]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_tables: check for overflow of rule dlen field
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nfnetlink.h>
18#include <linux/netfilter/nf_tables.h>
19#include <net/netfilter/nf_tables_core.h>
20#include <net/netfilter/nf_tables.h>
99633ab2 21#include <net/net_namespace.h>
96518518
PM		 22#include <net/sock.h>
23
96518518
PM		 24static LIST_HEAD(nf_tables_expressions);
25
26/**
27 * nft_register_afinfo - register nf_tables address family info
28 *
29 * @afi: address family info to register
30 *
31 * Register the address family for use with nf_tables. Returns zero on
32 * success or a negative errno code otherwise.
33 */
99633ab2 34int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 35{
36 INIT_LIST_HEAD(&afi->tables);
37 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 38 list_add_tail_rcu(&afi->list, &net->nft.af_info);
96518518
PM		 39 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
40 return 0;
41}
42EXPORT_SYMBOL_GPL(nft_register_afinfo);
43
44/**
45 * nft_unregister_afinfo - unregister nf_tables address family info
46 *
47 * @afi: address family info to unregister
48 *
49 * Unregister the address family for use with nf_tables.
50 */
51void nft_unregister_afinfo(struct nft_af_info *afi)
52{
53 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 54 list_del_rcu(&afi->list);
96518518
PM		 55 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
56}
57EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
58
99633ab2 59static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
96518518
PM		 60{
61 struct nft_af_info *afi;
62
99633ab2 63 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 64 if (afi->family == family)
65 return afi;
66 }
67 return NULL;
68}
69
99633ab2
PNA		 70static struct nft_af_info *
71nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
96518518
PM		 72{
73 struct nft_af_info *afi;
74
99633ab2 75 afi = nft_afinfo_lookup(net, family);
96518518
PM		 76 if (afi != NULL)
77 return afi;
78#ifdef CONFIG_MODULES
79 if (autoload) {
80 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
81 request_module("nft-afinfo-%u", family);
82 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 83 afi = nft_afinfo_lookup(net, family);
96518518
PM		 84 if (afi != NULL)
85 return ERR_PTR(-EAGAIN);
86 }
87#endif
88 return ERR_PTR(-EAFNOSUPPORT);
89}
90
7c95f6d8
PNA		 91static void nft_ctx_init(struct nft_ctx *ctx,
92 const struct sk_buff *skb,
93 const struct nlmsghdr *nlh,
94 struct nft_af_info *afi,
95 struct nft_table *table,
96 struct nft_chain *chain,
97 const struct nlattr * const *nla)
98{
128ad332
PNA		 99 ctx->net = sock_net(skb->sk);
100 ctx->afi = afi;
101 ctx->table = table;
102 ctx->chain = chain;
103 ctx->nla = nla;
104 ctx->portid = NETLINK_CB(skb).portid;
105 ctx->report = nlmsg_report(nlh);
106 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 107}
108
b380e5c7
PNA		 109static struct nft_trans *nft_trans_alloc(struct nft_ctx *ctx, int msg_type,
110 u32 size)
1081d11b
PNA		 111{
112 struct nft_trans *trans;
113
114 trans = kzalloc(sizeof(struct nft_trans) + size, GFP_KERNEL);
115 if (trans == NULL)
116 return NULL;
117
b380e5c7 118 trans->msg_type = msg_type;
1081d11b
PNA		 119 trans->ctx = *ctx;
120
121 return trans;
122}
123
124static void nft_trans_destroy(struct nft_trans *trans)
125{
126 list_del(&trans->list);
127 kfree(trans);
128}
129
c5598794
AB		 130static void nf_tables_unregister_hooks(const struct nft_table *table,
131 const struct nft_chain *chain,
132 unsigned int hook_nops)
133{
134 if (!(table->flags & NFT_TABLE_F_DORMANT) &&
135 chain->flags & NFT_BASE_CHAIN)
136 nf_unregister_hooks(nft_base_chain(chain)->ops, hook_nops);
137}
138
ee01d542
AB		 139/* Internal table flags */
140#define NFT_TABLE_INACTIVE (1 << 15)
141
142static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
143{
144 struct nft_trans *trans;
145
146 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
147 if (trans == NULL)
148 return -ENOMEM;
149
150 if (msg_type == NFT_MSG_NEWTABLE)
151 ctx->table->flags |= NFT_TABLE_INACTIVE;
152
153 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
154 return 0;
155}
156
157static int nft_deltable(struct nft_ctx *ctx)
158{
159 int err;
160
161 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
162 if (err < 0)
163 return err;
164
165 list_del_rcu(&ctx->table->list);
166 return err;
167}
168
169static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
170{
171 struct nft_trans *trans;
172
173 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
174 if (trans == NULL)
175 return -ENOMEM;
176
177 if (msg_type == NFT_MSG_NEWCHAIN)
178 ctx->chain->flags |= NFT_CHAIN_INACTIVE;
179
180 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
181 return 0;
182}
183
184static int nft_delchain(struct nft_ctx *ctx)
185{
186 int err;
187
188 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
189 if (err < 0)
190 return err;
191
192 ctx->table->use--;
193 list_del_rcu(&ctx->chain->list);
194
195 return err;
196}
197
198static inline bool
199nft_rule_is_active(struct net *net, const struct nft_rule *rule)
200{
201 return (rule->genmask & (1 << net->nft.gencursor)) == 0;
202}
203
204static inline int gencursor_next(struct net *net)
205{
206 return net->nft.gencursor+1 == 1 ? 1 : 0;
207}
208
209static inline int
210nft_rule_is_active_next(struct net *net, const struct nft_rule *rule)
211{
212 return (rule->genmask & (1 << gencursor_next(net))) == 0;
213}
214
215static inline void
216nft_rule_activate_next(struct net *net, struct nft_rule *rule)
217{
218 /* Now inactive, will be active in the future */
219 rule->genmask = (1 << net->nft.gencursor);
220}
221
222static inline void
223nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
224{
225 rule->genmask = (1 << gencursor_next(net));
226}
227
228static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
229{
8670c3a5 230 rule->genmask &= ~(1 << gencursor_next(net));
ee01d542
AB		 231}
232
233static int
234nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
235{
236 /* You cannot delete the same rule twice */
237 if (nft_rule_is_active_next(ctx->net, rule)) {
238 nft_rule_deactivate_next(ctx->net, rule);
239 ctx->chain->use--;
240 return 0;
241 }
242 return -ENOENT;
243}
244
245static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
246 struct nft_rule *rule)
247{
248 struct nft_trans *trans;
249
250 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
251 if (trans == NULL)
252 return NULL;
253
254 nft_trans_rule(trans) = rule;
255 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
256
257 return trans;
258}
259
260static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
261{
262 struct nft_trans *trans;
263 int err;
264
265 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
266 if (trans == NULL)
267 return -ENOMEM;
268
269 err = nf_tables_delrule_deactivate(ctx, rule);
270 if (err < 0) {
271 nft_trans_destroy(trans);
272 return err;
273 }
274
275 return 0;
276}
277
278static int nft_delrule_by_chain(struct nft_ctx *ctx)
279{
280 struct nft_rule *rule;
281 int err;
282
283 list_for_each_entry(rule, &ctx->chain->rules, list) {
284 err = nft_delrule(ctx, rule);
285 if (err < 0)
286 return err;
287 }
288 return 0;
289}
290
291/* Internal set flag */
292#define NFT_SET_INACTIVE (1 << 15)
293
294static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
295 struct nft_set *set)
296{
297 struct nft_trans *trans;
298
299 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
300 if (trans == NULL)
301 return -ENOMEM;
302
303 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
304 nft_trans_set_id(trans) =
305 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
306 set->flags |= NFT_SET_INACTIVE;
307 }
308 nft_trans_set(trans) = set;
309 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
310
311 return 0;
312}
313
314static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
315{
316 int err;
317
318 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
319 if (err < 0)
320 return err;
321
322 list_del_rcu(&set->list);
323 ctx->table->use--;
324
325 return err;
326}
327
96518518
PM		 328/*
329 * Tables
330 */
331
332static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
333 const struct nlattr *nla)
334{
335 struct nft_table *table;
336
337 list_for_each_entry(table, &afi->tables, list) {
338 if (!nla_strcmp(nla, table->name))
339 return table;
340 }
341 return NULL;
342}
343
344static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
9370761c 345 const struct nlattr *nla)
96518518
PM		 346{
347 struct nft_table *table;
348
349 if (nla == NULL)
350 return ERR_PTR(-EINVAL);
351
352 table = nft_table_lookup(afi, nla);
353 if (table != NULL)
354 return table;
355
96518518
PM		 356 return ERR_PTR(-ENOENT);
357}
358
359static inline u64 nf_tables_alloc_handle(struct nft_table *table)
360{
361 return ++table->hgenerator;
362}
363
2a37d755 364static const struct nf_chain_type *chain_type[AF_MAX][NFT_CHAIN_T_MAX];
9370761c 365
2a37d755 366static const struct nf_chain_type *
baae3e62 367__nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
9370761c
PNA		 368{
369 int i;
370
baae3e62 371 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 372 if (chain_type[family][i] != NULL &&
373 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 374 return chain_type[family][i];
9370761c 375 }
baae3e62 376 return NULL;
9370761c
PNA		 377}
378
2a37d755 379static const struct nf_chain_type *
baae3e62
PM		 380nf_tables_chain_type_lookup(const struct nft_af_info *afi,
381 const struct nlattr *nla,
382 bool autoload)
9370761c 383{
2a37d755 384 const struct nf_chain_type *type;
9370761c
PNA		 385
386 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 387 if (type != NULL)
388 return type;
9370761c 389#ifdef CONFIG_MODULES
93b0806f 390 if (autoload) {
9370761c 391 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2fec6bb6
PNA		 392 request_module("nft-chain-%u-%.*s", afi->family,
393 nla_len(nla), (const char *)nla_data(nla));
9370761c
PNA		 394 nfnl_lock(NFNL_SUBSYS_NFTABLES);
395 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 396 if (type != NULL)
397 return ERR_PTR(-EAGAIN);
9370761c
PNA		 398 }
399#endif
93b0806f 400 return ERR_PTR(-ENOENT);
9370761c
PNA		 401}
402
96518518
PM		 403static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
404 [NFTA_TABLE_NAME] = { .type = NLA_STRING },
9ddf6323 405 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
96518518
PM		 406};
407
84d7fce6
PNA		 408static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
409 u32 portid, u32 seq, int event, u32 flags,
410 int family, const struct nft_table *table)
96518518
PM		 411{
412 struct nlmsghdr *nlh;
413 struct nfgenmsg *nfmsg;
414
415 event |= NFNL_SUBSYS_NFTABLES << 8;
416 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
417 if (nlh == NULL)
418 goto nla_put_failure;
419
420 nfmsg = nlmsg_data(nlh);
421 nfmsg->nfgen_family = family;
422 nfmsg->version = NFNETLINK_V0;
84d7fce6 423 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 424
9ddf6323 425 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768
TB		 426 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
427 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
96518518
PM		 428 goto nla_put_failure;
429
053c095a
JB		 430 nlmsg_end(skb, nlh);
431 return 0;
96518518
PM		 432
433nla_put_failure:
434 nlmsg_trim(skb, nlh);
435 return -1;
436}
437
35151d84 438static int nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 439{
440 struct sk_buff *skb;
96518518
PM		 441 int err;
442
128ad332
PNA		 443 if (!ctx->report &&
444 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
96518518
PM		 445 return 0;
446
447 err = -ENOBUFS;
448 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
449 if (skb == NULL)
450 goto err;
451
84d7fce6
PNA		 452 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
453 event, 0, ctx->afi->family, ctx->table);
96518518
PM		 454 if (err < 0) {
455 kfree_skb(skb);
456 goto err;
457 }
458
128ad332
PNA		 459 err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
460 ctx->report, GFP_KERNEL);
96518518 461err:
128ad332
PNA		 462 if (err < 0) {
463 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
464 err);
465 }
96518518
PM		 466 return err;
467}
468
469static int nf_tables_dump_tables(struct sk_buff *skb,
470 struct netlink_callback *cb)
471{
472 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
473 const struct nft_af_info *afi;
474 const struct nft_table *table;
475 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 476 struct net *net = sock_net(skb->sk);
96518518
PM		 477 int family = nfmsg->nfgen_family;
478
e688a7f8 479 rcu_read_lock();
38e029f1
PNA		 480 cb->seq = net->nft.base_seq;
481
e688a7f8 482 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 483 if (family != NFPROTO_UNSPEC && family != afi->family)
484 continue;
485
e688a7f8 486 list_for_each_entry_rcu(table, &afi->tables, list) {
96518518
PM		 487 if (idx < s_idx)
488 goto cont;
489 if (idx > s_idx)
490 memset(&cb->args[1], 0,
491 sizeof(cb->args) - sizeof(cb->args[0]));
84d7fce6 492 if (nf_tables_fill_table_info(skb, net,
96518518
PM		 493 NETLINK_CB(cb->skb).portid,
494 cb->nlh->nlmsg_seq,
495 NFT_MSG_NEWTABLE,
496 NLM_F_MULTI,
497 afi->family, table) < 0)
498 goto done;
38e029f1
PNA		 499
500 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 501cont:
502 idx++;
503 }
504 }
505done:
e688a7f8 506 rcu_read_unlock();
96518518
PM		 507 cb->args[0] = idx;
508 return skb->len;
509}
510
511static int nf_tables_gettable(struct sock *nlsk, struct sk_buff *skb,
512 const struct nlmsghdr *nlh,
513 const struct nlattr * const nla[])
514{
515 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
516 const struct nft_af_info *afi;
517 const struct nft_table *table;
518 struct sk_buff *skb2;
99633ab2 519 struct net *net = sock_net(skb->sk);
96518518
PM		 520 int family = nfmsg->nfgen_family;
521 int err;
522
523 if (nlh->nlmsg_flags & NLM_F_DUMP) {
524 struct netlink_dump_control c = {
525 .dump = nf_tables_dump_tables,
526 };
527 return netlink_dump_start(nlsk, skb, nlh, &c);
528 }
529
99633ab2 530 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 531 if (IS_ERR(afi))
532 return PTR_ERR(afi);
533
9370761c 534 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
96518518
PM		 535 if (IS_ERR(table))
536 return PTR_ERR(table);
55dd6f93
PNA		 537 if (table->flags & NFT_TABLE_INACTIVE)
538 return -ENOENT;
96518518
PM		 539
540 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
541 if (!skb2)
542 return -ENOMEM;
543
84d7fce6 544 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 545 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
546 family, table);
547 if (err < 0)
548 goto err;
549
550 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
551
552err:
553 kfree_skb(skb2);
554 return err;
555}
556
115a60b1
PM		 557static int nf_tables_table_enable(const struct nft_af_info *afi,
558 struct nft_table *table)
9ddf6323
PNA		 559{
560 struct nft_chain *chain;
561 int err, i = 0;
562
563 list_for_each_entry(chain, &table->chains, list) {
d2012975
PNA		 564 if (!(chain->flags & NFT_BASE_CHAIN))
565 continue;
566
115a60b1 567 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
9ddf6323
PNA		 568 if (err < 0)
569 goto err;
570
571 i++;
572 }
573 return 0;
574err:
575 list_for_each_entry(chain, &table->chains, list) {
d2012975
PNA		 576 if (!(chain->flags & NFT_BASE_CHAIN))
577 continue;
578
9ddf6323
PNA		 579 if (i-- <= 0)
580 break;
581
115a60b1 582 nf_unregister_hooks(nft_base_chain(chain)->ops, afi->nops);
9ddf6323
PNA		 583 }
584 return err;
585}
586
f75edf5e 587static void nf_tables_table_disable(const struct nft_af_info *afi,
115a60b1 588 struct nft_table *table)
9ddf6323
PNA		 589{
590 struct nft_chain *chain;
591
d2012975
PNA		 592 list_for_each_entry(chain, &table->chains, list) {
593 if (chain->flags & NFT_BASE_CHAIN)
115a60b1
PM		 594 nf_unregister_hooks(nft_base_chain(chain)->ops,
595 afi->nops);
d2012975 596 }
9ddf6323
PNA		 597}
598
e1aaca93 599static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 600{
55dd6f93 601 struct nft_trans *trans;
e1aaca93 602 u32 flags;
55dd6f93 603 int ret = 0;
9ddf6323 604
e1aaca93
PNA		 605 if (!ctx->nla[NFTA_TABLE_FLAGS])
606 return 0;
9ddf6323 607
e1aaca93
PNA		 608 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
609 if (flags & ~NFT_TABLE_F_DORMANT)
610 return -EINVAL;
611
63283dd2
PNA		 612 if (flags == ctx->table->flags)
613 return 0;
614
55dd6f93
PNA		 615 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
616 sizeof(struct nft_trans_table));
617 if (trans == NULL)
618 return -ENOMEM;
9ddf6323 619
e1aaca93
PNA		 620 if ((flags & NFT_TABLE_F_DORMANT) &&
621 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 622 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 623 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
624 ctx->table->flags & NFT_TABLE_F_DORMANT) {
625 ret = nf_tables_table_enable(ctx->afi, ctx->table);
55dd6f93 626 if (ret >= 0) {
e1aaca93 627 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 628 nft_trans_table_enable(trans) = true;
9ddf6323 629 }
9ddf6323 630 }
e1aaca93
PNA		 631 if (ret < 0)
632 goto err;
9ddf6323 633
55dd6f93
PNA		 634 nft_trans_table_update(trans) = true;
635 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
636 return 0;
9ddf6323 637err:
55dd6f93 638 nft_trans_destroy(trans);
9ddf6323
PNA		 639 return ret;
640}
641
96518518
PM		 642static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
643 const struct nlmsghdr *nlh,
644 const struct nlattr * const nla[])
645{
646 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
647 const struct nlattr *name;
648 struct nft_af_info *afi;
649 struct nft_table *table;
99633ab2 650 struct net *net = sock_net(skb->sk);
96518518 651 int family = nfmsg->nfgen_family;
c5c1f975 652 u32 flags = 0;
e1aaca93 653 struct nft_ctx ctx;
55dd6f93 654 int err;
96518518 655
99633ab2 656 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 657 if (IS_ERR(afi))
658 return PTR_ERR(afi);
659
660 name = nla[NFTA_TABLE_NAME];
9370761c 661 table = nf_tables_table_lookup(afi, name);
96518518
PM		 662 if (IS_ERR(table)) {
663 if (PTR_ERR(table) != -ENOENT)
664 return PTR_ERR(table);
665 table = NULL;
666 }
667
668 if (table != NULL) {
55dd6f93
PNA		 669 if (table->flags & NFT_TABLE_INACTIVE)
670 return -ENOENT;
96518518
PM		 671 if (nlh->nlmsg_flags & NLM_F_EXCL)
672 return -EEXIST;
673 if (nlh->nlmsg_flags & NLM_F_REPLACE)
674 return -EOPNOTSUPP;
e1aaca93
PNA		 675
676 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
677 return nf_tables_updtable(&ctx);
96518518
PM		 678 }
679
c5c1f975
PM		 680 if (nla[NFTA_TABLE_FLAGS]) {
681 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
682 if (flags & ~NFT_TABLE_F_DORMANT)
683 return -EINVAL;
684 }
685
7047f9d0
PM		 686 if (!try_module_get(afi->owner))
687 return -EAFNOSUPPORT;
688
96518518 689 table = kzalloc(sizeof(*table) + nla_len(name), GFP_KERNEL);
7047f9d0
PM		 690 if (table == NULL) {
691 module_put(afi->owner);
96518518 692 return -ENOMEM;
7047f9d0 693 }
96518518
PM		 694
695 nla_strlcpy(table->name, name, nla_len(name));
696 INIT_LIST_HEAD(&table->chains);
20a69341 697 INIT_LIST_HEAD(&table->sets);
c5c1f975 698 table->flags = flags;
9ddf6323 699
55dd6f93
PNA		 700 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
701 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
702 if (err < 0) {
703 kfree(table);
704 module_put(afi->owner);
705 return err;
706 }
e688a7f8 707 list_add_tail_rcu(&table->list, &afi->tables);
96518518
PM		 708 return 0;
709}
710
b9ac12ef
AB		 711static int nft_flush_table(struct nft_ctx *ctx)
712{
713 int err;
714 struct nft_chain *chain, *nc;
715 struct nft_set *set, *ns;
716
a2f18db0 717 list_for_each_entry(chain, &ctx->table->chains, list) {
b9ac12ef
AB		 718 ctx->chain = chain;
719
720 err = nft_delrule_by_chain(ctx);
721 if (err < 0)
722 goto out;
b9ac12ef
AB		 723 }
724
725 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
726 if (set->flags & NFT_SET_ANONYMOUS &&
727 !list_empty(&set->bindings))
728 continue;
729
730 err = nft_delset(ctx, set);
731 if (err < 0)
732 goto out;
733 }
734
a2f18db0
PNA		 735 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
736 ctx->chain = chain;
737
738 err = nft_delchain(ctx);
739 if (err < 0)
740 goto out;
741 }
742
b9ac12ef
AB		 743 err = nft_deltable(ctx);
744out:
745 return err;
746}
747
748static int nft_flush(struct nft_ctx *ctx, int family)
749{
750 struct nft_af_info *afi;
751 struct nft_table *table, *nt;
752 const struct nlattr * const *nla = ctx->nla;
753 int err = 0;
754
755 list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
756 if (family != AF_UNSPEC && afi->family != family)
757 continue;
758
759 ctx->afi = afi;
760 list_for_each_entry_safe(table, nt, &afi->tables, list) {
761 if (nla[NFTA_TABLE_NAME] &&
762 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
763 continue;
764
765 ctx->table = table;
766
767 err = nft_flush_table(ctx);
768 if (err < 0)
769 goto out;
770 }
771 }
772out:
773 return err;
774}
775
96518518
PM		 776static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
777 const struct nlmsghdr *nlh,
778 const struct nlattr * const nla[])
779{
780 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
781 struct nft_af_info *afi;
782 struct nft_table *table;
99633ab2 783 struct net *net = sock_net(skb->sk);
ee01d542 784 int family = nfmsg->nfgen_family;
55dd6f93 785 struct nft_ctx ctx;
96518518 786
b9ac12ef
AB		 787 nft_ctx_init(&ctx, skb, nlh, NULL, NULL, NULL, nla);
788 if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
789 return nft_flush(&ctx, family);
790
99633ab2 791 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 792 if (IS_ERR(afi))
793 return PTR_ERR(afi);
794
9370761c 795 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
96518518
PM		 796 if (IS_ERR(table))
797 return PTR_ERR(table);
55dd6f93
PNA		 798 if (table->flags & NFT_TABLE_INACTIVE)
799 return -ENOENT;
96518518 800
b9ac12ef
AB		 801 ctx.afi = afi;
802 ctx.table = table;
55dd6f93 803
b9ac12ef 804 return nft_flush_table(&ctx);
96518518
PM		 805}
806
55dd6f93
PNA		 807static void nf_tables_table_destroy(struct nft_ctx *ctx)
808{
4fefee57
PNA		 809 BUG_ON(ctx->table->use > 0);
810
55dd6f93
PNA		 811 kfree(ctx->table);
812 module_put(ctx->afi->owner);
813}
814
2a37d755 815int nft_register_chain_type(const struct nf_chain_type *ctype)
96518518 816{
9370761c 817 int err = 0;
96518518
PM		 818
819 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c
PNA		 820 if (chain_type[ctype->family][ctype->type] != NULL) {
821 err = -EBUSY;
822 goto out;
96518518 823 }
9370761c
PNA		 824 chain_type[ctype->family][ctype->type] = ctype;
825out:
96518518
PM		 826 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
827 return err;
828}
9370761c 829EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 830
2a37d755 831void nft_unregister_chain_type(const struct nf_chain_type *ctype)
96518518 832{
96518518 833 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 834 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 835 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
836}
9370761c 837EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 838
839/*
840 * Chains
841 */
842
843static struct nft_chain *
844nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle)
845{
846 struct nft_chain *chain;
847
848 list_for_each_entry(chain, &table->chains, list) {
849 if (chain->handle == handle)
850 return chain;
851 }
852
853 return ERR_PTR(-ENOENT);
854}
855
856static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
857 const struct nlattr *nla)
858{
859 struct nft_chain *chain;
860
861 if (nla == NULL)
862 return ERR_PTR(-EINVAL);
863
864 list_for_each_entry(chain, &table->chains, list) {
865 if (!nla_strcmp(nla, chain->name))
866 return chain;
867 }
868
869 return ERR_PTR(-ENOENT);
870}
871
872static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
873 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING },
874 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
875 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
876 .len = NFT_CHAIN_MAXNAMELEN - 1 },
877 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 878 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 879 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 880 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 881};
882
883static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
884 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
885 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
886};
887
0ca743a5
PNA		 888static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
889{
890 struct nft_stats *cpu_stats, total;
891 struct nlattr *nest;
ce355e20
ED		 892 unsigned int seq;
893 u64 pkts, bytes;
0ca743a5
PNA		 894 int cpu;
895
896 memset(&total, 0, sizeof(total));
897 for_each_possible_cpu(cpu) {
898 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 899 do {
900 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
901 pkts = cpu_stats->pkts;
902 bytes = cpu_stats->bytes;
903 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
904 total.pkts += pkts;
905 total.bytes += bytes;
0ca743a5
PNA		 906 }
907 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
908 if (nest == NULL)
909 goto nla_put_failure;
910
911 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts)) ||
912 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes)))
913 goto nla_put_failure;
914
915 nla_nest_end(skb, nest);
916 return 0;
917
918nla_put_failure:
919 return -ENOSPC;
920}
921
84d7fce6
PNA		 922static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
923 u32 portid, u32 seq, int event, u32 flags,
924 int family, const struct nft_table *table,
96518518
PM		 925 const struct nft_chain *chain)
926{
927 struct nlmsghdr *nlh;
928 struct nfgenmsg *nfmsg;
929
930 event |= NFNL_SUBSYS_NFTABLES << 8;
931 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
932 if (nlh == NULL)
933 goto nla_put_failure;
934
935 nfmsg = nlmsg_data(nlh);
936 nfmsg->nfgen_family = family;
937 nfmsg->version = NFNETLINK_V0;
84d7fce6 938 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 939
940 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
941 goto nla_put_failure;
942 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle)))
943 goto nla_put_failure;
944 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
945 goto nla_put_failure;
946
947 if (chain->flags & NFT_BASE_CHAIN) {
0ca743a5 948 const struct nft_base_chain *basechain = nft_base_chain(chain);
115a60b1 949 const struct nf_hook_ops *ops = &basechain->ops[0];
0ca743a5
PNA		 950 struct nlattr *nest;
951
952 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 953 if (nest == NULL)
954 goto nla_put_failure;
955 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
956 goto nla_put_failure;
957 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
958 goto nla_put_failure;
959 nla_nest_end(skb, nest);
9370761c 960
0ca743a5
PNA		 961 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
962 htonl(basechain->policy)))
963 goto nla_put_failure;
964
baae3e62
PM		 965 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
966 goto nla_put_failure;
0ca743a5
PNA		 967
968 if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
969 goto nla_put_failure;
96518518
PM		 970 }
971
0ca743a5
PNA		 972 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
973 goto nla_put_failure;
974
053c095a
JB		 975 nlmsg_end(skb, nlh);
976 return 0;
96518518
PM		 977
978nla_put_failure:
979 nlmsg_trim(skb, nlh);
980 return -1;
981}
982
35151d84 983static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 984{
985 struct sk_buff *skb;
96518518
PM		 986 int err;
987
128ad332
PNA		 988 if (!ctx->report &&
989 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
96518518
PM		 990 return 0;
991
992 err = -ENOBUFS;
993 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
994 if (skb == NULL)
995 goto err;
996
84d7fce6
PNA		 997 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
998 event, 0, ctx->afi->family, ctx->table,
35151d84 999 ctx->chain);
96518518
PM		 1000 if (err < 0) {
1001 kfree_skb(skb);
1002 goto err;
1003 }
1004
128ad332
PNA		 1005 err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1006 ctx->report, GFP_KERNEL);
96518518 1007err:
128ad332
PNA		 1008 if (err < 0) {
1009 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1010 err);
1011 }
96518518
PM		 1012 return err;
1013}
1014
1015static int nf_tables_dump_chains(struct sk_buff *skb,
1016 struct netlink_callback *cb)
1017{
1018 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1019 const struct nft_af_info *afi;
1020 const struct nft_table *table;
1021 const struct nft_chain *chain;
1022 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1023 struct net *net = sock_net(skb->sk);
96518518
PM		 1024 int family = nfmsg->nfgen_family;
1025
e688a7f8 1026 rcu_read_lock();
38e029f1
PNA		 1027 cb->seq = net->nft.base_seq;
1028
e688a7f8 1029 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 1030 if (family != NFPROTO_UNSPEC && family != afi->family)
1031 continue;
1032
e688a7f8
PNA		 1033 list_for_each_entry_rcu(table, &afi->tables, list) {
1034 list_for_each_entry_rcu(chain, &table->chains, list) {
96518518
PM		 1035 if (idx < s_idx)
1036 goto cont;
1037 if (idx > s_idx)
1038 memset(&cb->args[1], 0,
1039 sizeof(cb->args) - sizeof(cb->args[0]));
84d7fce6
PNA		 1040 if (nf_tables_fill_chain_info(skb, net,
1041 NETLINK_CB(cb->skb).portid,
96518518
PM		 1042 cb->nlh->nlmsg_seq,
1043 NFT_MSG_NEWCHAIN,
1044 NLM_F_MULTI,
1045 afi->family, table, chain) < 0)
1046 goto done;
38e029f1
PNA		 1047
1048 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 1049cont:
1050 idx++;
1051 }
1052 }
1053 }
1054done:
e688a7f8 1055 rcu_read_unlock();
96518518
PM		 1056 cb->args[0] = idx;
1057 return skb->len;
1058}
1059
96518518
PM		 1060static int nf_tables_getchain(struct sock *nlsk, struct sk_buff *skb,
1061 const struct nlmsghdr *nlh,
1062 const struct nlattr * const nla[])
1063{
1064 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1065 const struct nft_af_info *afi;
1066 const struct nft_table *table;
1067 const struct nft_chain *chain;
1068 struct sk_buff *skb2;
99633ab2 1069 struct net *net = sock_net(skb->sk);
96518518
PM		 1070 int family = nfmsg->nfgen_family;
1071 int err;
1072
1073 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1074 struct netlink_dump_control c = {
1075 .dump = nf_tables_dump_chains,
1076 };
1077 return netlink_dump_start(nlsk, skb, nlh, &c);
1078 }
1079
99633ab2 1080 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1081 if (IS_ERR(afi))
1082 return PTR_ERR(afi);
1083
9370761c 1084 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 1085 if (IS_ERR(table))
1086 return PTR_ERR(table);
55dd6f93
PNA		 1087 if (table->flags & NFT_TABLE_INACTIVE)
1088 return -ENOENT;
96518518
PM		 1089
1090 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
1091 if (IS_ERR(chain))
1092 return PTR_ERR(chain);
91c7b38d
PNA		 1093 if (chain->flags & NFT_CHAIN_INACTIVE)
1094 return -ENOENT;
96518518
PM		 1095
1096 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1097 if (!skb2)
1098 return -ENOMEM;
1099
84d7fce6 1100 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1101 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1102 family, table, chain);
1103 if (err < 0)
1104 goto err;
1105
1106 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1107
1108err:
1109 kfree_skb(skb2);
1110 return err;
1111}
1112
0ca743a5
PNA		 1113static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1114 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1115 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1116};
1117
ff3cd7b3 1118static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1119{
1120 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1121 struct nft_stats __percpu *newstats;
1122 struct nft_stats *stats;
1123 int err;
1124
1125 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy);
1126 if (err < 0)
ff3cd7b3 1127 return ERR_PTR(err);
0ca743a5
PNA		 1128
1129 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1130 return ERR_PTR(-EINVAL);
0ca743a5 1131
ce355e20 1132 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1133 if (newstats == NULL)
ff3cd7b3 1134 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1135
1136 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1137 * are not exposed to userspace.
1138 */
e8781f70 1139 preempt_disable();
0ca743a5
PNA		 1140 stats = this_cpu_ptr(newstats);
1141 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1142 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1143 preempt_enable();
0ca743a5 1144
ff3cd7b3
PNA		 1145 return newstats;
1146}
1147
1148static void nft_chain_stats_replace(struct nft_base_chain *chain,
1149 struct nft_stats __percpu *newstats)
1150{
b88825de
PNA		 1151 if (newstats == NULL)
1152 return;
1153
0ca743a5 1154 if (chain->stats) {
0ca743a5 1155 struct nft_stats __percpu *oldstats =
67a8fc27 1156 nft_dereference(chain->stats);
0ca743a5
PNA		 1157
1158 rcu_assign_pointer(chain->stats, newstats);
1159 synchronize_rcu();
1160 free_percpu(oldstats);
1161 } else
1162 rcu_assign_pointer(chain->stats, newstats);
0ca743a5
PNA		 1163}
1164
91c7b38d
PNA		 1165static void nf_tables_chain_destroy(struct nft_chain *chain)
1166{
1167 BUG_ON(chain->use > 0);
1168
1169 if (chain->flags & NFT_BASE_CHAIN) {
1170 module_put(nft_base_chain(chain)->type->owner);
1171 free_percpu(nft_base_chain(chain)->stats);
1172 kfree(nft_base_chain(chain));
1173 } else {
1174 kfree(chain);
1175 }
1176}
1177
96518518
PM		 1178static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
1179 const struct nlmsghdr *nlh,
1180 const struct nlattr * const nla[])
1181{
1182 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1183 const struct nlattr * uninitialized_var(name);
7c95f6d8 1184 struct nft_af_info *afi;
96518518
PM		 1185 struct nft_table *table;
1186 struct nft_chain *chain;
0ca743a5 1187 struct nft_base_chain *basechain = NULL;
96518518 1188 struct nlattr *ha[NFTA_HOOK_MAX + 1];
99633ab2 1189 struct net *net = sock_net(skb->sk);
96518518 1190 int family = nfmsg->nfgen_family;
57de2a0c 1191 u8 policy = NF_ACCEPT;
96518518 1192 u64 handle = 0;
115a60b1 1193 unsigned int i;
ff3cd7b3 1194 struct nft_stats __percpu *stats;
96518518
PM		 1195 int err;
1196 bool create;
91c7b38d 1197 struct nft_ctx ctx;
96518518
PM		 1198
1199 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1200
99633ab2 1201 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 1202 if (IS_ERR(afi))
1203 return PTR_ERR(afi);
1204
9370761c 1205 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 1206 if (IS_ERR(table))
1207 return PTR_ERR(table);
1208
96518518
PM		 1209 chain = NULL;
1210 name = nla[NFTA_CHAIN_NAME];
1211
1212 if (nla[NFTA_CHAIN_HANDLE]) {
1213 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1214 chain = nf_tables_chain_lookup_byhandle(table, handle);
1215 if (IS_ERR(chain))
1216 return PTR_ERR(chain);
1217 } else {
1218 chain = nf_tables_chain_lookup(table, name);
1219 if (IS_ERR(chain)) {
1220 if (PTR_ERR(chain) != -ENOENT)
1221 return PTR_ERR(chain);
1222 chain = NULL;
1223 }
1224 }
1225
57de2a0c
PM		 1226 if (nla[NFTA_CHAIN_POLICY]) {
1227 if ((chain != NULL &&
1228 !(chain->flags & NFT_BASE_CHAIN)) ||
1229 nla[NFTA_CHAIN_HOOK] == NULL)
1230 return -EOPNOTSUPP;
1231
8f46df18 1232 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1233 switch (policy) {
1234 case NF_DROP:
1235 case NF_ACCEPT:
1236 break;
1237 default:
1238 return -EINVAL;
1239 }
1240 }
1241
96518518 1242 if (chain != NULL) {
91c7b38d
PNA		 1243 struct nft_stats *stats = NULL;
1244 struct nft_trans *trans;
1245
1246 if (chain->flags & NFT_CHAIN_INACTIVE)
1247 return -ENOENT;
96518518
PM		 1248 if (nlh->nlmsg_flags & NLM_F_EXCL)
1249 return -EEXIST;
1250 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1251 return -EOPNOTSUPP;
1252
1253 if (nla[NFTA_CHAIN_HANDLE] && name &&
1254 !IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME])))
1255 return -EEXIST;
1256
0ca743a5
PNA		 1257 if (nla[NFTA_CHAIN_COUNTERS]) {
1258 if (!(chain->flags & NFT_BASE_CHAIN))
1259 return -EOPNOTSUPP;
1260
ff3cd7b3
PNA		 1261 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1262 if (IS_ERR(stats))
1263 return PTR_ERR(stats);
0ca743a5
PNA		 1264 }
1265
91c7b38d
PNA		 1266 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1267 trans = nft_trans_alloc(&ctx, NFT_MSG_NEWCHAIN,
1268 sizeof(struct nft_trans_chain));
f5553c19
PNA		 1269 if (trans == NULL) {
1270 free_percpu(stats);
91c7b38d 1271 return -ENOMEM;
f5553c19 1272 }
4401a862 1273
91c7b38d
PNA		 1274 nft_trans_chain_stats(trans) = stats;
1275 nft_trans_chain_update(trans) = true;
4401a862 1276
91c7b38d
PNA		 1277 if (nla[NFTA_CHAIN_POLICY])
1278 nft_trans_chain_policy(trans) = policy;
1279 else
1280 nft_trans_chain_policy(trans) = -1;
96518518 1281
91c7b38d
PNA		 1282 if (nla[NFTA_CHAIN_HANDLE] && name) {
1283 nla_strlcpy(nft_trans_chain_name(trans), name,
1284 NFT_CHAIN_MAXNAMELEN);
1285 }
1286 list_add_tail(&trans->list, &net->nft.commit_list);
1287 return 0;
96518518
PM		 1288 }
1289
75820676
PM		 1290 if (table->use == UINT_MAX)
1291 return -EOVERFLOW;
1292
96518518 1293 if (nla[NFTA_CHAIN_HOOK]) {
2a37d755 1294 const struct nf_chain_type *type;
96518518 1295 struct nf_hook_ops *ops;
9370761c 1296 nf_hookfn *hookfn;
115a60b1 1297 u32 hooknum, priority;
9370761c 1298
baae3e62 1299 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
9370761c
PNA		 1300 if (nla[NFTA_CHAIN_TYPE]) {
1301 type = nf_tables_chain_type_lookup(afi,
1302 nla[NFTA_CHAIN_TYPE],
1303 create);
93b0806f
PM		 1304 if (IS_ERR(type))
1305 return PTR_ERR(type);
9370761c 1306 }
96518518
PM		 1307
1308 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
1309 nft_hook_policy);
1310 if (err < 0)
1311 return err;
1312 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1313 ha[NFTA_HOOK_PRIORITY] == NULL)
1314 return -EINVAL;
9370761c
PNA		 1315
1316 hooknum = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1317 if (hooknum >= afi->nhooks)
96518518 1318 return -EINVAL;
115a60b1 1319 priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
96518518 1320
baae3e62 1321 if (!(type->hook_mask & (1 << hooknum)))
9370761c 1322 return -EOPNOTSUPP;
fa2c1de0 1323 if (!try_module_get(type->owner))
baae3e62 1324 return -ENOENT;
fa2c1de0 1325 hookfn = type->hooks[hooknum];
9370761c 1326
96518518 1327 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
f5553c19
PNA		 1328 if (basechain == NULL) {
1329 module_put(type->owner);
96518518 1330 return -ENOMEM;
f5553c19 1331 }
9370761c 1332
4401a862 1333 if (nla[NFTA_CHAIN_COUNTERS]) {
ff3cd7b3
PNA		 1334 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1335 if (IS_ERR(stats)) {
fa2c1de0 1336 module_put(type->owner);
4401a862 1337 kfree(basechain);
ff3cd7b3 1338 return PTR_ERR(stats);
4401a862 1339 }
ff3cd7b3 1340 basechain->stats = stats;
4401a862 1341 } else {
ce355e20 1342 stats = netdev_alloc_pcpu_stats(struct nft_stats);
c123bb71 1343 if (stats == NULL) {
fa2c1de0 1344 module_put(type->owner);
4401a862 1345 kfree(basechain);
c123bb71 1346 return -ENOMEM;
4401a862 1347 }
ff3cd7b3 1348 rcu_assign_pointer(basechain->stats, stats);
4401a862
PM		 1349 }
1350
9370761c 1351 basechain->type = type;
96518518
PM		 1352 chain = &basechain->chain;
1353
115a60b1
PM		 1354 for (i = 0; i < afi->nops; i++) {
1355 ops = &basechain->ops[i];
1356 ops->pf = family;
1357 ops->owner = afi->owner;
1358 ops->hooknum = hooknum;
1359 ops->priority = priority;
1360 ops->priv = chain;
1361 ops->hook = afi->hooks[ops->hooknum];
1362 if (hookfn)
1363 ops->hook = hookfn;
1364 if (afi->hook_ops_init)
1365 afi->hook_ops_init(ops, i);
1366 }
96518518
PM		 1367
1368 chain->flags |= NFT_BASE_CHAIN;
57de2a0c 1369 basechain->policy = policy;
96518518
PM		 1370 } else {
1371 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1372 if (chain == NULL)
1373 return -ENOMEM;
1374 }
1375
1376 INIT_LIST_HEAD(&chain->rules);
1377 chain->handle = nf_tables_alloc_handle(table);
0628b123 1378 chain->net = net;
b5bc89bf 1379 chain->table = table;
96518518
PM		 1380 nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
1381
9ddf6323
PNA		 1382 if (!(table->flags & NFT_TABLE_F_DORMANT) &&
1383 chain->flags & NFT_BASE_CHAIN) {
115a60b1 1384 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
91c7b38d
PNA		 1385 if (err < 0)
1386 goto err1;
0ca743a5 1387 }
96518518 1388
91c7b38d
PNA		 1389 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1390 err = nft_trans_chain_add(&ctx, NFT_MSG_NEWCHAIN);
1391 if (err < 0)
1392 goto err2;
96518518 1393
4fefee57 1394 table->use++;
e688a7f8 1395 list_add_tail_rcu(&chain->list, &table->chains);
91c7b38d
PNA		 1396 return 0;
1397err2:
c5598794 1398 nf_tables_unregister_hooks(table, chain, afi->nops);
91c7b38d
PNA		 1399err1:
1400 nf_tables_chain_destroy(chain);
1401 return err;
96518518
PM		 1402}
1403
1404static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
1405 const struct nlmsghdr *nlh,
1406 const struct nlattr * const nla[])
1407{
1408 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1409 struct nft_af_info *afi;
96518518
PM		 1410 struct nft_table *table;
1411 struct nft_chain *chain;
99633ab2 1412 struct net *net = sock_net(skb->sk);
96518518 1413 int family = nfmsg->nfgen_family;
91c7b38d 1414 struct nft_ctx ctx;
96518518 1415
99633ab2 1416 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1417 if (IS_ERR(afi))
1418 return PTR_ERR(afi);
1419
9370761c 1420 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 1421 if (IS_ERR(table))
1422 return PTR_ERR(table);
55dd6f93
PNA		 1423 if (table->flags & NFT_TABLE_INACTIVE)
1424 return -ENOENT;
96518518
PM		 1425
1426 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
1427 if (IS_ERR(chain))
1428 return PTR_ERR(chain);
91c7b38d
PNA		 1429 if (chain->flags & NFT_CHAIN_INACTIVE)
1430 return -ENOENT;
4fefee57 1431 if (chain->use > 0)
96518518
PM		 1432 return -EBUSY;
1433
91c7b38d 1434 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
0165d932 1435
ee01d542 1436 return nft_delchain(&ctx);
96518518
PM		 1437}
1438
96518518
PM		 1439/*
1440 * Expressions
1441 */
1442
1443/**
ef1f7df9
PM		 1444 * nft_register_expr - register nf_tables expr type
1445 * @ops: expr type
96518518 1446 *
ef1f7df9 1447 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1448 * success or a negative errno code otherwise.
1449 */
ef1f7df9 1450int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1451{
1452 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1453 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1454 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1455 else
e688a7f8 1456 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1457 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1458 return 0;
1459}
1460EXPORT_SYMBOL_GPL(nft_register_expr);
1461
1462/**
ef1f7df9
PM		 1463 * nft_unregister_expr - unregister nf_tables expr type
1464 * @ops: expr type
96518518 1465 *
ef1f7df9 1466 * Unregisters the expr typefor use with nf_tables.
96518518 1467 */
ef1f7df9 1468void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1469{
1470 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1471 list_del_rcu(&type->list);
96518518
PM		 1472 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1473}
1474EXPORT_SYMBOL_GPL(nft_unregister_expr);
1475
64d46806
PM		 1476static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1477 struct nlattr *nla)
96518518 1478{
ef1f7df9 1479 const struct nft_expr_type *type;
96518518 1480
ef1f7df9 1481 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1482 if (!nla_strcmp(nla, type->name) &&
1483 (!type->family || type->family == family))
ef1f7df9 1484 return type;
96518518
PM		 1485 }
1486 return NULL;
1487}
1488
64d46806
PM		 1489static const struct nft_expr_type *nft_expr_type_get(u8 family,
1490 struct nlattr *nla)
96518518 1491{
ef1f7df9 1492 const struct nft_expr_type *type;
96518518
PM		 1493
1494 if (nla == NULL)
1495 return ERR_PTR(-EINVAL);
1496
64d46806 1497 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1498 if (type != NULL && try_module_get(type->owner))
1499 return type;
96518518
PM		 1500
1501#ifdef CONFIG_MODULES
ef1f7df9 1502 if (type == NULL) {
64d46806
PM		 1503 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1504 request_module("nft-expr-%u-%.*s", family,
1505 nla_len(nla), (char *)nla_data(nla));
1506 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1507 if (__nft_expr_type_get(family, nla))
1508 return ERR_PTR(-EAGAIN);
1509
96518518
PM		 1510 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1511 request_module("nft-expr-%.*s",
1512 nla_len(nla), (char *)nla_data(nla));
1513 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1514 if (__nft_expr_type_get(family, nla))
96518518
PM		 1515 return ERR_PTR(-EAGAIN);
1516 }
1517#endif
1518 return ERR_PTR(-ENOENT);
1519}
1520
1521static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1522 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1523 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1524};
1525
1526static int nf_tables_fill_expr_info(struct sk_buff *skb,
1527 const struct nft_expr *expr)
1528{
ef1f7df9 1529 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1530 goto nla_put_failure;
1531
1532 if (expr->ops->dump) {
1533 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1534 if (data == NULL)
1535 goto nla_put_failure;
1536 if (expr->ops->dump(skb, expr) < 0)
1537 goto nla_put_failure;
1538 nla_nest_end(skb, data);
1539 }
1540
1541 return skb->len;
1542
1543nla_put_failure:
1544 return -1;
1545};
1546
1547struct nft_expr_info {
1548 const struct nft_expr_ops *ops;
ef1f7df9 1549 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1550};
1551
0ca743a5
PNA		 1552static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1553 const struct nlattr *nla,
96518518
PM		 1554 struct nft_expr_info *info)
1555{
ef1f7df9 1556 const struct nft_expr_type *type;
96518518 1557 const struct nft_expr_ops *ops;
ef1f7df9 1558 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1559 int err;
1560
ef1f7df9 1561 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy);
96518518
PM		 1562 if (err < 0)
1563 return err;
1564
64d46806 1565 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1566 if (IS_ERR(type))
1567 return PTR_ERR(type);
1568
1569 if (tb[NFTA_EXPR_DATA]) {
1570 err = nla_parse_nested(info->tb, type->maxattr,
1571 tb[NFTA_EXPR_DATA], type->policy);
1572 if (err < 0)
1573 goto err1;
1574 } else
1575 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1576
1577 if (type->select_ops != NULL) {
0ca743a5
PNA		 1578 ops = type->select_ops(ctx,
1579 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1580 if (IS_ERR(ops)) {
1581 err = PTR_ERR(ops);
1582 goto err1;
1583 }
1584 } else
1585 ops = type->ops;
1586
96518518
PM		 1587 info->ops = ops;
1588 return 0;
ef1f7df9
PM		 1589
1590err1:
1591 module_put(type->owner);
1592 return err;
96518518
PM		 1593}
1594
1595static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1596 const struct nft_expr_info *info,
96518518
PM		 1597 struct nft_expr *expr)
1598{
1599 const struct nft_expr_ops *ops = info->ops;
1600 int err;
1601
1602 expr->ops = ops;
1603 if (ops->init) {
ef1f7df9 1604 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1605 if (err < 0)
1606 goto err1;
1607 }
1608
96518518
PM		 1609 return 0;
1610
1611err1:
1612 expr->ops = NULL;
1613 return err;
1614}
1615
62472bce
PM		 1616static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1617 struct nft_expr *expr)
96518518
PM		 1618{
1619 if (expr->ops->destroy)
62472bce 1620 expr->ops->destroy(ctx, expr);
ef1f7df9 1621 module_put(expr->ops->type->owner);
96518518
PM		 1622}
1623
1624/*
1625 * Rules
1626 */
1627
1628static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1629 u64 handle)
1630{
1631 struct nft_rule *rule;
1632
1633 // FIXME: this sucks
1634 list_for_each_entry(rule, &chain->rules, list) {
1635 if (handle == rule->handle)
1636 return rule;
1637 }
1638
1639 return ERR_PTR(-ENOENT);
1640}
1641
1642static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1643 const struct nlattr *nla)
1644{
1645 if (nla == NULL)
1646 return ERR_PTR(-EINVAL);
1647
1648 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1649}
1650
1651static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
1652 [NFTA_RULE_TABLE] = { .type = NLA_STRING },
1653 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1654 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1655 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1656 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1657 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1658 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1659 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1660 .len = NFT_USERDATA_MAXLEN },
96518518
PM		 1661};
1662
84d7fce6
PNA		 1663static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1664 u32 portid, u32 seq, int event,
1665 u32 flags, int family,
96518518
PM		 1666 const struct nft_table *table,
1667 const struct nft_chain *chain,
1668 const struct nft_rule *rule)
1669{
1670 struct nlmsghdr *nlh;
1671 struct nfgenmsg *nfmsg;
1672 const struct nft_expr *expr, *next;
1673 struct nlattr *list;
5e948466
EL		 1674 const struct nft_rule *prule;
1675 int type = event | NFNL_SUBSYS_NFTABLES << 8;
96518518 1676
5e948466 1677 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg),
96518518
PM		 1678 flags);
1679 if (nlh == NULL)
1680 goto nla_put_failure;
1681
1682 nfmsg = nlmsg_data(nlh);
1683 nfmsg->nfgen_family = family;
1684 nfmsg->version = NFNETLINK_V0;
84d7fce6 1685 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1686
1687 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1688 goto nla_put_failure;
1689 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1690 goto nla_put_failure;
1691 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle)))
1692 goto nla_put_failure;
1693
5e948466
EL		 1694 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
1695 prule = list_entry(rule->list.prev, struct nft_rule, list);
1696 if (nla_put_be64(skb, NFTA_RULE_POSITION,
1697 cpu_to_be64(prule->handle)))
1698 goto nla_put_failure;
1699 }
1700
96518518
PM		 1701 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1702 if (list == NULL)
1703 goto nla_put_failure;
1704 nft_rule_for_each_expr(expr, next, rule) {
1705 struct nlattr *elem = nla_nest_start(skb, NFTA_LIST_ELEM);
1706 if (elem == NULL)
1707 goto nla_put_failure;
1708 if (nf_tables_fill_expr_info(skb, expr) < 0)
1709 goto nla_put_failure;
1710 nla_nest_end(skb, elem);
1711 }
1712 nla_nest_end(skb, list);
1713
0768b3b3
PNA		 1714 if (rule->ulen &&
1715 nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
1716 goto nla_put_failure;
1717
053c095a
JB		 1718 nlmsg_end(skb, nlh);
1719 return 0;
96518518
PM		 1720
1721nla_put_failure:
1722 nlmsg_trim(skb, nlh);
1723 return -1;
1724}
1725
35151d84 1726static int nf_tables_rule_notify(const struct nft_ctx *ctx,
96518518 1727 const struct nft_rule *rule,
35151d84 1728 int event)
96518518
PM		 1729{
1730 struct sk_buff *skb;
96518518
PM		 1731 int err;
1732
128ad332
PNA		 1733 if (!ctx->report &&
1734 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
96518518
PM		 1735 return 0;
1736
1737 err = -ENOBUFS;
1738 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1739 if (skb == NULL)
1740 goto err;
1741
84d7fce6
PNA		 1742 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
1743 event, 0, ctx->afi->family, ctx->table,
35151d84 1744 ctx->chain, rule);
96518518
PM		 1745 if (err < 0) {
1746 kfree_skb(skb);
1747 goto err;
1748 }
1749
128ad332
PNA		 1750 err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1751 ctx->report, GFP_KERNEL);
96518518 1752err:
128ad332
PNA		 1753 if (err < 0) {
1754 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1755 err);
1756 }
96518518
PM		 1757 return err;
1758}
1759
1760static int nf_tables_dump_rules(struct sk_buff *skb,
1761 struct netlink_callback *cb)
1762{
1763 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1764 const struct nft_af_info *afi;
1765 const struct nft_table *table;
1766 const struct nft_chain *chain;
1767 const struct nft_rule *rule;
1768 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1769 struct net *net = sock_net(skb->sk);
96518518
PM		 1770 int family = nfmsg->nfgen_family;
1771
e688a7f8 1772 rcu_read_lock();
38e029f1
PNA		 1773 cb->seq = net->nft.base_seq;
1774
e688a7f8 1775 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 1776 if (family != NFPROTO_UNSPEC && family != afi->family)
1777 continue;
1778
e688a7f8
PNA		 1779 list_for_each_entry_rcu(table, &afi->tables, list) {
1780 list_for_each_entry_rcu(chain, &table->chains, list) {
1781 list_for_each_entry_rcu(rule, &chain->rules, list) {
0628b123
PNA		 1782 if (!nft_rule_is_active(net, rule))
1783 goto cont;
96518518
PM		 1784 if (idx < s_idx)
1785 goto cont;
1786 if (idx > s_idx)
1787 memset(&cb->args[1], 0,
1788 sizeof(cb->args) - sizeof(cb->args[0]));
84d7fce6 1789 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
96518518
PM		 1790 cb->nlh->nlmsg_seq,
1791 NFT_MSG_NEWRULE,
1792 NLM_F_MULTI | NLM_F_APPEND,
1793 afi->family, table, chain, rule) < 0)
1794 goto done;
38e029f1
PNA		 1795
1796 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 1797cont:
1798 idx++;
1799 }
1800 }
1801 }
1802 }
1803done:
e688a7f8
PNA		 1804 rcu_read_unlock();
1805
96518518
PM		 1806 cb->args[0] = idx;
1807 return skb->len;
1808}
1809
1810static int nf_tables_getrule(struct sock *nlsk, struct sk_buff *skb,
1811 const struct nlmsghdr *nlh,
1812 const struct nlattr * const nla[])
1813{
1814 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1815 const struct nft_af_info *afi;
1816 const struct nft_table *table;
1817 const struct nft_chain *chain;
1818 const struct nft_rule *rule;
1819 struct sk_buff *skb2;
99633ab2 1820 struct net *net = sock_net(skb->sk);
96518518
PM		 1821 int family = nfmsg->nfgen_family;
1822 int err;
1823
1824 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1825 struct netlink_dump_control c = {
1826 .dump = nf_tables_dump_rules,
1827 };
1828 return netlink_dump_start(nlsk, skb, nlh, &c);
1829 }
1830
99633ab2 1831 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1832 if (IS_ERR(afi))
1833 return PTR_ERR(afi);
1834
9370761c 1835 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1836 if (IS_ERR(table))
1837 return PTR_ERR(table);
55dd6f93
PNA		 1838 if (table->flags & NFT_TABLE_INACTIVE)
1839 return -ENOENT;
96518518
PM		 1840
1841 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1842 if (IS_ERR(chain))
1843 return PTR_ERR(chain);
91c7b38d
PNA		 1844 if (chain->flags & NFT_CHAIN_INACTIVE)
1845 return -ENOENT;
96518518
PM		 1846
1847 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
1848 if (IS_ERR(rule))
1849 return PTR_ERR(rule);
1850
1851 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1852 if (!skb2)
1853 return -ENOMEM;
1854
84d7fce6 1855 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1856 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
1857 family, table, chain, rule);
1858 if (err < 0)
1859 goto err;
1860
1861 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1862
1863err:
1864 kfree_skb(skb2);
1865 return err;
1866}
1867
62472bce
PM		 1868static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
1869 struct nft_rule *rule)
96518518 1870{
96518518
PM		 1871 struct nft_expr *expr;
1872
1873 /*
1874 * Careful: some expressions might not be initialized in case this
1875 * is called on error from nf_tables_newrule().
1876 */
1877 expr = nft_expr_first(rule);
1878 while (expr->ops && expr != nft_expr_last(rule)) {
62472bce 1879 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 1880 expr = nft_expr_next(expr);
1881 }
1882 kfree(rule);
1883}
1884
1081d11b
PNA		 1885#define NFT_RULE_MAXEXPRS 128
1886
1887static struct nft_expr_info *info;
1888
96518518
PM		 1889static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
1890 const struct nlmsghdr *nlh,
1891 const struct nlattr * const nla[])
1892{
1893 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1894 struct nft_af_info *afi;
99633ab2 1895 struct net *net = sock_net(skb->sk);
96518518
PM		 1896 struct nft_table *table;
1897 struct nft_chain *chain;
1898 struct nft_rule *rule, *old_rule = NULL;
1081d11b 1899 struct nft_trans *trans = NULL;
96518518
PM		 1900 struct nft_expr *expr;
1901 struct nft_ctx ctx;
1902 struct nlattr *tmp;
0768b3b3 1903 unsigned int size, i, n, ulen = 0;
96518518
PM		 1904 int err, rem;
1905 bool create;
5e948466 1906 u64 handle, pos_handle;
96518518
PM		 1907
1908 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1909
99633ab2 1910 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
96518518
PM		 1911 if (IS_ERR(afi))
1912 return PTR_ERR(afi);
1913
9370761c 1914 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1915 if (IS_ERR(table))
1916 return PTR_ERR(table);
1917
1918 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1919 if (IS_ERR(chain))
1920 return PTR_ERR(chain);
1921
1922 if (nla[NFTA_RULE_HANDLE]) {
1923 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
1924 rule = __nf_tables_rule_lookup(chain, handle);
1925 if (IS_ERR(rule))
1926 return PTR_ERR(rule);
1927
1928 if (nlh->nlmsg_flags & NLM_F_EXCL)
1929 return -EEXIST;
1930 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1931 old_rule = rule;
1932 else
1933 return -EOPNOTSUPP;
1934 } else {
1935 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
1936 return -EINVAL;
1937 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 1938
1939 if (chain->use == UINT_MAX)
1940 return -EOVERFLOW;
96518518
PM		 1941 }
1942
5e948466
EL		 1943 if (nla[NFTA_RULE_POSITION]) {
1944 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
1945 return -EOPNOTSUPP;
1946
1947 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
1948 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
1949 if (IS_ERR(old_rule))
1950 return PTR_ERR(old_rule);
1951 }
1952
0ca743a5
PNA		 1953 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1954
96518518
PM		 1955 n = 0;
1956 size = 0;
1957 if (nla[NFTA_RULE_EXPRESSIONS]) {
1958 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
1959 err = -EINVAL;
1960 if (nla_type(tmp) != NFTA_LIST_ELEM)
1961 goto err1;
1962 if (n == NFT_RULE_MAXEXPRS)
1963 goto err1;
0ca743a5 1964 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 1965 if (err < 0)
1966 goto err1;
1967 size += info[n].ops->size;
1968 n++;
1969 }
1970 }
9889840f
PM		 1971 /* Check for overflow of dlen field */
1972 err = -EFBIG;
1973 if (size >= 1 << 12)
1974 goto err1;
96518518 1975
0768b3b3
PNA		 1976 if (nla[NFTA_RULE_USERDATA])
1977 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
1978
96518518 1979 err = -ENOMEM;
0768b3b3 1980 rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
96518518
PM		 1981 if (rule == NULL)
1982 goto err1;
1983
0628b123
PNA		 1984 nft_rule_activate_next(net, rule);
1985
96518518
PM		 1986 rule->handle = handle;
1987 rule->dlen = size;
0768b3b3
PNA		 1988 rule->ulen = ulen;
1989
1990 if (ulen)
1991 nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
96518518 1992
96518518
PM		 1993 expr = nft_expr_first(rule);
1994 for (i = 0; i < n; i++) {
1995 err = nf_tables_newexpr(&ctx, &info[i], expr);
1996 if (err < 0)
1997 goto err2;
ef1f7df9 1998 info[i].ops = NULL;
96518518
PM		 1999 expr = nft_expr_next(expr);
2000 }
2001
96518518 2002 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
0628b123 2003 if (nft_rule_is_active_next(net, old_rule)) {
ac904ac8 2004 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
b380e5c7 2005 old_rule);
1081d11b 2006 if (trans == NULL) {
0628b123
PNA		 2007 err = -ENOMEM;
2008 goto err2;
2009 }
ee01d542 2010 nft_rule_deactivate_next(net, old_rule);
ac34b861 2011 chain->use--;
5bc5c307 2012 list_add_tail_rcu(&rule->list, &old_rule->list);
0628b123
PNA		 2013 } else {
2014 err = -ENOENT;
2015 goto err2;
2016 }
96518518 2017 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 2018 if (old_rule)
2019 list_add_rcu(&rule->list, &old_rule->list);
2020 else
2021 list_add_tail_rcu(&rule->list, &chain->rules);
2022 else {
2023 if (old_rule)
2024 list_add_tail_rcu(&rule->list, &old_rule->list);
2025 else
2026 list_add_rcu(&rule->list, &chain->rules);
2027 }
96518518 2028
b380e5c7 2029 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 2030 err = -ENOMEM;
2031 goto err3;
2032 }
4fefee57 2033 chain->use++;
96518518
PM		 2034 return 0;
2035
0628b123
PNA		 2036err3:
2037 list_del_rcu(&rule->list);
1081d11b
PNA		 2038 if (trans) {
2039 list_del_rcu(&nft_trans_rule(trans)->list);
2040 nft_rule_clear(net, nft_trans_rule(trans));
2041 nft_trans_destroy(trans);
ac34b861 2042 chain->use++;
0628b123 2043 }
96518518 2044err2:
62472bce 2045 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 2046err1:
2047 for (i = 0; i < n; i++) {
2048 if (info[i].ops != NULL)
ef1f7df9 2049 module_put(info[i].ops->type->owner);
96518518
PM		 2050 }
2051 return err;
2052}
2053
2054static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
2055 const struct nlmsghdr *nlh,
2056 const struct nlattr * const nla[])
2057{
2058 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 2059 struct nft_af_info *afi;
99633ab2 2060 struct net *net = sock_net(skb->sk);
7c95f6d8 2061 struct nft_table *table;
cf9dc09d
PNA		 2062 struct nft_chain *chain = NULL;
2063 struct nft_rule *rule;
0628b123
PNA		 2064 int family = nfmsg->nfgen_family, err = 0;
2065 struct nft_ctx ctx;
96518518 2066
99633ab2 2067 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 2068 if (IS_ERR(afi))
2069 return PTR_ERR(afi);
2070
9370761c 2071 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 2072 if (IS_ERR(table))
2073 return PTR_ERR(table);
55dd6f93
PNA		 2074 if (table->flags & NFT_TABLE_INACTIVE)
2075 return -ENOENT;
96518518 2076
cf9dc09d
PNA		 2077 if (nla[NFTA_RULE_CHAIN]) {
2078 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
2079 if (IS_ERR(chain))
2080 return PTR_ERR(chain);
2081 }
96518518 2082
0628b123
PNA		 2083 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
2084
cf9dc09d
PNA		 2085 if (chain) {
2086 if (nla[NFTA_RULE_HANDLE]) {
2087 rule = nf_tables_rule_lookup(chain,
2088 nla[NFTA_RULE_HANDLE]);
2089 if (IS_ERR(rule))
2090 return PTR_ERR(rule);
96518518 2091
5e266fe7 2092 err = nft_delrule(&ctx, rule);
cf9dc09d 2093 } else {
ce24b721 2094 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2095 }
2096 } else {
2097 list_for_each_entry(chain, &table->chains, list) {
2098 ctx.chain = chain;
ce24b721 2099 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2100 if (err < 0)
2101 break;
2102 }
2103 }
2104
2105 return err;
2106}
2107
20a69341
PM		 2108/*
2109 * Sets
2110 */
2111
2112static LIST_HEAD(nf_tables_set_ops);
2113
2114int nft_register_set(struct nft_set_ops *ops)
2115{
2116 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 2117 list_add_tail_rcu(&ops->list, &nf_tables_set_ops);
20a69341
PM		 2118 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2119 return 0;
2120}
2121EXPORT_SYMBOL_GPL(nft_register_set);
2122
2123void nft_unregister_set(struct nft_set_ops *ops)
2124{
2125 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 2126 list_del_rcu(&ops->list);
20a69341
PM		 2127 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2128}
2129EXPORT_SYMBOL_GPL(nft_unregister_set);
2130
c50b960c
PM		 2131/*
2132 * Select a set implementation based on the data characteristics and the
2133 * given policy. The total memory use might not be known if no size is
2134 * given, in that case the amount of memory per element is used.
2135 */
2136static const struct nft_set_ops *
2137nft_select_set_ops(const struct nlattr * const nla[],
2138 const struct nft_set_desc *desc,
2139 enum nft_set_policies policy)
20a69341 2140{
c50b960c
PM		 2141 const struct nft_set_ops *ops, *bops;
2142 struct nft_set_estimate est, best;
20a69341
PM		 2143 u32 features;
2144
2145#ifdef CONFIG_MODULES
2146 if (list_empty(&nf_tables_set_ops)) {
2147 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2148 request_module("nft-set");
2149 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2150 if (!list_empty(&nf_tables_set_ops))
2151 return ERR_PTR(-EAGAIN);
2152 }
2153#endif
2154 features = 0;
2155 if (nla[NFTA_SET_FLAGS] != NULL) {
2156 features = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2157 features &= NFT_SET_INTERVAL | NFT_SET_MAP;
2158 }
2159
c50b960c
PM		 2160 bops = NULL;
2161 best.size = ~0;
2162 best.class = ~0;
2163
20a69341
PM		 2164 list_for_each_entry(ops, &nf_tables_set_ops, list) {
2165 if ((ops->features & features) != features)
2166 continue;
c50b960c
PM		 2167 if (!ops->estimate(desc, features, &est))
2168 continue;
2169
2170 switch (policy) {
2171 case NFT_SET_POL_PERFORMANCE:
2172 if (est.class < best.class)
2173 break;
2174 if (est.class == best.class && est.size < best.size)
2175 break;
2176 continue;
2177 case NFT_SET_POL_MEMORY:
2178 if (est.size < best.size)
2179 break;
2180 if (est.size == best.size && est.class < best.class)
2181 break;
2182 continue;
2183 default:
2184 break;
2185 }
2186
20a69341
PM		 2187 if (!try_module_get(ops->owner))
2188 continue;
c50b960c
PM		 2189 if (bops != NULL)
2190 module_put(bops->owner);
2191
2192 bops = ops;
2193 best = est;
20a69341
PM		 2194 }
2195
c50b960c
PM		 2196 if (bops != NULL)
2197 return bops;
2198
20a69341
PM		 2199 return ERR_PTR(-EOPNOTSUPP);
2200}
2201
2202static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
2203 [NFTA_SET_TABLE] = { .type = NLA_STRING },
a9bdd836
PNA		 2204 [NFTA_SET_NAME] = { .type = NLA_STRING,
2205 .len = IFNAMSIZ - 1 },
20a69341
PM		 2206 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2207 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2208 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2209 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2210 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2211 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2212 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2213 [NFTA_SET_ID] = { .type = NLA_U32 },
c50b960c
PM		 2214};
2215
2216static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2217 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2218};
2219
2220static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
2221 const struct sk_buff *skb,
2222 const struct nlmsghdr *nlh,
2223 const struct nlattr * const nla[])
2224{
99633ab2 2225 struct net *net = sock_net(skb->sk);
20a69341 2226 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 2227 struct nft_af_info *afi = NULL;
2228 struct nft_table *table = NULL;
20a69341 2229
c9c8e485
PNA		 2230 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
2231 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
2232 if (IS_ERR(afi))
2233 return PTR_ERR(afi);
2234 }
20a69341
PM		 2235
2236 if (nla[NFTA_SET_TABLE] != NULL) {
ec2c9935
PM		 2237 if (afi == NULL)
2238 return -EAFNOSUPPORT;
2239
9370761c 2240 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
20a69341
PM		 2241 if (IS_ERR(table))
2242 return PTR_ERR(table);
55dd6f93
PNA		 2243 if (table->flags & NFT_TABLE_INACTIVE)
2244 return -ENOENT;
20a69341
PM		 2245 }
2246
0ca743a5 2247 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2248 return 0;
2249}
2250
2251struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2252 const struct nlattr *nla)
2253{
2254 struct nft_set *set;
2255
2256 if (nla == NULL)
2257 return ERR_PTR(-EINVAL);
2258
2259 list_for_each_entry(set, &table->sets, list) {
2260 if (!nla_strcmp(nla, set->name))
2261 return set;
2262 }
2263 return ERR_PTR(-ENOENT);
2264}
2265
958bee14
PNA		 2266struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2267 const struct nlattr *nla)
2268{
2269 struct nft_trans *trans;
2270 u32 id = ntohl(nla_get_be32(nla));
2271
2272 list_for_each_entry(trans, &net->nft.commit_list, list) {
2273 if (trans->msg_type == NFT_MSG_NEWSET &&
2274 id == nft_trans_set_id(trans))
2275 return nft_trans_set(trans);
2276 }
2277 return ERR_PTR(-ENOENT);
2278}
2279
20a69341
PM		 2280static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2281 const char *name)
2282{
2283 const struct nft_set *i;
2284 const char *p;
2285 unsigned long *inuse;
60eb1894 2286 unsigned int n = 0, min = 0;
20a69341
PM		 2287
2288 p = strnchr(name, IFNAMSIZ, '%');
2289 if (p != NULL) {
2290 if (p[1] != 'd' || strchr(p + 2, '%'))
2291 return -EINVAL;
2292
2293 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2294 if (inuse == NULL)
2295 return -ENOMEM;
60eb1894 2296cont:
20a69341 2297 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2298 int tmp;
2299
2300 if (!sscanf(i->name, name, &tmp))
20a69341 2301 continue;
60eb1894 2302 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2303 continue;
14662917 2304
60eb1894 2305 set_bit(tmp - min, inuse);
20a69341
PM		 2306 }
2307
53b70287 2308 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2309 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2310 min += BITS_PER_BYTE * PAGE_SIZE;
2311 memset(inuse, 0, PAGE_SIZE);
2312 goto cont;
2313 }
20a69341
PM		 2314 free_page((unsigned long)inuse);
2315 }
2316
60eb1894 2317 snprintf(set->name, sizeof(set->name), name, min + n);
20a69341
PM		 2318 list_for_each_entry(i, &ctx->table->sets, list) {
2319 if (!strcmp(set->name, i->name))
2320 return -ENFILE;
2321 }
2322 return 0;
2323}
2324
2325static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2326 const struct nft_set *set, u16 event, u16 flags)
2327{
2328 struct nfgenmsg *nfmsg;
2329 struct nlmsghdr *nlh;
c50b960c 2330 struct nlattr *desc;
128ad332
PNA		 2331 u32 portid = ctx->portid;
2332 u32 seq = ctx->seq;
20a69341
PM		 2333
2334 event |= NFNL_SUBSYS_NFTABLES << 8;
2335 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2336 flags);
2337 if (nlh == NULL)
2338 goto nla_put_failure;
2339
2340 nfmsg = nlmsg_data(nlh);
2341 nfmsg->nfgen_family = ctx->afi->family;
2342 nfmsg->version = NFNETLINK_V0;
84d7fce6 2343 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 2344
2345 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2346 goto nla_put_failure;
2347 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2348 goto nla_put_failure;
2349 if (set->flags != 0)
2350 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2351 goto nla_put_failure;
2352
2353 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2354 goto nla_put_failure;
2355 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2356 goto nla_put_failure;
2357 if (set->flags & NFT_SET_MAP) {
2358 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2359 goto nla_put_failure;
2360 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2361 goto nla_put_failure;
2362 }
2363
9363dc4b
AB		 2364 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2365 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2366 goto nla_put_failure;
2367 }
2368
c50b960c
PM		 2369 desc = nla_nest_start(skb, NFTA_SET_DESC);
2370 if (desc == NULL)
2371 goto nla_put_failure;
2372 if (set->size &&
2373 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2374 goto nla_put_failure;
2375 nla_nest_end(skb, desc);
2376
053c095a
JB		 2377 nlmsg_end(skb, nlh);
2378 return 0;
20a69341
PM		 2379
2380nla_put_failure:
2381 nlmsg_trim(skb, nlh);
2382 return -1;
2383}
2384
2385static int nf_tables_set_notify(const struct nft_ctx *ctx,
2386 const struct nft_set *set,
31f8441c 2387 int event, gfp_t gfp_flags)
20a69341
PM		 2388{
2389 struct sk_buff *skb;
128ad332 2390 u32 portid = ctx->portid;
20a69341
PM		 2391 int err;
2392
128ad332
PNA		 2393 if (!ctx->report &&
2394 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
20a69341
PM		 2395 return 0;
2396
2397 err = -ENOBUFS;
31f8441c 2398 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 2399 if (skb == NULL)
2400 goto err;
2401
2402 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2403 if (err < 0) {
2404 kfree_skb(skb);
2405 goto err;
2406 }
2407
128ad332 2408 err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES,
31f8441c 2409 ctx->report, gfp_flags);
20a69341
PM		 2410err:
2411 if (err < 0)
99633ab2 2412 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err);
20a69341
PM		 2413 return err;
2414}
2415
5b96af77 2416static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 2417{
2418 const struct nft_set *set;
2419 unsigned int idx, s_idx = cb->args[0];
7c95f6d8 2420 struct nft_af_info *afi;
c9c8e485
PNA		 2421 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2422 struct net *net = sock_net(skb->sk);
2423 int cur_family = cb->args[3];
5b96af77 2424 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 2425
2426 if (cb->args[1])
2427 return skb->len;
2428
e688a7f8 2429 rcu_read_lock();
38e029f1
PNA		 2430 cb->seq = net->nft.base_seq;
2431
e688a7f8 2432 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
5b96af77
PNA		 2433 if (ctx->afi && ctx->afi != afi)
2434 continue;
2435
c9c8e485
PNA		 2436 if (cur_family) {
2437 if (afi->family != cur_family)
2438 continue;
2439
2440 cur_family = 0;
2441 }
e688a7f8 2442 list_for_each_entry_rcu(table, &afi->tables, list) {
5b96af77
PNA		 2443 if (ctx->table && ctx->table != table)
2444 continue;
2445
c9c8e485
PNA		 2446 if (cur_table) {
2447 if (cur_table != table)
2448 continue;
2449
2450 cur_table = NULL;
2451 }
c9c8e485 2452 idx = 0;
5b96af77 2453 list_for_each_entry_rcu(set, &table->sets, list) {
c9c8e485
PNA		 2454 if (idx < s_idx)
2455 goto cont;
5b96af77
PNA		 2456
2457 ctx_set = *ctx;
2458 ctx_set.table = table;
2459 ctx_set.afi = afi;
2460 if (nf_tables_fill_set(skb, &ctx_set, set,
c9c8e485
PNA		 2461 NFT_MSG_NEWSET,
2462 NLM_F_MULTI) < 0) {
2463 cb->args[0] = idx;
2464 cb->args[2] = (unsigned long) table;
2465 cb->args[3] = afi->family;
2466 goto done;
2467 }
38e029f1 2468 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485
PNA		 2469cont:
2470 idx++;
2471 }
2472 if (s_idx)
2473 s_idx = 0;
2474 }
2475 }
2476 cb->args[1] = 1;
2477done:
e688a7f8 2478 rcu_read_unlock();
c9c8e485
PNA		 2479 return skb->len;
2480}
2481
5b96af77 2482static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 2483{
5b96af77
PNA		 2484 kfree(cb->data);
2485 return 0;
20a69341
PM		 2486}
2487
2488static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
2489 const struct nlmsghdr *nlh,
2490 const struct nlattr * const nla[])
2491{
2492 const struct nft_set *set;
2493 struct nft_ctx ctx;
2494 struct sk_buff *skb2;
c9c8e485 2495 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2496 int err;
2497
01cfa0a4 2498 /* Verify existence before starting dump */
20a69341
PM		 2499 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2500 if (err < 0)
2501 return err;
2502
2503 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2504 struct netlink_dump_control c = {
2505 .dump = nf_tables_dump_sets,
5b96af77 2506 .done = nf_tables_dump_sets_done,
20a69341 2507 };
5b96af77
PNA		 2508 struct nft_ctx *ctx_dump;
2509
2510 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2511 if (ctx_dump == NULL)
2512 return -ENOMEM;
2513
2514 *ctx_dump = ctx;
2515 c.data = ctx_dump;
2516
20a69341
PM		 2517 return netlink_dump_start(nlsk, skb, nlh, &c);
2518 }
2519
c9c8e485
PNA		 2520 /* Only accept unspec with dump */
2521 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2522 return -EAFNOSUPPORT;
2523
20a69341
PM		 2524 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2525 if (IS_ERR(set))
2526 return PTR_ERR(set);
958bee14
PNA		 2527 if (set->flags & NFT_SET_INACTIVE)
2528 return -ENOENT;
20a69341
PM		 2529
2530 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2531 if (skb2 == NULL)
2532 return -ENOMEM;
2533
2534 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2535 if (err < 0)
2536 goto err;
2537
2538 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2539
2540err:
2541 kfree_skb(skb2);
2542 return err;
2543}
2544
c50b960c
PM		 2545static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2546 struct nft_set_desc *desc,
2547 const struct nlattr *nla)
2548{
2549 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2550 int err;
2551
2552 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla, nft_set_desc_policy);
2553 if (err < 0)
2554 return err;
2555
2556 if (da[NFTA_SET_DESC_SIZE] != NULL)
2557 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
2558
2559 return 0;
2560}
2561
20a69341
PM		 2562static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
2563 const struct nlmsghdr *nlh,
2564 const struct nlattr * const nla[])
2565{
2566 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2567 const struct nft_set_ops *ops;
7c95f6d8 2568 struct nft_af_info *afi;
99633ab2 2569 struct net *net = sock_net(skb->sk);
20a69341
PM		 2570 struct nft_table *table;
2571 struct nft_set *set;
2572 struct nft_ctx ctx;
2573 char name[IFNAMSIZ];
2574 unsigned int size;
2575 bool create;
c50b960c
PM		 2576 u32 ktype, dtype, flags, policy;
2577 struct nft_set_desc desc;
20a69341
PM		 2578 int err;
2579
2580 if (nla[NFTA_SET_TABLE] == NULL ||
2581 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 2582 nla[NFTA_SET_KEY_LEN] == NULL ||
2583 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 2584 return -EINVAL;
2585
c50b960c
PM		 2586 memset(&desc, 0, sizeof(desc));
2587
20a69341
PM		 2588 ktype = NFT_DATA_VALUE;
2589 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
2590 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
2591 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
2592 return -EINVAL;
2593 }
2594
c50b960c
PM		 2595 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
2596 if (desc.klen == 0 || desc.klen > FIELD_SIZEOF(struct nft_data, data))
20a69341
PM		 2597 return -EINVAL;
2598
2599 flags = 0;
2600 if (nla[NFTA_SET_FLAGS] != NULL) {
2601 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2602 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
2603 NFT_SET_INTERVAL | NFT_SET_MAP))
2604 return -EINVAL;
2605 }
2606
2607 dtype = 0;
20a69341
PM		 2608 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
2609 if (!(flags & NFT_SET_MAP))
2610 return -EINVAL;
2611
2612 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
2613 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
2614 dtype != NFT_DATA_VERDICT)
2615 return -EINVAL;
2616
2617 if (dtype != NFT_DATA_VERDICT) {
2618 if (nla[NFTA_SET_DATA_LEN] == NULL)
2619 return -EINVAL;
c50b960c
PM		 2620 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
2621 if (desc.dlen == 0 ||
2622 desc.dlen > FIELD_SIZEOF(struct nft_data, data))
20a69341
PM		 2623 return -EINVAL;
2624 } else
c50b960c 2625 desc.dlen = sizeof(struct nft_data);
20a69341
PM		 2626 } else if (flags & NFT_SET_MAP)
2627 return -EINVAL;
2628
c50b960c
PM		 2629 policy = NFT_SET_POL_PERFORMANCE;
2630 if (nla[NFTA_SET_POLICY] != NULL)
2631 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
2632
2633 if (nla[NFTA_SET_DESC] != NULL) {
2634 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
2635 if (err < 0)
2636 return err;
2637 }
2638
20a69341
PM		 2639 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2640
99633ab2 2641 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
20a69341
PM		 2642 if (IS_ERR(afi))
2643 return PTR_ERR(afi);
2644
9370761c 2645 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
20a69341
PM		 2646 if (IS_ERR(table))
2647 return PTR_ERR(table);
2648
0ca743a5 2649 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2650
2651 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME]);
2652 if (IS_ERR(set)) {
2653 if (PTR_ERR(set) != -ENOENT)
2654 return PTR_ERR(set);
2655 set = NULL;
2656 }
2657
2658 if (set != NULL) {
2659 if (nlh->nlmsg_flags & NLM_F_EXCL)
2660 return -EEXIST;
2661 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2662 return -EOPNOTSUPP;
2663 return 0;
2664 }
2665
2666 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2667 return -ENOENT;
2668
c50b960c 2669 ops = nft_select_set_ops(nla, &desc, policy);
20a69341
PM		 2670 if (IS_ERR(ops))
2671 return PTR_ERR(ops);
2672
2673 size = 0;
2674 if (ops->privsize != NULL)
2675 size = ops->privsize(nla);
2676
2677 err = -ENOMEM;
2678 set = kzalloc(sizeof(*set) + size, GFP_KERNEL);
2679 if (set == NULL)
2680 goto err1;
2681
2682 nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name));
2683 err = nf_tables_set_alloc_name(&ctx, set, name);
2684 if (err < 0)
2685 goto err2;
2686
2687 INIT_LIST_HEAD(&set->bindings);
2688 set->ops = ops;
2689 set->ktype = ktype;
c50b960c 2690 set->klen = desc.klen;
20a69341 2691 set->dtype = dtype;
c50b960c 2692 set->dlen = desc.dlen;
20a69341 2693 set->flags = flags;
c50b960c 2694 set->size = desc.size;
9363dc4b 2695 set->policy = policy;
20a69341 2696
c50b960c 2697 err = ops->init(set, &desc, nla);
20a69341
PM		 2698 if (err < 0)
2699 goto err2;
2700
958bee14 2701 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341
PM		 2702 if (err < 0)
2703 goto err2;
2704
e688a7f8 2705 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 2706 table->use++;
20a69341
PM		 2707 return 0;
2708
2709err2:
2710 kfree(set);
2711err1:
2712 module_put(ops->owner);
2713 return err;
2714}
2715
958bee14 2716static void nft_set_destroy(struct nft_set *set)
20a69341 2717{
20a69341
PM		 2718 set->ops->destroy(set);
2719 module_put(set->ops->owner);
2720 kfree(set);
2721}
2722
958bee14
PNA		 2723static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
2724{
e688a7f8 2725 list_del_rcu(&set->list);
31f8441c 2726 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
958bee14
PNA		 2727 nft_set_destroy(set);
2728}
2729
20a69341
PM		 2730static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
2731 const struct nlmsghdr *nlh,
2732 const struct nlattr * const nla[])
2733{
c9c8e485 2734 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2735 struct nft_set *set;
2736 struct nft_ctx ctx;
2737 int err;
2738
ec2c9935
PM		 2739 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2740 return -EAFNOSUPPORT;
20a69341
PM		 2741 if (nla[NFTA_SET_TABLE] == NULL)
2742 return -EINVAL;
2743
2744 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2745 if (err < 0)
2746 return err;
2747
2748 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2749 if (IS_ERR(set))
2750 return PTR_ERR(set);
958bee14
PNA		 2751 if (set->flags & NFT_SET_INACTIVE)
2752 return -ENOENT;
20a69341
PM		 2753 if (!list_empty(&set->bindings))
2754 return -EBUSY;
2755
ee01d542 2756 return nft_delset(&ctx, set);
20a69341
PM		 2757}
2758
2759static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
2760 const struct nft_set *set,
2761 const struct nft_set_iter *iter,
2762 const struct nft_set_elem *elem)
2763{
2764 enum nft_registers dreg;
2765
2766 dreg = nft_type_to_reg(set->dtype);
2ee0d3c8
PNA		 2767 return nft_validate_data_load(ctx, dreg, &elem->data,
2768 set->dtype == NFT_DATA_VERDICT ?
2769 NFT_DATA_VERDICT : NFT_DATA_VALUE);
20a69341
PM		 2770}
2771
2772int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
2773 struct nft_set_binding *binding)
2774{
2775 struct nft_set_binding *i;
2776 struct nft_set_iter iter;
2777
2778 if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
2779 return -EBUSY;
2780
2781 if (set->flags & NFT_SET_MAP) {
2782 /* If the set is already bound to the same chain all
2783 * jumps are already validated for that chain.
2784 */
2785 list_for_each_entry(i, &set->bindings, list) {
2786 if (i->chain == binding->chain)
2787 goto bind;
2788 }
2789
2790 iter.skip = 0;
2791 iter.count = 0;
2792 iter.err = 0;
2793 iter.fn = nf_tables_bind_check_setelem;
2794
2795 set->ops->walk(ctx, set, &iter);
2796 if (iter.err < 0) {
2797 /* Destroy anonymous sets if binding fails */
2798 if (set->flags & NFT_SET_ANONYMOUS)
2799 nf_tables_set_destroy(ctx, set);
2800
2801 return iter.err;
2802 }
2803 }
2804bind:
2805 binding->chain = ctx->chain;
e688a7f8 2806 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 2807 return 0;
2808}
2809
2810void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
2811 struct nft_set_binding *binding)
2812{
e688a7f8 2813 list_del_rcu(&binding->list);
20a69341 2814
958bee14
PNA		 2815 if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS &&
2816 !(set->flags & NFT_SET_INACTIVE))
20a69341
PM		 2817 nf_tables_set_destroy(ctx, set);
2818}
2819
2820/*
2821 * Set elements
2822 */
2823
2824static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
2825 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
2826 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
2827 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
2828};
2829
2830static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
2831 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING },
2832 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING },
2833 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 2834 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 2835};
2836
2837static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx,
2838 const struct sk_buff *skb,
2839 const struct nlmsghdr *nlh,
55dd6f93
PNA		 2840 const struct nlattr * const nla[],
2841 bool trans)
20a69341
PM		 2842{
2843 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 2844 struct nft_af_info *afi;
2845 struct nft_table *table;
99633ab2 2846 struct net *net = sock_net(skb->sk);
20a69341 2847
99633ab2 2848 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
20a69341
PM		 2849 if (IS_ERR(afi))
2850 return PTR_ERR(afi);
2851
9370761c 2852 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341
PM		 2853 if (IS_ERR(table))
2854 return PTR_ERR(table);
55dd6f93
PNA		 2855 if (!trans && (table->flags & NFT_TABLE_INACTIVE))
2856 return -ENOENT;
20a69341 2857
0ca743a5 2858 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2859 return 0;
2860}
2861
2862static int nf_tables_fill_setelem(struct sk_buff *skb,
2863 const struct nft_set *set,
2864 const struct nft_set_elem *elem)
2865{
2866 unsigned char *b = skb_tail_pointer(skb);
2867 struct nlattr *nest;
2868
2869 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
2870 if (nest == NULL)
2871 goto nla_put_failure;
2872
2873 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, &elem->key, NFT_DATA_VALUE,
2874 set->klen) < 0)
2875 goto nla_put_failure;
2876
2877 if (set->flags & NFT_SET_MAP &&
2878 !(elem->flags & NFT_SET_ELEM_INTERVAL_END) &&
2879 nft_data_dump(skb, NFTA_SET_ELEM_DATA, &elem->data,
2880 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
2881 set->dlen) < 0)
2882 goto nla_put_failure;
2883
2884 if (elem->flags != 0)
2885 if (nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, htonl(elem->flags)))
2886 goto nla_put_failure;
2887
2888 nla_nest_end(skb, nest);
2889 return 0;
2890
2891nla_put_failure:
2892 nlmsg_trim(skb, b);
2893 return -EMSGSIZE;
2894}
2895
2896struct nft_set_dump_args {
2897 const struct netlink_callback *cb;
2898 struct nft_set_iter iter;
2899 struct sk_buff *skb;
2900};
2901
2902static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
2903 const struct nft_set *set,
2904 const struct nft_set_iter *iter,
2905 const struct nft_set_elem *elem)
2906{
2907 struct nft_set_dump_args *args;
2908
2909 args = container_of(iter, struct nft_set_dump_args, iter);
2910 return nf_tables_fill_setelem(args->skb, set, elem);
2911}
2912
2913static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
2914{
2915 const struct nft_set *set;
2916 struct nft_set_dump_args args;
2917 struct nft_ctx ctx;
2918 struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
2919 struct nfgenmsg *nfmsg;
2920 struct nlmsghdr *nlh;
2921 struct nlattr *nest;
2922 u32 portid, seq;
2923 int event, err;
2924
720e0dfa
MN		 2925 err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
2926 NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy);
20a69341
PM		 2927 if (err < 0)
2928 return err;
2929
55dd6f93
PNA		 2930 err = nft_ctx_init_from_elemattr(&ctx, cb->skb, cb->nlh, (void *)nla,
2931 false);
20a69341
PM		 2932 if (err < 0)
2933 return err;
2934
2935 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2936 if (IS_ERR(set))
2937 return PTR_ERR(set);
958bee14
PNA		 2938 if (set->flags & NFT_SET_INACTIVE)
2939 return -ENOENT;
20a69341
PM		 2940
2941 event = NFT_MSG_NEWSETELEM;
2942 event |= NFNL_SUBSYS_NFTABLES << 8;
2943 portid = NETLINK_CB(cb->skb).portid;
2944 seq = cb->nlh->nlmsg_seq;
2945
2946 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2947 NLM_F_MULTI);
2948 if (nlh == NULL)
2949 goto nla_put_failure;
2950
2951 nfmsg = nlmsg_data(nlh);
6403d962 2952 nfmsg->nfgen_family = ctx.afi->family;
20a69341 2953 nfmsg->version = NFNETLINK_V0;
84d7fce6 2954 nfmsg->res_id = htons(ctx.net->nft.base_seq & 0xffff);
20a69341
PM		 2955
2956 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
2957 goto nla_put_failure;
2958 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
2959 goto nla_put_failure;
2960
2961 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
2962 if (nest == NULL)
2963 goto nla_put_failure;
2964
2965 args.cb = cb;
2966 args.skb = skb;
2967 args.iter.skip = cb->args[0];
2968 args.iter.count = 0;
2969 args.iter.err = 0;
2970 args.iter.fn = nf_tables_dump_setelem;
2971 set->ops->walk(&ctx, set, &args.iter);
2972
2973 nla_nest_end(skb, nest);
2974 nlmsg_end(skb, nlh);
2975
2976 if (args.iter.err && args.iter.err != -EMSGSIZE)
2977 return args.iter.err;
2978 if (args.iter.count == cb->args[0])
2979 return 0;
2980
2981 cb->args[0] = args.iter.count;
2982 return skb->len;
2983
2984nla_put_failure:
2985 return -ENOSPC;
2986}
2987
2988static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
2989 const struct nlmsghdr *nlh,
2990 const struct nlattr * const nla[])
2991{
2992 const struct nft_set *set;
2993 struct nft_ctx ctx;
2994 int err;
2995
55dd6f93 2996 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false);
20a69341
PM		 2997 if (err < 0)
2998 return err;
2999
3000 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
3001 if (IS_ERR(set))
3002 return PTR_ERR(set);
958bee14
PNA		 3003 if (set->flags & NFT_SET_INACTIVE)
3004 return -ENOENT;
20a69341
PM		 3005
3006 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3007 struct netlink_dump_control c = {
3008 .dump = nf_tables_dump_set,
3009 };
3010 return netlink_dump_start(nlsk, skb, nlh, &c);
3011 }
3012 return -EOPNOTSUPP;
3013}
3014
d60ce62f
AB		 3015static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3016 const struct nft_ctx *ctx, u32 seq,
3017 u32 portid, int event, u16 flags,
3018 const struct nft_set *set,
3019 const struct nft_set_elem *elem)
3020{
3021 struct nfgenmsg *nfmsg;
3022 struct nlmsghdr *nlh;
3023 struct nlattr *nest;
3024 int err;
3025
3026 event |= NFNL_SUBSYS_NFTABLES << 8;
3027 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3028 flags);
3029 if (nlh == NULL)
3030 goto nla_put_failure;
3031
3032 nfmsg = nlmsg_data(nlh);
3033 nfmsg->nfgen_family = ctx->afi->family;
3034 nfmsg->version = NFNETLINK_V0;
84d7fce6 3035 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 3036
3037 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3038 goto nla_put_failure;
3039 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3040 goto nla_put_failure;
3041
3042 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3043 if (nest == NULL)
3044 goto nla_put_failure;
3045
3046 err = nf_tables_fill_setelem(skb, set, elem);
3047 if (err < 0)
3048 goto nla_put_failure;
3049
3050 nla_nest_end(skb, nest);
3051
053c095a
JB		 3052 nlmsg_end(skb, nlh);
3053 return 0;
d60ce62f
AB		 3054
3055nla_put_failure:
3056 nlmsg_trim(skb, nlh);
3057 return -1;
3058}
3059
3060static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
3061 const struct nft_set *set,
3062 const struct nft_set_elem *elem,
3063 int event, u16 flags)
3064{
128ad332
PNA		 3065 struct net *net = ctx->net;
3066 u32 portid = ctx->portid;
d60ce62f
AB		 3067 struct sk_buff *skb;
3068 int err;
3069
128ad332 3070 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
d60ce62f
AB		 3071 return 0;
3072
3073 err = -ENOBUFS;
3074 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3075 if (skb == NULL)
3076 goto err;
3077
3078 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3079 set, elem);
3080 if (err < 0) {
3081 kfree_skb(skb);
3082 goto err;
3083 }
3084
128ad332 3085 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
d60ce62f
AB		 3086 GFP_KERNEL);
3087err:
3088 if (err < 0)
3089 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
3090 return err;
3091}
3092
60319eb1
PNA		 3093static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3094 int msg_type,
3095 struct nft_set *set)
3096{
3097 struct nft_trans *trans;
3098
3099 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3100 if (trans == NULL)
3101 return NULL;
3102
3103 nft_trans_elem_set(trans) = set;
3104 return trans;
3105}
3106
3107static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 3108 const struct nlattr *attr)
3109{
3110 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3111 struct nft_data_desc d1, d2;
3112 struct nft_set_elem elem;
3113 struct nft_set_binding *binding;
3114 enum nft_registers dreg;
60319eb1 3115 struct nft_trans *trans;
20a69341
PM		 3116 int err;
3117
c50b960c
PM		 3118 if (set->size && set->nelems == set->size)
3119 return -ENFILE;
3120
20a69341
PM		 3121 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3122 nft_set_elem_policy);
3123 if (err < 0)
3124 return err;
3125
3126 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3127 return -EINVAL;
3128
3129 elem.flags = 0;
3130 if (nla[NFTA_SET_ELEM_FLAGS] != NULL) {
3131 elem.flags = ntohl(nla_get_be32(nla[NFTA_SET_ELEM_FLAGS]));
3132 if (elem.flags & ~NFT_SET_ELEM_INTERVAL_END)
3133 return -EINVAL;
3134 }
3135
3136 if (set->flags & NFT_SET_MAP) {
3137 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
3138 !(elem.flags & NFT_SET_ELEM_INTERVAL_END))
3139 return -EINVAL;
bd7fc645
PNA		 3140 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
3141 elem.flags & NFT_SET_ELEM_INTERVAL_END)
3142 return -EINVAL;
20a69341
PM		 3143 } else {
3144 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3145 return -EINVAL;
3146 }
3147
3148 err = nft_data_init(ctx, &elem.key, &d1, nla[NFTA_SET_ELEM_KEY]);
3149 if (err < 0)
3150 goto err1;
3151 err = -EINVAL;
3152 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3153 goto err2;
3154
3155 err = -EEXIST;
3156 if (set->ops->get(set, &elem) == 0)
3157 goto err2;
3158
3159 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
3160 err = nft_data_init(ctx, &elem.data, &d2, nla[NFTA_SET_ELEM_DATA]);
3161 if (err < 0)
3162 goto err2;
3163
3164 err = -EINVAL;
3165 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3166 goto err3;
3167
3168 dreg = nft_type_to_reg(set->dtype);
3169 list_for_each_entry(binding, &set->bindings, list) {
3170 struct nft_ctx bind_ctx = {
3171 .afi = ctx->afi,
3172 .table = ctx->table,
7c95f6d8 3173 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 3174 };
3175
3176 err = nft_validate_data_load(&bind_ctx, dreg,
3177 &elem.data, d2.type);
3178 if (err < 0)
3179 goto err3;
3180 }
3181 }
3182
60319eb1
PNA		 3183 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
3184 if (trans == NULL)
3185 goto err3;
3186
20a69341
PM		 3187 err = set->ops->insert(set, &elem);
3188 if (err < 0)
60319eb1 3189 goto err4;
20a69341 3190
60319eb1 3191 nft_trans_elem(trans) = elem;
46bbafce 3192 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 3193 return 0;
3194
60319eb1
PNA		 3195err4:
3196 kfree(trans);
20a69341
PM		 3197err3:
3198 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3199 nft_data_uninit(&elem.data, d2.type);
3200err2:
3201 nft_data_uninit(&elem.key, d1.type);
3202err1:
3203 return err;
3204}
3205
3206static int nf_tables_newsetelem(struct sock *nlsk, struct sk_buff *skb,
3207 const struct nlmsghdr *nlh,
3208 const struct nlattr * const nla[])
3209{
958bee14 3210 struct net *net = sock_net(skb->sk);
20a69341
PM		 3211 const struct nlattr *attr;
3212 struct nft_set *set;
3213 struct nft_ctx ctx;
60319eb1 3214 int rem, err = 0;
20a69341 3215
7d5570ca
PNA		 3216 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
3217 return -EINVAL;
3218
55dd6f93 3219 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, true);
20a69341
PM		 3220 if (err < 0)
3221 return err;
3222
3223 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
958bee14
PNA		 3224 if (IS_ERR(set)) {
3225 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
3226 set = nf_tables_set_lookup_byid(net,
3227 nla[NFTA_SET_ELEM_LIST_SET_ID]);
3228 }
3229 if (IS_ERR(set))
3230 return PTR_ERR(set);
3231 }
3232
20a69341
PM		 3233 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3234 return -EBUSY;
3235
3236 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3237 err = nft_add_set_elem(&ctx, set, attr);
3238 if (err < 0)
60319eb1 3239 break;
4fefee57
PNA		 3240
3241 set->nelems++;
20a69341 3242 }
60319eb1 3243 return err;
20a69341
PM		 3244}
3245
60319eb1 3246static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 3247 const struct nlattr *attr)
3248{
3249 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3250 struct nft_data_desc desc;
3251 struct nft_set_elem elem;
60319eb1 3252 struct nft_trans *trans;
20a69341
PM		 3253 int err;
3254
3255 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3256 nft_set_elem_policy);
3257 if (err < 0)
3258 goto err1;
3259
3260 err = -EINVAL;
3261 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3262 goto err1;
3263
3264 err = nft_data_init(ctx, &elem.key, &desc, nla[NFTA_SET_ELEM_KEY]);
3265 if (err < 0)
3266 goto err1;
3267
3268 err = -EINVAL;
3269 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3270 goto err2;
3271
3272 err = set->ops->get(set, &elem);
3273 if (err < 0)
3274 goto err2;
3275
60319eb1 3276 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 3277 if (trans == NULL) {
3278 err = -ENOMEM;
60319eb1 3279 goto err2;
609ccf08 3280 }
20a69341 3281
60319eb1 3282 nft_trans_elem(trans) = elem;
46bbafce 3283 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 3284 return 0;
20a69341
PM		 3285err2:
3286 nft_data_uninit(&elem.key, desc.type);
3287err1:
3288 return err;
3289}
3290
3291static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb,
3292 const struct nlmsghdr *nlh,
3293 const struct nlattr * const nla[])
3294{
3295 const struct nlattr *attr;
3296 struct nft_set *set;
3297 struct nft_ctx ctx;
60319eb1 3298 int rem, err = 0;
20a69341 3299
7d5570ca
PNA		 3300 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
3301 return -EINVAL;
3302
55dd6f93 3303 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false);
20a69341
PM		 3304 if (err < 0)
3305 return err;
3306
3307 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
3308 if (IS_ERR(set))
3309 return PTR_ERR(set);
3310 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3311 return -EBUSY;
3312
3313 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3314 err = nft_del_setelem(&ctx, set, attr);
3315 if (err < 0)
60319eb1 3316 break;
4fefee57
PNA		 3317
3318 set->nelems--;
20a69341 3319 }
60319eb1 3320 return err;
20a69341
PM		 3321}
3322
84d7fce6
PNA		 3323static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
3324 u32 portid, u32 seq)
3325{
3326 struct nlmsghdr *nlh;
3327 struct nfgenmsg *nfmsg;
3328 int event = (NFNL_SUBSYS_NFTABLES << 8) | NFT_MSG_NEWGEN;
3329
3330 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
3331 if (nlh == NULL)
3332 goto nla_put_failure;
3333
3334 nfmsg = nlmsg_data(nlh);
3335 nfmsg->nfgen_family = AF_UNSPEC;
3336 nfmsg->version = NFNETLINK_V0;
3337 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
3338
3339 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)))
3340 goto nla_put_failure;
3341
053c095a
JB		 3342 nlmsg_end(skb, nlh);
3343 return 0;
84d7fce6
PNA		 3344
3345nla_put_failure:
3346 nlmsg_trim(skb, nlh);
3347 return -EMSGSIZE;
3348}
3349
3350static int nf_tables_gen_notify(struct net *net, struct sk_buff *skb, int event)
3351{
3352 struct nlmsghdr *nlh = nlmsg_hdr(skb);
3353 struct sk_buff *skb2;
3354 int err;
3355
3356 if (nlmsg_report(nlh) &&
3357 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
3358 return 0;
3359
3360 err = -ENOBUFS;
3361 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3362 if (skb2 == NULL)
3363 goto err;
3364
3365 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
3366 nlh->nlmsg_seq);
3367 if (err < 0) {
3368 kfree_skb(skb2);
3369 goto err;
3370 }
3371
3372 err = nfnetlink_send(skb2, net, NETLINK_CB(skb).portid,
3373 NFNLGRP_NFTABLES, nlmsg_report(nlh), GFP_KERNEL);
3374err:
3375 if (err < 0) {
3376 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
3377 err);
3378 }
3379 return err;
3380}
3381
3382static int nf_tables_getgen(struct sock *nlsk, struct sk_buff *skb,
3383 const struct nlmsghdr *nlh,
3384 const struct nlattr * const nla[])
3385{
3386 struct net *net = sock_net(skb->sk);
3387 struct sk_buff *skb2;
3388 int err;
3389
3390 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
3391 if (skb2 == NULL)
3392 return -ENOMEM;
3393
3394 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
3395 nlh->nlmsg_seq);
3396 if (err < 0)
3397 goto err;
3398
3399 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3400err:
3401 kfree_skb(skb2);
3402 return err;
3403}
3404
96518518
PM		 3405static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
3406 [NFT_MSG_NEWTABLE] = {
55dd6f93 3407 .call_batch = nf_tables_newtable,
96518518
PM		 3408 .attr_count = NFTA_TABLE_MAX,
3409 .policy = nft_table_policy,
3410 },
3411 [NFT_MSG_GETTABLE] = {
3412 .call = nf_tables_gettable,
3413 .attr_count = NFTA_TABLE_MAX,
3414 .policy = nft_table_policy,
3415 },
3416 [NFT_MSG_DELTABLE] = {
55dd6f93 3417 .call_batch = nf_tables_deltable,
96518518
PM		 3418 .attr_count = NFTA_TABLE_MAX,
3419 .policy = nft_table_policy,
3420 },
3421 [NFT_MSG_NEWCHAIN] = {
91c7b38d 3422 .call_batch = nf_tables_newchain,
96518518
PM		 3423 .attr_count = NFTA_CHAIN_MAX,
3424 .policy = nft_chain_policy,
3425 },
3426 [NFT_MSG_GETCHAIN] = {
3427 .call = nf_tables_getchain,
3428 .attr_count = NFTA_CHAIN_MAX,
3429 .policy = nft_chain_policy,
3430 },
3431 [NFT_MSG_DELCHAIN] = {
91c7b38d 3432 .call_batch = nf_tables_delchain,
96518518
PM		 3433 .attr_count = NFTA_CHAIN_MAX,
3434 .policy = nft_chain_policy,
3435 },
3436 [NFT_MSG_NEWRULE] = {
0628b123 3437 .call_batch = nf_tables_newrule,
96518518
PM		 3438 .attr_count = NFTA_RULE_MAX,
3439 .policy = nft_rule_policy,
3440 },
3441 [NFT_MSG_GETRULE] = {
3442 .call = nf_tables_getrule,
3443 .attr_count = NFTA_RULE_MAX,
3444 .policy = nft_rule_policy,
3445 },
3446 [NFT_MSG_DELRULE] = {
0628b123 3447 .call_batch = nf_tables_delrule,
96518518
PM		 3448 .attr_count = NFTA_RULE_MAX,
3449 .policy = nft_rule_policy,
3450 },
20a69341 3451 [NFT_MSG_NEWSET] = {
958bee14 3452 .call_batch = nf_tables_newset,
20a69341
PM		 3453 .attr_count = NFTA_SET_MAX,
3454 .policy = nft_set_policy,
3455 },
3456 [NFT_MSG_GETSET] = {
3457 .call = nf_tables_getset,
3458 .attr_count = NFTA_SET_MAX,
3459 .policy = nft_set_policy,
3460 },
3461 [NFT_MSG_DELSET] = {
958bee14 3462 .call_batch = nf_tables_delset,
20a69341
PM		 3463 .attr_count = NFTA_SET_MAX,
3464 .policy = nft_set_policy,
3465 },
3466 [NFT_MSG_NEWSETELEM] = {
958bee14 3467 .call_batch = nf_tables_newsetelem,
20a69341
PM		 3468 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3469 .policy = nft_set_elem_list_policy,
3470 },
3471 [NFT_MSG_GETSETELEM] = {
3472 .call = nf_tables_getsetelem,
3473 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3474 .policy = nft_set_elem_list_policy,
3475 },
3476 [NFT_MSG_DELSETELEM] = {
958bee14 3477 .call_batch = nf_tables_delsetelem,
20a69341
PM		 3478 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3479 .policy = nft_set_elem_list_policy,
3480 },
84d7fce6
PNA		 3481 [NFT_MSG_GETGEN] = {
3482 .call = nf_tables_getgen,
3483 },
96518518
PM		 3484};
3485
91c7b38d
PNA		 3486static void nft_chain_commit_update(struct nft_trans *trans)
3487{
3488 struct nft_base_chain *basechain;
3489
3490 if (nft_trans_chain_name(trans)[0])
3491 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
3492
3493 if (!(trans->ctx.chain->flags & NFT_BASE_CHAIN))
3494 return;
3495
3496 basechain = nft_base_chain(trans->ctx.chain);
3497 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
3498
3499 switch (nft_trans_chain_policy(trans)) {
3500 case NF_DROP:
3501 case NF_ACCEPT:
3502 basechain->policy = nft_trans_chain_policy(trans);
3503 break;
3504 }
3505}
3506
b326dd37 3507static void nf_tables_commit_release(struct nft_trans *trans)
c7c32e72 3508{
c7c32e72
PNA		 3509 switch (trans->msg_type) {
3510 case NFT_MSG_DELTABLE:
3511 nf_tables_table_destroy(&trans->ctx);
3512 break;
3513 case NFT_MSG_DELCHAIN:
3514 nf_tables_chain_destroy(trans->ctx.chain);
3515 break;
3516 case NFT_MSG_DELRULE:
3517 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
3518 break;
3519 case NFT_MSG_DELSET:
3520 nft_set_destroy(nft_trans_set(trans));
3521 break;
3522 }
3523 kfree(trans);
3524}
3525
37082f93
PNA		 3526static int nf_tables_commit(struct sk_buff *skb)
3527{
3528 struct net *net = sock_net(skb->sk);
3529 struct nft_trans *trans, *next;
a3716e70 3530 struct nft_trans_elem *te;
37082f93
PNA		 3531
3532 /* Bump generation counter, invalidate any dump in progress */
38e029f1 3533 while (++net->nft.base_seq == 0);
37082f93
PNA		 3534
3535 /* A new generation has just started */
3536 net->nft.gencursor = gencursor_next(net);
3537
3538 /* Make sure all packets have left the previous generation before
3539 * purging old rules.
3540 */
3541 synchronize_rcu();
3542
3543 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 3544 switch (trans->msg_type) {
55dd6f93
PNA		 3545 case NFT_MSG_NEWTABLE:
3546 if (nft_trans_table_update(trans)) {
3547 if (!nft_trans_table_enable(trans)) {
3548 nf_tables_table_disable(trans->ctx.afi,
3549 trans->ctx.table);
3550 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
3551 }
3552 } else {
3553 trans->ctx.table->flags &= ~NFT_TABLE_INACTIVE;
3554 }
35151d84 3555 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 3556 nft_trans_destroy(trans);
3557 break;
3558 case NFT_MSG_DELTABLE:
35151d84 3559 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 3560 break;
91c7b38d
PNA		 3561 case NFT_MSG_NEWCHAIN:
3562 if (nft_trans_chain_update(trans))
3563 nft_chain_commit_update(trans);
4fefee57 3564 else
91c7b38d 3565 trans->ctx.chain->flags &= ~NFT_CHAIN_INACTIVE;
4fefee57 3566
35151d84 3567 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
91c7b38d
PNA		 3568 nft_trans_destroy(trans);
3569 break;
3570 case NFT_MSG_DELCHAIN:
35151d84 3571 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c5598794
AB		 3572 nf_tables_unregister_hooks(trans->ctx.table,
3573 trans->ctx.chain,
3574 trans->ctx.afi->nops);
91c7b38d 3575 break;
b380e5c7
PNA		 3576 case NFT_MSG_NEWRULE:
3577 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 3578 nf_tables_rule_notify(&trans->ctx,
37082f93 3579 nft_trans_rule(trans),
35151d84 3580 NFT_MSG_NEWRULE);
37082f93 3581 nft_trans_destroy(trans);
b380e5c7
PNA		 3582 break;
3583 case NFT_MSG_DELRULE:
3584 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 3585 nf_tables_rule_notify(&trans->ctx,
3586 nft_trans_rule(trans),
3587 NFT_MSG_DELRULE);
b380e5c7 3588 break;
958bee14
PNA		 3589 case NFT_MSG_NEWSET:
3590 nft_trans_set(trans)->flags &= ~NFT_SET_INACTIVE;
4fefee57
PNA		 3591 /* This avoids hitting -EBUSY when deleting the table
3592 * from the transaction.
3593 */
3594 if (nft_trans_set(trans)->flags & NFT_SET_ANONYMOUS &&
3595 !list_empty(&nft_trans_set(trans)->bindings))
3596 trans->ctx.table->use--;
3597
958bee14 3598 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 3599 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 3600 nft_trans_destroy(trans);
3601 break;
3602 case NFT_MSG_DELSET:
3603 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 3604 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 3605 break;
60319eb1 3606 case NFT_MSG_NEWSETELEM:
60319eb1
PNA		 3607 nf_tables_setelem_notify(&trans->ctx,
3608 nft_trans_elem_set(trans),
3609 &nft_trans_elem(trans),
3610 NFT_MSG_NEWSETELEM, 0);
3611 nft_trans_destroy(trans);
3612 break;
3613 case NFT_MSG_DELSETELEM:
a3716e70
PNA		 3614 te = (struct nft_trans_elem *)trans->data;
3615 nf_tables_setelem_notify(&trans->ctx, te->set,
3616 &te->elem,
60319eb1 3617 NFT_MSG_DELSETELEM, 0);
a3716e70 3618 te->set->ops->get(te->set, &te->elem);
a3716e70 3619 nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
02263db0
PNA		 3620 if (te->set->flags & NFT_SET_MAP &&
3621 !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
3622 nft_data_uninit(&te->elem.data, te->set->dtype);
3623 te->set->ops->remove(te->set, &te->elem);
60319eb1
PNA		 3624 nft_trans_destroy(trans);
3625 break;
37082f93 3626 }
37082f93
PNA		 3627 }
3628
b326dd37
PNA		 3629 synchronize_rcu();
3630
37082f93 3631 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
c7c32e72 3632 list_del(&trans->list);
b326dd37 3633 nf_tables_commit_release(trans);
37082f93 3634 }
84d7fce6
PNA		 3635
3636 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
37082f93
PNA		 3637
3638 return 0;
3639}
3640
b326dd37 3641static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 3642{
c7c32e72
PNA		 3643 switch (trans->msg_type) {
3644 case NFT_MSG_NEWTABLE:
3645 nf_tables_table_destroy(&trans->ctx);
3646 break;
3647 case NFT_MSG_NEWCHAIN:
3648 nf_tables_chain_destroy(trans->ctx.chain);
3649 break;
3650 case NFT_MSG_NEWRULE:
3651 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
3652 break;
3653 case NFT_MSG_NEWSET:
3654 nft_set_destroy(nft_trans_set(trans));
3655 break;
3656 }
3657 kfree(trans);
3658}
3659
37082f93
PNA		 3660static int nf_tables_abort(struct sk_buff *skb)
3661{
3662 struct net *net = sock_net(skb->sk);
3663 struct nft_trans *trans, *next;
02263db0 3664 struct nft_trans_elem *te;
37082f93
PNA		 3665
3666 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 3667 switch (trans->msg_type) {
55dd6f93
PNA		 3668 case NFT_MSG_NEWTABLE:
3669 if (nft_trans_table_update(trans)) {
3670 if (nft_trans_table_enable(trans)) {
3671 nf_tables_table_disable(trans->ctx.afi,
3672 trans->ctx.table);
3673 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
3674 }
3675 nft_trans_destroy(trans);
3676 } else {
e688a7f8 3677 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 3678 }
3679 break;
3680 case NFT_MSG_DELTABLE:
e688a7f8
PNA		 3681 list_add_tail_rcu(&trans->ctx.table->list,
3682 &trans->ctx.afi->tables);
55dd6f93
PNA		 3683 nft_trans_destroy(trans);
3684 break;
91c7b38d
PNA		 3685 case NFT_MSG_NEWCHAIN:
3686 if (nft_trans_chain_update(trans)) {
982f4051 3687 free_percpu(nft_trans_chain_stats(trans));
91c7b38d
PNA		 3688
3689 nft_trans_destroy(trans);
3690 } else {
4fefee57 3691 trans->ctx.table->use--;
e688a7f8 3692 list_del_rcu(&trans->ctx.chain->list);
c5598794
AB		 3693 nf_tables_unregister_hooks(trans->ctx.table,
3694 trans->ctx.chain,
3695 trans->ctx.afi->nops);
91c7b38d
PNA		 3696 }
3697 break;
3698 case NFT_MSG_DELCHAIN:
4fefee57 3699 trans->ctx.table->use++;
e688a7f8
PNA		 3700 list_add_tail_rcu(&trans->ctx.chain->list,
3701 &trans->ctx.table->chains);
91c7b38d
PNA		 3702 nft_trans_destroy(trans);
3703 break;
b380e5c7 3704 case NFT_MSG_NEWRULE:
4fefee57 3705 trans->ctx.chain->use--;
b380e5c7
PNA		 3706 list_del_rcu(&nft_trans_rule(trans)->list);
3707 break;
3708 case NFT_MSG_DELRULE:
4fefee57 3709 trans->ctx.chain->use++;
b380e5c7 3710 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 3711 nft_trans_destroy(trans);
b380e5c7 3712 break;
958bee14 3713 case NFT_MSG_NEWSET:
4fefee57 3714 trans->ctx.table->use--;
e688a7f8 3715 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 3716 break;
3717 case NFT_MSG_DELSET:
4fefee57 3718 trans->ctx.table->use++;
e688a7f8
PNA		 3719 list_add_tail_rcu(&nft_trans_set(trans)->list,
3720 &trans->ctx.table->sets);
958bee14
PNA		 3721 nft_trans_destroy(trans);
3722 break;
60319eb1 3723 case NFT_MSG_NEWSETELEM:
4fefee57 3724 nft_trans_elem_set(trans)->nelems--;
02263db0
PNA		 3725 te = (struct nft_trans_elem *)trans->data;
3726 te->set->ops->get(te->set, &te->elem);
3727 nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
3728 if (te->set->flags & NFT_SET_MAP &&
3729 !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
3730 nft_data_uninit(&te->elem.data, te->set->dtype);
3731 te->set->ops->remove(te->set, &te->elem);
60319eb1
PNA		 3732 nft_trans_destroy(trans);
3733 break;
3734 case NFT_MSG_DELSETELEM:
4fefee57 3735 nft_trans_elem_set(trans)->nelems++;
60319eb1
PNA		 3736 nft_trans_destroy(trans);
3737 break;
37082f93 3738 }
37082f93
PNA		 3739 }
3740
b326dd37
PNA		 3741 synchronize_rcu();
3742
a1cee076
PNA		 3743 list_for_each_entry_safe_reverse(trans, next,
3744 &net->nft.commit_list, list) {
c7c32e72 3745 list_del(&trans->list);
b326dd37 3746 nf_tables_abort_release(trans);
37082f93
PNA		 3747 }
3748
3749 return 0;
3750}
3751
96518518
PM		 3752static const struct nfnetlink_subsystem nf_tables_subsys = {
3753 .name = "nf_tables",
3754 .subsys_id = NFNL_SUBSYS_NFTABLES,
3755 .cb_count = NFT_MSG_MAX,
3756 .cb = nf_tables_cb,
0628b123
PNA		 3757 .commit = nf_tables_commit,
3758 .abort = nf_tables_abort,
96518518
PM		 3759};
3760
7210e4e3
PNA		 3761int nft_chain_validate_dependency(const struct nft_chain *chain,
3762 enum nft_chain_type type)
3763{
3764 const struct nft_base_chain *basechain;
3765
3766 if (chain->flags & NFT_BASE_CHAIN) {
3767 basechain = nft_base_chain(chain);
3768 if (basechain->type->type != type)
3769 return -EOPNOTSUPP;
3770 }
3771 return 0;
3772}
3773EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
3774
75e8d06d
PNA		 3775int nft_chain_validate_hooks(const struct nft_chain *chain,
3776 unsigned int hook_flags)
3777{
3778 struct nft_base_chain *basechain;
3779
3780 if (chain->flags & NFT_BASE_CHAIN) {
3781 basechain = nft_base_chain(chain);
3782
3783 if ((1 << basechain->ops[0].hooknum) & hook_flags)
3784 return 0;
3785
3786 return -EOPNOTSUPP;
3787 }
3788
3789 return 0;
3790}
3791EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
3792
20a69341
PM		 3793/*
3794 * Loop detection - walk through the ruleset beginning at the destination chain
3795 * of a new jump until either the source chain is reached (loop) or all
3796 * reachable chains have been traversed.
3797 *
3798 * The loop check is performed whenever a new jump verdict is added to an
3799 * expression or verdict map or a verdict map is bound to a new chain.
3800 */
3801
3802static int nf_tables_check_loops(const struct nft_ctx *ctx,
3803 const struct nft_chain *chain);
3804
3805static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
3806 const struct nft_set *set,
3807 const struct nft_set_iter *iter,
3808 const struct nft_set_elem *elem)
3809{
62f9c8b4
PNA		 3810 if (elem->flags & NFT_SET_ELEM_INTERVAL_END)
3811 return 0;
3812
20a69341
PM		 3813 switch (elem->data.verdict) {
3814 case NFT_JUMP:
3815 case NFT_GOTO:
3816 return nf_tables_check_loops(ctx, elem->data.chain);
3817 default:
3818 return 0;
3819 }
3820}
3821
3822static int nf_tables_check_loops(const struct nft_ctx *ctx,
3823 const struct nft_chain *chain)
3824{
3825 const struct nft_rule *rule;
3826 const struct nft_expr *expr, *last;
20a69341
PM		 3827 const struct nft_set *set;
3828 struct nft_set_binding *binding;
3829 struct nft_set_iter iter;
20a69341
PM		 3830
3831 if (ctx->chain == chain)
3832 return -ELOOP;
3833
3834 list_for_each_entry(rule, &chain->rules, list) {
3835 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 3836 const struct nft_data *data = NULL;
3837 int err;
3838
3839 if (!expr->ops->validate)
20a69341
PM		 3840 continue;
3841
0ca743a5
PNA		 3842 err = expr->ops->validate(ctx, expr, &data);
3843 if (err < 0)
3844 return err;
3845
20a69341 3846 if (data == NULL)
0ca743a5 3847 continue;
20a69341
PM		 3848
3849 switch (data->verdict) {
3850 case NFT_JUMP:
3851 case NFT_GOTO:
3852 err = nf_tables_check_loops(ctx, data->chain);
3853 if (err < 0)
3854 return err;
3855 default:
3856 break;
3857 }
3858 }
3859 }
3860
3861 list_for_each_entry(set, &ctx->table->sets, list) {
3862 if (!(set->flags & NFT_SET_MAP) ||
3863 set->dtype != NFT_DATA_VERDICT)
3864 continue;
3865
3866 list_for_each_entry(binding, &set->bindings, list) {
3867 if (binding->chain != chain)
3868 continue;
3869
3870 iter.skip = 0;
3871 iter.count = 0;
3872 iter.err = 0;
3873 iter.fn = nf_tables_loop_check_setelem;
3874
3875 set->ops->walk(ctx, set, &iter);
3876 if (iter.err < 0)
3877 return iter.err;
3878 }
3879 }
3880
3881 return 0;
3882}
3883
96518518
PM		 3884/**
3885 * nft_validate_input_register - validate an expressions' input register
3886 *
3887 * @reg: the register number
3888 *
3889 * Validate that the input register is one of the general purpose
3890 * registers.
3891 */
3892int nft_validate_input_register(enum nft_registers reg)
3893{
3894 if (reg <= NFT_REG_VERDICT)
3895 return -EINVAL;
3896 if (reg > NFT_REG_MAX)
3897 return -ERANGE;
3898 return 0;
3899}
3900EXPORT_SYMBOL_GPL(nft_validate_input_register);
3901
3902/**
3903 * nft_validate_output_register - validate an expressions' output register
3904 *
3905 * @reg: the register number
3906 *
3907 * Validate that the output register is one of the general purpose
3908 * registers or the verdict register.
3909 */
3910int nft_validate_output_register(enum nft_registers reg)
3911{
3912 if (reg < NFT_REG_VERDICT)
3913 return -EINVAL;
3914 if (reg > NFT_REG_MAX)
3915 return -ERANGE;
3916 return 0;
3917}
3918EXPORT_SYMBOL_GPL(nft_validate_output_register);
3919
3920/**
3921 * nft_validate_data_load - validate an expressions' data load
3922 *
3923 * @ctx: context of the expression performing the load
3924 * @reg: the destination register number
3925 * @data: the data to load
3926 * @type: the data type
3927 *
3928 * Validate that a data load uses the appropriate data type for
3929 * the destination register. A value of NULL for the data means
3930 * that its runtime gathered data, which is always of type
3931 * NFT_DATA_VALUE.
3932 */
3933int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
3934 const struct nft_data *data,
3935 enum nft_data_types type)
3936{
20a69341
PM		 3937 int err;
3938
96518518
PM		 3939 switch (reg) {
3940 case NFT_REG_VERDICT:
3941 if (data == NULL || type != NFT_DATA_VERDICT)
3942 return -EINVAL;
20a69341
PM		 3943
3944 if (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP) {
3945 err = nf_tables_check_loops(ctx, data->chain);
3946 if (err < 0)
3947 return err;
3948
3949 if (ctx->chain->level + 1 > data->chain->level) {
3950 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
3951 return -EMLINK;
3952 data->chain->level = ctx->chain->level + 1;
3953 }
3954 }
3955
96518518
PM		 3956 return 0;
3957 default:
3958 if (data != NULL && type != NFT_DATA_VALUE)
3959 return -EINVAL;
3960 return 0;
3961 }
3962}
3963EXPORT_SYMBOL_GPL(nft_validate_data_load);
3964
3965static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
3966 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
3967 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
3968 .len = NFT_CHAIN_MAXNAMELEN - 1 },
3969};
3970
3971static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
3972 struct nft_data_desc *desc, const struct nlattr *nla)
3973{
3974 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
3975 struct nft_chain *chain;
3976 int err;
3977
3978 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy);
3979 if (err < 0)
3980 return err;
3981
3982 if (!tb[NFTA_VERDICT_CODE])
3983 return -EINVAL;
3984 data->verdict = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
3985
3986 switch (data->verdict) {
e0abdadc
PM		 3987 default:
3988 switch (data->verdict & NF_VERDICT_MASK) {
3989 case NF_ACCEPT:
3990 case NF_DROP:
3991 case NF_QUEUE:
3992 break;
3993 default:
3994 return -EINVAL;
3995 }
3996 /* fall through */
96518518
PM		 3997 case NFT_CONTINUE:
3998 case NFT_BREAK:
3999 case NFT_RETURN:
4000 desc->len = sizeof(data->verdict);
4001 break;
4002 case NFT_JUMP:
4003 case NFT_GOTO:
4004 if (!tb[NFTA_VERDICT_CHAIN])
4005 return -EINVAL;
4006 chain = nf_tables_chain_lookup(ctx->table,
4007 tb[NFTA_VERDICT_CHAIN]);
4008 if (IS_ERR(chain))
4009 return PTR_ERR(chain);
4010 if (chain->flags & NFT_BASE_CHAIN)
4011 return -EOPNOTSUPP;
4012
96518518
PM		 4013 chain->use++;
4014 data->chain = chain;
4015 desc->len = sizeof(data);
4016 break;
96518518
PM		 4017 }
4018
4019 desc->type = NFT_DATA_VERDICT;
4020 return 0;
4021}
4022
4023static void nft_verdict_uninit(const struct nft_data *data)
4024{
4025 switch (data->verdict) {
4026 case NFT_JUMP:
4027 case NFT_GOTO:
4028 data->chain->use--;
4029 break;
4030 }
4031}
4032
4033static int nft_verdict_dump(struct sk_buff *skb, const struct nft_data *data)
4034{
4035 struct nlattr *nest;
4036
4037 nest = nla_nest_start(skb, NFTA_DATA_VERDICT);
4038 if (!nest)
4039 goto nla_put_failure;
4040
4041 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict)))
4042 goto nla_put_failure;
4043
4044 switch (data->verdict) {
4045 case NFT_JUMP:
4046 case NFT_GOTO:
4047 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, data->chain->name))
4048 goto nla_put_failure;
4049 }
4050 nla_nest_end(skb, nest);
4051 return 0;
4052
4053nla_put_failure:
4054 return -1;
4055}
4056
4057static int nft_value_init(const struct nft_ctx *ctx, struct nft_data *data,
4058 struct nft_data_desc *desc, const struct nlattr *nla)
4059{
4060 unsigned int len;
4061
4062 len = nla_len(nla);
4063 if (len == 0)
4064 return -EINVAL;
4065 if (len > sizeof(data->data))
4066 return -EOVERFLOW;
4067
4068 nla_memcpy(data->data, nla, sizeof(data->data));
4069 desc->type = NFT_DATA_VALUE;
4070 desc->len = len;
4071 return 0;
4072}
4073
4074static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
4075 unsigned int len)
4076{
4077 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
4078}
4079
4080static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
4081 [NFTA_DATA_VALUE] = { .type = NLA_BINARY,
4082 .len = FIELD_SIZEOF(struct nft_data, data) },
4083 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
4084};
4085
4086/**
4087 * nft_data_init - parse nf_tables data netlink attributes
4088 *
4089 * @ctx: context of the expression using the data
4090 * @data: destination struct nft_data
4091 * @desc: data description
4092 * @nla: netlink attribute containing data
4093 *
4094 * Parse the netlink data attributes and initialize a struct nft_data.
4095 * The type and length of data are returned in the data description.
4096 *
4097 * The caller can indicate that it only wants to accept data of type
4098 * NFT_DATA_VALUE by passing NULL for the ctx argument.
4099 */
4100int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
4101 struct nft_data_desc *desc, const struct nlattr *nla)
4102{
4103 struct nlattr *tb[NFTA_DATA_MAX + 1];
4104 int err;
4105
4106 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy);
4107 if (err < 0)
4108 return err;
4109
4110 if (tb[NFTA_DATA_VALUE])
4111 return nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]);
4112 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
4113 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
4114 return -EINVAL;
4115}
4116EXPORT_SYMBOL_GPL(nft_data_init);
4117
4118/**
4119 * nft_data_uninit - release a nft_data item
4120 *
4121 * @data: struct nft_data to release
4122 * @type: type of data
4123 *
4124 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4125 * all others need to be released by calling this function.
4126 */
4127void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
4128{
4129 switch (type) {
4130 case NFT_DATA_VALUE:
4131 return;
4132 case NFT_DATA_VERDICT:
4133 return nft_verdict_uninit(data);
4134 default:
4135 WARN_ON(1);
4136 }
4137}
4138EXPORT_SYMBOL_GPL(nft_data_uninit);
4139
4140int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
4141 enum nft_data_types type, unsigned int len)
4142{
4143 struct nlattr *nest;
4144 int err;
4145
4146 nest = nla_nest_start(skb, attr);
4147 if (nest == NULL)
4148 return -1;
4149
4150 switch (type) {
4151 case NFT_DATA_VALUE:
4152 err = nft_value_dump(skb, data, len);
4153 break;
4154 case NFT_DATA_VERDICT:
4155 err = nft_verdict_dump(skb, data);
4156 break;
4157 default:
4158 err = -EINVAL;
4159 WARN_ON(1);
4160 }
4161
4162 nla_nest_end(skb, nest);
4163 return err;
4164}
4165EXPORT_SYMBOL_GPL(nft_data_dump);
4166
99633ab2
PNA		 4167static int nf_tables_init_net(struct net *net)
4168{
4169 INIT_LIST_HEAD(&net->nft.af_info);
0628b123 4170 INIT_LIST_HEAD(&net->nft.commit_list);
38e029f1 4171 net->nft.base_seq = 1;
99633ab2
PNA		 4172 return 0;
4173}
4174
4175static struct pernet_operations nf_tables_net_ops = {
4176 .init = nf_tables_init_net,
4177};
4178
96518518
PM		 4179static int __init nf_tables_module_init(void)
4180{
4181 int err;
4182
4183 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
4184 GFP_KERNEL);
4185 if (info == NULL) {
4186 err = -ENOMEM;
4187 goto err1;
4188 }
4189
4190 err = nf_tables_core_module_init();
4191 if (err < 0)
4192 goto err2;
4193
4194 err = nfnetlink_subsys_register(&nf_tables_subsys);
4195 if (err < 0)
4196 goto err3;
4197
4198 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
99633ab2 4199 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 4200err3:
4201 nf_tables_core_module_exit();
4202err2:
4203 kfree(info);
4204err1:
4205 return err;
4206}
4207
4208static void __exit nf_tables_module_exit(void)
4209{
99633ab2 4210 unregister_pernet_subsys(&nf_tables_net_ops);
96518518 4211 nfnetlink_subsys_unregister(&nf_tables_subsys);
1b1bc49c 4212 rcu_barrier();
96518518
PM		 4213 nf_tables_core_module_exit();
4214 kfree(info);
4215}
4216
4217module_init(nf_tables_module_init);
4218module_exit(nf_tables_module_exit);
4219
4220MODULE_LICENSE("GPL");
4221MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
4222MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror