019}
3020
c50b960c
PM		 3021static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3022 struct nft_set_desc *desc,
3023 const struct nlattr *nla)
3024{
3025 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3026 int err;
3027
fceb6435
JB		 3028 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3029 nft_set_desc_policy, NULL);
c50b960c
PM		 3030 if (err < 0)
3031 return err;
3032
3033 if (da[NFTA_SET_DESC_SIZE] != NULL)
3034 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3035
3036 return 0;
3037}
3038
633c9a84
PNA		 3039static int nf_tables_newset(struct net *net, struct sock *nlsk,
3040 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3041 const struct nlattr * const nla[],
3042 struct netlink_ext_ack *extack)
20a69341
PM		 3043{
3044 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3045 u8 genmask = nft_genmask_next(net);
98319cb9 3046 int family = nfmsg->nfgen_family;
20a69341 3047 const struct nft_set_ops *ops;
20a69341
PM		 3048 struct nft_table *table;
3049 struct nft_set *set;
3050 struct nft_ctx ctx;
38745490 3051 char *name;
20a69341
PM		 3052 unsigned int size;
3053 bool create;
761da293 3054 u64 timeout;
8aeff920 3055 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3056 struct nft_set_desc desc;
e6d8ecac
CFG		 3057 unsigned char *udata;
3058 u16 udlen;
20a69341
PM		 3059 int err;
3060
3061 if (nla[NFTA_SET_TABLE] == NULL ||
3062 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3063 nla[NFTA_SET_KEY_LEN] == NULL ||
3064 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3065 return -EINVAL;
3066
c50b960c
PM		 3067 memset(&desc, 0, sizeof(desc));
3068
20a69341
PM		 3069 ktype = NFT_DATA_VALUE;
3070 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3071 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3072 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3073 return -EINVAL;
3074 }
3075
c50b960c 3076 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3077 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3078 return -EINVAL;
3079
3080 flags = 0;
3081 if (nla[NFTA_SET_FLAGS] != NULL) {
3082 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3083 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3084 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3085 NFT_SET_MAP | NFT_SET_EVAL |
3086 NFT_SET_OBJECT))
20a69341 3087 return -EINVAL;
8aeff920
PNA		 3088 /* Only one of these operations is supported */
3089 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3090 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3091 return -EOPNOTSUPP;
20a69341
PM		 3092 }
3093
3094 dtype = 0;
20a69341
PM		 3095 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3096 if (!(flags & NFT_SET_MAP))
3097 return -EINVAL;
3098
3099 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3100 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3101 dtype != NFT_DATA_VERDICT)
3102 return -EINVAL;
3103
3104 if (dtype != NFT_DATA_VERDICT) {
3105 if (nla[NFTA_SET_DATA_LEN] == NULL)
3106 return -EINVAL;
c50b960c 3107 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3108 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3109 return -EINVAL;
3110 } else
7d740264 3111 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3112 } else if (flags & NFT_SET_MAP)
3113 return -EINVAL;
3114
8aeff920
PNA		 3115 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3116 if (!(flags & NFT_SET_OBJECT))
3117 return -EINVAL;
3118
3119 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3120 if (objtype == NFT_OBJECT_UNSPEC ||
3121 objtype > NFT_OBJECT_MAX)
3122 return -EINVAL;
3123 } else if (flags & NFT_SET_OBJECT)
3124 return -EINVAL;
3125 else
3126 objtype = NFT_OBJECT_UNSPEC;
3127
761da293
PM		 3128 timeout = 0;
3129 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3130 if (!(flags & NFT_SET_TIMEOUT))
3131 return -EINVAL;
d3e2a111
AP		 3132 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3133 nla[NFTA_SET_TIMEOUT])));
761da293
PM		 3134 }
3135 gc_int = 0;
3136 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3137 if (!(flags & NFT_SET_TIMEOUT))
3138 return -EINVAL;
3139 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3140 }
3141
c50b960c
PM		 3142 policy = NFT_SET_POL_PERFORMANCE;
3143 if (nla[NFTA_SET_POLICY] != NULL)
3144 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3145
3146 if (nla[NFTA_SET_DESC] != NULL) {
3147 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3148 if (err < 0)
3149 return err;
3150 }
3151
20a69341
PM		 3152 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3153
cac20fcd 3154 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 3155 if (IS_ERR(table)) {
3156 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3157 return PTR_ERR(table);
36dd1bcc 3158 }
20a69341 3159
98319cb9 3160 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3161
cac20fcd 3162 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 3163 if (IS_ERR(set)) {
36dd1bcc
PNA		 3164 if (PTR_ERR(set) != -ENOENT) {
3165 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3166 return PTR_ERR(set);
36dd1bcc 3167 }
1a28ad74 3168 } else {
36dd1bcc
PNA		 3169 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3170 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3171 return -EEXIST;
36dd1bcc 3172 }
20a69341
PM		 3173 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3174 return -EOPNOTSUPP;
36dd1bcc 3175
20a69341
PM		 3176 return 0;
3177 }
3178
3179 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3180 return -ENOENT;
3181
2b664957 3182 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3183 if (IS_ERR(ops))
3184 return PTR_ERR(ops);
3185
e6d8ecac
CFG		 3186 udlen = 0;
3187 if (nla[NFTA_SET_USERDATA])
3188 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3189
20a69341
PM		 3190 size = 0;
3191 if (ops->privsize != NULL)
347b408d 3192 size = ops->privsize(nla, &desc);
20a69341 3193
1ff75a3e
PNA		 3194 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3195 if (!set) {
3196 err = -ENOMEM;
20a69341 3197 goto err1;
1ff75a3e 3198 }
20a69341 3199
38745490
PS		 3200 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3201 if (!name) {
3202 err = -ENOMEM;
3203 goto err2;
3204 }
3205
20a69341 3206 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3207 kfree(name);
20a69341
PM		 3208 if (err < 0)
3209 goto err2;
3210
e6d8ecac
CFG		 3211 udata = NULL;
3212 if (udlen) {
3213 udata = set->data + size;
3214 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3215 }
3216
20a69341
PM		 3217 INIT_LIST_HEAD(&set->bindings);
3218 set->ops = ops;
3219 set->ktype = ktype;
c50b960c 3220 set->klen = desc.klen;
20a69341 3221 set->dtype = dtype;
8aeff920 3222 set->objtype = objtype;
c50b960c 3223 set->dlen = desc.dlen;
20a69341 3224 set->flags = flags;
c50b960c 3225 set->size = desc.size;
9363dc4b 3226 set->policy = policy;
e6d8ecac
CFG		 3227 set->udlen = udlen;
3228 set->udata = udata;
761da293
PM		 3229 set->timeout = timeout;
3230 set->gc_int = gc_int;
3ecbfd65 3231 set->handle = nf_tables_alloc_handle(table);
20a69341 3232
c50b960c 3233 err = ops->init(set, &desc, nla);
20a69341
PM		 3234 if (err < 0)
3235 goto err2;
3236
958bee14 3237 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3238 if (err < 0)
c17c3cdf 3239 goto err3;
20a69341 3240
e688a7f8 3241 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3242 table->use++;
20a69341
PM		 3243 return 0;
3244
c17c3cdf
LZ		 3245err3:
3246 ops->destroy(set);
20a69341 3247err2:
1ff75a3e 3248 kvfree(set);
20a69341 3249err1:
2b664957 3250 module_put(ops->type->owner);
20a69341
PM		 3251 return err;
3252}
3253
958bee14 3254static void nft_set_destroy(struct nft_set *set)
20a69341 3255{
20a69341 3256 set->ops->destroy(set);
2b664957 3257 module_put(set->ops->type->owner);
38745490 3258 kfree(set->name);
1ff75a3e 3259 kvfree(set);
20a69341
PM		 3260}
3261
958bee14
PNA		 3262static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3263{
e688a7f8 3264 list_del_rcu(&set->list);
31f8441c 3265 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
958bee14
PNA		 3266 nft_set_destroy(set);
3267}
3268
633c9a84
PNA		 3269static int nf_tables_delset(struct net *net, struct sock *nlsk,
3270 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3271 const struct nlattr * const nla[],
3272 struct netlink_ext_ack *extack)
20a69341 3273{
c9c8e485 3274 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3275 u8 genmask = nft_genmask_next(net);
36dd1bcc 3276 const struct nlattr *attr;
20a69341
PM		 3277 struct nft_set *set;
3278 struct nft_ctx ctx;
3279 int err;
3280
ec2c9935
PM		 3281 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3282 return -EAFNOSUPPORT;
20a69341
PM		 3283 if (nla[NFTA_SET_TABLE] == NULL)
3284 return -EINVAL;
3285
36dd1bcc
PNA		 3286 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3287 genmask);
20a69341
PM		 3288 if (err < 0)
3289 return err;
3290
36dd1bcc
PNA		 3291 if (nla[NFTA_SET_HANDLE]) {
3292 attr = nla[NFTA_SET_HANDLE];
3293 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3294 } else {
3295 attr = nla[NFTA_SET_NAME];
3296 set = nft_set_lookup(ctx.table, attr, genmask);
3297 }
a8278400 3298
36dd1bcc
PNA		 3299 if (IS_ERR(set)) {
3300 NL_SET_BAD_ATTR(extack, attr);
3301 return PTR_ERR(set);
3302 }
a8278400 3303 if (!list_empty(&set->bindings) ||
36dd1bcc
PNA		 3304 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3305 NL_SET_BAD_ATTR(extack, attr);
20a69341 3306 return -EBUSY;
36dd1bcc 3307 }
20a69341 3308
ee01d542 3309 return nft_delset(&ctx, set);
20a69341
PM		 3310}
3311
3312static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3313 struct nft_set *set,
20a69341 3314 const struct nft_set_iter *iter,
de70185d 3315 struct nft_set_elem *elem)
20a69341 3316{
fe2811eb 3317 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3318 enum nft_registers dreg;
3319
3320 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3321 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3322 set->dtype == NFT_DATA_VERDICT ?
3323 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3324 set->dlen);
20a69341
PM		 3325}
3326
3327int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3328 struct nft_set_binding *binding)
3329{
3330 struct nft_set_binding *i;
3331 struct nft_set_iter iter;
3332
408070d6 3333 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3334 return -EBUSY;
3335
11113e19 3336 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3337 /* If the set is already bound to the same chain all
3338 * jumps are already validated for that chain.
3339 */
3340 list_for_each_entry(i, &set->bindings, list) {
a4684402 3341 if (i->flags & NFT_SET_MAP &&
11113e19 3342 i->chain == binding->chain)
20a69341
PM		 3343 goto bind;
3344 }
3345
8588ac09 3346 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3347 iter.skip = 0;
3348 iter.count = 0;
3349 iter.err = 0;
3350 iter.fn = nf_tables_bind_check_setelem;
3351
3352 set->ops->walk(ctx, set, &iter);
a02f4248 3353 if (iter.err < 0)
20a69341 3354 return iter.err;
20a69341
PM		 3355 }
3356bind:
3357 binding->chain = ctx->chain;
e688a7f8 3358 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3359 return 0;
3360}
63aea290 3361EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341
PM		 3362
3363void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3364 struct nft_set_binding *binding)
3365{
e688a7f8 3366 list_del_rcu(&binding->list);
20a69341 3367
408070d6 3368 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
37a9cc52 3369 nft_is_active(ctx->net, set))
20a69341
PM		 3370 nf_tables_set_destroy(ctx, set);
3371}
63aea290 3372EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3373
3ac4c07a
PM		 3374const struct nft_set_ext_type nft_set_ext_types[] = {
3375 [NFT_SET_EXT_KEY] = {
7d740264 3376 .align = __alignof__(u32),
3ac4c07a
PM		 3377 },
3378 [NFT_SET_EXT_DATA] = {
7d740264 3379 .align = __alignof__(u32),
3ac4c07a 3380 },
f25ad2e9
PM		 3381 [NFT_SET_EXT_EXPR] = {
3382 .align = __alignof__(struct nft_expr),
3383 },
8aeff920
PNA		 3384 [NFT_SET_EXT_OBJREF] = {
3385 .len = sizeof(struct nft_object *),
3386 .align = __alignof__(struct nft_object *),
3387 },
3ac4c07a
PM		 3388 [NFT_SET_EXT_FLAGS] = {
3389 .len = sizeof(u8),
3390 .align = __alignof__(u8),
3391 },
c3e1b005
PM		 3392 [NFT_SET_EXT_TIMEOUT] = {
3393 .len = sizeof(u64),
3394 .align = __alignof__(u64),
3395 },
3396 [NFT_SET_EXT_EXPIRATION] = {
3397 .len = sizeof(unsigned long),
3398 .align = __alignof__(unsigned long),
3399 },
68e942e8
PM		 3400 [NFT_SET_EXT_USERDATA] = {
3401 .len = sizeof(struct nft_userdata),
3402 .align = __alignof__(struct nft_userdata),
3403 },
3ac4c07a
PM		 3404};
3405EXPORT_SYMBOL_GPL(nft_set_ext_types);
3406
20a69341
PM		 3407/*
3408 * Set elements
3409 */
3410
3411static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3412 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3413 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3414 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3415 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3416 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3417 .len = NFT_USERDATA_MAXLEN },
467697d2
FW		 3418 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3419 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
20a69341
PM		 3420};
3421
3422static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3423 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3424 .len = NFT_TABLE_MAXNAMELEN - 1 },
3425 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3426 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3427 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3428 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3429};
3430
633c9a84 3431static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3432 const struct sk_buff *skb,
3433 const struct nlmsghdr *nlh,
f2a6d766 3434 const struct nlattr * const nla[],
36dd1bcc 3435 struct netlink_ext_ack *extack,
f2a6d766 3436 u8 genmask)
20a69341
PM		 3437{
3438 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3439 int family = nfmsg->nfgen_family;
7c95f6d8 3440 struct nft_table *table;
20a69341 3441
cac20fcd
PNA		 3442 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3443 genmask);
36dd1bcc
PNA		 3444 if (IS_ERR(table)) {
3445 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 3446 return PTR_ERR(table);
36dd1bcc 3447 }
20a69341 3448
98319cb9 3449 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3450 return 0;
3451}
3452
3453static int nf_tables_fill_setelem(struct sk_buff *skb,
3454 const struct nft_set *set,
3455 const struct nft_set_elem *elem)
3456{
fe2811eb 3457 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3458 unsigned char *b = skb_tail_pointer(skb);
3459 struct nlattr *nest;
3460
3461 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3462 if (nest == NULL)
3463 goto nla_put_failure;
3464
fe2811eb
PM		 3465 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3466 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3467 goto nla_put_failure;
3468
fe2811eb
PM		 3469 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3470 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3471 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3472 set->dlen) < 0)
3473 goto nla_put_failure;
3474
f25ad2e9
PM		 3475 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3476 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3477 goto nla_put_failure;
3478
8aeff920
PNA		 3479 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3480 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3481 (*nft_set_ext_obj(ext))->name) < 0)
3482 goto nla_put_failure;
3483
fe2811eb
PM		 3484 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3485 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3486 htonl(*nft_set_ext_flags(ext))))
3487 goto nla_put_failure;
20a69341 3488
c3e1b005
PM		 3489 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3490 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
d3e2a111
AP		 3491 cpu_to_be64(jiffies_to_msecs(
3492 *nft_set_ext_timeout(ext))),
b46f6ded 3493 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3494 goto nla_put_failure;
3495
3496 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3497 unsigned long expires, now = jiffies;
3498
3499 expires = *nft_set_ext_expiration(ext);
3500 if (time_before(now, expires))
3501 expires -= now;
3502 else
3503 expires = 0;
3504
3505 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
b46f6ded
ND		 3506 cpu_to_be64(jiffies_to_msecs(expires)),
3507 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3508 goto nla_put_failure;
3509 }
3510
68e942e8
PM		 3511 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3512 struct nft_userdata *udata;
3513
3514 udata = nft_set_ext_userdata(ext);
3515 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3516 udata->len + 1, udata->data))
3517 goto nla_put_failure;
3518 }
3519
20a69341
PM		 3520 nla_nest_end(skb, nest);
3521 return 0;
3522
3523nla_put_failure:
3524 nlmsg_trim(skb, b);
3525 return -EMSGSIZE;
3526}
3527
3528struct nft_set_dump_args {
3529 const struct netlink_callback *cb;
3530 struct nft_set_iter iter;
3531 struct sk_buff *skb;
3532};
3533
3534static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3535 struct nft_set *set,
20a69341 3536 const struct nft_set_iter *iter,
de70185d 3537 struct nft_set_elem *elem)
20a69341
PM		 3538{
3539 struct nft_set_dump_args *args;
3540
3541 args = container_of(iter, struct nft_set_dump_args, iter);
3542 return nf_tables_fill_setelem(args->skb, set, elem);
3543}
3544
fa803605
LZ		 3545struct nft_set_dump_ctx {
3546 const struct nft_set *set;
3547 struct nft_ctx ctx;
3548};
3549
20a69341
PM		 3550static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3551{
fa803605 3552 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3553 struct net *net = sock_net(skb->sk);
fa803605 3554 struct nft_table *table;
de70185d 3555 struct nft_set *set;
20a69341 3556 struct nft_set_dump_args args;
fa803605 3557 bool set_found = false;
20a69341
PM		 3558 struct nfgenmsg *nfmsg;
3559 struct nlmsghdr *nlh;
3560 struct nlattr *nest;
3561 u32 portid, seq;
fa803605 3562 int event;
20a69341 3563
fa803605 3564 rcu_read_lock();
36596dad
PNA		 3565 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3566 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 3567 dump_ctx->ctx.family != table->family)
fa803605 3568 continue;
20a69341 3569
36596dad
PNA		 3570 if (table != dump_ctx->ctx.table)
3571 continue;
20a69341 3572
36596dad
PNA		 3573 list_for_each_entry_rcu(set, &table->sets, list) {
3574 if (set == dump_ctx->set) {
3575 set_found = true;
3576 break;
fa803605 3577 }
fa803605
LZ		 3578 }
3579 break;
3580 }
3581
3582 if (!set_found) {
3583 rcu_read_unlock();
3584 return -ENOENT;
3585 }
20a69341 3586
dedb67c4 3587 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3588 portid = NETLINK_CB(cb->skb).portid;
3589 seq = cb->nlh->nlmsg_seq;
3590
3591 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3592 NLM_F_MULTI);
3593 if (nlh == NULL)
3594 goto nla_put_failure;
3595
3596 nfmsg = nlmsg_data(nlh);
98319cb9 3597 nfmsg->nfgen_family = table->family;
20a69341 3598 nfmsg->version = NFNETLINK_V0;
fa803605 3599 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3600
fa803605 3601 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3602 goto nla_put_failure;
3603 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3604 goto nla_put_failure;
3605
3606 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3607 if (nest == NULL)
3608 goto nla_put_failure;
3609
8588ac09
PNA		 3610 args.cb = cb;
3611 args.skb = skb;
fa803605 3612 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3613 args.iter.skip = cb->args[0];
3614 args.iter.count = 0;
3615 args.iter.err = 0;
3616 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3617 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3618 rcu_read_unlock();
20a69341
PM		 3619
3620 nla_nest_end(skb, nest);
3621 nlmsg_end(skb, nlh);
3622
3623 if (args.iter.err && args.iter.err != -EMSGSIZE)
3624 return args.iter.err;
3625 if (args.iter.count == cb->args[0])
3626 return 0;
3627
3628 cb->args[0] = args.iter.count;
3629 return skb->len;
3630
3631nla_put_failure:
fa803605 3632 rcu_read_unlock();
20a69341
PM		 3633 return -ENOSPC;
3634}
3635
fa803605
LZ		 3636static int nf_tables_dump_set_done(struct netlink_callback *cb)
3637{
3638 kfree(cb->data);
3639 return 0;
3640}
3641
d60ce62f
AB		 3642static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3643 const struct nft_ctx *ctx, u32 seq,
3644 u32 portid, int event, u16 flags,
3645 const struct nft_set *set,
3646 const struct nft_set_elem *elem)
3647{
3648 struct nfgenmsg *nfmsg;
3649 struct nlmsghdr *nlh;
3650 struct nlattr *nest;
3651 int err;
3652
dedb67c4 3653 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 3654 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3655 flags);
3656 if (nlh == NULL)
3657 goto nla_put_failure;
3658
3659 nfmsg = nlmsg_data(nlh);
36596dad 3660 nfmsg->nfgen_family = ctx->family;
d60ce62f 3661 nfmsg->version = NFNETLINK_V0;
84d7fce6 3662 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 3663
3664 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3665 goto nla_put_failure;
3666 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3667 goto nla_put_failure;
3668
3669 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3670 if (nest == NULL)
3671 goto nla_put_failure;
3672
3673 err = nf_tables_fill_setelem(skb, set, elem);
3674 if (err < 0)
3675 goto nla_put_failure;
3676
3677 nla_nest_end(skb, nest);
3678
053c095a
JB		 3679 nlmsg_end(skb, nlh);
3680 return 0;
d60ce62f
AB		 3681
3682nla_put_failure:
3683 nlmsg_trim(skb, nlh);
3684 return -1;
3685}
3686
ba0e4d99
PNA		 3687static int nft_setelem_parse_flags(const struct nft_set *set,
3688 const struct nlattr *attr, u32 *flags)
3689{
3690 if (attr == NULL)
3691 return 0;
3692
3693 *flags = ntohl(nla_get_be32(attr));
3694 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3695 return -EINVAL;
3696 if (!(set->flags & NFT_SET_INTERVAL) &&
3697 *flags & NFT_SET_ELEM_INTERVAL_END)
3698 return -EINVAL;
3699
3700 return 0;
3701}
3702
3703static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3704 const struct nlattr *attr)
3705{
3706 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3707 const struct nft_set_ext *ext;
3708 struct nft_data_desc desc;
3709 struct nft_set_elem elem;
3710 struct sk_buff *skb;
3711 uint32_t flags = 0;
3712 void *priv;
3713 int err;
3714
3715 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3716 nft_set_elem_policy, NULL);
3717 if (err < 0)
3718 return err;
3719
3720 if (!nla[NFTA_SET_ELEM_KEY])
3721 return -EINVAL;
3722
3723 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3724 if (err < 0)
3725 return err;
3726
3727 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3728 nla[NFTA_SET_ELEM_KEY]);
3729 if (err < 0)
3730 return err;
3731
3732 err = -EINVAL;
3733 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3734 return err;
3735
3736 priv = set->ops->get(ctx->net, set, &elem, flags);
3737 if (IS_ERR(priv))
3738 return PTR_ERR(priv);
3739
3740 elem.priv = priv;
3741 ext = nft_set_elem_ext(set, &elem);
3742
3743 err = -ENOMEM;
3744 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3745 if (skb == NULL)
3746 goto err1;
3747
3748 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3749 NFT_MSG_NEWSETELEM, 0, set, &elem);
3750 if (err < 0)
3751 goto err2;
3752
3753 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3754 /* This avoids a loop in nfnetlink. */
3755 if (err < 0)
3756 goto err1;
3757
3758 return 0;
3759err2:
3760 kfree_skb(skb);
3761err1:
3762 /* this avoids a loop in nfnetlink. */
3763 return err == -EAGAIN ? -ENOBUFS : err;
3764}
3765
3766static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3767 struct sk_buff *skb, const struct nlmsghdr *nlh,
3768 const struct nlattr * const nla[],
3769 struct netlink_ext_ack *extack)
3770{
3771 u8 genmask = nft_genmask_cur(net);
3772 struct nft_set *set;
3773 struct nlattr *attr;
3774 struct nft_ctx ctx;
3775 int rem, err = 0;
3776
36dd1bcc
PNA		 3777 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
3778 genmask);
ba0e4d99
PNA		 3779 if (err < 0)
3780 return err;
3781
cac20fcd 3782 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 3783 if (IS_ERR(set))
3784 return PTR_ERR(set);
3785
3786 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3787 struct netlink_dump_control c = {
3788 .dump = nf_tables_dump_set,
3789 .done = nf_tables_dump_set_done,
3790 };
3791 struct nft_set_dump_ctx *dump_ctx;
3792
3793 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3794 if (!dump_ctx)
3795 return -ENOMEM;
3796
3797 dump_ctx->set = set;
3798 dump_ctx->ctx = ctx;
3799
3800 c.data = dump_ctx;
3801 return netlink_dump_start(nlsk, skb, nlh, &c);
3802 }
3803
3804 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3805 return -EINVAL;
3806
3807 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3808 err = nft_get_set_elem(&ctx, set, attr);
3809 if (err < 0)
3810 break;
3811 }
3812
3813 return err;
3814}
3815
25e94a99
PNA		 3816static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3817 const struct nft_set *set,
3818 const struct nft_set_elem *elem,
3819 int event, u16 flags)
d60ce62f 3820{
128ad332
PNA		 3821 struct net *net = ctx->net;
3822 u32 portid = ctx->portid;
d60ce62f
AB		 3823 struct sk_buff *skb;
3824 int err;
3825
128ad332 3826 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 3827 return;
d60ce62f 3828
d60ce62f
AB		 3829 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3830 if (skb == NULL)
3831 goto err;
3832
3833 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3834 set, elem);
3835 if (err < 0) {
3836 kfree_skb(skb);
3837 goto err;
3838 }
3839
25e94a99
PNA		 3840 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3841 GFP_KERNEL);
3842 return;
d60ce62f 3843err:
25e94a99 3844 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 3845}
3846
60319eb1
PNA		 3847static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3848 int msg_type,
3849 struct nft_set *set)
3850{
3851 struct nft_trans *trans;
3852
3853 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3854 if (trans == NULL)
3855 return NULL;
3856
3857 nft_trans_elem_set(trans) = set;
3858 return trans;
3859}
3860
22fe54d5
PM		 3861void *nft_set_elem_init(const struct nft_set *set,
3862 const struct nft_set_ext_tmpl *tmpl,
49499c3e 3863 const u32 *key, const u32 *data,
22fe54d5 3864 u64 timeout, gfp_t gfp)
fe2811eb
PM		 3865{
3866 struct nft_set_ext *ext;
3867 void *elem;
3868
3869 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3870 if (elem == NULL)
3871 return NULL;
3872
3873 ext = nft_set_elem_ext(set, elem);
3874 nft_set_ext_init(ext, tmpl);
3875
3876 memcpy(nft_set_ext_key(ext), key, set->klen);
3877 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3878 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 3879 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3880 *nft_set_ext_expiration(ext) =
d3e2a111 3881 jiffies + timeout;
c3e1b005
PM		 3882 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3883 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 3884
3885 return elem;
3886}
3887
61f9e292
LZ		 3888void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3889 bool destroy_expr)
61edafbb
PM		 3890{
3891 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3892
59105446 3893 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 3894 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 3895 nft_data_release(nft_set_ext_data(ext), set->dtype);
61f9e292 3896 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
f25ad2e9 3897 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
8aeff920
PNA		 3898 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3899 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 3900 kfree(elem);
3901}
3902EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3903
59105446
PNA		 3904/* Only called from commit path, nft_set_elem_deactivate() already deals with
3905 * the refcounting from the preparation phase.
3906 */
3907static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3908{
3909 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3910
3911 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3912 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3913 kfree(elem);
3914}
3915
60319eb1 3916static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 3917 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 3918{
3919 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 3920 u8 genmask = nft_genmask_next(ctx->net);
20a69341 3921 struct nft_data_desc d1, d2;
fe2811eb 3922 struct nft_set_ext_tmpl tmpl;
c016c7e4 3923 struct nft_set_ext *ext, *ext2;
20a69341
PM		 3924 struct nft_set_elem elem;
3925 struct nft_set_binding *binding;
8aeff920 3926 struct nft_object *obj = NULL;
68e942e8 3927 struct nft_userdata *udata;
fe2811eb 3928 struct nft_data data;
20a69341 3929 enum nft_registers dreg;
60319eb1 3930 struct nft_trans *trans;
0e9091d6 3931 u32 flags = 0;
c3e1b005 3932 u64 timeout;
68e942e8 3933 u8 ulen;
20a69341
PM		 3934 int err;
3935
3936 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 3937 nft_set_elem_policy, NULL);
20a69341
PM		 3938 if (err < 0)
3939 return err;
3940
3941 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3942 return -EINVAL;
3943
fe2811eb
PM		 3944 nft_set_ext_prepare(&tmpl);
3945
0e9091d6
PNA		 3946 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3947 if (err < 0)
3948 return err;
3949 if (flags != 0)
3950 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 3951
3952 if (set->flags & NFT_SET_MAP) {
3953 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 3954 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 3955 return -EINVAL;
bd7fc645 3956 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 3957 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 3958 return -EINVAL;
20a69341
PM		 3959 } else {
3960 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3961 return -EINVAL;
3962 }
3963
c3e1b005
PM		 3964 timeout = 0;
3965 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3966 if (!(set->flags & NFT_SET_TIMEOUT))
3967 return -EINVAL;
d3e2a111
AP		 3968 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3969 nla[NFTA_SET_ELEM_TIMEOUT])));
c3e1b005
PM		 3970 } else if (set->flags & NFT_SET_TIMEOUT) {
3971 timeout = set->timeout;
3972 }
3973
7d740264 3974 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 3975 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 3976 if (err < 0)
3977 goto err1;
3978 err = -EINVAL;
3979 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3980 goto err2;
3981
7d740264 3982 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 3983 if (timeout > 0) {
3984 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
3985 if (timeout != set->timeout)
3986 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
3987 }
fe2811eb 3988
8aeff920
PNA		 3989 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
3990 if (!(set->flags & NFT_SET_OBJECT)) {
3991 err = -EINVAL;
3992 goto err2;
3993 }
cac20fcd
PNA		 3994 obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
3995 set->objtype, genmask);
8aeff920
PNA		 3996 if (IS_ERR(obj)) {
3997 err = PTR_ERR(obj);
3998 goto err2;
3999 }
4000 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4001 }
4002
20a69341 4003 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 4004 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4005 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 4006 if (err < 0)
4007 goto err2;
4008
4009 err = -EINVAL;
4010 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4011 goto err3;
4012
4013 dreg = nft_type_to_reg(set->dtype);
4014 list_for_each_entry(binding, &set->bindings, list) {
4015 struct nft_ctx bind_ctx = {
58c78e10 4016 .net = ctx->net,
36596dad 4017 .family = ctx->family,
20a69341 4018 .table = ctx->table,
7c95f6d8 4019 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4020 };
4021
11113e19
PM		 4022 if (!(binding->flags & NFT_SET_MAP))
4023 continue;
4024
1ec10212
PM		 4025 err = nft_validate_register_store(&bind_ctx, dreg,
4026 &data,
4027 d2.type, d2.len);
20a69341
PM		 4028 if (err < 0)
4029 goto err3;
4030 }
fe2811eb 4031
7d740264 4032 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4033 }
4034
68e942e8
PM		 4035 /* The full maximum length of userdata can exceed the maximum
4036 * offset value (U8_MAX) for following extensions, therefor it
4037 * must be the last extension added.
4038 */
4039 ulen = 0;
4040 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4041 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4042 if (ulen > 0)
4043 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4044 ulen);
4045 }
4046
fe2811eb 4047 err = -ENOMEM;
7d740264 4048 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 4049 timeout, GFP_KERNEL);
fe2811eb
PM		 4050 if (elem.priv == NULL)
4051 goto err3;
4052
4053 ext = nft_set_elem_ext(set, elem.priv);
4054 if (flags)
4055 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4056 if (ulen > 0) {
4057 udata = nft_set_ext_userdata(ext);
4058 udata->len = ulen - 1;
4059 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4060 }
8aeff920
PNA		 4061 if (obj) {
4062 *nft_set_ext_obj(ext) = obj;
4063 obj->use++;
4064 }
fe2811eb 4065
60319eb1
PNA		 4066 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4067 if (trans == NULL)
fe2811eb 4068 goto err4;
60319eb1 4069
69086658 4070 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4071 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4072 if (err) {
4073 if (err == -EEXIST) {
9744a6fc
PNA		 4074 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4075 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4076 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4077 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
4078 return -EBUSY;
8aeff920
PNA		 4079 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4080 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4081 memcmp(nft_set_ext_data(ext),
4082 nft_set_ext_data(ext2), set->dlen) != 0) ||
4083 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4084 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4085 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4086 err = -EBUSY;
4087 else if (!(nlmsg_flags & NLM_F_EXCL))
4088 err = 0;
4089 }
fe2811eb 4090 goto err5;
c016c7e4 4091 }
20a69341 4092
35d0ac90
PNA		 4093 if (set->size &&
4094 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4095 err = -ENFILE;
4096 goto err6;
4097 }
4098
60319eb1 4099 nft_trans_elem(trans) = elem;
46bbafce 4100 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4101 return 0;
4102
35d0ac90 4103err6:
5cb82a38 4104 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4105err5:
60319eb1 4106 kfree(trans);
fe2811eb
PM		 4107err4:
4108 kfree(elem.priv);
20a69341
PM		 4109err3:
4110 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4111 nft_data_release(&data, d2.type);
20a69341 4112err2:
59105446 4113 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4114err1:
4115 return err;
4116}
4117
633c9a84
PNA		 4118static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4119 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4120 const struct nlattr * const nla[],
4121 struct netlink_ext_ack *extack)
20a69341 4122{
f2a6d766 4123 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4124 const struct nlattr *attr;
4125 struct nft_set *set;
4126 struct nft_ctx ctx;
60319eb1 4127 int rem, err = 0;
20a69341 4128
7d5570ca
PNA		 4129 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4130 return -EINVAL;
4131
36dd1bcc
PNA		 4132 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4133 genmask);
20a69341
PM		 4134 if (err < 0)
4135 return err;
4136
a3073c17
PNA		 4137 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4138 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4139 if (IS_ERR(set))
4140 return PTR_ERR(set);
958bee14 4141
20a69341
PM		 4142 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4143 return -EBUSY;
4144
4145 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4146 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4147 if (err < 0)
60319eb1 4148 break;
20a69341 4149 }
60319eb1 4150 return err;
20a69341
PM		 4151}
4152
59105446
PNA		 4153/**
4154 * nft_data_hold - hold a nft_data item
4155 *
4156 * @data: struct nft_data to release
4157 * @type: type of data
4158 *
4159 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4160 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4161 * NFT_GOTO verdicts. This function must be called on active data objects
4162 * from the second phase of the commit protocol.
4163 */
4164static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4165{
4166 if (type == NFT_DATA_VERDICT) {
4167 switch (data->verdict.code) {
4168 case NFT_JUMP:
4169 case NFT_GOTO:
4170 data->verdict.chain->use++;
4171 break;
4172 }
4173 }
4174}
4175
4176static void nft_set_elem_activate(const struct net *net,
4177 const struct nft_set *set,
4178 struct nft_set_elem *elem)
4179{
4180 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4181
4182 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4183 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4184 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4185 (*nft_set_ext_obj(ext))->use++;
4186}
4187
4188static void nft_set_elem_deactivate(const struct net *net,
4189 const struct nft_set *set,
4190 struct nft_set_elem *elem)
4191{
4192 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4193
4194 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4195 nft_data_release(nft_set_ext_data(ext), set->dtype);
4196 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4197 (*nft_set_ext_obj(ext))->use--;
4198}
4199
60319eb1 4200static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4201 const struct nlattr *attr)
4202{
4203 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4204 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4205 struct nft_data_desc desc;
4206 struct nft_set_elem elem;
3971ca14 4207 struct nft_set_ext *ext;
60319eb1 4208 struct nft_trans *trans;
3971ca14
PNA		 4209 u32 flags = 0;
4210 void *priv;
20a69341
PM		 4211 int err;
4212
4213 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4214 nft_set_elem_policy, NULL);
20a69341
PM		 4215 if (err < 0)
4216 goto err1;
4217
4218 err = -EINVAL;
4219 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4220 goto err1;
4221
3971ca14
PNA		 4222 nft_set_ext_prepare(&tmpl);
4223
4224 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4225 if (err < 0)
4226 return err;
4227 if (flags != 0)
4228 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4229
7d740264 4230 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4231 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4232 if (err < 0)
4233 goto err1;
4234
4235 err = -EINVAL;
4236 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4237 goto err2;
4238
3971ca14
PNA		 4239 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4240
4241 err = -ENOMEM;
4242 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4243 GFP_KERNEL);
4244 if (elem.priv == NULL)
4245 goto err2;
4246
4247 ext = nft_set_elem_ext(set, elem.priv);
4248 if (flags)
4249 *nft_set_ext_flags(ext) = flags;
4250
60319eb1 4251 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4252 if (trans == NULL) {
4253 err = -ENOMEM;
3971ca14 4254 goto err3;
609ccf08 4255 }
20a69341 4256
42a55769 4257 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4258 if (priv == NULL) {
cc02e457 4259 err = -ENOENT;
3971ca14 4260 goto err4;
cc02e457 4261 }
3971ca14
PNA		 4262 kfree(elem.priv);
4263 elem.priv = priv;
cc02e457 4264
59105446
PNA		 4265 nft_set_elem_deactivate(ctx->net, set, &elem);
4266
60319eb1 4267 nft_trans_elem(trans) = elem;
46bbafce 4268 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4269 return 0;
cc02e457 4270
3971ca14 4271err4:
cc02e457 4272 kfree(trans);
3971ca14
PNA		 4273err3:
4274 kfree(elem.priv);
20a69341 4275err2:
59105446 4276 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4277err1:
4278 return err;
4279}
4280
8411b644 4281static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4282 struct nft_set *set,
8411b644 4283 const struct nft_set_iter *iter,
de70185d 4284 struct nft_set_elem *elem)
8411b644
PNA		 4285{
4286 struct nft_trans *trans;
4287 int err;
4288
4289 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4290 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4291 if (!trans)
4292 return -ENOMEM;
4293
1ba1c414 4294 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4295 err = -ENOENT;
4296 goto err1;
4297 }
b2c11e4b 4298 set->ndeact++;
8411b644 4299
de70185d
PNA		 4300 nft_trans_elem_set(trans) = set;
4301 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4302 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4303
4304 return 0;
4305err1:
4306 kfree(trans);
4307 return err;
4308}
4309
633c9a84
PNA		 4310static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4311 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4312 const struct nlattr * const nla[],
4313 struct netlink_ext_ack *extack)
20a69341 4314{
f2a6d766 4315 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4316 const struct nlattr *attr;
4317 struct nft_set *set;
4318 struct nft_ctx ctx;
60319eb1 4319 int rem, err = 0;
20a69341 4320
36dd1bcc
PNA		 4321 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4322 genmask);
20a69341
PM		 4323 if (err < 0)
4324 return err;
4325
cac20fcd 4326 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 4327 if (IS_ERR(set))
4328 return PTR_ERR(set);
4329 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4330 return -EBUSY;
4331
8411b644 4332 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4333 struct nft_set_iter iter = {
4334 .genmask = genmask,
4335 .fn = nft_flush_set,
8411b644 4336 };
baa2d42c 4337 set->ops->walk(&ctx, set, &iter);
8411b644 4338
baa2d42c 4339 return iter.err;
8411b644
PNA		 4340 }
4341
20a69341
PM		 4342 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4343 err = nft_del_setelem(&ctx, set, attr);
4344 if (err < 0)
60319eb1 4345 break;
4fefee57 4346
3dd0673a 4347 set->ndeact++;
20a69341 4348 }
60319eb1 4349 return err;
20a69341
PM		 4350}
4351
cfed7e1b
PM		 4352void nft_set_gc_batch_release(struct rcu_head *rcu)
4353{
4354 struct nft_set_gc_batch *gcb;
4355 unsigned int i;
4356
4357 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4358 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4359 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4360 kfree(gcb);
4361}
4362EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4363
4364struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4365 gfp_t gfp)
4366{
4367 struct nft_set_gc_batch *gcb;
4368
4369 gcb = kzalloc(sizeof(*gcb), gfp);
4370 if (gcb == NULL)
4371 return gcb;
4372 gcb->head.set = set;
4373 return gcb;
4374}
4375EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4376
e5009240
PNA		 4377/*
4378 * Stateful objects
4379 */
4380
4381/**
4382 * nft_register_obj- register nf_tables stateful object type
4383 * @obj: object type
4384 *
4385 * Registers the object type for use with nf_tables. Returns zero on
4386 * success or a negative errno code otherwise.
4387 */
4388int nft_register_obj(struct nft_object_type *obj_type)
4389{
4390 if (obj_type->type == NFT_OBJECT_UNSPEC)
4391 return -EINVAL;
4392
4393 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4394 list_add_rcu(&obj_type->list, &nf_tables_objects);
4395 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4396 return 0;
4397}
4398EXPORT_SYMBOL_GPL(nft_register_obj);
4399
4400/**
4401 * nft_unregister_obj - unregister nf_tables object type
4402 * @obj: object type
4403 *
4404 * Unregisters the object type for use with nf_tables.
4405 */
4406void nft_unregister_obj(struct nft_object_type *obj_type)
4407{
4408 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4409 list_del_rcu(&obj_type->list);
4410 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4411}
4412EXPORT_SYMBOL_GPL(nft_unregister_obj);
4413
cac20fcd
PNA		 4414struct nft_object *nft_obj_lookup(const struct nft_table *table,
4415 const struct nlattr *nla, u32 objtype,
4416 u8 genmask)
e5009240
PNA		 4417{
4418 struct nft_object *obj;
4419
4420 list_for_each_entry(obj, &table->objects, list) {
4421 if (!nla_strcmp(nla, obj->name) &&
dfc46034 4422 objtype == obj->ops->type->type &&
e5009240
PNA		 4423 nft_active_genmask(obj, genmask))
4424 return obj;
4425 }
4426 return ERR_PTR(-ENOENT);
4427}
cac20fcd 4428EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 4429
cac20fcd
PNA		 4430static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4431 const struct nlattr *nla,
4432 u32 objtype, u8 genmask)
3ecbfd65
HS		 4433{
4434 struct nft_object *obj;
4435
4436 list_for_each_entry(obj, &table->objects, list) {
4437 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4438 objtype == obj->ops->type->type &&
4439 nft_active_genmask(obj, genmask))
4440 return obj;
4441 }
4442 return ERR_PTR(-ENOENT);
4443}
4444
e5009240 4445static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4446 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4447 .len = NFT_TABLE_MAXNAMELEN - 1 },
4448 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4449 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4450 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4451 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 4452 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 4453};
4454
84fba055
FW		 4455static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4456 const struct nft_object_type *type,
e5009240
PNA		 4457 const struct nlattr *attr)
4458{
5b4c6e38 4459 struct nlattr **tb;
dfc46034 4460 const struct nft_object_ops *ops;
e5009240 4461 struct nft_object *obj;
5b4c6e38
GS		 4462 int err = -ENOMEM;
4463
4464 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4465 if (!tb)
4466 goto err1;
e5009240
PNA		 4467
4468 if (attr) {
fceb6435
JB		 4469 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4470 NULL);
e5009240 4471 if (err < 0)
5b4c6e38 4472 goto err2;
e5009240
PNA		 4473 } else {
4474 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4475 }
4476
dfc46034
PBG		 4477 if (type->select_ops) {
4478 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4479 if (IS_ERR(ops)) {
4480 err = PTR_ERR(ops);
5b4c6e38 4481 goto err2;
dfc46034
PBG		 4482 }
4483 } else {
4484 ops = type->ops;
4485 }
4486
e5009240 4487 err = -ENOMEM;
dfc46034 4488 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 4489 if (!obj)
4490 goto err2;
e5009240 4491
dfc46034 4492 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 4493 if (err < 0)
5b4c6e38 4494 goto err3;
e5009240 4495
dfc46034
PBG		 4496 obj->ops = ops;
4497
5b4c6e38 4498 kfree(tb);
e5009240 4499 return obj;
5b4c6e38 4500err3:
e5009240 4501 kfree(obj);
5b4c6e38
GS		 4502err2:
4503 kfree(tb);
e5009240
PNA		 4504err1:
4505 return ERR_PTR(err);
4506}
4507
4508static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4509 struct nft_object *obj, bool reset)
e5009240
PNA		 4510{
4511 struct nlattr *nest;
4512
4513 nest = nla_nest_start(skb, attr);
4514 if (!nest)
4515 goto nla_put_failure;
dfc46034 4516 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 4517 goto nla_put_failure;
4518 nla_nest_end(skb, nest);
4519 return 0;
4520
4521nla_put_failure:
4522 return -1;
4523}
4524
4525static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4526{
4527 const struct nft_object_type *type;
4528
4529 list_for_each_entry(type, &nf_tables_objects, list) {
4530 if (objtype == type->type)
4531 return type;
4532 }
4533 return NULL;
4534}
4535
4536static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4537{
4538 const struct nft_object_type *type;
4539
4540 type = __nft_obj_type_get(objtype);
4541 if (type != NULL && try_module_get(type->owner))
4542 return type;
4543
4544#ifdef CONFIG_MODULES
4545 if (type == NULL) {
4546 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4547 request_module("nft-obj-%u", objtype);
4548 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4549 if (__nft_obj_type_get(objtype))
4550 return ERR_PTR(-EAGAIN);
4551 }
4552#endif
4553 return ERR_PTR(-ENOENT);
4554}
4555
4556static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4557 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4558 const struct nlattr * const nla[],
4559 struct netlink_ext_ack *extack)
e5009240
PNA		 4560{
4561 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4562 const struct nft_object_type *type;
4563 u8 genmask = nft_genmask_next(net);
4564 int family = nfmsg->nfgen_family;
e5009240
PNA		 4565 struct nft_table *table;
4566 struct nft_object *obj;
4567 struct nft_ctx ctx;
4568 u32 objtype;
4569 int err;
4570
4571 if (!nla[NFTA_OBJ_TYPE] ||
4572 !nla[NFTA_OBJ_NAME] ||
4573 !nla[NFTA_OBJ_DATA])
4574 return -EINVAL;
4575
cac20fcd 4576 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4577 if (IS_ERR(table)) {
4578 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4579 return PTR_ERR(table);
36dd1bcc 4580 }
e5009240
PNA		 4581
4582 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 4583 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 4584 if (IS_ERR(obj)) {
4585 err = PTR_ERR(obj);
36dd1bcc
PNA		 4586 if (err != -ENOENT) {
4587 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4588 return err;
36dd1bcc 4589 }
1a28ad74 4590 } else {
36dd1bcc
PNA		 4591 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4592 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4593 return -EEXIST;
36dd1bcc 4594 }
e5009240
PNA		 4595 return 0;
4596 }
4597
98319cb9 4598 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 4599
4600 type = nft_obj_type_get(objtype);
4601 if (IS_ERR(type))
4602 return PTR_ERR(type);
4603
84fba055 4604 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 4605 if (IS_ERR(obj)) {
4606 err = PTR_ERR(obj);
4607 goto err1;
4608 }
18965317 4609 obj->table = table;
3ecbfd65
HS		 4610 obj->handle = nf_tables_alloc_handle(table);
4611
61509575
PS		 4612 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4613 if (!obj->name) {
4614 err = -ENOMEM;
4615 goto err2;
4616 }
e5009240
PNA		 4617
4618 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4619 if (err < 0)
61509575 4620 goto err3;
e5009240
PNA		 4621
4622 list_add_tail_rcu(&obj->list, &table->objects);
4623 table->use++;
4624 return 0;
61509575
PS		 4625err3:
4626 kfree(obj->name);
e5009240 4627err2:
dfc46034
PBG		 4628 if (obj->ops->destroy)
4629 obj->ops->destroy(obj);
e5009240
PNA		 4630 kfree(obj);
4631err1:
4632 module_put(type->owner);
4633 return err;
4634}
4635
4636static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4637 u32 portid, u32 seq, int event, u32 flags,
4638 int family, const struct nft_table *table,
43da04a5 4639 struct nft_object *obj, bool reset)
e5009240
PNA		 4640{
4641 struct nfgenmsg *nfmsg;
4642 struct nlmsghdr *nlh;
4643
dedb67c4 4644 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 4645 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4646 if (nlh == NULL)
4647 goto nla_put_failure;
4648
4649 nfmsg = nlmsg_data(nlh);
4650 nfmsg->nfgen_family = family;
4651 nfmsg->version = NFNETLINK_V0;
4652 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4653
4654 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4655 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
dfc46034 4656 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 4657 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 4658 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
4659 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
4660 NFTA_OBJ_PAD))
e5009240
PNA		 4661 goto nla_put_failure;
4662
4663 nlmsg_end(skb, nlh);
4664 return 0;
4665
4666nla_put_failure:
4667 nlmsg_trim(skb, nlh);
4668 return -1;
4669}
4670
a9fea2a3 4671struct nft_obj_filter {
e46abbcc 4672 char *table;
a9fea2a3
PNA		 4673 u32 type;
4674};
4675
e5009240
PNA		 4676static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4677{
4678 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 4679 const struct nft_table *table;
e5009240 4680 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 4681 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 4682 struct net *net = sock_net(skb->sk);
4683 int family = nfmsg->nfgen_family;
43da04a5
PNA		 4684 struct nft_object *obj;
4685 bool reset = false;
4686
4687 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4688 reset = true;
e5009240
PNA		 4689
4690 rcu_read_lock();
4691 cb->seq = net->nft.base_seq;
4692
36596dad 4693 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 4694 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 4695 continue;
4696
36596dad
PNA		 4697 list_for_each_entry_rcu(obj, &table->objects, list) {
4698 if (!nft_is_active(net, obj))
4699 goto cont;
4700 if (idx < s_idx)
4701 goto cont;
4702 if (idx > s_idx)
4703 memset(&cb->args[1], 0,
4704 sizeof(cb->args) - sizeof(cb->args[0]));
4705 if (filter && filter->table[0] &&
4706 strcmp(filter->table, table->name))
4707 goto cont;
4708 if (filter &&
4709 filter->type != NFT_OBJECT_UNSPEC &&
4710 obj->ops->type->type != filter->type)
4711 goto cont;
a9fea2a3 4712
36596dad
PNA		 4713 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4714 cb->nlh->nlmsg_seq,
4715 NFT_MSG_NEWOBJ,
4716 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 4717 table->family, table,
36596dad
PNA		 4718 obj, reset) < 0)
4719 goto done;
e5009240 4720
36596dad 4721 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 4722cont:
36596dad 4723 idx++;
e5009240
PNA		 4724 }
4725 }
4726done:
4727 rcu_read_unlock();
4728
4729 cb->args[0] = idx;
4730 return skb->len;
4731}
4732
a9fea2a3
PNA		 4733static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4734{
e46abbcc
PS		 4735 struct nft_obj_filter *filter = cb->data;
4736
8bea728d
HL		 4737 if (filter) {
4738 kfree(filter->table);
4739 kfree(filter);
4740 }
a9fea2a3
PNA		 4741
4742 return 0;
4743}
4744
4745static struct nft_obj_filter *
4746nft_obj_filter_alloc(const struct nlattr * const nla[])
4747{
4748 struct nft_obj_filter *filter;
4749
4750 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4751 if (!filter)
4752 return ERR_PTR(-ENOMEM);
4753
e46abbcc
PS		 4754 if (nla[NFTA_OBJ_TABLE]) {
4755 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL);
4756 if (!filter->table) {
4757 kfree(filter);
4758 return ERR_PTR(-ENOMEM);
4759 }
4760 }
a9fea2a3
PNA		 4761 if (nla[NFTA_OBJ_TYPE])
4762 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4763
4764 return filter;
4765}
4766
e5009240
PNA		 4767static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4768 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4769 const struct nlattr * const nla[],
4770 struct netlink_ext_ack *extack)
e5009240
PNA		 4771{
4772 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4773 u8 genmask = nft_genmask_cur(net);
4774 int family = nfmsg->nfgen_family;
e5009240
PNA		 4775 const struct nft_table *table;
4776 struct nft_object *obj;
4777 struct sk_buff *skb2;
43da04a5 4778 bool reset = false;
e5009240
PNA		 4779 u32 objtype;
4780 int err;
4781
4782 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4783 struct netlink_dump_control c = {
4784 .dump = nf_tables_dump_obj,
a9fea2a3 4785 .done = nf_tables_dump_obj_done,
e5009240 4786 };
a9fea2a3
PNA		 4787
4788 if (nla[NFTA_OBJ_TABLE] ||
4789 nla[NFTA_OBJ_TYPE]) {
4790 struct nft_obj_filter *filter;
4791
4792 filter = nft_obj_filter_alloc(nla);
4793 if (IS_ERR(filter))
4794 return -ENOMEM;
4795
4796 c.data = filter;
4797 }
e5009240
PNA		 4798 return netlink_dump_start(nlsk, skb, nlh, &c);
4799 }
4800
4801 if (!nla[NFTA_OBJ_NAME] ||
4802 !nla[NFTA_OBJ_TYPE])
4803 return -EINVAL;
4804
cac20fcd 4805 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4806 if (IS_ERR(table)) {
4807 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4808 return PTR_ERR(table);
36dd1bcc 4809 }
e5009240
PNA		 4810
4811 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 4812 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 4813 if (IS_ERR(obj)) {
4814 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4815 return PTR_ERR(obj);
36dd1bcc 4816 }
e5009240
PNA		 4817
4818 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4819 if (!skb2)
4820 return -ENOMEM;
4821
43da04a5
PNA		 4822 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4823 reset = true;
4824
e5009240
PNA		 4825 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4826 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 4827 family, table, obj, reset);
e5009240
PNA		 4828 if (err < 0)
4829 goto err;
4830
4831 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4832err:
4833 kfree_skb(skb2);
4834 return err;
e5009240
PNA		 4835}
4836
4837static void nft_obj_destroy(struct nft_object *obj)
4838{
dfc46034
PBG		 4839 if (obj->ops->destroy)
4840 obj->ops->destroy(obj);
e5009240 4841
dfc46034 4842 module_put(obj->ops->type->owner);
61509575 4843 kfree(obj->name);
e5009240
PNA		 4844 kfree(obj);
4845}
4846
4847static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 4848 struct sk_buff *skb, const struct nlmsghdr *nlh,
4849 const struct nlattr * const nla[],
4850 struct netlink_ext_ack *extack)
e5009240
PNA		 4851{
4852 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4853 u8 genmask = nft_genmask_next(net);
4854 int family = nfmsg->nfgen_family;
36dd1bcc 4855 const struct nlattr *attr;
e5009240
PNA		 4856 struct nft_table *table;
4857 struct nft_object *obj;
4858 struct nft_ctx ctx;
4859 u32 objtype;
4860
4861 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 4862 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 4863 return -EINVAL;
4864
cac20fcd 4865 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4866 if (IS_ERR(table)) {
4867 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4868 return PTR_ERR(table);
36dd1bcc 4869 }
e5009240
PNA		 4870
4871 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 4872 if (nla[NFTA_OBJ_HANDLE]) {
4873 attr = nla[NFTA_OBJ_HANDLE];
4874 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
4875 } else {
4876 attr = nla[NFTA_OBJ_NAME];
4877 obj = nft_obj_lookup(table, attr, objtype, genmask);
4878 }
4879
4880 if (IS_ERR(obj)) {
4881 NL_SET_BAD_ATTR(extack, attr);
e5009240 4882 return PTR_ERR(obj);
36dd1bcc
PNA		 4883 }
4884 if (obj->use > 0) {
4885 NL_SET_BAD_ATTR(extack, attr);
e5009240 4886 return -EBUSY;
36dd1bcc 4887 }
e5009240 4888
98319cb9 4889 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 4890
4891 return nft_delobj(&ctx, obj);
4892}
4893
25e94a99
PNA		 4894void nft_obj_notify(struct net *net, struct nft_table *table,
4895 struct nft_object *obj, u32 portid, u32 seq, int event,
4896 int family, int report, gfp_t gfp)
e5009240
PNA		 4897{
4898 struct sk_buff *skb;
4899 int err;
4900
2599e989
PNA		 4901 if (!report &&
4902 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4903 return;
e5009240 4904
2599e989 4905 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 4906 if (skb == NULL)
4907 goto err;
4908
2599e989
PNA		 4909 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4910 table, obj, false);
e5009240
PNA		 4911 if (err < 0) {
4912 kfree_skb(skb);
4913 goto err;
4914 }
4915
25e94a99
PNA		 4916 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4917 return;
e5009240 4918err:
25e94a99 4919 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 4920}
2599e989
PNA		 4921EXPORT_SYMBOL_GPL(nft_obj_notify);
4922
25e94a99
PNA		 4923static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4924 struct nft_object *obj, int event)
2599e989 4925{
25e94a99 4926 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 4927 ctx->family, ctx->report, GFP_KERNEL);
2599e989 4928}
e5009240 4929
3b49e2e9
PNA		 4930/*
4931 * Flow tables
4932 */
4933void nft_register_flowtable_type(struct nf_flowtable_type *type)
4934{
4935 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4936 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
4937 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4938}
4939EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
4940
4941void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
4942{
4943 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4944 list_del_rcu(&type->list);
4945 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4946}
4947EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
4948
4949static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
4950 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
4951 .len = NFT_NAME_MAXLEN - 1 },
4952 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
4953 .len = NFT_NAME_MAXLEN - 1 },
4954 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 4955 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
3b49e2e9
PNA		 4956};
4957
cac20fcd
PNA		 4958struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
4959 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 4960{
4961 struct nft_flowtable *flowtable;
4962
4963 list_for_each_entry(flowtable, &table->flowtables, list) {
4964 if (!nla_strcmp(nla, flowtable->name) &&
4965 nft_active_genmask(flowtable, genmask))
4966 return flowtable;
4967 }
4968 return ERR_PTR(-ENOENT);
4969}
cac20fcd 4970EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 4971
ae0662f8 4972static struct nft_flowtable *
cac20fcd
PNA		 4973nft_flowtable_lookup_byhandle(const struct nft_table *table,
4974 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 4975{
4976 struct nft_flowtable *flowtable;
4977
4978 list_for_each_entry(flowtable, &table->flowtables, list) {
4979 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
4980 nft_active_genmask(flowtable, genmask))
4981 return flowtable;
4982 }
4983 return ERR_PTR(-ENOENT);
4984}
4985
3b49e2e9
PNA		 4986static int nf_tables_parse_devices(const struct nft_ctx *ctx,
4987 const struct nlattr *attr,
4988 struct net_device *dev_array[], int *len)
4989{
4990 const struct nlattr *tmp;
4991 struct net_device *dev;
4992 char ifname[IFNAMSIZ];
4993 int rem, n = 0, err;
4994
4995 nla_for_each_nested(tmp, attr, rem) {
4996 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
4997 err = -EINVAL;
4998 goto err1;
4999 }
5000
5001 nla_strlcpy(ifname, tmp, IFNAMSIZ);
90d2723c 5002 dev = __dev_get_by_name(ctx->net, ifname);
3b49e2e9
PNA		 5003 if (!dev) {
5004 err = -ENOENT;
5005 goto err1;
5006 }
5007
5008 dev_array[n++] = dev;
5009 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5010 err = -EFBIG;
5011 goto err1;
5012 }
5013 }
5014 if (!len)
5015 return -EINVAL;
5016
5017 err = 0;
5018err1:
5019 *len = n;
5020 return err;
5021}
5022
5023static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5024 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5025 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5026 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5027};
5028
5029static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5030 const struct nlattr *attr,
5031 struct nft_flowtable *flowtable)
5032{
5033 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5034 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5035 struct nf_hook_ops *ops;
5036 int hooknum, priority;
5037 int err, n = 0, i;
5038
5039 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5040 nft_flowtable_hook_policy, NULL);
5041 if (err < 0)
5042 return err;
5043
5044 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5045 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5046 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5047 return -EINVAL;
5048
5049 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 5050 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 5051 return -EINVAL;
5052
5053 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5054
5055 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5056 dev_array, &n);
5057 if (err < 0)
d92191aa 5058 return err;
3b49e2e9
PNA		 5059
5060 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
90d2723c
PNA		 5061 if (!ops)
5062 return -ENOMEM;
3b49e2e9 5063
0e839dfa
PNA		 5064 flowtable->hooknum = hooknum;
5065 flowtable->priority = priority;
3b49e2e9
PNA		 5066 flowtable->ops = ops;
5067 flowtable->ops_len = n;
5068
5069 for (i = 0; i < n; i++) {
5070 flowtable->ops[i].pf = NFPROTO_NETDEV;
5071 flowtable->ops[i].hooknum = hooknum;
5072 flowtable->ops[i].priority = priority;
17857d92 5073 flowtable->ops[i].priv = &flowtable->data;
3b49e2e9
PNA		 5074 flowtable->ops[i].hook = flowtable->data.type->hook;
5075 flowtable->ops[i].dev = dev_array[i];
d92191aa
PNA		 5076 flowtable->dev_name[i] = kstrdup(dev_array[i]->name,
5077 GFP_KERNEL);
3b49e2e9
PNA		 5078 }
5079
3b49e2e9
PNA		 5080 return err;
5081}
5082
98319cb9 5083static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5084{
5085 const struct nf_flowtable_type *type;
5086
5087 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 5088 if (family == type->family)
3b49e2e9
PNA		 5089 return type;
5090 }
5091 return NULL;
5092}
5093
98319cb9 5094static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5095{
5096 const struct nf_flowtable_type *type;
5097
98319cb9 5098 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 5099 if (type != NULL && try_module_get(type->owner))
5100 return type;
5101
5102#ifdef CONFIG_MODULES
5103 if (type == NULL) {
5104 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
98319cb9 5105 request_module("nf-flowtable-%u", family);
3b49e2e9 5106 nfnl_lock(NFNL_SUBSYS_NFTABLES);
98319cb9 5107 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 5108 return ERR_PTR(-EAGAIN);
5109 }
5110#endif
5111 return ERR_PTR(-ENOENT);
5112}
5113
3b49e2e9
PNA		 5114static void nft_unregister_flowtable_net_hooks(struct net *net,
5115 struct nft_flowtable *flowtable)
5116{
5117 int i;
5118
5119 for (i = 0; i < flowtable->ops_len; i++) {
5120 if (!flowtable->ops[i].dev)
5121 continue;
5122
5123 nf_unregister_net_hook(net, &flowtable->ops[i]);
5124 }
5125}
5126
5127static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5128 struct sk_buff *skb,
5129 const struct nlmsghdr *nlh,
5130 const struct nlattr * const nla[],
5131 struct netlink_ext_ack *extack)
5132{
5133 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5134 const struct nf_flowtable_type *type;
32fc7187 5135 struct nft_flowtable *flowtable, *ft;
3b49e2e9
PNA		 5136 u8 genmask = nft_genmask_next(net);
5137 int family = nfmsg->nfgen_family;
3b49e2e9
PNA		 5138 struct nft_table *table;
5139 struct nft_ctx ctx;
5140 int err, i, k;
5141
5142 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5143 !nla[NFTA_FLOWTABLE_NAME] ||
5144 !nla[NFTA_FLOWTABLE_HOOK])
5145 return -EINVAL;
5146
cac20fcd
PNA		 5147 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5148 genmask);
36dd1bcc
PNA		 5149 if (IS_ERR(table)) {
5150 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5151 return PTR_ERR(table);
36dd1bcc 5152 }
3b49e2e9 5153
cac20fcd
PNA		 5154 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5155 genmask);
3b49e2e9
PNA		 5156 if (IS_ERR(flowtable)) {
5157 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 5158 if (err != -ENOENT) {
5159 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5160 return err;
36dd1bcc 5161 }
3b49e2e9 5162 } else {
36dd1bcc
PNA		 5163 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5164 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5165 return -EEXIST;
36dd1bcc 5166 }
3b49e2e9
PNA		 5167
5168 return 0;
5169 }
5170
98319cb9 5171 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5172
5173 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5174 if (!flowtable)
5175 return -ENOMEM;
5176
5177 flowtable->table = table;
3ecbfd65
HS		 5178 flowtable->handle = nf_tables_alloc_handle(table);
5179
3b49e2e9
PNA		 5180 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5181 if (!flowtable->name) {
5182 err = -ENOMEM;
5183 goto err1;
5184 }
5185
98319cb9 5186 type = nft_flowtable_type_get(family);
3b49e2e9
PNA		 5187 if (IS_ERR(type)) {
5188 err = PTR_ERR(type);
5189 goto err2;
5190 }
5191
5192 flowtable->data.type = type;
a268de77 5193 err = type->init(&flowtable->data);
3b49e2e9
PNA		 5194 if (err < 0)
5195 goto err3;
5196
5197 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5198 flowtable);
5199 if (err < 0)
a268de77 5200 goto err4;
3b49e2e9
PNA		 5201
5202 for (i = 0; i < flowtable->ops_len; i++) {
32fc7187
PNA		 5203 if (!flowtable->ops[i].dev)
5204 continue;
5205
5206 list_for_each_entry(ft, &table->flowtables, list) {
5207 for (k = 0; k < ft->ops_len; k++) {
5208 if (!ft->ops[k].dev)
5209 continue;
5210
5211 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5212 flowtable->ops[i].pf == ft->ops[k].pf) {
5213 err = -EBUSY;
a268de77 5214 goto err5;
32fc7187
PNA		 5215 }
5216 }
5217 }
5218
3b49e2e9
PNA		 5219 err = nf_register_net_hook(net, &flowtable->ops[i]);
5220 if (err < 0)
a268de77 5221 goto err5;
3b49e2e9
PNA		 5222 }
5223
5224 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5225 if (err < 0)
a268de77 5226 goto err6;
3b49e2e9
PNA		 5227
5228 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5229 table->use++;
5230
5231 return 0;
a268de77 5232err6:
3b49e2e9 5233 i = flowtable->ops_len;
a268de77 5234err5:
d92191aa
PNA		 5235 for (k = i - 1; k >= 0; k--) {
5236 kfree(flowtable->dev_name[k]);
0e0d5002 5237 nf_unregister_net_hook(net, &flowtable->ops[k]);
d92191aa 5238 }
3b49e2e9
PNA		 5239
5240 kfree(flowtable->ops);
a268de77
FF		 5241err4:
5242 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5243err3:
5244 module_put(type->owner);
5245err2:
5246 kfree(flowtable->name);
5247err1:
5248 kfree(flowtable);
5249 return err;
5250}
5251
5252static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5253 struct sk_buff *skb,
5254 const struct nlmsghdr *nlh,
5255 const struct nlattr * const nla[],
5256 struct netlink_ext_ack *extack)
5257{
5258 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5259 u8 genmask = nft_genmask_next(net);
5260 int family = nfmsg->nfgen_family;
5261 struct nft_flowtable *flowtable;
36dd1bcc 5262 const struct nlattr *attr;
3b49e2e9
PNA		 5263 struct nft_table *table;
5264 struct nft_ctx ctx;
5265
e603ea4b
PNA		 5266 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5267 (!nla[NFTA_FLOWTABLE_NAME] &&
5268 !nla[NFTA_FLOWTABLE_HANDLE]))
5269 return -EINVAL;
5270
cac20fcd
PNA		 5271 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5272 genmask);
36dd1bcc
PNA		 5273 if (IS_ERR(table)) {
5274 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5275 return PTR_ERR(table);
36dd1bcc 5276 }
3b49e2e9 5277
36dd1bcc
PNA		 5278 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5279 attr = nla[NFTA_FLOWTABLE_HANDLE];
5280 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5281 } else {
5282 attr = nla[NFTA_FLOWTABLE_NAME];
5283 flowtable = nft_flowtable_lookup(table, attr, genmask);
5284 }
5285
5286 if (IS_ERR(flowtable)) {
5287 NL_SET_BAD_ATTR(extack, attr);
5288 return PTR_ERR(flowtable);
5289 }
5290 if (flowtable->use > 0) {
5291 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 5292 return -EBUSY;
36dd1bcc 5293 }
3b49e2e9 5294
98319cb9 5295 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5296
5297 return nft_delflowtable(&ctx, flowtable);
5298}
5299
5300static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5301 u32 portid, u32 seq, int event,
5302 u32 flags, int family,
5303 struct nft_flowtable *flowtable)
5304{
5305 struct nlattr *nest, *nest_devs;
5306 struct nfgenmsg *nfmsg;
5307 struct nlmsghdr *nlh;
5308 int i;
5309
5310 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5311 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5312 if (nlh == NULL)
5313 goto nla_put_failure;
5314
5315 nfmsg = nlmsg_data(nlh);
5316 nfmsg->nfgen_family = family;
5317 nfmsg->version = NFNETLINK_V0;
5318 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5319
5320 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5321 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 5322 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5323 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5324 NFTA_FLOWTABLE_PAD))
3b49e2e9
PNA		 5325 goto nla_put_failure;
5326
5327 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5328 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5329 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5330 goto nla_put_failure;
5331
5332 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5333 if (!nest_devs)
5334 goto nla_put_failure;
5335
5336 for (i = 0; i < flowtable->ops_len; i++) {
d92191aa 5337 if (flowtable->dev_name[i][0] &&
3b49e2e9 5338 nla_put_string(skb, NFTA_DEVICE_NAME,
d92191aa 5339 flowtable->dev_name[i]))
3b49e2e9
PNA		 5340 goto nla_put_failure;
5341 }
5342 nla_nest_end(skb, nest_devs);
5343 nla_nest_end(skb, nest);
5344
5345 nlmsg_end(skb, nlh);
5346 return 0;
5347
5348nla_put_failure:
5349 nlmsg_trim(skb, nlh);
5350 return -1;
5351}
5352
5353struct nft_flowtable_filter {
5354 char *table;
5355};
5356
5357static int nf_tables_dump_flowtable(struct sk_buff *skb,
5358 struct netlink_callback *cb)
5359{
5360 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5361 struct nft_flowtable_filter *filter = cb->data;
5362 unsigned int idx = 0, s_idx = cb->args[0];
5363 struct net *net = sock_net(skb->sk);
5364 int family = nfmsg->nfgen_family;
5365 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5366 const struct nft_table *table;
5367
5368 rcu_read_lock();
5369 cb->seq = net->nft.base_seq;
5370
36596dad 5371 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5372 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 5373 continue;
5374
36596dad
PNA		 5375 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5376 if (!nft_is_active(net, flowtable))
5377 goto cont;
5378 if (idx < s_idx)
5379 goto cont;
5380 if (idx > s_idx)
5381 memset(&cb->args[1], 0,
5382 sizeof(cb->args) - sizeof(cb->args[0]));
5383 if (filter && filter->table[0] &&
5384 strcmp(filter->table, table->name))
5385 goto cont;
3b49e2e9 5386
36596dad
PNA		 5387 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5388 cb->nlh->nlmsg_seq,
5389 NFT_MSG_NEWFLOWTABLE,
5390 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5391 table->family, flowtable) < 0)
36596dad 5392 goto done;
3b49e2e9 5393
36596dad 5394 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 5395cont:
36596dad 5396 idx++;
3b49e2e9
PNA		 5397 }
5398 }
5399done:
5400 rcu_read_unlock();
5401
5402 cb->args[0] = idx;
5403 return skb->len;
5404}
5405
5406static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
5407{
5408 struct nft_flowtable_filter *filter = cb->data;
5409
5410 if (!filter)
5411 return 0;
5412
5413 kfree(filter->table);
5414 kfree(filter);
5415
5416 return 0;
5417}
5418
5419static struct nft_flowtable_filter *
5420nft_flowtable_filter_alloc(const struct nlattr * const nla[])
5421{
5422 struct nft_flowtable_filter *filter;
5423
5424 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
5425 if (!filter)
5426 return ERR_PTR(-ENOMEM);
5427
5428 if (nla[NFTA_FLOWTABLE_TABLE]) {
5429 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5430 GFP_KERNEL);
5431 if (!filter->table) {
5432 kfree(filter);
5433 return ERR_PTR(-ENOMEM);
5434 }
5435 }
5436 return filter;
5437}
5438
5439static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5440 struct sk_buff *skb,
5441 const struct nlmsghdr *nlh,
5442 const struct nlattr * const nla[],
5443 struct netlink_ext_ack *extack)
5444{
5445 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5446 u8 genmask = nft_genmask_cur(net);
5447 int family = nfmsg->nfgen_family;
5448 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5449 const struct nft_table *table;
5450 struct sk_buff *skb2;
5451 int err;
5452
5453 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5454 struct netlink_dump_control c = {
5455 .dump = nf_tables_dump_flowtable,
5456 .done = nf_tables_dump_flowtable_done,
5457 };
5458
5459 if (nla[NFTA_FLOWTABLE_TABLE]) {
5460 struct nft_flowtable_filter *filter;
5461
5462 filter = nft_flowtable_filter_alloc(nla);
5463 if (IS_ERR(filter))
5464 return -ENOMEM;
5465
5466 c.data = filter;
5467 }
5468 return netlink_dump_start(nlsk, skb, nlh, &c);
5469 }
5470
5471 if (!nla[NFTA_FLOWTABLE_NAME])
5472 return -EINVAL;
5473
cac20fcd
PNA		 5474 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5475 genmask);
3b49e2e9
PNA		 5476 if (IS_ERR(table))
5477 return PTR_ERR(table);
5478
cac20fcd
PNA		 5479 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5480 genmask);
03a0120f 5481 if (IS_ERR(flowtable))
3b49e2e9
PNA		 5482 return PTR_ERR(flowtable);
5483
5484 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5485 if (!skb2)
5486 return -ENOMEM;
5487
5488 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5489 nlh->nlmsg_seq,
5490 NFT_MSG_NEWFLOWTABLE, 0, family,
5491 flowtable);
5492 if (err < 0)
5493 goto err;
5494
5495 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5496err:
5497 kfree_skb(skb2);
5498 return err;
5499}
5500
5501static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5502 struct nft_flowtable *flowtable,
5503 int event)
5504{
5505 struct sk_buff *skb;
5506 int err;
5507
5508 if (ctx->report &&
5509 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5510 return;
5511
5512 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5513 if (skb == NULL)
5514 goto err;
5515
5516 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5517 ctx->seq, event, 0,
36596dad 5518 ctx->family, flowtable);
3b49e2e9
PNA		 5519 if (err < 0) {
5520 kfree_skb(skb);
5521 goto err;
5522 }
5523
5524 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5525 ctx->report, GFP_KERNEL);
5526 return;
5527err:
5528 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5529}
5530
3b49e2e9
PNA		 5531static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5532{
c04a3f73 5533 kfree(flowtable->ops);
3b49e2e9 5534 kfree(flowtable->name);
b408c5b0 5535 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5536 module_put(flowtable->data.type->owner);
5537}
5538
84d7fce6
PNA		 5539static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5540 u32 portid, u32 seq)
5541{
5542 struct nlmsghdr *nlh;
5543 struct nfgenmsg *nfmsg;
784b4e61 5544 char buf[TASK_COMM_LEN];
dedb67c4 5545 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 5546
5547 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5548 if (nlh == NULL)
5549 goto nla_put_failure;
5550
5551 nfmsg = nlmsg_data(nlh);
5552 nfmsg->nfgen_family = AF_UNSPEC;
5553 nfmsg->version = NFNETLINK_V0;
5554 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5555
784b4e61
PS		 5556 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5557 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5558 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 5559 goto nla_put_failure;
5560
053c095a
JB		 5561 nlmsg_end(skb, nlh);
5562 return 0;
84d7fce6
PNA		 5563
5564nla_put_failure:
5565 nlmsg_trim(skb, nlh);
5566 return -EMSGSIZE;
5567}
5568
3b49e2e9
PNA		 5569static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5570 struct nft_flowtable *flowtable)
5571{
5572 int i;
5573
5574 for (i = 0; i < flowtable->ops_len; i++) {
5575 if (flowtable->ops[i].dev != dev)
5576 continue;
5577
5578 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
d92191aa 5579 flowtable->dev_name[i][0] = '\0';
3b49e2e9
PNA		 5580 flowtable->ops[i].dev = NULL;
5581 break;
5582 }
5583}
5584
5585static int nf_tables_flowtable_event(struct notifier_block *this,
5586 unsigned long event, void *ptr)
5587{
5588 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5589 struct nft_flowtable *flowtable;
5590 struct nft_table *table;
3b49e2e9
PNA		 5591
5592 if (event != NETDEV_UNREGISTER)
5593 return 0;
5594
5595 nfnl_lock(NFNL_SUBSYS_NFTABLES);
36596dad
PNA		 5596 list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
5597 list_for_each_entry(flowtable, &table->flowtables, list) {
5598 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 5599 }
5600 }
5601 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5602
5603 return NOTIFY_DONE;
5604}
5605
5606static struct notifier_block nf_tables_flowtable_notifier = {
5607 .notifier_call = nf_tables_flowtable_event,
5608};
5609
25e94a99
PNA		 5610static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5611 int event)
84d7fce6
PNA		 5612{
5613 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5614 struct sk_buff *skb2;
5615 int err;
5616
5617 if (nlmsg_report(nlh) &&
5618 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5619 return;
84d7fce6 5620
84d7fce6
PNA		 5621 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5622 if (skb2 == NULL)
5623 goto err;
5624
5625 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5626 nlh->nlmsg_seq);
5627 if (err < 0) {
5628 kfree_skb(skb2);
5629 goto err;
5630 }
5631
25e94a99
PNA		 5632 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5633 nlmsg_report(nlh), GFP_KERNEL);
5634 return;
84d7fce6 5635err:
25e94a99
PNA		 5636 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5637 -ENOBUFS);
84d7fce6
PNA		 5638}
5639
7b8002a1
PNA		 5640static int nf_tables_getgen(struct net *net, struct sock *nlsk,
5641 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5642 const struct nlattr * const nla[],
5643 struct netlink_ext_ack *extack)
84d7fce6 5644{
84d7fce6
PNA		 5645 struct sk_buff *skb2;
5646 int err;
5647
5648 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5649 if (skb2 == NULL)
5650 return -ENOMEM;
5651
5652 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5653 nlh->nlmsg_seq);
5654 if (err < 0)
5655 goto err;
5656
5657 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5658err:
5659 kfree_skb(skb2);
5660 return err;
5661}
5662
96518518
PM		 5663static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
5664 [NFT_MSG_NEWTABLE] = {
55dd6f93 5665 .call_batch = nf_tables_newtable,
96518518
PM		 5666 .attr_count = NFTA_TABLE_MAX,
5667 .policy = nft_table_policy,
5668 },
5669 [NFT_MSG_GETTABLE] = {
5670 .call = nf_tables_gettable,
5671 .attr_count = NFTA_TABLE_MAX,
5672 .policy = nft_table_policy,
5673 },
5674 [NFT_MSG_DELTABLE] = {
55dd6f93 5675 .call_batch = nf_tables_deltable,
96518518
PM		 5676 .attr_count = NFTA_TABLE_MAX,
5677 .policy = nft_table_policy,
5678 },
5679 [NFT_MSG_NEWCHAIN] = {
91c7b38d 5680 .call_batch = nf_tables_newchain,
96518518
PM		 5681 .attr_count = NFTA_CHAIN_MAX,
5682 .policy = nft_chain_policy,
5683 },
5684 [NFT_MSG_GETCHAIN] = {
5685 .call = nf_tables_getchain,
5686 .attr_count = NFTA_CHAIN_MAX,
5687 .policy = nft_chain_policy,
5688 },
5689 [NFT_MSG_DELCHAIN] = {
91c7b38d 5690 .call_batch = nf_tables_delchain,
96518518
PM		 5691 .attr_count = NFTA_CHAIN_MAX,
5692 .policy = nft_chain_policy,
5693 },
5694 [NFT_MSG_NEWRULE] = {
0628b123 5695 .call_batch = nf_tables_newrule,
96518518
PM		 5696 .attr_count = NFTA_RULE_MAX,
5697 .policy = nft_rule_policy,
5698 },
5699 [NFT_MSG_GETRULE] = {
5700 .call = nf_tables_getrule,
5701 .attr_count = NFTA_RULE_MAX,
5702 .policy = nft_rule_policy,
5703 },
5704 [NFT_MSG_DELRULE] = {
0628b123 5705 .call_batch = nf_tables_delrule,
96518518
PM		 5706 .attr_count = NFTA_RULE_MAX,
5707 .policy = nft_rule_policy,
5708 },
20a69341 5709 [NFT_MSG_NEWSET] = {
958bee14 5710 .call_batch = nf_tables_newset,
20a69341
PM		 5711 .attr_count = NFTA_SET_MAX,
5712 .policy = nft_set_policy,
5713 },
5714 [NFT_MSG_GETSET] = {
5715 .call = nf_tables_getset,
5716 .attr_count = NFTA_SET_MAX,
5717 .policy = nft_set_policy,
5718 },
5719 [NFT_MSG_DELSET] = {
958bee14 5720 .call_batch = nf_tables_delset,
20a69341
PM		 5721 .attr_count = NFTA_SET_MAX,
5722 .policy = nft_set_policy,
5723 },
5724 [NFT_MSG_NEWSETELEM] = {
958bee14 5725 .call_batch = nf_tables_newsetelem,
20a69341
PM		 5726 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5727 .policy = nft_set_elem_list_policy,
5728 },
5729 [NFT_MSG_GETSETELEM] = {
5730 .call = nf_tables_getsetelem,
5731 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5732 .policy = nft_set_elem_list_policy,
5733 },
5734 [NFT_MSG_DELSETELEM] = {
958bee14 5735 .call_batch = nf_tables_delsetelem,
20a69341
PM		 5736 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5737 .policy = nft_set_elem_list_policy,
5738 },
84d7fce6
PNA		 5739 [NFT_MSG_GETGEN] = {
5740 .call = nf_tables_getgen,
5741 },
e5009240
PNA		 5742 [NFT_MSG_NEWOBJ] = {
5743 .call_batch = nf_tables_newobj,
5744 .attr_count = NFTA_OBJ_MAX,
5745 .policy = nft_obj_policy,
5746 },
5747 [NFT_MSG_GETOBJ] = {
5748 .call = nf_tables_getobj,
5749 .attr_count = NFTA_OBJ_MAX,
5750 .policy = nft_obj_policy,
5751 },
5752 [NFT_MSG_DELOBJ] = {
5753 .call_batch = nf_tables_delobj,
5754 .attr_count = NFTA_OBJ_MAX,
5755 .policy = nft_obj_policy,
5756 },
43da04a5
PNA		 5757 [NFT_MSG_GETOBJ_RESET] = {
5758 .call = nf_tables_getobj,
5759 .attr_count = NFTA_OBJ_MAX,
5760 .policy = nft_obj_policy,
5761 },
3b49e2e9
PNA		 5762 [NFT_MSG_NEWFLOWTABLE] = {
5763 .call_batch = nf_tables_newflowtable,
5764 .attr_count = NFTA_FLOWTABLE_MAX,
5765 .policy = nft_flowtable_policy,
5766 },
5767 [NFT_MSG_GETFLOWTABLE] = {
5768 .call = nf_tables_getflowtable,
5769 .attr_count = NFTA_FLOWTABLE_MAX,
5770 .policy = nft_flowtable_policy,
5771 },
5772 [NFT_MSG_DELFLOWTABLE] = {
5773 .call_batch = nf_tables_delflowtable,
5774 .attr_count = NFTA_FLOWTABLE_MAX,
5775 .policy = nft_flowtable_policy,
5776 },
96518518
PM		 5777};
5778
91c7b38d
PNA		 5779static void nft_chain_commit_update(struct nft_trans *trans)
5780{
5781 struct nft_base_chain *basechain;
5782
b7263e07 5783 if (nft_trans_chain_name(trans))
91c7b38d
PNA		 5784 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
5785
f323d954 5786 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 5787 return;
5788
5789 basechain = nft_base_chain(trans->ctx.chain);
5790 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5791
5792 switch (nft_trans_chain_policy(trans)) {
5793 case NF_DROP:
5794 case NF_ACCEPT:
5795 basechain->policy = nft_trans_chain_policy(trans);
5796 break;
5797 }
5798}
5799
b326dd37 5800static void nf_tables_commit_release(struct nft_trans *trans)
c7c32e72 5801{
c7c32e72
PNA		 5802 switch (trans->msg_type) {
5803 case NFT_MSG_DELTABLE:
5804 nf_tables_table_destroy(&trans->ctx);
5805 break;
5806 case NFT_MSG_DELCHAIN:
43a605f2 5807 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 5808 break;
5809 case NFT_MSG_DELRULE:
5810 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5811 break;
5812 case NFT_MSG_DELSET:
5813 nft_set_destroy(nft_trans_set(trans));
5814 break;
61edafbb 5815 case NFT_MSG_DELSETELEM:
59105446
PNA		 5816 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
5817 nft_trans_elem(trans).priv);
61edafbb 5818 break;
e5009240
PNA		 5819 case NFT_MSG_DELOBJ:
5820 nft_obj_destroy(nft_trans_obj(trans));
5821 break;
3b49e2e9
PNA		 5822 case NFT_MSG_DELFLOWTABLE:
5823 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5824 break;
c7c32e72
PNA		 5825 }
5826 kfree(trans);
5827}
5828
5913beaf 5829static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 5830{
37082f93 5831 struct nft_trans *trans, *next;
a3716e70 5832 struct nft_trans_elem *te;
37082f93
PNA		 5833
5834 /* Bump generation counter, invalidate any dump in progress */
38e029f1 5835 while (++net->nft.base_seq == 0);
37082f93
PNA		 5836
5837 /* A new generation has just started */
ea4bd995 5838 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 5839
5840 /* Make sure all packets have left the previous generation before
5841 * purging old rules.
5842 */
5843 synchronize_rcu();
5844
5845 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 5846 switch (trans->msg_type) {
55dd6f93
PNA		 5847 case NFT_MSG_NEWTABLE:
5848 if (nft_trans_table_update(trans)) {
5849 if (!nft_trans_table_enable(trans)) {
664b0f8c 5850 nf_tables_table_disable(net,
55dd6f93
PNA		 5851 trans->ctx.table);
5852 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5853 }
5854 } else {
f2a6d766 5855 nft_clear(net, trans->ctx.table);
55dd6f93 5856 }
35151d84 5857 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 5858 nft_trans_destroy(trans);
5859 break;
5860 case NFT_MSG_DELTABLE:
f2a6d766 5861 list_del_rcu(&trans->ctx.table->list);
35151d84 5862 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 5863 break;
91c7b38d
PNA		 5864 case NFT_MSG_NEWCHAIN:
5865 if (nft_trans_chain_update(trans))
5866 nft_chain_commit_update(trans);
4fefee57 5867 else
664b0f8c 5868 nft_clear(net, trans->ctx.chain);
4fefee57 5869
35151d84 5870 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
91c7b38d
PNA		 5871 nft_trans_destroy(trans);
5872 break;
5873 case NFT_MSG_DELCHAIN:
664b0f8c 5874 list_del_rcu(&trans->ctx.chain->list);
35151d84 5875 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 5876 nf_tables_unregister_hook(trans->ctx.net,
5877 trans->ctx.table,
5878 trans->ctx.chain);
91c7b38d 5879 break;
b380e5c7 5880 case NFT_MSG_NEWRULE:
889f7ee7 5881 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 5882 nf_tables_rule_notify(&trans->ctx,
37082f93 5883 nft_trans_rule(trans),
35151d84 5884 NFT_MSG_NEWRULE);
37082f93 5885 nft_trans_destroy(trans);
b380e5c7
PNA		 5886 break;
5887 case NFT_MSG_DELRULE:
5888 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 5889 nf_tables_rule_notify(&trans->ctx,
5890 nft_trans_rule(trans),
5891 NFT_MSG_DELRULE);
b380e5c7 5892 break;
958bee14 5893 case NFT_MSG_NEWSET:
37a9cc52 5894 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 5895 /* This avoids hitting -EBUSY when deleting the table
5896 * from the transaction.
5897 */
408070d6 5898 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 5899 !list_empty(&nft_trans_set(trans)->bindings))
5900 trans->ctx.table->use--;
5901
958bee14 5902 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5903 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 5904 nft_trans_destroy(trans);
5905 break;
5906 case NFT_MSG_DELSET:
37a9cc52 5907 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 5908 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5909 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 5910 break;
60319eb1 5911 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 5912 te = (struct nft_trans_elem *)trans->data;
5913
42a55769 5914 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 5915 nf_tables_setelem_notify(&trans->ctx, te->set,
5916 &te->elem,
60319eb1
PNA		 5917 NFT_MSG_NEWSETELEM, 0);
5918 nft_trans_destroy(trans);
5919 break;
5920 case NFT_MSG_DELSETELEM:
a3716e70 5921 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5922
a3716e70
PNA		 5923 nf_tables_setelem_notify(&trans->ctx, te->set,
5924 &te->elem,
60319eb1 5925 NFT_MSG_DELSETELEM, 0);
5cb82a38 5926 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 5927 atomic_dec(&te->set->nelems);
5928 te->set->ndeact--;
60319eb1 5929 break;
e5009240
PNA		 5930 case NFT_MSG_NEWOBJ:
5931 nft_clear(net, nft_trans_obj(trans));
5932 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5933 NFT_MSG_NEWOBJ);
5934 nft_trans_destroy(trans);
5935 break;
5936 case NFT_MSG_DELOBJ:
5937 list_del_rcu(&nft_trans_obj(trans)->list);
5938 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5939 NFT_MSG_DELOBJ);
5940 break;
3b49e2e9
PNA		 5941 case NFT_MSG_NEWFLOWTABLE:
5942 nft_clear(net, nft_trans_flowtable(trans));
5943 nf_tables_flowtable_notify(&trans->ctx,
5944 nft_trans_flowtable(trans),
5945 NFT_MSG_NEWFLOWTABLE);
5946 nft_trans_destroy(trans);
5947 break;
5948 case NFT_MSG_DELFLOWTABLE:
5949 list_del_rcu(&nft_trans_flowtable(trans)->list);
5950 nf_tables_flowtable_notify(&trans->ctx,
5951 nft_trans_flowtable(trans),
5952 NFT_MSG_DELFLOWTABLE);
5953 nft_unregister_flowtable_net_hooks(net,
5954 nft_trans_flowtable(trans));
5955 break;
37082f93 5956 }
37082f93
PNA		 5957 }
5958
b326dd37
PNA		 5959 synchronize_rcu();
5960
37082f93 5961 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
c7c32e72 5962 list_del(&trans->list);
b326dd37 5963 nf_tables_commit_release(trans);
37082f93 5964 }
84d7fce6
PNA		 5965
5966 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
37082f93
PNA		 5967
5968 return 0;
5969}
5970
b326dd37 5971static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 5972{
c7c32e72
PNA		 5973 switch (trans->msg_type) {
5974 case NFT_MSG_NEWTABLE:
5975 nf_tables_table_destroy(&trans->ctx);
5976 break;
5977 case NFT_MSG_NEWCHAIN:
43a605f2 5978 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 5979 break;
5980 case NFT_MSG_NEWRULE:
5981 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5982 break;
5983 case NFT_MSG_NEWSET:
5984 nft_set_destroy(nft_trans_set(trans));
5985 break;
61edafbb
PM		 5986 case NFT_MSG_NEWSETELEM:
5987 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 5988 nft_trans_elem(trans).priv, true);
61edafbb 5989 break;
e5009240
PNA		 5990 case NFT_MSG_NEWOBJ:
5991 nft_obj_destroy(nft_trans_obj(trans));
5992 break;
3b49e2e9
PNA		 5993 case NFT_MSG_NEWFLOWTABLE:
5994 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5995 break;
c7c32e72
PNA		 5996 }
5997 kfree(trans);
5998}
5999
5913beaf 6000static int nf_tables_abort(struct net *net, struct sk_buff *skb)
37082f93 6001{
37082f93 6002 struct nft_trans *trans, *next;
02263db0 6003 struct nft_trans_elem *te;
37082f93 6004
a907e36d
XL		 6005 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6006 list) {
b380e5c7 6007 switch (trans->msg_type) {
55dd6f93
PNA		 6008 case NFT_MSG_NEWTABLE:
6009 if (nft_trans_table_update(trans)) {
6010 if (nft_trans_table_enable(trans)) {
664b0f8c 6011 nf_tables_table_disable(net,
55dd6f93
PNA		 6012 trans->ctx.table);
6013 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6014 }
6015 nft_trans_destroy(trans);
6016 } else {
e688a7f8 6017 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 6018 }
6019 break;
6020 case NFT_MSG_DELTABLE:
f2a6d766 6021 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 6022 nft_trans_destroy(trans);
6023 break;
91c7b38d
PNA		 6024 case NFT_MSG_NEWCHAIN:
6025 if (nft_trans_chain_update(trans)) {
982f4051 6026 free_percpu(nft_trans_chain_stats(trans));
91c7b38d
PNA		 6027
6028 nft_trans_destroy(trans);
6029 } else {
4fefee57 6030 trans->ctx.table->use--;
e688a7f8 6031 list_del_rcu(&trans->ctx.chain->list);
c974a3a3
PNA		 6032 nf_tables_unregister_hook(trans->ctx.net,
6033 trans->ctx.table,
6034 trans->ctx.chain);
91c7b38d
PNA		 6035 }
6036 break;
6037 case NFT_MSG_DELCHAIN:
4fefee57 6038 trans->ctx.table->use++;
664b0f8c 6039 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 6040 nft_trans_destroy(trans);
6041 break;
b380e5c7 6042 case NFT_MSG_NEWRULE:
4fefee57 6043 trans->ctx.chain->use--;
b380e5c7
PNA		 6044 list_del_rcu(&nft_trans_rule(trans)->list);
6045 break;
6046 case NFT_MSG_DELRULE:
4fefee57 6047 trans->ctx.chain->use++;
889f7ee7 6048 nft_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 6049 nft_trans_destroy(trans);
b380e5c7 6050 break;
958bee14 6051 case NFT_MSG_NEWSET:
4fefee57 6052 trans->ctx.table->use--;
e688a7f8 6053 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 6054 break;
6055 case NFT_MSG_DELSET:
4fefee57 6056 trans->ctx.table->use++;
37a9cc52 6057 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 6058 nft_trans_destroy(trans);
6059 break;
60319eb1 6060 case NFT_MSG_NEWSETELEM:
02263db0 6061 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6062
5cb82a38 6063 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 6064 atomic_dec(&te->set->nelems);
60319eb1
PNA		 6065 break;
6066 case NFT_MSG_DELSETELEM:
cc02e457
PM		 6067 te = (struct nft_trans_elem *)trans->data;
6068
59105446 6069 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 6070 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 6071 te->set->ndeact--;
cc02e457 6072
e5009240
PNA		 6073 nft_trans_destroy(trans);
6074 break;
6075 case NFT_MSG_NEWOBJ:
6076 trans->ctx.table->use--;
6077 list_del_rcu(&nft_trans_obj(trans)->list);
6078 break;
6079 case NFT_MSG_DELOBJ:
6080 trans->ctx.table->use++;
6081 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 6082 nft_trans_destroy(trans);
6083 break;
3b49e2e9
PNA		 6084 case NFT_MSG_NEWFLOWTABLE:
6085 trans->ctx.table->use--;
6086 list_del_rcu(&nft_trans_flowtable(trans)->list);
6087 nft_unregister_flowtable_net_hooks(net,
6088 nft_trans_flowtable(trans));
6089 break;
6090 case NFT_MSG_DELFLOWTABLE:
6091 trans->ctx.table->use++;
6092 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6093 nft_trans_destroy(trans);
6094 break;
37082f93 6095 }
37082f93
PNA		 6096 }
6097
b326dd37
PNA		 6098 synchronize_rcu();
6099
a1cee076
PNA		 6100 list_for_each_entry_safe_reverse(trans, next,
6101 &net->nft.commit_list, list) {
c7c32e72 6102 list_del(&trans->list);
b326dd37 6103 nf_tables_abort_release(trans);
37082f93
PNA		 6104 }
6105
6106 return 0;
6107}
6108
74e8bcd2
PNA		 6109static bool nf_tables_valid_genid(struct net *net, u32 genid)
6110{
6111 return net->nft.base_seq == genid;
6112}
6113
96518518
PM		 6114static const struct nfnetlink_subsystem nf_tables_subsys = {
6115 .name = "nf_tables",
6116 .subsys_id = NFNL_SUBSYS_NFTABLES,
6117 .cb_count = NFT_MSG_MAX,
6118 .cb = nf_tables_cb,
0628b123
PNA		 6119 .commit = nf_tables_commit,
6120 .abort = nf_tables_abort,
74e8bcd2 6121 .valid_genid = nf_tables_valid_genid,
96518518
PM		 6122};
6123
7210e4e3 6124int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 6125 enum nft_chain_types type)
7210e4e3
PNA		 6126{
6127 const struct nft_base_chain *basechain;
6128
f323d954 6129 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6130 basechain = nft_base_chain(chain);
6131 if (basechain->type->type != type)
6132 return -EOPNOTSUPP;
6133 }
6134 return 0;
6135}
6136EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6137
75e8d06d
PNA		 6138int nft_chain_validate_hooks(const struct nft_chain *chain,
6139 unsigned int hook_flags)
6140{
6141 struct nft_base_chain *basechain;
6142
f323d954 6143 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6144 basechain = nft_base_chain(chain);
6145
c974a3a3 6146 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6147 return 0;
6148
6149 return -EOPNOTSUPP;
6150 }
6151
6152 return 0;
6153}
6154EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6155
20a69341
PM		 6156/*
6157 * Loop detection - walk through the ruleset beginning at the destination chain
6158 * of a new jump until either the source chain is reached (loop) or all
6159 * reachable chains have been traversed.
6160 *
6161 * The loop check is performed whenever a new jump verdict is added to an
6162 * expression or verdict map or a verdict map is bound to a new chain.
6163 */
6164
6165static int nf_tables_check_loops(const struct nft_ctx *ctx,
6166 const struct nft_chain *chain);
6167
6168static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6169 struct nft_set *set,
20a69341 6170 const struct nft_set_iter *iter,
de70185d 6171 struct nft_set_elem *elem)
20a69341 6172{
fe2811eb
PM		 6173 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6174 const struct nft_data *data;
6175
6176 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6177 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 6178 return 0;
6179
fe2811eb 6180 data = nft_set_ext_data(ext);
1ca2e170 6181 switch (data->verdict.code) {
20a69341
PM		 6182 case NFT_JUMP:
6183 case NFT_GOTO:
1ca2e170 6184 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6185 default:
6186 return 0;
6187 }
6188}
6189
6190static int nf_tables_check_loops(const struct nft_ctx *ctx,
6191 const struct nft_chain *chain)
6192{
6193 const struct nft_rule *rule;
6194 const struct nft_expr *expr, *last;
de70185d 6195 struct nft_set *set;
20a69341
PM		 6196 struct nft_set_binding *binding;
6197 struct nft_set_iter iter;
20a69341
PM		 6198
6199 if (ctx->chain == chain)
6200 return -ELOOP;
6201
6202 list_for_each_entry(rule, &chain->rules, list) {
6203 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 6204 const struct nft_data *data = NULL;
6205 int err;
6206
6207 if (!expr->ops->validate)
20a69341
PM		 6208 continue;
6209
0ca743a5
PNA		 6210 err = expr->ops->validate(ctx, expr, &data);
6211 if (err < 0)
6212 return err;
6213
20a69341 6214 if (data == NULL)
0ca743a5 6215 continue;
20a69341 6216
1ca2e170 6217 switch (data->verdict.code) {
20a69341
PM		 6218 case NFT_JUMP:
6219 case NFT_GOTO:
1ca2e170
PM		 6220 err = nf_tables_check_loops(ctx,
6221 data->verdict.chain);
20a69341
PM		 6222 if (err < 0)
6223 return err;
6224 default:
6225 break;
6226 }
6227 }
6228 }
6229
6230 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 6231 if (!nft_is_active_next(ctx->net, set))
6232 continue;
20a69341
PM		 6233 if (!(set->flags & NFT_SET_MAP) ||
6234 set->dtype != NFT_DATA_VERDICT)
6235 continue;
6236
6237 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 6238 if (!(binding->flags & NFT_SET_MAP) ||
6239 binding->chain != chain)
20a69341
PM		 6240 continue;
6241
8588ac09 6242 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 6243 iter.skip = 0;
6244 iter.count = 0;
6245 iter.err = 0;
6246 iter.fn = nf_tables_loop_check_setelem;
6247
6248 set->ops->walk(ctx, set, &iter);
6249 if (iter.err < 0)
6250 return iter.err;
6251 }
6252 }
6253
6254 return 0;
6255}
6256
36b701fa
LGL		 6257/**
6258 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6259 *
6260 * @attr: netlink attribute to fetch value from
6261 * @max: maximum value to be stored in dest
6262 * @dest: pointer to the variable
6263 *
6264 * Parse, check and store a given u32 netlink attribute into variable.
6265 * This function returns -ERANGE if the value goes over maximum value.
6266 * Otherwise a 0 is returned and the attribute value is stored in the
6267 * destination variable.
6268 */
f1d505bb 6269int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 6270{
09525a09 6271 u32 val;
36b701fa
LGL		 6272
6273 val = ntohl(nla_get_be32(attr));
6274 if (val > max)
6275 return -ERANGE;
6276
6277 *dest = val;
6278 return 0;
6279}
6280EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6281
49499c3e
PM		 6282/**
6283 * nft_parse_register - parse a register value from a netlink attribute
6284 *
6285 * @attr: netlink attribute
6286 *
6287 * Parse and translate a register value from a netlink attribute.
6288 * Registers used to be 128 bit wide, these register numbers will be
6289 * mapped to the corresponding 32 bit register numbers.
6290 */
b1c96ed3
PM		 6291unsigned int nft_parse_register(const struct nlattr *attr)
6292{
49499c3e
PM		 6293 unsigned int reg;
6294
6295 reg = ntohl(nla_get_be32(attr));
6296 switch (reg) {
6297 case NFT_REG_VERDICT...NFT_REG_4:
6298 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6299 default:
6300 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6301 }
b1c96ed3
PM		 6302}
6303EXPORT_SYMBOL_GPL(nft_parse_register);
6304
49499c3e
PM		 6305/**
6306 * nft_dump_register - dump a register value to a netlink attribute
6307 *
6308 * @skb: socket buffer
6309 * @attr: attribute number
6310 * @reg: register number
6311 *
6312 * Construct a netlink attribute containing the register number. For
6313 * compatibility reasons, register numbers being a multiple of 4 are
6314 * translated to the corresponding 128 bit register numbers.
6315 */
b1c96ed3
PM		 6316int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6317{
49499c3e
PM		 6318 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6319 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6320 else
6321 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6322
b1c96ed3
PM		 6323 return nla_put_be32(skb, attr, htonl(reg));
6324}
6325EXPORT_SYMBOL_GPL(nft_dump_register);
6326
96518518 6327/**
d07db988 6328 * nft_validate_register_load - validate a load from a register
96518518
PM		 6329 *
6330 * @reg: the register number
d07db988 6331 * @len: the length of the data
96518518
PM		 6332 *
6333 * Validate that the input register is one of the general purpose
d07db988 6334 * registers and that the length of the load is within the bounds.
96518518 6335 */
d07db988 6336int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 6337{
49499c3e 6338 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 6339 return -EINVAL;
d07db988
PM		 6340 if (len == 0)
6341 return -EINVAL;
49499c3e 6342 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 6343 return -ERANGE;
49499c3e 6344
96518518
PM		 6345 return 0;
6346}
d07db988 6347EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 6348
96518518 6349/**
1ec10212 6350 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 6351 *
6352 * @ctx: context of the expression performing the load
6353 * @reg: the destination register number
6354 * @data: the data to load
6355 * @type: the data type
45d9bcda 6356 * @len: the length of the data
96518518
PM		 6357 *
6358 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 6359 * the destination register and the length is within the bounds.
6360 * A value of NULL for the data means that its runtime gathered
58f40ab6 6361 * data.
96518518 6362 */
1ec10212
PM		 6363int nft_validate_register_store(const struct nft_ctx *ctx,
6364 enum nft_registers reg,
6365 const struct nft_data *data,
6366 enum nft_data_types type, unsigned int len)
96518518 6367{
20a69341
PM		 6368 int err;
6369
96518518
PM		 6370 switch (reg) {
6371 case NFT_REG_VERDICT:
58f40ab6 6372 if (type != NFT_DATA_VERDICT)
96518518 6373 return -EINVAL;
20a69341 6374
58f40ab6 6375 if (data != NULL &&
1ca2e170
PM		 6376 (data->verdict.code == NFT_GOTO ||
6377 data->verdict.code == NFT_JUMP)) {
6378 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6379 if (err < 0)
6380 return err;
6381
1ca2e170
PM		 6382 if (ctx->chain->level + 1 >
6383 data->verdict.chain->level) {
20a69341
PM		 6384 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
6385 return -EMLINK;
1ca2e170 6386 data->verdict.chain->level = ctx->chain->level + 1;
20a69341
PM		 6387 }
6388 }
6389
96518518
PM		 6390 return 0;
6391 default:
49499c3e 6392 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 6393 return -EINVAL;
45d9bcda
PM		 6394 if (len == 0)
6395 return -EINVAL;
49499c3e
PM		 6396 if (reg * NFT_REG32_SIZE + len >
6397 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 6398 return -ERANGE;
27e6d201 6399
96518518
PM		 6400 if (data != NULL && type != NFT_DATA_VALUE)
6401 return -EINVAL;
6402 return 0;
6403 }
6404}
1ec10212 6405EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 6406
6407static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
6408 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
6409 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
6410 .len = NFT_CHAIN_MAXNAMELEN - 1 },
6411};
6412
6413static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
6414 struct nft_data_desc *desc, const struct nlattr *nla)
6415{
664b0f8c 6416 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 6417 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
6418 struct nft_chain *chain;
6419 int err;
6420
fceb6435
JB		 6421 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
6422 NULL);
96518518
PM		 6423 if (err < 0)
6424 return err;
6425
6426 if (!tb[NFTA_VERDICT_CODE])
6427 return -EINVAL;
1ca2e170 6428 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 6429
1ca2e170 6430 switch (data->verdict.code) {
e0abdadc 6431 default:
1ca2e170 6432 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 6433 case NF_ACCEPT:
6434 case NF_DROP:
6435 case NF_QUEUE:
6436 break;
6437 default:
6438 return -EINVAL;
6439 }
6440 /* fall through */
96518518
PM		 6441 case NFT_CONTINUE:
6442 case NFT_BREAK:
6443 case NFT_RETURN:
96518518
PM		 6444 break;
6445 case NFT_JUMP:
6446 case NFT_GOTO:
6447 if (!tb[NFTA_VERDICT_CHAIN])
6448 return -EINVAL;
cac20fcd
PNA		 6449 chain = nft_chain_lookup(ctx->table, tb[NFTA_VERDICT_CHAIN],
6450 genmask);
96518518
PM		 6451 if (IS_ERR(chain))
6452 return PTR_ERR(chain);
f323d954 6453 if (nft_is_base_chain(chain))
96518518
PM		 6454 return -EOPNOTSUPP;
6455
96518518 6456 chain->use++;
1ca2e170 6457 data->verdict.chain = chain;
96518518 6458 break;
96518518
PM		 6459 }
6460
4c4ed074 6461 desc->len = sizeof(data->verdict);
96518518
PM		 6462 desc->type = NFT_DATA_VERDICT;
6463 return 0;
6464}
6465
6466static void nft_verdict_uninit(const struct nft_data *data)
6467{
1ca2e170 6468 switch (data->verdict.code) {
96518518
PM		 6469 case NFT_JUMP:
6470 case NFT_GOTO:
1ca2e170 6471 data->verdict.chain->use--;
96518518
PM		 6472 break;
6473 }
6474}
6475
33d5a7b1 6476int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 6477{
6478 struct nlattr *nest;
6479
33d5a7b1 6480 nest = nla_nest_start(skb, type);
96518518
PM		 6481 if (!nest)
6482 goto nla_put_failure;
6483
33d5a7b1 6484 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 6485 goto nla_put_failure;
6486
33d5a7b1 6487 switch (v->code) {
96518518
PM		 6488 case NFT_JUMP:
6489 case NFT_GOTO:
1ca2e170 6490 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 6491 v->chain->name))
96518518
PM		 6492 goto nla_put_failure;
6493 }
6494 nla_nest_end(skb, nest);
6495 return 0;
6496
6497nla_put_failure:
6498 return -1;
6499}
6500
d0a11fc3
PM		 6501static int nft_value_init(const struct nft_ctx *ctx,
6502 struct nft_data *data, unsigned int size,
96518518
PM		 6503 struct nft_data_desc *desc, const struct nlattr *nla)
6504{
6505 unsigned int len;
6506
6507 len = nla_len(nla);
6508 if (len == 0)
6509 return -EINVAL;
d0a11fc3 6510 if (len > size)
96518518
PM		 6511 return -EOVERFLOW;
6512
d0a11fc3 6513 nla_memcpy(data->data, nla, len);
96518518
PM		 6514 desc->type = NFT_DATA_VALUE;
6515 desc->len = len;
6516 return 0;
6517}
6518
6519static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
6520 unsigned int len)
6521{
6522 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
6523}
6524
6525static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 6526 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 6527 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
6528};
6529
6530/**
6531 * nft_data_init - parse nf_tables data netlink attributes
6532 *
6533 * @ctx: context of the expression using the data
6534 * @data: destination struct nft_data
d0a11fc3 6535 * @size: maximum data length
96518518
PM		 6536 * @desc: data description
6537 * @nla: netlink attribute containing data
6538 *
6539 * Parse the netlink data attributes and initialize a struct nft_data.
6540 * The type and length of data are returned in the data description.
6541 *
6542 * The caller can indicate that it only wants to accept data of type
6543 * NFT_DATA_VALUE by passing NULL for the ctx argument.
6544 */
d0a11fc3
PM		 6545int nft_data_init(const struct nft_ctx *ctx,
6546 struct nft_data *data, unsigned int size,
96518518
PM		 6547 struct nft_data_desc *desc, const struct nlattr *nla)
6548{
6549 struct nlattr *tb[NFTA_DATA_MAX + 1];
6550 int err;
6551
fceb6435 6552 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 6553 if (err < 0)
6554 return err;
6555
6556 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 6557 return nft_value_init(ctx, data, size, desc,
6558 tb[NFTA_DATA_VALUE]);
96518518
PM		 6559 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
6560 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
6561 return -EINVAL;
6562}
6563EXPORT_SYMBOL_GPL(nft_data_init);
6564
6565/**
59105446 6566 * nft_data_release - release a nft_data item
96518518
PM		 6567 *
6568 * @data: struct nft_data to release
6569 * @type: type of data
6570 *
6571 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6572 * all others need to be released by calling this function.
6573 */
59105446 6574void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 6575{
960bd2c2 6576 if (type < NFT_DATA_VERDICT)
96518518 6577 return;
960bd2c2 6578 switch (type) {
96518518
PM		 6579 case NFT_DATA_VERDICT:
6580 return nft_verdict_uninit(data);
6581 default:
6582 WARN_ON(1);
6583 }
6584}
59105446 6585EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 6586
6587int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
6588 enum nft_data_types type, unsigned int len)
6589{
6590 struct nlattr *nest;
6591 int err;
6592
6593 nest = nla_nest_start(skb, attr);
6594 if (nest == NULL)
6595 return -1;
6596
6597 switch (type) {
6598 case NFT_DATA_VALUE:
6599 err = nft_value_dump(skb, data, len);
6600 break;
6601 case NFT_DATA_VERDICT:
33d5a7b1 6602 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 6603 break;
6604 default:
6605 err = -EINVAL;
6606 WARN_ON(1);
6607 }
6608
6609 nla_nest_end(skb, nest);
6610 return err;
6611}
6612EXPORT_SYMBOL_GPL(nft_data_dump);
6613
5ebe0b0e
PNA		 6614int __nft_release_basechain(struct nft_ctx *ctx)
6615{
6616 struct nft_rule *rule, *nr;
6617
f323d954 6618 BUG_ON(!nft_is_base_chain(ctx->chain));
5ebe0b0e 6619
c974a3a3 6620 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 6621 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6622 list_del(&rule->list);
6623 ctx->chain->use--;
6624 nf_tables_rule_destroy(ctx, rule);
6625 }
6626 list_del(&ctx->chain->list);
6627 ctx->table->use--;
43a605f2 6628 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 6629
6630 return 0;
6631}
6632EXPORT_SYMBOL_GPL(__nft_release_basechain);
6633
98319cb9 6634static void __nft_release_tables(struct net *net)
df05ef87 6635{
3b49e2e9 6636 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 6637 struct nft_table *table, *nt;
6638 struct nft_chain *chain, *nc;
e5009240 6639 struct nft_object *obj, *ne;
df05ef87
PNA		 6640 struct nft_rule *rule, *nr;
6641 struct nft_set *set, *ns;
6642 struct nft_ctx ctx = {
6643 .net = net,
43a605f2 6644 .family = NFPROTO_NETDEV,
df05ef87
PNA		 6645 };
6646
36596dad 6647 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 6648 ctx.family = table->family;
dd4cbef7 6649
df05ef87 6650 list_for_each_entry(chain, &table->chains, list)
c974a3a3 6651 nf_tables_unregister_hook(net, table, chain);
3b49e2e9
PNA		 6652 list_for_each_entry(flowtable, &table->flowtables, list)
6653 nf_unregister_net_hooks(net, flowtable->ops,
6654 flowtable->ops_len);
df05ef87
PNA		 6655 /* No packets are walking on these chains anymore. */
6656 ctx.table = table;
6657 list_for_each_entry(chain, &table->chains, list) {
6658 ctx.chain = chain;
6659 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
6660 list_del(&rule->list);
6661 chain->use--;
6662 nf_tables_rule_destroy(&ctx, rule);
6663 }
6664 }
3b49e2e9
PNA		 6665 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
6666 list_del(&flowtable->list);
6667 table->use--;
6668 nf_tables_flowtable_destroy(flowtable);
6669 }
df05ef87
PNA		 6670 list_for_each_entry_safe(set, ns, &table->sets, list) {
6671 list_del(&set->list);
6672 table->use--;
6673 nft_set_destroy(set);
6674 }
e5009240
PNA		 6675 list_for_each_entry_safe(obj, ne, &table->objects, list) {
6676 list_del(&obj->list);
6677 table->use--;
6678 nft_obj_destroy(obj);
6679 }
df05ef87 6680 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 6681 ctx.chain = chain;
df05ef87
PNA		 6682 list_del(&chain->list);
6683 table->use--;
43a605f2 6684 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 6685 }
6686 list_del(&table->list);
6687 nf_tables_table_destroy(&ctx);
6688 }
6689}
6690
dd4cbef7
PNA		 6691static int __net_init nf_tables_init_net(struct net *net)
6692{
6693 INIT_LIST_HEAD(&net->nft.tables);
6694 INIT_LIST_HEAD(&net->nft.commit_list);
6695 net->nft.base_seq = 1;
6696 return 0;
6697}
6698
6699static void __net_exit nf_tables_exit_net(struct net *net)
6700{
98319cb9 6701 __nft_release_tables(net);
dd4cbef7
PNA		 6702 WARN_ON_ONCE(!list_empty(&net->nft.tables));
6703 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
6704}
6705
99633ab2
PNA		 6706static struct pernet_operations nf_tables_net_ops = {
6707 .init = nf_tables_init_net,
613d0776 6708 .exit = nf_tables_exit_net,
99633ab2
PNA		 6709};
6710
96518518
PM		 6711static int __init nf_tables_module_init(void)
6712{
6713 int err;
6714
02c7b25e
PNA		 6715 nft_chain_filter_init();
6716
96518518
PM		 6717 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
6718 GFP_KERNEL);
6719 if (info == NULL) {
6720 err = -ENOMEM;
6721 goto err1;
6722 }
6723
6724 err = nf_tables_core_module_init();
6725 if (err < 0)
6726 goto err2;
6727
6728 err = nfnetlink_subsys_register(&nf_tables_subsys);
6729 if (err < 0)
6730 goto err3;
6731
3b49e2e9
PNA		 6732 register_netdevice_notifier(&nf_tables_flowtable_notifier);
6733
99633ab2 6734 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 6735err3:
6736 nf_tables_core_module_exit();
6737err2:
6738 kfree(info);
6739err1:
6740 return err;
6741}
6742
6743static void __exit nf_tables_module_exit(void)
6744{
99633ab2 6745 unregister_pernet_subsys(&nf_tables_net_ops);
96518518 6746 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 6747 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
1b1bc49c 6748 rcu_barrier();
96518518
PM		 6749 nf_tables_core_module_exit();
6750 kfree(info);
02c7b25e 6751 nft_chain_filter_fini();
96518518
PM		 6752}
6753
6754module_init(nf_tables_module_init);
6755module_exit(nf_tables_module_exit);
6756
6757MODULE_LICENSE("GPL");
6758MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
6759MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror