]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_flowtable: remove duplicated transition in diagram
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
0eb71a9d 17#include <linux/rhashtable.h>
96518518
PM		 18#include <linux/netfilter.h>
19#include <linux/netfilter/nfnetlink.h>
20#include <linux/netfilter/nf_tables.h>
3b49e2e9 21#include <net/netfilter/nf_flow_table.h>
96518518
PM		 22#include <net/netfilter/nf_tables_core.h>
23#include <net/netfilter/nf_tables.h>
99633ab2 24#include <net/net_namespace.h>
96518518
PM		 25#include <net/sock.h>
26
96518518 27static LIST_HEAD(nf_tables_expressions);
e5009240 28static LIST_HEAD(nf_tables_objects);
3b49e2e9 29static LIST_HEAD(nf_tables_flowtables);
0935d558
FW		 30static LIST_HEAD(nf_tables_destroy_list);
31static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
3ecbfd65 32static u64 table_handle;
96518518 33
a654de8f
PNA		 34enum {
35 NFT_VALIDATE_SKIP = 0,
36 NFT_VALIDATE_NEED,
37 NFT_VALIDATE_DO,
38};
39
4d44175a
FW		 40static struct rhltable nft_objname_ht;
41
1b2470e5
FW		 42static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
43static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
44static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
45
4d44175a
FW		 46static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
47static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
48static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
49
1b2470e5
FW		 50static const struct rhashtable_params nft_chain_ht_params = {
51 .head_offset = offsetof(struct nft_chain, rhlhead),
52 .key_offset = offsetof(struct nft_chain, name),
53 .hashfn = nft_chain_hash,
54 .obj_hashfn = nft_chain_hash_obj,
55 .obj_cmpfn = nft_chain_hash_cmp,
56 .locks_mul = 1,
57 .automatic_shrinking = true,
58};
59
4d44175a
FW		 60static const struct rhashtable_params nft_objname_ht_params = {
61 .head_offset = offsetof(struct nft_object, rhlhead),
62 .key_offset = offsetof(struct nft_object, key),
63 .hashfn = nft_objname_hash,
64 .obj_hashfn = nft_objname_hash_obj,
65 .obj_cmpfn = nft_objname_hash_cmp,
66 .automatic_shrinking = true,
67};
68
a654de8f
PNA		 69static void nft_validate_state_update(struct net *net, u8 new_validate_state)
70{
71 switch (net->nft.validate_state) {
72 case NFT_VALIDATE_SKIP:
73 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
74 break;
75 case NFT_VALIDATE_NEED:
76 break;
77 case NFT_VALIDATE_DO:
78 if (new_validate_state == NFT_VALIDATE_NEED)
79 return;
80 }
81
82 net->nft.validate_state = new_validate_state;
83}
0935d558
FW		 84static void nf_tables_trans_destroy_work(struct work_struct *w);
85static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
a654de8f 86
7c95f6d8 87static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 88 struct net *net,
7c95f6d8
PNA		 89 const struct sk_buff *skb,
90 const struct nlmsghdr *nlh,
36596dad 91 u8 family,
7c95f6d8
PNA		 92 struct nft_table *table,
93 struct nft_chain *chain,
94 const struct nlattr * const *nla)
95{
633c9a84 96 ctx->net = net;
36596dad 97 ctx->family = family;
26b2f552 98 ctx->level = 0;
128ad332
PNA		 99 ctx->table = table;
100 ctx->chain = chain;
101 ctx->nla = nla;
102 ctx->portid = NETLINK_CB(skb).portid;
103 ctx->report = nlmsg_report(nlh);
104 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 105}
106
8411b644
PNA		 107static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
108 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 109{
110 struct nft_trans *trans;
111
8411b644 112 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 113 if (trans == NULL)
114 return NULL;
115
b380e5c7 116 trans->msg_type = msg_type;
1081d11b
PNA		 117 trans->ctx = *ctx;
118
119 return trans;
120}
121
8411b644
PNA		 122static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
123 int msg_type, u32 size)
124{
125 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
126}
127
1081d11b
PNA		 128static void nft_trans_destroy(struct nft_trans *trans)
129{
130 list_del(&trans->list);
131 kfree(trans);
132}
133
f6ac8585
PNA		 134static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
135{
136 struct net *net = ctx->net;
137 struct nft_trans *trans;
138
139 if (!nft_set_is_anonymous(set))
140 return;
141
142 list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
143 if (trans->msg_type == NFT_MSG_NEWSET &&
144 nft_trans_set(trans) == set) {
40ba1d9b 145 set->bound = true;
f6ac8585
PNA		 146 break;
147 }
148 }
149}
150
c974a3a3
PNA		 151static int nf_tables_register_hook(struct net *net,
152 const struct nft_table *table,
153 struct nft_chain *chain)
d8ee8f7c 154{
4e25ceb8 155 const struct nft_base_chain *basechain;
a37061a6 156 const struct nf_hook_ops *ops;
ae6153b5 157
d8ee8f7c 158 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 159 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 160 return 0;
161
4e25ceb8
FW		 162 basechain = nft_base_chain(chain);
163 ops = &basechain->ops;
ae6153b5 164
4e25ceb8
FW		 165 if (basechain->type->ops_register)
166 return basechain->type->ops_register(net, ops);
167
a37061a6 168 return nf_register_net_hook(net, ops);
d8ee8f7c
PNA		 169}
170
c974a3a3
PNA		 171static void nf_tables_unregister_hook(struct net *net,
172 const struct nft_table *table,
173 struct nft_chain *chain)
c5598794 174{
4e25ceb8
FW		 175 const struct nft_base_chain *basechain;
176 const struct nf_hook_ops *ops;
177
d8ee8f7c 178 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 179 !nft_is_base_chain(chain))
d8ee8f7c 180 return;
4e25ceb8
FW		 181 basechain = nft_base_chain(chain);
182 ops = &basechain->ops;
d8ee8f7c 183
4e25ceb8
FW		 184 if (basechain->type->ops_unregister)
185 return basechain->type->ops_unregister(net, ops);
186
187 nf_unregister_net_hook(net, ops);
c5598794
AB		 188}
189
ee01d542
AB		 190static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
191{
192 struct nft_trans *trans;
193
194 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
195 if (trans == NULL)
196 return -ENOMEM;
197
198 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 199 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 200
201 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
202 return 0;
203}
204
205static int nft_deltable(struct nft_ctx *ctx)
206{
207 int err;
208
209 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
210 if (err < 0)
211 return err;
212
f2a6d766 213 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 214 return err;
215}
216
217static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
218{
219 struct nft_trans *trans;
220
221 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
222 if (trans == NULL)
223 return -ENOMEM;
224
225 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 226 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 227
228 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
229 return 0;
230}
231
232static int nft_delchain(struct nft_ctx *ctx)
233{
234 int err;
235
236 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
237 if (err < 0)
238 return err;
239
240 ctx->table->use--;
664b0f8c 241 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 242
243 return err;
244}
245
bb7b40ae
PNA		 246static void nft_rule_expr_activate(const struct nft_ctx *ctx,
247 struct nft_rule *rule)
248{
249 struct nft_expr *expr;
250
251 expr = nft_expr_first(rule);
252 while (expr != nft_expr_last(rule) && expr->ops) {
253 if (expr->ops->activate)
254 expr->ops->activate(ctx, expr);
255
256 expr = nft_expr_next(expr);
257 }
258}
259
260static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
f6ac8585
PNA		 261 struct nft_rule *rule,
262 enum nft_trans_phase phase)
bb7b40ae
PNA		 263{
264 struct nft_expr *expr;
265
266 expr = nft_expr_first(rule);
267 while (expr != nft_expr_last(rule) && expr->ops) {
268 if (expr->ops->deactivate)
f6ac8585 269 expr->ops->deactivate(ctx, expr, phase);
bb7b40ae
PNA		 270
271 expr = nft_expr_next(expr);
272 }
273}
274
ee01d542
AB		 275static int
276nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
277{
278 /* You cannot delete the same rule twice */
889f7ee7
PNA		 279 if (nft_is_active_next(ctx->net, rule)) {
280 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 281 ctx->chain->use--;
282 return 0;
283 }
284 return -ENOENT;
285}
286
287static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
288 struct nft_rule *rule)
289{
290 struct nft_trans *trans;
291
292 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
293 if (trans == NULL)
294 return NULL;
295
1a94e38d
PNA		 296 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
297 nft_trans_rule_id(trans) =
298 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
299 }
ee01d542
AB		 300 nft_trans_rule(trans) = rule;
301 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
302
303 return trans;
304}
305
306static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
307{
308 struct nft_trans *trans;
309 int err;
310
311 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
312 if (trans == NULL)
313 return -ENOMEM;
314
315 err = nf_tables_delrule_deactivate(ctx, rule);
316 if (err < 0) {
317 nft_trans_destroy(trans);
318 return err;
319 }
f6ac8585 320 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
ee01d542
AB		 321
322 return 0;
323}
324
325static int nft_delrule_by_chain(struct nft_ctx *ctx)
326{
327 struct nft_rule *rule;
328 int err;
329
330 list_for_each_entry(rule, &ctx->chain->rules, list) {
23b7ca4f
PNA		 331 if (!nft_is_active_next(ctx->net, rule))
332 continue;
333
ee01d542
AB		 334 err = nft_delrule(ctx, rule);
335 if (err < 0)
336 return err;
337 }
338 return 0;
339}
340
cd5125d8 341static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
ee01d542
AB		 342 struct nft_set *set)
343{
344 struct nft_trans *trans;
345
346 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
347 if (trans == NULL)
348 return -ENOMEM;
349
350 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
351 nft_trans_set_id(trans) =
352 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 353 nft_activate_next(ctx->net, set);
ee01d542
AB		 354 }
355 nft_trans_set(trans) = set;
356 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
357
358 return 0;
359}
360
cd5125d8 361static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
ee01d542
AB		 362{
363 int err;
364
365 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
366 if (err < 0)
367 return err;
368
37a9cc52 369 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 370 ctx->table->use--;
371
372 return err;
373}
374
e5009240
PNA		 375static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
376 struct nft_object *obj)
377{
378 struct nft_trans *trans;
379
380 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
381 if (trans == NULL)
382 return -ENOMEM;
383
384 if (msg_type == NFT_MSG_NEWOBJ)
385 nft_activate_next(ctx->net, obj);
386
387 nft_trans_obj(trans) = obj;
388 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
389
390 return 0;
391}
392
393static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
394{
395 int err;
396
397 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
398 if (err < 0)
399 return err;
400
401 nft_deactivate_next(ctx->net, obj);
402 ctx->table->use--;
403
404 return err;
405}
406
3b49e2e9
PNA		 407static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
408 struct nft_flowtable *flowtable)
409{
410 struct nft_trans *trans;
411
412 trans = nft_trans_alloc(ctx, msg_type,
413 sizeof(struct nft_trans_flowtable));
414 if (trans == NULL)
415 return -ENOMEM;
416
417 if (msg_type == NFT_MSG_NEWFLOWTABLE)
418 nft_activate_next(ctx->net, flowtable);
419
420 nft_trans_flowtable(trans) = flowtable;
421 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
422
423 return 0;
424}
425
426static int nft_delflowtable(struct nft_ctx *ctx,
427 struct nft_flowtable *flowtable)
428{
429 int err;
430
431 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
432 if (err < 0)
433 return err;
434
435 nft_deactivate_next(ctx->net, flowtable);
436 ctx->table->use--;
437
438 return err;
439}
440
96518518
PM		 441/*
442 * Tables
443 */
444
36596dad 445static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 446 const struct nlattr *nla,
36596dad 447 u8 family, u8 genmask)
96518518
PM		 448{
449 struct nft_table *table;
450
cac20fcd
PNA		 451 if (nla == NULL)
452 return ERR_PTR(-EINVAL);
453
d9adf22a 454 list_for_each_entry_rcu(table, &net->nft.tables, list) {
f2a6d766 455 if (!nla_strcmp(nla, table->name) &&
98319cb9 456 table->family == family &&
f2a6d766 457 nft_active_genmask(table, genmask))
96518518
PM		 458 return table;
459 }
cac20fcd
PNA		 460
461 return ERR_PTR(-ENOENT);
96518518
PM		 462}
463
3ecbfd65
HS		 464static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
465 const struct nlattr *nla,
466 u8 genmask)
467{
468 struct nft_table *table;
469
470 list_for_each_entry(table, &net->nft.tables, list) {
471 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
472 nft_active_genmask(table, genmask))
473 return table;
474 }
3ecbfd65
HS		 475
476 return ERR_PTR(-ENOENT);
477}
478
96518518
PM		 479static inline u64 nf_tables_alloc_handle(struct nft_table *table)
480{
481 return ++table->hgenerator;
482}
483
32537e91 484static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 485
32537e91 486static const struct nft_chain_type *
1ea26cca 487__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 488{
489 int i;
490
baae3e62 491 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 492 if (chain_type[family][i] != NULL &&
493 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 494 return chain_type[family][i];
9370761c 495 }
baae3e62 496 return NULL;
9370761c
PNA		 497}
498
452238e8
FW		 499/*
500 * Loading a module requires dropping mutex that guards the
501 * transaction.
502 * We first need to abort any pending transactions as once
503 * mutex is unlocked a different client could start a new
504 * transaction. It must not see any 'future generation'
505 * changes * as these changes will never happen.
506 */
507#ifdef CONFIG_MODULES
508static int __nf_tables_abort(struct net *net);
509
510static void nft_request_module(struct net *net, const char *fmt, ...)
511{
512 char module_name[MODULE_NAME_LEN];
513 va_list args;
514 int ret;
515
516 __nf_tables_abort(net);
517
518 va_start(args, fmt);
519 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
520 va_end(args);
521 if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
522 return;
523
f102d66b 524 mutex_unlock(&net->nft.commit_mutex);
452238e8 525 request_module("%s", module_name);
f102d66b 526 mutex_lock(&net->nft.commit_mutex);
452238e8
FW		 527}
528#endif
529
f102d66b
FW		 530static void lockdep_nfnl_nft_mutex_not_held(void)
531{
532#ifdef CONFIG_PROVE_LOCKING
533 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
534#endif
535}
536
32537e91 537static const struct nft_chain_type *
452238e8
FW		 538nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
539 u8 family, bool autoload)
9370761c 540{
32537e91 541 const struct nft_chain_type *type;
9370761c 542
1ea26cca 543 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 544 if (type != NULL)
545 return type;
f102d66b
FW		 546
547 lockdep_nfnl_nft_mutex_not_held();
9370761c 548#ifdef CONFIG_MODULES
93b0806f 549 if (autoload) {
452238e8
FW		 550 nft_request_module(net, "nft-chain-%u-%.*s", family,
551 nla_len(nla), (const char *)nla_data(nla));
1ea26cca 552 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 553 if (type != NULL)
554 return ERR_PTR(-EAGAIN);
9370761c
PNA		 555 }
556#endif
93b0806f 557 return ERR_PTR(-ENOENT);
9370761c
PNA		 558}
559
96518518 560static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 561 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
562 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 563 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 564 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 565};
566
84d7fce6
PNA		 567static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
568 u32 portid, u32 seq, int event, u32 flags,
569 int family, const struct nft_table *table)
96518518
PM		 570{
571 struct nlmsghdr *nlh;
572 struct nfgenmsg *nfmsg;
573
dedb67c4 574 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 575 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
576 if (nlh == NULL)
577 goto nla_put_failure;
578
579 nfmsg = nlmsg_data(nlh);
580 nfmsg->nfgen_family = family;
581 nfmsg->version = NFNETLINK_V0;
84d7fce6 582 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 583
9ddf6323 584 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 585 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 586 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
587 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
588 NFTA_TABLE_PAD))
96518518
PM		 589 goto nla_put_failure;
590
053c095a
JB		 591 nlmsg_end(skb, nlh);
592 return 0;
96518518
PM		 593
594nla_put_failure:
595 nlmsg_trim(skb, nlh);
596 return -1;
597}
598
25e94a99 599static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 600{
601 struct sk_buff *skb;
96518518
PM		 602 int err;
603
128ad332
PNA		 604 if (!ctx->report &&
605 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 606 return;
96518518 607
96518518
PM		 608 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
609 if (skb == NULL)
610 goto err;
611
84d7fce6 612 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 613 event, 0, ctx->family, ctx->table);
96518518
PM		 614 if (err < 0) {
615 kfree_skb(skb);
616 goto err;
617 }
618
25e94a99
PNA		 619 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
620 ctx->report, GFP_KERNEL);
621 return;
96518518 622err:
25e94a99 623 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 624}
625
626static int nf_tables_dump_tables(struct sk_buff *skb,
627 struct netlink_callback *cb)
628{
629 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 630 const struct nft_table *table;
631 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 632 struct net *net = sock_net(skb->sk);
96518518
PM		 633 int family = nfmsg->nfgen_family;
634
e688a7f8 635 rcu_read_lock();
38e029f1
PNA		 636 cb->seq = net->nft.base_seq;
637
36596dad 638 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 639 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 640 continue;
641
36596dad
PNA		 642 if (idx < s_idx)
643 goto cont;
644 if (idx > s_idx)
645 memset(&cb->args[1], 0,
646 sizeof(cb->args) - sizeof(cb->args[0]));
647 if (!nft_is_active(net, table))
648 continue;
649 if (nf_tables_fill_table_info(skb, net,
650 NETLINK_CB(cb->skb).portid,
651 cb->nlh->nlmsg_seq,
652 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 653 table->family, table) < 0)
36596dad
PNA		 654 goto done;
655
656 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 657cont:
36596dad 658 idx++;
96518518
PM		 659 }
660done:
e688a7f8 661 rcu_read_unlock();
96518518
PM		 662 cb->args[0] = idx;
663 return skb->len;
664}
665
d9adf22a
FW		 666static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
667 const struct nlmsghdr *nlh,
668 struct netlink_dump_control *c)
669{
670 int err;
671
672 if (!try_module_get(THIS_MODULE))
673 return -EINVAL;
674
675 rcu_read_unlock();
676 err = netlink_dump_start(nlsk, skb, nlh, c);
677 rcu_read_lock();
678 module_put(THIS_MODULE);
679
680 return err;
681}
682
683/* called with rcu_read_lock held */
7b8002a1
PNA		 684static int nf_tables_gettable(struct net *net, struct sock *nlsk,
685 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 686 const struct nlattr * const nla[],
687 struct netlink_ext_ack *extack)
96518518
PM		 688{
689 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 690 u8 genmask = nft_genmask_cur(net);
96518518
PM		 691 const struct nft_table *table;
692 struct sk_buff *skb2;
693 int family = nfmsg->nfgen_family;
694 int err;
695
696 if (nlh->nlmsg_flags & NLM_F_DUMP) {
697 struct netlink_dump_control c = {
698 .dump = nf_tables_dump_tables,
d9adf22a 699 .module = THIS_MODULE,
96518518 700 };
d9adf22a
FW		 701
702 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 703 }
704
cac20fcd 705 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 706 if (IS_ERR(table)) {
707 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 708 return PTR_ERR(table);
36dd1bcc 709 }
96518518 710
d9adf22a 711 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 712 if (!skb2)
713 return -ENOMEM;
714
84d7fce6 715 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 716 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
717 family, table);
718 if (err < 0)
719 goto err;
720
721 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
722
723err:
724 kfree_skb(skb2);
725 return err;
726}
727
c9c17211 728static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 729{
730 struct nft_chain *chain;
731 u32 i = 0;
732
733 list_for_each_entry(chain, &table->chains, list) {
734 if (!nft_is_active_next(net, chain))
735 continue;
f323d954 736 if (!nft_is_base_chain(chain))
10435c11
F		 737 continue;
738
739 if (cnt && i++ == cnt)
740 break;
741
c974a3a3 742 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 743 }
744}
745
c9c17211 746static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 747{
748 struct nft_chain *chain;
749 int err, i = 0;
750
751 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 752 if (!nft_is_active_next(net, chain))
753 continue;
f323d954 754 if (!nft_is_base_chain(chain))
d2012975
PNA		 755 continue;
756
c974a3a3 757 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 758 if (err < 0)
759 goto err;
760
761 i++;
762 }
763 return 0;
764err:
10435c11 765 if (i)
c9c17211 766 nft_table_disable(net, table, i);
9ddf6323
PNA		 767 return err;
768}
769
c9c17211 770static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 771{
c9c17211 772 nft_table_disable(net, table, 0);
9ddf6323
PNA		 773}
774
e1aaca93 775static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 776{
55dd6f93 777 struct nft_trans *trans;
e1aaca93 778 u32 flags;
55dd6f93 779 int ret = 0;
9ddf6323 780
e1aaca93
PNA		 781 if (!ctx->nla[NFTA_TABLE_FLAGS])
782 return 0;
9ddf6323 783
e1aaca93
PNA		 784 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
785 if (flags & ~NFT_TABLE_F_DORMANT)
786 return -EINVAL;
787
63283dd2
PNA		 788 if (flags == ctx->table->flags)
789 return 0;
790
55dd6f93
PNA		 791 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
792 sizeof(struct nft_trans_table));
793 if (trans == NULL)
794 return -ENOMEM;
9ddf6323 795
e1aaca93
PNA		 796 if ((flags & NFT_TABLE_F_DORMANT) &&
797 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 798 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 799 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
800 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 801 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 802 if (ret >= 0) {
e1aaca93 803 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 804 nft_trans_table_enable(trans) = true;
9ddf6323 805 }
9ddf6323 806 }
e1aaca93
PNA		 807 if (ret < 0)
808 goto err;
9ddf6323 809
55dd6f93
PNA		 810 nft_trans_table_update(trans) = true;
811 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
812 return 0;
9ddf6323 813err:
55dd6f93 814 nft_trans_destroy(trans);
9ddf6323
PNA		 815 return ret;
816}
817
1b2470e5
FW		 818static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
819{
820 const char *name = data;
821
822 return jhash(name, strlen(name), seed);
823}
824
825static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
826{
827 const struct nft_chain *chain = data;
828
829 return nft_chain_hash(chain->name, 0, seed);
830}
831
832static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
833 const void *ptr)
834{
835 const struct nft_chain *chain = ptr;
836 const char *name = arg->key;
837
838 return strcmp(chain->name, name);
839}
840
4d44175a
FW		 841static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
842{
843 const struct nft_object_hash_key *k = data;
844
845 seed ^= hash_ptr(k->table, 32);
846
847 return jhash(k->name, strlen(k->name), seed);
848}
849
850static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
851{
852 const struct nft_object *obj = data;
853
854 return nft_objname_hash(&obj->key, 0, seed);
855}
856
857static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
858 const void *ptr)
859{
860 const struct nft_object_hash_key *k = arg->key;
861 const struct nft_object *obj = ptr;
862
863 if (obj->key.table != k->table)
864 return -1;
865
866 return strcmp(obj->key.name, k->name);
867}
868
633c9a84
PNA		 869static int nf_tables_newtable(struct net *net, struct sock *nlsk,
870 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 871 const struct nlattr * const nla[],
872 struct netlink_ext_ack *extack)
96518518
PM		 873{
874 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 875 u8 genmask = nft_genmask_next(net);
96518518 876 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 877 const struct nlattr *attr;
878 struct nft_table *table;
c5c1f975 879 u32 flags = 0;
e1aaca93 880 struct nft_ctx ctx;
55dd6f93 881 int err;
96518518 882
f102d66b 883 lockdep_assert_held(&net->nft.commit_mutex);
36dd1bcc
PNA		 884 attr = nla[NFTA_TABLE_NAME];
885 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 886 if (IS_ERR(table)) {
887 if (PTR_ERR(table) != -ENOENT)
888 return PTR_ERR(table);
1a28ad74 889 } else {
36dd1bcc
PNA		 890 if (nlh->nlmsg_flags & NLM_F_EXCL) {
891 NL_SET_BAD_ATTR(extack, attr);
96518518 892 return -EEXIST;
36dd1bcc 893 }
96518518
PM		 894 if (nlh->nlmsg_flags & NLM_F_REPLACE)
895 return -EOPNOTSUPP;
e1aaca93 896
98319cb9 897 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 898 return nf_tables_updtable(&ctx);
96518518
PM		 899 }
900
c5c1f975
PM		 901 if (nla[NFTA_TABLE_FLAGS]) {
902 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
903 if (flags & ~NFT_TABLE_F_DORMANT)
904 return -EINVAL;
905 }
906
ffdb210e 907 err = -ENOMEM;
1cae565e 908 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 909 if (table == NULL)
98319cb9 910 goto err_kzalloc;
96518518 911
36dd1bcc 912 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 913 if (table->name == NULL)
98319cb9 914 goto err_strdup;
e46abbcc 915
1b2470e5
FW		 916 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
917 if (err)
918 goto err_chain_ht;
919
96518518 920 INIT_LIST_HEAD(&table->chains);
20a69341 921 INIT_LIST_HEAD(&table->sets);
e5009240 922 INIT_LIST_HEAD(&table->objects);
3b49e2e9 923 INIT_LIST_HEAD(&table->flowtables);
98319cb9 924 table->family = family;
c5c1f975 925 table->flags = flags;
3ecbfd65 926 table->handle = ++table_handle;
9ddf6323 927
98319cb9 928 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 929 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 930 if (err < 0)
98319cb9 931 goto err_trans;
ffdb210e 932
36596dad 933 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 934 return 0;
98319cb9 935err_trans:
1b2470e5
FW		 936 rhltable_destroy(&table->chains_ht);
937err_chain_ht:
e46abbcc 938 kfree(table->name);
98319cb9 939err_strdup:
ffdb210e 940 kfree(table);
98319cb9 941err_kzalloc:
ffdb210e 942 return err;
96518518
PM		 943}
944
b9ac12ef
AB		 945static int nft_flush_table(struct nft_ctx *ctx)
946{
3b49e2e9 947 struct nft_flowtable *flowtable, *nft;
b9ac12ef 948 struct nft_chain *chain, *nc;
e5009240 949 struct nft_object *obj, *ne;
b9ac12ef 950 struct nft_set *set, *ns;
3b49e2e9 951 int err;
b9ac12ef 952
a2f18db0 953 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 954 if (!nft_is_active_next(ctx->net, chain))
955 continue;
956
b9ac12ef
AB		 957 ctx->chain = chain;
958
959 err = nft_delrule_by_chain(ctx);
960 if (err < 0)
961 goto out;
b9ac12ef
AB		 962 }
963
964 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 965 if (!nft_is_active_next(ctx->net, set))
966 continue;
967
408070d6 968 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 969 !list_empty(&set->bindings))
970 continue;
971
972 err = nft_delset(ctx, set);
973 if (err < 0)
974 goto out;
975 }
976
3b49e2e9
PNA		 977 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
978 err = nft_delflowtable(ctx, flowtable);
979 if (err < 0)
980 goto out;
981 }
982
e5009240
PNA		 983 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
984 err = nft_delobj(ctx, obj);
985 if (err < 0)
986 goto out;
987 }
988
a2f18db0 989 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 990 if (!nft_is_active_next(ctx->net, chain))
991 continue;
992
a2f18db0
PNA		 993 ctx->chain = chain;
994
995 err = nft_delchain(ctx);
996 if (err < 0)
997 goto out;
998 }
999
b9ac12ef
AB		 1000 err = nft_deltable(ctx);
1001out:
1002 return err;
1003}
1004
1005static int nft_flush(struct nft_ctx *ctx, int family)
1006{
b9ac12ef
AB		 1007 struct nft_table *table, *nt;
1008 const struct nlattr * const *nla = ctx->nla;
1009 int err = 0;
1010
36596dad 1011 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 1012 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 1013 continue;
1014
98319cb9 1015 ctx->family = table->family;
f2a6d766 1016
36596dad
PNA		 1017 if (!nft_is_active_next(ctx->net, table))
1018 continue;
b9ac12ef 1019
36596dad
PNA		 1020 if (nla[NFTA_TABLE_NAME] &&
1021 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1022 continue;
b9ac12ef 1023
36596dad
PNA		 1024 ctx->table = table;
1025
1026 err = nft_flush_table(ctx);
1027 if (err < 0)
1028 goto out;
b9ac12ef
AB		 1029 }
1030out:
1031 return err;
1032}
1033
633c9a84
PNA		 1034static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1035 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1036 const struct nlattr * const nla[],
1037 struct netlink_ext_ack *extack)
96518518
PM		 1038{
1039 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1040 u8 genmask = nft_genmask_next(net);
ee01d542 1041 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 1042 const struct nlattr *attr;
1043 struct nft_table *table;
55dd6f93 1044 struct nft_ctx ctx;
96518518 1045
36596dad 1046 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 1047 if (family == AF_UNSPEC ||
1048 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 1049 return nft_flush(&ctx, family);
1050
36dd1bcc
PNA		 1051 if (nla[NFTA_TABLE_HANDLE]) {
1052 attr = nla[NFTA_TABLE_HANDLE];
1053 table = nft_table_lookup_byhandle(net, attr, genmask);
1054 } else {
1055 attr = nla[NFTA_TABLE_NAME];
1056 table = nft_table_lookup(net, attr, family, genmask);
1057 }
3ecbfd65 1058
36dd1bcc
PNA		 1059 if (IS_ERR(table)) {
1060 NL_SET_BAD_ATTR(extack, attr);
96518518 1061 return PTR_ERR(table);
36dd1bcc 1062 }
96518518 1063
a8278400
PNA		 1064 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1065 table->use > 0)
1066 return -EBUSY;
1067
98319cb9 1068 ctx.family = family;
b9ac12ef 1069 ctx.table = table;
55dd6f93 1070
b9ac12ef 1071 return nft_flush_table(&ctx);
96518518
PM		 1072}
1073
55dd6f93
PNA		 1074static void nf_tables_table_destroy(struct nft_ctx *ctx)
1075{
fa5950e4
FW		 1076 if (WARN_ON(ctx->table->use > 0))
1077 return;
4fefee57 1078
1b2470e5 1079 rhltable_destroy(&ctx->table->chains_ht);
e46abbcc 1080 kfree(ctx->table->name);
55dd6f93 1081 kfree(ctx->table);
55dd6f93
PNA		 1082}
1083
cc07eeb0 1084void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 1085{
d8297d4f 1086 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
cc07eeb0 1087 return;
d8297d4f 1088
96518518 1089 nfnl_lock(NFNL_SUBSYS_NFTABLES);
cc07eeb0
PNA		 1090 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
1091 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1092 return;
96518518 1093 }
9370761c 1094 chain_type[ctype->family][ctype->type] = ctype;
96518518 1095 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 1096}
9370761c 1097EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 1098
32537e91 1099void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 1100{
96518518 1101 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 1102 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 1103 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1104}
9370761c 1105EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 1106
1107/*
1108 * Chains
1109 */
1110
1111static struct nft_chain *
cac20fcd 1112nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 1113{
1114 struct nft_chain *chain;
1115
1116 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 1117 if (chain->handle == handle &&
1118 nft_active_genmask(chain, genmask))
96518518
PM		 1119 return chain;
1120 }
1121
1122 return ERR_PTR(-ENOENT);
1123}
1124
4d44175a 1125static bool lockdep_commit_lock_is_held(const struct net *net)
f102d66b
FW		 1126{
1127#ifdef CONFIG_PROVE_LOCKING
1128 return lockdep_is_held(&net->nft.commit_mutex);
1129#else
1130 return true;
1131#endif
1132}
1133
1134static struct nft_chain *nft_chain_lookup(struct net *net,
1135 struct nft_table *table,
cac20fcd 1136 const struct nlattr *nla, u8 genmask)
96518518 1137{
1b2470e5
FW		 1138 char search[NFT_CHAIN_MAXNAMELEN + 1];
1139 struct rhlist_head *tmp, *list;
96518518
PM		 1140 struct nft_chain *chain;
1141
1142 if (nla == NULL)
1143 return ERR_PTR(-EINVAL);
1144
1b2470e5 1145 nla_strlcpy(search, nla, sizeof(search));
96518518 1146
1b2470e5 1147 WARN_ON(!rcu_read_lock_held() &&
f102d66b 1148 !lockdep_commit_lock_is_held(net));
1b2470e5
FW		 1149
1150 chain = ERR_PTR(-ENOENT);
1151 rcu_read_lock();
1152 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1153 if (!list)
1154 goto out_unlock;
1155
1156 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1157 if (nft_active_genmask(chain, genmask))
1158 goto out_unlock;
1159 }
1160 chain = ERR_PTR(-ENOENT);
1161out_unlock:
1162 rcu_read_unlock();
1163 return chain;
96518518
PM		 1164}
1165
1166static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 1167 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1168 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1169 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1170 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1171 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1172 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 1173 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 1174 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 1175 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 1176};
1177
1178static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1179 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1180 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1181 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1182 .len = IFNAMSIZ - 1 },
96518518
PM		 1183};
1184
0ca743a5
PNA		 1185static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1186{
1187 struct nft_stats *cpu_stats, total;
1188 struct nlattr *nest;
ce355e20
ED		 1189 unsigned int seq;
1190 u64 pkts, bytes;
0ca743a5
PNA		 1191 int cpu;
1192
1193 memset(&total, 0, sizeof(total));
1194 for_each_possible_cpu(cpu) {
1195 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1196 do {
1197 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1198 pkts = cpu_stats->pkts;
1199 bytes = cpu_stats->bytes;
1200 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1201 total.pkts += pkts;
1202 total.bytes += bytes;
0ca743a5
PNA		 1203 }
1204 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1205 if (nest == NULL)
1206 goto nla_put_failure;
1207
b46f6ded
ND		 1208 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1209 NFTA_COUNTER_PAD) ||
1210 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1211 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1212 goto nla_put_failure;
1213
1214 nla_nest_end(skb, nest);
1215 return 0;
1216
1217nla_put_failure:
1218 return -ENOSPC;
1219}
1220
84d7fce6
PNA		 1221static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1222 u32 portid, u32 seq, int event, u32 flags,
1223 int family, const struct nft_table *table,
96518518
PM		 1224 const struct nft_chain *chain)
1225{
1226 struct nlmsghdr *nlh;
1227 struct nfgenmsg *nfmsg;
1228
dedb67c4 1229 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1230 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1231 if (nlh == NULL)
1232 goto nla_put_failure;
1233
1234 nfmsg = nlmsg_data(nlh);
1235 nfmsg->nfgen_family = family;
1236 nfmsg->version = NFNETLINK_V0;
84d7fce6 1237 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1238
1239 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1240 goto nla_put_failure;
b46f6ded
ND		 1241 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1242 NFTA_CHAIN_PAD))
96518518
PM		 1243 goto nla_put_failure;
1244 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1245 goto nla_put_failure;
1246
f323d954 1247 if (nft_is_base_chain(chain)) {
0ca743a5 1248 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1249 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1250 struct nlattr *nest;
1251
1252 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1253 if (nest == NULL)
1254 goto nla_put_failure;
1255 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1256 goto nla_put_failure;
1257 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1258 goto nla_put_failure;
2cbce139
PNA		 1259 if (basechain->dev_name[0] &&
1260 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1261 goto nla_put_failure;
96518518 1262 nla_nest_end(skb, nest);
9370761c 1263
0ca743a5
PNA		 1264 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1265 htonl(basechain->policy)))
1266 goto nla_put_failure;
1267
baae3e62
PM		 1268 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1269 goto nla_put_failure;
0ca743a5 1270
4c05ec47
TY		 1271 if (rcu_access_pointer(basechain->stats) &&
1272 nft_dump_stats(skb, rcu_dereference(basechain->stats)))
0ca743a5 1273 goto nla_put_failure;
96518518
PM		 1274 }
1275
0ca743a5
PNA		 1276 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1277 goto nla_put_failure;
1278
053c095a
JB		 1279 nlmsg_end(skb, nlh);
1280 return 0;
96518518
PM		 1281
1282nla_put_failure:
1283 nlmsg_trim(skb, nlh);
1284 return -1;
1285}
1286
25e94a99 1287static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1288{
1289 struct sk_buff *skb;
96518518
PM		 1290 int err;
1291
128ad332
PNA		 1292 if (!ctx->report &&
1293 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1294 return;
96518518 1295
96518518
PM		 1296 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1297 if (skb == NULL)
1298 goto err;
1299
84d7fce6 1300 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1301 event, 0, ctx->family, ctx->table,
35151d84 1302 ctx->chain);
96518518
PM		 1303 if (err < 0) {
1304 kfree_skb(skb);
1305 goto err;
1306 }
1307
25e94a99
PNA		 1308 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1309 ctx->report, GFP_KERNEL);
1310 return;
96518518 1311err:
25e94a99 1312 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1313}
1314
1315static int nf_tables_dump_chains(struct sk_buff *skb,
1316 struct netlink_callback *cb)
1317{
1318 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1319 const struct nft_table *table;
1320 const struct nft_chain *chain;
1321 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1322 struct net *net = sock_net(skb->sk);
96518518
PM		 1323 int family = nfmsg->nfgen_family;
1324
e688a7f8 1325 rcu_read_lock();
38e029f1
PNA		 1326 cb->seq = net->nft.base_seq;
1327
36596dad 1328 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1329 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1330 continue;
1331
36596dad
PNA		 1332 list_for_each_entry_rcu(chain, &table->chains, list) {
1333 if (idx < s_idx)
1334 goto cont;
1335 if (idx > s_idx)
1336 memset(&cb->args[1], 0,
1337 sizeof(cb->args) - sizeof(cb->args[0]));
1338 if (!nft_is_active(net, chain))
1339 continue;
1340 if (nf_tables_fill_chain_info(skb, net,
1341 NETLINK_CB(cb->skb).portid,
1342 cb->nlh->nlmsg_seq,
1343 NFT_MSG_NEWCHAIN,
1344 NLM_F_MULTI,
98319cb9 1345 table->family, table,
36596dad
PNA		 1346 chain) < 0)
1347 goto done;
38e029f1 1348
36596dad 1349 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1350cont:
36596dad 1351 idx++;
96518518
PM		 1352 }
1353 }
1354done:
e688a7f8 1355 rcu_read_unlock();
96518518
PM		 1356 cb->args[0] = idx;
1357 return skb->len;
1358}
1359
d9adf22a 1360/* called with rcu_read_lock held */
7b8002a1
PNA		 1361static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1362 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1363 const struct nlattr * const nla[],
1364 struct netlink_ext_ack *extack)
96518518
PM		 1365{
1366 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1367 u8 genmask = nft_genmask_cur(net);
96518518 1368 const struct nft_chain *chain;
1b2470e5 1369 struct nft_table *table;
96518518
PM		 1370 struct sk_buff *skb2;
1371 int family = nfmsg->nfgen_family;
1372 int err;
1373
1374 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1375 struct netlink_dump_control c = {
1376 .dump = nf_tables_dump_chains,
d9adf22a 1377 .module = THIS_MODULE,
96518518 1378 };
d9adf22a
FW		 1379
1380 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 1381 }
1382
cac20fcd 1383 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1384 if (IS_ERR(table)) {
1385 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1386 return PTR_ERR(table);
36dd1bcc 1387 }
96518518 1388
f102d66b 1389 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1390 if (IS_ERR(chain)) {
1391 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1392 return PTR_ERR(chain);
36dd1bcc 1393 }
96518518 1394
d9adf22a 1395 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 1396 if (!skb2)
1397 return -ENOMEM;
1398
84d7fce6 1399 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1400 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1401 family, table, chain);
1402 if (err < 0)
1403 goto err;
1404
1405 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1406
1407err:
1408 kfree_skb(skb2);
1409 return err;
1410}
1411
0ca743a5
PNA		 1412static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1413 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1414 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1415};
1416
ff3cd7b3 1417static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1418{
1419 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1420 struct nft_stats __percpu *newstats;
1421 struct nft_stats *stats;
1422 int err;
1423
fceb6435
JB		 1424 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1425 NULL);
0ca743a5 1426 if (err < 0)
ff3cd7b3 1427 return ERR_PTR(err);
0ca743a5
PNA		 1428
1429 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1430 return ERR_PTR(-EINVAL);
0ca743a5 1431
ce355e20 1432 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1433 if (newstats == NULL)
ff3cd7b3 1434 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1435
1436 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1437 * are not exposed to userspace.
1438 */
e8781f70 1439 preempt_disable();
0ca743a5
PNA		 1440 stats = this_cpu_ptr(newstats);
1441 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1442 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1443 preempt_enable();
0ca743a5 1444
ff3cd7b3
PNA		 1445 return newstats;
1446}
1447
4c05ec47
TY		 1448static void nft_chain_stats_replace(struct net *net,
1449 struct nft_base_chain *chain,
ff3cd7b3
PNA		 1450 struct nft_stats __percpu *newstats)
1451{
0befd061
PNA		 1452 struct nft_stats __percpu *oldstats;
1453
b88825de
PNA		 1454 if (newstats == NULL)
1455 return;
1456
4c05ec47
TY		 1457 if (rcu_access_pointer(chain->stats)) {
1458 oldstats = rcu_dereference_protected(chain->stats,
1459 lockdep_commit_lock_is_held(net));
0ca743a5
PNA		 1460 rcu_assign_pointer(chain->stats, newstats);
1461 synchronize_rcu();
1462 free_percpu(oldstats);
bbb8c61f 1463 } else {
0ca743a5 1464 rcu_assign_pointer(chain->stats, newstats);
bbb8c61f
TY		 1465 static_branch_inc(&nft_counters_enabled);
1466 }
0ca743a5
PNA		 1467}
1468
0cbc06b3
FW		 1469static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1470{
1471 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1472 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1473
1474 if (g0 != g1)
1475 kvfree(g1);
1476 kvfree(g0);
1477
1478 /* should be NULL either via abort or via successful commit */
1479 WARN_ON_ONCE(chain->rules_next);
1480 kvfree(chain->rules_next);
1481}
1482
43a605f2 1483static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1484{
43a605f2
PNA		 1485 struct nft_chain *chain = ctx->chain;
1486
fa5950e4
FW		 1487 if (WARN_ON(chain->use > 0))
1488 return;
91c7b38d 1489
0cbc06b3
FW		 1490 /* no concurrent access possible anymore */
1491 nf_tables_chain_free_chain_rules(chain);
1492
f323d954 1493 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1494 struct nft_base_chain *basechain = nft_base_chain(chain);
1495
1496 module_put(basechain->type->owner);
4c05ec47 1497 if (rcu_access_pointer(basechain->stats)) {
9f08ea84 1498 static_branch_dec(&nft_counters_enabled);
4c05ec47
TY		 1499 free_percpu(rcu_dereference_raw(basechain->stats));
1500 }
b7263e07 1501 kfree(chain->name);
2cbce139 1502 kfree(basechain);
91c7b38d 1503 } else {
b7263e07 1504 kfree(chain->name);
91c7b38d
PNA		 1505 kfree(chain);
1506 }
1507}
1508
508f8ccd
PNA		 1509struct nft_chain_hook {
1510 u32 num;
84ba7dd7 1511 s32 priority;
32537e91 1512 const struct nft_chain_type *type;
508f8ccd
PNA		 1513 struct net_device *dev;
1514};
1515
1516static int nft_chain_parse_hook(struct net *net,
1517 const struct nlattr * const nla[],
36596dad 1518 struct nft_chain_hook *hook, u8 family,
445509eb 1519 bool autoload)
508f8ccd
PNA		 1520{
1521 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1522 const struct nft_chain_type *type;
508f8ccd
PNA		 1523 struct net_device *dev;
1524 int err;
1525
f102d66b
FW		 1526 lockdep_assert_held(&net->nft.commit_mutex);
1527 lockdep_nfnl_nft_mutex_not_held();
1528
508f8ccd 1529 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1530 nft_hook_policy, NULL);
508f8ccd
PNA		 1531 if (err < 0)
1532 return err;
1533
1534 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1535 ha[NFTA_HOOK_PRIORITY] == NULL)
1536 return -EINVAL;
1537
1538 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1539 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1540
36596dad 1541 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1542 if (nla[NFTA_CHAIN_TYPE]) {
452238e8 1543 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
445509eb 1544 family, autoload);
508f8ccd
PNA		 1545 if (IS_ERR(type))
1546 return PTR_ERR(type);
1547 }
1548 if (!(type->hook_mask & (1 << hook->num)))
1549 return -EOPNOTSUPP;
84ba7dd7
FW		 1550
1551 if (type->type == NFT_CHAIN_T_NAT &&
1552 hook->priority <= NF_IP_PRI_CONNTRACK)
1553 return -EOPNOTSUPP;
1554
508f8ccd
PNA		 1555 if (!try_module_get(type->owner))
1556 return -ENOENT;
1557
1558 hook->type = type;
1559
1560 hook->dev = NULL;
36596dad 1561 if (family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1562 char ifname[IFNAMSIZ];
1563
1564 if (!ha[NFTA_HOOK_DEV]) {
1565 module_put(type->owner);
1566 return -EOPNOTSUPP;
1567 }
1568
1569 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
90d2723c 1570 dev = __dev_get_by_name(net, ifname);
508f8ccd
PNA		 1571 if (!dev) {
1572 module_put(type->owner);
1573 return -ENOENT;
1574 }
1575 hook->dev = dev;
1576 } else if (ha[NFTA_HOOK_DEV]) {
1577 module_put(type->owner);
1578 return -EOPNOTSUPP;
1579 }
1580
1581 return 0;
1582}
1583
1584static void nft_chain_release_hook(struct nft_chain_hook *hook)
1585{
1586 module_put(hook->type->owner);
508f8ccd
PNA		 1587}
1588
0cbc06b3
FW		 1589struct nft_rules_old {
1590 struct rcu_head h;
1591 struct nft_rule **start;
1592};
1593
1594static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1595 unsigned int alloc)
1596{
1597 if (alloc > INT_MAX)
1598 return NULL;
1599
1600 alloc += 1; /* NULL, ends rules */
1601 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1602 return NULL;
1603
1604 alloc *= sizeof(struct nft_rule *);
1605 alloc += sizeof(struct nft_rules_old);
1606
1607 return kvmalloc(alloc, GFP_KERNEL);
1608}
1609
4035285f 1610static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
445509eb 1611 u8 policy)
4035285f
PNA		 1612{
1613 const struct nlattr * const *nla = ctx->nla;
1614 struct nft_table *table = ctx->table;
4035285f
PNA		 1615 struct nft_base_chain *basechain;
1616 struct nft_stats __percpu *stats;
1617 struct net *net = ctx->net;
1618 struct nft_chain *chain;
0cbc06b3 1619 struct nft_rule **rules;
4035285f
PNA		 1620 int err;
1621
1622 if (table->use == UINT_MAX)
1623 return -EOVERFLOW;
1624
1625 if (nla[NFTA_CHAIN_HOOK]) {
1626 struct nft_chain_hook hook;
1627 struct nf_hook_ops *ops;
4035285f 1628
445509eb 1629 err = nft_chain_parse_hook(net, nla, &hook, family, true);
4035285f
PNA		 1630 if (err < 0)
1631 return err;
1632
1633 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1634 if (basechain == NULL) {
1635 nft_chain_release_hook(&hook);
1636 return -ENOMEM;
1637 }
1638
1639 if (hook.dev != NULL)
1640 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1641
1642 if (nla[NFTA_CHAIN_COUNTERS]) {
1643 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1644 if (IS_ERR(stats)) {
1645 nft_chain_release_hook(&hook);
1646 kfree(basechain);
1647 return PTR_ERR(stats);
1648 }
4c05ec47 1649 rcu_assign_pointer(basechain->stats, stats);
4035285f
PNA		 1650 static_branch_inc(&nft_counters_enabled);
1651 }
1652
4035285f
PNA		 1653 basechain->type = hook.type;
1654 chain = &basechain->chain;
1655
c974a3a3
PNA		 1656 ops = &basechain->ops;
1657 ops->pf = family;
1658 ops->hooknum = hook.num;
1659 ops->priority = hook.priority;
1660 ops->priv = chain;
c2f9eafe 1661 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1662 ops->dev = hook.dev;
c974a3a3 1663
4035285f
PNA		 1664 chain->flags |= NFT_BASE_CHAIN;
1665 basechain->policy = policy;
1666 } else {
1667 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1668 if (chain == NULL)
1669 return -ENOMEM;
1670 }
43a605f2
PNA		 1671 ctx->chain = chain;
1672
4035285f
PNA		 1673 INIT_LIST_HEAD(&chain->rules);
1674 chain->handle = nf_tables_alloc_handle(table);
1675 chain->table = table;
1676 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1677 if (!chain->name) {
1678 err = -ENOMEM;
1679 goto err1;
1680 }
1681
0cbc06b3
FW		 1682 rules = nf_tables_chain_alloc_rules(chain, 0);
1683 if (!rules) {
1684 err = -ENOMEM;
1685 goto err1;
1686 }
1687
1688 *rules = NULL;
1689 rcu_assign_pointer(chain->rules_gen_0, rules);
1690 rcu_assign_pointer(chain->rules_gen_1, rules);
1691
c974a3a3 1692 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1693 if (err < 0)
1694 goto err1;
1695
1b2470e5
FW		 1696 err = rhltable_insert_key(&table->chains_ht, chain->name,
1697 &chain->rhlhead, nft_chain_ht_params);
1698 if (err)
1699 goto err2;
1700
4035285f 1701 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1b2470e5
FW		 1702 if (err < 0) {
1703 rhltable_remove(&table->chains_ht, &chain->rhlhead,
1704 nft_chain_ht_params);
4035285f 1705 goto err2;
1b2470e5 1706 }
4035285f
PNA		 1707
1708 table->use++;
1709 list_add_tail_rcu(&chain->list, &table->chains);
1710
1711 return 0;
1712err2:
c974a3a3 1713 nf_tables_unregister_hook(net, table, chain);
4035285f 1714err1:
43a605f2 1715 nf_tables_chain_destroy(ctx);
4035285f
PNA		 1716
1717 return err;
1718}
1719
445509eb 1720static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy)
2c4a488a
PNA		 1721{
1722 const struct nlattr * const *nla = ctx->nla;
1723 struct nft_table *table = ctx->table;
1724 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1725 struct nft_base_chain *basechain;
1726 struct nft_stats *stats = NULL;
1727 struct nft_chain_hook hook;
2c4a488a
PNA		 1728 struct nf_hook_ops *ops;
1729 struct nft_trans *trans;
c974a3a3 1730 int err;
2c4a488a
PNA		 1731
1732 if (nla[NFTA_CHAIN_HOOK]) {
1733 if (!nft_is_base_chain(chain))
1734 return -EBUSY;
1735
36596dad 1736 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
445509eb 1737 false);
2c4a488a
PNA		 1738 if (err < 0)
1739 return err;
1740
1741 basechain = nft_base_chain(chain);
1742 if (basechain->type != hook.type) {
1743 nft_chain_release_hook(&hook);
1744 return -EBUSY;
1745 }
1746
c974a3a3
PNA		 1747 ops = &basechain->ops;
1748 if (ops->hooknum != hook.num ||
1749 ops->priority != hook.priority ||
1750 ops->dev != hook.dev) {
1751 nft_chain_release_hook(&hook);
1752 return -EBUSY;
2c4a488a
PNA		 1753 }
1754 nft_chain_release_hook(&hook);
1755 }
1756
1757 if (nla[NFTA_CHAIN_HANDLE] &&
1758 nla[NFTA_CHAIN_NAME]) {
1759 struct nft_chain *chain2;
1760
f102d66b
FW		 1761 chain2 = nft_chain_lookup(ctx->net, table,
1762 nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 1763 if (!IS_ERR(chain2))
1764 return -EEXIST;
2c4a488a
PNA		 1765 }
1766
1767 if (nla[NFTA_CHAIN_COUNTERS]) {
1768 if (!nft_is_base_chain(chain))
1769 return -EOPNOTSUPP;
1770
1771 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1772 if (IS_ERR(stats))
1773 return PTR_ERR(stats);
1774 }
1775
c6cc94df 1776 err = -ENOMEM;
2c4a488a
PNA		 1777 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1778 sizeof(struct nft_trans_chain));
c6cc94df
FW		 1779 if (trans == NULL)
1780 goto err;
2c4a488a
PNA		 1781
1782 nft_trans_chain_stats(trans) = stats;
1783 nft_trans_chain_update(trans) = true;
1784
1785 if (nla[NFTA_CHAIN_POLICY])
1786 nft_trans_chain_policy(trans) = policy;
1787 else
1788 nft_trans_chain_policy(trans) = -1;
1789
c6cc94df
FW		 1790 if (nla[NFTA_CHAIN_HANDLE] &&
1791 nla[NFTA_CHAIN_NAME]) {
1792 struct nft_trans *tmp;
1793 char *name;
1794
1795 err = -ENOMEM;
1796 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1797 if (!name)
1798 goto err;
1799
1800 err = -EEXIST;
1801 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
1802 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
1803 tmp->ctx.table == table &&
1804 nft_trans_chain_update(tmp) &&
1805 nft_trans_chain_name(tmp) &&
1806 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
1807 kfree(name);
1808 goto err;
1809 }
2c4a488a 1810 }
c6cc94df
FW		 1811
1812 nft_trans_chain_name(trans) = name;
2c4a488a
PNA		 1813 }
1814 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1815
1816 return 0;
c6cc94df
FW		 1817err:
1818 free_percpu(stats);
1819 kfree(trans);
1820 return err;
2c4a488a
PNA		 1821}
1822
633c9a84
PNA		 1823static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1824 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1825 const struct nlattr * const nla[],
1826 struct netlink_ext_ack *extack)
96518518
PM		 1827{
1828 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 1829 u8 genmask = nft_genmask_next(net);
1830 int family = nfmsg->nfgen_family;
36dd1bcc 1831 const struct nlattr *attr;
96518518
PM		 1832 struct nft_table *table;
1833 struct nft_chain *chain;
57de2a0c 1834 u8 policy = NF_ACCEPT;
4035285f 1835 struct nft_ctx ctx;
96518518 1836 u64 handle = 0;
96518518 1837
f102d66b
FW		 1838 lockdep_assert_held(&net->nft.commit_mutex);
1839
cac20fcd 1840 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1841 if (IS_ERR(table)) {
1842 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1843 return PTR_ERR(table);
36dd1bcc 1844 }
96518518 1845
96518518 1846 chain = NULL;
36dd1bcc 1847 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 1848
1849 if (nla[NFTA_CHAIN_HANDLE]) {
1850 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 1851 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 1852 if (IS_ERR(chain)) {
1853 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 1854 return PTR_ERR(chain);
36dd1bcc
PNA		 1855 }
1856 attr = nla[NFTA_CHAIN_HANDLE];
96518518 1857 } else {
f102d66b 1858 chain = nft_chain_lookup(net, table, attr, genmask);
96518518 1859 if (IS_ERR(chain)) {
36dd1bcc
PNA		 1860 if (PTR_ERR(chain) != -ENOENT) {
1861 NL_SET_BAD_ATTR(extack, attr);
96518518 1862 return PTR_ERR(chain);
36dd1bcc 1863 }
96518518
PM		 1864 chain = NULL;
1865 }
1866 }
1867
57de2a0c 1868 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 1869 if (chain != NULL &&
36dd1bcc
PNA		 1870 !nft_is_base_chain(chain)) {
1871 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 1872 return -EOPNOTSUPP;
36dd1bcc 1873 }
d6b6cb1d
PNA		 1874
1875 if (chain == NULL &&
36dd1bcc
PNA		 1876 nla[NFTA_CHAIN_HOOK] == NULL) {
1877 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 1878 return -EOPNOTSUPP;
36dd1bcc 1879 }
57de2a0c 1880
8f46df18 1881 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1882 switch (policy) {
1883 case NF_DROP:
1884 case NF_ACCEPT:
1885 break;
1886 default:
1887 return -EINVAL;
1888 }
1889 }
1890
98319cb9 1891 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 1892
96518518 1893 if (chain != NULL) {
36dd1bcc
PNA		 1894 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1895 NL_SET_BAD_ATTR(extack, attr);
96518518 1896 return -EEXIST;
36dd1bcc 1897 }
96518518
PM		 1898 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1899 return -EOPNOTSUPP;
1900
445509eb 1901 return nf_tables_updchain(&ctx, genmask, policy);
96518518
PM		 1902 }
1903
445509eb 1904 return nf_tables_addchain(&ctx, family, genmask, policy);
96518518
PM		 1905}
1906
633c9a84
PNA		 1907static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1908 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1909 const struct nlattr * const nla[],
1910 struct netlink_ext_ack *extack)
96518518
PM		 1911{
1912 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1913 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 1914 int family = nfmsg->nfgen_family;
1915 const struct nlattr *attr;
96518518
PM		 1916 struct nft_table *table;
1917 struct nft_chain *chain;
9dee1474 1918 struct nft_rule *rule;
91c7b38d 1919 struct nft_ctx ctx;
3ecbfd65 1920 u64 handle;
9dee1474
PNA		 1921 u32 use;
1922 int err;
96518518 1923
cac20fcd 1924 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1925 if (IS_ERR(table)) {
1926 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1927 return PTR_ERR(table);
36dd1bcc 1928 }
96518518 1929
3ecbfd65 1930 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 1931 attr = nla[NFTA_CHAIN_HANDLE];
1932 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 1933 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 1934 } else {
36dd1bcc 1935 attr = nla[NFTA_CHAIN_NAME];
f102d66b 1936 chain = nft_chain_lookup(net, table, attr, genmask);
3ecbfd65 1937 }
36dd1bcc
PNA		 1938 if (IS_ERR(chain)) {
1939 NL_SET_BAD_ATTR(extack, attr);
96518518 1940 return PTR_ERR(chain);
36dd1bcc 1941 }
9dee1474
PNA		 1942
1943 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1944 chain->use > 0)
96518518
PM		 1945 return -EBUSY;
1946
98319cb9 1947 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 1948
9dee1474
PNA		 1949 use = chain->use;
1950 list_for_each_entry(rule, &chain->rules, list) {
1951 if (!nft_is_active_next(net, rule))
1952 continue;
1953 use--;
1954
1955 err = nft_delrule(&ctx, rule);
1956 if (err < 0)
1957 return err;
1958 }
1959
1960 /* There are rules and elements that are still holding references to us,
1961 * we cannot do a recursive removal in this case.
1962 */
36dd1bcc
PNA		 1963 if (use > 0) {
1964 NL_SET_BAD_ATTR(extack, attr);
9dee1474 1965 return -EBUSY;
36dd1bcc 1966 }
9dee1474 1967
ee01d542 1968 return nft_delchain(&ctx);
96518518
PM		 1969}
1970
96518518
PM		 1971/*
1972 * Expressions
1973 */
1974
1975/**
ef1f7df9
PM		 1976 * nft_register_expr - register nf_tables expr type
1977 * @ops: expr type
96518518 1978 *
ef1f7df9 1979 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1980 * success or a negative errno code otherwise.
1981 */
ef1f7df9 1982int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1983{
1984 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1985 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1986 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1987 else
e688a7f8 1988 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1989 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1990 return 0;
1991}
1992EXPORT_SYMBOL_GPL(nft_register_expr);
1993
1994/**
ef1f7df9
PM		 1995 * nft_unregister_expr - unregister nf_tables expr type
1996 * @ops: expr type
96518518 1997 *
ef1f7df9 1998 * Unregisters the expr typefor use with nf_tables.
96518518 1999 */
ef1f7df9 2000void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 2001{
2002 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 2003 list_del_rcu(&type->list);
96518518
PM		 2004 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2005}
2006EXPORT_SYMBOL_GPL(nft_unregister_expr);
2007
64d46806
PM		 2008static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2009 struct nlattr *nla)
96518518 2010{
ef1f7df9 2011 const struct nft_expr_type *type;
96518518 2012
ef1f7df9 2013 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 2014 if (!nla_strcmp(nla, type->name) &&
2015 (!type->family || type->family == family))
ef1f7df9 2016 return type;
96518518
PM		 2017 }
2018 return NULL;
2019}
2020
452238e8
FW		 2021static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2022 u8 family,
64d46806 2023 struct nlattr *nla)
96518518 2024{
ef1f7df9 2025 const struct nft_expr_type *type;
96518518
PM		 2026
2027 if (nla == NULL)
2028 return ERR_PTR(-EINVAL);
2029
64d46806 2030 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 2031 if (type != NULL && try_module_get(type->owner))
2032 return type;
96518518 2033
f102d66b 2034 lockdep_nfnl_nft_mutex_not_held();
96518518 2035#ifdef CONFIG_MODULES
ef1f7df9 2036 if (type == NULL) {
452238e8
FW		 2037 nft_request_module(net, "nft-expr-%u-%.*s", family,
2038 nla_len(nla), (char *)nla_data(nla));
64d46806
PM		 2039 if (__nft_expr_type_get(family, nla))
2040 return ERR_PTR(-EAGAIN);
2041
452238e8
FW		 2042 nft_request_module(net, "nft-expr-%.*s",
2043 nla_len(nla), (char *)nla_data(nla));
64d46806 2044 if (__nft_expr_type_get(family, nla))
96518518
PM		 2045 return ERR_PTR(-EAGAIN);
2046 }
2047#endif
2048 return ERR_PTR(-ENOENT);
2049}
2050
2051static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2052 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
2053 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2054};
2055
2056static int nf_tables_fill_expr_info(struct sk_buff *skb,
2057 const struct nft_expr *expr)
2058{
ef1f7df9 2059 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 2060 goto nla_put_failure;
2061
2062 if (expr->ops->dump) {
2063 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
2064 if (data == NULL)
2065 goto nla_put_failure;
2066 if (expr->ops->dump(skb, expr) < 0)
2067 goto nla_put_failure;
2068 nla_nest_end(skb, data);
2069 }
2070
2071 return skb->len;
2072
2073nla_put_failure:
2074 return -1;
2075};
2076
0b2d8a7b
PM		 2077int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2078 const struct nft_expr *expr)
2079{
2080 struct nlattr *nest;
2081
2082 nest = nla_nest_start(skb, attr);
2083 if (!nest)
2084 goto nla_put_failure;
2085 if (nf_tables_fill_expr_info(skb, expr) < 0)
2086 goto nla_put_failure;
2087 nla_nest_end(skb, nest);
2088 return 0;
2089
2090nla_put_failure:
2091 return -1;
2092}
2093
96518518
PM		 2094struct nft_expr_info {
2095 const struct nft_expr_ops *ops;
ef1f7df9 2096 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 2097};
2098
0ca743a5
PNA		 2099static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2100 const struct nlattr *nla,
96518518
PM		 2101 struct nft_expr_info *info)
2102{
ef1f7df9 2103 const struct nft_expr_type *type;
96518518 2104 const struct nft_expr_ops *ops;
ef1f7df9 2105 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 2106 int err;
2107
fceb6435 2108 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 2109 if (err < 0)
2110 return err;
2111
452238e8 2112 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 2113 if (IS_ERR(type))
2114 return PTR_ERR(type);
2115
2116 if (tb[NFTA_EXPR_DATA]) {
2117 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 2118 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 2119 if (err < 0)
2120 goto err1;
2121 } else
2122 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2123
2124 if (type->select_ops != NULL) {
0ca743a5
PNA		 2125 ops = type->select_ops(ctx,
2126 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 2127 if (IS_ERR(ops)) {
2128 err = PTR_ERR(ops);
2129 goto err1;
2130 }
2131 } else
2132 ops = type->ops;
2133
96518518
PM		 2134 info->ops = ops;
2135 return 0;
ef1f7df9
PM		 2136
2137err1:
2138 module_put(type->owner);
2139 return err;
96518518
PM		 2140}
2141
2142static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 2143 const struct nft_expr_info *info,
96518518
PM		 2144 struct nft_expr *expr)
2145{
2146 const struct nft_expr_ops *ops = info->ops;
2147 int err;
2148
2149 expr->ops = ops;
2150 if (ops->init) {
ef1f7df9 2151 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 2152 if (err < 0)
2153 goto err1;
2154 }
2155
96518518 2156 return 0;
96518518
PM		 2157err1:
2158 expr->ops = NULL;
2159 return err;
2160}
2161
62472bce
PM		 2162static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2163 struct nft_expr *expr)
96518518 2164{
3f3a390d
PNA		 2165 const struct nft_expr_type *type = expr->ops->type;
2166
96518518 2167 if (expr->ops->destroy)
62472bce 2168 expr->ops->destroy(ctx, expr);
3f3a390d 2169 module_put(type->owner);
96518518
PM		 2170}
2171
0b2d8a7b
PM		 2172struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2173 const struct nlattr *nla)
2174{
2175 struct nft_expr_info info;
2176 struct nft_expr *expr;
b8e20400 2177 struct module *owner;
0b2d8a7b
PM		 2178 int err;
2179
2180 err = nf_tables_expr_parse(ctx, nla, &info);
2181 if (err < 0)
2182 goto err1;
2183
2184 err = -ENOMEM;
2185 expr = kzalloc(info.ops->size, GFP_KERNEL);
2186 if (expr == NULL)
2187 goto err2;
2188
2189 err = nf_tables_newexpr(ctx, &info, expr);
2190 if (err < 0)
6cafaf47 2191 goto err3;
0b2d8a7b
PM		 2192
2193 return expr;
6cafaf47
LZ		 2194err3:
2195 kfree(expr);
0b2d8a7b 2196err2:
b8e20400
PNA		 2197 owner = info.ops->type->owner;
2198 if (info.ops->type->release_ops)
2199 info.ops->type->release_ops(info.ops);
2200
2201 module_put(owner);
0b2d8a7b
PM		 2202err1:
2203 return ERR_PTR(err);
2204}
2205
2206void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2207{
2208 nf_tables_expr_destroy(ctx, expr);
2209 kfree(expr);
2210}
2211
96518518
PM		 2212/*
2213 * Rules
2214 */
2215
cac20fcd
PNA		 2216static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2217 u64 handle)
96518518
PM		 2218{
2219 struct nft_rule *rule;
2220
2221 // FIXME: this sucks
d9adf22a 2222 list_for_each_entry_rcu(rule, &chain->rules, list) {
96518518
PM		 2223 if (handle == rule->handle)
2224 return rule;
2225 }
2226
2227 return ERR_PTR(-ENOENT);
2228}
2229
cac20fcd
PNA		 2230static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2231 const struct nlattr *nla)
96518518
PM		 2232{
2233 if (nla == NULL)
2234 return ERR_PTR(-EINVAL);
2235
cac20fcd 2236 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 2237}
2238
2239static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 2240 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2241 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 2242 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2243 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2244 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2245 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 2246 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 2247 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 2248 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2249 .len = NFT_USERDATA_MAXLEN },
467697d2 2250 [NFTA_RULE_ID] = { .type = NLA_U32 },
0604628b 2251 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
96518518
PM		 2252};
2253
84d7fce6
PNA		 2254static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2255 u32 portid, u32 seq, int event,
2256 u32 flags, int family,
96518518
PM		 2257 const struct nft_table *table,
2258 const struct nft_chain *chain,
2259 const struct nft_rule *rule)
2260{
2261 struct nlmsghdr *nlh;
2262 struct nfgenmsg *nfmsg;
2263 const struct nft_expr *expr, *next;
2264 struct nlattr *list;
5e948466 2265 const struct nft_rule *prule;
dedb67c4 2266 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 2267
dedb67c4 2268 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 2269 if (nlh == NULL)
2270 goto nla_put_failure;
2271
2272 nfmsg = nlmsg_data(nlh);
2273 nfmsg->nfgen_family = family;
2274 nfmsg->version = NFNETLINK_V0;
84d7fce6 2275 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2276
2277 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2278 goto nla_put_failure;
2279 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2280 goto nla_put_failure;
b46f6ded
ND		 2281 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2282 NFTA_RULE_PAD))
96518518
PM		 2283 goto nla_put_failure;
2284
5e948466 2285 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 2286 prule = list_prev_entry(rule, list);
5e948466 2287 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2288 cpu_to_be64(prule->handle),
2289 NFTA_RULE_PAD))
5e948466
EL		 2290 goto nla_put_failure;
2291 }
2292
96518518
PM		 2293 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2294 if (list == NULL)
2295 goto nla_put_failure;
2296 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2297 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2298 goto nla_put_failure;
96518518
PM		 2299 }
2300 nla_nest_end(skb, list);
2301
86f1ec32
PM		 2302 if (rule->udata) {
2303 struct nft_userdata *udata = nft_userdata(rule);
2304 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2305 udata->data) < 0)
2306 goto nla_put_failure;
2307 }
0768b3b3 2308
053c095a
JB		 2309 nlmsg_end(skb, nlh);
2310 return 0;
96518518
PM		 2311
2312nla_put_failure:
2313 nlmsg_trim(skb, nlh);
2314 return -1;
2315}
2316
25e94a99
PNA		 2317static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2318 const struct nft_rule *rule, int event)
96518518
PM		 2319{
2320 struct sk_buff *skb;
96518518
PM		 2321 int err;
2322
128ad332
PNA		 2323 if (!ctx->report &&
2324 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2325 return;
96518518 2326
96518518
PM		 2327 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2328 if (skb == NULL)
2329 goto err;
2330
84d7fce6 2331 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2332 event, 0, ctx->family, ctx->table,
35151d84 2333 ctx->chain, rule);
96518518
PM		 2334 if (err < 0) {
2335 kfree_skb(skb);
2336 goto err;
2337 }
2338
25e94a99
PNA		 2339 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2340 ctx->report, GFP_KERNEL);
2341 return;
96518518 2342err:
25e94a99 2343 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2344}
2345
6e1f760e 2346struct nft_rule_dump_ctx {
e46abbcc 2347 char *table;
b7263e07 2348 char *chain;
6e1f760e
PNA		 2349};
2350
241faece
PS		 2351static int __nf_tables_dump_rules(struct sk_buff *skb,
2352 unsigned int *idx,
2353 struct netlink_callback *cb,
2354 const struct nft_table *table,
2355 const struct nft_chain *chain)
2356{
2357 struct net *net = sock_net(skb->sk);
2358 unsigned int s_idx = cb->args[0];
2359 const struct nft_rule *rule;
241faece
PS		 2360
2361 list_for_each_entry_rcu(rule, &chain->rules, list) {
2362 if (!nft_is_active(net, rule))
2363 goto cont;
2364 if (*idx < s_idx)
2365 goto cont;
2366 if (*idx > s_idx) {
2367 memset(&cb->args[1], 0,
2368 sizeof(cb->args) - sizeof(cb->args[0]));
2369 }
2370 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2371 cb->nlh->nlmsg_seq,
2372 NFT_MSG_NEWRULE,
2373 NLM_F_MULTI | NLM_F_APPEND,
2374 table->family,
2375 table, chain, rule) < 0)
310529e6 2376 return 1;
241faece
PS		 2377
2378 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2379cont:
2380 (*idx)++;
2381 }
310529e6 2382 return 0;
241faece
PS		 2383}
2384
96518518
PM		 2385static int nf_tables_dump_rules(struct sk_buff *skb,
2386 struct netlink_callback *cb)
2387{
2388 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2389 const struct nft_rule_dump_ctx *ctx = cb->data;
241faece 2390 struct nft_table *table;
96518518 2391 const struct nft_chain *chain;
241faece 2392 unsigned int idx = 0;
99633ab2 2393 struct net *net = sock_net(skb->sk);
96518518
PM		 2394 int family = nfmsg->nfgen_family;
2395
e688a7f8 2396 rcu_read_lock();
38e029f1
PNA		 2397 cb->seq = net->nft.base_seq;
2398
36596dad 2399 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2400 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2401 continue;
2402
2403 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2404 continue;
2405
715849ab 2406 if (ctx && ctx->table && ctx->chain) {
241faece 2407 struct rhlist_head *list, *tmp;
6e1f760e 2408
241faece
PS		 2409 list = rhltable_lookup(&table->chains_ht, ctx->chain,
2410 nft_chain_ht_params);
2411 if (!list)
2412 goto done;
2413
2414 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2415 if (!nft_is_active(net, chain))
2416 continue;
2417 __nf_tables_dump_rules(skb, &idx,
2418 cb, table, chain);
2419 break;
96518518 2420 }
241faece 2421 goto done;
96518518 2422 }
241faece
PS		 2423
2424 list_for_each_entry_rcu(chain, &table->chains, list) {
2425 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2426 goto done;
2427 }
2428
2429 if (ctx && ctx->table)
2430 break;
96518518
PM		 2431 }
2432done:
e688a7f8 2433 rcu_read_unlock();
310529e6
PS		 2434
2435 cb->args[0] = idx;
96518518
PM		 2436 return skb->len;
2437}
2438
90fd131a
FW		 2439static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2440{
2441 const struct nlattr * const *nla = cb->data;
2442 struct nft_rule_dump_ctx *ctx = NULL;
2443
2444 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2445 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2446 if (!ctx)
2447 return -ENOMEM;
2448
2449 if (nla[NFTA_RULE_TABLE]) {
2450 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2451 GFP_ATOMIC);
2452 if (!ctx->table) {
2453 kfree(ctx);
2454 return -ENOMEM;
2455 }
2456 }
2457 if (nla[NFTA_RULE_CHAIN]) {
2458 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2459 GFP_ATOMIC);
2460 if (!ctx->chain) {
2461 kfree(ctx->table);
2462 kfree(ctx);
2463 return -ENOMEM;
2464 }
2465 }
2466 }
2467
2468 cb->data = ctx;
2469 return 0;
2470}
2471
6e1f760e
PNA		 2472static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2473{
e46abbcc
PS		 2474 struct nft_rule_dump_ctx *ctx = cb->data;
2475
2476 if (ctx) {
2477 kfree(ctx->table);
b7263e07 2478 kfree(ctx->chain);
e46abbcc
PS		 2479 kfree(ctx);
2480 }
6e1f760e
PNA		 2481 return 0;
2482}
2483
d9adf22a 2484/* called with rcu_read_lock held */
7b8002a1
PNA		 2485static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2486 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2487 const struct nlattr * const nla[],
2488 struct netlink_ext_ack *extack)
96518518
PM		 2489{
2490 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2491 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2492 const struct nft_chain *chain;
2493 const struct nft_rule *rule;
1b2470e5 2494 struct nft_table *table;
96518518
PM		 2495 struct sk_buff *skb2;
2496 int family = nfmsg->nfgen_family;
2497 int err;
2498
2499 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2500 struct netlink_dump_control c = {
90fd131a 2501 .start= nf_tables_dump_rules_start,
96518518 2502 .dump = nf_tables_dump_rules,
6e1f760e 2503 .done = nf_tables_dump_rules_done,
d9adf22a 2504 .module = THIS_MODULE,
90fd131a 2505 .data = (void *)nla,
96518518 2506 };
6e1f760e 2507
d9adf22a 2508 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 2509 }
2510
cac20fcd 2511 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2512 if (IS_ERR(table)) {
2513 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2514 return PTR_ERR(table);
36dd1bcc 2515 }
96518518 2516
f102d66b 2517 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2518 if (IS_ERR(chain)) {
2519 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2520 return PTR_ERR(chain);
36dd1bcc 2521 }
96518518 2522
cac20fcd 2523 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2524 if (IS_ERR(rule)) {
2525 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2526 return PTR_ERR(rule);
36dd1bcc 2527 }
96518518 2528
d9adf22a 2529 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 2530 if (!skb2)
2531 return -ENOMEM;
2532
84d7fce6 2533 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2534 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2535 family, table, chain, rule);
2536 if (err < 0)
2537 goto err;
2538
2539 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2540
2541err:
2542 kfree_skb(skb2);
2543 return err;
2544}
2545
62472bce
PM		 2546static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2547 struct nft_rule *rule)
96518518 2548{
29e38801 2549 struct nft_expr *expr, *next;
96518518
PM		 2550
2551 /*
2552 * Careful: some expressions might not be initialized in case this
2553 * is called on error from nf_tables_newrule().
2554 */
2555 expr = nft_expr_first(rule);
3e38df13 2556 while (expr != nft_expr_last(rule) && expr->ops) {
29e38801 2557 next = nft_expr_next(expr);
62472bce 2558 nf_tables_expr_destroy(ctx, expr);
29e38801 2559 expr = next;
96518518
PM		 2560 }
2561 kfree(rule);
2562}
2563
bb7b40ae
PNA		 2564static void nf_tables_rule_release(const struct nft_ctx *ctx,
2565 struct nft_rule *rule)
2566{
f6ac8585 2567 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
bb7b40ae
PNA		 2568 nf_tables_rule_destroy(ctx, rule);
2569}
2570
a654de8f
PNA		 2571int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2572{
2573 struct nft_expr *expr, *last;
2574 const struct nft_data *data;
2575 struct nft_rule *rule;
2576 int err;
2577
26b2f552
TY		 2578 if (ctx->level == NFT_JUMP_STACK_SIZE)
2579 return -EMLINK;
2580
a654de8f
PNA		 2581 list_for_each_entry(rule, &chain->rules, list) {
2582 if (!nft_is_active_next(ctx->net, rule))
2583 continue;
2584
2585 nft_rule_for_each_expr(expr, last, rule) {
2586 if (!expr->ops->validate)
2587 continue;
2588
2589 err = expr->ops->validate(ctx, expr, &data);
2590 if (err < 0)
2591 return err;
2592 }
2593 }
2594
2595 return 0;
2596}
2597EXPORT_SYMBOL_GPL(nft_chain_validate);
2598
2599static int nft_table_validate(struct net *net, const struct nft_table *table)
2600{
2601 struct nft_chain *chain;
2602 struct nft_ctx ctx = {
2603 .net = net,
2604 .family = table->family,
2605 };
2606 int err;
2607
2608 list_for_each_entry(chain, &table->chains, list) {
2609 if (!nft_is_base_chain(chain))
2610 continue;
2611
2612 ctx.chain = chain;
2613 err = nft_chain_validate(&ctx, chain);
2614 if (err < 0)
2615 return err;
2616 }
2617
2618 return 0;
2619}
2620
75dd48e2
PS		 2621static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2622 const struct nlattr *nla);
2623
1081d11b
PNA		 2624#define NFT_RULE_MAXEXPRS 128
2625
633c9a84
PNA		 2626static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2627 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2628 const struct nlattr * const nla[],
2629 struct netlink_ext_ack *extack)
96518518
PM		 2630{
2631 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2632 u8 genmask = nft_genmask_next(net);
2a43ecf9 2633 struct nft_expr_info *info = NULL;
98319cb9 2634 int family = nfmsg->nfgen_family;
96518518
PM		 2635 struct nft_table *table;
2636 struct nft_chain *chain;
2637 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2638 struct nft_userdata *udata;
1081d11b 2639 struct nft_trans *trans = NULL;
96518518
PM		 2640 struct nft_expr *expr;
2641 struct nft_ctx ctx;
2642 struct nlattr *tmp;
86f1ec32 2643 unsigned int size, i, n, ulen = 0, usize = 0;
96518518 2644 int err, rem;
5e948466 2645 u64 handle, pos_handle;
96518518 2646
f102d66b
FW		 2647 lockdep_assert_held(&net->nft.commit_mutex);
2648
cac20fcd 2649 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2650 if (IS_ERR(table)) {
2651 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2652 return PTR_ERR(table);
36dd1bcc 2653 }
96518518 2654
f102d66b 2655 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2656 if (IS_ERR(chain)) {
2657 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2658 return PTR_ERR(chain);
36dd1bcc 2659 }
96518518
PM		 2660
2661 if (nla[NFTA_RULE_HANDLE]) {
2662 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 2663 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 2664 if (IS_ERR(rule)) {
2665 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2666 return PTR_ERR(rule);
36dd1bcc 2667 }
96518518 2668
36dd1bcc
PNA		 2669 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2670 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2671 return -EEXIST;
36dd1bcc 2672 }
96518518
PM		 2673 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2674 old_rule = rule;
2675 else
2676 return -EOPNOTSUPP;
2677 } else {
445509eb
PNA		 2678 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
2679 nlh->nlmsg_flags & NLM_F_REPLACE)
96518518
PM		 2680 return -EINVAL;
2681 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2682
2683 if (chain->use == UINT_MAX)
2684 return -EOVERFLOW;
5e948466 2685
447750f2
FW		 2686 if (nla[NFTA_RULE_POSITION]) {
2687 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2688 old_rule = __nft_rule_lookup(chain, pos_handle);
2689 if (IS_ERR(old_rule)) {
2690 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
2691 return PTR_ERR(old_rule);
2692 }
75dd48e2
PS		 2693 } else if (nla[NFTA_RULE_POSITION_ID]) {
2694 old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
2695 if (IS_ERR(old_rule)) {
2696 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
2697 return PTR_ERR(old_rule);
2698 }
36dd1bcc 2699 }
5e948466
EL		 2700 }
2701
98319cb9 2702 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 2703
96518518
PM		 2704 n = 0;
2705 size = 0;
2706 if (nla[NFTA_RULE_EXPRESSIONS]) {
2a43ecf9
FW		 2707 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
2708 sizeof(struct nft_expr_info),
2709 GFP_KERNEL);
2710 if (!info)
2711 return -ENOMEM;
2712
96518518
PM		 2713 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2714 err = -EINVAL;
2715 if (nla_type(tmp) != NFTA_LIST_ELEM)
2716 goto err1;
2717 if (n == NFT_RULE_MAXEXPRS)
2718 goto err1;
0ca743a5 2719 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2720 if (err < 0)
2721 goto err1;
2722 size += info[n].ops->size;
2723 n++;
2724 }
2725 }
9889840f
PM		 2726 /* Check for overflow of dlen field */
2727 err = -EFBIG;
2728 if (size >= 1 << 12)
2729 goto err1;
96518518 2730
86f1ec32 2731 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2732 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2733 if (ulen > 0)
2734 usize = sizeof(struct nft_userdata) + ulen;
2735 }
0768b3b3 2736
96518518 2737 err = -ENOMEM;
86f1ec32 2738 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2739 if (rule == NULL)
2740 goto err1;
2741
889f7ee7 2742 nft_activate_next(net, rule);
0628b123 2743
96518518
PM		 2744 rule->handle = handle;
2745 rule->dlen = size;
86f1ec32 2746 rule->udata = ulen ? 1 : 0;
0768b3b3 2747
86f1ec32
PM		 2748 if (ulen) {
2749 udata = nft_userdata(rule);
2750 udata->len = ulen - 1;
2751 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2752 }
96518518 2753
96518518
PM		 2754 expr = nft_expr_first(rule);
2755 for (i = 0; i < n; i++) {
2756 err = nf_tables_newexpr(&ctx, &info[i], expr);
2757 if (err < 0)
2758 goto err2;
a654de8f
PNA		 2759
2760 if (info[i].ops->validate)
2761 nft_validate_state_update(net, NFT_VALIDATE_NEED);
2762
ef1f7df9 2763 info[i].ops = NULL;
96518518
PM		 2764 expr = nft_expr_next(expr);
2765 }
2766
96518518 2767 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
ca089878 2768 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
569ccae6
FW		 2769 if (trans == NULL) {
2770 err = -ENOMEM;
2771 goto err2;
2772 }
ca089878
TY		 2773 err = nft_delrule(&ctx, old_rule);
2774 if (err < 0) {
2775 nft_trans_destroy(trans);
569ccae6
FW		 2776 goto err2;
2777 }
2778
2779 list_add_tail_rcu(&rule->list, &old_rule->list);
2780 } else {
2781 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2782 err = -ENOMEM;
2783 goto err2;
2784 }
2785
2786 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2787 if (old_rule)
2788 list_add_rcu(&rule->list, &old_rule->list);
2789 else
2790 list_add_tail_rcu(&rule->list, &chain->rules);
2791 } else {
2792 if (old_rule)
2793 list_add_tail_rcu(&rule->list, &old_rule->list);
2794 else
2795 list_add_rcu(&rule->list, &chain->rules);
2796 }
0628b123 2797 }
2a43ecf9 2798 kvfree(info);
4fefee57 2799 chain->use++;
96518518 2800
a654de8f
PNA		 2801 if (net->nft.validate_state == NFT_VALIDATE_DO)
2802 return nft_table_validate(net, table);
2803
2804 return 0;
96518518 2805err2:
bb7b40ae 2806 nf_tables_rule_release(&ctx, rule);
96518518
PM		 2807err1:
2808 for (i = 0; i < n; i++) {
2809 if (info[i].ops != NULL)
ef1f7df9 2810 module_put(info[i].ops->type->owner);
96518518 2811 }
2a43ecf9 2812 kvfree(info);
96518518
PM		 2813 return err;
2814}
2815
1a94e38d
PNA		 2816static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2817 const struct nlattr *nla)
2818{
2819 u32 id = ntohl(nla_get_be32(nla));
2820 struct nft_trans *trans;
2821
2822 list_for_each_entry(trans, &net->nft.commit_list, list) {
2823 struct nft_rule *rule = nft_trans_rule(trans);
2824
2825 if (trans->msg_type == NFT_MSG_NEWRULE &&
2826 id == nft_trans_rule_id(trans))
2827 return rule;
2828 }
2829 return ERR_PTR(-ENOENT);
2830}
2831
633c9a84
PNA		 2832static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2833 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2834 const struct nlattr * const nla[],
2835 struct netlink_ext_ack *extack)
96518518
PM		 2836{
2837 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2838 u8 genmask = nft_genmask_next(net);
7c95f6d8 2839 struct nft_table *table;
cf9dc09d
PNA		 2840 struct nft_chain *chain = NULL;
2841 struct nft_rule *rule;
0628b123
PNA		 2842 int family = nfmsg->nfgen_family, err = 0;
2843 struct nft_ctx ctx;
96518518 2844
cac20fcd 2845 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2846 if (IS_ERR(table)) {
2847 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2848 return PTR_ERR(table);
36dd1bcc 2849 }
96518518 2850
cf9dc09d 2851 if (nla[NFTA_RULE_CHAIN]) {
f102d66b
FW		 2852 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
2853 genmask);
36dd1bcc
PNA		 2854 if (IS_ERR(chain)) {
2855 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 2856 return PTR_ERR(chain);
36dd1bcc 2857 }
cf9dc09d 2858 }
96518518 2859
98319cb9 2860 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 2861
cf9dc09d
PNA		 2862 if (chain) {
2863 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 2864 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2865 if (IS_ERR(rule)) {
2866 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 2867 return PTR_ERR(rule);
36dd1bcc 2868 }
96518518 2869
1a94e38d
PNA		 2870 err = nft_delrule(&ctx, rule);
2871 } else if (nla[NFTA_RULE_ID]) {
2872 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 2873 if (IS_ERR(rule)) {
2874 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 2875 return PTR_ERR(rule);
36dd1bcc 2876 }
1a94e38d 2877
5e266fe7 2878 err = nft_delrule(&ctx, rule);
cf9dc09d 2879 } else {
ce24b721 2880 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2881 }
2882 } else {
2883 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2884 if (!nft_is_active_next(net, chain))
2885 continue;
2886
cf9dc09d 2887 ctx.chain = chain;
ce24b721 2888 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2889 if (err < 0)
2890 break;
2891 }
2892 }
2893
2894 return err;
2895}
2896
20a69341
PM		 2897/*
2898 * Sets
2899 */
2900
2b664957 2901static LIST_HEAD(nf_tables_set_types);
20a69341 2902
2b664957 2903int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2904{
2905 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2906 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2907 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2908 return 0;
2909}
2910EXPORT_SYMBOL_GPL(nft_register_set);
2911
2b664957 2912void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2913{
2914 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2915 list_del_rcu(&type->list);
20a69341
PM		 2916 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2917}
2918EXPORT_SYMBOL_GPL(nft_unregister_set);
2919
2b664957 2920#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 2921 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
2922 NFT_SET_EVAL)
2b664957 2923
71cc0873 2924static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 2925{
71cc0873 2926 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 2927}
2928
c50b960c
PM		 2929/*
2930 * Select a set implementation based on the data characteristics and the
2931 * given policy. The total memory use might not be known if no size is
2932 * given, in that case the amount of memory per element is used.
2933 */
2934static const struct nft_set_ops *
2b664957
PNA		 2935nft_select_set_ops(const struct nft_ctx *ctx,
2936 const struct nlattr * const nla[],
c50b960c
PM		 2937 const struct nft_set_desc *desc,
2938 enum nft_set_policies policy)
20a69341 2939{
c50b960c
PM		 2940 const struct nft_set_ops *ops, *bops;
2941 struct nft_set_estimate est, best;
2b664957
PNA		 2942 const struct nft_set_type *type;
2943 u32 flags = 0;
20a69341 2944
f102d66b
FW		 2945 lockdep_assert_held(&ctx->net->nft.commit_mutex);
2946 lockdep_nfnl_nft_mutex_not_held();
20a69341 2947#ifdef CONFIG_MODULES
2b664957 2948 if (list_empty(&nf_tables_set_types)) {
452238e8 2949 nft_request_module(ctx->net, "nft-set");
2b664957 2950 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2951 return ERR_PTR(-EAGAIN);
2952 }
2953#endif
2b664957
PNA		 2954 if (nla[NFTA_SET_FLAGS] != NULL)
2955 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2956
55af753c
PNA		 2957 bops = NULL;
2958 best.size = ~0;
2959 best.lookup = ~0;
0b5a7874 2960 best.space = ~0;
c50b960c 2961
2b664957 2962 list_for_each_entry(type, &nf_tables_set_types, list) {
71cc0873 2963 ops = &type->ops;
2b664957 2964
71cc0873 2965 if (!nft_set_ops_candidate(type, flags))
20a69341 2966 continue;
2b664957 2967 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2968 continue;
2969
2970 switch (policy) {
2971 case NFT_SET_POL_PERFORMANCE:
55af753c 2972 if (est.lookup < best.lookup)
c50b960c 2973 break;
644e334e
PNA		 2974 if (est.lookup == best.lookup &&
2975 est.space < best.space)
2976 break;
c50b960c
PM		 2977 continue;
2978 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2979 if (!desc->size) {
2980 if (est.space < best.space)
2981 break;
2982 if (est.space == best.space &&
2983 est.lookup < best.lookup)
2984 break;
4f2921ca 2985 } else if (est.size < best.size || !bops) {
c50b960c 2986 break;
0b5a7874 2987 }
c50b960c
PM		 2988 continue;
2989 default:
2990 break;
2991 }
2992
2b664957 2993 if (!try_module_get(type->owner))
20a69341 2994 continue;
c50b960c 2995 if (bops != NULL)
71cc0873 2996 module_put(to_set_type(bops)->owner);
c50b960c
PM		 2997
2998 bops = ops;
2999 best = est;
20a69341
PM		 3000 }
3001
c50b960c
PM		 3002 if (bops != NULL)
3003 return bops;
3004
20a69341
PM		 3005 return ERR_PTR(-EOPNOTSUPP);
3006}
3007
3008static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 3009 [NFTA_SET_TABLE] = { .type = NLA_STRING,
3010 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 3011 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 3012 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 3013 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
3014 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
3015 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
3016 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
3017 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 3018 [NFTA_SET_POLICY] = { .type = NLA_U32 },
3019 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 3020 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 3021 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
3022 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 3023 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
3024 .len = NFT_USERDATA_MAXLEN },
8aeff920 3025 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 3026 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 3027};
3028
3029static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3030 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 3031};
3032
633c9a84 3033static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3034 const struct sk_buff *skb,
3035 const struct nlmsghdr *nlh,
f2a6d766 3036 const struct nlattr * const nla[],
36dd1bcc 3037 struct netlink_ext_ack *extack,
f2a6d766 3038 u8 genmask)
20a69341
PM		 3039{
3040 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3041 int family = nfmsg->nfgen_family;
7c95f6d8 3042 struct nft_table *table = NULL;
20a69341 3043
20a69341 3044 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 3045 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3046 genmask);
36dd1bcc
PNA		 3047 if (IS_ERR(table)) {
3048 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3049 return PTR_ERR(table);
36dd1bcc 3050 }
20a69341
PM		 3051 }
3052
98319cb9 3053 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3054 return 0;
3055}
3056
cac20fcd
PNA		 3057static struct nft_set *nft_set_lookup(const struct nft_table *table,
3058 const struct nlattr *nla, u8 genmask)
20a69341
PM		 3059{
3060 struct nft_set *set;
3061
3062 if (nla == NULL)
3063 return ERR_PTR(-EINVAL);
3064
d9adf22a 3065 list_for_each_entry_rcu(set, &table->sets, list) {
37a9cc52
PNA		 3066 if (!nla_strcmp(nla, set->name) &&
3067 nft_active_genmask(set, genmask))
20a69341
PM		 3068 return set;
3069 }
3070 return ERR_PTR(-ENOENT);
3071}
3072
cac20fcd
PNA		 3073static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3074 const struct nlattr *nla,
3075 u8 genmask)
3ecbfd65
HS		 3076{
3077 struct nft_set *set;
3078
3ecbfd65
HS		 3079 list_for_each_entry(set, &table->sets, list) {
3080 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3081 nft_active_genmask(set, genmask))
3082 return set;
3083 }
3084 return ERR_PTR(-ENOENT);
3085}
3086
cac20fcd
PNA		 3087static struct nft_set *nft_set_lookup_byid(const struct net *net,
3088 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 3089{
3090 struct nft_trans *trans;
3091 u32 id = ntohl(nla_get_be32(nla));
3092
3093 list_for_each_entry(trans, &net->nft.commit_list, list) {
9c7f96fd
AK		 3094 if (trans->msg_type == NFT_MSG_NEWSET) {
3095 struct nft_set *set = nft_trans_set(trans);
37a9cc52 3096
9c7f96fd
AK		 3097 if (id == nft_trans_set_id(trans) &&
3098 nft_active_genmask(set, genmask))
3099 return set;
3100 }
958bee14
PNA		 3101 }
3102 return ERR_PTR(-ENOENT);
3103}
c7a72e3f 3104
10659cba
PNA		 3105struct nft_set *nft_set_lookup_global(const struct net *net,
3106 const struct nft_table *table,
3107 const struct nlattr *nla_set_name,
3108 const struct nlattr *nla_set_id,
3109 u8 genmask)
c7a72e3f
PNA		 3110{
3111 struct nft_set *set;
3112
cac20fcd 3113 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 3114 if (IS_ERR(set)) {
3115 if (!nla_set_id)
3116 return set;
3117
cac20fcd 3118 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 3119 }
3120 return set;
3121}
10659cba 3122EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 3123
20a69341
PM		 3124static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3125 const char *name)
3126{
3127 const struct nft_set *i;
3128 const char *p;
3129 unsigned long *inuse;
60eb1894 3130 unsigned int n = 0, min = 0;
20a69341 3131
38745490 3132 p = strchr(name, '%');
20a69341
PM		 3133 if (p != NULL) {
3134 if (p[1] != 'd' || strchr(p + 2, '%'))
3135 return -EINVAL;
3136
3137 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3138 if (inuse == NULL)
3139 return -ENOMEM;
60eb1894 3140cont:
20a69341 3141 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 3142 int tmp;
3143
37a9cc52
PNA		 3144 if (!nft_is_active_next(ctx->net, set))
3145 continue;
14662917 3146 if (!sscanf(i->name, name, &tmp))
20a69341 3147 continue;
60eb1894 3148 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 3149 continue;
14662917 3150
60eb1894 3151 set_bit(tmp - min, inuse);
20a69341
PM		 3152 }
3153
53b70287 3154 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 3155 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3156 min += BITS_PER_BYTE * PAGE_SIZE;
3157 memset(inuse, 0, PAGE_SIZE);
3158 goto cont;
3159 }
20a69341
PM		 3160 free_page((unsigned long)inuse);
3161 }
3162
38745490
PS		 3163 set->name = kasprintf(GFP_KERNEL, name, min + n);
3164 if (!set->name)
3165 return -ENOMEM;
3166
20a69341 3167 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 3168 if (!nft_is_active_next(ctx->net, i))
3169 continue;
e63aaaa6
AY		 3170 if (!strcmp(set->name, i->name)) {
3171 kfree(set->name);
20a69341 3172 return -ENFILE;
e63aaaa6 3173 }
20a69341
PM		 3174 }
3175 return 0;
3176}
3177
8e1102d5
FW		 3178static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3179{
3180 u64 ms = be64_to_cpu(nla_get_be64(nla));
3181 u64 max = (u64)(~((u64)0));
3182
3183 max = div_u64(max, NSEC_PER_MSEC);
3184 if (ms >= max)
3185 return -ERANGE;
3186
3187 ms *= NSEC_PER_MSEC;
3188 *result = nsecs_to_jiffies64(ms);
3189 return 0;
3190}
3191
d6501de8 3192static __be64 nf_jiffies64_to_msecs(u64 input)
8e1102d5
FW		 3193{
3194 u64 ms = jiffies64_to_nsecs(input);
3195
3196 return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
3197}
3198
20a69341
PM		 3199static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3200 const struct nft_set *set, u16 event, u16 flags)
3201{
3202 struct nfgenmsg *nfmsg;
3203 struct nlmsghdr *nlh;
c50b960c 3204 struct nlattr *desc;
128ad332
PNA		 3205 u32 portid = ctx->portid;
3206 u32 seq = ctx->seq;
20a69341 3207
dedb67c4 3208 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 3209 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3210 flags);
3211 if (nlh == NULL)
3212 goto nla_put_failure;
3213
3214 nfmsg = nlmsg_data(nlh);
36596dad 3215 nfmsg->nfgen_family = ctx->family;
20a69341 3216 nfmsg->version = NFNETLINK_V0;
84d7fce6 3217 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 3218
3219 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3220 goto nla_put_failure;
3221 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3222 goto nla_put_failure;
3ecbfd65
HS		 3223 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3224 NFTA_SET_PAD))
3225 goto nla_put_failure;
20a69341
PM		 3226 if (set->flags != 0)
3227 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3228 goto nla_put_failure;
3229
3230 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3231 goto nla_put_failure;
3232 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3233 goto nla_put_failure;
3234 if (set->flags & NFT_SET_MAP) {
3235 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3236 goto nla_put_failure;
3237 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3238 goto nla_put_failure;
3239 }
8aeff920
PNA		 3240 if (set->flags & NFT_SET_OBJECT &&
3241 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3242 goto nla_put_failure;
20a69341 3243
761da293 3244 if (set->timeout &&
d3e2a111 3245 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 3246 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 3247 NFTA_SET_PAD))
761da293
PM		 3248 goto nla_put_failure;
3249 if (set->gc_int &&
3250 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3251 goto nla_put_failure;
3252
9363dc4b
AB		 3253 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3254 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3255 goto nla_put_failure;
3256 }
3257
e6d8ecac
CFG		 3258 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3259 goto nla_put_failure;
3260
c50b960c
PM		 3261 desc = nla_nest_start(skb, NFTA_SET_DESC);
3262 if (desc == NULL)
3263 goto nla_put_failure;
3264 if (set->size &&
3265 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3266 goto nla_put_failure;
3267 nla_nest_end(skb, desc);
3268
053c095a
JB		 3269 nlmsg_end(skb, nlh);
3270 return 0;
20a69341
PM		 3271
3272nla_put_failure:
3273 nlmsg_trim(skb, nlh);
3274 return -1;
3275}
3276
25e94a99
PNA		 3277static void nf_tables_set_notify(const struct nft_ctx *ctx,
3278 const struct nft_set *set, int event,
3279 gfp_t gfp_flags)
20a69341
PM		 3280{
3281 struct sk_buff *skb;
128ad332 3282 u32 portid = ctx->portid;
20a69341
PM		 3283 int err;
3284
128ad332
PNA		 3285 if (!ctx->report &&
3286 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 3287 return;
20a69341 3288
31f8441c 3289 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 3290 if (skb == NULL)
3291 goto err;
3292
3293 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3294 if (err < 0) {
3295 kfree_skb(skb);
3296 goto err;
3297 }
3298
25e94a99
PNA		 3299 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3300 gfp_flags);
3301 return;
20a69341 3302err:
25e94a99 3303 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 3304}
3305
5b96af77 3306static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 3307{
3308 const struct nft_set *set;
3309 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 3310 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3311 struct net *net = sock_net(skb->sk);
5b96af77 3312 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 3313
3314 if (cb->args[1])
3315 return skb->len;
3316
e688a7f8 3317 rcu_read_lock();
38e029f1
PNA		 3318 cb->seq = net->nft.base_seq;
3319
36596dad
PNA		 3320 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3321 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 3322 ctx->family != table->family)
36596dad
PNA		 3323 continue;
3324
3325 if (ctx->table && ctx->table != table)
5b96af77
PNA		 3326 continue;
3327
36596dad
PNA		 3328 if (cur_table) {
3329 if (cur_table != table)
c9c8e485
PNA		 3330 continue;
3331
36596dad 3332 cur_table = NULL;
c9c8e485 3333 }
36596dad
PNA		 3334 idx = 0;
3335 list_for_each_entry_rcu(set, &table->sets, list) {
3336 if (idx < s_idx)
3337 goto cont;
3338 if (!nft_is_active(net, set))
3339 goto cont;
5b96af77 3340
36596dad
PNA		 3341 ctx_set = *ctx;
3342 ctx_set.table = table;
98319cb9 3343 ctx_set.family = table->family;
c9c8e485 3344
36596dad
PNA		 3345 if (nf_tables_fill_set(skb, &ctx_set, set,
3346 NFT_MSG_NEWSET,
3347 NLM_F_MULTI) < 0) {
3348 cb->args[0] = idx;
3349 cb->args[2] = (unsigned long) table;
3350 goto done;
c9c8e485 3351 }
36596dad 3352 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 3353cont:
36596dad 3354 idx++;
c9c8e485 3355 }
36596dad
PNA		 3356 if (s_idx)
3357 s_idx = 0;
c9c8e485
PNA		 3358 }
3359 cb->args[1] = 1;
3360done:
e688a7f8 3361 rcu_read_unlock();
c9c8e485
PNA		 3362 return skb->len;
3363}
3364
90fd131a
FW		 3365static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3366{
3367 struct nft_ctx *ctx_dump = NULL;
3368
3369 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3370 if (ctx_dump == NULL)
3371 return -ENOMEM;
3372
3373 cb->data = ctx_dump;
3374 return 0;
3375}
3376
5b96af77 3377static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 3378{
5b96af77
PNA		 3379 kfree(cb->data);
3380 return 0;
20a69341
PM		 3381}
3382
d9adf22a 3383/* called with rcu_read_lock held */
7b8002a1
PNA		 3384static int nf_tables_getset(struct net *net, struct sock *nlsk,
3385 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3386 const struct nlattr * const nla[],
3387 struct netlink_ext_ack *extack)
20a69341 3388{
f2a6d766 3389 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3390 const struct nft_set *set;
3391 struct nft_ctx ctx;
3392 struct sk_buff *skb2;
c9c8e485 3393 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 3394 int err;
3395
01cfa0a4 3396 /* Verify existence before starting dump */
36dd1bcc
PNA		 3397 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3398 genmask);
20a69341
PM		 3399 if (err < 0)
3400 return err;
3401
3402 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3403 struct netlink_dump_control c = {
90fd131a 3404 .start = nf_tables_dump_sets_start,
20a69341 3405 .dump = nf_tables_dump_sets,
5b96af77 3406 .done = nf_tables_dump_sets_done,
90fd131a 3407 .data = &ctx,
d9adf22a 3408 .module = THIS_MODULE,
20a69341 3409 };
5b96af77 3410
d9adf22a 3411 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
20a69341
PM		 3412 }
3413
c9c8e485
PNA		 3414 /* Only accept unspec with dump */
3415 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3416 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3417 if (!nla[NFTA_SET_TABLE])
3418 return -EINVAL;
c9c8e485 3419
cac20fcd 3420 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3421 if (IS_ERR(set))
3422 return PTR_ERR(set);
3423
d9adf22a 3424 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
20a69341
PM		 3425 if (skb2 == NULL)
3426 return -ENOMEM;
3427
3428 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3429 if (err < 0)
3430 goto err;
3431
3432 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3433
3434err:
3435 kfree_skb(skb2);
3436 return err;
3437}
3438
c50b960c
PM		 3439static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3440 struct nft_set_desc *desc,
3441 const struct nlattr *nla)
3442{
3443 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3444 int err;
3445
fceb6435
JB		 3446 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3447 nft_set_desc_policy, NULL);
c50b960c
PM		 3448 if (err < 0)
3449 return err;
3450
3451 if (da[NFTA_SET_DESC_SIZE] != NULL)
3452 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3453
3454 return 0;
3455}
3456
633c9a84
PNA		 3457static int nf_tables_newset(struct net *net, struct sock *nlsk,
3458 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3459 const struct nlattr * const nla[],
3460 struct netlink_ext_ack *extack)
20a69341
PM		 3461{
3462 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3463 u8 genmask = nft_genmask_next(net);
98319cb9 3464 int family = nfmsg->nfgen_family;
20a69341 3465 const struct nft_set_ops *ops;
20a69341
PM		 3466 struct nft_table *table;
3467 struct nft_set *set;
3468 struct nft_ctx ctx;
38745490 3469 char *name;
4ef360dd 3470 u64 size;
761da293 3471 u64 timeout;
8aeff920 3472 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3473 struct nft_set_desc desc;
e6d8ecac
CFG		 3474 unsigned char *udata;
3475 u16 udlen;
20a69341
PM		 3476 int err;
3477
3478 if (nla[NFTA_SET_TABLE] == NULL ||
3479 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3480 nla[NFTA_SET_KEY_LEN] == NULL ||
3481 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3482 return -EINVAL;
3483
c50b960c
PM		 3484 memset(&desc, 0, sizeof(desc));
3485
20a69341
PM		 3486 ktype = NFT_DATA_VALUE;
3487 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3488 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3489 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3490 return -EINVAL;
3491 }
3492
c50b960c 3493 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3494 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3495 return -EINVAL;
3496
3497 flags = 0;
3498 if (nla[NFTA_SET_FLAGS] != NULL) {
3499 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3500 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3501 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3502 NFT_SET_MAP | NFT_SET_EVAL |
3503 NFT_SET_OBJECT))
20a69341 3504 return -EINVAL;
8aeff920
PNA		 3505 /* Only one of these operations is supported */
3506 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3507 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3508 return -EOPNOTSUPP;
20a69341
PM		 3509 }
3510
3511 dtype = 0;
20a69341
PM		 3512 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3513 if (!(flags & NFT_SET_MAP))
3514 return -EINVAL;
3515
3516 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3517 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3518 dtype != NFT_DATA_VERDICT)
3519 return -EINVAL;
3520
3521 if (dtype != NFT_DATA_VERDICT) {
3522 if (nla[NFTA_SET_DATA_LEN] == NULL)
3523 return -EINVAL;
c50b960c 3524 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3525 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3526 return -EINVAL;
3527 } else
7d740264 3528 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3529 } else if (flags & NFT_SET_MAP)
3530 return -EINVAL;
3531
8aeff920
PNA		 3532 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3533 if (!(flags & NFT_SET_OBJECT))
3534 return -EINVAL;
3535
3536 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3537 if (objtype == NFT_OBJECT_UNSPEC ||
3538 objtype > NFT_OBJECT_MAX)
3539 return -EINVAL;
3540 } else if (flags & NFT_SET_OBJECT)
3541 return -EINVAL;
3542 else
3543 objtype = NFT_OBJECT_UNSPEC;
3544
761da293
PM		 3545 timeout = 0;
3546 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3547 if (!(flags & NFT_SET_TIMEOUT))
3548 return -EINVAL;
8e1102d5
FW		 3549
3550 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3551 if (err)
3552 return err;
761da293
PM		 3553 }
3554 gc_int = 0;
3555 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3556 if (!(flags & NFT_SET_TIMEOUT))
3557 return -EINVAL;
3558 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3559 }
3560
c50b960c
PM		 3561 policy = NFT_SET_POL_PERFORMANCE;
3562 if (nla[NFTA_SET_POLICY] != NULL)
3563 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3564
3565 if (nla[NFTA_SET_DESC] != NULL) {
3566 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3567 if (err < 0)
3568 return err;
3569 }
3570
cac20fcd 3571 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 3572 if (IS_ERR(table)) {
3573 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3574 return PTR_ERR(table);
36dd1bcc 3575 }
20a69341 3576
98319cb9 3577 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3578
cac20fcd 3579 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 3580 if (IS_ERR(set)) {
36dd1bcc
PNA		 3581 if (PTR_ERR(set) != -ENOENT) {
3582 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3583 return PTR_ERR(set);
36dd1bcc 3584 }
1a28ad74 3585 } else {
36dd1bcc
PNA		 3586 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3587 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3588 return -EEXIST;
36dd1bcc 3589 }
20a69341
PM		 3590 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3591 return -EOPNOTSUPP;
36dd1bcc 3592
20a69341
PM		 3593 return 0;
3594 }
3595
3596 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3597 return -ENOENT;
3598
2b664957 3599 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3600 if (IS_ERR(ops))
3601 return PTR_ERR(ops);
3602
e6d8ecac
CFG		 3603 udlen = 0;
3604 if (nla[NFTA_SET_USERDATA])
3605 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3606
20a69341
PM		 3607 size = 0;
3608 if (ops->privsize != NULL)
347b408d 3609 size = ops->privsize(nla, &desc);
20a69341 3610
1ff75a3e
PNA		 3611 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3612 if (!set) {
3613 err = -ENOMEM;
20a69341 3614 goto err1;
1ff75a3e 3615 }
20a69341 3616
38745490
PS		 3617 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3618 if (!name) {
3619 err = -ENOMEM;
3620 goto err2;
3621 }
3622
20a69341 3623 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3624 kfree(name);
20a69341
PM		 3625 if (err < 0)
3626 goto err2;
3627
e6d8ecac
CFG		 3628 udata = NULL;
3629 if (udlen) {
3630 udata = set->data + size;
3631 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3632 }
3633
20a69341 3634 INIT_LIST_HEAD(&set->bindings);
3453c927
PNA		 3635 set->table = table;
3636 write_pnet(&set->net, net);
20a69341
PM		 3637 set->ops = ops;
3638 set->ktype = ktype;
c50b960c 3639 set->klen = desc.klen;
20a69341 3640 set->dtype = dtype;
8aeff920 3641 set->objtype = objtype;
c50b960c 3642 set->dlen = desc.dlen;
20a69341 3643 set->flags = flags;
c50b960c 3644 set->size = desc.size;
9363dc4b 3645 set->policy = policy;
e6d8ecac
CFG		 3646 set->udlen = udlen;
3647 set->udata = udata;
761da293
PM		 3648 set->timeout = timeout;
3649 set->gc_int = gc_int;
3ecbfd65 3650 set->handle = nf_tables_alloc_handle(table);
20a69341 3651
c50b960c 3652 err = ops->init(set, &desc, nla);
20a69341 3653 if (err < 0)
2f6adf48 3654 goto err3;
20a69341 3655
958bee14 3656 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3657 if (err < 0)
2f6adf48 3658 goto err4;
20a69341 3659
e688a7f8 3660 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3661 table->use++;
20a69341
PM		 3662 return 0;
3663
2f6adf48 3664err4:
c17c3cdf 3665 ops->destroy(set);
2f6adf48
FW		 3666err3:
3667 kfree(set->name);
20a69341 3668err2:
1ff75a3e 3669 kvfree(set);
20a69341 3670err1:
71cc0873 3671 module_put(to_set_type(ops)->owner);
20a69341
PM		 3672 return err;
3673}
3674
958bee14 3675static void nft_set_destroy(struct nft_set *set)
20a69341 3676{
273fe3f1
PNA		 3677 if (WARN_ON(set->use > 0))
3678 return;
3679
20a69341 3680 set->ops->destroy(set);
71cc0873 3681 module_put(to_set_type(set->ops)->owner);
38745490 3682 kfree(set->name);
1ff75a3e 3683 kvfree(set);
20a69341
PM		 3684}
3685
633c9a84
PNA		 3686static int nf_tables_delset(struct net *net, struct sock *nlsk,
3687 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3688 const struct nlattr * const nla[],
3689 struct netlink_ext_ack *extack)
20a69341 3690{
c9c8e485 3691 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3692 u8 genmask = nft_genmask_next(net);
36dd1bcc 3693 const struct nlattr *attr;
20a69341
PM		 3694 struct nft_set *set;
3695 struct nft_ctx ctx;
3696 int err;
3697
ec2c9935
PM		 3698 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3699 return -EAFNOSUPPORT;
20a69341
PM		 3700 if (nla[NFTA_SET_TABLE] == NULL)
3701 return -EINVAL;
3702
36dd1bcc
PNA		 3703 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3704 genmask);
20a69341
PM		 3705 if (err < 0)
3706 return err;
3707
36dd1bcc
PNA		 3708 if (nla[NFTA_SET_HANDLE]) {
3709 attr = nla[NFTA_SET_HANDLE];
3710 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3711 } else {
3712 attr = nla[NFTA_SET_NAME];
3713 set = nft_set_lookup(ctx.table, attr, genmask);
3714 }
a8278400 3715
36dd1bcc
PNA		 3716 if (IS_ERR(set)) {
3717 NL_SET_BAD_ATTR(extack, attr);
3718 return PTR_ERR(set);
3719 }
273fe3f1 3720 if (set->use ||
36dd1bcc
PNA		 3721 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3722 NL_SET_BAD_ATTR(extack, attr);
20a69341 3723 return -EBUSY;
36dd1bcc 3724 }
20a69341 3725
ee01d542 3726 return nft_delset(&ctx, set);
20a69341
PM		 3727}
3728
3729static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3730 struct nft_set *set,
20a69341 3731 const struct nft_set_iter *iter,
de70185d 3732 struct nft_set_elem *elem)
20a69341 3733{
fe2811eb 3734 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3735 enum nft_registers dreg;
3736
3737 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3738 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3739 set->dtype == NFT_DATA_VERDICT ?
3740 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3741 set->dlen);
20a69341
PM		 3742}
3743
3744int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3745 struct nft_set_binding *binding)
3746{
3747 struct nft_set_binding *i;
3748 struct nft_set_iter iter;
3749
273fe3f1
PNA		 3750 if (set->use == UINT_MAX)
3751 return -EOVERFLOW;
3752
408070d6 3753 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3754 return -EBUSY;
3755
11113e19 3756 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3757 /* If the set is already bound to the same chain all
3758 * jumps are already validated for that chain.
3759 */
3760 list_for_each_entry(i, &set->bindings, list) {
a4684402 3761 if (i->flags & NFT_SET_MAP &&
11113e19 3762 i->chain == binding->chain)
20a69341
PM		 3763 goto bind;
3764 }
3765
8588ac09 3766 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3767 iter.skip = 0;
3768 iter.count = 0;
3769 iter.err = 0;
3770 iter.fn = nf_tables_bind_check_setelem;
3771
3772 set->ops->walk(ctx, set, &iter);
a02f4248 3773 if (iter.err < 0)
20a69341 3774 return iter.err;
20a69341
PM		 3775 }
3776bind:
3777 binding->chain = ctx->chain;
e688a7f8 3778 list_add_tail_rcu(&binding->list, &set->bindings);
f6ac8585 3779 nft_set_trans_bind(ctx, set);
273fe3f1 3780 set->use++;
f6ac8585 3781
20a69341
PM		 3782 return 0;
3783}
63aea290 3784EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341 3785
cd5125d8 3786void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
f6ac8585 3787 struct nft_set_binding *binding, bool event)
20a69341 3788{
e688a7f8 3789 list_del_rcu(&binding->list);
20a69341 3790
f6ac8585 3791 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
cd5125d8 3792 list_del_rcu(&set->list);
f6ac8585
PNA		 3793 if (event)
3794 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
3795 GFP_KERNEL);
3796 }
20a69341 3797}
63aea290 3798EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3799
273fe3f1
PNA		 3800void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
3801 struct nft_set_binding *binding,
3802 enum nft_trans_phase phase)
3803{
3804 switch (phase) {
3805 case NFT_TRANS_PREPARE:
3806 set->use--;
3807 return;
3808 case NFT_TRANS_ABORT:
3809 case NFT_TRANS_RELEASE:
3810 set->use--;
3811 /* fall through */
3812 default:
3813 nf_tables_unbind_set(ctx, set, binding,
3814 phase == NFT_TRANS_COMMIT);
3815 }
3816}
3817EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
3818
cd5125d8
FW		 3819void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
3820{
f6ac8585 3821 if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
cd5125d8 3822 nft_set_destroy(set);
cd5125d8
FW		 3823}
3824EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
3825
3ac4c07a
PM		 3826const struct nft_set_ext_type nft_set_ext_types[] = {
3827 [NFT_SET_EXT_KEY] = {
7d740264 3828 .align = __alignof__(u32),
3ac4c07a
PM		 3829 },
3830 [NFT_SET_EXT_DATA] = {
7d740264 3831 .align = __alignof__(u32),
3ac4c07a 3832 },
f25ad2e9
PM		 3833 [NFT_SET_EXT_EXPR] = {
3834 .align = __alignof__(struct nft_expr),
3835 },
8aeff920
PNA		 3836 [NFT_SET_EXT_OBJREF] = {
3837 .len = sizeof(struct nft_object *),
3838 .align = __alignof__(struct nft_object *),
3839 },
3ac4c07a
PM		 3840 [NFT_SET_EXT_FLAGS] = {
3841 .len = sizeof(u8),
3842 .align = __alignof__(u8),
3843 },
c3e1b005
PM		 3844 [NFT_SET_EXT_TIMEOUT] = {
3845 .len = sizeof(u64),
3846 .align = __alignof__(u64),
3847 },
3848 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 3849 .len = sizeof(u64),
3850 .align = __alignof__(u64),
c3e1b005 3851 },
68e942e8
PM		 3852 [NFT_SET_EXT_USERDATA] = {
3853 .len = sizeof(struct nft_userdata),
3854 .align = __alignof__(struct nft_userdata),
3855 },
3ac4c07a
PM		 3856};
3857EXPORT_SYMBOL_GPL(nft_set_ext_types);
3858
20a69341
PM		 3859/*
3860 * Set elements
3861 */
3862
3863static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3864 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3865 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3866 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3867 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3868 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3869 .len = NFT_USERDATA_MAXLEN },
467697d2
FW		 3870 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3871 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
20a69341
PM		 3872};
3873
3874static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3875 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3876 .len = NFT_TABLE_MAXNAMELEN - 1 },
3877 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3878 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3879 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3880 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3881};
3882
633c9a84 3883static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3884 const struct sk_buff *skb,
3885 const struct nlmsghdr *nlh,
f2a6d766 3886 const struct nlattr * const nla[],
36dd1bcc 3887 struct netlink_ext_ack *extack,
f2a6d766 3888 u8 genmask)
20a69341
PM		 3889{
3890 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3891 int family = nfmsg->nfgen_family;
7c95f6d8 3892 struct nft_table *table;
20a69341 3893
cac20fcd
PNA		 3894 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3895 genmask);
36dd1bcc
PNA		 3896 if (IS_ERR(table)) {
3897 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 3898 return PTR_ERR(table);
36dd1bcc 3899 }
20a69341 3900
98319cb9 3901 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3902 return 0;
3903}
3904
3905static int nf_tables_fill_setelem(struct sk_buff *skb,
3906 const struct nft_set *set,
3907 const struct nft_set_elem *elem)
3908{
fe2811eb 3909 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3910 unsigned char *b = skb_tail_pointer(skb);
3911 struct nlattr *nest;
3912
3913 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3914 if (nest == NULL)
3915 goto nla_put_failure;
3916
fe2811eb
PM		 3917 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3918 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3919 goto nla_put_failure;
3920
fe2811eb
PM		 3921 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3922 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3923 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3924 set->dlen) < 0)
3925 goto nla_put_failure;
3926
f25ad2e9
PM		 3927 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3928 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3929 goto nla_put_failure;
3930
8aeff920
PNA		 3931 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3932 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
d152159b 3933 (*nft_set_ext_obj(ext))->key.name) < 0)
8aeff920
PNA		 3934 goto nla_put_failure;
3935
fe2811eb
PM		 3936 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3937 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3938 htonl(*nft_set_ext_flags(ext))))
3939 goto nla_put_failure;
20a69341 3940
c3e1b005
PM		 3941 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3942 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 3943 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 3944 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3945 goto nla_put_failure;
3946
3947 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 3948 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 3949
3950 expires = *nft_set_ext_expiration(ext);
8e1102d5 3951 if (time_before64(now, expires))
c3e1b005
PM		 3952 expires -= now;
3953 else
3954 expires = 0;
3955
3956 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 3957 nf_jiffies64_to_msecs(expires),
b46f6ded 3958 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3959 goto nla_put_failure;
3960 }
3961
68e942e8
PM		 3962 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3963 struct nft_userdata *udata;
3964
3965 udata = nft_set_ext_userdata(ext);
3966 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3967 udata->len + 1, udata->data))
3968 goto nla_put_failure;
3969 }
3970
20a69341
PM		 3971 nla_nest_end(skb, nest);
3972 return 0;
3973
3974nla_put_failure:
3975 nlmsg_trim(skb, b);
3976 return -EMSGSIZE;
3977}
3978
3979struct nft_set_dump_args {
3980 const struct netlink_callback *cb;
3981 struct nft_set_iter iter;
3982 struct sk_buff *skb;
3983};
3984
3985static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3986 struct nft_set *set,
20a69341 3987 const struct nft_set_iter *iter,
de70185d 3988 struct nft_set_elem *elem)
20a69341
PM		 3989{
3990 struct nft_set_dump_args *args;
3991
3992 args = container_of(iter, struct nft_set_dump_args, iter);
3993 return nf_tables_fill_setelem(args->skb, set, elem);
3994}
3995
fa803605
LZ		 3996struct nft_set_dump_ctx {
3997 const struct nft_set *set;
3998 struct nft_ctx ctx;
3999};
4000
20a69341
PM		 4001static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4002{
fa803605 4003 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 4004 struct net *net = sock_net(skb->sk);
fa803605 4005 struct nft_table *table;
de70185d 4006 struct nft_set *set;
20a69341 4007 struct nft_set_dump_args args;
fa803605 4008 bool set_found = false;
20a69341
PM		 4009 struct nfgenmsg *nfmsg;
4010 struct nlmsghdr *nlh;
4011 struct nlattr *nest;
4012 u32 portid, seq;
fa803605 4013 int event;
20a69341 4014
fa803605 4015 rcu_read_lock();
36596dad
PNA		 4016 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4017 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 4018 dump_ctx->ctx.family != table->family)
fa803605 4019 continue;
20a69341 4020
36596dad
PNA		 4021 if (table != dump_ctx->ctx.table)
4022 continue;
20a69341 4023
36596dad
PNA		 4024 list_for_each_entry_rcu(set, &table->sets, list) {
4025 if (set == dump_ctx->set) {
4026 set_found = true;
4027 break;
fa803605 4028 }
fa803605
LZ		 4029 }
4030 break;
4031 }
4032
4033 if (!set_found) {
4034 rcu_read_unlock();
4035 return -ENOENT;
4036 }
20a69341 4037
dedb67c4 4038 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 4039 portid = NETLINK_CB(cb->skb).portid;
4040 seq = cb->nlh->nlmsg_seq;
4041
4042 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4043 NLM_F_MULTI);
4044 if (nlh == NULL)
4045 goto nla_put_failure;
4046
4047 nfmsg = nlmsg_data(nlh);
98319cb9 4048 nfmsg->nfgen_family = table->family;
20a69341 4049 nfmsg->version = NFNETLINK_V0;
fa803605 4050 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 4051
fa803605 4052 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 4053 goto nla_put_failure;
4054 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4055 goto nla_put_failure;
4056
4057 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4058 if (nest == NULL)
4059 goto nla_put_failure;
4060
8588ac09
PNA		 4061 args.cb = cb;
4062 args.skb = skb;
fa803605 4063 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 4064 args.iter.skip = cb->args[0];
4065 args.iter.count = 0;
4066 args.iter.err = 0;
4067 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 4068 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4069 rcu_read_unlock();
20a69341
PM		 4070
4071 nla_nest_end(skb, nest);
4072 nlmsg_end(skb, nlh);
4073
4074 if (args.iter.err && args.iter.err != -EMSGSIZE)
4075 return args.iter.err;
4076 if (args.iter.count == cb->args[0])
4077 return 0;
4078
4079 cb->args[0] = args.iter.count;
4080 return skb->len;
4081
4082nla_put_failure:
fa803605 4083 rcu_read_unlock();
20a69341
PM		 4084 return -ENOSPC;
4085}
4086
90fd131a
FW		 4087static int nf_tables_dump_set_start(struct netlink_callback *cb)
4088{
4089 struct nft_set_dump_ctx *dump_ctx = cb->data;
4090
4091 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4092
4093 return cb->data ? 0 : -ENOMEM;
4094}
4095
fa803605
LZ		 4096static int nf_tables_dump_set_done(struct netlink_callback *cb)
4097{
4098 kfree(cb->data);
4099 return 0;
4100}
4101
d60ce62f
AB		 4102static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4103 const struct nft_ctx *ctx, u32 seq,
4104 u32 portid, int event, u16 flags,
4105 const struct nft_set *set,
4106 const struct nft_set_elem *elem)
4107{
4108 struct nfgenmsg *nfmsg;
4109 struct nlmsghdr *nlh;
4110 struct nlattr *nest;
4111 int err;
4112
dedb67c4 4113 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 4114 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4115 flags);
4116 if (nlh == NULL)
4117 goto nla_put_failure;
4118
4119 nfmsg = nlmsg_data(nlh);
36596dad 4120 nfmsg->nfgen_family = ctx->family;
d60ce62f 4121 nfmsg->version = NFNETLINK_V0;
84d7fce6 4122 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 4123
4124 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4125 goto nla_put_failure;
4126 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4127 goto nla_put_failure;
4128
4129 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4130 if (nest == NULL)
4131 goto nla_put_failure;
4132
4133 err = nf_tables_fill_setelem(skb, set, elem);
4134 if (err < 0)
4135 goto nla_put_failure;
4136
4137 nla_nest_end(skb, nest);
4138
053c095a
JB		 4139 nlmsg_end(skb, nlh);
4140 return 0;
d60ce62f
AB		 4141
4142nla_put_failure:
4143 nlmsg_trim(skb, nlh);
4144 return -1;
4145}
4146
ba0e4d99
PNA		 4147static int nft_setelem_parse_flags(const struct nft_set *set,
4148 const struct nlattr *attr, u32 *flags)
4149{
4150 if (attr == NULL)
4151 return 0;
4152
4153 *flags = ntohl(nla_get_be32(attr));
4154 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4155 return -EINVAL;
4156 if (!(set->flags & NFT_SET_INTERVAL) &&
4157 *flags & NFT_SET_ELEM_INTERVAL_END)
4158 return -EINVAL;
4159
4160 return 0;
4161}
4162
4163static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4164 const struct nlattr *attr)
4165{
4166 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
ba0e4d99
PNA		 4167 struct nft_data_desc desc;
4168 struct nft_set_elem elem;
4169 struct sk_buff *skb;
4170 uint32_t flags = 0;
4171 void *priv;
4172 int err;
4173
4174 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4175 nft_set_elem_policy, NULL);
4176 if (err < 0)
4177 return err;
4178
4179 if (!nla[NFTA_SET_ELEM_KEY])
4180 return -EINVAL;
4181
4182 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4183 if (err < 0)
4184 return err;
4185
4186 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4187 nla[NFTA_SET_ELEM_KEY]);
4188 if (err < 0)
4189 return err;
4190
4191 err = -EINVAL;
4192 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4193 return err;
4194
4195 priv = set->ops->get(ctx->net, set, &elem, flags);
4196 if (IS_ERR(priv))
4197 return PTR_ERR(priv);
4198
4199 elem.priv = priv;
ba0e4d99
PNA		 4200
4201 err = -ENOMEM;
d9adf22a 4202 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
ba0e4d99
PNA		 4203 if (skb == NULL)
4204 goto err1;
4205
4206 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4207 NFT_MSG_NEWSETELEM, 0, set, &elem);
4208 if (err < 0)
4209 goto err2;
4210
4211 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4212 /* This avoids a loop in nfnetlink. */
4213 if (err < 0)
4214 goto err1;
4215
4216 return 0;
4217err2:
4218 kfree_skb(skb);
4219err1:
4220 /* this avoids a loop in nfnetlink. */
4221 return err == -EAGAIN ? -ENOBUFS : err;
4222}
4223
d9adf22a 4224/* called with rcu_read_lock held */
ba0e4d99
PNA		 4225static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4226 struct sk_buff *skb, const struct nlmsghdr *nlh,
4227 const struct nlattr * const nla[],
4228 struct netlink_ext_ack *extack)
4229{
4230 u8 genmask = nft_genmask_cur(net);
4231 struct nft_set *set;
4232 struct nlattr *attr;
4233 struct nft_ctx ctx;
4234 int rem, err = 0;
4235
36dd1bcc
PNA		 4236 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4237 genmask);
ba0e4d99
PNA		 4238 if (err < 0)
4239 return err;
4240
cac20fcd 4241 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 4242 if (IS_ERR(set))
4243 return PTR_ERR(set);
4244
4245 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4246 struct netlink_dump_control c = {
90fd131a 4247 .start = nf_tables_dump_set_start,
ba0e4d99
PNA		 4248 .dump = nf_tables_dump_set,
4249 .done = nf_tables_dump_set_done,
d9adf22a 4250 .module = THIS_MODULE,
ba0e4d99 4251 };
90fd131a
FW		 4252 struct nft_set_dump_ctx dump_ctx = {
4253 .set = set,
4254 .ctx = ctx,
4255 };
ba0e4d99 4256
90fd131a 4257 c.data = &dump_ctx;
d9adf22a 4258 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
ba0e4d99
PNA		 4259 }
4260
4261 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4262 return -EINVAL;
4263
4264 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4265 err = nft_get_set_elem(&ctx, set, attr);
4266 if (err < 0)
4267 break;
4268 }
4269
4270 return err;
4271}
4272
25e94a99
PNA		 4273static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4274 const struct nft_set *set,
4275 const struct nft_set_elem *elem,
4276 int event, u16 flags)
d60ce62f 4277{
128ad332
PNA		 4278 struct net *net = ctx->net;
4279 u32 portid = ctx->portid;
d60ce62f
AB		 4280 struct sk_buff *skb;
4281 int err;
4282
128ad332 4283 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4284 return;
d60ce62f 4285
d60ce62f
AB		 4286 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4287 if (skb == NULL)
4288 goto err;
4289
4290 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4291 set, elem);
4292 if (err < 0) {
4293 kfree_skb(skb);
4294 goto err;
4295 }
4296
25e94a99
PNA		 4297 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4298 GFP_KERNEL);
4299 return;
d60ce62f 4300err:
25e94a99 4301 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 4302}
4303
60319eb1
PNA		 4304static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4305 int msg_type,
4306 struct nft_set *set)
4307{
4308 struct nft_trans *trans;
4309
4310 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4311 if (trans == NULL)
4312 return NULL;
4313
4314 nft_trans_elem_set(trans) = set;
4315 return trans;
4316}
4317
22fe54d5
PM		 4318void *nft_set_elem_init(const struct nft_set *set,
4319 const struct nft_set_ext_tmpl *tmpl,
49499c3e 4320 const u32 *key, const u32 *data,
22fe54d5 4321 u64 timeout, gfp_t gfp)
fe2811eb
PM		 4322{
4323 struct nft_set_ext *ext;
4324 void *elem;
4325
4326 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4327 if (elem == NULL)
4328 return NULL;
4329
4330 ext = nft_set_elem_ext(set, elem);
4331 nft_set_ext_init(ext, tmpl);
4332
4333 memcpy(nft_set_ext_key(ext), key, set->klen);
4334 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4335 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 4336 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
4337 *nft_set_ext_expiration(ext) =
8e1102d5 4338 get_jiffies_64() + timeout;
c3e1b005
PM		 4339 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4340 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 4341
4342 return elem;
4343}
4344
61f9e292
LZ		 4345void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4346 bool destroy_expr)
61edafbb
PM		 4347{
4348 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3453c927
PNA		 4349 struct nft_ctx ctx = {
4350 .net = read_pnet(&set->net),
4351 .family = set->table->family,
4352 };
61edafbb 4353
59105446 4354 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 4355 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 4356 nft_data_release(nft_set_ext_data(ext), set->dtype);
371ebcbb
PNA		 4357 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4358 struct nft_expr *expr = nft_set_ext_expr(ext);
4359
4360 if (expr->ops->destroy_clone) {
4361 expr->ops->destroy_clone(&ctx, expr);
4362 module_put(expr->ops->type->owner);
4363 } else {
4364 nf_tables_expr_destroy(&ctx, expr);
4365 }
4366 }
8aeff920
PNA		 4367 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4368 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 4369 kfree(elem);
4370}
4371EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4372
59105446
PNA		 4373/* Only called from commit path, nft_set_elem_deactivate() already deals with
4374 * the refcounting from the preparation phase.
4375 */
3453c927
PNA		 4376static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4377 const struct nft_set *set, void *elem)
59105446
PNA		 4378{
4379 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4380
4381 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3453c927 4382 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
59105446
PNA		 4383 kfree(elem);
4384}
4385
60319eb1 4386static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 4387 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 4388{
4389 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 4390 u8 genmask = nft_genmask_next(ctx->net);
20a69341 4391 struct nft_data_desc d1, d2;
fe2811eb 4392 struct nft_set_ext_tmpl tmpl;
c016c7e4 4393 struct nft_set_ext *ext, *ext2;
20a69341
PM		 4394 struct nft_set_elem elem;
4395 struct nft_set_binding *binding;
8aeff920 4396 struct nft_object *obj = NULL;
68e942e8 4397 struct nft_userdata *udata;
fe2811eb 4398 struct nft_data data;
20a69341 4399 enum nft_registers dreg;
60319eb1 4400 struct nft_trans *trans;
0e9091d6 4401 u32 flags = 0;
c3e1b005 4402 u64 timeout;
68e942e8 4403 u8 ulen;
20a69341
PM		 4404 int err;
4405
4406 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4407 nft_set_elem_policy, NULL);
20a69341
PM		 4408 if (err < 0)
4409 return err;
4410
4411 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4412 return -EINVAL;
4413
fe2811eb
PM		 4414 nft_set_ext_prepare(&tmpl);
4415
0e9091d6
PNA		 4416 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4417 if (err < 0)
4418 return err;
4419 if (flags != 0)
4420 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 4421
4422 if (set->flags & NFT_SET_MAP) {
4423 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 4424 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 4425 return -EINVAL;
bd7fc645 4426 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 4427 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 4428 return -EINVAL;
20a69341
PM		 4429 } else {
4430 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4431 return -EINVAL;
4432 }
4433
c3e1b005
PM		 4434 timeout = 0;
4435 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4436 if (!(set->flags & NFT_SET_TIMEOUT))
4437 return -EINVAL;
8e1102d5
FW		 4438 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4439 &timeout);
4440 if (err)
4441 return err;
c3e1b005
PM		 4442 } else if (set->flags & NFT_SET_TIMEOUT) {
4443 timeout = set->timeout;
4444 }
4445
7d740264 4446 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 4447 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4448 if (err < 0)
4449 goto err1;
4450 err = -EINVAL;
4451 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4452 goto err2;
4453
7d740264 4454 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 4455 if (timeout > 0) {
4456 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4457 if (timeout != set->timeout)
4458 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4459 }
fe2811eb 4460
8aeff920
PNA		 4461 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4462 if (!(set->flags & NFT_SET_OBJECT)) {
4463 err = -EINVAL;
4464 goto err2;
4465 }
4d44175a
FW		 4466 obj = nft_obj_lookup(ctx->net, ctx->table,
4467 nla[NFTA_SET_ELEM_OBJREF],
cac20fcd 4468 set->objtype, genmask);
8aeff920
PNA		 4469 if (IS_ERR(obj)) {
4470 err = PTR_ERR(obj);
4471 goto err2;
4472 }
4473 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4474 }
4475
20a69341 4476 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 4477 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4478 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 4479 if (err < 0)
4480 goto err2;
4481
4482 err = -EINVAL;
4483 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4484 goto err3;
4485
4486 dreg = nft_type_to_reg(set->dtype);
4487 list_for_each_entry(binding, &set->bindings, list) {
4488 struct nft_ctx bind_ctx = {
58c78e10 4489 .net = ctx->net,
36596dad 4490 .family = ctx->family,
20a69341 4491 .table = ctx->table,
7c95f6d8 4492 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4493 };
4494
11113e19
PM		 4495 if (!(binding->flags & NFT_SET_MAP))
4496 continue;
4497
1ec10212
PM		 4498 err = nft_validate_register_store(&bind_ctx, dreg,
4499 &data,
4500 d2.type, d2.len);
20a69341
PM		 4501 if (err < 0)
4502 goto err3;
a654de8f
PNA		 4503
4504 if (d2.type == NFT_DATA_VERDICT &&
4505 (data.verdict.code == NFT_GOTO ||
4506 data.verdict.code == NFT_JUMP))
4507 nft_validate_state_update(ctx->net,
4508 NFT_VALIDATE_NEED);
20a69341 4509 }
fe2811eb 4510
7d740264 4511 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4512 }
4513
68e942e8
PM		 4514 /* The full maximum length of userdata can exceed the maximum
4515 * offset value (U8_MAX) for following extensions, therefor it
4516 * must be the last extension added.
4517 */
4518 ulen = 0;
4519 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4520 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4521 if (ulen > 0)
4522 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4523 ulen);
4524 }
4525
fe2811eb 4526 err = -ENOMEM;
7d740264 4527 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 4528 timeout, GFP_KERNEL);
fe2811eb
PM		 4529 if (elem.priv == NULL)
4530 goto err3;
4531
4532 ext = nft_set_elem_ext(set, elem.priv);
4533 if (flags)
4534 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4535 if (ulen > 0) {
4536 udata = nft_set_ext_userdata(ext);
4537 udata->len = ulen - 1;
4538 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4539 }
8aeff920
PNA		 4540 if (obj) {
4541 *nft_set_ext_obj(ext) = obj;
4542 obj->use++;
4543 }
fe2811eb 4544
60319eb1
PNA		 4545 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4546 if (trans == NULL)
fe2811eb 4547 goto err4;
60319eb1 4548
69086658 4549 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4550 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4551 if (err) {
4552 if (err == -EEXIST) {
9744a6fc
PNA		 4553 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4554 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4555 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
f0dfd7a2
CIK		 4556 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4557 err = -EBUSY;
4558 goto err5;
4559 }
8aeff920
PNA		 4560 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4561 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4562 memcmp(nft_set_ext_data(ext),
4563 nft_set_ext_data(ext2), set->dlen) != 0) ||
4564 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4565 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4566 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4567 err = -EBUSY;
4568 else if (!(nlmsg_flags & NLM_F_EXCL))
4569 err = 0;
4570 }
fe2811eb 4571 goto err5;
c016c7e4 4572 }
20a69341 4573
35d0ac90
PNA		 4574 if (set->size &&
4575 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4576 err = -ENFILE;
4577 goto err6;
4578 }
4579
60319eb1 4580 nft_trans_elem(trans) = elem;
46bbafce 4581 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4582 return 0;
4583
35d0ac90 4584err6:
5cb82a38 4585 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4586err5:
60319eb1 4587 kfree(trans);
fe2811eb 4588err4:
b91d9036
TY		 4589 if (obj)
4590 obj->use--;
fe2811eb 4591 kfree(elem.priv);
20a69341
PM		 4592err3:
4593 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4594 nft_data_release(&data, d2.type);
20a69341 4595err2:
59105446 4596 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4597err1:
4598 return err;
4599}
4600
633c9a84
PNA		 4601static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4602 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4603 const struct nlattr * const nla[],
4604 struct netlink_ext_ack *extack)
20a69341 4605{
f2a6d766 4606 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4607 const struct nlattr *attr;
4608 struct nft_set *set;
4609 struct nft_ctx ctx;
a654de8f 4610 int rem, err;
20a69341 4611
7d5570ca
PNA		 4612 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4613 return -EINVAL;
4614
36dd1bcc
PNA		 4615 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4616 genmask);
20a69341
PM		 4617 if (err < 0)
4618 return err;
4619
a3073c17
PNA		 4620 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4621 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4622 if (IS_ERR(set))
4623 return PTR_ERR(set);
958bee14 4624
20a69341
PM		 4625 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4626 return -EBUSY;
4627
4628 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4629 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4630 if (err < 0)
a654de8f 4631 return err;
20a69341 4632 }
a654de8f
PNA		 4633
4634 if (net->nft.validate_state == NFT_VALIDATE_DO)
4635 return nft_table_validate(net, ctx.table);
4636
4637 return 0;
20a69341
PM		 4638}
4639
59105446
PNA		 4640/**
4641 * nft_data_hold - hold a nft_data item
4642 *
4643 * @data: struct nft_data to release
4644 * @type: type of data
4645 *
4646 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4647 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4648 * NFT_GOTO verdicts. This function must be called on active data objects
4649 * from the second phase of the commit protocol.
4650 */
bb7b40ae 4651void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
59105446
PNA		 4652{
4653 if (type == NFT_DATA_VERDICT) {
4654 switch (data->verdict.code) {
4655 case NFT_JUMP:
4656 case NFT_GOTO:
4657 data->verdict.chain->use++;
4658 break;
4659 }
4660 }
4661}
4662
4663static void nft_set_elem_activate(const struct net *net,
4664 const struct nft_set *set,
4665 struct nft_set_elem *elem)
4666{
4667 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4668
4669 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4670 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4671 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4672 (*nft_set_ext_obj(ext))->use++;
4673}
4674
4675static void nft_set_elem_deactivate(const struct net *net,
4676 const struct nft_set *set,
4677 struct nft_set_elem *elem)
4678{
4679 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4680
4681 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4682 nft_data_release(nft_set_ext_data(ext), set->dtype);
4683 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4684 (*nft_set_ext_obj(ext))->use--;
4685}
4686
60319eb1 4687static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4688 const struct nlattr *attr)
4689{
4690 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4691 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4692 struct nft_data_desc desc;
4693 struct nft_set_elem elem;
3971ca14 4694 struct nft_set_ext *ext;
60319eb1 4695 struct nft_trans *trans;
3971ca14
PNA		 4696 u32 flags = 0;
4697 void *priv;
20a69341
PM		 4698 int err;
4699
4700 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4701 nft_set_elem_policy, NULL);
20a69341
PM		 4702 if (err < 0)
4703 goto err1;
4704
4705 err = -EINVAL;
4706 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4707 goto err1;
4708
3971ca14
PNA		 4709 nft_set_ext_prepare(&tmpl);
4710
4711 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4712 if (err < 0)
4713 return err;
4714 if (flags != 0)
4715 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4716
7d740264 4717 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4718 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4719 if (err < 0)
4720 goto err1;
4721
4722 err = -EINVAL;
4723 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4724 goto err2;
4725
3971ca14
PNA		 4726 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4727
4728 err = -ENOMEM;
4729 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4730 GFP_KERNEL);
4731 if (elem.priv == NULL)
4732 goto err2;
4733
4734 ext = nft_set_elem_ext(set, elem.priv);
4735 if (flags)
4736 *nft_set_ext_flags(ext) = flags;
4737
60319eb1 4738 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4739 if (trans == NULL) {
4740 err = -ENOMEM;
3971ca14 4741 goto err3;
609ccf08 4742 }
20a69341 4743
42a55769 4744 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4745 if (priv == NULL) {
cc02e457 4746 err = -ENOENT;
3971ca14 4747 goto err4;
cc02e457 4748 }
3971ca14
PNA		 4749 kfree(elem.priv);
4750 elem.priv = priv;
cc02e457 4751
59105446
PNA		 4752 nft_set_elem_deactivate(ctx->net, set, &elem);
4753
60319eb1 4754 nft_trans_elem(trans) = elem;
46bbafce 4755 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4756 return 0;
cc02e457 4757
3971ca14 4758err4:
cc02e457 4759 kfree(trans);
3971ca14
PNA		 4760err3:
4761 kfree(elem.priv);
20a69341 4762err2:
59105446 4763 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4764err1:
4765 return err;
4766}
4767
8411b644 4768static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4769 struct nft_set *set,
8411b644 4770 const struct nft_set_iter *iter,
de70185d 4771 struct nft_set_elem *elem)
8411b644
PNA		 4772{
4773 struct nft_trans *trans;
4774 int err;
4775
4776 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4777 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4778 if (!trans)
4779 return -ENOMEM;
4780
1ba1c414 4781 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4782 err = -ENOENT;
4783 goto err1;
4784 }
b2c11e4b 4785 set->ndeact++;
8411b644 4786
7acfda53 4787 nft_set_elem_deactivate(ctx->net, set, elem);
de70185d
PNA		 4788 nft_trans_elem_set(trans) = set;
4789 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4790 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4791
4792 return 0;
4793err1:
4794 kfree(trans);
4795 return err;
4796}
4797
633c9a84
PNA		 4798static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4799 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4800 const struct nlattr * const nla[],
4801 struct netlink_ext_ack *extack)
20a69341 4802{
f2a6d766 4803 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4804 const struct nlattr *attr;
4805 struct nft_set *set;
4806 struct nft_ctx ctx;
60319eb1 4807 int rem, err = 0;
20a69341 4808
36dd1bcc
PNA		 4809 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4810 genmask);
20a69341
PM		 4811 if (err < 0)
4812 return err;
4813
cac20fcd 4814 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 4815 if (IS_ERR(set))
4816 return PTR_ERR(set);
4817 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4818 return -EBUSY;
4819
8411b644 4820 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4821 struct nft_set_iter iter = {
4822 .genmask = genmask,
4823 .fn = nft_flush_set,
8411b644 4824 };
baa2d42c 4825 set->ops->walk(&ctx, set, &iter);
8411b644 4826
baa2d42c 4827 return iter.err;
8411b644
PNA		 4828 }
4829
20a69341
PM		 4830 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4831 err = nft_del_setelem(&ctx, set, attr);
4832 if (err < 0)
60319eb1 4833 break;
4fefee57 4834
3dd0673a 4835 set->ndeact++;
20a69341 4836 }
60319eb1 4837 return err;
20a69341
PM		 4838}
4839
cfed7e1b
PM		 4840void nft_set_gc_batch_release(struct rcu_head *rcu)
4841{
4842 struct nft_set_gc_batch *gcb;
4843 unsigned int i;
4844
4845 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4846 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4847 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4848 kfree(gcb);
4849}
4850EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4851
4852struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4853 gfp_t gfp)
4854{
4855 struct nft_set_gc_batch *gcb;
4856
4857 gcb = kzalloc(sizeof(*gcb), gfp);
4858 if (gcb == NULL)
4859 return gcb;
4860 gcb->head.set = set;
4861 return gcb;
4862}
4863EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4864
e5009240
PNA		 4865/*
4866 * Stateful objects
4867 */
4868
4869/**
4870 * nft_register_obj- register nf_tables stateful object type
4871 * @obj: object type
4872 *
4873 * Registers the object type for use with nf_tables. Returns zero on
4874 * success or a negative errno code otherwise.
4875 */
4876int nft_register_obj(struct nft_object_type *obj_type)
4877{
4878 if (obj_type->type == NFT_OBJECT_UNSPEC)
4879 return -EINVAL;
4880
4881 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4882 list_add_rcu(&obj_type->list, &nf_tables_objects);
4883 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4884 return 0;
4885}
4886EXPORT_SYMBOL_GPL(nft_register_obj);
4887
4888/**
4889 * nft_unregister_obj - unregister nf_tables object type
4890 * @obj: object type
4891 *
4892 * Unregisters the object type for use with nf_tables.
4893 */
4894void nft_unregister_obj(struct nft_object_type *obj_type)
4895{
4896 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4897 list_del_rcu(&obj_type->list);
4898 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4899}
4900EXPORT_SYMBOL_GPL(nft_unregister_obj);
4901
4d44175a
FW		 4902struct nft_object *nft_obj_lookup(const struct net *net,
4903 const struct nft_table *table,
cac20fcd
PNA		 4904 const struct nlattr *nla, u32 objtype,
4905 u8 genmask)
e5009240 4906{
4d44175a
FW		 4907 struct nft_object_hash_key k = { .table = table };
4908 char search[NFT_OBJ_MAXNAMELEN];
4909 struct rhlist_head *tmp, *list;
e5009240
PNA		 4910 struct nft_object *obj;
4911
4d44175a
FW		 4912 nla_strlcpy(search, nla, sizeof(search));
4913 k.name = search;
4914
4915 WARN_ON_ONCE(!rcu_read_lock_held() &&
4916 !lockdep_commit_lock_is_held(net));
4917
4918 rcu_read_lock();
4919 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
4920 if (!list)
4921 goto out;
4922
4923 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
4924 if (objtype == obj->ops->type->type &&
4925 nft_active_genmask(obj, genmask)) {
4926 rcu_read_unlock();
e5009240 4927 return obj;
4d44175a 4928 }
e5009240 4929 }
4d44175a
FW		 4930out:
4931 rcu_read_unlock();
e5009240
PNA		 4932 return ERR_PTR(-ENOENT);
4933}
cac20fcd 4934EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 4935
cac20fcd
PNA		 4936static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4937 const struct nlattr *nla,
4938 u32 objtype, u8 genmask)
3ecbfd65
HS		 4939{
4940 struct nft_object *obj;
4941
4942 list_for_each_entry(obj, &table->objects, list) {
4943 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4944 objtype == obj->ops->type->type &&
4945 nft_active_genmask(obj, genmask))
4946 return obj;
4947 }
4948 return ERR_PTR(-ENOENT);
4949}
4950
e5009240 4951static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4952 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4953 .len = NFT_TABLE_MAXNAMELEN - 1 },
4954 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4955 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4956 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4957 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 4958 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 4959};
4960
84fba055
FW		 4961static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4962 const struct nft_object_type *type,
e5009240
PNA		 4963 const struct nlattr *attr)
4964{
5b4c6e38 4965 struct nlattr **tb;
dfc46034 4966 const struct nft_object_ops *ops;
e5009240 4967 struct nft_object *obj;
5b4c6e38
GS		 4968 int err = -ENOMEM;
4969
4970 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4971 if (!tb)
4972 goto err1;
e5009240
PNA		 4973
4974 if (attr) {
fceb6435
JB		 4975 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4976 NULL);
e5009240 4977 if (err < 0)
5b4c6e38 4978 goto err2;
e5009240
PNA		 4979 } else {
4980 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4981 }
4982
dfc46034
PBG		 4983 if (type->select_ops) {
4984 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4985 if (IS_ERR(ops)) {
4986 err = PTR_ERR(ops);
5b4c6e38 4987 goto err2;
dfc46034
PBG		 4988 }
4989 } else {
4990 ops = type->ops;
4991 }
4992
e5009240 4993 err = -ENOMEM;
dfc46034 4994 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 4995 if (!obj)
4996 goto err2;
e5009240 4997
dfc46034 4998 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 4999 if (err < 0)
5b4c6e38 5000 goto err3;
e5009240 5001
dfc46034
PBG		 5002 obj->ops = ops;
5003
5b4c6e38 5004 kfree(tb);
e5009240 5005 return obj;
5b4c6e38 5006err3:
e5009240 5007 kfree(obj);
5b4c6e38
GS		 5008err2:
5009 kfree(tb);
e5009240
PNA		 5010err1:
5011 return ERR_PTR(err);
5012}
5013
5014static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 5015 struct nft_object *obj, bool reset)
e5009240
PNA		 5016{
5017 struct nlattr *nest;
5018
5019 nest = nla_nest_start(skb, attr);
5020 if (!nest)
5021 goto nla_put_failure;
dfc46034 5022 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 5023 goto nla_put_failure;
5024 nla_nest_end(skb, nest);
5025 return 0;
5026
5027nla_put_failure:
5028 return -1;
5029}
5030
5031static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5032{
5033 const struct nft_object_type *type;
5034
5035 list_for_each_entry(type, &nf_tables_objects, list) {
5036 if (objtype == type->type)
5037 return type;
5038 }
5039 return NULL;
5040}
5041
452238e8
FW		 5042static const struct nft_object_type *
5043nft_obj_type_get(struct net *net, u32 objtype)
e5009240
PNA		 5044{
5045 const struct nft_object_type *type;
5046
5047 type = __nft_obj_type_get(objtype);
5048 if (type != NULL && try_module_get(type->owner))
5049 return type;
5050
f102d66b 5051 lockdep_nfnl_nft_mutex_not_held();
e5009240
PNA		 5052#ifdef CONFIG_MODULES
5053 if (type == NULL) {
452238e8 5054 nft_request_module(net, "nft-obj-%u", objtype);
e5009240
PNA		 5055 if (__nft_obj_type_get(objtype))
5056 return ERR_PTR(-EAGAIN);
5057 }
5058#endif
5059 return ERR_PTR(-ENOENT);
5060}
5061
5062static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5063 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5064 const struct nlattr * const nla[],
5065 struct netlink_ext_ack *extack)
e5009240
PNA		 5066{
5067 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5068 const struct nft_object_type *type;
5069 u8 genmask = nft_genmask_next(net);
5070 int family = nfmsg->nfgen_family;
e5009240
PNA		 5071 struct nft_table *table;
5072 struct nft_object *obj;
5073 struct nft_ctx ctx;
5074 u32 objtype;
5075 int err;
5076
5077 if (!nla[NFTA_OBJ_TYPE] ||
5078 !nla[NFTA_OBJ_NAME] ||
5079 !nla[NFTA_OBJ_DATA])
5080 return -EINVAL;
5081
cac20fcd 5082 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5083 if (IS_ERR(table)) {
5084 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5085 return PTR_ERR(table);
36dd1bcc 5086 }
e5009240
PNA		 5087
5088 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5089 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 5090 if (IS_ERR(obj)) {
5091 err = PTR_ERR(obj);
36dd1bcc
PNA		 5092 if (err != -ENOENT) {
5093 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5094 return err;
36dd1bcc 5095 }
1a28ad74 5096 } else {
36dd1bcc
PNA		 5097 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5098 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5099 return -EEXIST;
36dd1bcc 5100 }
e5009240
PNA		 5101 return 0;
5102 }
5103
98319cb9 5104 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240 5105
452238e8 5106 type = nft_obj_type_get(net, objtype);
e5009240
PNA		 5107 if (IS_ERR(type))
5108 return PTR_ERR(type);
5109
84fba055 5110 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 5111 if (IS_ERR(obj)) {
5112 err = PTR_ERR(obj);
5113 goto err1;
5114 }
d152159b 5115 obj->key.table = table;
3ecbfd65
HS		 5116 obj->handle = nf_tables_alloc_handle(table);
5117
d152159b
FW		 5118 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5119 if (!obj->key.name) {
61509575
PS		 5120 err = -ENOMEM;
5121 goto err2;
5122 }
e5009240
PNA		 5123
5124 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5125 if (err < 0)
61509575 5126 goto err3;
e5009240 5127
4d44175a
FW		 5128 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
5129 nft_objname_ht_params);
5130 if (err < 0)
5131 goto err4;
5132
e5009240
PNA		 5133 list_add_tail_rcu(&obj->list, &table->objects);
5134 table->use++;
5135 return 0;
4d44175a
FW		 5136err4:
5137 /* queued in transaction log */
5138 INIT_LIST_HEAD(&obj->list);
5139 return err;
61509575 5140err3:
d152159b 5141 kfree(obj->key.name);
e5009240 5142err2:
dfc46034 5143 if (obj->ops->destroy)
00bfb320 5144 obj->ops->destroy(&ctx, obj);
e5009240
PNA		 5145 kfree(obj);
5146err1:
5147 module_put(type->owner);
5148 return err;
5149}
5150
5151static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5152 u32 portid, u32 seq, int event, u32 flags,
5153 int family, const struct nft_table *table,
43da04a5 5154 struct nft_object *obj, bool reset)
e5009240
PNA		 5155{
5156 struct nfgenmsg *nfmsg;
5157 struct nlmsghdr *nlh;
5158
dedb67c4 5159 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 5160 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5161 if (nlh == NULL)
5162 goto nla_put_failure;
5163
5164 nfmsg = nlmsg_data(nlh);
5165 nfmsg->nfgen_family = family;
5166 nfmsg->version = NFNETLINK_V0;
5167 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5168
5169 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
d152159b 5170 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
dfc46034 5171 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 5172 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 5173 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5174 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5175 NFTA_OBJ_PAD))
e5009240
PNA		 5176 goto nla_put_failure;
5177
5178 nlmsg_end(skb, nlh);
5179 return 0;
5180
5181nla_put_failure:
5182 nlmsg_trim(skb, nlh);
5183 return -1;
5184}
5185
a9fea2a3 5186struct nft_obj_filter {
e46abbcc 5187 char *table;
a9fea2a3
PNA		 5188 u32 type;
5189};
5190
e5009240
PNA		 5191static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
5192{
5193 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 5194 const struct nft_table *table;
e5009240 5195 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 5196 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 5197 struct net *net = sock_net(skb->sk);
5198 int family = nfmsg->nfgen_family;
43da04a5
PNA		 5199 struct nft_object *obj;
5200 bool reset = false;
5201
5202 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5203 reset = true;
e5009240
PNA		 5204
5205 rcu_read_lock();
5206 cb->seq = net->nft.base_seq;
5207
36596dad 5208 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5209 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 5210 continue;
5211
36596dad
PNA		 5212 list_for_each_entry_rcu(obj, &table->objects, list) {
5213 if (!nft_is_active(net, obj))
5214 goto cont;
5215 if (idx < s_idx)
5216 goto cont;
5217 if (idx > s_idx)
5218 memset(&cb->args[1], 0,
5219 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5220 if (filter && filter->table &&
36596dad
PNA		 5221 strcmp(filter->table, table->name))
5222 goto cont;
5223 if (filter &&
5224 filter->type != NFT_OBJECT_UNSPEC &&
5225 obj->ops->type->type != filter->type)
5226 goto cont;
a9fea2a3 5227
36596dad
PNA		 5228 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
5229 cb->nlh->nlmsg_seq,
5230 NFT_MSG_NEWOBJ,
5231 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5232 table->family, table,
36596dad
PNA		 5233 obj, reset) < 0)
5234 goto done;
e5009240 5235
36596dad 5236 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 5237cont:
36596dad 5238 idx++;
e5009240
PNA		 5239 }
5240 }
5241done:
5242 rcu_read_unlock();
5243
5244 cb->args[0] = idx;
5245 return skb->len;
5246}
5247
90fd131a 5248static int nf_tables_dump_obj_start(struct netlink_callback *cb)
a9fea2a3 5249{
90fd131a
FW		 5250 const struct nlattr * const *nla = cb->data;
5251 struct nft_obj_filter *filter = NULL;
e46abbcc 5252
90fd131a
FW		 5253 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
5254 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5255 if (!filter)
5256 return -ENOMEM;
5257
5258 if (nla[NFTA_OBJ_TABLE]) {
5259 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
5260 if (!filter->table) {
5261 kfree(filter);
5262 return -ENOMEM;
5263 }
5264 }
5265
5266 if (nla[NFTA_OBJ_TYPE])
5267 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
8bea728d 5268 }
a9fea2a3 5269
90fd131a 5270 cb->data = filter;
a9fea2a3
PNA		 5271 return 0;
5272}
5273
90fd131a 5274static int nf_tables_dump_obj_done(struct netlink_callback *cb)
a9fea2a3 5275{
90fd131a 5276 struct nft_obj_filter *filter = cb->data;
a9fea2a3 5277
90fd131a
FW		 5278 if (filter) {
5279 kfree(filter->table);
5280 kfree(filter);
e46abbcc 5281 }
a9fea2a3 5282
90fd131a 5283 return 0;
a9fea2a3
PNA		 5284}
5285
d9adf22a 5286/* called with rcu_read_lock held */
e5009240
PNA		 5287static int nf_tables_getobj(struct net *net, struct sock *nlsk,
5288 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5289 const struct nlattr * const nla[],
5290 struct netlink_ext_ack *extack)
e5009240
PNA		 5291{
5292 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5293 u8 genmask = nft_genmask_cur(net);
5294 int family = nfmsg->nfgen_family;
e5009240
PNA		 5295 const struct nft_table *table;
5296 struct nft_object *obj;
5297 struct sk_buff *skb2;
43da04a5 5298 bool reset = false;
e5009240
PNA		 5299 u32 objtype;
5300 int err;
5301
5302 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5303 struct netlink_dump_control c = {
90fd131a 5304 .start = nf_tables_dump_obj_start,
e5009240 5305 .dump = nf_tables_dump_obj,
a9fea2a3 5306 .done = nf_tables_dump_obj_done,
d9adf22a 5307 .module = THIS_MODULE,
90fd131a 5308 .data = (void *)nla,
e5009240 5309 };
a9fea2a3 5310
d9adf22a 5311 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
e5009240
PNA		 5312 }
5313
5314 if (!nla[NFTA_OBJ_NAME] ||
5315 !nla[NFTA_OBJ_TYPE])
5316 return -EINVAL;
5317
cac20fcd 5318 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5319 if (IS_ERR(table)) {
5320 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5321 return PTR_ERR(table);
36dd1bcc 5322 }
e5009240
PNA		 5323
5324 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5325 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 5326 if (IS_ERR(obj)) {
5327 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5328 return PTR_ERR(obj);
36dd1bcc 5329 }
e5009240 5330
d9adf22a 5331 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
e5009240
PNA		 5332 if (!skb2)
5333 return -ENOMEM;
5334
43da04a5
PNA		 5335 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5336 reset = true;
5337
e5009240
PNA		 5338 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5339 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 5340 family, table, obj, reset);
e5009240
PNA		 5341 if (err < 0)
5342 goto err;
5343
5344 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5345err:
5346 kfree_skb(skb2);
5347 return err;
e5009240
PNA		 5348}
5349
00bfb320 5350static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
e5009240 5351{
dfc46034 5352 if (obj->ops->destroy)
00bfb320 5353 obj->ops->destroy(ctx, obj);
e5009240 5354
dfc46034 5355 module_put(obj->ops->type->owner);
d152159b 5356 kfree(obj->key.name);
e5009240
PNA		 5357 kfree(obj);
5358}
5359
5360static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 5361 struct sk_buff *skb, const struct nlmsghdr *nlh,
5362 const struct nlattr * const nla[],
5363 struct netlink_ext_ack *extack)
e5009240
PNA		 5364{
5365 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5366 u8 genmask = nft_genmask_next(net);
5367 int family = nfmsg->nfgen_family;
36dd1bcc 5368 const struct nlattr *attr;
e5009240
PNA		 5369 struct nft_table *table;
5370 struct nft_object *obj;
5371 struct nft_ctx ctx;
5372 u32 objtype;
5373
5374 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 5375 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 5376 return -EINVAL;
5377
cac20fcd 5378 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5379 if (IS_ERR(table)) {
5380 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5381 return PTR_ERR(table);
36dd1bcc 5382 }
e5009240
PNA		 5383
5384 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 5385 if (nla[NFTA_OBJ_HANDLE]) {
5386 attr = nla[NFTA_OBJ_HANDLE];
5387 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5388 } else {
5389 attr = nla[NFTA_OBJ_NAME];
4d44175a 5390 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
36dd1bcc
PNA		 5391 }
5392
5393 if (IS_ERR(obj)) {
5394 NL_SET_BAD_ATTR(extack, attr);
e5009240 5395 return PTR_ERR(obj);
36dd1bcc
PNA		 5396 }
5397 if (obj->use > 0) {
5398 NL_SET_BAD_ATTR(extack, attr);
e5009240 5399 return -EBUSY;
36dd1bcc 5400 }
e5009240 5401
98319cb9 5402 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 5403
5404 return nft_delobj(&ctx, obj);
5405}
5406
d152159b 5407void nft_obj_notify(struct net *net, const struct nft_table *table,
25e94a99
PNA		 5408 struct nft_object *obj, u32 portid, u32 seq, int event,
5409 int family, int report, gfp_t gfp)
e5009240
PNA		 5410{
5411 struct sk_buff *skb;
5412 int err;
5413
2599e989
PNA		 5414 if (!report &&
5415 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5416 return;
e5009240 5417
2599e989 5418 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 5419 if (skb == NULL)
5420 goto err;
5421
2599e989
PNA		 5422 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5423 table, obj, false);
e5009240
PNA		 5424 if (err < 0) {
5425 kfree_skb(skb);
5426 goto err;
5427 }
5428
25e94a99
PNA		 5429 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5430 return;
e5009240 5431err:
25e94a99 5432 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 5433}
2599e989
PNA		 5434EXPORT_SYMBOL_GPL(nft_obj_notify);
5435
25e94a99
PNA		 5436static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5437 struct nft_object *obj, int event)
2599e989 5438{
25e94a99 5439 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 5440 ctx->family, ctx->report, GFP_KERNEL);
2599e989 5441}
e5009240 5442
3b49e2e9
PNA		 5443/*
5444 * Flow tables
5445 */
5446void nft_register_flowtable_type(struct nf_flowtable_type *type)
5447{
5448 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5449 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5450 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5451}
5452EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5453
5454void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5455{
5456 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5457 list_del_rcu(&type->list);
5458 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5459}
5460EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5461
5462static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5463 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
5464 .len = NFT_NAME_MAXLEN - 1 },
5465 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
5466 .len = NFT_NAME_MAXLEN - 1 },
5467 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 5468 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
3b49e2e9
PNA		 5469};
5470
cac20fcd
PNA		 5471struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5472 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 5473{
5474 struct nft_flowtable *flowtable;
5475
d9adf22a 5476 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
3b49e2e9
PNA		 5477 if (!nla_strcmp(nla, flowtable->name) &&
5478 nft_active_genmask(flowtable, genmask))
5479 return flowtable;
5480 }
5481 return ERR_PTR(-ENOENT);
5482}
cac20fcd 5483EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 5484
ae0662f8 5485static struct nft_flowtable *
cac20fcd
PNA		 5486nft_flowtable_lookup_byhandle(const struct nft_table *table,
5487 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 5488{
5489 struct nft_flowtable *flowtable;
5490
5491 list_for_each_entry(flowtable, &table->flowtables, list) {
5492 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5493 nft_active_genmask(flowtable, genmask))
5494 return flowtable;
5495 }
5496 return ERR_PTR(-ENOENT);
5497}
5498
3b49e2e9
PNA		 5499static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5500 const struct nlattr *attr,
5501 struct net_device *dev_array[], int *len)
5502{
5503 const struct nlattr *tmp;
5504 struct net_device *dev;
5505 char ifname[IFNAMSIZ];
5506 int rem, n = 0, err;
5507
5508 nla_for_each_nested(tmp, attr, rem) {
5509 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5510 err = -EINVAL;
5511 goto err1;
5512 }
5513
5514 nla_strlcpy(ifname, tmp, IFNAMSIZ);
90d2723c 5515 dev = __dev_get_by_name(ctx->net, ifname);
3b49e2e9
PNA		 5516 if (!dev) {
5517 err = -ENOENT;
5518 goto err1;
5519 }
5520
5521 dev_array[n++] = dev;
5522 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5523 err = -EFBIG;
5524 goto err1;
5525 }
5526 }
5527 if (!len)
5528 return -EINVAL;
5529
5530 err = 0;
5531err1:
5532 *len = n;
5533 return err;
5534}
5535
5536static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5537 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5538 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5539 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5540};
5541
5542static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5543 const struct nlattr *attr,
5544 struct nft_flowtable *flowtable)
5545{
5546 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5547 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5548 struct nf_hook_ops *ops;
5549 int hooknum, priority;
5550 int err, n = 0, i;
5551
5552 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5553 nft_flowtable_hook_policy, NULL);
5554 if (err < 0)
5555 return err;
5556
5557 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5558 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5559 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5560 return -EINVAL;
5561
5562 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 5563 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 5564 return -EINVAL;
5565
5566 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5567
5568 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5569 dev_array, &n);
5570 if (err < 0)
d92191aa 5571 return err;
3b49e2e9 5572
6396bb22 5573 ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
90d2723c
PNA		 5574 if (!ops)
5575 return -ENOMEM;
3b49e2e9 5576
0e839dfa
PNA		 5577 flowtable->hooknum = hooknum;
5578 flowtable->priority = priority;
3b49e2e9
PNA		 5579 flowtable->ops = ops;
5580 flowtable->ops_len = n;
5581
5582 for (i = 0; i < n; i++) {
5583 flowtable->ops[i].pf = NFPROTO_NETDEV;
5584 flowtable->ops[i].hooknum = hooknum;
5585 flowtable->ops[i].priority = priority;
17857d92 5586 flowtable->ops[i].priv = &flowtable->data;
3b49e2e9
PNA		 5587 flowtable->ops[i].hook = flowtable->data.type->hook;
5588 flowtable->ops[i].dev = dev_array[i];
5589 }
5590
3b49e2e9
PNA		 5591 return err;
5592}
5593
98319cb9 5594static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5595{
5596 const struct nf_flowtable_type *type;
5597
5598 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 5599 if (family == type->family)
3b49e2e9
PNA		 5600 return type;
5601 }
5602 return NULL;
5603}
5604
452238e8
FW		 5605static const struct nf_flowtable_type *
5606nft_flowtable_type_get(struct net *net, u8 family)
3b49e2e9
PNA		 5607{
5608 const struct nf_flowtable_type *type;
5609
98319cb9 5610 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 5611 if (type != NULL && try_module_get(type->owner))
5612 return type;
5613
f102d66b 5614 lockdep_nfnl_nft_mutex_not_held();
3b49e2e9
PNA		 5615#ifdef CONFIG_MODULES
5616 if (type == NULL) {
452238e8 5617 nft_request_module(net, "nf-flowtable-%u", family);
98319cb9 5618 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 5619 return ERR_PTR(-EAGAIN);
5620 }
5621#endif
5622 return ERR_PTR(-ENOENT);
5623}
5624
3b49e2e9
PNA		 5625static void nft_unregister_flowtable_net_hooks(struct net *net,
5626 struct nft_flowtable *flowtable)
5627{
5628 int i;
5629
5630 for (i = 0; i < flowtable->ops_len; i++) {
5631 if (!flowtable->ops[i].dev)
5632 continue;
5633
5634 nf_unregister_net_hook(net, &flowtable->ops[i]);
5635 }
5636}
5637
5638static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5639 struct sk_buff *skb,
5640 const struct nlmsghdr *nlh,
5641 const struct nlattr * const nla[],
5642 struct netlink_ext_ack *extack)
5643{
5644 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5645 const struct nf_flowtable_type *type;
32fc7187 5646 struct nft_flowtable *flowtable, *ft;
3b49e2e9
PNA		 5647 u8 genmask = nft_genmask_next(net);
5648 int family = nfmsg->nfgen_family;
3b49e2e9
PNA		 5649 struct nft_table *table;
5650 struct nft_ctx ctx;
5651 int err, i, k;
5652
5653 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5654 !nla[NFTA_FLOWTABLE_NAME] ||
5655 !nla[NFTA_FLOWTABLE_HOOK])
5656 return -EINVAL;
5657
cac20fcd
PNA		 5658 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5659 genmask);
36dd1bcc
PNA		 5660 if (IS_ERR(table)) {
5661 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5662 return PTR_ERR(table);
36dd1bcc 5663 }
3b49e2e9 5664
cac20fcd
PNA		 5665 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5666 genmask);
3b49e2e9
PNA		 5667 if (IS_ERR(flowtable)) {
5668 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 5669 if (err != -ENOENT) {
5670 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5671 return err;
36dd1bcc 5672 }
3b49e2e9 5673 } else {
36dd1bcc
PNA		 5674 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5675 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5676 return -EEXIST;
36dd1bcc 5677 }
3b49e2e9
PNA		 5678
5679 return 0;
5680 }
5681
98319cb9 5682 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5683
5684 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5685 if (!flowtable)
5686 return -ENOMEM;
5687
5688 flowtable->table = table;
3ecbfd65
HS		 5689 flowtable->handle = nf_tables_alloc_handle(table);
5690
3b49e2e9
PNA		 5691 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5692 if (!flowtable->name) {
5693 err = -ENOMEM;
5694 goto err1;
5695 }
5696
452238e8 5697 type = nft_flowtable_type_get(net, family);
3b49e2e9
PNA		 5698 if (IS_ERR(type)) {
5699 err = PTR_ERR(type);
5700 goto err2;
5701 }
5702
5703 flowtable->data.type = type;
a268de77 5704 err = type->init(&flowtable->data);
3b49e2e9
PNA		 5705 if (err < 0)
5706 goto err3;
5707
5708 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5709 flowtable);
5710 if (err < 0)
a268de77 5711 goto err4;
3b49e2e9
PNA		 5712
5713 for (i = 0; i < flowtable->ops_len; i++) {
32fc7187
PNA		 5714 if (!flowtable->ops[i].dev)
5715 continue;
5716
5717 list_for_each_entry(ft, &table->flowtables, list) {
5718 for (k = 0; k < ft->ops_len; k++) {
5719 if (!ft->ops[k].dev)
5720 continue;
5721
5722 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5723 flowtable->ops[i].pf == ft->ops[k].pf) {
5724 err = -EBUSY;
a268de77 5725 goto err5;
32fc7187
PNA		 5726 }
5727 }
5728 }
5729
3b49e2e9
PNA		 5730 err = nf_register_net_hook(net, &flowtable->ops[i]);
5731 if (err < 0)
a268de77 5732 goto err5;
3b49e2e9
PNA		 5733 }
5734
5735 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5736 if (err < 0)
a268de77 5737 goto err6;
3b49e2e9
PNA		 5738
5739 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5740 table->use++;
5741
5742 return 0;
a268de77 5743err6:
3b49e2e9 5744 i = flowtable->ops_len;
a268de77 5745err5:
b8088dda 5746 for (k = i - 1; k >= 0; k--)
0e0d5002 5747 nf_unregister_net_hook(net, &flowtable->ops[k]);
3b49e2e9
PNA		 5748
5749 kfree(flowtable->ops);
a268de77
FF		 5750err4:
5751 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5752err3:
5753 module_put(type->owner);
5754err2:
5755 kfree(flowtable->name);
5756err1:
5757 kfree(flowtable);
5758 return err;
5759}
5760
5761static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5762 struct sk_buff *skb,
5763 const struct nlmsghdr *nlh,
5764 const struct nlattr * const nla[],
5765 struct netlink_ext_ack *extack)
5766{
5767 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5768 u8 genmask = nft_genmask_next(net);
5769 int family = nfmsg->nfgen_family;
5770 struct nft_flowtable *flowtable;
36dd1bcc 5771 const struct nlattr *attr;
3b49e2e9
PNA		 5772 struct nft_table *table;
5773 struct nft_ctx ctx;
5774
e603ea4b
PNA		 5775 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5776 (!nla[NFTA_FLOWTABLE_NAME] &&
5777 !nla[NFTA_FLOWTABLE_HANDLE]))
5778 return -EINVAL;
5779
cac20fcd
PNA		 5780 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5781 genmask);
36dd1bcc
PNA		 5782 if (IS_ERR(table)) {
5783 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5784 return PTR_ERR(table);
36dd1bcc 5785 }
3b49e2e9 5786
36dd1bcc
PNA		 5787 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5788 attr = nla[NFTA_FLOWTABLE_HANDLE];
5789 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5790 } else {
5791 attr = nla[NFTA_FLOWTABLE_NAME];
5792 flowtable = nft_flowtable_lookup(table, attr, genmask);
5793 }
5794
5795 if (IS_ERR(flowtable)) {
5796 NL_SET_BAD_ATTR(extack, attr);
5797 return PTR_ERR(flowtable);
5798 }
5799 if (flowtable->use > 0) {
5800 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 5801 return -EBUSY;
36dd1bcc 5802 }
3b49e2e9 5803
98319cb9 5804 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5805
5806 return nft_delflowtable(&ctx, flowtable);
5807}
5808
5809static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5810 u32 portid, u32 seq, int event,
5811 u32 flags, int family,
5812 struct nft_flowtable *flowtable)
5813{
5814 struct nlattr *nest, *nest_devs;
5815 struct nfgenmsg *nfmsg;
5816 struct nlmsghdr *nlh;
5817 int i;
5818
5819 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5820 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5821 if (nlh == NULL)
5822 goto nla_put_failure;
5823
5824 nfmsg = nlmsg_data(nlh);
5825 nfmsg->nfgen_family = family;
5826 nfmsg->version = NFNETLINK_V0;
5827 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5828
5829 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5830 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 5831 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5832 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5833 NFTA_FLOWTABLE_PAD))
3b49e2e9
PNA		 5834 goto nla_put_failure;
5835
5836 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
eb895086
KL		 5837 if (!nest)
5838 goto nla_put_failure;
3b49e2e9
PNA		 5839 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5840 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5841 goto nla_put_failure;
5842
5843 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5844 if (!nest_devs)
5845 goto nla_put_failure;
5846
5847 for (i = 0; i < flowtable->ops_len; i++) {
b8088dda
FW		 5848 const struct net_device *dev = READ_ONCE(flowtable->ops[i].dev);
5849
5850 if (dev &&
5851 nla_put_string(skb, NFTA_DEVICE_NAME, dev->name))
3b49e2e9
PNA		 5852 goto nla_put_failure;
5853 }
5854 nla_nest_end(skb, nest_devs);
5855 nla_nest_end(skb, nest);
5856
5857 nlmsg_end(skb, nlh);
5858 return 0;
5859
5860nla_put_failure:
5861 nlmsg_trim(skb, nlh);
5862 return -1;
5863}
5864
5865struct nft_flowtable_filter {
5866 char *table;
5867};
5868
5869static int nf_tables_dump_flowtable(struct sk_buff *skb,
5870 struct netlink_callback *cb)
5871{
5872 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5873 struct nft_flowtable_filter *filter = cb->data;
5874 unsigned int idx = 0, s_idx = cb->args[0];
5875 struct net *net = sock_net(skb->sk);
5876 int family = nfmsg->nfgen_family;
5877 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5878 const struct nft_table *table;
5879
5880 rcu_read_lock();
5881 cb->seq = net->nft.base_seq;
5882
36596dad 5883 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5884 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 5885 continue;
5886
36596dad
PNA		 5887 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5888 if (!nft_is_active(net, flowtable))
5889 goto cont;
5890 if (idx < s_idx)
5891 goto cont;
5892 if (idx > s_idx)
5893 memset(&cb->args[1], 0,
5894 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5895 if (filter && filter->table &&
36596dad
PNA		 5896 strcmp(filter->table, table->name))
5897 goto cont;
3b49e2e9 5898
36596dad
PNA		 5899 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5900 cb->nlh->nlmsg_seq,
5901 NFT_MSG_NEWFLOWTABLE,
5902 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5903 table->family, flowtable) < 0)
36596dad 5904 goto done;
3b49e2e9 5905
36596dad 5906 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 5907cont:
36596dad 5908 idx++;
3b49e2e9
PNA		 5909 }
5910 }
5911done:
5912 rcu_read_unlock();
5913
5914 cb->args[0] = idx;
5915 return skb->len;
5916}
5917
90fd131a 5918static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
3b49e2e9 5919{
90fd131a
FW		 5920 const struct nlattr * const *nla = cb->data;
5921 struct nft_flowtable_filter *filter = NULL;
3b49e2e9 5922
90fd131a
FW		 5923 if (nla[NFTA_FLOWTABLE_TABLE]) {
5924 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5925 if (!filter)
5926 return -ENOMEM;
3b49e2e9 5927
90fd131a
FW		 5928 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5929 GFP_ATOMIC);
5930 if (!filter->table) {
5931 kfree(filter);
5932 return -ENOMEM;
5933 }
5934 }
3b49e2e9 5935
90fd131a 5936 cb->data = filter;
3b49e2e9
PNA		 5937 return 0;
5938}
5939
90fd131a 5940static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
3b49e2e9 5941{
90fd131a 5942 struct nft_flowtable_filter *filter = cb->data;
3b49e2e9 5943
3b49e2e9 5944 if (!filter)
90fd131a 5945 return 0;
3b49e2e9 5946
90fd131a
FW		 5947 kfree(filter->table);
5948 kfree(filter);
5949
5950 return 0;
3b49e2e9
PNA		 5951}
5952
d9adf22a 5953/* called with rcu_read_lock held */
3b49e2e9
PNA		 5954static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5955 struct sk_buff *skb,
5956 const struct nlmsghdr *nlh,
5957 const struct nlattr * const nla[],
5958 struct netlink_ext_ack *extack)
5959{
5960 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5961 u8 genmask = nft_genmask_cur(net);
5962 int family = nfmsg->nfgen_family;
5963 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5964 const struct nft_table *table;
5965 struct sk_buff *skb2;
5966 int err;
5967
5968 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5969 struct netlink_dump_control c = {
90fd131a 5970 .start = nf_tables_dump_flowtable_start,
3b49e2e9
PNA		 5971 .dump = nf_tables_dump_flowtable,
5972 .done = nf_tables_dump_flowtable_done,
d9adf22a 5973 .module = THIS_MODULE,
90fd131a 5974 .data = (void *)nla,
3b49e2e9
PNA		 5975 };
5976
d9adf22a 5977 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3b49e2e9
PNA		 5978 }
5979
5980 if (!nla[NFTA_FLOWTABLE_NAME])
5981 return -EINVAL;
5982
cac20fcd
PNA		 5983 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5984 genmask);
3b49e2e9
PNA		 5985 if (IS_ERR(table))
5986 return PTR_ERR(table);
5987
cac20fcd
PNA		 5988 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5989 genmask);
03a0120f 5990 if (IS_ERR(flowtable))
3b49e2e9
PNA		 5991 return PTR_ERR(flowtable);
5992
d9adf22a 5993 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3b49e2e9
PNA		 5994 if (!skb2)
5995 return -ENOMEM;
5996
5997 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5998 nlh->nlmsg_seq,
5999 NFT_MSG_NEWFLOWTABLE, 0, family,
6000 flowtable);
6001 if (err < 0)
6002 goto err;
6003
6004 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6005err:
6006 kfree_skb(skb2);
6007 return err;
6008}
6009
6010static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
6011 struct nft_flowtable *flowtable,
6012 int event)
6013{
6014 struct sk_buff *skb;
6015 int err;
6016
6017 if (ctx->report &&
6018 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
6019 return;
6020
6021 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6022 if (skb == NULL)
6023 goto err;
6024
6025 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
6026 ctx->seq, event, 0,
36596dad 6027 ctx->family, flowtable);
3b49e2e9
PNA		 6028 if (err < 0) {
6029 kfree_skb(skb);
6030 goto err;
6031 }
6032
6033 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
6034 ctx->report, GFP_KERNEL);
6035 return;
6036err:
6037 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
6038}
6039
3b49e2e9
PNA		 6040static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
6041{
c04a3f73 6042 kfree(flowtable->ops);
3b49e2e9 6043 kfree(flowtable->name);
b408c5b0 6044 flowtable->data.type->free(&flowtable->data);
3b49e2e9 6045 module_put(flowtable->data.type->owner);
a12486eb 6046 kfree(flowtable);
3b49e2e9
PNA		 6047}
6048
84d7fce6
PNA		 6049static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
6050 u32 portid, u32 seq)
6051{
6052 struct nlmsghdr *nlh;
6053 struct nfgenmsg *nfmsg;
784b4e61 6054 char buf[TASK_COMM_LEN];
dedb67c4 6055 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 6056
6057 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
6058 if (nlh == NULL)
6059 goto nla_put_failure;
6060
6061 nfmsg = nlmsg_data(nlh);
6062 nfmsg->nfgen_family = AF_UNSPEC;
6063 nfmsg->version = NFNETLINK_V0;
6064 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
6065
784b4e61
PS		 6066 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
6067 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
6068 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 6069 goto nla_put_failure;
6070
053c095a
JB		 6071 nlmsg_end(skb, nlh);
6072 return 0;
84d7fce6
PNA		 6073
6074nla_put_failure:
6075 nlmsg_trim(skb, nlh);
6076 return -EMSGSIZE;
6077}
6078
3b49e2e9
PNA		 6079static void nft_flowtable_event(unsigned long event, struct net_device *dev,
6080 struct nft_flowtable *flowtable)
6081{
6082 int i;
6083
6084 for (i = 0; i < flowtable->ops_len; i++) {
6085 if (flowtable->ops[i].dev != dev)
6086 continue;
6087
6088 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
6089 flowtable->ops[i].dev = NULL;
6090 break;
6091 }
6092}
6093
6094static int nf_tables_flowtable_event(struct notifier_block *this,
6095 unsigned long event, void *ptr)
6096{
6097 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
6098 struct nft_flowtable *flowtable;
6099 struct nft_table *table;
0a2cf5ee 6100 struct net *net;
3b49e2e9
PNA		 6101
6102 if (event != NETDEV_UNREGISTER)
6103 return 0;
6104
6a48de01 6105 net = dev_net(dev);
9e619d87 6106 mutex_lock(&net->nft.commit_mutex);
0a2cf5ee 6107 list_for_each_entry(table, &net->nft.tables, list) {
36596dad
PNA		 6108 list_for_each_entry(flowtable, &table->flowtables, list) {
6109 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 6110 }
6111 }
9e619d87 6112 mutex_unlock(&net->nft.commit_mutex);
6a48de01 6113
3b49e2e9
PNA		 6114 return NOTIFY_DONE;
6115}
6116
6117static struct notifier_block nf_tables_flowtable_notifier = {
6118 .notifier_call = nf_tables_flowtable_event,
6119};
6120
25e94a99
PNA		 6121static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
6122 int event)
84d7fce6
PNA		 6123{
6124 struct nlmsghdr *nlh = nlmsg_hdr(skb);
6125 struct sk_buff *skb2;
6126 int err;
6127
6128 if (nlmsg_report(nlh) &&
6129 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 6130 return;
84d7fce6 6131
84d7fce6
PNA		 6132 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6133 if (skb2 == NULL)
6134 goto err;
6135
6136 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6137 nlh->nlmsg_seq);
6138 if (err < 0) {
6139 kfree_skb(skb2);
6140 goto err;
6141 }
6142
25e94a99
PNA		 6143 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6144 nlmsg_report(nlh), GFP_KERNEL);
6145 return;
84d7fce6 6146err:
25e94a99
PNA		 6147 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6148 -ENOBUFS);
84d7fce6
PNA		 6149}
6150
7b8002a1
PNA		 6151static int nf_tables_getgen(struct net *net, struct sock *nlsk,
6152 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 6153 const struct nlattr * const nla[],
6154 struct netlink_ext_ack *extack)
84d7fce6 6155{
84d7fce6
PNA		 6156 struct sk_buff *skb2;
6157 int err;
6158
d9adf22a 6159 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
84d7fce6
PNA		 6160 if (skb2 == NULL)
6161 return -ENOMEM;
6162
6163 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6164 nlh->nlmsg_seq);
6165 if (err < 0)
6166 goto err;
6167
6168 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6169err:
6170 kfree_skb(skb2);
6171 return err;
6172}
6173
96518518
PM		 6174static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
6175 [NFT_MSG_NEWTABLE] = {
55dd6f93 6176 .call_batch = nf_tables_newtable,
96518518
PM		 6177 .attr_count = NFTA_TABLE_MAX,
6178 .policy = nft_table_policy,
6179 },
6180 [NFT_MSG_GETTABLE] = {
d9adf22a 6181 .call_rcu = nf_tables_gettable,
96518518
PM		 6182 .attr_count = NFTA_TABLE_MAX,
6183 .policy = nft_table_policy,
6184 },
6185 [NFT_MSG_DELTABLE] = {
55dd6f93 6186 .call_batch = nf_tables_deltable,
96518518
PM		 6187 .attr_count = NFTA_TABLE_MAX,
6188 .policy = nft_table_policy,
6189 },
6190 [NFT_MSG_NEWCHAIN] = {
91c7b38d 6191 .call_batch = nf_tables_newchain,
96518518
PM		 6192 .attr_count = NFTA_CHAIN_MAX,
6193 .policy = nft_chain_policy,
6194 },
6195 [NFT_MSG_GETCHAIN] = {
d9adf22a 6196 .call_rcu = nf_tables_getchain,
96518518
PM		 6197 .attr_count = NFTA_CHAIN_MAX,
6198 .policy = nft_chain_policy,
6199 },
6200 [NFT_MSG_DELCHAIN] = {
91c7b38d 6201 .call_batch = nf_tables_delchain,
96518518
PM		 6202 .attr_count = NFTA_CHAIN_MAX,
6203 .policy = nft_chain_policy,
6204 },
6205 [NFT_MSG_NEWRULE] = {
0628b123 6206 .call_batch = nf_tables_newrule,
96518518
PM		 6207 .attr_count = NFTA_RULE_MAX,
6208 .policy = nft_rule_policy,
6209 },
6210 [NFT_MSG_GETRULE] = {
d9adf22a 6211 .call_rcu = nf_tables_getrule,
96518518
PM		 6212 .attr_count = NFTA_RULE_MAX,
6213 .policy = nft_rule_policy,
6214 },
6215 [NFT_MSG_DELRULE] = {
0628b123 6216 .call_batch = nf_tables_delrule,
96518518
PM		 6217 .attr_count = NFTA_RULE_MAX,
6218 .policy = nft_rule_policy,
6219 },
20a69341 6220 [NFT_MSG_NEWSET] = {
958bee14 6221 .call_batch = nf_tables_newset,
20a69341
PM		 6222 .attr_count = NFTA_SET_MAX,
6223 .policy = nft_set_policy,
6224 },
6225 [NFT_MSG_GETSET] = {
d9adf22a 6226 .call_rcu = nf_tables_getset,
20a69341
PM		 6227 .attr_count = NFTA_SET_MAX,
6228 .policy = nft_set_policy,
6229 },
6230 [NFT_MSG_DELSET] = {
958bee14 6231 .call_batch = nf_tables_delset,
20a69341
PM		 6232 .attr_count = NFTA_SET_MAX,
6233 .policy = nft_set_policy,
6234 },
6235 [NFT_MSG_NEWSETELEM] = {
958bee14 6236 .call_batch = nf_tables_newsetelem,
20a69341
PM		 6237 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6238 .policy = nft_set_elem_list_policy,
6239 },
6240 [NFT_MSG_GETSETELEM] = {
d9adf22a 6241 .call_rcu = nf_tables_getsetelem,
20a69341
PM		 6242 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6243 .policy = nft_set_elem_list_policy,
6244 },
6245 [NFT_MSG_DELSETELEM] = {
958bee14 6246 .call_batch = nf_tables_delsetelem,
20a69341
PM		 6247 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6248 .policy = nft_set_elem_list_policy,
6249 },
84d7fce6 6250 [NFT_MSG_GETGEN] = {
d9adf22a 6251 .call_rcu = nf_tables_getgen,
84d7fce6 6252 },
e5009240
PNA		 6253 [NFT_MSG_NEWOBJ] = {
6254 .call_batch = nf_tables_newobj,
6255 .attr_count = NFTA_OBJ_MAX,
6256 .policy = nft_obj_policy,
6257 },
6258 [NFT_MSG_GETOBJ] = {
d9adf22a 6259 .call_rcu = nf_tables_getobj,
e5009240
PNA		 6260 .attr_count = NFTA_OBJ_MAX,
6261 .policy = nft_obj_policy,
6262 },
6263 [NFT_MSG_DELOBJ] = {
6264 .call_batch = nf_tables_delobj,
6265 .attr_count = NFTA_OBJ_MAX,
6266 .policy = nft_obj_policy,
6267 },
43da04a5 6268 [NFT_MSG_GETOBJ_RESET] = {
d9adf22a 6269 .call_rcu = nf_tables_getobj,
43da04a5
PNA		 6270 .attr_count = NFTA_OBJ_MAX,
6271 .policy = nft_obj_policy,
6272 },
3b49e2e9
PNA		 6273 [NFT_MSG_NEWFLOWTABLE] = {
6274 .call_batch = nf_tables_newflowtable,
6275 .attr_count = NFTA_FLOWTABLE_MAX,
6276 .policy = nft_flowtable_policy,
6277 },
6278 [NFT_MSG_GETFLOWTABLE] = {
d9adf22a 6279 .call_rcu = nf_tables_getflowtable,
3b49e2e9
PNA		 6280 .attr_count = NFTA_FLOWTABLE_MAX,
6281 .policy = nft_flowtable_policy,
6282 },
6283 [NFT_MSG_DELFLOWTABLE] = {
6284 .call_batch = nf_tables_delflowtable,
6285 .attr_count = NFTA_FLOWTABLE_MAX,
6286 .policy = nft_flowtable_policy,
6287 },
96518518
PM		 6288};
6289
a654de8f
PNA		 6290static int nf_tables_validate(struct net *net)
6291{
6292 struct nft_table *table;
6293
6294 switch (net->nft.validate_state) {
6295 case NFT_VALIDATE_SKIP:
6296 break;
6297 case NFT_VALIDATE_NEED:
6298 nft_validate_state_update(net, NFT_VALIDATE_DO);
6299 /* fall through */
6300 case NFT_VALIDATE_DO:
6301 list_for_each_entry(table, &net->nft.tables, list) {
6302 if (nft_table_validate(net, table) < 0)
6303 return -EAGAIN;
6304 }
6305 break;
6306 }
6307
6308 return 0;
6309}
6310
91c7b38d
PNA		 6311static void nft_chain_commit_update(struct nft_trans *trans)
6312{
6313 struct nft_base_chain *basechain;
6314
1b2470e5
FW		 6315 if (nft_trans_chain_name(trans)) {
6316 rhltable_remove(&trans->ctx.table->chains_ht,
6317 &trans->ctx.chain->rhlhead,
6318 nft_chain_ht_params);
d71efb59 6319 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
1b2470e5
FW		 6320 rhltable_insert_key(&trans->ctx.table->chains_ht,
6321 trans->ctx.chain->name,
6322 &trans->ctx.chain->rhlhead,
6323 nft_chain_ht_params);
6324 }
91c7b38d 6325
f323d954 6326 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 6327 return;
6328
6329 basechain = nft_base_chain(trans->ctx.chain);
4c05ec47
TY		 6330 nft_chain_stats_replace(trans->ctx.net, basechain,
6331 nft_trans_chain_stats(trans));
91c7b38d
PNA		 6332
6333 switch (nft_trans_chain_policy(trans)) {
6334 case NF_DROP:
6335 case NF_ACCEPT:
6336 basechain->policy = nft_trans_chain_policy(trans);
6337 break;
6338 }
6339}
6340
2f99aa31 6341static void nft_commit_release(struct nft_trans *trans)
c7c32e72 6342{
c7c32e72
PNA		 6343 switch (trans->msg_type) {
6344 case NFT_MSG_DELTABLE:
6345 nf_tables_table_destroy(&trans->ctx);
6346 break;
9f8aac0b
FW		 6347 case NFT_MSG_NEWCHAIN:
6348 kfree(nft_trans_chain_name(trans));
6349 break;
c7c32e72 6350 case NFT_MSG_DELCHAIN:
43a605f2 6351 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6352 break;
6353 case NFT_MSG_DELRULE:
6354 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6355 break;
6356 case NFT_MSG_DELSET:
6357 nft_set_destroy(nft_trans_set(trans));
6358 break;
61edafbb 6359 case NFT_MSG_DELSETELEM:
3453c927
PNA		 6360 nf_tables_set_elem_destroy(&trans->ctx,
6361 nft_trans_elem_set(trans),
59105446 6362 nft_trans_elem(trans).priv);
61edafbb 6363 break;
e5009240 6364 case NFT_MSG_DELOBJ:
00bfb320 6365 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6366 break;
3b49e2e9
PNA		 6367 case NFT_MSG_DELFLOWTABLE:
6368 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6369 break;
c7c32e72 6370 }
0935d558
FW		 6371
6372 if (trans->put_net)
6373 put_net(trans->ctx.net);
6374
c7c32e72
PNA		 6375 kfree(trans);
6376}
6377
0935d558 6378static void nf_tables_trans_destroy_work(struct work_struct *w)
2f99aa31
FW		 6379{
6380 struct nft_trans *trans, *next;
0935d558
FW		 6381 LIST_HEAD(head);
6382
6383 spin_lock(&nf_tables_destroy_list_lock);
6384 list_splice_init(&nf_tables_destroy_list, &head);
6385 spin_unlock(&nf_tables_destroy_list_lock);
2f99aa31 6386
0935d558 6387 if (list_empty(&head))
2f99aa31
FW		 6388 return;
6389
6390 synchronize_rcu();
6391
0935d558 6392 list_for_each_entry_safe(trans, next, &head, list) {
2f99aa31
FW		 6393 list_del(&trans->list);
6394 nft_commit_release(trans);
6395 }
6396}
6397
0cbc06b3
FW		 6398static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6399{
6400 struct nft_rule *rule;
6401 unsigned int alloc = 0;
6402 int i;
6403
6404 /* already handled or inactive chain? */
6405 if (chain->rules_next || !nft_is_active_next(net, chain))
6406 return 0;
6407
6408 rule = list_entry(&chain->rules, struct nft_rule, list);
6409 i = 0;
6410
6411 list_for_each_entry_continue(rule, &chain->rules, list) {
6412 if (nft_is_active_next(net, rule))
6413 alloc++;
6414 }
6415
6416 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6417 if (!chain->rules_next)
6418 return -ENOMEM;
6419
6420 list_for_each_entry_continue(rule, &chain->rules, list) {
6421 if (nft_is_active_next(net, rule))
6422 chain->rules_next[i++] = rule;
6423 }
6424
6425 chain->rules_next[i] = NULL;
6426 return 0;
6427}
6428
6429static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6430{
6431 struct nft_trans *trans, *next;
6432
6433 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6434 struct nft_chain *chain = trans->ctx.chain;
6435
6436 if (trans->msg_type == NFT_MSG_NEWRULE ||
6437 trans->msg_type == NFT_MSG_DELRULE) {
6438 kvfree(chain->rules_next);
6439 chain->rules_next = NULL;
6440 }
6441 }
6442}
6443
6444static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6445{
6446 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6447
6448 kvfree(o->start);
6449}
6450
6451static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6452{
6453 struct nft_rule **r = rules;
6454 struct nft_rules_old *old;
6455
6456 while (*r)
6457 r++;
6458
6459 r++; /* rcu_head is after end marker */
6460 old = (void *) r;
6461 old->start = rules;
6462
6463 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6464}
6465
0fb39bbe 6466static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
0cbc06b3
FW		 6467{
6468 struct nft_rule **g0, **g1;
6469 bool next_genbit;
6470
6471 next_genbit = nft_gencursor_next(net);
6472
6473 g0 = rcu_dereference_protected(chain->rules_gen_0,
f102d66b 6474 lockdep_commit_lock_is_held(net));
0cbc06b3 6475 g1 = rcu_dereference_protected(chain->rules_gen_1,
f102d66b 6476 lockdep_commit_lock_is_held(net));
0cbc06b3
FW		 6477
6478 /* No changes to this chain? */
6479 if (chain->rules_next == NULL) {
6480 /* chain had no change in last or next generation */
6481 if (g0 == g1)
6482 return;
6483 /*
6484 * chain had no change in this generation; make sure next
6485 * one uses same rules as current generation.
6486 */
6487 if (next_genbit) {
6488 rcu_assign_pointer(chain->rules_gen_1, g0);
6489 nf_tables_commit_chain_free_rules_old(g1);
6490 } else {
6491 rcu_assign_pointer(chain->rules_gen_0, g1);
6492 nf_tables_commit_chain_free_rules_old(g0);
6493 }
6494
6495 return;
6496 }
6497
6498 if (next_genbit)
6499 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6500 else
6501 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6502
6503 chain->rules_next = NULL;
6504
6505 if (g0 == g1)
6506 return;
6507
6508 if (next_genbit)
6509 nf_tables_commit_chain_free_rules_old(g1);
6510 else
6511 nf_tables_commit_chain_free_rules_old(g0);
6512}
6513
d152159b
FW		 6514static void nft_obj_del(struct nft_object *obj)
6515{
4d44175a 6516 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
d152159b
FW		 6517 list_del_rcu(&obj->list);
6518}
6519
1b2470e5
FW		 6520static void nft_chain_del(struct nft_chain *chain)
6521{
6522 struct nft_table *table = chain->table;
6523
6524 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
6525 nft_chain_ht_params));
6526 list_del_rcu(&chain->list);
6527}
6528
0935d558
FW		 6529static void nf_tables_commit_release(struct net *net)
6530{
6531 struct nft_trans *trans;
6532
6533 /* all side effects have to be made visible.
6534 * For example, if a chain named 'foo' has been deleted, a
6535 * new transaction must not find it anymore.
6536 *
6537 * Memory reclaim happens asynchronously from work queue
6538 * to prevent expensive synchronize_rcu() in commit phase.
6539 */
6540 if (list_empty(&net->nft.commit_list)) {
6541 mutex_unlock(&net->nft.commit_mutex);
6542 return;
6543 }
6544
6545 trans = list_last_entry(&net->nft.commit_list,
6546 struct nft_trans, list);
6547 get_net(trans->ctx.net);
6548 WARN_ON_ONCE(trans->put_net);
6549
6550 trans->put_net = true;
6551 spin_lock(&nf_tables_destroy_list_lock);
6552 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
6553 spin_unlock(&nf_tables_destroy_list_lock);
6554
6555 mutex_unlock(&net->nft.commit_mutex);
6556
6557 schedule_work(&trans_destroy_work);
6558}
6559
5913beaf 6560static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 6561{
37082f93 6562 struct nft_trans *trans, *next;
a3716e70 6563 struct nft_trans_elem *te;
0cbc06b3
FW		 6564 struct nft_chain *chain;
6565 struct nft_table *table;
37082f93 6566
b8b27498
FW		 6567 if (list_empty(&net->nft.commit_list)) {
6568 mutex_unlock(&net->nft.commit_mutex);
6569 return 0;
6570 }
6571
a654de8f
PNA		 6572 /* 0. Validate ruleset, otherwise roll back for error reporting. */
6573 if (nf_tables_validate(net) < 0)
6574 return -EAGAIN;
6575
0cbc06b3
FW		 6576 /* 1. Allocate space for next generation rules_gen_X[] */
6577 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6578 int ret;
37082f93 6579
0cbc06b3
FW		 6580 if (trans->msg_type == NFT_MSG_NEWRULE ||
6581 trans->msg_type == NFT_MSG_DELRULE) {
6582 chain = trans->ctx.chain;
6583
6584 ret = nf_tables_commit_chain_prepare(net, chain);
6585 if (ret < 0) {
6586 nf_tables_commit_chain_prepare_cancel(net);
6587 return ret;
6588 }
6589 }
6590 }
37082f93 6591
0cbc06b3
FW		 6592 /* step 2. Make rules_gen_X visible to packet path */
6593 list_for_each_entry(table, &net->nft.tables, list) {
0fb39bbe
FW		 6594 list_for_each_entry(chain, &table->chains, list)
6595 nf_tables_commit_chain(net, chain);
0cbc06b3
FW		 6596 }
6597
6598 /*
6599 * Bump generation counter, invalidate any dump in progress.
6600 * Cannot fail after this point.
37082f93 6601 */
0cbc06b3
FW		 6602 while (++net->nft.base_seq == 0);
6603
6604 /* step 3. Start new generation, rules_gen_X now in use. */
6605 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 6606
6607 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 6608 switch (trans->msg_type) {
55dd6f93
PNA		 6609 case NFT_MSG_NEWTABLE:
6610 if (nft_trans_table_update(trans)) {
6611 if (!nft_trans_table_enable(trans)) {
664b0f8c 6612 nf_tables_table_disable(net,
55dd6f93
PNA		 6613 trans->ctx.table);
6614 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6615 }
6616 } else {
f2a6d766 6617 nft_clear(net, trans->ctx.table);
55dd6f93 6618 }
35151d84 6619 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 6620 nft_trans_destroy(trans);
6621 break;
6622 case NFT_MSG_DELTABLE:
f2a6d766 6623 list_del_rcu(&trans->ctx.table->list);
35151d84 6624 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 6625 break;
91c7b38d 6626 case NFT_MSG_NEWCHAIN:
9f8aac0b 6627 if (nft_trans_chain_update(trans)) {
91c7b38d 6628 nft_chain_commit_update(trans);
9f8aac0b
FW		 6629 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6630 /* trans destroyed after rcu grace period */
6631 } else {
664b0f8c 6632 nft_clear(net, trans->ctx.chain);
9f8aac0b
FW		 6633 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6634 nft_trans_destroy(trans);
6635 }
91c7b38d
PNA		 6636 break;
6637 case NFT_MSG_DELCHAIN:
1b2470e5 6638 nft_chain_del(trans->ctx.chain);
35151d84 6639 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 6640 nf_tables_unregister_hook(trans->ctx.net,
6641 trans->ctx.table,
6642 trans->ctx.chain);
91c7b38d 6643 break;
b380e5c7 6644 case NFT_MSG_NEWRULE:
889f7ee7 6645 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 6646 nf_tables_rule_notify(&trans->ctx,
37082f93 6647 nft_trans_rule(trans),
35151d84 6648 NFT_MSG_NEWRULE);
37082f93 6649 nft_trans_destroy(trans);
b380e5c7
PNA		 6650 break;
6651 case NFT_MSG_DELRULE:
6652 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 6653 nf_tables_rule_notify(&trans->ctx,
6654 nft_trans_rule(trans),
6655 NFT_MSG_DELRULE);
f6ac8585
PNA		 6656 nft_rule_expr_deactivate(&trans->ctx,
6657 nft_trans_rule(trans),
6658 NFT_TRANS_COMMIT);
b380e5c7 6659 break;
958bee14 6660 case NFT_MSG_NEWSET:
37a9cc52 6661 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 6662 /* This avoids hitting -EBUSY when deleting the table
6663 * from the transaction.
6664 */
408070d6 6665 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 6666 !list_empty(&nft_trans_set(trans)->bindings))
6667 trans->ctx.table->use--;
6668
958bee14 6669 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6670 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 6671 nft_trans_destroy(trans);
6672 break;
6673 case NFT_MSG_DELSET:
37a9cc52 6674 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 6675 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6676 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 6677 break;
60319eb1 6678 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 6679 te = (struct nft_trans_elem *)trans->data;
6680
42a55769 6681 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 6682 nf_tables_setelem_notify(&trans->ctx, te->set,
6683 &te->elem,
60319eb1
PNA		 6684 NFT_MSG_NEWSETELEM, 0);
6685 nft_trans_destroy(trans);
6686 break;
6687 case NFT_MSG_DELSETELEM:
a3716e70 6688 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6689
a3716e70
PNA		 6690 nf_tables_setelem_notify(&trans->ctx, te->set,
6691 &te->elem,
60319eb1 6692 NFT_MSG_DELSETELEM, 0);
5cb82a38 6693 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 6694 atomic_dec(&te->set->nelems);
6695 te->set->ndeact--;
60319eb1 6696 break;
e5009240
PNA		 6697 case NFT_MSG_NEWOBJ:
6698 nft_clear(net, nft_trans_obj(trans));
6699 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6700 NFT_MSG_NEWOBJ);
6701 nft_trans_destroy(trans);
6702 break;
6703 case NFT_MSG_DELOBJ:
d152159b 6704 nft_obj_del(nft_trans_obj(trans));
e5009240
PNA		 6705 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6706 NFT_MSG_DELOBJ);
6707 break;
3b49e2e9
PNA		 6708 case NFT_MSG_NEWFLOWTABLE:
6709 nft_clear(net, nft_trans_flowtable(trans));
6710 nf_tables_flowtable_notify(&trans->ctx,
6711 nft_trans_flowtable(trans),
6712 NFT_MSG_NEWFLOWTABLE);
6713 nft_trans_destroy(trans);
6714 break;
6715 case NFT_MSG_DELFLOWTABLE:
6716 list_del_rcu(&nft_trans_flowtable(trans)->list);
6717 nf_tables_flowtable_notify(&trans->ctx,
6718 nft_trans_flowtable(trans),
6719 NFT_MSG_DELFLOWTABLE);
6720 nft_unregister_flowtable_net_hooks(net,
6721 nft_trans_flowtable(trans));
6722 break;
37082f93 6723 }
37082f93
PNA		 6724 }
6725
84d7fce6 6726 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
0935d558 6727 nf_tables_commit_release(net);
37082f93
PNA		 6728
6729 return 0;
6730}
6731
b326dd37 6732static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 6733{
c7c32e72
PNA		 6734 switch (trans->msg_type) {
6735 case NFT_MSG_NEWTABLE:
6736 nf_tables_table_destroy(&trans->ctx);
6737 break;
6738 case NFT_MSG_NEWCHAIN:
43a605f2 6739 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6740 break;
6741 case NFT_MSG_NEWRULE:
6742 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6743 break;
6744 case NFT_MSG_NEWSET:
40ba1d9b 6745 nft_set_destroy(nft_trans_set(trans));
c7c32e72 6746 break;
61edafbb
PM		 6747 case NFT_MSG_NEWSETELEM:
6748 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 6749 nft_trans_elem(trans).priv, true);
61edafbb 6750 break;
e5009240 6751 case NFT_MSG_NEWOBJ:
00bfb320 6752 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6753 break;
3b49e2e9
PNA		 6754 case NFT_MSG_NEWFLOWTABLE:
6755 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6756 break;
c7c32e72
PNA		 6757 }
6758 kfree(trans);
6759}
6760
71ad00c5 6761static int __nf_tables_abort(struct net *net)
37082f93 6762{
37082f93 6763 struct nft_trans *trans, *next;
02263db0 6764 struct nft_trans_elem *te;
37082f93 6765
a907e36d
XL		 6766 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6767 list) {
b380e5c7 6768 switch (trans->msg_type) {
55dd6f93
PNA		 6769 case NFT_MSG_NEWTABLE:
6770 if (nft_trans_table_update(trans)) {
6771 if (nft_trans_table_enable(trans)) {
664b0f8c 6772 nf_tables_table_disable(net,
55dd6f93
PNA		 6773 trans->ctx.table);
6774 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6775 }
6776 nft_trans_destroy(trans);
6777 } else {
e688a7f8 6778 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 6779 }
6780 break;
6781 case NFT_MSG_DELTABLE:
f2a6d766 6782 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 6783 nft_trans_destroy(trans);
6784 break;
91c7b38d
PNA		 6785 case NFT_MSG_NEWCHAIN:
6786 if (nft_trans_chain_update(trans)) {
982f4051 6787 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b 6788 kfree(nft_trans_chain_name(trans));
91c7b38d
PNA		 6789 nft_trans_destroy(trans);
6790 } else {
4fefee57 6791 trans->ctx.table->use--;
1b2470e5 6792 nft_chain_del(trans->ctx.chain);
c974a3a3
PNA		 6793 nf_tables_unregister_hook(trans->ctx.net,
6794 trans->ctx.table,
6795 trans->ctx.chain);
91c7b38d
PNA		 6796 }
6797 break;
6798 case NFT_MSG_DELCHAIN:
4fefee57 6799 trans->ctx.table->use++;
664b0f8c 6800 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 6801 nft_trans_destroy(trans);
6802 break;
b380e5c7 6803 case NFT_MSG_NEWRULE:
4fefee57 6804 trans->ctx.chain->use--;
b380e5c7 6805 list_del_rcu(&nft_trans_rule(trans)->list);
f6ac8585
PNA		 6806 nft_rule_expr_deactivate(&trans->ctx,
6807 nft_trans_rule(trans),
6808 NFT_TRANS_ABORT);
b380e5c7
PNA		 6809 break;
6810 case NFT_MSG_DELRULE:
4fefee57 6811 trans->ctx.chain->use++;
889f7ee7 6812 nft_clear(trans->ctx.net, nft_trans_rule(trans));
bb7b40ae 6813 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
37082f93 6814 nft_trans_destroy(trans);
b380e5c7 6815 break;
958bee14 6816 case NFT_MSG_NEWSET:
4fefee57 6817 trans->ctx.table->use--;
40ba1d9b
PNA		 6818 if (nft_trans_set(trans)->bound) {
6819 nft_trans_destroy(trans);
6820 break;
6821 }
6822 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 6823 break;
6824 case NFT_MSG_DELSET:
4fefee57 6825 trans->ctx.table->use++;
37a9cc52 6826 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 6827 nft_trans_destroy(trans);
6828 break;
60319eb1 6829 case NFT_MSG_NEWSETELEM:
40ba1d9b
PNA		 6830 if (nft_trans_elem_set(trans)->bound) {
6831 nft_trans_destroy(trans);
6832 break;
6833 }
02263db0 6834 te = (struct nft_trans_elem *)trans->data;
5cb82a38 6835 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 6836 atomic_dec(&te->set->nelems);
60319eb1
PNA		 6837 break;
6838 case NFT_MSG_DELSETELEM:
cc02e457
PM		 6839 te = (struct nft_trans_elem *)trans->data;
6840
59105446 6841 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 6842 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 6843 te->set->ndeact--;
cc02e457 6844
e5009240
PNA		 6845 nft_trans_destroy(trans);
6846 break;
6847 case NFT_MSG_NEWOBJ:
6848 trans->ctx.table->use--;
4d44175a 6849 nft_obj_del(nft_trans_obj(trans));
e5009240
PNA		 6850 break;
6851 case NFT_MSG_DELOBJ:
6852 trans->ctx.table->use++;
6853 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 6854 nft_trans_destroy(trans);
6855 break;
3b49e2e9
PNA		 6856 case NFT_MSG_NEWFLOWTABLE:
6857 trans->ctx.table->use--;
6858 list_del_rcu(&nft_trans_flowtable(trans)->list);
6859 nft_unregister_flowtable_net_hooks(net,
6860 nft_trans_flowtable(trans));
6861 break;
6862 case NFT_MSG_DELFLOWTABLE:
6863 trans->ctx.table->use++;
6864 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6865 nft_trans_destroy(trans);
6866 break;
37082f93 6867 }
37082f93
PNA		 6868 }
6869
b326dd37
PNA		 6870 synchronize_rcu();
6871
a1cee076
PNA		 6872 list_for_each_entry_safe_reverse(trans, next,
6873 &net->nft.commit_list, list) {
c7c32e72 6874 list_del(&trans->list);
b326dd37 6875 nf_tables_abort_release(trans);
37082f93
PNA		 6876 }
6877
6878 return 0;
6879}
6880
a654de8f
PNA		 6881static void nf_tables_cleanup(struct net *net)
6882{
6883 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
6884}
6885
71ad00c5
FW		 6886static int nf_tables_abort(struct net *net, struct sk_buff *skb)
6887{
f102d66b
FW		 6888 int ret = __nf_tables_abort(net);
6889
6890 mutex_unlock(&net->nft.commit_mutex);
6891
6892 return ret;
71ad00c5
FW		 6893}
6894
74e8bcd2
PNA		 6895static bool nf_tables_valid_genid(struct net *net, u32 genid)
6896{
f102d66b
FW		 6897 bool genid_ok;
6898
6899 mutex_lock(&net->nft.commit_mutex);
6900
6901 genid_ok = genid == 0 || net->nft.base_seq == genid;
6902 if (!genid_ok)
6903 mutex_unlock(&net->nft.commit_mutex);
6904
6905 /* else, commit mutex has to be released by commit or abort function */
6906 return genid_ok;
74e8bcd2
PNA		 6907}
6908
96518518
PM		 6909static const struct nfnetlink_subsystem nf_tables_subsys = {
6910 .name = "nf_tables",
6911 .subsys_id = NFNL_SUBSYS_NFTABLES,
6912 .cb_count = NFT_MSG_MAX,
6913 .cb = nf_tables_cb,
0628b123
PNA		 6914 .commit = nf_tables_commit,
6915 .abort = nf_tables_abort,
a654de8f 6916 .cleanup = nf_tables_cleanup,
74e8bcd2 6917 .valid_genid = nf_tables_valid_genid,
be2ab5b4 6918 .owner = THIS_MODULE,
96518518
PM		 6919};
6920
7210e4e3 6921int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 6922 enum nft_chain_types type)
7210e4e3
PNA		 6923{
6924 const struct nft_base_chain *basechain;
6925
f323d954 6926 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6927 basechain = nft_base_chain(chain);
6928 if (basechain->type->type != type)
6929 return -EOPNOTSUPP;
6930 }
6931 return 0;
6932}
6933EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6934
75e8d06d
PNA		 6935int nft_chain_validate_hooks(const struct nft_chain *chain,
6936 unsigned int hook_flags)
6937{
6938 struct nft_base_chain *basechain;
6939
f323d954 6940 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6941 basechain = nft_base_chain(chain);
6942
c974a3a3 6943 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6944 return 0;
6945
6946 return -EOPNOTSUPP;
6947 }
6948
6949 return 0;
6950}
6951EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6952
20a69341
PM		 6953/*
6954 * Loop detection - walk through the ruleset beginning at the destination chain
6955 * of a new jump until either the source chain is reached (loop) or all
6956 * reachable chains have been traversed.
6957 *
6958 * The loop check is performed whenever a new jump verdict is added to an
6959 * expression or verdict map or a verdict map is bound to a new chain.
6960 */
6961
6962static int nf_tables_check_loops(const struct nft_ctx *ctx,
6963 const struct nft_chain *chain);
6964
6965static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6966 struct nft_set *set,
20a69341 6967 const struct nft_set_iter *iter,
de70185d 6968 struct nft_set_elem *elem)
20a69341 6969{
fe2811eb
PM		 6970 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6971 const struct nft_data *data;
6972
6973 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6974 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 6975 return 0;
6976
fe2811eb 6977 data = nft_set_ext_data(ext);
1ca2e170 6978 switch (data->verdict.code) {
20a69341
PM		 6979 case NFT_JUMP:
6980 case NFT_GOTO:
1ca2e170 6981 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6982 default:
6983 return 0;
6984 }
6985}
6986
6987static int nf_tables_check_loops(const struct nft_ctx *ctx,
6988 const struct nft_chain *chain)
6989{
6990 const struct nft_rule *rule;
6991 const struct nft_expr *expr, *last;
de70185d 6992 struct nft_set *set;
20a69341
PM		 6993 struct nft_set_binding *binding;
6994 struct nft_set_iter iter;
20a69341
PM		 6995
6996 if (ctx->chain == chain)
6997 return -ELOOP;
6998
6999 list_for_each_entry(rule, &chain->rules, list) {
7000 nft_rule_for_each_expr(expr, last, rule) {
a654de8f
PNA		 7001 struct nft_immediate_expr *priv;
7002 const struct nft_data *data;
0ca743a5
PNA		 7003 int err;
7004
a654de8f 7005 if (strcmp(expr->ops->type->name, "immediate"))
20a69341
PM		 7006 continue;
7007
a654de8f
PNA		 7008 priv = nft_expr_priv(expr);
7009 if (priv->dreg != NFT_REG_VERDICT)
0ca743a5 7010 continue;
20a69341 7011
a654de8f 7012 data = &priv->data;
1ca2e170 7013 switch (data->verdict.code) {
20a69341
PM		 7014 case NFT_JUMP:
7015 case NFT_GOTO:
1ca2e170
PM		 7016 err = nf_tables_check_loops(ctx,
7017 data->verdict.chain);
20a69341
PM		 7018 if (err < 0)
7019 return err;
7020 default:
7021 break;
7022 }
7023 }
7024 }
7025
7026 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 7027 if (!nft_is_active_next(ctx->net, set))
7028 continue;
20a69341
PM		 7029 if (!(set->flags & NFT_SET_MAP) ||
7030 set->dtype != NFT_DATA_VERDICT)
7031 continue;
7032
7033 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 7034 if (!(binding->flags & NFT_SET_MAP) ||
7035 binding->chain != chain)
20a69341
PM		 7036 continue;
7037
8588ac09 7038 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 7039 iter.skip = 0;
7040 iter.count = 0;
7041 iter.err = 0;
7042 iter.fn = nf_tables_loop_check_setelem;
7043
7044 set->ops->walk(ctx, set, &iter);
7045 if (iter.err < 0)
7046 return iter.err;
7047 }
7048 }
7049
7050 return 0;
7051}
7052
36b701fa
LGL		 7053/**
7054 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
7055 *
7056 * @attr: netlink attribute to fetch value from
7057 * @max: maximum value to be stored in dest
7058 * @dest: pointer to the variable
7059 *
7060 * Parse, check and store a given u32 netlink attribute into variable.
7061 * This function returns -ERANGE if the value goes over maximum value.
7062 * Otherwise a 0 is returned and the attribute value is stored in the
7063 * destination variable.
7064 */
f1d505bb 7065int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 7066{
09525a09 7067 u32 val;
36b701fa
LGL		 7068
7069 val = ntohl(nla_get_be32(attr));
7070 if (val > max)
7071 return -ERANGE;
7072
7073 *dest = val;
7074 return 0;
7075}
7076EXPORT_SYMBOL_GPL(nft_parse_u32_check);
7077
49499c3e
PM		 7078/**
7079 * nft_parse_register - parse a register value from a netlink attribute
7080 *
7081 * @attr: netlink attribute
7082 *
7083 * Parse and translate a register value from a netlink attribute.
7084 * Registers used to be 128 bit wide, these register numbers will be
7085 * mapped to the corresponding 32 bit register numbers.
7086 */
b1c96ed3
PM		 7087unsigned int nft_parse_register(const struct nlattr *attr)
7088{
49499c3e
PM		 7089 unsigned int reg;
7090
7091 reg = ntohl(nla_get_be32(attr));
7092 switch (reg) {
7093 case NFT_REG_VERDICT...NFT_REG_4:
7094 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
7095 default:
7096 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
7097 }
b1c96ed3
PM		 7098}
7099EXPORT_SYMBOL_GPL(nft_parse_register);
7100
49499c3e
PM		 7101/**
7102 * nft_dump_register - dump a register value to a netlink attribute
7103 *
7104 * @skb: socket buffer
7105 * @attr: attribute number
7106 * @reg: register number
7107 *
7108 * Construct a netlink attribute containing the register number. For
7109 * compatibility reasons, register numbers being a multiple of 4 are
7110 * translated to the corresponding 128 bit register numbers.
7111 */
b1c96ed3
PM		 7112int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
7113{
49499c3e
PM		 7114 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
7115 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
7116 else
7117 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
7118
b1c96ed3
PM		 7119 return nla_put_be32(skb, attr, htonl(reg));
7120}
7121EXPORT_SYMBOL_GPL(nft_dump_register);
7122
96518518 7123/**
d07db988 7124 * nft_validate_register_load - validate a load from a register
96518518
PM		 7125 *
7126 * @reg: the register number
d07db988 7127 * @len: the length of the data
96518518
PM		 7128 *
7129 * Validate that the input register is one of the general purpose
d07db988 7130 * registers and that the length of the load is within the bounds.
96518518 7131 */
d07db988 7132int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 7133{
49499c3e 7134 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 7135 return -EINVAL;
d07db988
PM		 7136 if (len == 0)
7137 return -EINVAL;
49499c3e 7138 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 7139 return -ERANGE;
49499c3e 7140
96518518
PM		 7141 return 0;
7142}
d07db988 7143EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 7144
96518518 7145/**
1ec10212 7146 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 7147 *
7148 * @ctx: context of the expression performing the load
7149 * @reg: the destination register number
7150 * @data: the data to load
7151 * @type: the data type
45d9bcda 7152 * @len: the length of the data
96518518
PM		 7153 *
7154 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 7155 * the destination register and the length is within the bounds.
7156 * A value of NULL for the data means that its runtime gathered
58f40ab6 7157 * data.
96518518 7158 */
1ec10212
PM		 7159int nft_validate_register_store(const struct nft_ctx *ctx,
7160 enum nft_registers reg,
7161 const struct nft_data *data,
7162 enum nft_data_types type, unsigned int len)
96518518 7163{
20a69341
PM		 7164 int err;
7165
96518518
PM		 7166 switch (reg) {
7167 case NFT_REG_VERDICT:
58f40ab6 7168 if (type != NFT_DATA_VERDICT)
96518518 7169 return -EINVAL;
20a69341 7170
58f40ab6 7171 if (data != NULL &&
1ca2e170
PM		 7172 (data->verdict.code == NFT_GOTO ||
7173 data->verdict.code == NFT_JUMP)) {
7174 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7175 if (err < 0)
7176 return err;
20a69341
PM		 7177 }
7178
96518518
PM		 7179 return 0;
7180 default:
49499c3e 7181 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 7182 return -EINVAL;
45d9bcda
PM		 7183 if (len == 0)
7184 return -EINVAL;
49499c3e
PM		 7185 if (reg * NFT_REG32_SIZE + len >
7186 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 7187 return -ERANGE;
27e6d201 7188
96518518
PM		 7189 if (data != NULL && type != NFT_DATA_VALUE)
7190 return -EINVAL;
7191 return 0;
7192 }
7193}
1ec10212 7194EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 7195
7196static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
7197 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
7198 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
7199 .len = NFT_CHAIN_MAXNAMELEN - 1 },
7200};
7201
7202static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
7203 struct nft_data_desc *desc, const struct nlattr *nla)
7204{
664b0f8c 7205 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 7206 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
7207 struct nft_chain *chain;
7208 int err;
7209
fceb6435
JB		 7210 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
7211 NULL);
96518518
PM		 7212 if (err < 0)
7213 return err;
7214
7215 if (!tb[NFTA_VERDICT_CODE])
7216 return -EINVAL;
1ca2e170 7217 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 7218
1ca2e170 7219 switch (data->verdict.code) {
e0abdadc 7220 default:
1ca2e170 7221 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 7222 case NF_ACCEPT:
7223 case NF_DROP:
7224 case NF_QUEUE:
7225 break;
7226 default:
7227 return -EINVAL;
7228 }
7229 /* fall through */
96518518
PM		 7230 case NFT_CONTINUE:
7231 case NFT_BREAK:
7232 case NFT_RETURN:
96518518
PM		 7233 break;
7234 case NFT_JUMP:
7235 case NFT_GOTO:
7236 if (!tb[NFTA_VERDICT_CHAIN])
7237 return -EINVAL;
f102d66b
FW		 7238 chain = nft_chain_lookup(ctx->net, ctx->table,
7239 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 7240 if (IS_ERR(chain))
7241 return PTR_ERR(chain);
f323d954 7242 if (nft_is_base_chain(chain))
96518518
PM		 7243 return -EOPNOTSUPP;
7244
96518518 7245 chain->use++;
1ca2e170 7246 data->verdict.chain = chain;
96518518 7247 break;
96518518
PM		 7248 }
7249
4c4ed074 7250 desc->len = sizeof(data->verdict);
96518518
PM		 7251 desc->type = NFT_DATA_VERDICT;
7252 return 0;
7253}
7254
7255static void nft_verdict_uninit(const struct nft_data *data)
7256{
1ca2e170 7257 switch (data->verdict.code) {
96518518
PM		 7258 case NFT_JUMP:
7259 case NFT_GOTO:
1ca2e170 7260 data->verdict.chain->use--;
96518518
PM		 7261 break;
7262 }
7263}
7264
33d5a7b1 7265int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 7266{
7267 struct nlattr *nest;
7268
33d5a7b1 7269 nest = nla_nest_start(skb, type);
96518518
PM		 7270 if (!nest)
7271 goto nla_put_failure;
7272
33d5a7b1 7273 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 7274 goto nla_put_failure;
7275
33d5a7b1 7276 switch (v->code) {
96518518
PM		 7277 case NFT_JUMP:
7278 case NFT_GOTO:
1ca2e170 7279 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 7280 v->chain->name))
96518518
PM		 7281 goto nla_put_failure;
7282 }
7283 nla_nest_end(skb, nest);
7284 return 0;
7285
7286nla_put_failure:
7287 return -1;
7288}
7289
d0a11fc3
PM		 7290static int nft_value_init(const struct nft_ctx *ctx,
7291 struct nft_data *data, unsigned int size,
96518518
PM		 7292 struct nft_data_desc *desc, const struct nlattr *nla)
7293{
7294 unsigned int len;
7295
7296 len = nla_len(nla);
7297 if (len == 0)
7298 return -EINVAL;
d0a11fc3 7299 if (len > size)
96518518
PM		 7300 return -EOVERFLOW;
7301
d0a11fc3 7302 nla_memcpy(data->data, nla, len);
96518518
PM		 7303 desc->type = NFT_DATA_VALUE;
7304 desc->len = len;
7305 return 0;
7306}
7307
7308static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
7309 unsigned int len)
7310{
7311 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
7312}
7313
7314static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 7315 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 7316 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
7317};
7318
7319/**
7320 * nft_data_init - parse nf_tables data netlink attributes
7321 *
7322 * @ctx: context of the expression using the data
7323 * @data: destination struct nft_data
d0a11fc3 7324 * @size: maximum data length
96518518
PM		 7325 * @desc: data description
7326 * @nla: netlink attribute containing data
7327 *
7328 * Parse the netlink data attributes and initialize a struct nft_data.
7329 * The type and length of data are returned in the data description.
7330 *
7331 * The caller can indicate that it only wants to accept data of type
7332 * NFT_DATA_VALUE by passing NULL for the ctx argument.
7333 */
d0a11fc3
PM		 7334int nft_data_init(const struct nft_ctx *ctx,
7335 struct nft_data *data, unsigned int size,
96518518
PM		 7336 struct nft_data_desc *desc, const struct nlattr *nla)
7337{
7338 struct nlattr *tb[NFTA_DATA_MAX + 1];
7339 int err;
7340
fceb6435 7341 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 7342 if (err < 0)
7343 return err;
7344
7345 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 7346 return nft_value_init(ctx, data, size, desc,
7347 tb[NFTA_DATA_VALUE]);
96518518
PM		 7348 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
7349 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
7350 return -EINVAL;
7351}
7352EXPORT_SYMBOL_GPL(nft_data_init);
7353
7354/**
59105446 7355 * nft_data_release - release a nft_data item
96518518
PM		 7356 *
7357 * @data: struct nft_data to release
7358 * @type: type of data
7359 *
7360 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
7361 * all others need to be released by calling this function.
7362 */
59105446 7363void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 7364{
960bd2c2 7365 if (type < NFT_DATA_VERDICT)
96518518 7366 return;
960bd2c2 7367 switch (type) {
96518518
PM		 7368 case NFT_DATA_VERDICT:
7369 return nft_verdict_uninit(data);
7370 default:
7371 WARN_ON(1);
7372 }
7373}
59105446 7374EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 7375
7376int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
7377 enum nft_data_types type, unsigned int len)
7378{
7379 struct nlattr *nest;
7380 int err;
7381
7382 nest = nla_nest_start(skb, attr);
7383 if (nest == NULL)
7384 return -1;
7385
7386 switch (type) {
7387 case NFT_DATA_VALUE:
7388 err = nft_value_dump(skb, data, len);
7389 break;
7390 case NFT_DATA_VERDICT:
33d5a7b1 7391 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 7392 break;
7393 default:
7394 err = -EINVAL;
7395 WARN_ON(1);
7396 }
7397
7398 nla_nest_end(skb, nest);
7399 return err;
7400}
7401EXPORT_SYMBOL_GPL(nft_data_dump);
7402
5ebe0b0e
PNA		 7403int __nft_release_basechain(struct nft_ctx *ctx)
7404{
7405 struct nft_rule *rule, *nr;
7406
fa5950e4
FW		 7407 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
7408 return 0;
5ebe0b0e 7409
c974a3a3 7410 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 7411 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
7412 list_del(&rule->list);
7413 ctx->chain->use--;
bb7b40ae 7414 nf_tables_rule_release(ctx, rule);
5ebe0b0e 7415 }
1b2470e5 7416 nft_chain_del(ctx->chain);
5ebe0b0e 7417 ctx->table->use--;
43a605f2 7418 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 7419
7420 return 0;
7421}
7422EXPORT_SYMBOL_GPL(__nft_release_basechain);
7423
98319cb9 7424static void __nft_release_tables(struct net *net)
df05ef87 7425{
3b49e2e9 7426 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 7427 struct nft_table *table, *nt;
7428 struct nft_chain *chain, *nc;
e5009240 7429 struct nft_object *obj, *ne;
df05ef87
PNA		 7430 struct nft_rule *rule, *nr;
7431 struct nft_set *set, *ns;
7432 struct nft_ctx ctx = {
7433 .net = net,
43a605f2 7434 .family = NFPROTO_NETDEV,
df05ef87
PNA		 7435 };
7436
36596dad 7437 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 7438 ctx.family = table->family;
dd4cbef7 7439
df05ef87 7440 list_for_each_entry(chain, &table->chains, list)
c974a3a3 7441 nf_tables_unregister_hook(net, table, chain);
df05ef87
PNA		 7442 /* No packets are walking on these chains anymore. */
7443 ctx.table = table;
7444 list_for_each_entry(chain, &table->chains, list) {
7445 ctx.chain = chain;
7446 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7447 list_del(&rule->list);
7448 chain->use--;
bb7b40ae 7449 nf_tables_rule_release(&ctx, rule);
df05ef87
PNA		 7450 }
7451 }
3b49e2e9
PNA		 7452 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7453 list_del(&flowtable->list);
7454 table->use--;
7455 nf_tables_flowtable_destroy(flowtable);
7456 }
df05ef87
PNA		 7457 list_for_each_entry_safe(set, ns, &table->sets, list) {
7458 list_del(&set->list);
7459 table->use--;
7460 nft_set_destroy(set);
7461 }
e5009240 7462 list_for_each_entry_safe(obj, ne, &table->objects, list) {
d152159b 7463 nft_obj_del(obj);
e5009240 7464 table->use--;
00bfb320 7465 nft_obj_destroy(&ctx, obj);
e5009240 7466 }
df05ef87 7467 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 7468 ctx.chain = chain;
1b2470e5 7469 nft_chain_del(chain);
df05ef87 7470 table->use--;
43a605f2 7471 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 7472 }
7473 list_del(&table->list);
7474 nf_tables_table_destroy(&ctx);
7475 }
7476}
7477
dd4cbef7
PNA		 7478static int __net_init nf_tables_init_net(struct net *net)
7479{
7480 INIT_LIST_HEAD(&net->nft.tables);
7481 INIT_LIST_HEAD(&net->nft.commit_list);
f102d66b 7482 mutex_init(&net->nft.commit_mutex);
dd4cbef7 7483 net->nft.base_seq = 1;
a654de8f
PNA		 7484 net->nft.validate_state = NFT_VALIDATE_SKIP;
7485
dd4cbef7
PNA		 7486 return 0;
7487}
7488
7489static void __net_exit nf_tables_exit_net(struct net *net)
7490{
f102d66b 7491 mutex_lock(&net->nft.commit_mutex);
71ad00c5
FW		 7492 if (!list_empty(&net->nft.commit_list))
7493 __nf_tables_abort(net);
98319cb9 7494 __nft_release_tables(net);
f102d66b 7495 mutex_unlock(&net->nft.commit_mutex);
dd4cbef7 7496 WARN_ON_ONCE(!list_empty(&net->nft.tables));
dd4cbef7
PNA		 7497}
7498
99633ab2
PNA		 7499static struct pernet_operations nf_tables_net_ops = {
7500 .init = nf_tables_init_net,
613d0776 7501 .exit = nf_tables_exit_net,
99633ab2
PNA		 7502};
7503
96518518
PM		 7504static int __init nf_tables_module_init(void)
7505{
7506 int err;
7507
0935d558 7508 spin_lock_init(&nf_tables_destroy_list_lock);
d209df3e
FW		 7509 err = register_pernet_subsys(&nf_tables_net_ops);
7510 if (err < 0)
7511 return err;
7512
7513 err = nft_chain_filter_init();
7514 if (err < 0)
7515 goto err1;
02c7b25e 7516
96518518
PM		 7517 err = nf_tables_core_module_init();
7518 if (err < 0)
d209df3e 7519 goto err2;
96518518 7520
d209df3e 7521 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
96518518 7522 if (err < 0)
d209df3e 7523 goto err3;
96518518 7524
4d44175a
FW		 7525 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
7526 if (err < 0)
7527 goto err4;
7528
d209df3e
FW		 7529 /* must be last */
7530 err = nfnetlink_subsys_register(&nf_tables_subsys);
7531 if (err < 0)
4d44175a 7532 goto err5;
3b49e2e9 7533
d209df3e 7534 return err;
4d44175a
FW		 7535err5:
7536 rhltable_destroy(&nft_objname_ht);
d209df3e
FW		 7537err4:
7538 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7539err3:
96518518 7540 nf_tables_core_module_exit();
d209df3e
FW		 7541err2:
7542 nft_chain_filter_fini();
7543err1:
7544 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 7545 return err;
7546}
7547
7548static void __exit nf_tables_module_exit(void)
7549{
7550 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 7551 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
0a2cf5ee 7552 nft_chain_filter_fini();
71ad00c5 7553 unregister_pernet_subsys(&nf_tables_net_ops);
0935d558 7554 cancel_work_sync(&trans_destroy_work);
1b1bc49c 7555 rcu_barrier();
4d44175a 7556 rhltable_destroy(&nft_objname_ht);
96518518 7557 nf_tables_core_module_exit();
96518518
PM		 7558}
7559
7560module_init(nf_tables_module_init);
7561module_exit(nf_tables_module_exit);
7562
7563MODULE_LICENSE("GPL");
7564MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
7565MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror