]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
net/ibmvnic: Fix RTNL deadlock during device reset
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
0eb71a9d 17#include <linux/rhashtable.h>
96518518
PM		 18#include <linux/netfilter.h>
19#include <linux/netfilter/nfnetlink.h>
20#include <linux/netfilter/nf_tables.h>
3b49e2e9 21#include <net/netfilter/nf_flow_table.h>
96518518
PM		 22#include <net/netfilter/nf_tables_core.h>
23#include <net/netfilter/nf_tables.h>
99633ab2 24#include <net/net_namespace.h>
96518518
PM		 25#include <net/sock.h>
26
96518518 27static LIST_HEAD(nf_tables_expressions);
e5009240 28static LIST_HEAD(nf_tables_objects);
3b49e2e9 29static LIST_HEAD(nf_tables_flowtables);
0935d558
FW		 30static LIST_HEAD(nf_tables_destroy_list);
31static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
3ecbfd65 32static u64 table_handle;
96518518 33
a654de8f
PNA		 34enum {
35 NFT_VALIDATE_SKIP = 0,
36 NFT_VALIDATE_NEED,
37 NFT_VALIDATE_DO,
38};
39
1b2470e5
FW		 40static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
41static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
42static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
43
44static const struct rhashtable_params nft_chain_ht_params = {
45 .head_offset = offsetof(struct nft_chain, rhlhead),
46 .key_offset = offsetof(struct nft_chain, name),
47 .hashfn = nft_chain_hash,
48 .obj_hashfn = nft_chain_hash_obj,
49 .obj_cmpfn = nft_chain_hash_cmp,
50 .locks_mul = 1,
51 .automatic_shrinking = true,
52};
53
a654de8f
PNA		 54static void nft_validate_state_update(struct net *net, u8 new_validate_state)
55{
56 switch (net->nft.validate_state) {
57 case NFT_VALIDATE_SKIP:
58 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
59 break;
60 case NFT_VALIDATE_NEED:
61 break;
62 case NFT_VALIDATE_DO:
63 if (new_validate_state == NFT_VALIDATE_NEED)
64 return;
65 }
66
67 net->nft.validate_state = new_validate_state;
68}
0935d558
FW		 69static void nf_tables_trans_destroy_work(struct work_struct *w);
70static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
a654de8f 71
7c95f6d8 72static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 73 struct net *net,
7c95f6d8
PNA		 74 const struct sk_buff *skb,
75 const struct nlmsghdr *nlh,
36596dad 76 u8 family,
7c95f6d8
PNA		 77 struct nft_table *table,
78 struct nft_chain *chain,
79 const struct nlattr * const *nla)
80{
633c9a84 81 ctx->net = net;
36596dad 82 ctx->family = family;
26b2f552 83 ctx->level = 0;
128ad332
PNA		 84 ctx->table = table;
85 ctx->chain = chain;
86 ctx->nla = nla;
87 ctx->portid = NETLINK_CB(skb).portid;
88 ctx->report = nlmsg_report(nlh);
89 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 90}
91
8411b644
PNA		 92static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
93 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 94{
95 struct nft_trans *trans;
96
8411b644 97 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 98 if (trans == NULL)
99 return NULL;
100
b380e5c7 101 trans->msg_type = msg_type;
1081d11b
PNA		 102 trans->ctx = *ctx;
103
104 return trans;
105}
106
8411b644
PNA		 107static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
108 int msg_type, u32 size)
109{
110 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
111}
112
1081d11b
PNA		 113static void nft_trans_destroy(struct nft_trans *trans)
114{
115 list_del(&trans->list);
116 kfree(trans);
117}
118
c974a3a3
PNA		 119static int nf_tables_register_hook(struct net *net,
120 const struct nft_table *table,
121 struct nft_chain *chain)
d8ee8f7c 122{
4e25ceb8 123 const struct nft_base_chain *basechain;
a37061a6 124 const struct nf_hook_ops *ops;
ae6153b5 125
d8ee8f7c 126 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 127 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 128 return 0;
129
4e25ceb8
FW		 130 basechain = nft_base_chain(chain);
131 ops = &basechain->ops;
ae6153b5 132
4e25ceb8
FW		 133 if (basechain->type->ops_register)
134 return basechain->type->ops_register(net, ops);
135
a37061a6 136 return nf_register_net_hook(net, ops);
d8ee8f7c
PNA		 137}
138
c974a3a3
PNA		 139static void nf_tables_unregister_hook(struct net *net,
140 const struct nft_table *table,
141 struct nft_chain *chain)
c5598794 142{
4e25ceb8
FW		 143 const struct nft_base_chain *basechain;
144 const struct nf_hook_ops *ops;
145
d8ee8f7c 146 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 147 !nft_is_base_chain(chain))
d8ee8f7c 148 return;
4e25ceb8
FW		 149 basechain = nft_base_chain(chain);
150 ops = &basechain->ops;
d8ee8f7c 151
4e25ceb8
FW		 152 if (basechain->type->ops_unregister)
153 return basechain->type->ops_unregister(net, ops);
154
155 nf_unregister_net_hook(net, ops);
c5598794
AB		 156}
157
ee01d542
AB		 158static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
159{
160 struct nft_trans *trans;
161
162 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
163 if (trans == NULL)
164 return -ENOMEM;
165
166 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 167 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 168
169 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
170 return 0;
171}
172
173static int nft_deltable(struct nft_ctx *ctx)
174{
175 int err;
176
177 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
178 if (err < 0)
179 return err;
180
f2a6d766 181 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 182 return err;
183}
184
185static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
186{
187 struct nft_trans *trans;
188
189 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
190 if (trans == NULL)
191 return -ENOMEM;
192
193 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 194 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 195
196 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
197 return 0;
198}
199
200static int nft_delchain(struct nft_ctx *ctx)
201{
202 int err;
203
204 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
205 if (err < 0)
206 return err;
207
208 ctx->table->use--;
664b0f8c 209 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 210
211 return err;
212}
213
0ef235c7
FW		 214/* either expr ops provide both activate/deactivate, or neither */
215static bool nft_expr_check_ops(const struct nft_expr_ops *ops)
216{
217 if (!ops)
218 return true;
219
220 if (WARN_ON_ONCE((!ops->activate ^ !ops->deactivate)))
221 return false;
222
223 return true;
224}
225
bb7b40ae
PNA		 226static void nft_rule_expr_activate(const struct nft_ctx *ctx,
227 struct nft_rule *rule)
228{
229 struct nft_expr *expr;
230
231 expr = nft_expr_first(rule);
232 while (expr != nft_expr_last(rule) && expr->ops) {
233 if (expr->ops->activate)
234 expr->ops->activate(ctx, expr);
235
236 expr = nft_expr_next(expr);
237 }
238}
239
240static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
241 struct nft_rule *rule)
242{
243 struct nft_expr *expr;
244
245 expr = nft_expr_first(rule);
246 while (expr != nft_expr_last(rule) && expr->ops) {
247 if (expr->ops->deactivate)
248 expr->ops->deactivate(ctx, expr);
249
250 expr = nft_expr_next(expr);
251 }
252}
253
ee01d542
AB		 254static int
255nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
256{
257 /* You cannot delete the same rule twice */
889f7ee7
PNA		 258 if (nft_is_active_next(ctx->net, rule)) {
259 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 260 ctx->chain->use--;
261 return 0;
262 }
263 return -ENOENT;
264}
265
266static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
267 struct nft_rule *rule)
268{
269 struct nft_trans *trans;
270
271 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
272 if (trans == NULL)
273 return NULL;
274
1a94e38d
PNA		 275 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
276 nft_trans_rule_id(trans) =
277 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
278 }
ee01d542
AB		 279 nft_trans_rule(trans) = rule;
280 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
281
282 return trans;
283}
284
285static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
286{
287 struct nft_trans *trans;
288 int err;
289
290 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
291 if (trans == NULL)
292 return -ENOMEM;
293
294 err = nf_tables_delrule_deactivate(ctx, rule);
295 if (err < 0) {
296 nft_trans_destroy(trans);
297 return err;
298 }
bb7b40ae 299 nft_rule_expr_deactivate(ctx, rule);
ee01d542
AB		 300
301 return 0;
302}
303
304static int nft_delrule_by_chain(struct nft_ctx *ctx)
305{
306 struct nft_rule *rule;
307 int err;
308
309 list_for_each_entry(rule, &ctx->chain->rules, list) {
310 err = nft_delrule(ctx, rule);
311 if (err < 0)
312 return err;
313 }
314 return 0;
315}
316
cd5125d8 317static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
ee01d542
AB		 318 struct nft_set *set)
319{
320 struct nft_trans *trans;
321
322 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
323 if (trans == NULL)
324 return -ENOMEM;
325
326 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
327 nft_trans_set_id(trans) =
328 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 329 nft_activate_next(ctx->net, set);
ee01d542
AB		 330 }
331 nft_trans_set(trans) = set;
332 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
333
334 return 0;
335}
336
cd5125d8 337static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
ee01d542
AB		 338{
339 int err;
340
341 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
342 if (err < 0)
343 return err;
344
37a9cc52 345 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 346 ctx->table->use--;
347
348 return err;
349}
350
e5009240
PNA		 351static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
352 struct nft_object *obj)
353{
354 struct nft_trans *trans;
355
356 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
357 if (trans == NULL)
358 return -ENOMEM;
359
360 if (msg_type == NFT_MSG_NEWOBJ)
361 nft_activate_next(ctx->net, obj);
362
363 nft_trans_obj(trans) = obj;
364 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
365
366 return 0;
367}
368
369static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
370{
371 int err;
372
373 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
374 if (err < 0)
375 return err;
376
377 nft_deactivate_next(ctx->net, obj);
378 ctx->table->use--;
379
380 return err;
381}
382
3b49e2e9
PNA		 383static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
384 struct nft_flowtable *flowtable)
385{
386 struct nft_trans *trans;
387
388 trans = nft_trans_alloc(ctx, msg_type,
389 sizeof(struct nft_trans_flowtable));
390 if (trans == NULL)
391 return -ENOMEM;
392
393 if (msg_type == NFT_MSG_NEWFLOWTABLE)
394 nft_activate_next(ctx->net, flowtable);
395
396 nft_trans_flowtable(trans) = flowtable;
397 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
398
399 return 0;
400}
401
402static int nft_delflowtable(struct nft_ctx *ctx,
403 struct nft_flowtable *flowtable)
404{
405 int err;
406
407 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
408 if (err < 0)
409 return err;
410
411 nft_deactivate_next(ctx->net, flowtable);
412 ctx->table->use--;
413
414 return err;
415}
416
96518518
PM		 417/*
418 * Tables
419 */
420
36596dad 421static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 422 const struct nlattr *nla,
36596dad 423 u8 family, u8 genmask)
96518518
PM		 424{
425 struct nft_table *table;
426
cac20fcd
PNA		 427 if (nla == NULL)
428 return ERR_PTR(-EINVAL);
429
d9adf22a 430 list_for_each_entry_rcu(table, &net->nft.tables, list) {
f2a6d766 431 if (!nla_strcmp(nla, table->name) &&
98319cb9 432 table->family == family &&
f2a6d766 433 nft_active_genmask(table, genmask))
96518518
PM		 434 return table;
435 }
cac20fcd
PNA		 436
437 return ERR_PTR(-ENOENT);
96518518
PM		 438}
439
3ecbfd65
HS		 440static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
441 const struct nlattr *nla,
442 u8 genmask)
443{
444 struct nft_table *table;
445
446 list_for_each_entry(table, &net->nft.tables, list) {
447 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
448 nft_active_genmask(table, genmask))
449 return table;
450 }
3ecbfd65
HS		 451
452 return ERR_PTR(-ENOENT);
453}
454
96518518
PM		 455static inline u64 nf_tables_alloc_handle(struct nft_table *table)
456{
457 return ++table->hgenerator;
458}
459
32537e91 460static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 461
32537e91 462static const struct nft_chain_type *
1ea26cca 463__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 464{
465 int i;
466
baae3e62 467 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 468 if (chain_type[family][i] != NULL &&
469 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 470 return chain_type[family][i];
9370761c 471 }
baae3e62 472 return NULL;
9370761c
PNA		 473}
474
452238e8
FW		 475/*
476 * Loading a module requires dropping mutex that guards the
477 * transaction.
478 * We first need to abort any pending transactions as once
479 * mutex is unlocked a different client could start a new
480 * transaction. It must not see any 'future generation'
481 * changes * as these changes will never happen.
482 */
483#ifdef CONFIG_MODULES
484static int __nf_tables_abort(struct net *net);
485
486static void nft_request_module(struct net *net, const char *fmt, ...)
487{
488 char module_name[MODULE_NAME_LEN];
489 va_list args;
490 int ret;
491
492 __nf_tables_abort(net);
493
494 va_start(args, fmt);
495 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
496 va_end(args);
497 if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
498 return;
499
f102d66b 500 mutex_unlock(&net->nft.commit_mutex);
452238e8 501 request_module("%s", module_name);
f102d66b 502 mutex_lock(&net->nft.commit_mutex);
452238e8
FW		 503}
504#endif
505
f102d66b
FW		 506static void lockdep_nfnl_nft_mutex_not_held(void)
507{
508#ifdef CONFIG_PROVE_LOCKING
509 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
510#endif
511}
512
32537e91 513static const struct nft_chain_type *
452238e8
FW		 514nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
515 u8 family, bool autoload)
9370761c 516{
32537e91 517 const struct nft_chain_type *type;
9370761c 518
1ea26cca 519 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 520 if (type != NULL)
521 return type;
f102d66b
FW		 522
523 lockdep_nfnl_nft_mutex_not_held();
9370761c 524#ifdef CONFIG_MODULES
93b0806f 525 if (autoload) {
452238e8
FW		 526 nft_request_module(net, "nft-chain-%u-%.*s", family,
527 nla_len(nla), (const char *)nla_data(nla));
1ea26cca 528 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 529 if (type != NULL)
530 return ERR_PTR(-EAGAIN);
9370761c
PNA		 531 }
532#endif
93b0806f 533 return ERR_PTR(-ENOENT);
9370761c
PNA		 534}
535
96518518 536static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 537 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
538 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 539 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 540 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 541};
542
84d7fce6
PNA		 543static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
544 u32 portid, u32 seq, int event, u32 flags,
545 int family, const struct nft_table *table)
96518518
PM		 546{
547 struct nlmsghdr *nlh;
548 struct nfgenmsg *nfmsg;
549
dedb67c4 550 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 551 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
552 if (nlh == NULL)
553 goto nla_put_failure;
554
555 nfmsg = nlmsg_data(nlh);
556 nfmsg->nfgen_family = family;
557 nfmsg->version = NFNETLINK_V0;
84d7fce6 558 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 559
9ddf6323 560 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 561 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 562 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
563 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
564 NFTA_TABLE_PAD))
96518518
PM		 565 goto nla_put_failure;
566
053c095a
JB		 567 nlmsg_end(skb, nlh);
568 return 0;
96518518
PM		 569
570nla_put_failure:
571 nlmsg_trim(skb, nlh);
572 return -1;
573}
574
25e94a99 575static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 576{
577 struct sk_buff *skb;
96518518
PM		 578 int err;
579
128ad332
PNA		 580 if (!ctx->report &&
581 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 582 return;
96518518 583
96518518
PM		 584 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
585 if (skb == NULL)
586 goto err;
587
84d7fce6 588 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 589 event, 0, ctx->family, ctx->table);
96518518
PM		 590 if (err < 0) {
591 kfree_skb(skb);
592 goto err;
593 }
594
25e94a99
PNA		 595 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
596 ctx->report, GFP_KERNEL);
597 return;
96518518 598err:
25e94a99 599 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 600}
601
602static int nf_tables_dump_tables(struct sk_buff *skb,
603 struct netlink_callback *cb)
604{
605 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 606 const struct nft_table *table;
607 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 608 struct net *net = sock_net(skb->sk);
96518518
PM		 609 int family = nfmsg->nfgen_family;
610
e688a7f8 611 rcu_read_lock();
38e029f1
PNA		 612 cb->seq = net->nft.base_seq;
613
36596dad 614 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 615 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 616 continue;
617
36596dad
PNA		 618 if (idx < s_idx)
619 goto cont;
620 if (idx > s_idx)
621 memset(&cb->args[1], 0,
622 sizeof(cb->args) - sizeof(cb->args[0]));
623 if (!nft_is_active(net, table))
624 continue;
625 if (nf_tables_fill_table_info(skb, net,
626 NETLINK_CB(cb->skb).portid,
627 cb->nlh->nlmsg_seq,
628 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 629 table->family, table) < 0)
36596dad
PNA		 630 goto done;
631
632 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 633cont:
36596dad 634 idx++;
96518518
PM		 635 }
636done:
e688a7f8 637 rcu_read_unlock();
96518518
PM		 638 cb->args[0] = idx;
639 return skb->len;
640}
641
d9adf22a
FW		 642static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
643 const struct nlmsghdr *nlh,
644 struct netlink_dump_control *c)
645{
646 int err;
647
648 if (!try_module_get(THIS_MODULE))
649 return -EINVAL;
650
651 rcu_read_unlock();
652 err = netlink_dump_start(nlsk, skb, nlh, c);
653 rcu_read_lock();
654 module_put(THIS_MODULE);
655
656 return err;
657}
658
659/* called with rcu_read_lock held */
7b8002a1
PNA		 660static int nf_tables_gettable(struct net *net, struct sock *nlsk,
661 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 662 const struct nlattr * const nla[],
663 struct netlink_ext_ack *extack)
96518518
PM		 664{
665 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 666 u8 genmask = nft_genmask_cur(net);
96518518
PM		 667 const struct nft_table *table;
668 struct sk_buff *skb2;
669 int family = nfmsg->nfgen_family;
670 int err;
671
672 if (nlh->nlmsg_flags & NLM_F_DUMP) {
673 struct netlink_dump_control c = {
674 .dump = nf_tables_dump_tables,
d9adf22a 675 .module = THIS_MODULE,
96518518 676 };
d9adf22a
FW		 677
678 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 679 }
680
cac20fcd 681 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 682 if (IS_ERR(table)) {
683 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 684 return PTR_ERR(table);
36dd1bcc 685 }
96518518 686
d9adf22a 687 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 688 if (!skb2)
689 return -ENOMEM;
690
84d7fce6 691 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 692 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
693 family, table);
694 if (err < 0)
695 goto err;
696
697 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
698
699err:
700 kfree_skb(skb2);
701 return err;
702}
703
c9c17211 704static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 705{
706 struct nft_chain *chain;
707 u32 i = 0;
708
709 list_for_each_entry(chain, &table->chains, list) {
710 if (!nft_is_active_next(net, chain))
711 continue;
f323d954 712 if (!nft_is_base_chain(chain))
10435c11
F		 713 continue;
714
715 if (cnt && i++ == cnt)
716 break;
717
c974a3a3 718 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 719 }
720}
721
c9c17211 722static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 723{
724 struct nft_chain *chain;
725 int err, i = 0;
726
727 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 728 if (!nft_is_active_next(net, chain))
729 continue;
f323d954 730 if (!nft_is_base_chain(chain))
d2012975
PNA		 731 continue;
732
c974a3a3 733 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 734 if (err < 0)
735 goto err;
736
737 i++;
738 }
739 return 0;
740err:
10435c11 741 if (i)
c9c17211 742 nft_table_disable(net, table, i);
9ddf6323
PNA		 743 return err;
744}
745
c9c17211 746static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 747{
c9c17211 748 nft_table_disable(net, table, 0);
9ddf6323
PNA		 749}
750
e1aaca93 751static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 752{
55dd6f93 753 struct nft_trans *trans;
e1aaca93 754 u32 flags;
55dd6f93 755 int ret = 0;
9ddf6323 756
e1aaca93
PNA		 757 if (!ctx->nla[NFTA_TABLE_FLAGS])
758 return 0;
9ddf6323 759
e1aaca93
PNA		 760 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
761 if (flags & ~NFT_TABLE_F_DORMANT)
762 return -EINVAL;
763
63283dd2
PNA		 764 if (flags == ctx->table->flags)
765 return 0;
766
55dd6f93
PNA		 767 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
768 sizeof(struct nft_trans_table));
769 if (trans == NULL)
770 return -ENOMEM;
9ddf6323 771
e1aaca93
PNA		 772 if ((flags & NFT_TABLE_F_DORMANT) &&
773 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 774 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 775 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
776 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 777 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 778 if (ret >= 0) {
e1aaca93 779 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 780 nft_trans_table_enable(trans) = true;
9ddf6323 781 }
9ddf6323 782 }
e1aaca93
PNA		 783 if (ret < 0)
784 goto err;
9ddf6323 785
55dd6f93
PNA		 786 nft_trans_table_update(trans) = true;
787 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
788 return 0;
9ddf6323 789err:
55dd6f93 790 nft_trans_destroy(trans);
9ddf6323
PNA		 791 return ret;
792}
793
1b2470e5
FW		 794static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
795{
796 const char *name = data;
797
798 return jhash(name, strlen(name), seed);
799}
800
801static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
802{
803 const struct nft_chain *chain = data;
804
805 return nft_chain_hash(chain->name, 0, seed);
806}
807
808static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
809 const void *ptr)
810{
811 const struct nft_chain *chain = ptr;
812 const char *name = arg->key;
813
814 return strcmp(chain->name, name);
815}
816
633c9a84
PNA		 817static int nf_tables_newtable(struct net *net, struct sock *nlsk,
818 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 819 const struct nlattr * const nla[],
820 struct netlink_ext_ack *extack)
96518518
PM		 821{
822 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 823 u8 genmask = nft_genmask_next(net);
96518518 824 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 825 const struct nlattr *attr;
826 struct nft_table *table;
c5c1f975 827 u32 flags = 0;
e1aaca93 828 struct nft_ctx ctx;
55dd6f93 829 int err;
96518518 830
f102d66b 831 lockdep_assert_held(&net->nft.commit_mutex);
36dd1bcc
PNA		 832 attr = nla[NFTA_TABLE_NAME];
833 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 834 if (IS_ERR(table)) {
835 if (PTR_ERR(table) != -ENOENT)
836 return PTR_ERR(table);
1a28ad74 837 } else {
36dd1bcc
PNA		 838 if (nlh->nlmsg_flags & NLM_F_EXCL) {
839 NL_SET_BAD_ATTR(extack, attr);
96518518 840 return -EEXIST;
36dd1bcc 841 }
96518518
PM		 842 if (nlh->nlmsg_flags & NLM_F_REPLACE)
843 return -EOPNOTSUPP;
e1aaca93 844
98319cb9 845 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 846 return nf_tables_updtable(&ctx);
96518518
PM		 847 }
848
c5c1f975
PM		 849 if (nla[NFTA_TABLE_FLAGS]) {
850 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
851 if (flags & ~NFT_TABLE_F_DORMANT)
852 return -EINVAL;
853 }
854
ffdb210e 855 err = -ENOMEM;
1cae565e 856 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 857 if (table == NULL)
98319cb9 858 goto err_kzalloc;
96518518 859
36dd1bcc 860 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 861 if (table->name == NULL)
98319cb9 862 goto err_strdup;
e46abbcc 863
1b2470e5
FW		 864 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
865 if (err)
866 goto err_chain_ht;
867
96518518 868 INIT_LIST_HEAD(&table->chains);
20a69341 869 INIT_LIST_HEAD(&table->sets);
e5009240 870 INIT_LIST_HEAD(&table->objects);
3b49e2e9 871 INIT_LIST_HEAD(&table->flowtables);
98319cb9 872 table->family = family;
c5c1f975 873 table->flags = flags;
3ecbfd65 874 table->handle = ++table_handle;
9ddf6323 875
98319cb9 876 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 877 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 878 if (err < 0)
98319cb9 879 goto err_trans;
ffdb210e 880
36596dad 881 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 882 return 0;
98319cb9 883err_trans:
1b2470e5
FW		 884 rhltable_destroy(&table->chains_ht);
885err_chain_ht:
e46abbcc 886 kfree(table->name);
98319cb9 887err_strdup:
ffdb210e 888 kfree(table);
98319cb9 889err_kzalloc:
ffdb210e 890 return err;
96518518
PM		 891}
892
b9ac12ef
AB		 893static int nft_flush_table(struct nft_ctx *ctx)
894{
3b49e2e9 895 struct nft_flowtable *flowtable, *nft;
b9ac12ef 896 struct nft_chain *chain, *nc;
e5009240 897 struct nft_object *obj, *ne;
b9ac12ef 898 struct nft_set *set, *ns;
3b49e2e9 899 int err;
b9ac12ef 900
a2f18db0 901 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 902 if (!nft_is_active_next(ctx->net, chain))
903 continue;
904
b9ac12ef
AB		 905 ctx->chain = chain;
906
907 err = nft_delrule_by_chain(ctx);
908 if (err < 0)
909 goto out;
b9ac12ef
AB		 910 }
911
912 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 913 if (!nft_is_active_next(ctx->net, set))
914 continue;
915
408070d6 916 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 917 !list_empty(&set->bindings))
918 continue;
919
920 err = nft_delset(ctx, set);
921 if (err < 0)
922 goto out;
923 }
924
3b49e2e9
PNA		 925 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
926 err = nft_delflowtable(ctx, flowtable);
927 if (err < 0)
928 goto out;
929 }
930
e5009240
PNA		 931 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
932 err = nft_delobj(ctx, obj);
933 if (err < 0)
934 goto out;
935 }
936
a2f18db0 937 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 938 if (!nft_is_active_next(ctx->net, chain))
939 continue;
940
a2f18db0
PNA		 941 ctx->chain = chain;
942
943 err = nft_delchain(ctx);
944 if (err < 0)
945 goto out;
946 }
947
b9ac12ef
AB		 948 err = nft_deltable(ctx);
949out:
950 return err;
951}
952
953static int nft_flush(struct nft_ctx *ctx, int family)
954{
b9ac12ef
AB		 955 struct nft_table *table, *nt;
956 const struct nlattr * const *nla = ctx->nla;
957 int err = 0;
958
36596dad 959 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 960 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 961 continue;
962
98319cb9 963 ctx->family = table->family;
f2a6d766 964
36596dad
PNA		 965 if (!nft_is_active_next(ctx->net, table))
966 continue;
b9ac12ef 967
36596dad
PNA		 968 if (nla[NFTA_TABLE_NAME] &&
969 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
970 continue;
b9ac12ef 971
36596dad
PNA		 972 ctx->table = table;
973
974 err = nft_flush_table(ctx);
975 if (err < 0)
976 goto out;
b9ac12ef
AB		 977 }
978out:
979 return err;
980}
981
633c9a84
PNA		 982static int nf_tables_deltable(struct net *net, struct sock *nlsk,
983 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 984 const struct nlattr * const nla[],
985 struct netlink_ext_ack *extack)
96518518
PM		 986{
987 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 988 u8 genmask = nft_genmask_next(net);
ee01d542 989 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 990 const struct nlattr *attr;
991 struct nft_table *table;
55dd6f93 992 struct nft_ctx ctx;
96518518 993
36596dad 994 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 995 if (family == AF_UNSPEC ||
996 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 997 return nft_flush(&ctx, family);
998
36dd1bcc
PNA		 999 if (nla[NFTA_TABLE_HANDLE]) {
1000 attr = nla[NFTA_TABLE_HANDLE];
1001 table = nft_table_lookup_byhandle(net, attr, genmask);
1002 } else {
1003 attr = nla[NFTA_TABLE_NAME];
1004 table = nft_table_lookup(net, attr, family, genmask);
1005 }
3ecbfd65 1006
36dd1bcc
PNA		 1007 if (IS_ERR(table)) {
1008 NL_SET_BAD_ATTR(extack, attr);
96518518 1009 return PTR_ERR(table);
36dd1bcc 1010 }
96518518 1011
a8278400
PNA		 1012 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1013 table->use > 0)
1014 return -EBUSY;
1015
98319cb9 1016 ctx.family = family;
b9ac12ef 1017 ctx.table = table;
55dd6f93 1018
b9ac12ef 1019 return nft_flush_table(&ctx);
96518518
PM		 1020}
1021
55dd6f93
PNA		 1022static void nf_tables_table_destroy(struct nft_ctx *ctx)
1023{
fa5950e4
FW		 1024 if (WARN_ON(ctx->table->use > 0))
1025 return;
4fefee57 1026
1b2470e5 1027 rhltable_destroy(&ctx->table->chains_ht);
e46abbcc 1028 kfree(ctx->table->name);
55dd6f93 1029 kfree(ctx->table);
55dd6f93
PNA		 1030}
1031
cc07eeb0 1032void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 1033{
d8297d4f 1034 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
cc07eeb0 1035 return;
d8297d4f 1036
96518518 1037 nfnl_lock(NFNL_SUBSYS_NFTABLES);
cc07eeb0
PNA		 1038 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
1039 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1040 return;
96518518 1041 }
9370761c 1042 chain_type[ctype->family][ctype->type] = ctype;
96518518 1043 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 1044}
9370761c 1045EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 1046
32537e91 1047void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 1048{
96518518 1049 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 1050 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 1051 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1052}
9370761c 1053EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 1054
1055/*
1056 * Chains
1057 */
1058
1059static struct nft_chain *
cac20fcd 1060nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 1061{
1062 struct nft_chain *chain;
1063
1064 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 1065 if (chain->handle == handle &&
1066 nft_active_genmask(chain, genmask))
96518518
PM		 1067 return chain;
1068 }
1069
1070 return ERR_PTR(-ENOENT);
1071}
1072
f102d66b
FW		 1073static bool lockdep_commit_lock_is_held(struct net *net)
1074{
1075#ifdef CONFIG_PROVE_LOCKING
1076 return lockdep_is_held(&net->nft.commit_mutex);
1077#else
1078 return true;
1079#endif
1080}
1081
1082static struct nft_chain *nft_chain_lookup(struct net *net,
1083 struct nft_table *table,
cac20fcd 1084 const struct nlattr *nla, u8 genmask)
96518518 1085{
1b2470e5
FW		 1086 char search[NFT_CHAIN_MAXNAMELEN + 1];
1087 struct rhlist_head *tmp, *list;
96518518
PM		 1088 struct nft_chain *chain;
1089
1090 if (nla == NULL)
1091 return ERR_PTR(-EINVAL);
1092
1b2470e5 1093 nla_strlcpy(search, nla, sizeof(search));
96518518 1094
1b2470e5 1095 WARN_ON(!rcu_read_lock_held() &&
f102d66b 1096 !lockdep_commit_lock_is_held(net));
1b2470e5
FW		 1097
1098 chain = ERR_PTR(-ENOENT);
1099 rcu_read_lock();
1100 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1101 if (!list)
1102 goto out_unlock;
1103
1104 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1105 if (nft_active_genmask(chain, genmask))
1106 goto out_unlock;
1107 }
1108 chain = ERR_PTR(-ENOENT);
1109out_unlock:
1110 rcu_read_unlock();
1111 return chain;
96518518
PM		 1112}
1113
1114static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 1115 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1116 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1117 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1118 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1119 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1120 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 1121 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 1122 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 1123 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 1124};
1125
1126static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1127 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1128 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1129 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1130 .len = IFNAMSIZ - 1 },
96518518
PM		 1131};
1132
0ca743a5
PNA		 1133static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1134{
1135 struct nft_stats *cpu_stats, total;
1136 struct nlattr *nest;
ce355e20
ED		 1137 unsigned int seq;
1138 u64 pkts, bytes;
0ca743a5
PNA		 1139 int cpu;
1140
1141 memset(&total, 0, sizeof(total));
1142 for_each_possible_cpu(cpu) {
1143 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1144 do {
1145 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1146 pkts = cpu_stats->pkts;
1147 bytes = cpu_stats->bytes;
1148 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1149 total.pkts += pkts;
1150 total.bytes += bytes;
0ca743a5
PNA		 1151 }
1152 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1153 if (nest == NULL)
1154 goto nla_put_failure;
1155
b46f6ded
ND		 1156 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1157 NFTA_COUNTER_PAD) ||
1158 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1159 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1160 goto nla_put_failure;
1161
1162 nla_nest_end(skb, nest);
1163 return 0;
1164
1165nla_put_failure:
1166 return -ENOSPC;
1167}
1168
84d7fce6
PNA		 1169static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1170 u32 portid, u32 seq, int event, u32 flags,
1171 int family, const struct nft_table *table,
96518518
PM		 1172 const struct nft_chain *chain)
1173{
1174 struct nlmsghdr *nlh;
1175 struct nfgenmsg *nfmsg;
1176
dedb67c4 1177 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1178 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1179 if (nlh == NULL)
1180 goto nla_put_failure;
1181
1182 nfmsg = nlmsg_data(nlh);
1183 nfmsg->nfgen_family = family;
1184 nfmsg->version = NFNETLINK_V0;
84d7fce6 1185 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1186
1187 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1188 goto nla_put_failure;
b46f6ded
ND		 1189 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1190 NFTA_CHAIN_PAD))
96518518
PM		 1191 goto nla_put_failure;
1192 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1193 goto nla_put_failure;
1194
f323d954 1195 if (nft_is_base_chain(chain)) {
0ca743a5 1196 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1197 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1198 struct nlattr *nest;
1199
1200 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1201 if (nest == NULL)
1202 goto nla_put_failure;
1203 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1204 goto nla_put_failure;
1205 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1206 goto nla_put_failure;
2cbce139
PNA		 1207 if (basechain->dev_name[0] &&
1208 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1209 goto nla_put_failure;
96518518 1210 nla_nest_end(skb, nest);
9370761c 1211
0ca743a5
PNA		 1212 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1213 htonl(basechain->policy)))
1214 goto nla_put_failure;
1215
baae3e62
PM		 1216 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1217 goto nla_put_failure;
0ca743a5 1218
5f9bfe0e 1219 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
0ca743a5 1220 goto nla_put_failure;
96518518
PM		 1221 }
1222
0ca743a5
PNA		 1223 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1224 goto nla_put_failure;
1225
053c095a
JB		 1226 nlmsg_end(skb, nlh);
1227 return 0;
96518518
PM		 1228
1229nla_put_failure:
1230 nlmsg_trim(skb, nlh);
1231 return -1;
1232}
1233
25e94a99 1234static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1235{
1236 struct sk_buff *skb;
96518518
PM		 1237 int err;
1238
128ad332
PNA		 1239 if (!ctx->report &&
1240 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1241 return;
96518518 1242
96518518
PM		 1243 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1244 if (skb == NULL)
1245 goto err;
1246
84d7fce6 1247 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1248 event, 0, ctx->family, ctx->table,
35151d84 1249 ctx->chain);
96518518
PM		 1250 if (err < 0) {
1251 kfree_skb(skb);
1252 goto err;
1253 }
1254
25e94a99
PNA		 1255 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1256 ctx->report, GFP_KERNEL);
1257 return;
96518518 1258err:
25e94a99 1259 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1260}
1261
1262static int nf_tables_dump_chains(struct sk_buff *skb,
1263 struct netlink_callback *cb)
1264{
1265 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1266 const struct nft_table *table;
1267 const struct nft_chain *chain;
1268 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1269 struct net *net = sock_net(skb->sk);
96518518
PM		 1270 int family = nfmsg->nfgen_family;
1271
e688a7f8 1272 rcu_read_lock();
38e029f1
PNA		 1273 cb->seq = net->nft.base_seq;
1274
36596dad 1275 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1276 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1277 continue;
1278
36596dad
PNA		 1279 list_for_each_entry_rcu(chain, &table->chains, list) {
1280 if (idx < s_idx)
1281 goto cont;
1282 if (idx > s_idx)
1283 memset(&cb->args[1], 0,
1284 sizeof(cb->args) - sizeof(cb->args[0]));
1285 if (!nft_is_active(net, chain))
1286 continue;
1287 if (nf_tables_fill_chain_info(skb, net,
1288 NETLINK_CB(cb->skb).portid,
1289 cb->nlh->nlmsg_seq,
1290 NFT_MSG_NEWCHAIN,
1291 NLM_F_MULTI,
98319cb9 1292 table->family, table,
36596dad
PNA		 1293 chain) < 0)
1294 goto done;
38e029f1 1295
36596dad 1296 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1297cont:
36596dad 1298 idx++;
96518518
PM		 1299 }
1300 }
1301done:
e688a7f8 1302 rcu_read_unlock();
96518518
PM		 1303 cb->args[0] = idx;
1304 return skb->len;
1305}
1306
d9adf22a 1307/* called with rcu_read_lock held */
7b8002a1
PNA		 1308static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1309 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1310 const struct nlattr * const nla[],
1311 struct netlink_ext_ack *extack)
96518518
PM		 1312{
1313 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1314 u8 genmask = nft_genmask_cur(net);
96518518 1315 const struct nft_chain *chain;
1b2470e5 1316 struct nft_table *table;
96518518
PM		 1317 struct sk_buff *skb2;
1318 int family = nfmsg->nfgen_family;
1319 int err;
1320
1321 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1322 struct netlink_dump_control c = {
1323 .dump = nf_tables_dump_chains,
d9adf22a 1324 .module = THIS_MODULE,
96518518 1325 };
d9adf22a
FW		 1326
1327 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 1328 }
1329
cac20fcd 1330 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1331 if (IS_ERR(table)) {
1332 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1333 return PTR_ERR(table);
36dd1bcc 1334 }
96518518 1335
f102d66b 1336 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1337 if (IS_ERR(chain)) {
1338 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1339 return PTR_ERR(chain);
36dd1bcc 1340 }
96518518 1341
d9adf22a 1342 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 1343 if (!skb2)
1344 return -ENOMEM;
1345
84d7fce6 1346 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1347 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1348 family, table, chain);
1349 if (err < 0)
1350 goto err;
1351
1352 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1353
1354err:
1355 kfree_skb(skb2);
1356 return err;
1357}
1358
0ca743a5
PNA		 1359static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1360 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1361 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1362};
1363
ff3cd7b3 1364static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1365{
1366 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1367 struct nft_stats __percpu *newstats;
1368 struct nft_stats *stats;
1369 int err;
1370
fceb6435
JB		 1371 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1372 NULL);
0ca743a5 1373 if (err < 0)
ff3cd7b3 1374 return ERR_PTR(err);
0ca743a5
PNA		 1375
1376 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1377 return ERR_PTR(-EINVAL);
0ca743a5 1378
ce355e20 1379 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1380 if (newstats == NULL)
ff3cd7b3 1381 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1382
1383 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1384 * are not exposed to userspace.
1385 */
e8781f70 1386 preempt_disable();
0ca743a5
PNA		 1387 stats = this_cpu_ptr(newstats);
1388 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1389 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1390 preempt_enable();
0ca743a5 1391
ff3cd7b3
PNA		 1392 return newstats;
1393}
1394
1395static void nft_chain_stats_replace(struct nft_base_chain *chain,
1396 struct nft_stats __percpu *newstats)
1397{
0befd061
PNA		 1398 struct nft_stats __percpu *oldstats;
1399
b88825de
PNA		 1400 if (newstats == NULL)
1401 return;
1402
0ca743a5 1403 if (chain->stats) {
0befd061 1404 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
0ca743a5
PNA		 1405 rcu_assign_pointer(chain->stats, newstats);
1406 synchronize_rcu();
1407 free_percpu(oldstats);
bbb8c61f 1408 } else {
0ca743a5 1409 rcu_assign_pointer(chain->stats, newstats);
bbb8c61f
TY		 1410 static_branch_inc(&nft_counters_enabled);
1411 }
0ca743a5
PNA		 1412}
1413
0cbc06b3
FW		 1414static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1415{
1416 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1417 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1418
1419 if (g0 != g1)
1420 kvfree(g1);
1421 kvfree(g0);
1422
1423 /* should be NULL either via abort or via successful commit */
1424 WARN_ON_ONCE(chain->rules_next);
1425 kvfree(chain->rules_next);
1426}
1427
43a605f2 1428static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1429{
43a605f2
PNA		 1430 struct nft_chain *chain = ctx->chain;
1431
fa5950e4
FW		 1432 if (WARN_ON(chain->use > 0))
1433 return;
91c7b38d 1434
0cbc06b3
FW		 1435 /* no concurrent access possible anymore */
1436 nf_tables_chain_free_chain_rules(chain);
1437
f323d954 1438 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1439 struct nft_base_chain *basechain = nft_base_chain(chain);
1440
1441 module_put(basechain->type->owner);
1442 free_percpu(basechain->stats);
9f08ea84
PNA		 1443 if (basechain->stats)
1444 static_branch_dec(&nft_counters_enabled);
b7263e07 1445 kfree(chain->name);
2cbce139 1446 kfree(basechain);
91c7b38d 1447 } else {
b7263e07 1448 kfree(chain->name);
91c7b38d
PNA		 1449 kfree(chain);
1450 }
1451}
1452
508f8ccd
PNA		 1453struct nft_chain_hook {
1454 u32 num;
84ba7dd7 1455 s32 priority;
32537e91 1456 const struct nft_chain_type *type;
508f8ccd
PNA		 1457 struct net_device *dev;
1458};
1459
1460static int nft_chain_parse_hook(struct net *net,
1461 const struct nlattr * const nla[],
36596dad 1462 struct nft_chain_hook *hook, u8 family,
445509eb 1463 bool autoload)
508f8ccd
PNA		 1464{
1465 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1466 const struct nft_chain_type *type;
508f8ccd
PNA		 1467 struct net_device *dev;
1468 int err;
1469
f102d66b
FW		 1470 lockdep_assert_held(&net->nft.commit_mutex);
1471 lockdep_nfnl_nft_mutex_not_held();
1472
508f8ccd 1473 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1474 nft_hook_policy, NULL);
508f8ccd
PNA		 1475 if (err < 0)
1476 return err;
1477
1478 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1479 ha[NFTA_HOOK_PRIORITY] == NULL)
1480 return -EINVAL;
1481
1482 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1483 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1484
36596dad 1485 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1486 if (nla[NFTA_CHAIN_TYPE]) {
452238e8 1487 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
445509eb 1488 family, autoload);
508f8ccd
PNA		 1489 if (IS_ERR(type))
1490 return PTR_ERR(type);
1491 }
1492 if (!(type->hook_mask & (1 << hook->num)))
1493 return -EOPNOTSUPP;
84ba7dd7
FW		 1494
1495 if (type->type == NFT_CHAIN_T_NAT &&
1496 hook->priority <= NF_IP_PRI_CONNTRACK)
1497 return -EOPNOTSUPP;
1498
508f8ccd
PNA		 1499 if (!try_module_get(type->owner))
1500 return -ENOENT;
1501
1502 hook->type = type;
1503
1504 hook->dev = NULL;
36596dad 1505 if (family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1506 char ifname[IFNAMSIZ];
1507
1508 if (!ha[NFTA_HOOK_DEV]) {
1509 module_put(type->owner);
1510 return -EOPNOTSUPP;
1511 }
1512
1513 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
90d2723c 1514 dev = __dev_get_by_name(net, ifname);
508f8ccd
PNA		 1515 if (!dev) {
1516 module_put(type->owner);
1517 return -ENOENT;
1518 }
1519 hook->dev = dev;
1520 } else if (ha[NFTA_HOOK_DEV]) {
1521 module_put(type->owner);
1522 return -EOPNOTSUPP;
1523 }
1524
1525 return 0;
1526}
1527
1528static void nft_chain_release_hook(struct nft_chain_hook *hook)
1529{
1530 module_put(hook->type->owner);
508f8ccd
PNA		 1531}
1532
0cbc06b3
FW		 1533struct nft_rules_old {
1534 struct rcu_head h;
1535 struct nft_rule **start;
1536};
1537
1538static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1539 unsigned int alloc)
1540{
1541 if (alloc > INT_MAX)
1542 return NULL;
1543
1544 alloc += 1; /* NULL, ends rules */
1545 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1546 return NULL;
1547
1548 alloc *= sizeof(struct nft_rule *);
1549 alloc += sizeof(struct nft_rules_old);
1550
1551 return kvmalloc(alloc, GFP_KERNEL);
1552}
1553
4035285f 1554static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
445509eb 1555 u8 policy)
4035285f
PNA		 1556{
1557 const struct nlattr * const *nla = ctx->nla;
1558 struct nft_table *table = ctx->table;
4035285f
PNA		 1559 struct nft_base_chain *basechain;
1560 struct nft_stats __percpu *stats;
1561 struct net *net = ctx->net;
1562 struct nft_chain *chain;
0cbc06b3 1563 struct nft_rule **rules;
4035285f
PNA		 1564 int err;
1565
1566 if (table->use == UINT_MAX)
1567 return -EOVERFLOW;
1568
1569 if (nla[NFTA_CHAIN_HOOK]) {
1570 struct nft_chain_hook hook;
1571 struct nf_hook_ops *ops;
4035285f 1572
445509eb 1573 err = nft_chain_parse_hook(net, nla, &hook, family, true);
4035285f
PNA		 1574 if (err < 0)
1575 return err;
1576
1577 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1578 if (basechain == NULL) {
1579 nft_chain_release_hook(&hook);
1580 return -ENOMEM;
1581 }
1582
1583 if (hook.dev != NULL)
1584 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1585
1586 if (nla[NFTA_CHAIN_COUNTERS]) {
1587 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1588 if (IS_ERR(stats)) {
1589 nft_chain_release_hook(&hook);
1590 kfree(basechain);
1591 return PTR_ERR(stats);
1592 }
1593 basechain->stats = stats;
1594 static_branch_inc(&nft_counters_enabled);
1595 }
1596
4035285f
PNA		 1597 basechain->type = hook.type;
1598 chain = &basechain->chain;
1599
c974a3a3
PNA		 1600 ops = &basechain->ops;
1601 ops->pf = family;
1602 ops->hooknum = hook.num;
1603 ops->priority = hook.priority;
1604 ops->priv = chain;
c2f9eafe 1605 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1606 ops->dev = hook.dev;
c974a3a3 1607
4035285f
PNA		 1608 chain->flags |= NFT_BASE_CHAIN;
1609 basechain->policy = policy;
1610 } else {
1611 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1612 if (chain == NULL)
1613 return -ENOMEM;
1614 }
43a605f2
PNA		 1615 ctx->chain = chain;
1616
4035285f
PNA		 1617 INIT_LIST_HEAD(&chain->rules);
1618 chain->handle = nf_tables_alloc_handle(table);
1619 chain->table = table;
1620 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1621 if (!chain->name) {
1622 err = -ENOMEM;
1623 goto err1;
1624 }
1625
0cbc06b3
FW		 1626 rules = nf_tables_chain_alloc_rules(chain, 0);
1627 if (!rules) {
1628 err = -ENOMEM;
1629 goto err1;
1630 }
1631
1632 *rules = NULL;
1633 rcu_assign_pointer(chain->rules_gen_0, rules);
1634 rcu_assign_pointer(chain->rules_gen_1, rules);
1635
c974a3a3 1636 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1637 if (err < 0)
1638 goto err1;
1639
1b2470e5
FW		 1640 err = rhltable_insert_key(&table->chains_ht, chain->name,
1641 &chain->rhlhead, nft_chain_ht_params);
1642 if (err)
1643 goto err2;
1644
4035285f 1645 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1b2470e5
FW		 1646 if (err < 0) {
1647 rhltable_remove(&table->chains_ht, &chain->rhlhead,
1648 nft_chain_ht_params);
4035285f 1649 goto err2;
1b2470e5 1650 }
4035285f
PNA		 1651
1652 table->use++;
1653 list_add_tail_rcu(&chain->list, &table->chains);
1654
1655 return 0;
1656err2:
c974a3a3 1657 nf_tables_unregister_hook(net, table, chain);
4035285f 1658err1:
43a605f2 1659 nf_tables_chain_destroy(ctx);
4035285f
PNA		 1660
1661 return err;
1662}
1663
445509eb 1664static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy)
2c4a488a
PNA		 1665{
1666 const struct nlattr * const *nla = ctx->nla;
1667 struct nft_table *table = ctx->table;
1668 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1669 struct nft_base_chain *basechain;
1670 struct nft_stats *stats = NULL;
1671 struct nft_chain_hook hook;
2c4a488a
PNA		 1672 struct nf_hook_ops *ops;
1673 struct nft_trans *trans;
c974a3a3 1674 int err;
2c4a488a
PNA		 1675
1676 if (nla[NFTA_CHAIN_HOOK]) {
1677 if (!nft_is_base_chain(chain))
1678 return -EBUSY;
1679
36596dad 1680 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
445509eb 1681 false);
2c4a488a
PNA		 1682 if (err < 0)
1683 return err;
1684
1685 basechain = nft_base_chain(chain);
1686 if (basechain->type != hook.type) {
1687 nft_chain_release_hook(&hook);
1688 return -EBUSY;
1689 }
1690
c974a3a3
PNA		 1691 ops = &basechain->ops;
1692 if (ops->hooknum != hook.num ||
1693 ops->priority != hook.priority ||
1694 ops->dev != hook.dev) {
1695 nft_chain_release_hook(&hook);
1696 return -EBUSY;
2c4a488a
PNA		 1697 }
1698 nft_chain_release_hook(&hook);
1699 }
1700
1701 if (nla[NFTA_CHAIN_HANDLE] &&
1702 nla[NFTA_CHAIN_NAME]) {
1703 struct nft_chain *chain2;
1704
f102d66b
FW		 1705 chain2 = nft_chain_lookup(ctx->net, table,
1706 nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 1707 if (!IS_ERR(chain2))
1708 return -EEXIST;
2c4a488a
PNA		 1709 }
1710
1711 if (nla[NFTA_CHAIN_COUNTERS]) {
1712 if (!nft_is_base_chain(chain))
1713 return -EOPNOTSUPP;
1714
1715 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1716 if (IS_ERR(stats))
1717 return PTR_ERR(stats);
1718 }
1719
c6cc94df 1720 err = -ENOMEM;
2c4a488a
PNA		 1721 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1722 sizeof(struct nft_trans_chain));
c6cc94df
FW		 1723 if (trans == NULL)
1724 goto err;
2c4a488a
PNA		 1725
1726 nft_trans_chain_stats(trans) = stats;
1727 nft_trans_chain_update(trans) = true;
1728
1729 if (nla[NFTA_CHAIN_POLICY])
1730 nft_trans_chain_policy(trans) = policy;
1731 else
1732 nft_trans_chain_policy(trans) = -1;
1733
c6cc94df
FW		 1734 if (nla[NFTA_CHAIN_HANDLE] &&
1735 nla[NFTA_CHAIN_NAME]) {
1736 struct nft_trans *tmp;
1737 char *name;
1738
1739 err = -ENOMEM;
1740 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1741 if (!name)
1742 goto err;
1743
1744 err = -EEXIST;
1745 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
1746 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
1747 tmp->ctx.table == table &&
1748 nft_trans_chain_update(tmp) &&
1749 nft_trans_chain_name(tmp) &&
1750 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
1751 kfree(name);
1752 goto err;
1753 }
2c4a488a 1754 }
c6cc94df
FW		 1755
1756 nft_trans_chain_name(trans) = name;
2c4a488a
PNA		 1757 }
1758 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1759
1760 return 0;
c6cc94df
FW		 1761err:
1762 free_percpu(stats);
1763 kfree(trans);
1764 return err;
2c4a488a
PNA		 1765}
1766
633c9a84
PNA		 1767static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1768 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1769 const struct nlattr * const nla[],
1770 struct netlink_ext_ack *extack)
96518518
PM		 1771{
1772 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 1773 u8 genmask = nft_genmask_next(net);
1774 int family = nfmsg->nfgen_family;
36dd1bcc 1775 const struct nlattr *attr;
96518518
PM		 1776 struct nft_table *table;
1777 struct nft_chain *chain;
57de2a0c 1778 u8 policy = NF_ACCEPT;
4035285f 1779 struct nft_ctx ctx;
96518518 1780 u64 handle = 0;
96518518 1781
f102d66b
FW		 1782 lockdep_assert_held(&net->nft.commit_mutex);
1783
cac20fcd 1784 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1785 if (IS_ERR(table)) {
1786 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1787 return PTR_ERR(table);
36dd1bcc 1788 }
96518518 1789
96518518 1790 chain = NULL;
36dd1bcc 1791 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 1792
1793 if (nla[NFTA_CHAIN_HANDLE]) {
1794 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 1795 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 1796 if (IS_ERR(chain)) {
1797 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 1798 return PTR_ERR(chain);
36dd1bcc
PNA		 1799 }
1800 attr = nla[NFTA_CHAIN_HANDLE];
96518518 1801 } else {
f102d66b 1802 chain = nft_chain_lookup(net, table, attr, genmask);
96518518 1803 if (IS_ERR(chain)) {
36dd1bcc
PNA		 1804 if (PTR_ERR(chain) != -ENOENT) {
1805 NL_SET_BAD_ATTR(extack, attr);
96518518 1806 return PTR_ERR(chain);
36dd1bcc 1807 }
96518518
PM		 1808 chain = NULL;
1809 }
1810 }
1811
57de2a0c 1812 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 1813 if (chain != NULL &&
36dd1bcc
PNA		 1814 !nft_is_base_chain(chain)) {
1815 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 1816 return -EOPNOTSUPP;
36dd1bcc 1817 }
d6b6cb1d
PNA		 1818
1819 if (chain == NULL &&
36dd1bcc
PNA		 1820 nla[NFTA_CHAIN_HOOK] == NULL) {
1821 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 1822 return -EOPNOTSUPP;
36dd1bcc 1823 }
57de2a0c 1824
8f46df18 1825 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1826 switch (policy) {
1827 case NF_DROP:
1828 case NF_ACCEPT:
1829 break;
1830 default:
1831 return -EINVAL;
1832 }
1833 }
1834
98319cb9 1835 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 1836
96518518 1837 if (chain != NULL) {
36dd1bcc
PNA		 1838 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1839 NL_SET_BAD_ATTR(extack, attr);
96518518 1840 return -EEXIST;
36dd1bcc 1841 }
96518518
PM		 1842 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1843 return -EOPNOTSUPP;
1844
445509eb 1845 return nf_tables_updchain(&ctx, genmask, policy);
96518518
PM		 1846 }
1847
445509eb 1848 return nf_tables_addchain(&ctx, family, genmask, policy);
96518518
PM		 1849}
1850
633c9a84
PNA		 1851static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1852 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1853 const struct nlattr * const nla[],
1854 struct netlink_ext_ack *extack)
96518518
PM		 1855{
1856 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1857 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 1858 int family = nfmsg->nfgen_family;
1859 const struct nlattr *attr;
96518518
PM		 1860 struct nft_table *table;
1861 struct nft_chain *chain;
9dee1474 1862 struct nft_rule *rule;
91c7b38d 1863 struct nft_ctx ctx;
3ecbfd65 1864 u64 handle;
9dee1474
PNA		 1865 u32 use;
1866 int err;
96518518 1867
cac20fcd 1868 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1869 if (IS_ERR(table)) {
1870 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1871 return PTR_ERR(table);
36dd1bcc 1872 }
96518518 1873
3ecbfd65 1874 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 1875 attr = nla[NFTA_CHAIN_HANDLE];
1876 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 1877 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 1878 } else {
36dd1bcc 1879 attr = nla[NFTA_CHAIN_NAME];
f102d66b 1880 chain = nft_chain_lookup(net, table, attr, genmask);
3ecbfd65 1881 }
36dd1bcc
PNA		 1882 if (IS_ERR(chain)) {
1883 NL_SET_BAD_ATTR(extack, attr);
96518518 1884 return PTR_ERR(chain);
36dd1bcc 1885 }
9dee1474
PNA		 1886
1887 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1888 chain->use > 0)
96518518
PM		 1889 return -EBUSY;
1890
98319cb9 1891 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 1892
9dee1474
PNA		 1893 use = chain->use;
1894 list_for_each_entry(rule, &chain->rules, list) {
1895 if (!nft_is_active_next(net, rule))
1896 continue;
1897 use--;
1898
1899 err = nft_delrule(&ctx, rule);
1900 if (err < 0)
1901 return err;
1902 }
1903
1904 /* There are rules and elements that are still holding references to us,
1905 * we cannot do a recursive removal in this case.
1906 */
36dd1bcc
PNA		 1907 if (use > 0) {
1908 NL_SET_BAD_ATTR(extack, attr);
9dee1474 1909 return -EBUSY;
36dd1bcc 1910 }
9dee1474 1911
ee01d542 1912 return nft_delchain(&ctx);
96518518
PM		 1913}
1914
96518518
PM		 1915/*
1916 * Expressions
1917 */
1918
1919/**
ef1f7df9
PM		 1920 * nft_register_expr - register nf_tables expr type
1921 * @ops: expr type
96518518 1922 *
ef1f7df9 1923 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1924 * success or a negative errno code otherwise.
1925 */
ef1f7df9 1926int nft_register_expr(struct nft_expr_type *type)
96518518 1927{
0ef235c7
FW		 1928 if (!nft_expr_check_ops(type->ops))
1929 return -EINVAL;
1930
96518518 1931 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1932 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1933 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1934 else
e688a7f8 1935 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1936 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1937 return 0;
1938}
1939EXPORT_SYMBOL_GPL(nft_register_expr);
1940
1941/**
ef1f7df9
PM		 1942 * nft_unregister_expr - unregister nf_tables expr type
1943 * @ops: expr type
96518518 1944 *
ef1f7df9 1945 * Unregisters the expr typefor use with nf_tables.
96518518 1946 */
ef1f7df9 1947void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1948{
1949 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1950 list_del_rcu(&type->list);
96518518
PM		 1951 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1952}
1953EXPORT_SYMBOL_GPL(nft_unregister_expr);
1954
64d46806
PM		 1955static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1956 struct nlattr *nla)
96518518 1957{
ef1f7df9 1958 const struct nft_expr_type *type;
96518518 1959
ef1f7df9 1960 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1961 if (!nla_strcmp(nla, type->name) &&
1962 (!type->family || type->family == family))
ef1f7df9 1963 return type;
96518518
PM		 1964 }
1965 return NULL;
1966}
1967
452238e8
FW		 1968static const struct nft_expr_type *nft_expr_type_get(struct net *net,
1969 u8 family,
64d46806 1970 struct nlattr *nla)
96518518 1971{
ef1f7df9 1972 const struct nft_expr_type *type;
96518518
PM		 1973
1974 if (nla == NULL)
1975 return ERR_PTR(-EINVAL);
1976
64d46806 1977 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1978 if (type != NULL && try_module_get(type->owner))
1979 return type;
96518518 1980
f102d66b 1981 lockdep_nfnl_nft_mutex_not_held();
96518518 1982#ifdef CONFIG_MODULES
ef1f7df9 1983 if (type == NULL) {
452238e8
FW		 1984 nft_request_module(net, "nft-expr-%u-%.*s", family,
1985 nla_len(nla), (char *)nla_data(nla));
64d46806
PM		 1986 if (__nft_expr_type_get(family, nla))
1987 return ERR_PTR(-EAGAIN);
1988
452238e8
FW		 1989 nft_request_module(net, "nft-expr-%.*s",
1990 nla_len(nla), (char *)nla_data(nla));
64d46806 1991 if (__nft_expr_type_get(family, nla))
96518518
PM		 1992 return ERR_PTR(-EAGAIN);
1993 }
1994#endif
1995 return ERR_PTR(-ENOENT);
1996}
1997
1998static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1999 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
2000 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2001};
2002
2003static int nf_tables_fill_expr_info(struct sk_buff *skb,
2004 const struct nft_expr *expr)
2005{
ef1f7df9 2006 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 2007 goto nla_put_failure;
2008
2009 if (expr->ops->dump) {
2010 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
2011 if (data == NULL)
2012 goto nla_put_failure;
2013 if (expr->ops->dump(skb, expr) < 0)
2014 goto nla_put_failure;
2015 nla_nest_end(skb, data);
2016 }
2017
2018 return skb->len;
2019
2020nla_put_failure:
2021 return -1;
2022};
2023
0b2d8a7b
PM		 2024int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2025 const struct nft_expr *expr)
2026{
2027 struct nlattr *nest;
2028
2029 nest = nla_nest_start(skb, attr);
2030 if (!nest)
2031 goto nla_put_failure;
2032 if (nf_tables_fill_expr_info(skb, expr) < 0)
2033 goto nla_put_failure;
2034 nla_nest_end(skb, nest);
2035 return 0;
2036
2037nla_put_failure:
2038 return -1;
2039}
2040
96518518
PM		 2041struct nft_expr_info {
2042 const struct nft_expr_ops *ops;
ef1f7df9 2043 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 2044};
2045
0ca743a5
PNA		 2046static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2047 const struct nlattr *nla,
96518518
PM		 2048 struct nft_expr_info *info)
2049{
ef1f7df9 2050 const struct nft_expr_type *type;
96518518 2051 const struct nft_expr_ops *ops;
ef1f7df9 2052 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 2053 int err;
2054
fceb6435 2055 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 2056 if (err < 0)
2057 return err;
2058
452238e8 2059 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 2060 if (IS_ERR(type))
2061 return PTR_ERR(type);
2062
2063 if (tb[NFTA_EXPR_DATA]) {
2064 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 2065 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 2066 if (err < 0)
2067 goto err1;
2068 } else
2069 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2070
2071 if (type->select_ops != NULL) {
0ca743a5
PNA		 2072 ops = type->select_ops(ctx,
2073 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 2074 if (IS_ERR(ops)) {
2075 err = PTR_ERR(ops);
2076 goto err1;
2077 }
0ef235c7
FW		 2078 if (!nft_expr_check_ops(ops)) {
2079 err = -EINVAL;
2080 goto err1;
2081 }
ef1f7df9
PM		 2082 } else
2083 ops = type->ops;
2084
96518518
PM		 2085 info->ops = ops;
2086 return 0;
ef1f7df9
PM		 2087
2088err1:
2089 module_put(type->owner);
2090 return err;
96518518
PM		 2091}
2092
2093static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 2094 const struct nft_expr_info *info,
96518518
PM		 2095 struct nft_expr *expr)
2096{
2097 const struct nft_expr_ops *ops = info->ops;
2098 int err;
2099
2100 expr->ops = ops;
2101 if (ops->init) {
ef1f7df9 2102 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 2103 if (err < 0)
2104 goto err1;
2105 }
2106
96518518 2107 return 0;
96518518
PM		 2108err1:
2109 expr->ops = NULL;
2110 return err;
2111}
2112
62472bce
PM		 2113static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2114 struct nft_expr *expr)
96518518
PM		 2115{
2116 if (expr->ops->destroy)
62472bce 2117 expr->ops->destroy(ctx, expr);
ef1f7df9 2118 module_put(expr->ops->type->owner);
96518518
PM		 2119}
2120
0b2d8a7b
PM		 2121struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2122 const struct nlattr *nla)
2123{
2124 struct nft_expr_info info;
2125 struct nft_expr *expr;
2126 int err;
2127
2128 err = nf_tables_expr_parse(ctx, nla, &info);
2129 if (err < 0)
2130 goto err1;
2131
2132 err = -ENOMEM;
2133 expr = kzalloc(info.ops->size, GFP_KERNEL);
2134 if (expr == NULL)
2135 goto err2;
2136
2137 err = nf_tables_newexpr(ctx, &info, expr);
2138 if (err < 0)
6cafaf47 2139 goto err3;
0b2d8a7b
PM		 2140
2141 return expr;
6cafaf47
LZ		 2142err3:
2143 kfree(expr);
0b2d8a7b
PM		 2144err2:
2145 module_put(info.ops->type->owner);
2146err1:
2147 return ERR_PTR(err);
2148}
2149
2150void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2151{
2152 nf_tables_expr_destroy(ctx, expr);
2153 kfree(expr);
2154}
2155
96518518
PM		 2156/*
2157 * Rules
2158 */
2159
cac20fcd
PNA		 2160static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2161 u64 handle)
96518518
PM		 2162{
2163 struct nft_rule *rule;
2164
2165 // FIXME: this sucks
d9adf22a 2166 list_for_each_entry_rcu(rule, &chain->rules, list) {
96518518
PM		 2167 if (handle == rule->handle)
2168 return rule;
2169 }
2170
2171 return ERR_PTR(-ENOENT);
2172}
2173
cac20fcd
PNA		 2174static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2175 const struct nlattr *nla)
96518518
PM		 2176{
2177 if (nla == NULL)
2178 return ERR_PTR(-EINVAL);
2179
cac20fcd 2180 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 2181}
2182
2183static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 2184 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2185 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 2186 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2187 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2188 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2189 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 2190 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 2191 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 2192 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2193 .len = NFT_USERDATA_MAXLEN },
467697d2 2194 [NFTA_RULE_ID] = { .type = NLA_U32 },
96518518
PM		 2195};
2196
84d7fce6
PNA		 2197static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2198 u32 portid, u32 seq, int event,
2199 u32 flags, int family,
96518518
PM		 2200 const struct nft_table *table,
2201 const struct nft_chain *chain,
2202 const struct nft_rule *rule)
2203{
2204 struct nlmsghdr *nlh;
2205 struct nfgenmsg *nfmsg;
2206 const struct nft_expr *expr, *next;
2207 struct nlattr *list;
5e948466 2208 const struct nft_rule *prule;
dedb67c4 2209 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 2210
dedb67c4 2211 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 2212 if (nlh == NULL)
2213 goto nla_put_failure;
2214
2215 nfmsg = nlmsg_data(nlh);
2216 nfmsg->nfgen_family = family;
2217 nfmsg->version = NFNETLINK_V0;
84d7fce6 2218 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2219
2220 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2221 goto nla_put_failure;
2222 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2223 goto nla_put_failure;
b46f6ded
ND		 2224 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2225 NFTA_RULE_PAD))
96518518
PM		 2226 goto nla_put_failure;
2227
5e948466 2228 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 2229 prule = list_prev_entry(rule, list);
5e948466 2230 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2231 cpu_to_be64(prule->handle),
2232 NFTA_RULE_PAD))
5e948466
EL		 2233 goto nla_put_failure;
2234 }
2235
96518518
PM		 2236 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2237 if (list == NULL)
2238 goto nla_put_failure;
2239 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2240 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2241 goto nla_put_failure;
96518518
PM		 2242 }
2243 nla_nest_end(skb, list);
2244
86f1ec32
PM		 2245 if (rule->udata) {
2246 struct nft_userdata *udata = nft_userdata(rule);
2247 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2248 udata->data) < 0)
2249 goto nla_put_failure;
2250 }
0768b3b3 2251
053c095a
JB		 2252 nlmsg_end(skb, nlh);
2253 return 0;
96518518
PM		 2254
2255nla_put_failure:
2256 nlmsg_trim(skb, nlh);
2257 return -1;
2258}
2259
25e94a99
PNA		 2260static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2261 const struct nft_rule *rule, int event)
96518518
PM		 2262{
2263 struct sk_buff *skb;
96518518
PM		 2264 int err;
2265
128ad332
PNA		 2266 if (!ctx->report &&
2267 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2268 return;
96518518 2269
96518518
PM		 2270 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2271 if (skb == NULL)
2272 goto err;
2273
84d7fce6 2274 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2275 event, 0, ctx->family, ctx->table,
35151d84 2276 ctx->chain, rule);
96518518
PM		 2277 if (err < 0) {
2278 kfree_skb(skb);
2279 goto err;
2280 }
2281
25e94a99
PNA		 2282 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2283 ctx->report, GFP_KERNEL);
2284 return;
96518518 2285err:
25e94a99 2286 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2287}
2288
6e1f760e 2289struct nft_rule_dump_ctx {
e46abbcc 2290 char *table;
b7263e07 2291 char *chain;
6e1f760e
PNA		 2292};
2293
96518518
PM		 2294static int nf_tables_dump_rules(struct sk_buff *skb,
2295 struct netlink_callback *cb)
2296{
2297 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2298 const struct nft_rule_dump_ctx *ctx = cb->data;
96518518
PM		 2299 const struct nft_table *table;
2300 const struct nft_chain *chain;
2301 const struct nft_rule *rule;
2302 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 2303 struct net *net = sock_net(skb->sk);
96518518
PM		 2304 int family = nfmsg->nfgen_family;
2305
e688a7f8 2306 rcu_read_lock();
38e029f1
PNA		 2307 cb->seq = net->nft.base_seq;
2308
36596dad 2309 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2310 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2311 continue;
2312
2313 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2314 continue;
2315
36596dad
PNA		 2316 list_for_each_entry_rcu(chain, &table->chains, list) {
2317 if (ctx && ctx->chain &&
2318 strcmp(ctx->chain, chain->name) != 0)
6e1f760e
PNA		 2319 continue;
2320
36596dad
PNA		 2321 list_for_each_entry_rcu(rule, &chain->rules, list) {
2322 if (!nft_is_active(net, rule))
2323 goto cont;
2324 if (idx < s_idx)
2325 goto cont;
2326 if (idx > s_idx)
2327 memset(&cb->args[1], 0,
2328 sizeof(cb->args) - sizeof(cb->args[0]));
2329 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2330 cb->nlh->nlmsg_seq,
2331 NFT_MSG_NEWRULE,
2332 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 2333 table->family,
36596dad
PNA		 2334 table, chain, rule) < 0)
2335 goto done;
2336
2337 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 2338cont:
36596dad 2339 idx++;
96518518
PM		 2340 }
2341 }
2342 }
2343done:
e688a7f8
PNA		 2344 rcu_read_unlock();
2345
96518518
PM		 2346 cb->args[0] = idx;
2347 return skb->len;
2348}
2349
90fd131a
FW		 2350static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2351{
2352 const struct nlattr * const *nla = cb->data;
2353 struct nft_rule_dump_ctx *ctx = NULL;
2354
2355 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2356 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2357 if (!ctx)
2358 return -ENOMEM;
2359
2360 if (nla[NFTA_RULE_TABLE]) {
2361 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2362 GFP_ATOMIC);
2363 if (!ctx->table) {
2364 kfree(ctx);
2365 return -ENOMEM;
2366 }
2367 }
2368 if (nla[NFTA_RULE_CHAIN]) {
2369 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2370 GFP_ATOMIC);
2371 if (!ctx->chain) {
2372 kfree(ctx->table);
2373 kfree(ctx);
2374 return -ENOMEM;
2375 }
2376 }
2377 }
2378
2379 cb->data = ctx;
2380 return 0;
2381}
2382
6e1f760e
PNA		 2383static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2384{
e46abbcc
PS		 2385 struct nft_rule_dump_ctx *ctx = cb->data;
2386
2387 if (ctx) {
2388 kfree(ctx->table);
b7263e07 2389 kfree(ctx->chain);
e46abbcc
PS		 2390 kfree(ctx);
2391 }
6e1f760e
PNA		 2392 return 0;
2393}
2394
d9adf22a 2395/* called with rcu_read_lock held */
7b8002a1
PNA		 2396static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2397 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2398 const struct nlattr * const nla[],
2399 struct netlink_ext_ack *extack)
96518518
PM		 2400{
2401 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2402 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2403 const struct nft_chain *chain;
2404 const struct nft_rule *rule;
1b2470e5 2405 struct nft_table *table;
96518518
PM		 2406 struct sk_buff *skb2;
2407 int family = nfmsg->nfgen_family;
2408 int err;
2409
2410 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2411 struct netlink_dump_control c = {
90fd131a 2412 .start= nf_tables_dump_rules_start,
96518518 2413 .dump = nf_tables_dump_rules,
6e1f760e 2414 .done = nf_tables_dump_rules_done,
d9adf22a 2415 .module = THIS_MODULE,
90fd131a 2416 .data = (void *)nla,
96518518 2417 };
6e1f760e 2418
d9adf22a 2419 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 2420 }
2421
cac20fcd 2422 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2423 if (IS_ERR(table)) {
2424 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2425 return PTR_ERR(table);
36dd1bcc 2426 }
96518518 2427
f102d66b 2428 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2429 if (IS_ERR(chain)) {
2430 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2431 return PTR_ERR(chain);
36dd1bcc 2432 }
96518518 2433
cac20fcd 2434 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2435 if (IS_ERR(rule)) {
2436 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2437 return PTR_ERR(rule);
36dd1bcc 2438 }
96518518 2439
d9adf22a 2440 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 2441 if (!skb2)
2442 return -ENOMEM;
2443
84d7fce6 2444 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2445 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2446 family, table, chain, rule);
2447 if (err < 0)
2448 goto err;
2449
2450 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2451
2452err:
2453 kfree_skb(skb2);
2454 return err;
2455}
2456
62472bce
PM		 2457static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2458 struct nft_rule *rule)
96518518 2459{
29e38801 2460 struct nft_expr *expr, *next;
96518518
PM		 2461
2462 /*
2463 * Careful: some expressions might not be initialized in case this
2464 * is called on error from nf_tables_newrule().
2465 */
2466 expr = nft_expr_first(rule);
3e38df13 2467 while (expr != nft_expr_last(rule) && expr->ops) {
29e38801 2468 next = nft_expr_next(expr);
62472bce 2469 nf_tables_expr_destroy(ctx, expr);
29e38801 2470 expr = next;
96518518
PM		 2471 }
2472 kfree(rule);
2473}
2474
bb7b40ae
PNA		 2475static void nf_tables_rule_release(const struct nft_ctx *ctx,
2476 struct nft_rule *rule)
2477{
2478 nft_rule_expr_deactivate(ctx, rule);
2479 nf_tables_rule_destroy(ctx, rule);
2480}
2481
a654de8f
PNA		 2482int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2483{
2484 struct nft_expr *expr, *last;
2485 const struct nft_data *data;
2486 struct nft_rule *rule;
2487 int err;
2488
26b2f552
TY		 2489 if (ctx->level == NFT_JUMP_STACK_SIZE)
2490 return -EMLINK;
2491
a654de8f
PNA		 2492 list_for_each_entry(rule, &chain->rules, list) {
2493 if (!nft_is_active_next(ctx->net, rule))
2494 continue;
2495
2496 nft_rule_for_each_expr(expr, last, rule) {
2497 if (!expr->ops->validate)
2498 continue;
2499
2500 err = expr->ops->validate(ctx, expr, &data);
2501 if (err < 0)
2502 return err;
2503 }
2504 }
2505
2506 return 0;
2507}
2508EXPORT_SYMBOL_GPL(nft_chain_validate);
2509
2510static int nft_table_validate(struct net *net, const struct nft_table *table)
2511{
2512 struct nft_chain *chain;
2513 struct nft_ctx ctx = {
2514 .net = net,
2515 .family = table->family,
2516 };
2517 int err;
2518
2519 list_for_each_entry(chain, &table->chains, list) {
2520 if (!nft_is_base_chain(chain))
2521 continue;
2522
2523 ctx.chain = chain;
2524 err = nft_chain_validate(&ctx, chain);
2525 if (err < 0)
2526 return err;
2527 }
2528
2529 return 0;
2530}
2531
1081d11b
PNA		 2532#define NFT_RULE_MAXEXPRS 128
2533
633c9a84
PNA		 2534static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2535 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2536 const struct nlattr * const nla[],
2537 struct netlink_ext_ack *extack)
96518518
PM		 2538{
2539 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2540 u8 genmask = nft_genmask_next(net);
2a43ecf9 2541 struct nft_expr_info *info = NULL;
98319cb9 2542 int family = nfmsg->nfgen_family;
96518518
PM		 2543 struct nft_table *table;
2544 struct nft_chain *chain;
2545 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2546 struct nft_userdata *udata;
1081d11b 2547 struct nft_trans *trans = NULL;
96518518
PM		 2548 struct nft_expr *expr;
2549 struct nft_ctx ctx;
2550 struct nlattr *tmp;
86f1ec32 2551 unsigned int size, i, n, ulen = 0, usize = 0;
96518518 2552 int err, rem;
5e948466 2553 u64 handle, pos_handle;
96518518 2554
f102d66b
FW		 2555 lockdep_assert_held(&net->nft.commit_mutex);
2556
cac20fcd 2557 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2558 if (IS_ERR(table)) {
2559 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2560 return PTR_ERR(table);
36dd1bcc 2561 }
96518518 2562
f102d66b 2563 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2564 if (IS_ERR(chain)) {
2565 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2566 return PTR_ERR(chain);
36dd1bcc 2567 }
96518518
PM		 2568
2569 if (nla[NFTA_RULE_HANDLE]) {
2570 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 2571 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 2572 if (IS_ERR(rule)) {
2573 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2574 return PTR_ERR(rule);
36dd1bcc 2575 }
96518518 2576
36dd1bcc
PNA		 2577 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2578 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2579 return -EEXIST;
36dd1bcc 2580 }
96518518
PM		 2581 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2582 old_rule = rule;
2583 else
2584 return -EOPNOTSUPP;
2585 } else {
445509eb
PNA		 2586 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
2587 nlh->nlmsg_flags & NLM_F_REPLACE)
96518518
PM		 2588 return -EINVAL;
2589 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2590
2591 if (chain->use == UINT_MAX)
2592 return -EOVERFLOW;
5e948466 2593
447750f2
FW		 2594 if (nla[NFTA_RULE_POSITION]) {
2595 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2596 old_rule = __nft_rule_lookup(chain, pos_handle);
2597 if (IS_ERR(old_rule)) {
2598 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
2599 return PTR_ERR(old_rule);
2600 }
36dd1bcc 2601 }
5e948466
EL		 2602 }
2603
98319cb9 2604 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 2605
96518518
PM		 2606 n = 0;
2607 size = 0;
2608 if (nla[NFTA_RULE_EXPRESSIONS]) {
2a43ecf9
FW		 2609 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
2610 sizeof(struct nft_expr_info),
2611 GFP_KERNEL);
2612 if (!info)
2613 return -ENOMEM;
2614
96518518
PM		 2615 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2616 err = -EINVAL;
2617 if (nla_type(tmp) != NFTA_LIST_ELEM)
2618 goto err1;
2619 if (n == NFT_RULE_MAXEXPRS)
2620 goto err1;
0ca743a5 2621 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2622 if (err < 0)
2623 goto err1;
2624 size += info[n].ops->size;
2625 n++;
2626 }
2627 }
9889840f
PM		 2628 /* Check for overflow of dlen field */
2629 err = -EFBIG;
2630 if (size >= 1 << 12)
2631 goto err1;
96518518 2632
86f1ec32 2633 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2634 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2635 if (ulen > 0)
2636 usize = sizeof(struct nft_userdata) + ulen;
2637 }
0768b3b3 2638
96518518 2639 err = -ENOMEM;
86f1ec32 2640 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2641 if (rule == NULL)
2642 goto err1;
2643
889f7ee7 2644 nft_activate_next(net, rule);
0628b123 2645
96518518
PM		 2646 rule->handle = handle;
2647 rule->dlen = size;
86f1ec32 2648 rule->udata = ulen ? 1 : 0;
0768b3b3 2649
86f1ec32
PM		 2650 if (ulen) {
2651 udata = nft_userdata(rule);
2652 udata->len = ulen - 1;
2653 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2654 }
96518518 2655
96518518
PM		 2656 expr = nft_expr_first(rule);
2657 for (i = 0; i < n; i++) {
2658 err = nf_tables_newexpr(&ctx, &info[i], expr);
2659 if (err < 0)
2660 goto err2;
a654de8f
PNA		 2661
2662 if (info[i].ops->validate)
2663 nft_validate_state_update(net, NFT_VALIDATE_NEED);
2664
ef1f7df9 2665 info[i].ops = NULL;
96518518
PM		 2666 expr = nft_expr_next(expr);
2667 }
2668
96518518 2669 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
ca089878 2670 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
569ccae6
FW		 2671 if (trans == NULL) {
2672 err = -ENOMEM;
2673 goto err2;
2674 }
ca089878
TY		 2675 err = nft_delrule(&ctx, old_rule);
2676 if (err < 0) {
2677 nft_trans_destroy(trans);
569ccae6
FW		 2678 goto err2;
2679 }
2680
2681 list_add_tail_rcu(&rule->list, &old_rule->list);
2682 } else {
2683 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2684 err = -ENOMEM;
2685 goto err2;
2686 }
2687
2688 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2689 if (old_rule)
2690 list_add_rcu(&rule->list, &old_rule->list);
2691 else
2692 list_add_tail_rcu(&rule->list, &chain->rules);
2693 } else {
2694 if (old_rule)
2695 list_add_tail_rcu(&rule->list, &old_rule->list);
2696 else
2697 list_add_rcu(&rule->list, &chain->rules);
2698 }
0628b123 2699 }
2a43ecf9 2700 kvfree(info);
4fefee57 2701 chain->use++;
96518518 2702
a654de8f
PNA		 2703 if (net->nft.validate_state == NFT_VALIDATE_DO)
2704 return nft_table_validate(net, table);
2705
2706 return 0;
96518518 2707err2:
bb7b40ae 2708 nf_tables_rule_release(&ctx, rule);
96518518
PM		 2709err1:
2710 for (i = 0; i < n; i++) {
2711 if (info[i].ops != NULL)
ef1f7df9 2712 module_put(info[i].ops->type->owner);
96518518 2713 }
2a43ecf9 2714 kvfree(info);
96518518
PM		 2715 return err;
2716}
2717
1a94e38d
PNA		 2718static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2719 const struct nlattr *nla)
2720{
2721 u32 id = ntohl(nla_get_be32(nla));
2722 struct nft_trans *trans;
2723
2724 list_for_each_entry(trans, &net->nft.commit_list, list) {
2725 struct nft_rule *rule = nft_trans_rule(trans);
2726
2727 if (trans->msg_type == NFT_MSG_NEWRULE &&
2728 id == nft_trans_rule_id(trans))
2729 return rule;
2730 }
2731 return ERR_PTR(-ENOENT);
2732}
2733
633c9a84
PNA		 2734static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2735 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2736 const struct nlattr * const nla[],
2737 struct netlink_ext_ack *extack)
96518518
PM		 2738{
2739 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2740 u8 genmask = nft_genmask_next(net);
7c95f6d8 2741 struct nft_table *table;
cf9dc09d
PNA		 2742 struct nft_chain *chain = NULL;
2743 struct nft_rule *rule;
0628b123
PNA		 2744 int family = nfmsg->nfgen_family, err = 0;
2745 struct nft_ctx ctx;
96518518 2746
cac20fcd 2747 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2748 if (IS_ERR(table)) {
2749 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2750 return PTR_ERR(table);
36dd1bcc 2751 }
96518518 2752
cf9dc09d 2753 if (nla[NFTA_RULE_CHAIN]) {
f102d66b
FW		 2754 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
2755 genmask);
36dd1bcc
PNA		 2756 if (IS_ERR(chain)) {
2757 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 2758 return PTR_ERR(chain);
36dd1bcc 2759 }
cf9dc09d 2760 }
96518518 2761
98319cb9 2762 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 2763
cf9dc09d
PNA		 2764 if (chain) {
2765 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 2766 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2767 if (IS_ERR(rule)) {
2768 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 2769 return PTR_ERR(rule);
36dd1bcc 2770 }
96518518 2771
1a94e38d
PNA		 2772 err = nft_delrule(&ctx, rule);
2773 } else if (nla[NFTA_RULE_ID]) {
2774 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 2775 if (IS_ERR(rule)) {
2776 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 2777 return PTR_ERR(rule);
36dd1bcc 2778 }
1a94e38d 2779
5e266fe7 2780 err = nft_delrule(&ctx, rule);
cf9dc09d 2781 } else {
ce24b721 2782 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2783 }
2784 } else {
2785 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2786 if (!nft_is_active_next(net, chain))
2787 continue;
2788
cf9dc09d 2789 ctx.chain = chain;
ce24b721 2790 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2791 if (err < 0)
2792 break;
2793 }
2794 }
2795
2796 return err;
2797}
2798
20a69341
PM		 2799/*
2800 * Sets
2801 */
2802
2b664957 2803static LIST_HEAD(nf_tables_set_types);
20a69341 2804
2b664957 2805int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2806{
2807 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2808 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2809 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2810 return 0;
2811}
2812EXPORT_SYMBOL_GPL(nft_register_set);
2813
2b664957 2814void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2815{
2816 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2817 list_del_rcu(&type->list);
20a69341
PM		 2818 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2819}
2820EXPORT_SYMBOL_GPL(nft_unregister_set);
2821
2b664957 2822#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 2823 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
2824 NFT_SET_EVAL)
2b664957 2825
71cc0873 2826static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 2827{
71cc0873 2828 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 2829}
2830
c50b960c
PM		 2831/*
2832 * Select a set implementation based on the data characteristics and the
2833 * given policy. The total memory use might not be known if no size is
2834 * given, in that case the amount of memory per element is used.
2835 */
2836static const struct nft_set_ops *
2b664957
PNA		 2837nft_select_set_ops(const struct nft_ctx *ctx,
2838 const struct nlattr * const nla[],
c50b960c
PM		 2839 const struct nft_set_desc *desc,
2840 enum nft_set_policies policy)
20a69341 2841{
c50b960c
PM		 2842 const struct nft_set_ops *ops, *bops;
2843 struct nft_set_estimate est, best;
2b664957
PNA		 2844 const struct nft_set_type *type;
2845 u32 flags = 0;
20a69341 2846
f102d66b
FW		 2847 lockdep_assert_held(&ctx->net->nft.commit_mutex);
2848 lockdep_nfnl_nft_mutex_not_held();
20a69341 2849#ifdef CONFIG_MODULES
2b664957 2850 if (list_empty(&nf_tables_set_types)) {
452238e8 2851 nft_request_module(ctx->net, "nft-set");
2b664957 2852 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2853 return ERR_PTR(-EAGAIN);
2854 }
2855#endif
2b664957
PNA		 2856 if (nla[NFTA_SET_FLAGS] != NULL)
2857 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2858
55af753c
PNA		 2859 bops = NULL;
2860 best.size = ~0;
2861 best.lookup = ~0;
0b5a7874 2862 best.space = ~0;
c50b960c 2863
2b664957 2864 list_for_each_entry(type, &nf_tables_set_types, list) {
71cc0873 2865 ops = &type->ops;
2b664957 2866
71cc0873 2867 if (!nft_set_ops_candidate(type, flags))
20a69341 2868 continue;
2b664957 2869 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2870 continue;
2871
2872 switch (policy) {
2873 case NFT_SET_POL_PERFORMANCE:
55af753c 2874 if (est.lookup < best.lookup)
c50b960c 2875 break;
644e334e
PNA		 2876 if (est.lookup == best.lookup &&
2877 est.space < best.space)
2878 break;
c50b960c
PM		 2879 continue;
2880 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2881 if (!desc->size) {
2882 if (est.space < best.space)
2883 break;
2884 if (est.space == best.space &&
2885 est.lookup < best.lookup)
2886 break;
4f2921ca 2887 } else if (est.size < best.size || !bops) {
c50b960c 2888 break;
0b5a7874 2889 }
c50b960c
PM		 2890 continue;
2891 default:
2892 break;
2893 }
2894
2b664957 2895 if (!try_module_get(type->owner))
20a69341 2896 continue;
c50b960c 2897 if (bops != NULL)
71cc0873 2898 module_put(to_set_type(bops)->owner);
c50b960c
PM		 2899
2900 bops = ops;
2901 best = est;
20a69341
PM		 2902 }
2903
c50b960c
PM		 2904 if (bops != NULL)
2905 return bops;
2906
20a69341
PM		 2907 return ERR_PTR(-EOPNOTSUPP);
2908}
2909
2910static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2911 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2912 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2913 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2914 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2915 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2916 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2917 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2918 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2919 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2920 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2921 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2922 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2923 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2924 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2925 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2926 .len = NFT_USERDATA_MAXLEN },
8aeff920 2927 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 2928 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 2929};
2930
2931static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2932 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2933};
2934
633c9a84 2935static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2936 const struct sk_buff *skb,
2937 const struct nlmsghdr *nlh,
f2a6d766 2938 const struct nlattr * const nla[],
36dd1bcc 2939 struct netlink_ext_ack *extack,
f2a6d766 2940 u8 genmask)
20a69341
PM		 2941{
2942 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 2943 int family = nfmsg->nfgen_family;
7c95f6d8 2944 struct nft_table *table = NULL;
20a69341 2945
20a69341 2946 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 2947 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
2948 genmask);
36dd1bcc
PNA		 2949 if (IS_ERR(table)) {
2950 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 2951 return PTR_ERR(table);
36dd1bcc 2952 }
20a69341
PM		 2953 }
2954
98319cb9 2955 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 2956 return 0;
2957}
2958
cac20fcd
PNA		 2959static struct nft_set *nft_set_lookup(const struct nft_table *table,
2960 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2961{
2962 struct nft_set *set;
2963
2964 if (nla == NULL)
2965 return ERR_PTR(-EINVAL);
2966
d9adf22a 2967 list_for_each_entry_rcu(set, &table->sets, list) {
37a9cc52
PNA		 2968 if (!nla_strcmp(nla, set->name) &&
2969 nft_active_genmask(set, genmask))
20a69341
PM		 2970 return set;
2971 }
2972 return ERR_PTR(-ENOENT);
2973}
2974
cac20fcd
PNA		 2975static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
2976 const struct nlattr *nla,
2977 u8 genmask)
3ecbfd65
HS		 2978{
2979 struct nft_set *set;
2980
3ecbfd65
HS		 2981 list_for_each_entry(set, &table->sets, list) {
2982 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2983 nft_active_genmask(set, genmask))
2984 return set;
2985 }
2986 return ERR_PTR(-ENOENT);
2987}
2988
cac20fcd
PNA		 2989static struct nft_set *nft_set_lookup_byid(const struct net *net,
2990 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 2991{
2992 struct nft_trans *trans;
2993 u32 id = ntohl(nla_get_be32(nla));
2994
2995 list_for_each_entry(trans, &net->nft.commit_list, list) {
9c7f96fd
AK		 2996 if (trans->msg_type == NFT_MSG_NEWSET) {
2997 struct nft_set *set = nft_trans_set(trans);
37a9cc52 2998
9c7f96fd
AK		 2999 if (id == nft_trans_set_id(trans) &&
3000 nft_active_genmask(set, genmask))
3001 return set;
3002 }
958bee14
PNA		 3003 }
3004 return ERR_PTR(-ENOENT);
3005}
c7a72e3f 3006
10659cba
PNA		 3007struct nft_set *nft_set_lookup_global(const struct net *net,
3008 const struct nft_table *table,
3009 const struct nlattr *nla_set_name,
3010 const struct nlattr *nla_set_id,
3011 u8 genmask)
c7a72e3f
PNA		 3012{
3013 struct nft_set *set;
3014
cac20fcd 3015 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 3016 if (IS_ERR(set)) {
3017 if (!nla_set_id)
3018 return set;
3019
cac20fcd 3020 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 3021 }
3022 return set;
3023}
10659cba 3024EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 3025
20a69341
PM		 3026static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3027 const char *name)
3028{
3029 const struct nft_set *i;
3030 const char *p;
3031 unsigned long *inuse;
60eb1894 3032 unsigned int n = 0, min = 0;
20a69341 3033
38745490 3034 p = strchr(name, '%');
20a69341
PM		 3035 if (p != NULL) {
3036 if (p[1] != 'd' || strchr(p + 2, '%'))
3037 return -EINVAL;
3038
3039 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3040 if (inuse == NULL)
3041 return -ENOMEM;
60eb1894 3042cont:
20a69341 3043 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 3044 int tmp;
3045
37a9cc52
PNA		 3046 if (!nft_is_active_next(ctx->net, set))
3047 continue;
14662917 3048 if (!sscanf(i->name, name, &tmp))
20a69341 3049 continue;
60eb1894 3050 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 3051 continue;
14662917 3052
60eb1894 3053 set_bit(tmp - min, inuse);
20a69341
PM		 3054 }
3055
53b70287 3056 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 3057 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3058 min += BITS_PER_BYTE * PAGE_SIZE;
3059 memset(inuse, 0, PAGE_SIZE);
3060 goto cont;
3061 }
20a69341
PM		 3062 free_page((unsigned long)inuse);
3063 }
3064
38745490
PS		 3065 set->name = kasprintf(GFP_KERNEL, name, min + n);
3066 if (!set->name)
3067 return -ENOMEM;
3068
20a69341 3069 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 3070 if (!nft_is_active_next(ctx->net, i))
3071 continue;
e63aaaa6
AY		 3072 if (!strcmp(set->name, i->name)) {
3073 kfree(set->name);
20a69341 3074 return -ENFILE;
e63aaaa6 3075 }
20a69341
PM		 3076 }
3077 return 0;
3078}
3079
8e1102d5
FW		 3080static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3081{
3082 u64 ms = be64_to_cpu(nla_get_be64(nla));
3083 u64 max = (u64)(~((u64)0));
3084
3085 max = div_u64(max, NSEC_PER_MSEC);
3086 if (ms >= max)
3087 return -ERANGE;
3088
3089 ms *= NSEC_PER_MSEC;
3090 *result = nsecs_to_jiffies64(ms);
3091 return 0;
3092}
3093
d6501de8 3094static __be64 nf_jiffies64_to_msecs(u64 input)
8e1102d5
FW		 3095{
3096 u64 ms = jiffies64_to_nsecs(input);
3097
3098 return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
3099}
3100
20a69341
PM		 3101static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3102 const struct nft_set *set, u16 event, u16 flags)
3103{
3104 struct nfgenmsg *nfmsg;
3105 struct nlmsghdr *nlh;
c50b960c 3106 struct nlattr *desc;
128ad332
PNA		 3107 u32 portid = ctx->portid;
3108 u32 seq = ctx->seq;
20a69341 3109
dedb67c4 3110 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 3111 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3112 flags);
3113 if (nlh == NULL)
3114 goto nla_put_failure;
3115
3116 nfmsg = nlmsg_data(nlh);
36596dad 3117 nfmsg->nfgen_family = ctx->family;
20a69341 3118 nfmsg->version = NFNETLINK_V0;
84d7fce6 3119 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 3120
3121 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3122 goto nla_put_failure;
3123 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3124 goto nla_put_failure;
3ecbfd65
HS		 3125 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3126 NFTA_SET_PAD))
3127 goto nla_put_failure;
20a69341
PM		 3128 if (set->flags != 0)
3129 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3130 goto nla_put_failure;
3131
3132 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3133 goto nla_put_failure;
3134 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3135 goto nla_put_failure;
3136 if (set->flags & NFT_SET_MAP) {
3137 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3138 goto nla_put_failure;
3139 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3140 goto nla_put_failure;
3141 }
8aeff920
PNA		 3142 if (set->flags & NFT_SET_OBJECT &&
3143 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3144 goto nla_put_failure;
20a69341 3145
761da293 3146 if (set->timeout &&
d3e2a111 3147 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 3148 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 3149 NFTA_SET_PAD))
761da293
PM		 3150 goto nla_put_failure;
3151 if (set->gc_int &&
3152 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3153 goto nla_put_failure;
3154
9363dc4b
AB		 3155 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3156 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3157 goto nla_put_failure;
3158 }
3159
e6d8ecac
CFG		 3160 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3161 goto nla_put_failure;
3162
c50b960c
PM		 3163 desc = nla_nest_start(skb, NFTA_SET_DESC);
3164 if (desc == NULL)
3165 goto nla_put_failure;
3166 if (set->size &&
3167 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3168 goto nla_put_failure;
3169 nla_nest_end(skb, desc);
3170
053c095a
JB		 3171 nlmsg_end(skb, nlh);
3172 return 0;
20a69341
PM		 3173
3174nla_put_failure:
3175 nlmsg_trim(skb, nlh);
3176 return -1;
3177}
3178
25e94a99
PNA		 3179static void nf_tables_set_notify(const struct nft_ctx *ctx,
3180 const struct nft_set *set, int event,
3181 gfp_t gfp_flags)
20a69341
PM		 3182{
3183 struct sk_buff *skb;
128ad332 3184 u32 portid = ctx->portid;
20a69341
PM		 3185 int err;
3186
128ad332
PNA		 3187 if (!ctx->report &&
3188 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 3189 return;
20a69341 3190
31f8441c 3191 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 3192 if (skb == NULL)
3193 goto err;
3194
3195 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3196 if (err < 0) {
3197 kfree_skb(skb);
3198 goto err;
3199 }
3200
25e94a99
PNA		 3201 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3202 gfp_flags);
3203 return;
20a69341 3204err:
25e94a99 3205 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 3206}
3207
5b96af77 3208static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 3209{
3210 const struct nft_set *set;
3211 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 3212 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3213 struct net *net = sock_net(skb->sk);
5b96af77 3214 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 3215
3216 if (cb->args[1])
3217 return skb->len;
3218
e688a7f8 3219 rcu_read_lock();
38e029f1
PNA		 3220 cb->seq = net->nft.base_seq;
3221
36596dad
PNA		 3222 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3223 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 3224 ctx->family != table->family)
36596dad
PNA		 3225 continue;
3226
3227 if (ctx->table && ctx->table != table)
5b96af77
PNA		 3228 continue;
3229
36596dad
PNA		 3230 if (cur_table) {
3231 if (cur_table != table)
c9c8e485
PNA		 3232 continue;
3233
36596dad 3234 cur_table = NULL;
c9c8e485 3235 }
36596dad
PNA		 3236 idx = 0;
3237 list_for_each_entry_rcu(set, &table->sets, list) {
3238 if (idx < s_idx)
3239 goto cont;
3240 if (!nft_is_active(net, set))
3241 goto cont;
5b96af77 3242
36596dad
PNA		 3243 ctx_set = *ctx;
3244 ctx_set.table = table;
98319cb9 3245 ctx_set.family = table->family;
c9c8e485 3246
36596dad
PNA		 3247 if (nf_tables_fill_set(skb, &ctx_set, set,
3248 NFT_MSG_NEWSET,
3249 NLM_F_MULTI) < 0) {
3250 cb->args[0] = idx;
3251 cb->args[2] = (unsigned long) table;
3252 goto done;
c9c8e485 3253 }
36596dad 3254 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 3255cont:
36596dad 3256 idx++;
c9c8e485 3257 }
36596dad
PNA		 3258 if (s_idx)
3259 s_idx = 0;
c9c8e485
PNA		 3260 }
3261 cb->args[1] = 1;
3262done:
e688a7f8 3263 rcu_read_unlock();
c9c8e485
PNA		 3264 return skb->len;
3265}
3266
90fd131a
FW		 3267static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3268{
3269 struct nft_ctx *ctx_dump = NULL;
3270
3271 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3272 if (ctx_dump == NULL)
3273 return -ENOMEM;
3274
3275 cb->data = ctx_dump;
3276 return 0;
3277}
3278
5b96af77 3279static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 3280{
5b96af77
PNA		 3281 kfree(cb->data);
3282 return 0;
20a69341
PM		 3283}
3284
d9adf22a 3285/* called with rcu_read_lock held */
7b8002a1
PNA		 3286static int nf_tables_getset(struct net *net, struct sock *nlsk,
3287 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3288 const struct nlattr * const nla[],
3289 struct netlink_ext_ack *extack)
20a69341 3290{
f2a6d766 3291 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3292 const struct nft_set *set;
3293 struct nft_ctx ctx;
3294 struct sk_buff *skb2;
c9c8e485 3295 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 3296 int err;
3297
01cfa0a4 3298 /* Verify existence before starting dump */
36dd1bcc
PNA		 3299 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3300 genmask);
20a69341
PM		 3301 if (err < 0)
3302 return err;
3303
3304 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3305 struct netlink_dump_control c = {
90fd131a 3306 .start = nf_tables_dump_sets_start,
20a69341 3307 .dump = nf_tables_dump_sets,
5b96af77 3308 .done = nf_tables_dump_sets_done,
90fd131a 3309 .data = &ctx,
d9adf22a 3310 .module = THIS_MODULE,
20a69341 3311 };
5b96af77 3312
d9adf22a 3313 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
20a69341
PM		 3314 }
3315
c9c8e485
PNA		 3316 /* Only accept unspec with dump */
3317 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3318 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3319 if (!nla[NFTA_SET_TABLE])
3320 return -EINVAL;
c9c8e485 3321
cac20fcd 3322 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3323 if (IS_ERR(set))
3324 return PTR_ERR(set);
3325
d9adf22a 3326 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
20a69341
PM		 3327 if (skb2 == NULL)
3328 return -ENOMEM;
3329
3330 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3331 if (err < 0)
3332 goto err;
3333
3334 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3335
3336err:
3337 kfree_skb(skb2);
3338 return err;
3339}
3340
c50b960c
PM		 3341static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3342 struct nft_set_desc *desc,
3343 const struct nlattr *nla)
3344{
3345 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3346 int err;
3347
fceb6435
JB		 3348 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3349 nft_set_desc_policy, NULL);
c50b960c
PM		 3350 if (err < 0)
3351 return err;
3352
3353 if (da[NFTA_SET_DESC_SIZE] != NULL)
3354 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3355
3356 return 0;
3357}
3358
633c9a84
PNA		 3359static int nf_tables_newset(struct net *net, struct sock *nlsk,
3360 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3361 const struct nlattr * const nla[],
3362 struct netlink_ext_ack *extack)
20a69341
PM		 3363{
3364 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3365 u8 genmask = nft_genmask_next(net);
98319cb9 3366 int family = nfmsg->nfgen_family;
20a69341 3367 const struct nft_set_ops *ops;
20a69341
PM		 3368 struct nft_table *table;
3369 struct nft_set *set;
3370 struct nft_ctx ctx;
38745490 3371 char *name;
4ef360dd 3372 u64 size;
761da293 3373 u64 timeout;
8aeff920 3374 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3375 struct nft_set_desc desc;
e6d8ecac
CFG		 3376 unsigned char *udata;
3377 u16 udlen;
20a69341
PM		 3378 int err;
3379
3380 if (nla[NFTA_SET_TABLE] == NULL ||
3381 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3382 nla[NFTA_SET_KEY_LEN] == NULL ||
3383 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3384 return -EINVAL;
3385
c50b960c
PM		 3386 memset(&desc, 0, sizeof(desc));
3387
20a69341
PM		 3388 ktype = NFT_DATA_VALUE;
3389 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3390 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3391 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3392 return -EINVAL;
3393 }
3394
c50b960c 3395 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3396 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3397 return -EINVAL;
3398
3399 flags = 0;
3400 if (nla[NFTA_SET_FLAGS] != NULL) {
3401 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3402 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3403 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3404 NFT_SET_MAP | NFT_SET_EVAL |
3405 NFT_SET_OBJECT))
20a69341 3406 return -EINVAL;
8aeff920
PNA		 3407 /* Only one of these operations is supported */
3408 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3409 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3410 return -EOPNOTSUPP;
20a69341
PM		 3411 }
3412
3413 dtype = 0;
20a69341
PM		 3414 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3415 if (!(flags & NFT_SET_MAP))
3416 return -EINVAL;
3417
3418 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3419 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3420 dtype != NFT_DATA_VERDICT)
3421 return -EINVAL;
3422
3423 if (dtype != NFT_DATA_VERDICT) {
3424 if (nla[NFTA_SET_DATA_LEN] == NULL)
3425 return -EINVAL;
c50b960c 3426 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3427 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3428 return -EINVAL;
3429 } else
7d740264 3430 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3431 } else if (flags & NFT_SET_MAP)
3432 return -EINVAL;
3433
8aeff920
PNA		 3434 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3435 if (!(flags & NFT_SET_OBJECT))
3436 return -EINVAL;
3437
3438 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3439 if (objtype == NFT_OBJECT_UNSPEC ||
3440 objtype > NFT_OBJECT_MAX)
3441 return -EINVAL;
3442 } else if (flags & NFT_SET_OBJECT)
3443 return -EINVAL;
3444 else
3445 objtype = NFT_OBJECT_UNSPEC;
3446
761da293
PM		 3447 timeout = 0;
3448 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3449 if (!(flags & NFT_SET_TIMEOUT))
3450 return -EINVAL;
8e1102d5
FW		 3451
3452 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3453 if (err)
3454 return err;
761da293
PM		 3455 }
3456 gc_int = 0;
3457 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3458 if (!(flags & NFT_SET_TIMEOUT))
3459 return -EINVAL;
3460 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3461 }
3462
c50b960c
PM		 3463 policy = NFT_SET_POL_PERFORMANCE;
3464 if (nla[NFTA_SET_POLICY] != NULL)
3465 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3466
3467 if (nla[NFTA_SET_DESC] != NULL) {
3468 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3469 if (err < 0)
3470 return err;
3471 }
3472
cac20fcd 3473 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 3474 if (IS_ERR(table)) {
3475 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3476 return PTR_ERR(table);
36dd1bcc 3477 }
20a69341 3478
98319cb9 3479 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3480
cac20fcd 3481 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 3482 if (IS_ERR(set)) {
36dd1bcc
PNA		 3483 if (PTR_ERR(set) != -ENOENT) {
3484 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3485 return PTR_ERR(set);
36dd1bcc 3486 }
1a28ad74 3487 } else {
36dd1bcc
PNA		 3488 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3489 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3490 return -EEXIST;
36dd1bcc 3491 }
20a69341
PM		 3492 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3493 return -EOPNOTSUPP;
36dd1bcc 3494
20a69341
PM		 3495 return 0;
3496 }
3497
3498 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3499 return -ENOENT;
3500
2b664957 3501 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3502 if (IS_ERR(ops))
3503 return PTR_ERR(ops);
3504
e6d8ecac
CFG		 3505 udlen = 0;
3506 if (nla[NFTA_SET_USERDATA])
3507 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3508
20a69341
PM		 3509 size = 0;
3510 if (ops->privsize != NULL)
347b408d 3511 size = ops->privsize(nla, &desc);
20a69341 3512
1ff75a3e
PNA		 3513 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3514 if (!set) {
3515 err = -ENOMEM;
20a69341 3516 goto err1;
1ff75a3e 3517 }
20a69341 3518
38745490
PS		 3519 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3520 if (!name) {
3521 err = -ENOMEM;
3522 goto err2;
3523 }
3524
20a69341 3525 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3526 kfree(name);
20a69341
PM		 3527 if (err < 0)
3528 goto err2;
3529
e6d8ecac
CFG		 3530 udata = NULL;
3531 if (udlen) {
3532 udata = set->data + size;
3533 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3534 }
3535
20a69341 3536 INIT_LIST_HEAD(&set->bindings);
3453c927
PNA		 3537 set->table = table;
3538 write_pnet(&set->net, net);
20a69341
PM		 3539 set->ops = ops;
3540 set->ktype = ktype;
c50b960c 3541 set->klen = desc.klen;
20a69341 3542 set->dtype = dtype;
8aeff920 3543 set->objtype = objtype;
c50b960c 3544 set->dlen = desc.dlen;
20a69341 3545 set->flags = flags;
c50b960c 3546 set->size = desc.size;
9363dc4b 3547 set->policy = policy;
e6d8ecac
CFG		 3548 set->udlen = udlen;
3549 set->udata = udata;
761da293
PM		 3550 set->timeout = timeout;
3551 set->gc_int = gc_int;
3ecbfd65 3552 set->handle = nf_tables_alloc_handle(table);
20a69341 3553
c50b960c 3554 err = ops->init(set, &desc, nla);
20a69341 3555 if (err < 0)
2f6adf48 3556 goto err3;
20a69341 3557
958bee14 3558 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3559 if (err < 0)
2f6adf48 3560 goto err4;
20a69341 3561
e688a7f8 3562 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3563 table->use++;
20a69341
PM		 3564 return 0;
3565
2f6adf48 3566err4:
c17c3cdf 3567 ops->destroy(set);
2f6adf48
FW		 3568err3:
3569 kfree(set->name);
20a69341 3570err2:
1ff75a3e 3571 kvfree(set);
20a69341 3572err1:
71cc0873 3573 module_put(to_set_type(ops)->owner);
20a69341
PM		 3574 return err;
3575}
3576
958bee14 3577static void nft_set_destroy(struct nft_set *set)
20a69341 3578{
20a69341 3579 set->ops->destroy(set);
71cc0873 3580 module_put(to_set_type(set->ops)->owner);
38745490 3581 kfree(set->name);
1ff75a3e 3582 kvfree(set);
20a69341
PM		 3583}
3584
633c9a84
PNA		 3585static int nf_tables_delset(struct net *net, struct sock *nlsk,
3586 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3587 const struct nlattr * const nla[],
3588 struct netlink_ext_ack *extack)
20a69341 3589{
c9c8e485 3590 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3591 u8 genmask = nft_genmask_next(net);
36dd1bcc 3592 const struct nlattr *attr;
20a69341
PM		 3593 struct nft_set *set;
3594 struct nft_ctx ctx;
3595 int err;
3596
ec2c9935
PM		 3597 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3598 return -EAFNOSUPPORT;
20a69341
PM		 3599 if (nla[NFTA_SET_TABLE] == NULL)
3600 return -EINVAL;
3601
36dd1bcc
PNA		 3602 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3603 genmask);
20a69341
PM		 3604 if (err < 0)
3605 return err;
3606
36dd1bcc
PNA		 3607 if (nla[NFTA_SET_HANDLE]) {
3608 attr = nla[NFTA_SET_HANDLE];
3609 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3610 } else {
3611 attr = nla[NFTA_SET_NAME];
3612 set = nft_set_lookup(ctx.table, attr, genmask);
3613 }
a8278400 3614
36dd1bcc
PNA		 3615 if (IS_ERR(set)) {
3616 NL_SET_BAD_ATTR(extack, attr);
3617 return PTR_ERR(set);
3618 }
a8278400 3619 if (!list_empty(&set->bindings) ||
36dd1bcc
PNA		 3620 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3621 NL_SET_BAD_ATTR(extack, attr);
20a69341 3622 return -EBUSY;
36dd1bcc 3623 }
20a69341 3624
ee01d542 3625 return nft_delset(&ctx, set);
20a69341
PM		 3626}
3627
3628static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3629 struct nft_set *set,
20a69341 3630 const struct nft_set_iter *iter,
de70185d 3631 struct nft_set_elem *elem)
20a69341 3632{
fe2811eb 3633 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3634 enum nft_registers dreg;
3635
3636 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3637 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3638 set->dtype == NFT_DATA_VERDICT ?
3639 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3640 set->dlen);
20a69341
PM		 3641}
3642
3643int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3644 struct nft_set_binding *binding)
3645{
3646 struct nft_set_binding *i;
3647 struct nft_set_iter iter;
3648
408070d6 3649 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3650 return -EBUSY;
3651
11113e19 3652 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3653 /* If the set is already bound to the same chain all
3654 * jumps are already validated for that chain.
3655 */
3656 list_for_each_entry(i, &set->bindings, list) {
a4684402 3657 if (i->flags & NFT_SET_MAP &&
11113e19 3658 i->chain == binding->chain)
20a69341
PM		 3659 goto bind;
3660 }
3661
8588ac09 3662 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3663 iter.skip = 0;
3664 iter.count = 0;
3665 iter.err = 0;
3666 iter.fn = nf_tables_bind_check_setelem;
3667
3668 set->ops->walk(ctx, set, &iter);
a02f4248 3669 if (iter.err < 0)
20a69341 3670 return iter.err;
20a69341
PM		 3671 }
3672bind:
3673 binding->chain = ctx->chain;
e688a7f8 3674 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3675 return 0;
3676}
63aea290 3677EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341 3678
cd5125d8 3679void nf_tables_rebind_set(const struct nft_ctx *ctx, struct nft_set *set,
20a69341 3680 struct nft_set_binding *binding)
cd5125d8
FW		 3681{
3682 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
3683 nft_is_active(ctx->net, set))
3684 list_add_tail_rcu(&set->list, &ctx->table->sets);
3685
3686 list_add_tail_rcu(&binding->list, &set->bindings);
3687}
3688EXPORT_SYMBOL_GPL(nf_tables_rebind_set);
3689
3690void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3691 struct nft_set_binding *binding)
20a69341 3692{
e688a7f8 3693 list_del_rcu(&binding->list);
20a69341 3694
408070d6 3695 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
37a9cc52 3696 nft_is_active(ctx->net, set))
cd5125d8 3697 list_del_rcu(&set->list);
20a69341 3698}
63aea290 3699EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3700
cd5125d8
FW		 3701void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
3702{
3703 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
3704 nft_is_active(ctx->net, set)) {
3705 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
3706 nft_set_destroy(set);
3707 }
3708}
3709EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
3710
3ac4c07a
PM		 3711const struct nft_set_ext_type nft_set_ext_types[] = {
3712 [NFT_SET_EXT_KEY] = {
7d740264 3713 .align = __alignof__(u32),
3ac4c07a
PM		 3714 },
3715 [NFT_SET_EXT_DATA] = {
7d740264 3716 .align = __alignof__(u32),
3ac4c07a 3717 },
f25ad2e9
PM		 3718 [NFT_SET_EXT_EXPR] = {
3719 .align = __alignof__(struct nft_expr),
3720 },
8aeff920
PNA		 3721 [NFT_SET_EXT_OBJREF] = {
3722 .len = sizeof(struct nft_object *),
3723 .align = __alignof__(struct nft_object *),
3724 },
3ac4c07a
PM		 3725 [NFT_SET_EXT_FLAGS] = {
3726 .len = sizeof(u8),
3727 .align = __alignof__(u8),
3728 },
c3e1b005
PM		 3729 [NFT_SET_EXT_TIMEOUT] = {
3730 .len = sizeof(u64),
3731 .align = __alignof__(u64),
3732 },
3733 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 3734 .len = sizeof(u64),
3735 .align = __alignof__(u64),
c3e1b005 3736 },
68e942e8
PM		 3737 [NFT_SET_EXT_USERDATA] = {
3738 .len = sizeof(struct nft_userdata),
3739 .align = __alignof__(struct nft_userdata),
3740 },
3ac4c07a
PM		 3741};
3742EXPORT_SYMBOL_GPL(nft_set_ext_types);
3743
20a69341
PM		 3744/*
3745 * Set elements
3746 */
3747
3748static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3749 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3750 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3751 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3752 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3753 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3754 .len = NFT_USERDATA_MAXLEN },
467697d2
FW		 3755 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3756 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
20a69341
PM		 3757};
3758
3759static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3760 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3761 .len = NFT_TABLE_MAXNAMELEN - 1 },
3762 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3763 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3764 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3765 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3766};
3767
633c9a84 3768static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3769 const struct sk_buff *skb,
3770 const struct nlmsghdr *nlh,
f2a6d766 3771 const struct nlattr * const nla[],
36dd1bcc 3772 struct netlink_ext_ack *extack,
f2a6d766 3773 u8 genmask)
20a69341
PM		 3774{
3775 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3776 int family = nfmsg->nfgen_family;
7c95f6d8 3777 struct nft_table *table;
20a69341 3778
cac20fcd
PNA		 3779 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3780 genmask);
36dd1bcc
PNA		 3781 if (IS_ERR(table)) {
3782 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 3783 return PTR_ERR(table);
36dd1bcc 3784 }
20a69341 3785
98319cb9 3786 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3787 return 0;
3788}
3789
3790static int nf_tables_fill_setelem(struct sk_buff *skb,
3791 const struct nft_set *set,
3792 const struct nft_set_elem *elem)
3793{
fe2811eb 3794 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3795 unsigned char *b = skb_tail_pointer(skb);
3796 struct nlattr *nest;
3797
3798 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3799 if (nest == NULL)
3800 goto nla_put_failure;
3801
fe2811eb
PM		 3802 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3803 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3804 goto nla_put_failure;
3805
fe2811eb
PM		 3806 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3807 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3808 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3809 set->dlen) < 0)
3810 goto nla_put_failure;
3811
f25ad2e9
PM		 3812 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3813 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3814 goto nla_put_failure;
3815
8aeff920
PNA		 3816 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3817 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3818 (*nft_set_ext_obj(ext))->name) < 0)
3819 goto nla_put_failure;
3820
fe2811eb
PM		 3821 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3822 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3823 htonl(*nft_set_ext_flags(ext))))
3824 goto nla_put_failure;
20a69341 3825
c3e1b005
PM		 3826 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3827 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 3828 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 3829 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3830 goto nla_put_failure;
3831
3832 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 3833 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 3834
3835 expires = *nft_set_ext_expiration(ext);
8e1102d5 3836 if (time_before64(now, expires))
c3e1b005
PM		 3837 expires -= now;
3838 else
3839 expires = 0;
3840
3841 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 3842 nf_jiffies64_to_msecs(expires),
b46f6ded 3843 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3844 goto nla_put_failure;
3845 }
3846
68e942e8
PM		 3847 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3848 struct nft_userdata *udata;
3849
3850 udata = nft_set_ext_userdata(ext);
3851 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3852 udata->len + 1, udata->data))
3853 goto nla_put_failure;
3854 }
3855
20a69341
PM		 3856 nla_nest_end(skb, nest);
3857 return 0;
3858
3859nla_put_failure:
3860 nlmsg_trim(skb, b);
3861 return -EMSGSIZE;
3862}
3863
3864struct nft_set_dump_args {
3865 const struct netlink_callback *cb;
3866 struct nft_set_iter iter;
3867 struct sk_buff *skb;
3868};
3869
3870static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3871 struct nft_set *set,
20a69341 3872 const struct nft_set_iter *iter,
de70185d 3873 struct nft_set_elem *elem)
20a69341
PM		 3874{
3875 struct nft_set_dump_args *args;
3876
3877 args = container_of(iter, struct nft_set_dump_args, iter);
3878 return nf_tables_fill_setelem(args->skb, set, elem);
3879}
3880
fa803605
LZ		 3881struct nft_set_dump_ctx {
3882 const struct nft_set *set;
3883 struct nft_ctx ctx;
3884};
3885
20a69341
PM		 3886static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3887{
fa803605 3888 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3889 struct net *net = sock_net(skb->sk);
fa803605 3890 struct nft_table *table;
de70185d 3891 struct nft_set *set;
20a69341 3892 struct nft_set_dump_args args;
fa803605 3893 bool set_found = false;
20a69341
PM		 3894 struct nfgenmsg *nfmsg;
3895 struct nlmsghdr *nlh;
3896 struct nlattr *nest;
3897 u32 portid, seq;
fa803605 3898 int event;
20a69341 3899
fa803605 3900 rcu_read_lock();
36596dad
PNA		 3901 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3902 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 3903 dump_ctx->ctx.family != table->family)
fa803605 3904 continue;
20a69341 3905
36596dad
PNA		 3906 if (table != dump_ctx->ctx.table)
3907 continue;
20a69341 3908
36596dad
PNA		 3909 list_for_each_entry_rcu(set, &table->sets, list) {
3910 if (set == dump_ctx->set) {
3911 set_found = true;
3912 break;
fa803605 3913 }
fa803605
LZ		 3914 }
3915 break;
3916 }
3917
3918 if (!set_found) {
3919 rcu_read_unlock();
3920 return -ENOENT;
3921 }
20a69341 3922
dedb67c4 3923 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3924 portid = NETLINK_CB(cb->skb).portid;
3925 seq = cb->nlh->nlmsg_seq;
3926
3927 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3928 NLM_F_MULTI);
3929 if (nlh == NULL)
3930 goto nla_put_failure;
3931
3932 nfmsg = nlmsg_data(nlh);
98319cb9 3933 nfmsg->nfgen_family = table->family;
20a69341 3934 nfmsg->version = NFNETLINK_V0;
fa803605 3935 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3936
fa803605 3937 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3938 goto nla_put_failure;
3939 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3940 goto nla_put_failure;
3941
3942 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3943 if (nest == NULL)
3944 goto nla_put_failure;
3945
8588ac09
PNA		 3946 args.cb = cb;
3947 args.skb = skb;
fa803605 3948 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3949 args.iter.skip = cb->args[0];
3950 args.iter.count = 0;
3951 args.iter.err = 0;
3952 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3953 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3954 rcu_read_unlock();
20a69341
PM		 3955
3956 nla_nest_end(skb, nest);
3957 nlmsg_end(skb, nlh);
3958
3959 if (args.iter.err && args.iter.err != -EMSGSIZE)
3960 return args.iter.err;
3961 if (args.iter.count == cb->args[0])
3962 return 0;
3963
3964 cb->args[0] = args.iter.count;
3965 return skb->len;
3966
3967nla_put_failure:
fa803605 3968 rcu_read_unlock();
20a69341
PM		 3969 return -ENOSPC;
3970}
3971
90fd131a
FW		 3972static int nf_tables_dump_set_start(struct netlink_callback *cb)
3973{
3974 struct nft_set_dump_ctx *dump_ctx = cb->data;
3975
3976 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
3977
3978 return cb->data ? 0 : -ENOMEM;
3979}
3980
fa803605
LZ		 3981static int nf_tables_dump_set_done(struct netlink_callback *cb)
3982{
3983 kfree(cb->data);
3984 return 0;
3985}
3986
d60ce62f
AB		 3987static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3988 const struct nft_ctx *ctx, u32 seq,
3989 u32 portid, int event, u16 flags,
3990 const struct nft_set *set,
3991 const struct nft_set_elem *elem)
3992{
3993 struct nfgenmsg *nfmsg;
3994 struct nlmsghdr *nlh;
3995 struct nlattr *nest;
3996 int err;
3997
dedb67c4 3998 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 3999 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4000 flags);
4001 if (nlh == NULL)
4002 goto nla_put_failure;
4003
4004 nfmsg = nlmsg_data(nlh);
36596dad 4005 nfmsg->nfgen_family = ctx->family;
d60ce62f 4006 nfmsg->version = NFNETLINK_V0;
84d7fce6 4007 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 4008
4009 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4010 goto nla_put_failure;
4011 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4012 goto nla_put_failure;
4013
4014 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4015 if (nest == NULL)
4016 goto nla_put_failure;
4017
4018 err = nf_tables_fill_setelem(skb, set, elem);
4019 if (err < 0)
4020 goto nla_put_failure;
4021
4022 nla_nest_end(skb, nest);
4023
053c095a
JB		 4024 nlmsg_end(skb, nlh);
4025 return 0;
d60ce62f
AB		 4026
4027nla_put_failure:
4028 nlmsg_trim(skb, nlh);
4029 return -1;
4030}
4031
ba0e4d99
PNA		 4032static int nft_setelem_parse_flags(const struct nft_set *set,
4033 const struct nlattr *attr, u32 *flags)
4034{
4035 if (attr == NULL)
4036 return 0;
4037
4038 *flags = ntohl(nla_get_be32(attr));
4039 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4040 return -EINVAL;
4041 if (!(set->flags & NFT_SET_INTERVAL) &&
4042 *flags & NFT_SET_ELEM_INTERVAL_END)
4043 return -EINVAL;
4044
4045 return 0;
4046}
4047
4048static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4049 const struct nlattr *attr)
4050{
4051 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
ba0e4d99
PNA		 4052 struct nft_data_desc desc;
4053 struct nft_set_elem elem;
4054 struct sk_buff *skb;
4055 uint32_t flags = 0;
4056 void *priv;
4057 int err;
4058
4059 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4060 nft_set_elem_policy, NULL);
4061 if (err < 0)
4062 return err;
4063
4064 if (!nla[NFTA_SET_ELEM_KEY])
4065 return -EINVAL;
4066
4067 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4068 if (err < 0)
4069 return err;
4070
4071 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4072 nla[NFTA_SET_ELEM_KEY]);
4073 if (err < 0)
4074 return err;
4075
4076 err = -EINVAL;
4077 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4078 return err;
4079
4080 priv = set->ops->get(ctx->net, set, &elem, flags);
4081 if (IS_ERR(priv))
4082 return PTR_ERR(priv);
4083
4084 elem.priv = priv;
ba0e4d99
PNA		 4085
4086 err = -ENOMEM;
d9adf22a 4087 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
ba0e4d99
PNA		 4088 if (skb == NULL)
4089 goto err1;
4090
4091 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4092 NFT_MSG_NEWSETELEM, 0, set, &elem);
4093 if (err < 0)
4094 goto err2;
4095
4096 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4097 /* This avoids a loop in nfnetlink. */
4098 if (err < 0)
4099 goto err1;
4100
4101 return 0;
4102err2:
4103 kfree_skb(skb);
4104err1:
4105 /* this avoids a loop in nfnetlink. */
4106 return err == -EAGAIN ? -ENOBUFS : err;
4107}
4108
d9adf22a 4109/* called with rcu_read_lock held */
ba0e4d99
PNA		 4110static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4111 struct sk_buff *skb, const struct nlmsghdr *nlh,
4112 const struct nlattr * const nla[],
4113 struct netlink_ext_ack *extack)
4114{
4115 u8 genmask = nft_genmask_cur(net);
4116 struct nft_set *set;
4117 struct nlattr *attr;
4118 struct nft_ctx ctx;
4119 int rem, err = 0;
4120
36dd1bcc
PNA		 4121 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4122 genmask);
ba0e4d99
PNA		 4123 if (err < 0)
4124 return err;
4125
cac20fcd 4126 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 4127 if (IS_ERR(set))
4128 return PTR_ERR(set);
4129
4130 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4131 struct netlink_dump_control c = {
90fd131a 4132 .start = nf_tables_dump_set_start,
ba0e4d99
PNA		 4133 .dump = nf_tables_dump_set,
4134 .done = nf_tables_dump_set_done,
d9adf22a 4135 .module = THIS_MODULE,
ba0e4d99 4136 };
90fd131a
FW		 4137 struct nft_set_dump_ctx dump_ctx = {
4138 .set = set,
4139 .ctx = ctx,
4140 };
ba0e4d99 4141
90fd131a 4142 c.data = &dump_ctx;
d9adf22a 4143 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
ba0e4d99
PNA		 4144 }
4145
4146 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4147 return -EINVAL;
4148
4149 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4150 err = nft_get_set_elem(&ctx, set, attr);
4151 if (err < 0)
4152 break;
4153 }
4154
4155 return err;
4156}
4157
25e94a99
PNA		 4158static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4159 const struct nft_set *set,
4160 const struct nft_set_elem *elem,
4161 int event, u16 flags)
d60ce62f 4162{
128ad332
PNA		 4163 struct net *net = ctx->net;
4164 u32 portid = ctx->portid;
d60ce62f
AB		 4165 struct sk_buff *skb;
4166 int err;
4167
128ad332 4168 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4169 return;
d60ce62f 4170
d60ce62f
AB		 4171 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4172 if (skb == NULL)
4173 goto err;
4174
4175 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4176 set, elem);
4177 if (err < 0) {
4178 kfree_skb(skb);
4179 goto err;
4180 }
4181
25e94a99
PNA		 4182 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4183 GFP_KERNEL);
4184 return;
d60ce62f 4185err:
25e94a99 4186 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 4187}
4188
60319eb1
PNA		 4189static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4190 int msg_type,
4191 struct nft_set *set)
4192{
4193 struct nft_trans *trans;
4194
4195 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4196 if (trans == NULL)
4197 return NULL;
4198
4199 nft_trans_elem_set(trans) = set;
4200 return trans;
4201}
4202
22fe54d5
PM		 4203void *nft_set_elem_init(const struct nft_set *set,
4204 const struct nft_set_ext_tmpl *tmpl,
49499c3e 4205 const u32 *key, const u32 *data,
22fe54d5 4206 u64 timeout, gfp_t gfp)
fe2811eb
PM		 4207{
4208 struct nft_set_ext *ext;
4209 void *elem;
4210
4211 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4212 if (elem == NULL)
4213 return NULL;
4214
4215 ext = nft_set_elem_ext(set, elem);
4216 nft_set_ext_init(ext, tmpl);
4217
4218 memcpy(nft_set_ext_key(ext), key, set->klen);
4219 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4220 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 4221 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
4222 *nft_set_ext_expiration(ext) =
8e1102d5 4223 get_jiffies_64() + timeout;
c3e1b005
PM		 4224 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4225 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 4226
4227 return elem;
4228}
4229
61f9e292
LZ		 4230void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4231 bool destroy_expr)
61edafbb
PM		 4232{
4233 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3453c927
PNA		 4234 struct nft_ctx ctx = {
4235 .net = read_pnet(&set->net),
4236 .family = set->table->family,
4237 };
61edafbb 4238
59105446 4239 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 4240 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 4241 nft_data_release(nft_set_ext_data(ext), set->dtype);
371ebcbb
PNA		 4242 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4243 struct nft_expr *expr = nft_set_ext_expr(ext);
4244
4245 if (expr->ops->destroy_clone) {
4246 expr->ops->destroy_clone(&ctx, expr);
4247 module_put(expr->ops->type->owner);
4248 } else {
4249 nf_tables_expr_destroy(&ctx, expr);
4250 }
4251 }
8aeff920
PNA		 4252 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4253 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 4254 kfree(elem);
4255}
4256EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4257
59105446
PNA		 4258/* Only called from commit path, nft_set_elem_deactivate() already deals with
4259 * the refcounting from the preparation phase.
4260 */
3453c927
PNA		 4261static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4262 const struct nft_set *set, void *elem)
59105446
PNA		 4263{
4264 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4265
4266 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3453c927 4267 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
59105446
PNA		 4268 kfree(elem);
4269}
4270
60319eb1 4271static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 4272 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 4273{
4274 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 4275 u8 genmask = nft_genmask_next(ctx->net);
20a69341 4276 struct nft_data_desc d1, d2;
fe2811eb 4277 struct nft_set_ext_tmpl tmpl;
c016c7e4 4278 struct nft_set_ext *ext, *ext2;
20a69341
PM		 4279 struct nft_set_elem elem;
4280 struct nft_set_binding *binding;
8aeff920 4281 struct nft_object *obj = NULL;
68e942e8 4282 struct nft_userdata *udata;
fe2811eb 4283 struct nft_data data;
20a69341 4284 enum nft_registers dreg;
60319eb1 4285 struct nft_trans *trans;
0e9091d6 4286 u32 flags = 0;
c3e1b005 4287 u64 timeout;
68e942e8 4288 u8 ulen;
20a69341
PM		 4289 int err;
4290
4291 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4292 nft_set_elem_policy, NULL);
20a69341
PM		 4293 if (err < 0)
4294 return err;
4295
4296 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4297 return -EINVAL;
4298
fe2811eb
PM		 4299 nft_set_ext_prepare(&tmpl);
4300
0e9091d6
PNA		 4301 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4302 if (err < 0)
4303 return err;
4304 if (flags != 0)
4305 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 4306
4307 if (set->flags & NFT_SET_MAP) {
4308 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 4309 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 4310 return -EINVAL;
bd7fc645 4311 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 4312 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 4313 return -EINVAL;
20a69341
PM		 4314 } else {
4315 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4316 return -EINVAL;
4317 }
4318
c3e1b005
PM		 4319 timeout = 0;
4320 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4321 if (!(set->flags & NFT_SET_TIMEOUT))
4322 return -EINVAL;
8e1102d5
FW		 4323 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4324 &timeout);
4325 if (err)
4326 return err;
c3e1b005
PM		 4327 } else if (set->flags & NFT_SET_TIMEOUT) {
4328 timeout = set->timeout;
4329 }
4330
7d740264 4331 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 4332 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4333 if (err < 0)
4334 goto err1;
4335 err = -EINVAL;
4336 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4337 goto err2;
4338
7d740264 4339 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 4340 if (timeout > 0) {
4341 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4342 if (timeout != set->timeout)
4343 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4344 }
fe2811eb 4345
8aeff920
PNA		 4346 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4347 if (!(set->flags & NFT_SET_OBJECT)) {
4348 err = -EINVAL;
4349 goto err2;
4350 }
cac20fcd
PNA		 4351 obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
4352 set->objtype, genmask);
8aeff920
PNA		 4353 if (IS_ERR(obj)) {
4354 err = PTR_ERR(obj);
4355 goto err2;
4356 }
4357 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4358 }
4359
20a69341 4360 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 4361 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4362 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 4363 if (err < 0)
4364 goto err2;
4365
4366 err = -EINVAL;
4367 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4368 goto err3;
4369
4370 dreg = nft_type_to_reg(set->dtype);
4371 list_for_each_entry(binding, &set->bindings, list) {
4372 struct nft_ctx bind_ctx = {
58c78e10 4373 .net = ctx->net,
36596dad 4374 .family = ctx->family,
20a69341 4375 .table = ctx->table,
7c95f6d8 4376 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4377 };
4378
11113e19
PM		 4379 if (!(binding->flags & NFT_SET_MAP))
4380 continue;
4381
1ec10212
PM		 4382 err = nft_validate_register_store(&bind_ctx, dreg,
4383 &data,
4384 d2.type, d2.len);
20a69341
PM		 4385 if (err < 0)
4386 goto err3;
a654de8f
PNA		 4387
4388 if (d2.type == NFT_DATA_VERDICT &&
4389 (data.verdict.code == NFT_GOTO ||
4390 data.verdict.code == NFT_JUMP))
4391 nft_validate_state_update(ctx->net,
4392 NFT_VALIDATE_NEED);
20a69341 4393 }
fe2811eb 4394
7d740264 4395 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4396 }
4397
68e942e8
PM		 4398 /* The full maximum length of userdata can exceed the maximum
4399 * offset value (U8_MAX) for following extensions, therefor it
4400 * must be the last extension added.
4401 */
4402 ulen = 0;
4403 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4404 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4405 if (ulen > 0)
4406 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4407 ulen);
4408 }
4409
fe2811eb 4410 err = -ENOMEM;
7d740264 4411 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 4412 timeout, GFP_KERNEL);
fe2811eb
PM		 4413 if (elem.priv == NULL)
4414 goto err3;
4415
4416 ext = nft_set_elem_ext(set, elem.priv);
4417 if (flags)
4418 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4419 if (ulen > 0) {
4420 udata = nft_set_ext_userdata(ext);
4421 udata->len = ulen - 1;
4422 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4423 }
8aeff920
PNA		 4424 if (obj) {
4425 *nft_set_ext_obj(ext) = obj;
4426 obj->use++;
4427 }
fe2811eb 4428
60319eb1
PNA		 4429 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4430 if (trans == NULL)
fe2811eb 4431 goto err4;
60319eb1 4432
69086658 4433 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4434 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4435 if (err) {
4436 if (err == -EEXIST) {
9744a6fc
PNA		 4437 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4438 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4439 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
f0dfd7a2
CIK		 4440 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4441 err = -EBUSY;
4442 goto err5;
4443 }
8aeff920
PNA		 4444 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4445 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4446 memcmp(nft_set_ext_data(ext),
4447 nft_set_ext_data(ext2), set->dlen) != 0) ||
4448 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4449 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4450 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4451 err = -EBUSY;
4452 else if (!(nlmsg_flags & NLM_F_EXCL))
4453 err = 0;
4454 }
fe2811eb 4455 goto err5;
c016c7e4 4456 }
20a69341 4457
35d0ac90
PNA		 4458 if (set->size &&
4459 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4460 err = -ENFILE;
4461 goto err6;
4462 }
4463
60319eb1 4464 nft_trans_elem(trans) = elem;
46bbafce 4465 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4466 return 0;
4467
35d0ac90 4468err6:
5cb82a38 4469 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4470err5:
60319eb1 4471 kfree(trans);
fe2811eb
PM		 4472err4:
4473 kfree(elem.priv);
20a69341
PM		 4474err3:
4475 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4476 nft_data_release(&data, d2.type);
20a69341 4477err2:
59105446 4478 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4479err1:
4480 return err;
4481}
4482
633c9a84
PNA		 4483static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4484 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4485 const struct nlattr * const nla[],
4486 struct netlink_ext_ack *extack)
20a69341 4487{
f2a6d766 4488 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4489 const struct nlattr *attr;
4490 struct nft_set *set;
4491 struct nft_ctx ctx;
a654de8f 4492 int rem, err;
20a69341 4493
7d5570ca
PNA		 4494 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4495 return -EINVAL;
4496
36dd1bcc
PNA		 4497 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4498 genmask);
20a69341
PM		 4499 if (err < 0)
4500 return err;
4501
a3073c17
PNA		 4502 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4503 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4504 if (IS_ERR(set))
4505 return PTR_ERR(set);
958bee14 4506
20a69341
PM		 4507 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4508 return -EBUSY;
4509
4510 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4511 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4512 if (err < 0)
a654de8f 4513 return err;
20a69341 4514 }
a654de8f
PNA		 4515
4516 if (net->nft.validate_state == NFT_VALIDATE_DO)
4517 return nft_table_validate(net, ctx.table);
4518
4519 return 0;
20a69341
PM		 4520}
4521
59105446
PNA		 4522/**
4523 * nft_data_hold - hold a nft_data item
4524 *
4525 * @data: struct nft_data to release
4526 * @type: type of data
4527 *
4528 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4529 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4530 * NFT_GOTO verdicts. This function must be called on active data objects
4531 * from the second phase of the commit protocol.
4532 */
bb7b40ae 4533void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
59105446
PNA		 4534{
4535 if (type == NFT_DATA_VERDICT) {
4536 switch (data->verdict.code) {
4537 case NFT_JUMP:
4538 case NFT_GOTO:
4539 data->verdict.chain->use++;
4540 break;
4541 }
4542 }
4543}
4544
4545static void nft_set_elem_activate(const struct net *net,
4546 const struct nft_set *set,
4547 struct nft_set_elem *elem)
4548{
4549 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4550
4551 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4552 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4553 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4554 (*nft_set_ext_obj(ext))->use++;
4555}
4556
4557static void nft_set_elem_deactivate(const struct net *net,
4558 const struct nft_set *set,
4559 struct nft_set_elem *elem)
4560{
4561 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4562
4563 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4564 nft_data_release(nft_set_ext_data(ext), set->dtype);
4565 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4566 (*nft_set_ext_obj(ext))->use--;
4567}
4568
60319eb1 4569static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4570 const struct nlattr *attr)
4571{
4572 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4573 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4574 struct nft_data_desc desc;
4575 struct nft_set_elem elem;
3971ca14 4576 struct nft_set_ext *ext;
60319eb1 4577 struct nft_trans *trans;
3971ca14
PNA		 4578 u32 flags = 0;
4579 void *priv;
20a69341
PM		 4580 int err;
4581
4582 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4583 nft_set_elem_policy, NULL);
20a69341
PM		 4584 if (err < 0)
4585 goto err1;
4586
4587 err = -EINVAL;
4588 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4589 goto err1;
4590
3971ca14
PNA		 4591 nft_set_ext_prepare(&tmpl);
4592
4593 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4594 if (err < 0)
4595 return err;
4596 if (flags != 0)
4597 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4598
7d740264 4599 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4600 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4601 if (err < 0)
4602 goto err1;
4603
4604 err = -EINVAL;
4605 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4606 goto err2;
4607
3971ca14
PNA		 4608 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4609
4610 err = -ENOMEM;
4611 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4612 GFP_KERNEL);
4613 if (elem.priv == NULL)
4614 goto err2;
4615
4616 ext = nft_set_elem_ext(set, elem.priv);
4617 if (flags)
4618 *nft_set_ext_flags(ext) = flags;
4619
60319eb1 4620 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4621 if (trans == NULL) {
4622 err = -ENOMEM;
3971ca14 4623 goto err3;
609ccf08 4624 }
20a69341 4625
42a55769 4626 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4627 if (priv == NULL) {
cc02e457 4628 err = -ENOENT;
3971ca14 4629 goto err4;
cc02e457 4630 }
3971ca14
PNA		 4631 kfree(elem.priv);
4632 elem.priv = priv;
cc02e457 4633
59105446
PNA		 4634 nft_set_elem_deactivate(ctx->net, set, &elem);
4635
60319eb1 4636 nft_trans_elem(trans) = elem;
46bbafce 4637 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4638 return 0;
cc02e457 4639
3971ca14 4640err4:
cc02e457 4641 kfree(trans);
3971ca14
PNA		 4642err3:
4643 kfree(elem.priv);
20a69341 4644err2:
59105446 4645 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4646err1:
4647 return err;
4648}
4649
8411b644 4650static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4651 struct nft_set *set,
8411b644 4652 const struct nft_set_iter *iter,
de70185d 4653 struct nft_set_elem *elem)
8411b644
PNA		 4654{
4655 struct nft_trans *trans;
4656 int err;
4657
4658 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4659 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4660 if (!trans)
4661 return -ENOMEM;
4662
1ba1c414 4663 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4664 err = -ENOENT;
4665 goto err1;
4666 }
b2c11e4b 4667 set->ndeact++;
8411b644 4668
7acfda53 4669 nft_set_elem_deactivate(ctx->net, set, elem);
de70185d
PNA		 4670 nft_trans_elem_set(trans) = set;
4671 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4672 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4673
4674 return 0;
4675err1:
4676 kfree(trans);
4677 return err;
4678}
4679
633c9a84
PNA		 4680static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4681 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4682 const struct nlattr * const nla[],
4683 struct netlink_ext_ack *extack)
20a69341 4684{
f2a6d766 4685 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4686 const struct nlattr *attr;
4687 struct nft_set *set;
4688 struct nft_ctx ctx;
60319eb1 4689 int rem, err = 0;
20a69341 4690
36dd1bcc
PNA		 4691 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4692 genmask);
20a69341
PM		 4693 if (err < 0)
4694 return err;
4695
cac20fcd 4696 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 4697 if (IS_ERR(set))
4698 return PTR_ERR(set);
4699 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4700 return -EBUSY;
4701
8411b644 4702 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4703 struct nft_set_iter iter = {
4704 .genmask = genmask,
4705 .fn = nft_flush_set,
8411b644 4706 };
baa2d42c 4707 set->ops->walk(&ctx, set, &iter);
8411b644 4708
baa2d42c 4709 return iter.err;
8411b644
PNA		 4710 }
4711
20a69341
PM		 4712 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4713 err = nft_del_setelem(&ctx, set, attr);
4714 if (err < 0)
60319eb1 4715 break;
4fefee57 4716
3dd0673a 4717 set->ndeact++;
20a69341 4718 }
60319eb1 4719 return err;
20a69341
PM		 4720}
4721
cfed7e1b
PM		 4722void nft_set_gc_batch_release(struct rcu_head *rcu)
4723{
4724 struct nft_set_gc_batch *gcb;
4725 unsigned int i;
4726
4727 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4728 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4729 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4730 kfree(gcb);
4731}
4732EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4733
4734struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4735 gfp_t gfp)
4736{
4737 struct nft_set_gc_batch *gcb;
4738
4739 gcb = kzalloc(sizeof(*gcb), gfp);
4740 if (gcb == NULL)
4741 return gcb;
4742 gcb->head.set = set;
4743 return gcb;
4744}
4745EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4746
e5009240
PNA		 4747/*
4748 * Stateful objects
4749 */
4750
4751/**
4752 * nft_register_obj- register nf_tables stateful object type
4753 * @obj: object type
4754 *
4755 * Registers the object type for use with nf_tables. Returns zero on
4756 * success or a negative errno code otherwise.
4757 */
4758int nft_register_obj(struct nft_object_type *obj_type)
4759{
4760 if (obj_type->type == NFT_OBJECT_UNSPEC)
4761 return -EINVAL;
4762
4763 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4764 list_add_rcu(&obj_type->list, &nf_tables_objects);
4765 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4766 return 0;
4767}
4768EXPORT_SYMBOL_GPL(nft_register_obj);
4769
4770/**
4771 * nft_unregister_obj - unregister nf_tables object type
4772 * @obj: object type
4773 *
4774 * Unregisters the object type for use with nf_tables.
4775 */
4776void nft_unregister_obj(struct nft_object_type *obj_type)
4777{
4778 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4779 list_del_rcu(&obj_type->list);
4780 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4781}
4782EXPORT_SYMBOL_GPL(nft_unregister_obj);
4783
cac20fcd
PNA		 4784struct nft_object *nft_obj_lookup(const struct nft_table *table,
4785 const struct nlattr *nla, u32 objtype,
4786 u8 genmask)
e5009240
PNA		 4787{
4788 struct nft_object *obj;
4789
d9adf22a 4790 list_for_each_entry_rcu(obj, &table->objects, list) {
e5009240 4791 if (!nla_strcmp(nla, obj->name) &&
dfc46034 4792 objtype == obj->ops->type->type &&
e5009240
PNA		 4793 nft_active_genmask(obj, genmask))
4794 return obj;
4795 }
4796 return ERR_PTR(-ENOENT);
4797}
cac20fcd 4798EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 4799
cac20fcd
PNA		 4800static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4801 const struct nlattr *nla,
4802 u32 objtype, u8 genmask)
3ecbfd65
HS		 4803{
4804 struct nft_object *obj;
4805
4806 list_for_each_entry(obj, &table->objects, list) {
4807 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4808 objtype == obj->ops->type->type &&
4809 nft_active_genmask(obj, genmask))
4810 return obj;
4811 }
4812 return ERR_PTR(-ENOENT);
4813}
4814
e5009240 4815static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4816 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4817 .len = NFT_TABLE_MAXNAMELEN - 1 },
4818 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4819 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4820 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4821 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 4822 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 4823};
4824
84fba055
FW		 4825static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4826 const struct nft_object_type *type,
e5009240
PNA		 4827 const struct nlattr *attr)
4828{
5b4c6e38 4829 struct nlattr **tb;
dfc46034 4830 const struct nft_object_ops *ops;
e5009240 4831 struct nft_object *obj;
5b4c6e38
GS		 4832 int err = -ENOMEM;
4833
4834 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4835 if (!tb)
4836 goto err1;
e5009240
PNA		 4837
4838 if (attr) {
fceb6435
JB		 4839 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4840 NULL);
e5009240 4841 if (err < 0)
5b4c6e38 4842 goto err2;
e5009240
PNA		 4843 } else {
4844 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4845 }
4846
dfc46034
PBG		 4847 if (type->select_ops) {
4848 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4849 if (IS_ERR(ops)) {
4850 err = PTR_ERR(ops);
5b4c6e38 4851 goto err2;
dfc46034
PBG		 4852 }
4853 } else {
4854 ops = type->ops;
4855 }
4856
e5009240 4857 err = -ENOMEM;
dfc46034 4858 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 4859 if (!obj)
4860 goto err2;
e5009240 4861
dfc46034 4862 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 4863 if (err < 0)
5b4c6e38 4864 goto err3;
e5009240 4865
dfc46034
PBG		 4866 obj->ops = ops;
4867
5b4c6e38 4868 kfree(tb);
e5009240 4869 return obj;
5b4c6e38 4870err3:
e5009240 4871 kfree(obj);
5b4c6e38
GS		 4872err2:
4873 kfree(tb);
e5009240
PNA		 4874err1:
4875 return ERR_PTR(err);
4876}
4877
4878static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4879 struct nft_object *obj, bool reset)
e5009240
PNA		 4880{
4881 struct nlattr *nest;
4882
4883 nest = nla_nest_start(skb, attr);
4884 if (!nest)
4885 goto nla_put_failure;
dfc46034 4886 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 4887 goto nla_put_failure;
4888 nla_nest_end(skb, nest);
4889 return 0;
4890
4891nla_put_failure:
4892 return -1;
4893}
4894
4895static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4896{
4897 const struct nft_object_type *type;
4898
4899 list_for_each_entry(type, &nf_tables_objects, list) {
4900 if (objtype == type->type)
4901 return type;
4902 }
4903 return NULL;
4904}
4905
452238e8
FW		 4906static const struct nft_object_type *
4907nft_obj_type_get(struct net *net, u32 objtype)
e5009240
PNA		 4908{
4909 const struct nft_object_type *type;
4910
4911 type = __nft_obj_type_get(objtype);
4912 if (type != NULL && try_module_get(type->owner))
4913 return type;
4914
f102d66b 4915 lockdep_nfnl_nft_mutex_not_held();
e5009240
PNA		 4916#ifdef CONFIG_MODULES
4917 if (type == NULL) {
452238e8 4918 nft_request_module(net, "nft-obj-%u", objtype);
e5009240
PNA		 4919 if (__nft_obj_type_get(objtype))
4920 return ERR_PTR(-EAGAIN);
4921 }
4922#endif
4923 return ERR_PTR(-ENOENT);
4924}
4925
4926static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4927 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4928 const struct nlattr * const nla[],
4929 struct netlink_ext_ack *extack)
e5009240
PNA		 4930{
4931 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4932 const struct nft_object_type *type;
4933 u8 genmask = nft_genmask_next(net);
4934 int family = nfmsg->nfgen_family;
e5009240
PNA		 4935 struct nft_table *table;
4936 struct nft_object *obj;
4937 struct nft_ctx ctx;
4938 u32 objtype;
4939 int err;
4940
4941 if (!nla[NFTA_OBJ_TYPE] ||
4942 !nla[NFTA_OBJ_NAME] ||
4943 !nla[NFTA_OBJ_DATA])
4944 return -EINVAL;
4945
cac20fcd 4946 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4947 if (IS_ERR(table)) {
4948 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4949 return PTR_ERR(table);
36dd1bcc 4950 }
e5009240
PNA		 4951
4952 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 4953 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 4954 if (IS_ERR(obj)) {
4955 err = PTR_ERR(obj);
36dd1bcc
PNA		 4956 if (err != -ENOENT) {
4957 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4958 return err;
36dd1bcc 4959 }
1a28ad74 4960 } else {
36dd1bcc
PNA		 4961 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4962 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4963 return -EEXIST;
36dd1bcc 4964 }
e5009240
PNA		 4965 return 0;
4966 }
4967
98319cb9 4968 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240 4969
452238e8 4970 type = nft_obj_type_get(net, objtype);
e5009240
PNA		 4971 if (IS_ERR(type))
4972 return PTR_ERR(type);
4973
84fba055 4974 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 4975 if (IS_ERR(obj)) {
4976 err = PTR_ERR(obj);
4977 goto err1;
4978 }
18965317 4979 obj->table = table;
3ecbfd65
HS		 4980 obj->handle = nf_tables_alloc_handle(table);
4981
61509575
PS		 4982 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4983 if (!obj->name) {
4984 err = -ENOMEM;
4985 goto err2;
4986 }
e5009240
PNA		 4987
4988 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4989 if (err < 0)
61509575 4990 goto err3;
e5009240
PNA		 4991
4992 list_add_tail_rcu(&obj->list, &table->objects);
4993 table->use++;
4994 return 0;
61509575
PS		 4995err3:
4996 kfree(obj->name);
e5009240 4997err2:
dfc46034 4998 if (obj->ops->destroy)
00bfb320 4999 obj->ops->destroy(&ctx, obj);
e5009240
PNA		 5000 kfree(obj);
5001err1:
5002 module_put(type->owner);
5003 return err;
5004}
5005
5006static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5007 u32 portid, u32 seq, int event, u32 flags,
5008 int family, const struct nft_table *table,
43da04a5 5009 struct nft_object *obj, bool reset)
e5009240
PNA		 5010{
5011 struct nfgenmsg *nfmsg;
5012 struct nlmsghdr *nlh;
5013
dedb67c4 5014 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 5015 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5016 if (nlh == NULL)
5017 goto nla_put_failure;
5018
5019 nfmsg = nlmsg_data(nlh);
5020 nfmsg->nfgen_family = family;
5021 nfmsg->version = NFNETLINK_V0;
5022 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5023
5024 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
5025 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
dfc46034 5026 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 5027 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 5028 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5029 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5030 NFTA_OBJ_PAD))
e5009240
PNA		 5031 goto nla_put_failure;
5032
5033 nlmsg_end(skb, nlh);
5034 return 0;
5035
5036nla_put_failure:
5037 nlmsg_trim(skb, nlh);
5038 return -1;
5039}
5040
a9fea2a3 5041struct nft_obj_filter {
e46abbcc 5042 char *table;
a9fea2a3
PNA		 5043 u32 type;
5044};
5045
e5009240
PNA		 5046static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
5047{
5048 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 5049 const struct nft_table *table;
e5009240 5050 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 5051 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 5052 struct net *net = sock_net(skb->sk);
5053 int family = nfmsg->nfgen_family;
43da04a5
PNA		 5054 struct nft_object *obj;
5055 bool reset = false;
5056
5057 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5058 reset = true;
e5009240
PNA		 5059
5060 rcu_read_lock();
5061 cb->seq = net->nft.base_seq;
5062
36596dad 5063 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5064 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 5065 continue;
5066
36596dad
PNA		 5067 list_for_each_entry_rcu(obj, &table->objects, list) {
5068 if (!nft_is_active(net, obj))
5069 goto cont;
5070 if (idx < s_idx)
5071 goto cont;
5072 if (idx > s_idx)
5073 memset(&cb->args[1], 0,
5074 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5075 if (filter && filter->table &&
36596dad
PNA		 5076 strcmp(filter->table, table->name))
5077 goto cont;
5078 if (filter &&
5079 filter->type != NFT_OBJECT_UNSPEC &&
5080 obj->ops->type->type != filter->type)
5081 goto cont;
a9fea2a3 5082
36596dad
PNA		 5083 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
5084 cb->nlh->nlmsg_seq,
5085 NFT_MSG_NEWOBJ,
5086 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5087 table->family, table,
36596dad
PNA		 5088 obj, reset) < 0)
5089 goto done;
e5009240 5090
36596dad 5091 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 5092cont:
36596dad 5093 idx++;
e5009240
PNA		 5094 }
5095 }
5096done:
5097 rcu_read_unlock();
5098
5099 cb->args[0] = idx;
5100 return skb->len;
5101}
5102
90fd131a 5103static int nf_tables_dump_obj_start(struct netlink_callback *cb)
a9fea2a3 5104{
90fd131a
FW		 5105 const struct nlattr * const *nla = cb->data;
5106 struct nft_obj_filter *filter = NULL;
e46abbcc 5107
90fd131a
FW		 5108 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
5109 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5110 if (!filter)
5111 return -ENOMEM;
5112
5113 if (nla[NFTA_OBJ_TABLE]) {
5114 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
5115 if (!filter->table) {
5116 kfree(filter);
5117 return -ENOMEM;
5118 }
5119 }
5120
5121 if (nla[NFTA_OBJ_TYPE])
5122 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
8bea728d 5123 }
a9fea2a3 5124
90fd131a 5125 cb->data = filter;
a9fea2a3
PNA		 5126 return 0;
5127}
5128
90fd131a 5129static int nf_tables_dump_obj_done(struct netlink_callback *cb)
a9fea2a3 5130{
90fd131a 5131 struct nft_obj_filter *filter = cb->data;
a9fea2a3 5132
90fd131a
FW		 5133 if (filter) {
5134 kfree(filter->table);
5135 kfree(filter);
e46abbcc 5136 }
a9fea2a3 5137
90fd131a 5138 return 0;
a9fea2a3
PNA		 5139}
5140
d9adf22a 5141/* called with rcu_read_lock held */
e5009240
PNA		 5142static int nf_tables_getobj(struct net *net, struct sock *nlsk,
5143 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5144 const struct nlattr * const nla[],
5145 struct netlink_ext_ack *extack)
e5009240
PNA		 5146{
5147 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5148 u8 genmask = nft_genmask_cur(net);
5149 int family = nfmsg->nfgen_family;
e5009240
PNA		 5150 const struct nft_table *table;
5151 struct nft_object *obj;
5152 struct sk_buff *skb2;
43da04a5 5153 bool reset = false;
e5009240
PNA		 5154 u32 objtype;
5155 int err;
5156
5157 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5158 struct netlink_dump_control c = {
90fd131a 5159 .start = nf_tables_dump_obj_start,
e5009240 5160 .dump = nf_tables_dump_obj,
a9fea2a3 5161 .done = nf_tables_dump_obj_done,
d9adf22a 5162 .module = THIS_MODULE,
90fd131a 5163 .data = (void *)nla,
e5009240 5164 };
a9fea2a3 5165
d9adf22a 5166 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
e5009240
PNA		 5167 }
5168
5169 if (!nla[NFTA_OBJ_NAME] ||
5170 !nla[NFTA_OBJ_TYPE])
5171 return -EINVAL;
5172
cac20fcd 5173 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5174 if (IS_ERR(table)) {
5175 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5176 return PTR_ERR(table);
36dd1bcc 5177 }
e5009240
PNA		 5178
5179 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 5180 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 5181 if (IS_ERR(obj)) {
5182 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5183 return PTR_ERR(obj);
36dd1bcc 5184 }
e5009240 5185
d9adf22a 5186 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
e5009240
PNA		 5187 if (!skb2)
5188 return -ENOMEM;
5189
43da04a5
PNA		 5190 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5191 reset = true;
5192
e5009240
PNA		 5193 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5194 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 5195 family, table, obj, reset);
e5009240
PNA		 5196 if (err < 0)
5197 goto err;
5198
5199 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5200err:
5201 kfree_skb(skb2);
5202 return err;
e5009240
PNA		 5203}
5204
00bfb320 5205static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
e5009240 5206{
dfc46034 5207 if (obj->ops->destroy)
00bfb320 5208 obj->ops->destroy(ctx, obj);
e5009240 5209
dfc46034 5210 module_put(obj->ops->type->owner);
61509575 5211 kfree(obj->name);
e5009240
PNA		 5212 kfree(obj);
5213}
5214
5215static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 5216 struct sk_buff *skb, const struct nlmsghdr *nlh,
5217 const struct nlattr * const nla[],
5218 struct netlink_ext_ack *extack)
e5009240
PNA		 5219{
5220 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5221 u8 genmask = nft_genmask_next(net);
5222 int family = nfmsg->nfgen_family;
36dd1bcc 5223 const struct nlattr *attr;
e5009240
PNA		 5224 struct nft_table *table;
5225 struct nft_object *obj;
5226 struct nft_ctx ctx;
5227 u32 objtype;
5228
5229 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 5230 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 5231 return -EINVAL;
5232
cac20fcd 5233 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5234 if (IS_ERR(table)) {
5235 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5236 return PTR_ERR(table);
36dd1bcc 5237 }
e5009240
PNA		 5238
5239 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 5240 if (nla[NFTA_OBJ_HANDLE]) {
5241 attr = nla[NFTA_OBJ_HANDLE];
5242 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5243 } else {
5244 attr = nla[NFTA_OBJ_NAME];
5245 obj = nft_obj_lookup(table, attr, objtype, genmask);
5246 }
5247
5248 if (IS_ERR(obj)) {
5249 NL_SET_BAD_ATTR(extack, attr);
e5009240 5250 return PTR_ERR(obj);
36dd1bcc
PNA		 5251 }
5252 if (obj->use > 0) {
5253 NL_SET_BAD_ATTR(extack, attr);
e5009240 5254 return -EBUSY;
36dd1bcc 5255 }
e5009240 5256
98319cb9 5257 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 5258
5259 return nft_delobj(&ctx, obj);
5260}
5261
25e94a99
PNA		 5262void nft_obj_notify(struct net *net, struct nft_table *table,
5263 struct nft_object *obj, u32 portid, u32 seq, int event,
5264 int family, int report, gfp_t gfp)
e5009240
PNA		 5265{
5266 struct sk_buff *skb;
5267 int err;
5268
2599e989
PNA		 5269 if (!report &&
5270 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5271 return;
e5009240 5272
2599e989 5273 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 5274 if (skb == NULL)
5275 goto err;
5276
2599e989
PNA		 5277 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5278 table, obj, false);
e5009240
PNA		 5279 if (err < 0) {
5280 kfree_skb(skb);
5281 goto err;
5282 }
5283
25e94a99
PNA		 5284 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5285 return;
e5009240 5286err:
25e94a99 5287 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 5288}
2599e989
PNA		 5289EXPORT_SYMBOL_GPL(nft_obj_notify);
5290
25e94a99
PNA		 5291static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5292 struct nft_object *obj, int event)
2599e989 5293{
25e94a99 5294 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 5295 ctx->family, ctx->report, GFP_KERNEL);
2599e989 5296}
e5009240 5297
3b49e2e9
PNA		 5298/*
5299 * Flow tables
5300 */
5301void nft_register_flowtable_type(struct nf_flowtable_type *type)
5302{
5303 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5304 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5305 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5306}
5307EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5308
5309void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5310{
5311 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5312 list_del_rcu(&type->list);
5313 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5314}
5315EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5316
5317static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5318 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
5319 .len = NFT_NAME_MAXLEN - 1 },
5320 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
5321 .len = NFT_NAME_MAXLEN - 1 },
5322 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 5323 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
3b49e2e9
PNA		 5324};
5325
cac20fcd
PNA		 5326struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5327 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 5328{
5329 struct nft_flowtable *flowtable;
5330
d9adf22a 5331 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
3b49e2e9
PNA		 5332 if (!nla_strcmp(nla, flowtable->name) &&
5333 nft_active_genmask(flowtable, genmask))
5334 return flowtable;
5335 }
5336 return ERR_PTR(-ENOENT);
5337}
cac20fcd 5338EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 5339
ae0662f8 5340static struct nft_flowtable *
cac20fcd
PNA		 5341nft_flowtable_lookup_byhandle(const struct nft_table *table,
5342 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 5343{
5344 struct nft_flowtable *flowtable;
5345
5346 list_for_each_entry(flowtable, &table->flowtables, list) {
5347 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5348 nft_active_genmask(flowtable, genmask))
5349 return flowtable;
5350 }
5351 return ERR_PTR(-ENOENT);
5352}
5353
3b49e2e9
PNA		 5354static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5355 const struct nlattr *attr,
5356 struct net_device *dev_array[], int *len)
5357{
5358 const struct nlattr *tmp;
5359 struct net_device *dev;
5360 char ifname[IFNAMSIZ];
5361 int rem, n = 0, err;
5362
5363 nla_for_each_nested(tmp, attr, rem) {
5364 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5365 err = -EINVAL;
5366 goto err1;
5367 }
5368
5369 nla_strlcpy(ifname, tmp, IFNAMSIZ);
90d2723c 5370 dev = __dev_get_by_name(ctx->net, ifname);
3b49e2e9
PNA		 5371 if (!dev) {
5372 err = -ENOENT;
5373 goto err1;
5374 }
5375
5376 dev_array[n++] = dev;
5377 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5378 err = -EFBIG;
5379 goto err1;
5380 }
5381 }
5382 if (!len)
5383 return -EINVAL;
5384
5385 err = 0;
5386err1:
5387 *len = n;
5388 return err;
5389}
5390
5391static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5392 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5393 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5394 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5395};
5396
5397static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5398 const struct nlattr *attr,
5399 struct nft_flowtable *flowtable)
5400{
5401 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5402 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5403 struct nf_hook_ops *ops;
5404 int hooknum, priority;
5405 int err, n = 0, i;
5406
5407 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5408 nft_flowtable_hook_policy, NULL);
5409 if (err < 0)
5410 return err;
5411
5412 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5413 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5414 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5415 return -EINVAL;
5416
5417 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 5418 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 5419 return -EINVAL;
5420
5421 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5422
5423 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5424 dev_array, &n);
5425 if (err < 0)
d92191aa 5426 return err;
3b49e2e9 5427
6396bb22 5428 ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
90d2723c
PNA		 5429 if (!ops)
5430 return -ENOMEM;
3b49e2e9 5431
0e839dfa
PNA		 5432 flowtable->hooknum = hooknum;
5433 flowtable->priority = priority;
3b49e2e9
PNA		 5434 flowtable->ops = ops;
5435 flowtable->ops_len = n;
5436
5437 for (i = 0; i < n; i++) {
5438 flowtable->ops[i].pf = NFPROTO_NETDEV;
5439 flowtable->ops[i].hooknum = hooknum;
5440 flowtable->ops[i].priority = priority;
17857d92 5441 flowtable->ops[i].priv = &flowtable->data;
3b49e2e9
PNA		 5442 flowtable->ops[i].hook = flowtable->data.type->hook;
5443 flowtable->ops[i].dev = dev_array[i];
5444 }
5445
3b49e2e9
PNA		 5446 return err;
5447}
5448
98319cb9 5449static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5450{
5451 const struct nf_flowtable_type *type;
5452
5453 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 5454 if (family == type->family)
3b49e2e9
PNA		 5455 return type;
5456 }
5457 return NULL;
5458}
5459
452238e8
FW		 5460static const struct nf_flowtable_type *
5461nft_flowtable_type_get(struct net *net, u8 family)
3b49e2e9
PNA		 5462{
5463 const struct nf_flowtable_type *type;
5464
98319cb9 5465 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 5466 if (type != NULL && try_module_get(type->owner))
5467 return type;
5468
f102d66b 5469 lockdep_nfnl_nft_mutex_not_held();
3b49e2e9
PNA		 5470#ifdef CONFIG_MODULES
5471 if (type == NULL) {
452238e8 5472 nft_request_module(net, "nf-flowtable-%u", family);
98319cb9 5473 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 5474 return ERR_PTR(-EAGAIN);
5475 }
5476#endif
5477 return ERR_PTR(-ENOENT);
5478}
5479
3b49e2e9
PNA		 5480static void nft_unregister_flowtable_net_hooks(struct net *net,
5481 struct nft_flowtable *flowtable)
5482{
5483 int i;
5484
5485 for (i = 0; i < flowtable->ops_len; i++) {
5486 if (!flowtable->ops[i].dev)
5487 continue;
5488
5489 nf_unregister_net_hook(net, &flowtable->ops[i]);
5490 }
5491}
5492
5493static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5494 struct sk_buff *skb,
5495 const struct nlmsghdr *nlh,
5496 const struct nlattr * const nla[],
5497 struct netlink_ext_ack *extack)
5498{
5499 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5500 const struct nf_flowtable_type *type;
32fc7187 5501 struct nft_flowtable *flowtable, *ft;
3b49e2e9
PNA		 5502 u8 genmask = nft_genmask_next(net);
5503 int family = nfmsg->nfgen_family;
3b49e2e9
PNA		 5504 struct nft_table *table;
5505 struct nft_ctx ctx;
5506 int err, i, k;
5507
5508 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5509 !nla[NFTA_FLOWTABLE_NAME] ||
5510 !nla[NFTA_FLOWTABLE_HOOK])
5511 return -EINVAL;
5512
cac20fcd
PNA		 5513 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5514 genmask);
36dd1bcc
PNA		 5515 if (IS_ERR(table)) {
5516 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5517 return PTR_ERR(table);
36dd1bcc 5518 }
3b49e2e9 5519
cac20fcd
PNA		 5520 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5521 genmask);
3b49e2e9
PNA		 5522 if (IS_ERR(flowtable)) {
5523 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 5524 if (err != -ENOENT) {
5525 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5526 return err;
36dd1bcc 5527 }
3b49e2e9 5528 } else {
36dd1bcc
PNA		 5529 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5530 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5531 return -EEXIST;
36dd1bcc 5532 }
3b49e2e9
PNA		 5533
5534 return 0;
5535 }
5536
98319cb9 5537 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5538
5539 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5540 if (!flowtable)
5541 return -ENOMEM;
5542
5543 flowtable->table = table;
3ecbfd65
HS		 5544 flowtable->handle = nf_tables_alloc_handle(table);
5545
3b49e2e9
PNA		 5546 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5547 if (!flowtable->name) {
5548 err = -ENOMEM;
5549 goto err1;
5550 }
5551
452238e8 5552 type = nft_flowtable_type_get(net, family);
3b49e2e9
PNA		 5553 if (IS_ERR(type)) {
5554 err = PTR_ERR(type);
5555 goto err2;
5556 }
5557
5558 flowtable->data.type = type;
a268de77 5559 err = type->init(&flowtable->data);
3b49e2e9
PNA		 5560 if (err < 0)
5561 goto err3;
5562
5563 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5564 flowtable);
5565 if (err < 0)
a268de77 5566 goto err4;
3b49e2e9
PNA		 5567
5568 for (i = 0; i < flowtable->ops_len; i++) {
32fc7187
PNA		 5569 if (!flowtable->ops[i].dev)
5570 continue;
5571
5572 list_for_each_entry(ft, &table->flowtables, list) {
5573 for (k = 0; k < ft->ops_len; k++) {
5574 if (!ft->ops[k].dev)
5575 continue;
5576
5577 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5578 flowtable->ops[i].pf == ft->ops[k].pf) {
5579 err = -EBUSY;
a268de77 5580 goto err5;
32fc7187
PNA		 5581 }
5582 }
5583 }
5584
3b49e2e9
PNA		 5585 err = nf_register_net_hook(net, &flowtable->ops[i]);
5586 if (err < 0)
a268de77 5587 goto err5;
3b49e2e9
PNA		 5588 }
5589
5590 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5591 if (err < 0)
a268de77 5592 goto err6;
3b49e2e9
PNA		 5593
5594 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5595 table->use++;
5596
5597 return 0;
a268de77 5598err6:
3b49e2e9 5599 i = flowtable->ops_len;
a268de77 5600err5:
b8088dda 5601 for (k = i - 1; k >= 0; k--)
0e0d5002 5602 nf_unregister_net_hook(net, &flowtable->ops[k]);
3b49e2e9
PNA		 5603
5604 kfree(flowtable->ops);
a268de77
FF		 5605err4:
5606 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5607err3:
5608 module_put(type->owner);
5609err2:
5610 kfree(flowtable->name);
5611err1:
5612 kfree(flowtable);
5613 return err;
5614}
5615
5616static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5617 struct sk_buff *skb,
5618 const struct nlmsghdr *nlh,
5619 const struct nlattr * const nla[],
5620 struct netlink_ext_ack *extack)
5621{
5622 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5623 u8 genmask = nft_genmask_next(net);
5624 int family = nfmsg->nfgen_family;
5625 struct nft_flowtable *flowtable;
36dd1bcc 5626 const struct nlattr *attr;
3b49e2e9
PNA		 5627 struct nft_table *table;
5628 struct nft_ctx ctx;
5629
e603ea4b
PNA		 5630 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5631 (!nla[NFTA_FLOWTABLE_NAME] &&
5632 !nla[NFTA_FLOWTABLE_HANDLE]))
5633 return -EINVAL;
5634
cac20fcd
PNA		 5635 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5636 genmask);
36dd1bcc
PNA		 5637 if (IS_ERR(table)) {
5638 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5639 return PTR_ERR(table);
36dd1bcc 5640 }
3b49e2e9 5641
36dd1bcc
PNA		 5642 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5643 attr = nla[NFTA_FLOWTABLE_HANDLE];
5644 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5645 } else {
5646 attr = nla[NFTA_FLOWTABLE_NAME];
5647 flowtable = nft_flowtable_lookup(table, attr, genmask);
5648 }
5649
5650 if (IS_ERR(flowtable)) {
5651 NL_SET_BAD_ATTR(extack, attr);
5652 return PTR_ERR(flowtable);
5653 }
5654 if (flowtable->use > 0) {
5655 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 5656 return -EBUSY;
36dd1bcc 5657 }
3b49e2e9 5658
98319cb9 5659 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5660
5661 return nft_delflowtable(&ctx, flowtable);
5662}
5663
5664static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5665 u32 portid, u32 seq, int event,
5666 u32 flags, int family,
5667 struct nft_flowtable *flowtable)
5668{
5669 struct nlattr *nest, *nest_devs;
5670 struct nfgenmsg *nfmsg;
5671 struct nlmsghdr *nlh;
5672 int i;
5673
5674 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5675 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5676 if (nlh == NULL)
5677 goto nla_put_failure;
5678
5679 nfmsg = nlmsg_data(nlh);
5680 nfmsg->nfgen_family = family;
5681 nfmsg->version = NFNETLINK_V0;
5682 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5683
5684 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5685 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 5686 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5687 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5688 NFTA_FLOWTABLE_PAD))
3b49e2e9
PNA		 5689 goto nla_put_failure;
5690
5691 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5692 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5693 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5694 goto nla_put_failure;
5695
5696 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5697 if (!nest_devs)
5698 goto nla_put_failure;
5699
5700 for (i = 0; i < flowtable->ops_len; i++) {
b8088dda
FW		 5701 const struct net_device *dev = READ_ONCE(flowtable->ops[i].dev);
5702
5703 if (dev &&
5704 nla_put_string(skb, NFTA_DEVICE_NAME, dev->name))
3b49e2e9
PNA		 5705 goto nla_put_failure;
5706 }
5707 nla_nest_end(skb, nest_devs);
5708 nla_nest_end(skb, nest);
5709
5710 nlmsg_end(skb, nlh);
5711 return 0;
5712
5713nla_put_failure:
5714 nlmsg_trim(skb, nlh);
5715 return -1;
5716}
5717
5718struct nft_flowtable_filter {
5719 char *table;
5720};
5721
5722static int nf_tables_dump_flowtable(struct sk_buff *skb,
5723 struct netlink_callback *cb)
5724{
5725 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5726 struct nft_flowtable_filter *filter = cb->data;
5727 unsigned int idx = 0, s_idx = cb->args[0];
5728 struct net *net = sock_net(skb->sk);
5729 int family = nfmsg->nfgen_family;
5730 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5731 const struct nft_table *table;
5732
5733 rcu_read_lock();
5734 cb->seq = net->nft.base_seq;
5735
36596dad 5736 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5737 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 5738 continue;
5739
36596dad
PNA		 5740 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5741 if (!nft_is_active(net, flowtable))
5742 goto cont;
5743 if (idx < s_idx)
5744 goto cont;
5745 if (idx > s_idx)
5746 memset(&cb->args[1], 0,
5747 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5748 if (filter && filter->table &&
36596dad
PNA		 5749 strcmp(filter->table, table->name))
5750 goto cont;
3b49e2e9 5751
36596dad
PNA		 5752 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5753 cb->nlh->nlmsg_seq,
5754 NFT_MSG_NEWFLOWTABLE,
5755 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5756 table->family, flowtable) < 0)
36596dad 5757 goto done;
3b49e2e9 5758
36596dad 5759 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 5760cont:
36596dad 5761 idx++;
3b49e2e9
PNA		 5762 }
5763 }
5764done:
5765 rcu_read_unlock();
5766
5767 cb->args[0] = idx;
5768 return skb->len;
5769}
5770
90fd131a 5771static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
3b49e2e9 5772{
90fd131a
FW		 5773 const struct nlattr * const *nla = cb->data;
5774 struct nft_flowtable_filter *filter = NULL;
3b49e2e9 5775
90fd131a
FW		 5776 if (nla[NFTA_FLOWTABLE_TABLE]) {
5777 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5778 if (!filter)
5779 return -ENOMEM;
3b49e2e9 5780
90fd131a
FW		 5781 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5782 GFP_ATOMIC);
5783 if (!filter->table) {
5784 kfree(filter);
5785 return -ENOMEM;
5786 }
5787 }
3b49e2e9 5788
90fd131a 5789 cb->data = filter;
3b49e2e9
PNA		 5790 return 0;
5791}
5792
90fd131a 5793static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
3b49e2e9 5794{
90fd131a 5795 struct nft_flowtable_filter *filter = cb->data;
3b49e2e9 5796
3b49e2e9 5797 if (!filter)
90fd131a 5798 return 0;
3b49e2e9 5799
90fd131a
FW		 5800 kfree(filter->table);
5801 kfree(filter);
5802
5803 return 0;
3b49e2e9
PNA		 5804}
5805
d9adf22a 5806/* called with rcu_read_lock held */
3b49e2e9
PNA		 5807static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5808 struct sk_buff *skb,
5809 const struct nlmsghdr *nlh,
5810 const struct nlattr * const nla[],
5811 struct netlink_ext_ack *extack)
5812{
5813 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5814 u8 genmask = nft_genmask_cur(net);
5815 int family = nfmsg->nfgen_family;
5816 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5817 const struct nft_table *table;
5818 struct sk_buff *skb2;
5819 int err;
5820
5821 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5822 struct netlink_dump_control c = {
90fd131a 5823 .start = nf_tables_dump_flowtable_start,
3b49e2e9
PNA		 5824 .dump = nf_tables_dump_flowtable,
5825 .done = nf_tables_dump_flowtable_done,
d9adf22a 5826 .module = THIS_MODULE,
90fd131a 5827 .data = (void *)nla,
3b49e2e9
PNA		 5828 };
5829
d9adf22a 5830 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3b49e2e9
PNA		 5831 }
5832
5833 if (!nla[NFTA_FLOWTABLE_NAME])
5834 return -EINVAL;
5835
cac20fcd
PNA		 5836 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5837 genmask);
3b49e2e9
PNA		 5838 if (IS_ERR(table))
5839 return PTR_ERR(table);
5840
cac20fcd
PNA		 5841 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5842 genmask);
03a0120f 5843 if (IS_ERR(flowtable))
3b49e2e9
PNA		 5844 return PTR_ERR(flowtable);
5845
d9adf22a 5846 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3b49e2e9
PNA		 5847 if (!skb2)
5848 return -ENOMEM;
5849
5850 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5851 nlh->nlmsg_seq,
5852 NFT_MSG_NEWFLOWTABLE, 0, family,
5853 flowtable);
5854 if (err < 0)
5855 goto err;
5856
5857 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5858err:
5859 kfree_skb(skb2);
5860 return err;
5861}
5862
5863static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5864 struct nft_flowtable *flowtable,
5865 int event)
5866{
5867 struct sk_buff *skb;
5868 int err;
5869
5870 if (ctx->report &&
5871 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5872 return;
5873
5874 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5875 if (skb == NULL)
5876 goto err;
5877
5878 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5879 ctx->seq, event, 0,
36596dad 5880 ctx->family, flowtable);
3b49e2e9
PNA		 5881 if (err < 0) {
5882 kfree_skb(skb);
5883 goto err;
5884 }
5885
5886 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5887 ctx->report, GFP_KERNEL);
5888 return;
5889err:
5890 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5891}
5892
3b49e2e9
PNA		 5893static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5894{
c04a3f73 5895 kfree(flowtable->ops);
3b49e2e9 5896 kfree(flowtable->name);
b408c5b0 5897 flowtable->data.type->free(&flowtable->data);
3b49e2e9 5898 module_put(flowtable->data.type->owner);
a12486eb 5899 kfree(flowtable);
3b49e2e9
PNA		 5900}
5901
84d7fce6
PNA		 5902static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5903 u32 portid, u32 seq)
5904{
5905 struct nlmsghdr *nlh;
5906 struct nfgenmsg *nfmsg;
784b4e61 5907 char buf[TASK_COMM_LEN];
dedb67c4 5908 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 5909
5910 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5911 if (nlh == NULL)
5912 goto nla_put_failure;
5913
5914 nfmsg = nlmsg_data(nlh);
5915 nfmsg->nfgen_family = AF_UNSPEC;
5916 nfmsg->version = NFNETLINK_V0;
5917 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5918
784b4e61
PS		 5919 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5920 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5921 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 5922 goto nla_put_failure;
5923
053c095a
JB		 5924 nlmsg_end(skb, nlh);
5925 return 0;
84d7fce6
PNA		 5926
5927nla_put_failure:
5928 nlmsg_trim(skb, nlh);
5929 return -EMSGSIZE;
5930}
5931
3b49e2e9
PNA		 5932static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5933 struct nft_flowtable *flowtable)
5934{
5935 int i;
5936
5937 for (i = 0; i < flowtable->ops_len; i++) {
5938 if (flowtable->ops[i].dev != dev)
5939 continue;
5940
5941 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
5942 flowtable->ops[i].dev = NULL;
5943 break;
5944 }
5945}
5946
5947static int nf_tables_flowtable_event(struct notifier_block *this,
5948 unsigned long event, void *ptr)
5949{
5950 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5951 struct nft_flowtable *flowtable;
5952 struct nft_table *table;
0a2cf5ee 5953 struct net *net;
3b49e2e9
PNA		 5954
5955 if (event != NETDEV_UNREGISTER)
5956 return 0;
5957
6a48de01 5958 net = dev_net(dev);
9e619d87 5959 mutex_lock(&net->nft.commit_mutex);
0a2cf5ee 5960 list_for_each_entry(table, &net->nft.tables, list) {
36596dad
PNA		 5961 list_for_each_entry(flowtable, &table->flowtables, list) {
5962 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 5963 }
5964 }
9e619d87 5965 mutex_unlock(&net->nft.commit_mutex);
6a48de01 5966
3b49e2e9
PNA		 5967 return NOTIFY_DONE;
5968}
5969
5970static struct notifier_block nf_tables_flowtable_notifier = {
5971 .notifier_call = nf_tables_flowtable_event,
5972};
5973
25e94a99
PNA		 5974static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5975 int event)
84d7fce6
PNA		 5976{
5977 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5978 struct sk_buff *skb2;
5979 int err;
5980
5981 if (nlmsg_report(nlh) &&
5982 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5983 return;
84d7fce6 5984
84d7fce6
PNA		 5985 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5986 if (skb2 == NULL)
5987 goto err;
5988
5989 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5990 nlh->nlmsg_seq);
5991 if (err < 0) {
5992 kfree_skb(skb2);
5993 goto err;
5994 }
5995
25e94a99
PNA		 5996 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5997 nlmsg_report(nlh), GFP_KERNEL);
5998 return;
84d7fce6 5999err:
25e94a99
PNA		 6000 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6001 -ENOBUFS);
84d7fce6
PNA		 6002}
6003
7b8002a1
PNA		 6004static int nf_tables_getgen(struct net *net, struct sock *nlsk,
6005 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 6006 const struct nlattr * const nla[],
6007 struct netlink_ext_ack *extack)
84d7fce6 6008{
84d7fce6
PNA		 6009 struct sk_buff *skb2;
6010 int err;
6011
d9adf22a 6012 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
84d7fce6
PNA		 6013 if (skb2 == NULL)
6014 return -ENOMEM;
6015
6016 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6017 nlh->nlmsg_seq);
6018 if (err < 0)
6019 goto err;
6020
6021 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6022err:
6023 kfree_skb(skb2);
6024 return err;
6025}
6026
96518518
PM		 6027static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
6028 [NFT_MSG_NEWTABLE] = {
55dd6f93 6029 .call_batch = nf_tables_newtable,
96518518
PM		 6030 .attr_count = NFTA_TABLE_MAX,
6031 .policy = nft_table_policy,
6032 },
6033 [NFT_MSG_GETTABLE] = {
d9adf22a 6034 .call_rcu = nf_tables_gettable,
96518518
PM		 6035 .attr_count = NFTA_TABLE_MAX,
6036 .policy = nft_table_policy,
6037 },
6038 [NFT_MSG_DELTABLE] = {
55dd6f93 6039 .call_batch = nf_tables_deltable,
96518518
PM		 6040 .attr_count = NFTA_TABLE_MAX,
6041 .policy = nft_table_policy,
6042 },
6043 [NFT_MSG_NEWCHAIN] = {
91c7b38d 6044 .call_batch = nf_tables_newchain,
96518518
PM		 6045 .attr_count = NFTA_CHAIN_MAX,
6046 .policy = nft_chain_policy,
6047 },
6048 [NFT_MSG_GETCHAIN] = {
d9adf22a 6049 .call_rcu = nf_tables_getchain,
96518518
PM		 6050 .attr_count = NFTA_CHAIN_MAX,
6051 .policy = nft_chain_policy,
6052 },
6053 [NFT_MSG_DELCHAIN] = {
91c7b38d 6054 .call_batch = nf_tables_delchain,
96518518
PM		 6055 .attr_count = NFTA_CHAIN_MAX,
6056 .policy = nft_chain_policy,
6057 },
6058 [NFT_MSG_NEWRULE] = {
0628b123 6059 .call_batch = nf_tables_newrule,
96518518
PM		 6060 .attr_count = NFTA_RULE_MAX,
6061 .policy = nft_rule_policy,
6062 },
6063 [NFT_MSG_GETRULE] = {
d9adf22a 6064 .call_rcu = nf_tables_getrule,
96518518
PM		 6065 .attr_count = NFTA_RULE_MAX,
6066 .policy = nft_rule_policy,
6067 },
6068 [NFT_MSG_DELRULE] = {
0628b123 6069 .call_batch = nf_tables_delrule,
96518518
PM		 6070 .attr_count = NFTA_RULE_MAX,
6071 .policy = nft_rule_policy,
6072 },
20a69341 6073 [NFT_MSG_NEWSET] = {
958bee14 6074 .call_batch = nf_tables_newset,
20a69341
PM		 6075 .attr_count = NFTA_SET_MAX,
6076 .policy = nft_set_policy,
6077 },
6078 [NFT_MSG_GETSET] = {
d9adf22a 6079 .call_rcu = nf_tables_getset,
20a69341
PM		 6080 .attr_count = NFTA_SET_MAX,
6081 .policy = nft_set_policy,
6082 },
6083 [NFT_MSG_DELSET] = {
958bee14 6084 .call_batch = nf_tables_delset,
20a69341
PM		 6085 .attr_count = NFTA_SET_MAX,
6086 .policy = nft_set_policy,
6087 },
6088 [NFT_MSG_NEWSETELEM] = {
958bee14 6089 .call_batch = nf_tables_newsetelem,
20a69341
PM		 6090 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6091 .policy = nft_set_elem_list_policy,
6092 },
6093 [NFT_MSG_GETSETELEM] = {
d9adf22a 6094 .call_rcu = nf_tables_getsetelem,
20a69341
PM		 6095 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6096 .policy = nft_set_elem_list_policy,
6097 },
6098 [NFT_MSG_DELSETELEM] = {
958bee14 6099 .call_batch = nf_tables_delsetelem,
20a69341
PM		 6100 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6101 .policy = nft_set_elem_list_policy,
6102 },
84d7fce6 6103 [NFT_MSG_GETGEN] = {
d9adf22a 6104 .call_rcu = nf_tables_getgen,
84d7fce6 6105 },
e5009240
PNA		 6106 [NFT_MSG_NEWOBJ] = {
6107 .call_batch = nf_tables_newobj,
6108 .attr_count = NFTA_OBJ_MAX,
6109 .policy = nft_obj_policy,
6110 },
6111 [NFT_MSG_GETOBJ] = {
d9adf22a 6112 .call_rcu = nf_tables_getobj,
e5009240
PNA		 6113 .attr_count = NFTA_OBJ_MAX,
6114 .policy = nft_obj_policy,
6115 },
6116 [NFT_MSG_DELOBJ] = {
6117 .call_batch = nf_tables_delobj,
6118 .attr_count = NFTA_OBJ_MAX,
6119 .policy = nft_obj_policy,
6120 },
43da04a5 6121 [NFT_MSG_GETOBJ_RESET] = {
d9adf22a 6122 .call_rcu = nf_tables_getobj,
43da04a5
PNA		 6123 .attr_count = NFTA_OBJ_MAX,
6124 .policy = nft_obj_policy,
6125 },
3b49e2e9
PNA		 6126 [NFT_MSG_NEWFLOWTABLE] = {
6127 .call_batch = nf_tables_newflowtable,
6128 .attr_count = NFTA_FLOWTABLE_MAX,
6129 .policy = nft_flowtable_policy,
6130 },
6131 [NFT_MSG_GETFLOWTABLE] = {
d9adf22a 6132 .call_rcu = nf_tables_getflowtable,
3b49e2e9
PNA		 6133 .attr_count = NFTA_FLOWTABLE_MAX,
6134 .policy = nft_flowtable_policy,
6135 },
6136 [NFT_MSG_DELFLOWTABLE] = {
6137 .call_batch = nf_tables_delflowtable,
6138 .attr_count = NFTA_FLOWTABLE_MAX,
6139 .policy = nft_flowtable_policy,
6140 },
96518518
PM		 6141};
6142
a654de8f
PNA		 6143static int nf_tables_validate(struct net *net)
6144{
6145 struct nft_table *table;
6146
6147 switch (net->nft.validate_state) {
6148 case NFT_VALIDATE_SKIP:
6149 break;
6150 case NFT_VALIDATE_NEED:
6151 nft_validate_state_update(net, NFT_VALIDATE_DO);
6152 /* fall through */
6153 case NFT_VALIDATE_DO:
6154 list_for_each_entry(table, &net->nft.tables, list) {
6155 if (nft_table_validate(net, table) < 0)
6156 return -EAGAIN;
6157 }
6158 break;
6159 }
6160
6161 return 0;
6162}
6163
91c7b38d
PNA		 6164static void nft_chain_commit_update(struct nft_trans *trans)
6165{
6166 struct nft_base_chain *basechain;
6167
1b2470e5
FW		 6168 if (nft_trans_chain_name(trans)) {
6169 rhltable_remove(&trans->ctx.table->chains_ht,
6170 &trans->ctx.chain->rhlhead,
6171 nft_chain_ht_params);
d71efb59 6172 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
1b2470e5
FW		 6173 rhltable_insert_key(&trans->ctx.table->chains_ht,
6174 trans->ctx.chain->name,
6175 &trans->ctx.chain->rhlhead,
6176 nft_chain_ht_params);
6177 }
91c7b38d 6178
f323d954 6179 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 6180 return;
6181
6182 basechain = nft_base_chain(trans->ctx.chain);
6183 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
6184
6185 switch (nft_trans_chain_policy(trans)) {
6186 case NF_DROP:
6187 case NF_ACCEPT:
6188 basechain->policy = nft_trans_chain_policy(trans);
6189 break;
6190 }
6191}
6192
2f99aa31 6193static void nft_commit_release(struct nft_trans *trans)
c7c32e72 6194{
c7c32e72
PNA		 6195 switch (trans->msg_type) {
6196 case NFT_MSG_DELTABLE:
6197 nf_tables_table_destroy(&trans->ctx);
6198 break;
9f8aac0b
FW		 6199 case NFT_MSG_NEWCHAIN:
6200 kfree(nft_trans_chain_name(trans));
6201 break;
c7c32e72 6202 case NFT_MSG_DELCHAIN:
43a605f2 6203 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6204 break;
6205 case NFT_MSG_DELRULE:
6206 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6207 break;
6208 case NFT_MSG_DELSET:
6209 nft_set_destroy(nft_trans_set(trans));
6210 break;
61edafbb 6211 case NFT_MSG_DELSETELEM:
3453c927
PNA		 6212 nf_tables_set_elem_destroy(&trans->ctx,
6213 nft_trans_elem_set(trans),
59105446 6214 nft_trans_elem(trans).priv);
61edafbb 6215 break;
e5009240 6216 case NFT_MSG_DELOBJ:
00bfb320 6217 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6218 break;
3b49e2e9
PNA		 6219 case NFT_MSG_DELFLOWTABLE:
6220 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6221 break;
c7c32e72 6222 }
0935d558
FW		 6223
6224 if (trans->put_net)
6225 put_net(trans->ctx.net);
6226
c7c32e72
PNA		 6227 kfree(trans);
6228}
6229
0935d558 6230static void nf_tables_trans_destroy_work(struct work_struct *w)
2f99aa31
FW		 6231{
6232 struct nft_trans *trans, *next;
0935d558
FW		 6233 LIST_HEAD(head);
6234
6235 spin_lock(&nf_tables_destroy_list_lock);
6236 list_splice_init(&nf_tables_destroy_list, &head);
6237 spin_unlock(&nf_tables_destroy_list_lock);
2f99aa31 6238
0935d558 6239 if (list_empty(&head))
2f99aa31
FW		 6240 return;
6241
6242 synchronize_rcu();
6243
0935d558 6244 list_for_each_entry_safe(trans, next, &head, list) {
2f99aa31
FW		 6245 list_del(&trans->list);
6246 nft_commit_release(trans);
6247 }
6248}
6249
0cbc06b3
FW		 6250static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6251{
6252 struct nft_rule *rule;
6253 unsigned int alloc = 0;
6254 int i;
6255
6256 /* already handled or inactive chain? */
6257 if (chain->rules_next || !nft_is_active_next(net, chain))
6258 return 0;
6259
6260 rule = list_entry(&chain->rules, struct nft_rule, list);
6261 i = 0;
6262
6263 list_for_each_entry_continue(rule, &chain->rules, list) {
6264 if (nft_is_active_next(net, rule))
6265 alloc++;
6266 }
6267
6268 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6269 if (!chain->rules_next)
6270 return -ENOMEM;
6271
6272 list_for_each_entry_continue(rule, &chain->rules, list) {
6273 if (nft_is_active_next(net, rule))
6274 chain->rules_next[i++] = rule;
6275 }
6276
6277 chain->rules_next[i] = NULL;
6278 return 0;
6279}
6280
6281static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6282{
6283 struct nft_trans *trans, *next;
6284
6285 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6286 struct nft_chain *chain = trans->ctx.chain;
6287
6288 if (trans->msg_type == NFT_MSG_NEWRULE ||
6289 trans->msg_type == NFT_MSG_DELRULE) {
6290 kvfree(chain->rules_next);
6291 chain->rules_next = NULL;
6292 }
6293 }
6294}
6295
6296static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6297{
6298 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6299
6300 kvfree(o->start);
6301}
6302
6303static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6304{
6305 struct nft_rule **r = rules;
6306 struct nft_rules_old *old;
6307
6308 while (*r)
6309 r++;
6310
6311 r++; /* rcu_head is after end marker */
6312 old = (void *) r;
6313 old->start = rules;
6314
6315 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6316}
6317
0fb39bbe 6318static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
0cbc06b3
FW		 6319{
6320 struct nft_rule **g0, **g1;
6321 bool next_genbit;
6322
6323 next_genbit = nft_gencursor_next(net);
6324
6325 g0 = rcu_dereference_protected(chain->rules_gen_0,
f102d66b 6326 lockdep_commit_lock_is_held(net));
0cbc06b3 6327 g1 = rcu_dereference_protected(chain->rules_gen_1,
f102d66b 6328 lockdep_commit_lock_is_held(net));
0cbc06b3
FW		 6329
6330 /* No changes to this chain? */
6331 if (chain->rules_next == NULL) {
6332 /* chain had no change in last or next generation */
6333 if (g0 == g1)
6334 return;
6335 /*
6336 * chain had no change in this generation; make sure next
6337 * one uses same rules as current generation.
6338 */
6339 if (next_genbit) {
6340 rcu_assign_pointer(chain->rules_gen_1, g0);
6341 nf_tables_commit_chain_free_rules_old(g1);
6342 } else {
6343 rcu_assign_pointer(chain->rules_gen_0, g1);
6344 nf_tables_commit_chain_free_rules_old(g0);
6345 }
6346
6347 return;
6348 }
6349
6350 if (next_genbit)
6351 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6352 else
6353 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6354
6355 chain->rules_next = NULL;
6356
6357 if (g0 == g1)
6358 return;
6359
6360 if (next_genbit)
6361 nf_tables_commit_chain_free_rules_old(g1);
6362 else
6363 nf_tables_commit_chain_free_rules_old(g0);
6364}
6365
1b2470e5
FW		 6366static void nft_chain_del(struct nft_chain *chain)
6367{
6368 struct nft_table *table = chain->table;
6369
6370 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
6371 nft_chain_ht_params));
6372 list_del_rcu(&chain->list);
6373}
6374
0935d558
FW		 6375static void nf_tables_commit_release(struct net *net)
6376{
6377 struct nft_trans *trans;
6378
6379 /* all side effects have to be made visible.
6380 * For example, if a chain named 'foo' has been deleted, a
6381 * new transaction must not find it anymore.
6382 *
6383 * Memory reclaim happens asynchronously from work queue
6384 * to prevent expensive synchronize_rcu() in commit phase.
6385 */
6386 if (list_empty(&net->nft.commit_list)) {
6387 mutex_unlock(&net->nft.commit_mutex);
6388 return;
6389 }
6390
6391 trans = list_last_entry(&net->nft.commit_list,
6392 struct nft_trans, list);
6393 get_net(trans->ctx.net);
6394 WARN_ON_ONCE(trans->put_net);
6395
6396 trans->put_net = true;
6397 spin_lock(&nf_tables_destroy_list_lock);
6398 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
6399 spin_unlock(&nf_tables_destroy_list_lock);
6400
6401 mutex_unlock(&net->nft.commit_mutex);
6402
6403 schedule_work(&trans_destroy_work);
6404}
6405
5913beaf 6406static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 6407{
37082f93 6408 struct nft_trans *trans, *next;
a3716e70 6409 struct nft_trans_elem *te;
0cbc06b3
FW		 6410 struct nft_chain *chain;
6411 struct nft_table *table;
37082f93 6412
a654de8f
PNA		 6413 /* 0. Validate ruleset, otherwise roll back for error reporting. */
6414 if (nf_tables_validate(net) < 0)
6415 return -EAGAIN;
6416
0cbc06b3
FW		 6417 /* 1. Allocate space for next generation rules_gen_X[] */
6418 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6419 int ret;
37082f93 6420
0cbc06b3
FW		 6421 if (trans->msg_type == NFT_MSG_NEWRULE ||
6422 trans->msg_type == NFT_MSG_DELRULE) {
6423 chain = trans->ctx.chain;
6424
6425 ret = nf_tables_commit_chain_prepare(net, chain);
6426 if (ret < 0) {
6427 nf_tables_commit_chain_prepare_cancel(net);
6428 return ret;
6429 }
6430 }
6431 }
37082f93 6432
0cbc06b3
FW		 6433 /* step 2. Make rules_gen_X visible to packet path */
6434 list_for_each_entry(table, &net->nft.tables, list) {
0fb39bbe
FW		 6435 list_for_each_entry(chain, &table->chains, list)
6436 nf_tables_commit_chain(net, chain);
0cbc06b3
FW		 6437 }
6438
6439 /*
6440 * Bump generation counter, invalidate any dump in progress.
6441 * Cannot fail after this point.
37082f93 6442 */
0cbc06b3
FW		 6443 while (++net->nft.base_seq == 0);
6444
6445 /* step 3. Start new generation, rules_gen_X now in use. */
6446 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 6447
6448 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 6449 switch (trans->msg_type) {
55dd6f93
PNA		 6450 case NFT_MSG_NEWTABLE:
6451 if (nft_trans_table_update(trans)) {
6452 if (!nft_trans_table_enable(trans)) {
664b0f8c 6453 nf_tables_table_disable(net,
55dd6f93
PNA		 6454 trans->ctx.table);
6455 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6456 }
6457 } else {
f2a6d766 6458 nft_clear(net, trans->ctx.table);
55dd6f93 6459 }
35151d84 6460 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 6461 nft_trans_destroy(trans);
6462 break;
6463 case NFT_MSG_DELTABLE:
f2a6d766 6464 list_del_rcu(&trans->ctx.table->list);
35151d84 6465 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 6466 break;
91c7b38d 6467 case NFT_MSG_NEWCHAIN:
9f8aac0b 6468 if (nft_trans_chain_update(trans)) {
91c7b38d 6469 nft_chain_commit_update(trans);
9f8aac0b
FW		 6470 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6471 /* trans destroyed after rcu grace period */
6472 } else {
664b0f8c 6473 nft_clear(net, trans->ctx.chain);
9f8aac0b
FW		 6474 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6475 nft_trans_destroy(trans);
6476 }
91c7b38d
PNA		 6477 break;
6478 case NFT_MSG_DELCHAIN:
1b2470e5 6479 nft_chain_del(trans->ctx.chain);
35151d84 6480 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 6481 nf_tables_unregister_hook(trans->ctx.net,
6482 trans->ctx.table,
6483 trans->ctx.chain);
91c7b38d 6484 break;
b380e5c7 6485 case NFT_MSG_NEWRULE:
889f7ee7 6486 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 6487 nf_tables_rule_notify(&trans->ctx,
37082f93 6488 nft_trans_rule(trans),
35151d84 6489 NFT_MSG_NEWRULE);
37082f93 6490 nft_trans_destroy(trans);
b380e5c7
PNA		 6491 break;
6492 case NFT_MSG_DELRULE:
6493 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 6494 nf_tables_rule_notify(&trans->ctx,
6495 nft_trans_rule(trans),
6496 NFT_MSG_DELRULE);
b380e5c7 6497 break;
958bee14 6498 case NFT_MSG_NEWSET:
37a9cc52 6499 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 6500 /* This avoids hitting -EBUSY when deleting the table
6501 * from the transaction.
6502 */
408070d6 6503 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 6504 !list_empty(&nft_trans_set(trans)->bindings))
6505 trans->ctx.table->use--;
6506
958bee14 6507 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6508 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 6509 nft_trans_destroy(trans);
6510 break;
6511 case NFT_MSG_DELSET:
37a9cc52 6512 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 6513 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6514 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 6515 break;
60319eb1 6516 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 6517 te = (struct nft_trans_elem *)trans->data;
6518
42a55769 6519 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 6520 nf_tables_setelem_notify(&trans->ctx, te->set,
6521 &te->elem,
60319eb1
PNA		 6522 NFT_MSG_NEWSETELEM, 0);
6523 nft_trans_destroy(trans);
6524 break;
6525 case NFT_MSG_DELSETELEM:
a3716e70 6526 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6527
a3716e70
PNA		 6528 nf_tables_setelem_notify(&trans->ctx, te->set,
6529 &te->elem,
60319eb1 6530 NFT_MSG_DELSETELEM, 0);
5cb82a38 6531 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 6532 atomic_dec(&te->set->nelems);
6533 te->set->ndeact--;
60319eb1 6534 break;
e5009240
PNA		 6535 case NFT_MSG_NEWOBJ:
6536 nft_clear(net, nft_trans_obj(trans));
6537 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6538 NFT_MSG_NEWOBJ);
6539 nft_trans_destroy(trans);
6540 break;
6541 case NFT_MSG_DELOBJ:
6542 list_del_rcu(&nft_trans_obj(trans)->list);
6543 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6544 NFT_MSG_DELOBJ);
6545 break;
3b49e2e9
PNA		 6546 case NFT_MSG_NEWFLOWTABLE:
6547 nft_clear(net, nft_trans_flowtable(trans));
6548 nf_tables_flowtable_notify(&trans->ctx,
6549 nft_trans_flowtable(trans),
6550 NFT_MSG_NEWFLOWTABLE);
6551 nft_trans_destroy(trans);
6552 break;
6553 case NFT_MSG_DELFLOWTABLE:
6554 list_del_rcu(&nft_trans_flowtable(trans)->list);
6555 nf_tables_flowtable_notify(&trans->ctx,
6556 nft_trans_flowtable(trans),
6557 NFT_MSG_DELFLOWTABLE);
6558 nft_unregister_flowtable_net_hooks(net,
6559 nft_trans_flowtable(trans));
6560 break;
37082f93 6561 }
37082f93
PNA		 6562 }
6563
84d7fce6 6564 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
0935d558 6565 nf_tables_commit_release(net);
37082f93
PNA		 6566
6567 return 0;
6568}
6569
b326dd37 6570static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 6571{
c7c32e72
PNA		 6572 switch (trans->msg_type) {
6573 case NFT_MSG_NEWTABLE:
6574 nf_tables_table_destroy(&trans->ctx);
6575 break;
6576 case NFT_MSG_NEWCHAIN:
43a605f2 6577 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6578 break;
6579 case NFT_MSG_NEWRULE:
6580 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6581 break;
6582 case NFT_MSG_NEWSET:
6583 nft_set_destroy(nft_trans_set(trans));
6584 break;
61edafbb
PM		 6585 case NFT_MSG_NEWSETELEM:
6586 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 6587 nft_trans_elem(trans).priv, true);
61edafbb 6588 break;
e5009240 6589 case NFT_MSG_NEWOBJ:
00bfb320 6590 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6591 break;
3b49e2e9
PNA		 6592 case NFT_MSG_NEWFLOWTABLE:
6593 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6594 break;
c7c32e72
PNA		 6595 }
6596 kfree(trans);
6597}
6598
71ad00c5 6599static int __nf_tables_abort(struct net *net)
37082f93 6600{
37082f93 6601 struct nft_trans *trans, *next;
02263db0 6602 struct nft_trans_elem *te;
37082f93 6603
a907e36d
XL		 6604 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6605 list) {
b380e5c7 6606 switch (trans->msg_type) {
55dd6f93
PNA		 6607 case NFT_MSG_NEWTABLE:
6608 if (nft_trans_table_update(trans)) {
6609 if (nft_trans_table_enable(trans)) {
664b0f8c 6610 nf_tables_table_disable(net,
55dd6f93
PNA		 6611 trans->ctx.table);
6612 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6613 }
6614 nft_trans_destroy(trans);
6615 } else {
e688a7f8 6616 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 6617 }
6618 break;
6619 case NFT_MSG_DELTABLE:
f2a6d766 6620 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 6621 nft_trans_destroy(trans);
6622 break;
91c7b38d
PNA		 6623 case NFT_MSG_NEWCHAIN:
6624 if (nft_trans_chain_update(trans)) {
982f4051 6625 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b 6626 kfree(nft_trans_chain_name(trans));
91c7b38d
PNA		 6627 nft_trans_destroy(trans);
6628 } else {
4fefee57 6629 trans->ctx.table->use--;
1b2470e5 6630 nft_chain_del(trans->ctx.chain);
c974a3a3
PNA		 6631 nf_tables_unregister_hook(trans->ctx.net,
6632 trans->ctx.table,
6633 trans->ctx.chain);
91c7b38d
PNA		 6634 }
6635 break;
6636 case NFT_MSG_DELCHAIN:
4fefee57 6637 trans->ctx.table->use++;
664b0f8c 6638 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 6639 nft_trans_destroy(trans);
6640 break;
b380e5c7 6641 case NFT_MSG_NEWRULE:
4fefee57 6642 trans->ctx.chain->use--;
b380e5c7 6643 list_del_rcu(&nft_trans_rule(trans)->list);
bb7b40ae 6644 nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
b380e5c7
PNA		 6645 break;
6646 case NFT_MSG_DELRULE:
4fefee57 6647 trans->ctx.chain->use++;
889f7ee7 6648 nft_clear(trans->ctx.net, nft_trans_rule(trans));
bb7b40ae 6649 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
37082f93 6650 nft_trans_destroy(trans);
b380e5c7 6651 break;
958bee14 6652 case NFT_MSG_NEWSET:
4fefee57 6653 trans->ctx.table->use--;
e688a7f8 6654 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 6655 break;
6656 case NFT_MSG_DELSET:
4fefee57 6657 trans->ctx.table->use++;
37a9cc52 6658 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 6659 nft_trans_destroy(trans);
6660 break;
60319eb1 6661 case NFT_MSG_NEWSETELEM:
02263db0 6662 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6663
5cb82a38 6664 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 6665 atomic_dec(&te->set->nelems);
60319eb1
PNA		 6666 break;
6667 case NFT_MSG_DELSETELEM:
cc02e457
PM		 6668 te = (struct nft_trans_elem *)trans->data;
6669
59105446 6670 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 6671 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 6672 te->set->ndeact--;
cc02e457 6673
e5009240
PNA		 6674 nft_trans_destroy(trans);
6675 break;
6676 case NFT_MSG_NEWOBJ:
6677 trans->ctx.table->use--;
6678 list_del_rcu(&nft_trans_obj(trans)->list);
6679 break;
6680 case NFT_MSG_DELOBJ:
6681 trans->ctx.table->use++;
6682 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 6683 nft_trans_destroy(trans);
6684 break;
3b49e2e9
PNA		 6685 case NFT_MSG_NEWFLOWTABLE:
6686 trans->ctx.table->use--;
6687 list_del_rcu(&nft_trans_flowtable(trans)->list);
6688 nft_unregister_flowtable_net_hooks(net,
6689 nft_trans_flowtable(trans));
6690 break;
6691 case NFT_MSG_DELFLOWTABLE:
6692 trans->ctx.table->use++;
6693 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6694 nft_trans_destroy(trans);
6695 break;
37082f93 6696 }
37082f93
PNA		 6697 }
6698
b326dd37
PNA		 6699 synchronize_rcu();
6700
a1cee076
PNA		 6701 list_for_each_entry_safe_reverse(trans, next,
6702 &net->nft.commit_list, list) {
c7c32e72 6703 list_del(&trans->list);
b326dd37 6704 nf_tables_abort_release(trans);
37082f93
PNA		 6705 }
6706
6707 return 0;
6708}
6709
a654de8f
PNA		 6710static void nf_tables_cleanup(struct net *net)
6711{
6712 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
6713}
6714
71ad00c5
FW		 6715static int nf_tables_abort(struct net *net, struct sk_buff *skb)
6716{
f102d66b
FW		 6717 int ret = __nf_tables_abort(net);
6718
6719 mutex_unlock(&net->nft.commit_mutex);
6720
6721 return ret;
71ad00c5
FW		 6722}
6723
74e8bcd2
PNA		 6724static bool nf_tables_valid_genid(struct net *net, u32 genid)
6725{
f102d66b
FW		 6726 bool genid_ok;
6727
6728 mutex_lock(&net->nft.commit_mutex);
6729
6730 genid_ok = genid == 0 || net->nft.base_seq == genid;
6731 if (!genid_ok)
6732 mutex_unlock(&net->nft.commit_mutex);
6733
6734 /* else, commit mutex has to be released by commit or abort function */
6735 return genid_ok;
74e8bcd2
PNA		 6736}
6737
96518518
PM		 6738static const struct nfnetlink_subsystem nf_tables_subsys = {
6739 .name = "nf_tables",
6740 .subsys_id = NFNL_SUBSYS_NFTABLES,
6741 .cb_count = NFT_MSG_MAX,
6742 .cb = nf_tables_cb,
0628b123
PNA		 6743 .commit = nf_tables_commit,
6744 .abort = nf_tables_abort,
a654de8f 6745 .cleanup = nf_tables_cleanup,
74e8bcd2 6746 .valid_genid = nf_tables_valid_genid,
be2ab5b4 6747 .owner = THIS_MODULE,
96518518
PM		 6748};
6749
7210e4e3 6750int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 6751 enum nft_chain_types type)
7210e4e3
PNA		 6752{
6753 const struct nft_base_chain *basechain;
6754
f323d954 6755 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6756 basechain = nft_base_chain(chain);
6757 if (basechain->type->type != type)
6758 return -EOPNOTSUPP;
6759 }
6760 return 0;
6761}
6762EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6763
75e8d06d
PNA		 6764int nft_chain_validate_hooks(const struct nft_chain *chain,
6765 unsigned int hook_flags)
6766{
6767 struct nft_base_chain *basechain;
6768
f323d954 6769 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6770 basechain = nft_base_chain(chain);
6771
c974a3a3 6772 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6773 return 0;
6774
6775 return -EOPNOTSUPP;
6776 }
6777
6778 return 0;
6779}
6780EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6781
20a69341
PM		 6782/*
6783 * Loop detection - walk through the ruleset beginning at the destination chain
6784 * of a new jump until either the source chain is reached (loop) or all
6785 * reachable chains have been traversed.
6786 *
6787 * The loop check is performed whenever a new jump verdict is added to an
6788 * expression or verdict map or a verdict map is bound to a new chain.
6789 */
6790
6791static int nf_tables_check_loops(const struct nft_ctx *ctx,
6792 const struct nft_chain *chain);
6793
6794static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6795 struct nft_set *set,
20a69341 6796 const struct nft_set_iter *iter,
de70185d 6797 struct nft_set_elem *elem)
20a69341 6798{
fe2811eb
PM		 6799 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6800 const struct nft_data *data;
6801
6802 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6803 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 6804 return 0;
6805
fe2811eb 6806 data = nft_set_ext_data(ext);
1ca2e170 6807 switch (data->verdict.code) {
20a69341
PM		 6808 case NFT_JUMP:
6809 case NFT_GOTO:
1ca2e170 6810 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6811 default:
6812 return 0;
6813 }
6814}
6815
6816static int nf_tables_check_loops(const struct nft_ctx *ctx,
6817 const struct nft_chain *chain)
6818{
6819 const struct nft_rule *rule;
6820 const struct nft_expr *expr, *last;
de70185d 6821 struct nft_set *set;
20a69341
PM		 6822 struct nft_set_binding *binding;
6823 struct nft_set_iter iter;
20a69341
PM		 6824
6825 if (ctx->chain == chain)
6826 return -ELOOP;
6827
6828 list_for_each_entry(rule, &chain->rules, list) {
6829 nft_rule_for_each_expr(expr, last, rule) {
a654de8f
PNA		 6830 struct nft_immediate_expr *priv;
6831 const struct nft_data *data;
0ca743a5
PNA		 6832 int err;
6833
a654de8f 6834 if (strcmp(expr->ops->type->name, "immediate"))
20a69341
PM		 6835 continue;
6836
a654de8f
PNA		 6837 priv = nft_expr_priv(expr);
6838 if (priv->dreg != NFT_REG_VERDICT)
0ca743a5 6839 continue;
20a69341 6840
a654de8f 6841 data = &priv->data;
1ca2e170 6842 switch (data->verdict.code) {
20a69341
PM		 6843 case NFT_JUMP:
6844 case NFT_GOTO:
1ca2e170
PM		 6845 err = nf_tables_check_loops(ctx,
6846 data->verdict.chain);
20a69341
PM		 6847 if (err < 0)
6848 return err;
6849 default:
6850 break;
6851 }
6852 }
6853 }
6854
6855 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 6856 if (!nft_is_active_next(ctx->net, set))
6857 continue;
20a69341
PM		 6858 if (!(set->flags & NFT_SET_MAP) ||
6859 set->dtype != NFT_DATA_VERDICT)
6860 continue;
6861
6862 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 6863 if (!(binding->flags & NFT_SET_MAP) ||
6864 binding->chain != chain)
20a69341
PM		 6865 continue;
6866
8588ac09 6867 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 6868 iter.skip = 0;
6869 iter.count = 0;
6870 iter.err = 0;
6871 iter.fn = nf_tables_loop_check_setelem;
6872
6873 set->ops->walk(ctx, set, &iter);
6874 if (iter.err < 0)
6875 return iter.err;
6876 }
6877 }
6878
6879 return 0;
6880}
6881
36b701fa
LGL		 6882/**
6883 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6884 *
6885 * @attr: netlink attribute to fetch value from
6886 * @max: maximum value to be stored in dest
6887 * @dest: pointer to the variable
6888 *
6889 * Parse, check and store a given u32 netlink attribute into variable.
6890 * This function returns -ERANGE if the value goes over maximum value.
6891 * Otherwise a 0 is returned and the attribute value is stored in the
6892 * destination variable.
6893 */
f1d505bb 6894int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 6895{
09525a09 6896 u32 val;
36b701fa
LGL		 6897
6898 val = ntohl(nla_get_be32(attr));
6899 if (val > max)
6900 return -ERANGE;
6901
6902 *dest = val;
6903 return 0;
6904}
6905EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6906
49499c3e
PM		 6907/**
6908 * nft_parse_register - parse a register value from a netlink attribute
6909 *
6910 * @attr: netlink attribute
6911 *
6912 * Parse and translate a register value from a netlink attribute.
6913 * Registers used to be 128 bit wide, these register numbers will be
6914 * mapped to the corresponding 32 bit register numbers.
6915 */
b1c96ed3
PM		 6916unsigned int nft_parse_register(const struct nlattr *attr)
6917{
49499c3e
PM		 6918 unsigned int reg;
6919
6920 reg = ntohl(nla_get_be32(attr));
6921 switch (reg) {
6922 case NFT_REG_VERDICT...NFT_REG_4:
6923 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6924 default:
6925 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6926 }
b1c96ed3
PM		 6927}
6928EXPORT_SYMBOL_GPL(nft_parse_register);
6929
49499c3e
PM		 6930/**
6931 * nft_dump_register - dump a register value to a netlink attribute
6932 *
6933 * @skb: socket buffer
6934 * @attr: attribute number
6935 * @reg: register number
6936 *
6937 * Construct a netlink attribute containing the register number. For
6938 * compatibility reasons, register numbers being a multiple of 4 are
6939 * translated to the corresponding 128 bit register numbers.
6940 */
b1c96ed3
PM		 6941int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6942{
49499c3e
PM		 6943 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6944 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6945 else
6946 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6947
b1c96ed3
PM		 6948 return nla_put_be32(skb, attr, htonl(reg));
6949}
6950EXPORT_SYMBOL_GPL(nft_dump_register);
6951
96518518 6952/**
d07db988 6953 * nft_validate_register_load - validate a load from a register
96518518
PM		 6954 *
6955 * @reg: the register number
d07db988 6956 * @len: the length of the data
96518518
PM		 6957 *
6958 * Validate that the input register is one of the general purpose
d07db988 6959 * registers and that the length of the load is within the bounds.
96518518 6960 */
d07db988 6961int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 6962{
49499c3e 6963 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 6964 return -EINVAL;
d07db988
PM		 6965 if (len == 0)
6966 return -EINVAL;
49499c3e 6967 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 6968 return -ERANGE;
49499c3e 6969
96518518
PM		 6970 return 0;
6971}
d07db988 6972EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 6973
96518518 6974/**
1ec10212 6975 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 6976 *
6977 * @ctx: context of the expression performing the load
6978 * @reg: the destination register number
6979 * @data: the data to load
6980 * @type: the data type
45d9bcda 6981 * @len: the length of the data
96518518
PM		 6982 *
6983 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 6984 * the destination register and the length is within the bounds.
6985 * A value of NULL for the data means that its runtime gathered
58f40ab6 6986 * data.
96518518 6987 */
1ec10212
PM		 6988int nft_validate_register_store(const struct nft_ctx *ctx,
6989 enum nft_registers reg,
6990 const struct nft_data *data,
6991 enum nft_data_types type, unsigned int len)
96518518 6992{
20a69341
PM		 6993 int err;
6994
96518518
PM		 6995 switch (reg) {
6996 case NFT_REG_VERDICT:
58f40ab6 6997 if (type != NFT_DATA_VERDICT)
96518518 6998 return -EINVAL;
20a69341 6999
58f40ab6 7000 if (data != NULL &&
1ca2e170
PM		 7001 (data->verdict.code == NFT_GOTO ||
7002 data->verdict.code == NFT_JUMP)) {
7003 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7004 if (err < 0)
7005 return err;
20a69341
PM		 7006 }
7007
96518518
PM		 7008 return 0;
7009 default:
49499c3e 7010 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 7011 return -EINVAL;
45d9bcda
PM		 7012 if (len == 0)
7013 return -EINVAL;
49499c3e
PM		 7014 if (reg * NFT_REG32_SIZE + len >
7015 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 7016 return -ERANGE;
27e6d201 7017
96518518
PM		 7018 if (data != NULL && type != NFT_DATA_VALUE)
7019 return -EINVAL;
7020 return 0;
7021 }
7022}
1ec10212 7023EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 7024
7025static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
7026 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
7027 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
7028 .len = NFT_CHAIN_MAXNAMELEN - 1 },
7029};
7030
7031static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
7032 struct nft_data_desc *desc, const struct nlattr *nla)
7033{
664b0f8c 7034 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 7035 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
7036 struct nft_chain *chain;
7037 int err;
7038
fceb6435
JB		 7039 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
7040 NULL);
96518518
PM		 7041 if (err < 0)
7042 return err;
7043
7044 if (!tb[NFTA_VERDICT_CODE])
7045 return -EINVAL;
1ca2e170 7046 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 7047
1ca2e170 7048 switch (data->verdict.code) {
e0abdadc 7049 default:
1ca2e170 7050 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 7051 case NF_ACCEPT:
7052 case NF_DROP:
7053 case NF_QUEUE:
7054 break;
7055 default:
7056 return -EINVAL;
7057 }
7058 /* fall through */
96518518
PM		 7059 case NFT_CONTINUE:
7060 case NFT_BREAK:
7061 case NFT_RETURN:
96518518
PM		 7062 break;
7063 case NFT_JUMP:
7064 case NFT_GOTO:
7065 if (!tb[NFTA_VERDICT_CHAIN])
7066 return -EINVAL;
f102d66b
FW		 7067 chain = nft_chain_lookup(ctx->net, ctx->table,
7068 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 7069 if (IS_ERR(chain))
7070 return PTR_ERR(chain);
f323d954 7071 if (nft_is_base_chain(chain))
96518518
PM		 7072 return -EOPNOTSUPP;
7073
96518518 7074 chain->use++;
1ca2e170 7075 data->verdict.chain = chain;
96518518 7076 break;
96518518
PM		 7077 }
7078
4c4ed074 7079 desc->len = sizeof(data->verdict);
96518518
PM		 7080 desc->type = NFT_DATA_VERDICT;
7081 return 0;
7082}
7083
7084static void nft_verdict_uninit(const struct nft_data *data)
7085{
1ca2e170 7086 switch (data->verdict.code) {
96518518
PM		 7087 case NFT_JUMP:
7088 case NFT_GOTO:
1ca2e170 7089 data->verdict.chain->use--;
96518518
PM		 7090 break;
7091 }
7092}
7093
33d5a7b1 7094int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 7095{
7096 struct nlattr *nest;
7097
33d5a7b1 7098 nest = nla_nest_start(skb, type);
96518518
PM		 7099 if (!nest)
7100 goto nla_put_failure;
7101
33d5a7b1 7102 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 7103 goto nla_put_failure;
7104
33d5a7b1 7105 switch (v->code) {
96518518
PM		 7106 case NFT_JUMP:
7107 case NFT_GOTO:
1ca2e170 7108 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 7109 v->chain->name))
96518518
PM		 7110 goto nla_put_failure;
7111 }
7112 nla_nest_end(skb, nest);
7113 return 0;
7114
7115nla_put_failure:
7116 return -1;
7117}
7118
d0a11fc3
PM		 7119static int nft_value_init(const struct nft_ctx *ctx,
7120 struct nft_data *data, unsigned int size,
96518518
PM		 7121 struct nft_data_desc *desc, const struct nlattr *nla)
7122{
7123 unsigned int len;
7124
7125 len = nla_len(nla);
7126 if (len == 0)
7127 return -EINVAL;
d0a11fc3 7128 if (len > size)
96518518
PM		 7129 return -EOVERFLOW;
7130
d0a11fc3 7131 nla_memcpy(data->data, nla, len);
96518518
PM		 7132 desc->type = NFT_DATA_VALUE;
7133 desc->len = len;
7134 return 0;
7135}
7136
7137static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
7138 unsigned int len)
7139{
7140 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
7141}
7142
7143static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 7144 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 7145 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
7146};
7147
7148/**
7149 * nft_data_init - parse nf_tables data netlink attributes
7150 *
7151 * @ctx: context of the expression using the data
7152 * @data: destination struct nft_data
d0a11fc3 7153 * @size: maximum data length
96518518
PM		 7154 * @desc: data description
7155 * @nla: netlink attribute containing data
7156 *
7157 * Parse the netlink data attributes and initialize a struct nft_data.
7158 * The type and length of data are returned in the data description.
7159 *
7160 * The caller can indicate that it only wants to accept data of type
7161 * NFT_DATA_VALUE by passing NULL for the ctx argument.
7162 */
d0a11fc3
PM		 7163int nft_data_init(const struct nft_ctx *ctx,
7164 struct nft_data *data, unsigned int size,
96518518
PM		 7165 struct nft_data_desc *desc, const struct nlattr *nla)
7166{
7167 struct nlattr *tb[NFTA_DATA_MAX + 1];
7168 int err;
7169
fceb6435 7170 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 7171 if (err < 0)
7172 return err;
7173
7174 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 7175 return nft_value_init(ctx, data, size, desc,
7176 tb[NFTA_DATA_VALUE]);
96518518
PM		 7177 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
7178 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
7179 return -EINVAL;
7180}
7181EXPORT_SYMBOL_GPL(nft_data_init);
7182
7183/**
59105446 7184 * nft_data_release - release a nft_data item
96518518
PM		 7185 *
7186 * @data: struct nft_data to release
7187 * @type: type of data
7188 *
7189 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
7190 * all others need to be released by calling this function.
7191 */
59105446 7192void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 7193{
960bd2c2 7194 if (type < NFT_DATA_VERDICT)
96518518 7195 return;
960bd2c2 7196 switch (type) {
96518518
PM		 7197 case NFT_DATA_VERDICT:
7198 return nft_verdict_uninit(data);
7199 default:
7200 WARN_ON(1);
7201 }
7202}
59105446 7203EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 7204
7205int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
7206 enum nft_data_types type, unsigned int len)
7207{
7208 struct nlattr *nest;
7209 int err;
7210
7211 nest = nla_nest_start(skb, attr);
7212 if (nest == NULL)
7213 return -1;
7214
7215 switch (type) {
7216 case NFT_DATA_VALUE:
7217 err = nft_value_dump(skb, data, len);
7218 break;
7219 case NFT_DATA_VERDICT:
33d5a7b1 7220 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 7221 break;
7222 default:
7223 err = -EINVAL;
7224 WARN_ON(1);
7225 }
7226
7227 nla_nest_end(skb, nest);
7228 return err;
7229}
7230EXPORT_SYMBOL_GPL(nft_data_dump);
7231
5ebe0b0e
PNA		 7232int __nft_release_basechain(struct nft_ctx *ctx)
7233{
7234 struct nft_rule *rule, *nr;
7235
fa5950e4
FW		 7236 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
7237 return 0;
5ebe0b0e 7238
c974a3a3 7239 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 7240 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
7241 list_del(&rule->list);
7242 ctx->chain->use--;
bb7b40ae 7243 nf_tables_rule_release(ctx, rule);
5ebe0b0e 7244 }
1b2470e5 7245 nft_chain_del(ctx->chain);
5ebe0b0e 7246 ctx->table->use--;
43a605f2 7247 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 7248
7249 return 0;
7250}
7251EXPORT_SYMBOL_GPL(__nft_release_basechain);
7252
98319cb9 7253static void __nft_release_tables(struct net *net)
df05ef87 7254{
3b49e2e9 7255 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 7256 struct nft_table *table, *nt;
7257 struct nft_chain *chain, *nc;
e5009240 7258 struct nft_object *obj, *ne;
df05ef87
PNA		 7259 struct nft_rule *rule, *nr;
7260 struct nft_set *set, *ns;
7261 struct nft_ctx ctx = {
7262 .net = net,
43a605f2 7263 .family = NFPROTO_NETDEV,
df05ef87
PNA		 7264 };
7265
36596dad 7266 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 7267 ctx.family = table->family;
dd4cbef7 7268
df05ef87 7269 list_for_each_entry(chain, &table->chains, list)
c974a3a3 7270 nf_tables_unregister_hook(net, table, chain);
df05ef87
PNA		 7271 /* No packets are walking on these chains anymore. */
7272 ctx.table = table;
7273 list_for_each_entry(chain, &table->chains, list) {
7274 ctx.chain = chain;
7275 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7276 list_del(&rule->list);
7277 chain->use--;
bb7b40ae 7278 nf_tables_rule_release(&ctx, rule);
df05ef87
PNA		 7279 }
7280 }
3b49e2e9
PNA		 7281 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7282 list_del(&flowtable->list);
7283 table->use--;
7284 nf_tables_flowtable_destroy(flowtable);
7285 }
df05ef87
PNA		 7286 list_for_each_entry_safe(set, ns, &table->sets, list) {
7287 list_del(&set->list);
7288 table->use--;
7289 nft_set_destroy(set);
7290 }
e5009240
PNA		 7291 list_for_each_entry_safe(obj, ne, &table->objects, list) {
7292 list_del(&obj->list);
7293 table->use--;
00bfb320 7294 nft_obj_destroy(&ctx, obj);
e5009240 7295 }
df05ef87 7296 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 7297 ctx.chain = chain;
1b2470e5 7298 nft_chain_del(chain);
df05ef87 7299 table->use--;
43a605f2 7300 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 7301 }
7302 list_del(&table->list);
7303 nf_tables_table_destroy(&ctx);
7304 }
7305}
7306
dd4cbef7
PNA		 7307static int __net_init nf_tables_init_net(struct net *net)
7308{
7309 INIT_LIST_HEAD(&net->nft.tables);
7310 INIT_LIST_HEAD(&net->nft.commit_list);
f102d66b 7311 mutex_init(&net->nft.commit_mutex);
dd4cbef7 7312 net->nft.base_seq = 1;
a654de8f
PNA		 7313 net->nft.validate_state = NFT_VALIDATE_SKIP;
7314
dd4cbef7
PNA		 7315 return 0;
7316}
7317
7318static void __net_exit nf_tables_exit_net(struct net *net)
7319{
f102d66b 7320 mutex_lock(&net->nft.commit_mutex);
71ad00c5
FW		 7321 if (!list_empty(&net->nft.commit_list))
7322 __nf_tables_abort(net);
98319cb9 7323 __nft_release_tables(net);
f102d66b 7324 mutex_unlock(&net->nft.commit_mutex);
dd4cbef7 7325 WARN_ON_ONCE(!list_empty(&net->nft.tables));
dd4cbef7
PNA		 7326}
7327
99633ab2
PNA		 7328static struct pernet_operations nf_tables_net_ops = {
7329 .init = nf_tables_init_net,
613d0776 7330 .exit = nf_tables_exit_net,
99633ab2
PNA		 7331};
7332
96518518
PM		 7333static int __init nf_tables_module_init(void)
7334{
7335 int err;
7336
0935d558 7337 spin_lock_init(&nf_tables_destroy_list_lock);
d209df3e
FW		 7338 err = register_pernet_subsys(&nf_tables_net_ops);
7339 if (err < 0)
7340 return err;
7341
7342 err = nft_chain_filter_init();
7343 if (err < 0)
7344 goto err1;
02c7b25e 7345
96518518
PM		 7346 err = nf_tables_core_module_init();
7347 if (err < 0)
d209df3e 7348 goto err2;
96518518 7349
d209df3e 7350 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
96518518 7351 if (err < 0)
d209df3e 7352 goto err3;
96518518 7353
d209df3e
FW		 7354 /* must be last */
7355 err = nfnetlink_subsys_register(&nf_tables_subsys);
7356 if (err < 0)
7357 goto err4;
3b49e2e9 7358
d209df3e
FW		 7359 return err;
7360err4:
7361 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7362err3:
96518518 7363 nf_tables_core_module_exit();
d209df3e
FW		 7364err2:
7365 nft_chain_filter_fini();
7366err1:
7367 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 7368 return err;
7369}
7370
7371static void __exit nf_tables_module_exit(void)
7372{
7373 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 7374 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
0a2cf5ee 7375 nft_chain_filter_fini();
71ad00c5 7376 unregister_pernet_subsys(&nf_tables_net_ops);
0935d558 7377 cancel_work_sync(&trans_destroy_work);
1b1bc49c 7378 rcu_barrier();
96518518 7379 nf_tables_core_module_exit();
96518518
PM		 7380}
7381
7382module_init(nf_tables_module_init);
7383module_exit(nf_tables_module_exit);
7384
7385MODULE_LICENSE("GPL");
7386MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
7387MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror