]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
lan743x: Remove phy_read from link status change function
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
0eb71a9d 17#include <linux/rhashtable.h>
96518518
PM		 18#include <linux/netfilter.h>
19#include <linux/netfilter/nfnetlink.h>
20#include <linux/netfilter/nf_tables.h>
3b49e2e9 21#include <net/netfilter/nf_flow_table.h>
96518518
PM		 22#include <net/netfilter/nf_tables_core.h>
23#include <net/netfilter/nf_tables.h>
99633ab2 24#include <net/net_namespace.h>
96518518
PM		 25#include <net/sock.h>
26
96518518 27static LIST_HEAD(nf_tables_expressions);
e5009240 28static LIST_HEAD(nf_tables_objects);
3b49e2e9 29static LIST_HEAD(nf_tables_flowtables);
0935d558
FW		 30static LIST_HEAD(nf_tables_destroy_list);
31static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
3ecbfd65 32static u64 table_handle;
96518518 33
a654de8f
PNA		 34enum {
35 NFT_VALIDATE_SKIP = 0,
36 NFT_VALIDATE_NEED,
37 NFT_VALIDATE_DO,
38};
39
1b2470e5
FW		 40static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
41static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
42static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
43
44static const struct rhashtable_params nft_chain_ht_params = {
45 .head_offset = offsetof(struct nft_chain, rhlhead),
46 .key_offset = offsetof(struct nft_chain, name),
47 .hashfn = nft_chain_hash,
48 .obj_hashfn = nft_chain_hash_obj,
49 .obj_cmpfn = nft_chain_hash_cmp,
50 .locks_mul = 1,
51 .automatic_shrinking = true,
52};
53
a654de8f
PNA		 54static void nft_validate_state_update(struct net *net, u8 new_validate_state)
55{
56 switch (net->nft.validate_state) {
57 case NFT_VALIDATE_SKIP:
58 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
59 break;
60 case NFT_VALIDATE_NEED:
61 break;
62 case NFT_VALIDATE_DO:
63 if (new_validate_state == NFT_VALIDATE_NEED)
64 return;
65 }
66
67 net->nft.validate_state = new_validate_state;
68}
0935d558
FW		 69static void nf_tables_trans_destroy_work(struct work_struct *w);
70static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
a654de8f 71
7c95f6d8 72static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 73 struct net *net,
7c95f6d8
PNA		 74 const struct sk_buff *skb,
75 const struct nlmsghdr *nlh,
36596dad 76 u8 family,
7c95f6d8
PNA		 77 struct nft_table *table,
78 struct nft_chain *chain,
79 const struct nlattr * const *nla)
80{
633c9a84 81 ctx->net = net;
36596dad 82 ctx->family = family;
26b2f552 83 ctx->level = 0;
128ad332
PNA		 84 ctx->table = table;
85 ctx->chain = chain;
86 ctx->nla = nla;
87 ctx->portid = NETLINK_CB(skb).portid;
88 ctx->report = nlmsg_report(nlh);
89 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 90}
91
8411b644
PNA		 92static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
93 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 94{
95 struct nft_trans *trans;
96
8411b644 97 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 98 if (trans == NULL)
99 return NULL;
100
b380e5c7 101 trans->msg_type = msg_type;
1081d11b
PNA		 102 trans->ctx = *ctx;
103
104 return trans;
105}
106
8411b644
PNA		 107static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
108 int msg_type, u32 size)
109{
110 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
111}
112
1081d11b
PNA		 113static void nft_trans_destroy(struct nft_trans *trans)
114{
115 list_del(&trans->list);
116 kfree(trans);
117}
118
c974a3a3
PNA		 119static int nf_tables_register_hook(struct net *net,
120 const struct nft_table *table,
121 struct nft_chain *chain)
d8ee8f7c 122{
4e25ceb8 123 const struct nft_base_chain *basechain;
a37061a6 124 const struct nf_hook_ops *ops;
ae6153b5 125
d8ee8f7c 126 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 127 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 128 return 0;
129
4e25ceb8
FW		 130 basechain = nft_base_chain(chain);
131 ops = &basechain->ops;
ae6153b5 132
4e25ceb8
FW		 133 if (basechain->type->ops_register)
134 return basechain->type->ops_register(net, ops);
135
a37061a6 136 return nf_register_net_hook(net, ops);
d8ee8f7c
PNA		 137}
138
c974a3a3
PNA		 139static void nf_tables_unregister_hook(struct net *net,
140 const struct nft_table *table,
141 struct nft_chain *chain)
c5598794 142{
4e25ceb8
FW		 143 const struct nft_base_chain *basechain;
144 const struct nf_hook_ops *ops;
145
d8ee8f7c 146 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 147 !nft_is_base_chain(chain))
d8ee8f7c 148 return;
4e25ceb8
FW		 149 basechain = nft_base_chain(chain);
150 ops = &basechain->ops;
d8ee8f7c 151
4e25ceb8
FW		 152 if (basechain->type->ops_unregister)
153 return basechain->type->ops_unregister(net, ops);
154
155 nf_unregister_net_hook(net, ops);
c5598794
AB		 156}
157
ee01d542
AB		 158static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
159{
160 struct nft_trans *trans;
161
162 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
163 if (trans == NULL)
164 return -ENOMEM;
165
166 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 167 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 168
169 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
170 return 0;
171}
172
173static int nft_deltable(struct nft_ctx *ctx)
174{
175 int err;
176
177 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
178 if (err < 0)
179 return err;
180
f2a6d766 181 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 182 return err;
183}
184
185static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
186{
187 struct nft_trans *trans;
188
189 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
190 if (trans == NULL)
191 return -ENOMEM;
192
193 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 194 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 195
196 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
197 return 0;
198}
199
200static int nft_delchain(struct nft_ctx *ctx)
201{
202 int err;
203
204 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
205 if (err < 0)
206 return err;
207
208 ctx->table->use--;
664b0f8c 209 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 210
211 return err;
212}
213
0ef235c7
FW		 214/* either expr ops provide both activate/deactivate, or neither */
215static bool nft_expr_check_ops(const struct nft_expr_ops *ops)
216{
217 if (!ops)
218 return true;
219
220 if (WARN_ON_ONCE((!ops->activate ^ !ops->deactivate)))
221 return false;
222
223 return true;
224}
225
bb7b40ae
PNA		 226static void nft_rule_expr_activate(const struct nft_ctx *ctx,
227 struct nft_rule *rule)
228{
229 struct nft_expr *expr;
230
231 expr = nft_expr_first(rule);
232 while (expr != nft_expr_last(rule) && expr->ops) {
233 if (expr->ops->activate)
234 expr->ops->activate(ctx, expr);
235
236 expr = nft_expr_next(expr);
237 }
238}
239
240static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
241 struct nft_rule *rule)
242{
243 struct nft_expr *expr;
244
245 expr = nft_expr_first(rule);
246 while (expr != nft_expr_last(rule) && expr->ops) {
247 if (expr->ops->deactivate)
248 expr->ops->deactivate(ctx, expr);
249
250 expr = nft_expr_next(expr);
251 }
252}
253
ee01d542
AB		 254static int
255nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
256{
257 /* You cannot delete the same rule twice */
889f7ee7
PNA		 258 if (nft_is_active_next(ctx->net, rule)) {
259 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 260 ctx->chain->use--;
261 return 0;
262 }
263 return -ENOENT;
264}
265
266static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
267 struct nft_rule *rule)
268{
269 struct nft_trans *trans;
270
271 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
272 if (trans == NULL)
273 return NULL;
274
1a94e38d
PNA		 275 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
276 nft_trans_rule_id(trans) =
277 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
278 }
ee01d542
AB		 279 nft_trans_rule(trans) = rule;
280 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
281
282 return trans;
283}
284
285static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
286{
287 struct nft_trans *trans;
288 int err;
289
290 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
291 if (trans == NULL)
292 return -ENOMEM;
293
294 err = nf_tables_delrule_deactivate(ctx, rule);
295 if (err < 0) {
296 nft_trans_destroy(trans);
297 return err;
298 }
bb7b40ae 299 nft_rule_expr_deactivate(ctx, rule);
ee01d542
AB		 300
301 return 0;
302}
303
304static int nft_delrule_by_chain(struct nft_ctx *ctx)
305{
306 struct nft_rule *rule;
307 int err;
308
309 list_for_each_entry(rule, &ctx->chain->rules, list) {
310 err = nft_delrule(ctx, rule);
311 if (err < 0)
312 return err;
313 }
314 return 0;
315}
316
cd5125d8 317static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
ee01d542
AB		 318 struct nft_set *set)
319{
320 struct nft_trans *trans;
321
322 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
323 if (trans == NULL)
324 return -ENOMEM;
325
326 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
327 nft_trans_set_id(trans) =
328 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 329 nft_activate_next(ctx->net, set);
ee01d542
AB		 330 }
331 nft_trans_set(trans) = set;
332 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
333
334 return 0;
335}
336
cd5125d8 337static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
ee01d542
AB		 338{
339 int err;
340
341 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
342 if (err < 0)
343 return err;
344
37a9cc52 345 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 346 ctx->table->use--;
347
348 return err;
349}
350
e5009240
PNA		 351static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
352 struct nft_object *obj)
353{
354 struct nft_trans *trans;
355
356 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
357 if (trans == NULL)
358 return -ENOMEM;
359
360 if (msg_type == NFT_MSG_NEWOBJ)
361 nft_activate_next(ctx->net, obj);
362
363 nft_trans_obj(trans) = obj;
364 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
365
366 return 0;
367}
368
369static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
370{
371 int err;
372
373 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
374 if (err < 0)
375 return err;
376
377 nft_deactivate_next(ctx->net, obj);
378 ctx->table->use--;
379
380 return err;
381}
382
3b49e2e9
PNA		 383static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
384 struct nft_flowtable *flowtable)
385{
386 struct nft_trans *trans;
387
388 trans = nft_trans_alloc(ctx, msg_type,
389 sizeof(struct nft_trans_flowtable));
390 if (trans == NULL)
391 return -ENOMEM;
392
393 if (msg_type == NFT_MSG_NEWFLOWTABLE)
394 nft_activate_next(ctx->net, flowtable);
395
396 nft_trans_flowtable(trans) = flowtable;
397 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
398
399 return 0;
400}
401
402static int nft_delflowtable(struct nft_ctx *ctx,
403 struct nft_flowtable *flowtable)
404{
405 int err;
406
407 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
408 if (err < 0)
409 return err;
410
411 nft_deactivate_next(ctx->net, flowtable);
412 ctx->table->use--;
413
414 return err;
415}
416
96518518
PM		 417/*
418 * Tables
419 */
420
36596dad 421static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 422 const struct nlattr *nla,
36596dad 423 u8 family, u8 genmask)
96518518
PM		 424{
425 struct nft_table *table;
426
cac20fcd
PNA		 427 if (nla == NULL)
428 return ERR_PTR(-EINVAL);
429
d9adf22a 430 list_for_each_entry_rcu(table, &net->nft.tables, list) {
f2a6d766 431 if (!nla_strcmp(nla, table->name) &&
98319cb9 432 table->family == family &&
f2a6d766 433 nft_active_genmask(table, genmask))
96518518
PM		 434 return table;
435 }
cac20fcd
PNA		 436
437 return ERR_PTR(-ENOENT);
96518518
PM		 438}
439
3ecbfd65
HS		 440static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
441 const struct nlattr *nla,
442 u8 genmask)
443{
444 struct nft_table *table;
445
446 list_for_each_entry(table, &net->nft.tables, list) {
447 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
448 nft_active_genmask(table, genmask))
449 return table;
450 }
3ecbfd65
HS		 451
452 return ERR_PTR(-ENOENT);
453}
454
96518518
PM		 455static inline u64 nf_tables_alloc_handle(struct nft_table *table)
456{
457 return ++table->hgenerator;
458}
459
32537e91 460static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 461
32537e91 462static const struct nft_chain_type *
1ea26cca 463__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 464{
465 int i;
466
baae3e62 467 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 468 if (chain_type[family][i] != NULL &&
469 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 470 return chain_type[family][i];
9370761c 471 }
baae3e62 472 return NULL;
9370761c
PNA		 473}
474
452238e8
FW		 475/*
476 * Loading a module requires dropping mutex that guards the
477 * transaction.
478 * We first need to abort any pending transactions as once
479 * mutex is unlocked a different client could start a new
480 * transaction. It must not see any 'future generation'
481 * changes * as these changes will never happen.
482 */
483#ifdef CONFIG_MODULES
484static int __nf_tables_abort(struct net *net);
485
486static void nft_request_module(struct net *net, const char *fmt, ...)
487{
488 char module_name[MODULE_NAME_LEN];
489 va_list args;
490 int ret;
491
492 __nf_tables_abort(net);
493
494 va_start(args, fmt);
495 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
496 va_end(args);
497 if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
498 return;
499
f102d66b 500 mutex_unlock(&net->nft.commit_mutex);
452238e8 501 request_module("%s", module_name);
f102d66b 502 mutex_lock(&net->nft.commit_mutex);
452238e8
FW		 503}
504#endif
505
f102d66b
FW		 506static void lockdep_nfnl_nft_mutex_not_held(void)
507{
508#ifdef CONFIG_PROVE_LOCKING
509 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
510#endif
511}
512
32537e91 513static const struct nft_chain_type *
452238e8
FW		 514nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
515 u8 family, bool autoload)
9370761c 516{
32537e91 517 const struct nft_chain_type *type;
9370761c 518
1ea26cca 519 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 520 if (type != NULL)
521 return type;
f102d66b
FW		 522
523 lockdep_nfnl_nft_mutex_not_held();
9370761c 524#ifdef CONFIG_MODULES
93b0806f 525 if (autoload) {
452238e8
FW		 526 nft_request_module(net, "nft-chain-%u-%.*s", family,
527 nla_len(nla), (const char *)nla_data(nla));
1ea26cca 528 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 529 if (type != NULL)
530 return ERR_PTR(-EAGAIN);
9370761c
PNA		 531 }
532#endif
93b0806f 533 return ERR_PTR(-ENOENT);
9370761c
PNA		 534}
535
96518518 536static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 537 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
538 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 539 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 540 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 541};
542
84d7fce6
PNA		 543static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
544 u32 portid, u32 seq, int event, u32 flags,
545 int family, const struct nft_table *table)
96518518
PM		 546{
547 struct nlmsghdr *nlh;
548 struct nfgenmsg *nfmsg;
549
dedb67c4 550 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 551 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
552 if (nlh == NULL)
553 goto nla_put_failure;
554
555 nfmsg = nlmsg_data(nlh);
556 nfmsg->nfgen_family = family;
557 nfmsg->version = NFNETLINK_V0;
84d7fce6 558 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 559
9ddf6323 560 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 561 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 562 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
563 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
564 NFTA_TABLE_PAD))
96518518
PM		 565 goto nla_put_failure;
566
053c095a
JB		 567 nlmsg_end(skb, nlh);
568 return 0;
96518518
PM		 569
570nla_put_failure:
571 nlmsg_trim(skb, nlh);
572 return -1;
573}
574
25e94a99 575static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 576{
577 struct sk_buff *skb;
96518518
PM		 578 int err;
579
128ad332
PNA		 580 if (!ctx->report &&
581 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 582 return;
96518518 583
96518518
PM		 584 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
585 if (skb == NULL)
586 goto err;
587
84d7fce6 588 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 589 event, 0, ctx->family, ctx->table);
96518518
PM		 590 if (err < 0) {
591 kfree_skb(skb);
592 goto err;
593 }
594
25e94a99
PNA		 595 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
596 ctx->report, GFP_KERNEL);
597 return;
96518518 598err:
25e94a99 599 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 600}
601
602static int nf_tables_dump_tables(struct sk_buff *skb,
603 struct netlink_callback *cb)
604{
605 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 606 const struct nft_table *table;
607 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 608 struct net *net = sock_net(skb->sk);
96518518
PM		 609 int family = nfmsg->nfgen_family;
610
e688a7f8 611 rcu_read_lock();
38e029f1
PNA		 612 cb->seq = net->nft.base_seq;
613
36596dad 614 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 615 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 616 continue;
617
36596dad
PNA		 618 if (idx < s_idx)
619 goto cont;
620 if (idx > s_idx)
621 memset(&cb->args[1], 0,
622 sizeof(cb->args) - sizeof(cb->args[0]));
623 if (!nft_is_active(net, table))
624 continue;
625 if (nf_tables_fill_table_info(skb, net,
626 NETLINK_CB(cb->skb).portid,
627 cb->nlh->nlmsg_seq,
628 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 629 table->family, table) < 0)
36596dad
PNA		 630 goto done;
631
632 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 633cont:
36596dad 634 idx++;
96518518
PM		 635 }
636done:
e688a7f8 637 rcu_read_unlock();
96518518
PM		 638 cb->args[0] = idx;
639 return skb->len;
640}
641
d9adf22a
FW		 642static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
643 const struct nlmsghdr *nlh,
644 struct netlink_dump_control *c)
645{
646 int err;
647
648 if (!try_module_get(THIS_MODULE))
649 return -EINVAL;
650
651 rcu_read_unlock();
652 err = netlink_dump_start(nlsk, skb, nlh, c);
653 rcu_read_lock();
654 module_put(THIS_MODULE);
655
656 return err;
657}
658
659/* called with rcu_read_lock held */
7b8002a1
PNA		 660static int nf_tables_gettable(struct net *net, struct sock *nlsk,
661 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 662 const struct nlattr * const nla[],
663 struct netlink_ext_ack *extack)
96518518
PM		 664{
665 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 666 u8 genmask = nft_genmask_cur(net);
96518518
PM		 667 const struct nft_table *table;
668 struct sk_buff *skb2;
669 int family = nfmsg->nfgen_family;
670 int err;
671
672 if (nlh->nlmsg_flags & NLM_F_DUMP) {
673 struct netlink_dump_control c = {
674 .dump = nf_tables_dump_tables,
d9adf22a 675 .module = THIS_MODULE,
96518518 676 };
d9adf22a
FW		 677
678 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 679 }
680
cac20fcd 681 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 682 if (IS_ERR(table)) {
683 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 684 return PTR_ERR(table);
36dd1bcc 685 }
96518518 686
d9adf22a 687 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 688 if (!skb2)
689 return -ENOMEM;
690
84d7fce6 691 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 692 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
693 family, table);
694 if (err < 0)
695 goto err;
696
697 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
698
699err:
700 kfree_skb(skb2);
701 return err;
702}
703
c9c17211 704static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 705{
706 struct nft_chain *chain;
707 u32 i = 0;
708
709 list_for_each_entry(chain, &table->chains, list) {
710 if (!nft_is_active_next(net, chain))
711 continue;
f323d954 712 if (!nft_is_base_chain(chain))
10435c11
F		 713 continue;
714
715 if (cnt && i++ == cnt)
716 break;
717
c974a3a3 718 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 719 }
720}
721
c9c17211 722static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 723{
724 struct nft_chain *chain;
725 int err, i = 0;
726
727 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 728 if (!nft_is_active_next(net, chain))
729 continue;
f323d954 730 if (!nft_is_base_chain(chain))
d2012975
PNA		 731 continue;
732
c974a3a3 733 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 734 if (err < 0)
735 goto err;
736
737 i++;
738 }
739 return 0;
740err:
10435c11 741 if (i)
c9c17211 742 nft_table_disable(net, table, i);
9ddf6323
PNA		 743 return err;
744}
745
c9c17211 746static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 747{
c9c17211 748 nft_table_disable(net, table, 0);
9ddf6323
PNA		 749}
750
e1aaca93 751static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 752{
55dd6f93 753 struct nft_trans *trans;
e1aaca93 754 u32 flags;
55dd6f93 755 int ret = 0;
9ddf6323 756
e1aaca93
PNA		 757 if (!ctx->nla[NFTA_TABLE_FLAGS])
758 return 0;
9ddf6323 759
e1aaca93
PNA		 760 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
761 if (flags & ~NFT_TABLE_F_DORMANT)
762 return -EINVAL;
763
63283dd2
PNA		 764 if (flags == ctx->table->flags)
765 return 0;
766
55dd6f93
PNA		 767 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
768 sizeof(struct nft_trans_table));
769 if (trans == NULL)
770 return -ENOMEM;
9ddf6323 771
e1aaca93
PNA		 772 if ((flags & NFT_TABLE_F_DORMANT) &&
773 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 774 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 775 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
776 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 777 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 778 if (ret >= 0) {
e1aaca93 779 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 780 nft_trans_table_enable(trans) = true;
9ddf6323 781 }
9ddf6323 782 }
e1aaca93
PNA		 783 if (ret < 0)
784 goto err;
9ddf6323 785
55dd6f93
PNA		 786 nft_trans_table_update(trans) = true;
787 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
788 return 0;
9ddf6323 789err:
55dd6f93 790 nft_trans_destroy(trans);
9ddf6323
PNA		 791 return ret;
792}
793
1b2470e5
FW		 794static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
795{
796 const char *name = data;
797
798 return jhash(name, strlen(name), seed);
799}
800
801static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
802{
803 const struct nft_chain *chain = data;
804
805 return nft_chain_hash(chain->name, 0, seed);
806}
807
808static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
809 const void *ptr)
810{
811 const struct nft_chain *chain = ptr;
812 const char *name = arg->key;
813
814 return strcmp(chain->name, name);
815}
816
633c9a84
PNA		 817static int nf_tables_newtable(struct net *net, struct sock *nlsk,
818 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 819 const struct nlattr * const nla[],
820 struct netlink_ext_ack *extack)
96518518
PM		 821{
822 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 823 u8 genmask = nft_genmask_next(net);
96518518 824 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 825 const struct nlattr *attr;
826 struct nft_table *table;
c5c1f975 827 u32 flags = 0;
e1aaca93 828 struct nft_ctx ctx;
55dd6f93 829 int err;
96518518 830
f102d66b 831 lockdep_assert_held(&net->nft.commit_mutex);
36dd1bcc
PNA		 832 attr = nla[NFTA_TABLE_NAME];
833 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 834 if (IS_ERR(table)) {
835 if (PTR_ERR(table) != -ENOENT)
836 return PTR_ERR(table);
1a28ad74 837 } else {
36dd1bcc
PNA		 838 if (nlh->nlmsg_flags & NLM_F_EXCL) {
839 NL_SET_BAD_ATTR(extack, attr);
96518518 840 return -EEXIST;
36dd1bcc 841 }
96518518
PM		 842 if (nlh->nlmsg_flags & NLM_F_REPLACE)
843 return -EOPNOTSUPP;
e1aaca93 844
98319cb9 845 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 846 return nf_tables_updtable(&ctx);
96518518
PM		 847 }
848
c5c1f975
PM		 849 if (nla[NFTA_TABLE_FLAGS]) {
850 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
851 if (flags & ~NFT_TABLE_F_DORMANT)
852 return -EINVAL;
853 }
854
ffdb210e 855 err = -ENOMEM;
1cae565e 856 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 857 if (table == NULL)
98319cb9 858 goto err_kzalloc;
96518518 859
36dd1bcc 860 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 861 if (table->name == NULL)
98319cb9 862 goto err_strdup;
e46abbcc 863
1b2470e5
FW		 864 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
865 if (err)
866 goto err_chain_ht;
867
96518518 868 INIT_LIST_HEAD(&table->chains);
20a69341 869 INIT_LIST_HEAD(&table->sets);
e5009240 870 INIT_LIST_HEAD(&table->objects);
3b49e2e9 871 INIT_LIST_HEAD(&table->flowtables);
98319cb9 872 table->family = family;
c5c1f975 873 table->flags = flags;
3ecbfd65 874 table->handle = ++table_handle;
9ddf6323 875
98319cb9 876 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 877 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 878 if (err < 0)
98319cb9 879 goto err_trans;
ffdb210e 880
36596dad 881 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 882 return 0;
98319cb9 883err_trans:
1b2470e5
FW		 884 rhltable_destroy(&table->chains_ht);
885err_chain_ht:
e46abbcc 886 kfree(table->name);
98319cb9 887err_strdup:
ffdb210e 888 kfree(table);
98319cb9 889err_kzalloc:
ffdb210e 890 return err;
96518518
PM		 891}
892
b9ac12ef
AB		 893static int nft_flush_table(struct nft_ctx *ctx)
894{
3b49e2e9 895 struct nft_flowtable *flowtable, *nft;
b9ac12ef 896 struct nft_chain *chain, *nc;
e5009240 897 struct nft_object *obj, *ne;
b9ac12ef 898 struct nft_set *set, *ns;
3b49e2e9 899 int err;
b9ac12ef 900
a2f18db0 901 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 902 if (!nft_is_active_next(ctx->net, chain))
903 continue;
904
b9ac12ef
AB		 905 ctx->chain = chain;
906
907 err = nft_delrule_by_chain(ctx);
908 if (err < 0)
909 goto out;
b9ac12ef
AB		 910 }
911
912 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 913 if (!nft_is_active_next(ctx->net, set))
914 continue;
915
408070d6 916 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 917 !list_empty(&set->bindings))
918 continue;
919
920 err = nft_delset(ctx, set);
921 if (err < 0)
922 goto out;
923 }
924
3b49e2e9
PNA		 925 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
926 err = nft_delflowtable(ctx, flowtable);
927 if (err < 0)
928 goto out;
929 }
930
e5009240
PNA		 931 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
932 err = nft_delobj(ctx, obj);
933 if (err < 0)
934 goto out;
935 }
936
a2f18db0 937 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 938 if (!nft_is_active_next(ctx->net, chain))
939 continue;
940
a2f18db0
PNA		 941 ctx->chain = chain;
942
943 err = nft_delchain(ctx);
944 if (err < 0)
945 goto out;
946 }
947
b9ac12ef
AB		 948 err = nft_deltable(ctx);
949out:
950 return err;
951}
952
953static int nft_flush(struct nft_ctx *ctx, int family)
954{
b9ac12ef
AB		 955 struct nft_table *table, *nt;
956 const struct nlattr * const *nla = ctx->nla;
957 int err = 0;
958
36596dad 959 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 960 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 961 continue;
962
98319cb9 963 ctx->family = table->family;
f2a6d766 964
36596dad
PNA		 965 if (!nft_is_active_next(ctx->net, table))
966 continue;
b9ac12ef 967
36596dad
PNA		 968 if (nla[NFTA_TABLE_NAME] &&
969 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
970 continue;
b9ac12ef 971
36596dad
PNA		 972 ctx->table = table;
973
974 err = nft_flush_table(ctx);
975 if (err < 0)
976 goto out;
b9ac12ef
AB		 977 }
978out:
979 return err;
980}
981
633c9a84
PNA		 982static int nf_tables_deltable(struct net *net, struct sock *nlsk,
983 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 984 const struct nlattr * const nla[],
985 struct netlink_ext_ack *extack)
96518518
PM		 986{
987 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 988 u8 genmask = nft_genmask_next(net);
ee01d542 989 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 990 const struct nlattr *attr;
991 struct nft_table *table;
55dd6f93 992 struct nft_ctx ctx;
96518518 993
36596dad 994 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 995 if (family == AF_UNSPEC ||
996 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 997 return nft_flush(&ctx, family);
998
36dd1bcc
PNA		 999 if (nla[NFTA_TABLE_HANDLE]) {
1000 attr = nla[NFTA_TABLE_HANDLE];
1001 table = nft_table_lookup_byhandle(net, attr, genmask);
1002 } else {
1003 attr = nla[NFTA_TABLE_NAME];
1004 table = nft_table_lookup(net, attr, family, genmask);
1005 }
3ecbfd65 1006
36dd1bcc
PNA		 1007 if (IS_ERR(table)) {
1008 NL_SET_BAD_ATTR(extack, attr);
96518518 1009 return PTR_ERR(table);
36dd1bcc 1010 }
96518518 1011
a8278400
PNA		 1012 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1013 table->use > 0)
1014 return -EBUSY;
1015
98319cb9 1016 ctx.family = family;
b9ac12ef 1017 ctx.table = table;
55dd6f93 1018
b9ac12ef 1019 return nft_flush_table(&ctx);
96518518
PM		 1020}
1021
55dd6f93
PNA		 1022static void nf_tables_table_destroy(struct nft_ctx *ctx)
1023{
fa5950e4
FW		 1024 if (WARN_ON(ctx->table->use > 0))
1025 return;
4fefee57 1026
1b2470e5 1027 rhltable_destroy(&ctx->table->chains_ht);
e46abbcc 1028 kfree(ctx->table->name);
55dd6f93 1029 kfree(ctx->table);
55dd6f93
PNA		 1030}
1031
cc07eeb0 1032void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 1033{
d8297d4f 1034 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
cc07eeb0 1035 return;
d8297d4f 1036
96518518 1037 nfnl_lock(NFNL_SUBSYS_NFTABLES);
cc07eeb0
PNA		 1038 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
1039 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1040 return;
96518518 1041 }
9370761c 1042 chain_type[ctype->family][ctype->type] = ctype;
96518518 1043 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 1044}
9370761c 1045EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 1046
32537e91 1047void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 1048{
96518518 1049 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 1050 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 1051 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1052}
9370761c 1053EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 1054
1055/*
1056 * Chains
1057 */
1058
1059static struct nft_chain *
cac20fcd 1060nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 1061{
1062 struct nft_chain *chain;
1063
1064 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 1065 if (chain->handle == handle &&
1066 nft_active_genmask(chain, genmask))
96518518
PM		 1067 return chain;
1068 }
1069
1070 return ERR_PTR(-ENOENT);
1071}
1072
f102d66b
FW		 1073static bool lockdep_commit_lock_is_held(struct net *net)
1074{
1075#ifdef CONFIG_PROVE_LOCKING
1076 return lockdep_is_held(&net->nft.commit_mutex);
1077#else
1078 return true;
1079#endif
1080}
1081
1082static struct nft_chain *nft_chain_lookup(struct net *net,
1083 struct nft_table *table,
cac20fcd 1084 const struct nlattr *nla, u8 genmask)
96518518 1085{
1b2470e5
FW		 1086 char search[NFT_CHAIN_MAXNAMELEN + 1];
1087 struct rhlist_head *tmp, *list;
96518518
PM		 1088 struct nft_chain *chain;
1089
1090 if (nla == NULL)
1091 return ERR_PTR(-EINVAL);
1092
1b2470e5 1093 nla_strlcpy(search, nla, sizeof(search));
96518518 1094
1b2470e5 1095 WARN_ON(!rcu_read_lock_held() &&
f102d66b 1096 !lockdep_commit_lock_is_held(net));
1b2470e5
FW		 1097
1098 chain = ERR_PTR(-ENOENT);
1099 rcu_read_lock();
1100 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1101 if (!list)
1102 goto out_unlock;
1103
1104 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1105 if (nft_active_genmask(chain, genmask))
1106 goto out_unlock;
1107 }
1108 chain = ERR_PTR(-ENOENT);
1109out_unlock:
1110 rcu_read_unlock();
1111 return chain;
96518518
PM		 1112}
1113
1114static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 1115 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1116 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1117 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1118 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1119 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1120 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 1121 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 1122 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 1123 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 1124};
1125
1126static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1127 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1128 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1129 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1130 .len = IFNAMSIZ - 1 },
96518518
PM		 1131};
1132
0ca743a5
PNA		 1133static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1134{
1135 struct nft_stats *cpu_stats, total;
1136 struct nlattr *nest;
ce355e20
ED		 1137 unsigned int seq;
1138 u64 pkts, bytes;
0ca743a5
PNA		 1139 int cpu;
1140
1141 memset(&total, 0, sizeof(total));
1142 for_each_possible_cpu(cpu) {
1143 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1144 do {
1145 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1146 pkts = cpu_stats->pkts;
1147 bytes = cpu_stats->bytes;
1148 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1149 total.pkts += pkts;
1150 total.bytes += bytes;
0ca743a5
PNA		 1151 }
1152 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1153 if (nest == NULL)
1154 goto nla_put_failure;
1155
b46f6ded
ND		 1156 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1157 NFTA_COUNTER_PAD) ||
1158 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1159 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1160 goto nla_put_failure;
1161
1162 nla_nest_end(skb, nest);
1163 return 0;
1164
1165nla_put_failure:
1166 return -ENOSPC;
1167}
1168
84d7fce6
PNA		 1169static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1170 u32 portid, u32 seq, int event, u32 flags,
1171 int family, const struct nft_table *table,
96518518
PM		 1172 const struct nft_chain *chain)
1173{
1174 struct nlmsghdr *nlh;
1175 struct nfgenmsg *nfmsg;
1176
dedb67c4 1177 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1178 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1179 if (nlh == NULL)
1180 goto nla_put_failure;
1181
1182 nfmsg = nlmsg_data(nlh);
1183 nfmsg->nfgen_family = family;
1184 nfmsg->version = NFNETLINK_V0;
84d7fce6 1185 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1186
1187 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1188 goto nla_put_failure;
b46f6ded
ND		 1189 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1190 NFTA_CHAIN_PAD))
96518518
PM		 1191 goto nla_put_failure;
1192 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1193 goto nla_put_failure;
1194
f323d954 1195 if (nft_is_base_chain(chain)) {
0ca743a5 1196 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1197 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1198 struct nlattr *nest;
1199
1200 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1201 if (nest == NULL)
1202 goto nla_put_failure;
1203 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1204 goto nla_put_failure;
1205 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1206 goto nla_put_failure;
2cbce139
PNA		 1207 if (basechain->dev_name[0] &&
1208 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1209 goto nla_put_failure;
96518518 1210 nla_nest_end(skb, nest);
9370761c 1211
0ca743a5
PNA		 1212 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1213 htonl(basechain->policy)))
1214 goto nla_put_failure;
1215
baae3e62
PM		 1216 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1217 goto nla_put_failure;
0ca743a5 1218
4c05ec47
TY		 1219 if (rcu_access_pointer(basechain->stats) &&
1220 nft_dump_stats(skb, rcu_dereference(basechain->stats)))
0ca743a5 1221 goto nla_put_failure;
96518518
PM		 1222 }
1223
0ca743a5
PNA		 1224 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1225 goto nla_put_failure;
1226
053c095a
JB		 1227 nlmsg_end(skb, nlh);
1228 return 0;
96518518
PM		 1229
1230nla_put_failure:
1231 nlmsg_trim(skb, nlh);
1232 return -1;
1233}
1234
25e94a99 1235static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1236{
1237 struct sk_buff *skb;
96518518
PM		 1238 int err;
1239
128ad332
PNA		 1240 if (!ctx->report &&
1241 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1242 return;
96518518 1243
96518518
PM		 1244 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1245 if (skb == NULL)
1246 goto err;
1247
84d7fce6 1248 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1249 event, 0, ctx->family, ctx->table,
35151d84 1250 ctx->chain);
96518518
PM		 1251 if (err < 0) {
1252 kfree_skb(skb);
1253 goto err;
1254 }
1255
25e94a99
PNA		 1256 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1257 ctx->report, GFP_KERNEL);
1258 return;
96518518 1259err:
25e94a99 1260 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1261}
1262
1263static int nf_tables_dump_chains(struct sk_buff *skb,
1264 struct netlink_callback *cb)
1265{
1266 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1267 const struct nft_table *table;
1268 const struct nft_chain *chain;
1269 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1270 struct net *net = sock_net(skb->sk);
96518518
PM		 1271 int family = nfmsg->nfgen_family;
1272
e688a7f8 1273 rcu_read_lock();
38e029f1
PNA		 1274 cb->seq = net->nft.base_seq;
1275
36596dad 1276 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1277 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1278 continue;
1279
36596dad
PNA		 1280 list_for_each_entry_rcu(chain, &table->chains, list) {
1281 if (idx < s_idx)
1282 goto cont;
1283 if (idx > s_idx)
1284 memset(&cb->args[1], 0,
1285 sizeof(cb->args) - sizeof(cb->args[0]));
1286 if (!nft_is_active(net, chain))
1287 continue;
1288 if (nf_tables_fill_chain_info(skb, net,
1289 NETLINK_CB(cb->skb).portid,
1290 cb->nlh->nlmsg_seq,
1291 NFT_MSG_NEWCHAIN,
1292 NLM_F_MULTI,
98319cb9 1293 table->family, table,
36596dad
PNA		 1294 chain) < 0)
1295 goto done;
38e029f1 1296
36596dad 1297 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1298cont:
36596dad 1299 idx++;
96518518
PM		 1300 }
1301 }
1302done:
e688a7f8 1303 rcu_read_unlock();
96518518
PM		 1304 cb->args[0] = idx;
1305 return skb->len;
1306}
1307
d9adf22a 1308/* called with rcu_read_lock held */
7b8002a1
PNA		 1309static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1310 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1311 const struct nlattr * const nla[],
1312 struct netlink_ext_ack *extack)
96518518
PM		 1313{
1314 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1315 u8 genmask = nft_genmask_cur(net);
96518518 1316 const struct nft_chain *chain;
1b2470e5 1317 struct nft_table *table;
96518518
PM		 1318 struct sk_buff *skb2;
1319 int family = nfmsg->nfgen_family;
1320 int err;
1321
1322 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1323 struct netlink_dump_control c = {
1324 .dump = nf_tables_dump_chains,
d9adf22a 1325 .module = THIS_MODULE,
96518518 1326 };
d9adf22a
FW		 1327
1328 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 1329 }
1330
cac20fcd 1331 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1332 if (IS_ERR(table)) {
1333 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1334 return PTR_ERR(table);
36dd1bcc 1335 }
96518518 1336
f102d66b 1337 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1338 if (IS_ERR(chain)) {
1339 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1340 return PTR_ERR(chain);
36dd1bcc 1341 }
96518518 1342
d9adf22a 1343 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 1344 if (!skb2)
1345 return -ENOMEM;
1346
84d7fce6 1347 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1348 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1349 family, table, chain);
1350 if (err < 0)
1351 goto err;
1352
1353 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1354
1355err:
1356 kfree_skb(skb2);
1357 return err;
1358}
1359
0ca743a5
PNA		 1360static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1361 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1362 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1363};
1364
ff3cd7b3 1365static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1366{
1367 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1368 struct nft_stats __percpu *newstats;
1369 struct nft_stats *stats;
1370 int err;
1371
fceb6435
JB		 1372 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1373 NULL);
0ca743a5 1374 if (err < 0)
ff3cd7b3 1375 return ERR_PTR(err);
0ca743a5
PNA		 1376
1377 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1378 return ERR_PTR(-EINVAL);
0ca743a5 1379
ce355e20 1380 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1381 if (newstats == NULL)
ff3cd7b3 1382 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1383
1384 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1385 * are not exposed to userspace.
1386 */
e8781f70 1387 preempt_disable();
0ca743a5
PNA		 1388 stats = this_cpu_ptr(newstats);
1389 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1390 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1391 preempt_enable();
0ca743a5 1392
ff3cd7b3
PNA		 1393 return newstats;
1394}
1395
4c05ec47
TY		 1396static void nft_chain_stats_replace(struct net *net,
1397 struct nft_base_chain *chain,
ff3cd7b3
PNA		 1398 struct nft_stats __percpu *newstats)
1399{
0befd061
PNA		 1400 struct nft_stats __percpu *oldstats;
1401
b88825de
PNA		 1402 if (newstats == NULL)
1403 return;
1404
4c05ec47
TY		 1405 if (rcu_access_pointer(chain->stats)) {
1406 oldstats = rcu_dereference_protected(chain->stats,
1407 lockdep_commit_lock_is_held(net));
0ca743a5
PNA		 1408 rcu_assign_pointer(chain->stats, newstats);
1409 synchronize_rcu();
1410 free_percpu(oldstats);
bbb8c61f 1411 } else {
0ca743a5 1412 rcu_assign_pointer(chain->stats, newstats);
bbb8c61f
TY		 1413 static_branch_inc(&nft_counters_enabled);
1414 }
0ca743a5
PNA		 1415}
1416
0cbc06b3
FW		 1417static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1418{
1419 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1420 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1421
1422 if (g0 != g1)
1423 kvfree(g1);
1424 kvfree(g0);
1425
1426 /* should be NULL either via abort or via successful commit */
1427 WARN_ON_ONCE(chain->rules_next);
1428 kvfree(chain->rules_next);
1429}
1430
43a605f2 1431static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1432{
43a605f2
PNA		 1433 struct nft_chain *chain = ctx->chain;
1434
fa5950e4
FW		 1435 if (WARN_ON(chain->use > 0))
1436 return;
91c7b38d 1437
0cbc06b3
FW		 1438 /* no concurrent access possible anymore */
1439 nf_tables_chain_free_chain_rules(chain);
1440
f323d954 1441 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1442 struct nft_base_chain *basechain = nft_base_chain(chain);
1443
1444 module_put(basechain->type->owner);
4c05ec47 1445 if (rcu_access_pointer(basechain->stats)) {
9f08ea84 1446 static_branch_dec(&nft_counters_enabled);
4c05ec47
TY		 1447 free_percpu(rcu_dereference_raw(basechain->stats));
1448 }
b7263e07 1449 kfree(chain->name);
2cbce139 1450 kfree(basechain);
91c7b38d 1451 } else {
b7263e07 1452 kfree(chain->name);
91c7b38d
PNA		 1453 kfree(chain);
1454 }
1455}
1456
508f8ccd
PNA		 1457struct nft_chain_hook {
1458 u32 num;
84ba7dd7 1459 s32 priority;
32537e91 1460 const struct nft_chain_type *type;
508f8ccd
PNA		 1461 struct net_device *dev;
1462};
1463
1464static int nft_chain_parse_hook(struct net *net,
1465 const struct nlattr * const nla[],
36596dad 1466 struct nft_chain_hook *hook, u8 family,
445509eb 1467 bool autoload)
508f8ccd
PNA		 1468{
1469 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1470 const struct nft_chain_type *type;
508f8ccd
PNA		 1471 struct net_device *dev;
1472 int err;
1473
f102d66b
FW		 1474 lockdep_assert_held(&net->nft.commit_mutex);
1475 lockdep_nfnl_nft_mutex_not_held();
1476
508f8ccd 1477 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1478 nft_hook_policy, NULL);
508f8ccd
PNA		 1479 if (err < 0)
1480 return err;
1481
1482 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1483 ha[NFTA_HOOK_PRIORITY] == NULL)
1484 return -EINVAL;
1485
1486 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1487 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1488
36596dad 1489 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1490 if (nla[NFTA_CHAIN_TYPE]) {
452238e8 1491 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
445509eb 1492 family, autoload);
508f8ccd
PNA		 1493 if (IS_ERR(type))
1494 return PTR_ERR(type);
1495 }
1496 if (!(type->hook_mask & (1 << hook->num)))
1497 return -EOPNOTSUPP;
84ba7dd7
FW		 1498
1499 if (type->type == NFT_CHAIN_T_NAT &&
1500 hook->priority <= NF_IP_PRI_CONNTRACK)
1501 return -EOPNOTSUPP;
1502
508f8ccd
PNA		 1503 if (!try_module_get(type->owner))
1504 return -ENOENT;
1505
1506 hook->type = type;
1507
1508 hook->dev = NULL;
36596dad 1509 if (family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1510 char ifname[IFNAMSIZ];
1511
1512 if (!ha[NFTA_HOOK_DEV]) {
1513 module_put(type->owner);
1514 return -EOPNOTSUPP;
1515 }
1516
1517 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
90d2723c 1518 dev = __dev_get_by_name(net, ifname);
508f8ccd
PNA		 1519 if (!dev) {
1520 module_put(type->owner);
1521 return -ENOENT;
1522 }
1523 hook->dev = dev;
1524 } else if (ha[NFTA_HOOK_DEV]) {
1525 module_put(type->owner);
1526 return -EOPNOTSUPP;
1527 }
1528
1529 return 0;
1530}
1531
1532static void nft_chain_release_hook(struct nft_chain_hook *hook)
1533{
1534 module_put(hook->type->owner);
508f8ccd
PNA		 1535}
1536
0cbc06b3
FW		 1537struct nft_rules_old {
1538 struct rcu_head h;
1539 struct nft_rule **start;
1540};
1541
1542static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1543 unsigned int alloc)
1544{
1545 if (alloc > INT_MAX)
1546 return NULL;
1547
1548 alloc += 1; /* NULL, ends rules */
1549 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1550 return NULL;
1551
1552 alloc *= sizeof(struct nft_rule *);
1553 alloc += sizeof(struct nft_rules_old);
1554
1555 return kvmalloc(alloc, GFP_KERNEL);
1556}
1557
4035285f 1558static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
445509eb 1559 u8 policy)
4035285f
PNA		 1560{
1561 const struct nlattr * const *nla = ctx->nla;
1562 struct nft_table *table = ctx->table;
4035285f
PNA		 1563 struct nft_base_chain *basechain;
1564 struct nft_stats __percpu *stats;
1565 struct net *net = ctx->net;
1566 struct nft_chain *chain;
0cbc06b3 1567 struct nft_rule **rules;
4035285f
PNA		 1568 int err;
1569
1570 if (table->use == UINT_MAX)
1571 return -EOVERFLOW;
1572
1573 if (nla[NFTA_CHAIN_HOOK]) {
1574 struct nft_chain_hook hook;
1575 struct nf_hook_ops *ops;
4035285f 1576
445509eb 1577 err = nft_chain_parse_hook(net, nla, &hook, family, true);
4035285f
PNA		 1578 if (err < 0)
1579 return err;
1580
1581 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1582 if (basechain == NULL) {
1583 nft_chain_release_hook(&hook);
1584 return -ENOMEM;
1585 }
1586
1587 if (hook.dev != NULL)
1588 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1589
1590 if (nla[NFTA_CHAIN_COUNTERS]) {
1591 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1592 if (IS_ERR(stats)) {
1593 nft_chain_release_hook(&hook);
1594 kfree(basechain);
1595 return PTR_ERR(stats);
1596 }
4c05ec47 1597 rcu_assign_pointer(basechain->stats, stats);
4035285f
PNA		 1598 static_branch_inc(&nft_counters_enabled);
1599 }
1600
4035285f
PNA		 1601 basechain->type = hook.type;
1602 chain = &basechain->chain;
1603
c974a3a3
PNA		 1604 ops = &basechain->ops;
1605 ops->pf = family;
1606 ops->hooknum = hook.num;
1607 ops->priority = hook.priority;
1608 ops->priv = chain;
c2f9eafe 1609 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1610 ops->dev = hook.dev;
c974a3a3 1611
4035285f
PNA		 1612 chain->flags |= NFT_BASE_CHAIN;
1613 basechain->policy = policy;
1614 } else {
1615 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1616 if (chain == NULL)
1617 return -ENOMEM;
1618 }
43a605f2
PNA		 1619 ctx->chain = chain;
1620
4035285f
PNA		 1621 INIT_LIST_HEAD(&chain->rules);
1622 chain->handle = nf_tables_alloc_handle(table);
1623 chain->table = table;
1624 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1625 if (!chain->name) {
1626 err = -ENOMEM;
1627 goto err1;
1628 }
1629
0cbc06b3
FW		 1630 rules = nf_tables_chain_alloc_rules(chain, 0);
1631 if (!rules) {
1632 err = -ENOMEM;
1633 goto err1;
1634 }
1635
1636 *rules = NULL;
1637 rcu_assign_pointer(chain->rules_gen_0, rules);
1638 rcu_assign_pointer(chain->rules_gen_1, rules);
1639
c974a3a3 1640 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1641 if (err < 0)
1642 goto err1;
1643
1b2470e5
FW		 1644 err = rhltable_insert_key(&table->chains_ht, chain->name,
1645 &chain->rhlhead, nft_chain_ht_params);
1646 if (err)
1647 goto err2;
1648
4035285f 1649 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1b2470e5
FW		 1650 if (err < 0) {
1651 rhltable_remove(&table->chains_ht, &chain->rhlhead,
1652 nft_chain_ht_params);
4035285f 1653 goto err2;
1b2470e5 1654 }
4035285f
PNA		 1655
1656 table->use++;
1657 list_add_tail_rcu(&chain->list, &table->chains);
1658
1659 return 0;
1660err2:
c974a3a3 1661 nf_tables_unregister_hook(net, table, chain);
4035285f 1662err1:
43a605f2 1663 nf_tables_chain_destroy(ctx);
4035285f
PNA		 1664
1665 return err;
1666}
1667
445509eb 1668static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy)
2c4a488a
PNA		 1669{
1670 const struct nlattr * const *nla = ctx->nla;
1671 struct nft_table *table = ctx->table;
1672 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1673 struct nft_base_chain *basechain;
1674 struct nft_stats *stats = NULL;
1675 struct nft_chain_hook hook;
2c4a488a
PNA		 1676 struct nf_hook_ops *ops;
1677 struct nft_trans *trans;
c974a3a3 1678 int err;
2c4a488a
PNA		 1679
1680 if (nla[NFTA_CHAIN_HOOK]) {
1681 if (!nft_is_base_chain(chain))
1682 return -EBUSY;
1683
36596dad 1684 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
445509eb 1685 false);
2c4a488a
PNA		 1686 if (err < 0)
1687 return err;
1688
1689 basechain = nft_base_chain(chain);
1690 if (basechain->type != hook.type) {
1691 nft_chain_release_hook(&hook);
1692 return -EBUSY;
1693 }
1694
c974a3a3
PNA		 1695 ops = &basechain->ops;
1696 if (ops->hooknum != hook.num ||
1697 ops->priority != hook.priority ||
1698 ops->dev != hook.dev) {
1699 nft_chain_release_hook(&hook);
1700 return -EBUSY;
2c4a488a
PNA		 1701 }
1702 nft_chain_release_hook(&hook);
1703 }
1704
1705 if (nla[NFTA_CHAIN_HANDLE] &&
1706 nla[NFTA_CHAIN_NAME]) {
1707 struct nft_chain *chain2;
1708
f102d66b
FW		 1709 chain2 = nft_chain_lookup(ctx->net, table,
1710 nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 1711 if (!IS_ERR(chain2))
1712 return -EEXIST;
2c4a488a
PNA		 1713 }
1714
1715 if (nla[NFTA_CHAIN_COUNTERS]) {
1716 if (!nft_is_base_chain(chain))
1717 return -EOPNOTSUPP;
1718
1719 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1720 if (IS_ERR(stats))
1721 return PTR_ERR(stats);
1722 }
1723
c6cc94df 1724 err = -ENOMEM;
2c4a488a
PNA		 1725 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1726 sizeof(struct nft_trans_chain));
c6cc94df
FW		 1727 if (trans == NULL)
1728 goto err;
2c4a488a
PNA		 1729
1730 nft_trans_chain_stats(trans) = stats;
1731 nft_trans_chain_update(trans) = true;
1732
1733 if (nla[NFTA_CHAIN_POLICY])
1734 nft_trans_chain_policy(trans) = policy;
1735 else
1736 nft_trans_chain_policy(trans) = -1;
1737
c6cc94df
FW		 1738 if (nla[NFTA_CHAIN_HANDLE] &&
1739 nla[NFTA_CHAIN_NAME]) {
1740 struct nft_trans *tmp;
1741 char *name;
1742
1743 err = -ENOMEM;
1744 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1745 if (!name)
1746 goto err;
1747
1748 err = -EEXIST;
1749 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
1750 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
1751 tmp->ctx.table == table &&
1752 nft_trans_chain_update(tmp) &&
1753 nft_trans_chain_name(tmp) &&
1754 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
1755 kfree(name);
1756 goto err;
1757 }
2c4a488a 1758 }
c6cc94df
FW		 1759
1760 nft_trans_chain_name(trans) = name;
2c4a488a
PNA		 1761 }
1762 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1763
1764 return 0;
c6cc94df
FW		 1765err:
1766 free_percpu(stats);
1767 kfree(trans);
1768 return err;
2c4a488a
PNA		 1769}
1770
633c9a84
PNA		 1771static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1772 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1773 const struct nlattr * const nla[],
1774 struct netlink_ext_ack *extack)
96518518
PM		 1775{
1776 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 1777 u8 genmask = nft_genmask_next(net);
1778 int family = nfmsg->nfgen_family;
36dd1bcc 1779 const struct nlattr *attr;
96518518
PM		 1780 struct nft_table *table;
1781 struct nft_chain *chain;
57de2a0c 1782 u8 policy = NF_ACCEPT;
4035285f 1783 struct nft_ctx ctx;
96518518 1784 u64 handle = 0;
96518518 1785
f102d66b
FW		 1786 lockdep_assert_held(&net->nft.commit_mutex);
1787
cac20fcd 1788 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1789 if (IS_ERR(table)) {
1790 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1791 return PTR_ERR(table);
36dd1bcc 1792 }
96518518 1793
96518518 1794 chain = NULL;
36dd1bcc 1795 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 1796
1797 if (nla[NFTA_CHAIN_HANDLE]) {
1798 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 1799 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 1800 if (IS_ERR(chain)) {
1801 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 1802 return PTR_ERR(chain);
36dd1bcc
PNA		 1803 }
1804 attr = nla[NFTA_CHAIN_HANDLE];
96518518 1805 } else {
f102d66b 1806 chain = nft_chain_lookup(net, table, attr, genmask);
96518518 1807 if (IS_ERR(chain)) {
36dd1bcc
PNA		 1808 if (PTR_ERR(chain) != -ENOENT) {
1809 NL_SET_BAD_ATTR(extack, attr);
96518518 1810 return PTR_ERR(chain);
36dd1bcc 1811 }
96518518
PM		 1812 chain = NULL;
1813 }
1814 }
1815
57de2a0c 1816 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 1817 if (chain != NULL &&
36dd1bcc
PNA		 1818 !nft_is_base_chain(chain)) {
1819 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 1820 return -EOPNOTSUPP;
36dd1bcc 1821 }
d6b6cb1d
PNA		 1822
1823 if (chain == NULL &&
36dd1bcc
PNA		 1824 nla[NFTA_CHAIN_HOOK] == NULL) {
1825 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 1826 return -EOPNOTSUPP;
36dd1bcc 1827 }
57de2a0c 1828
8f46df18 1829 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1830 switch (policy) {
1831 case NF_DROP:
1832 case NF_ACCEPT:
1833 break;
1834 default:
1835 return -EINVAL;
1836 }
1837 }
1838
98319cb9 1839 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 1840
96518518 1841 if (chain != NULL) {
36dd1bcc
PNA		 1842 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1843 NL_SET_BAD_ATTR(extack, attr);
96518518 1844 return -EEXIST;
36dd1bcc 1845 }
96518518
PM		 1846 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1847 return -EOPNOTSUPP;
1848
445509eb 1849 return nf_tables_updchain(&ctx, genmask, policy);
96518518
PM		 1850 }
1851
445509eb 1852 return nf_tables_addchain(&ctx, family, genmask, policy);
96518518
PM		 1853}
1854
633c9a84
PNA		 1855static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1856 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1857 const struct nlattr * const nla[],
1858 struct netlink_ext_ack *extack)
96518518
PM		 1859{
1860 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1861 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 1862 int family = nfmsg->nfgen_family;
1863 const struct nlattr *attr;
96518518
PM		 1864 struct nft_table *table;
1865 struct nft_chain *chain;
9dee1474 1866 struct nft_rule *rule;
91c7b38d 1867 struct nft_ctx ctx;
3ecbfd65 1868 u64 handle;
9dee1474
PNA		 1869 u32 use;
1870 int err;
96518518 1871
cac20fcd 1872 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1873 if (IS_ERR(table)) {
1874 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1875 return PTR_ERR(table);
36dd1bcc 1876 }
96518518 1877
3ecbfd65 1878 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 1879 attr = nla[NFTA_CHAIN_HANDLE];
1880 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 1881 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 1882 } else {
36dd1bcc 1883 attr = nla[NFTA_CHAIN_NAME];
f102d66b 1884 chain = nft_chain_lookup(net, table, attr, genmask);
3ecbfd65 1885 }
36dd1bcc
PNA		 1886 if (IS_ERR(chain)) {
1887 NL_SET_BAD_ATTR(extack, attr);
96518518 1888 return PTR_ERR(chain);
36dd1bcc 1889 }
9dee1474
PNA		 1890
1891 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1892 chain->use > 0)
96518518
PM		 1893 return -EBUSY;
1894
98319cb9 1895 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 1896
9dee1474
PNA		 1897 use = chain->use;
1898 list_for_each_entry(rule, &chain->rules, list) {
1899 if (!nft_is_active_next(net, rule))
1900 continue;
1901 use--;
1902
1903 err = nft_delrule(&ctx, rule);
1904 if (err < 0)
1905 return err;
1906 }
1907
1908 /* There are rules and elements that are still holding references to us,
1909 * we cannot do a recursive removal in this case.
1910 */
36dd1bcc
PNA		 1911 if (use > 0) {
1912 NL_SET_BAD_ATTR(extack, attr);
9dee1474 1913 return -EBUSY;
36dd1bcc 1914 }
9dee1474 1915
ee01d542 1916 return nft_delchain(&ctx);
96518518
PM		 1917}
1918
96518518
PM		 1919/*
1920 * Expressions
1921 */
1922
1923/**
ef1f7df9
PM		 1924 * nft_register_expr - register nf_tables expr type
1925 * @ops: expr type
96518518 1926 *
ef1f7df9 1927 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1928 * success or a negative errno code otherwise.
1929 */
ef1f7df9 1930int nft_register_expr(struct nft_expr_type *type)
96518518 1931{
0ef235c7
FW		 1932 if (!nft_expr_check_ops(type->ops))
1933 return -EINVAL;
1934
96518518 1935 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1936 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1937 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1938 else
e688a7f8 1939 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1940 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1941 return 0;
1942}
1943EXPORT_SYMBOL_GPL(nft_register_expr);
1944
1945/**
ef1f7df9
PM		 1946 * nft_unregister_expr - unregister nf_tables expr type
1947 * @ops: expr type
96518518 1948 *
ef1f7df9 1949 * Unregisters the expr typefor use with nf_tables.
96518518 1950 */
ef1f7df9 1951void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1952{
1953 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1954 list_del_rcu(&type->list);
96518518
PM		 1955 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1956}
1957EXPORT_SYMBOL_GPL(nft_unregister_expr);
1958
64d46806
PM		 1959static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1960 struct nlattr *nla)
96518518 1961{
ef1f7df9 1962 const struct nft_expr_type *type;
96518518 1963
ef1f7df9 1964 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1965 if (!nla_strcmp(nla, type->name) &&
1966 (!type->family || type->family == family))
ef1f7df9 1967 return type;
96518518
PM		 1968 }
1969 return NULL;
1970}
1971
452238e8
FW		 1972static const struct nft_expr_type *nft_expr_type_get(struct net *net,
1973 u8 family,
64d46806 1974 struct nlattr *nla)
96518518 1975{
ef1f7df9 1976 const struct nft_expr_type *type;
96518518
PM		 1977
1978 if (nla == NULL)
1979 return ERR_PTR(-EINVAL);
1980
64d46806 1981 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1982 if (type != NULL && try_module_get(type->owner))
1983 return type;
96518518 1984
f102d66b 1985 lockdep_nfnl_nft_mutex_not_held();
96518518 1986#ifdef CONFIG_MODULES
ef1f7df9 1987 if (type == NULL) {
452238e8
FW		 1988 nft_request_module(net, "nft-expr-%u-%.*s", family,
1989 nla_len(nla), (char *)nla_data(nla));
64d46806
PM		 1990 if (__nft_expr_type_get(family, nla))
1991 return ERR_PTR(-EAGAIN);
1992
452238e8
FW		 1993 nft_request_module(net, "nft-expr-%.*s",
1994 nla_len(nla), (char *)nla_data(nla));
64d46806 1995 if (__nft_expr_type_get(family, nla))
96518518
PM		 1996 return ERR_PTR(-EAGAIN);
1997 }
1998#endif
1999 return ERR_PTR(-ENOENT);
2000}
2001
2002static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2003 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
2004 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2005};
2006
2007static int nf_tables_fill_expr_info(struct sk_buff *skb,
2008 const struct nft_expr *expr)
2009{
ef1f7df9 2010 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 2011 goto nla_put_failure;
2012
2013 if (expr->ops->dump) {
2014 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
2015 if (data == NULL)
2016 goto nla_put_failure;
2017 if (expr->ops->dump(skb, expr) < 0)
2018 goto nla_put_failure;
2019 nla_nest_end(skb, data);
2020 }
2021
2022 return skb->len;
2023
2024nla_put_failure:
2025 return -1;
2026};
2027
0b2d8a7b
PM		 2028int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2029 const struct nft_expr *expr)
2030{
2031 struct nlattr *nest;
2032
2033 nest = nla_nest_start(skb, attr);
2034 if (!nest)
2035 goto nla_put_failure;
2036 if (nf_tables_fill_expr_info(skb, expr) < 0)
2037 goto nla_put_failure;
2038 nla_nest_end(skb, nest);
2039 return 0;
2040
2041nla_put_failure:
2042 return -1;
2043}
2044
96518518
PM		 2045struct nft_expr_info {
2046 const struct nft_expr_ops *ops;
ef1f7df9 2047 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 2048};
2049
0ca743a5
PNA		 2050static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2051 const struct nlattr *nla,
96518518
PM		 2052 struct nft_expr_info *info)
2053{
ef1f7df9 2054 const struct nft_expr_type *type;
96518518 2055 const struct nft_expr_ops *ops;
ef1f7df9 2056 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 2057 int err;
2058
fceb6435 2059 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 2060 if (err < 0)
2061 return err;
2062
452238e8 2063 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 2064 if (IS_ERR(type))
2065 return PTR_ERR(type);
2066
2067 if (tb[NFTA_EXPR_DATA]) {
2068 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 2069 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 2070 if (err < 0)
2071 goto err1;
2072 } else
2073 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2074
2075 if (type->select_ops != NULL) {
0ca743a5
PNA		 2076 ops = type->select_ops(ctx,
2077 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 2078 if (IS_ERR(ops)) {
2079 err = PTR_ERR(ops);
2080 goto err1;
2081 }
0ef235c7
FW		 2082 if (!nft_expr_check_ops(ops)) {
2083 err = -EINVAL;
2084 goto err1;
2085 }
ef1f7df9
PM		 2086 } else
2087 ops = type->ops;
2088
96518518
PM		 2089 info->ops = ops;
2090 return 0;
ef1f7df9
PM		 2091
2092err1:
2093 module_put(type->owner);
2094 return err;
96518518
PM		 2095}
2096
2097static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 2098 const struct nft_expr_info *info,
96518518
PM		 2099 struct nft_expr *expr)
2100{
2101 const struct nft_expr_ops *ops = info->ops;
2102 int err;
2103
2104 expr->ops = ops;
2105 if (ops->init) {
ef1f7df9 2106 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 2107 if (err < 0)
2108 goto err1;
2109 }
2110
96518518 2111 return 0;
96518518
PM		 2112err1:
2113 expr->ops = NULL;
2114 return err;
2115}
2116
62472bce
PM		 2117static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2118 struct nft_expr *expr)
96518518
PM		 2119{
2120 if (expr->ops->destroy)
62472bce 2121 expr->ops->destroy(ctx, expr);
ef1f7df9 2122 module_put(expr->ops->type->owner);
96518518
PM		 2123}
2124
0b2d8a7b
PM		 2125struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2126 const struct nlattr *nla)
2127{
2128 struct nft_expr_info info;
2129 struct nft_expr *expr;
2130 int err;
2131
2132 err = nf_tables_expr_parse(ctx, nla, &info);
2133 if (err < 0)
2134 goto err1;
2135
2136 err = -ENOMEM;
2137 expr = kzalloc(info.ops->size, GFP_KERNEL);
2138 if (expr == NULL)
2139 goto err2;
2140
2141 err = nf_tables_newexpr(ctx, &info, expr);
2142 if (err < 0)
6cafaf47 2143 goto err3;
0b2d8a7b
PM		 2144
2145 return expr;
6cafaf47
LZ		 2146err3:
2147 kfree(expr);
0b2d8a7b
PM		 2148err2:
2149 module_put(info.ops->type->owner);
2150err1:
2151 return ERR_PTR(err);
2152}
2153
2154void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2155{
2156 nf_tables_expr_destroy(ctx, expr);
2157 kfree(expr);
2158}
2159
96518518
PM		 2160/*
2161 * Rules
2162 */
2163
cac20fcd
PNA		 2164static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2165 u64 handle)
96518518
PM		 2166{
2167 struct nft_rule *rule;
2168
2169 // FIXME: this sucks
d9adf22a 2170 list_for_each_entry_rcu(rule, &chain->rules, list) {
96518518
PM		 2171 if (handle == rule->handle)
2172 return rule;
2173 }
2174
2175 return ERR_PTR(-ENOENT);
2176}
2177
cac20fcd
PNA		 2178static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2179 const struct nlattr *nla)
96518518
PM		 2180{
2181 if (nla == NULL)
2182 return ERR_PTR(-EINVAL);
2183
cac20fcd 2184 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 2185}
2186
2187static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 2188 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2189 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 2190 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2191 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2192 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2193 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 2194 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 2195 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 2196 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2197 .len = NFT_USERDATA_MAXLEN },
467697d2 2198 [NFTA_RULE_ID] = { .type = NLA_U32 },
96518518
PM		 2199};
2200
84d7fce6
PNA		 2201static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2202 u32 portid, u32 seq, int event,
2203 u32 flags, int family,
96518518
PM		 2204 const struct nft_table *table,
2205 const struct nft_chain *chain,
2206 const struct nft_rule *rule)
2207{
2208 struct nlmsghdr *nlh;
2209 struct nfgenmsg *nfmsg;
2210 const struct nft_expr *expr, *next;
2211 struct nlattr *list;
5e948466 2212 const struct nft_rule *prule;
dedb67c4 2213 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 2214
dedb67c4 2215 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 2216 if (nlh == NULL)
2217 goto nla_put_failure;
2218
2219 nfmsg = nlmsg_data(nlh);
2220 nfmsg->nfgen_family = family;
2221 nfmsg->version = NFNETLINK_V0;
84d7fce6 2222 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2223
2224 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2225 goto nla_put_failure;
2226 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2227 goto nla_put_failure;
b46f6ded
ND		 2228 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2229 NFTA_RULE_PAD))
96518518
PM		 2230 goto nla_put_failure;
2231
5e948466 2232 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 2233 prule = list_prev_entry(rule, list);
5e948466 2234 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2235 cpu_to_be64(prule->handle),
2236 NFTA_RULE_PAD))
5e948466
EL		 2237 goto nla_put_failure;
2238 }
2239
96518518
PM		 2240 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2241 if (list == NULL)
2242 goto nla_put_failure;
2243 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2244 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2245 goto nla_put_failure;
96518518
PM		 2246 }
2247 nla_nest_end(skb, list);
2248
86f1ec32
PM		 2249 if (rule->udata) {
2250 struct nft_userdata *udata = nft_userdata(rule);
2251 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2252 udata->data) < 0)
2253 goto nla_put_failure;
2254 }
0768b3b3 2255
053c095a
JB		 2256 nlmsg_end(skb, nlh);
2257 return 0;
96518518
PM		 2258
2259nla_put_failure:
2260 nlmsg_trim(skb, nlh);
2261 return -1;
2262}
2263
25e94a99
PNA		 2264static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2265 const struct nft_rule *rule, int event)
96518518
PM		 2266{
2267 struct sk_buff *skb;
96518518
PM		 2268 int err;
2269
128ad332
PNA		 2270 if (!ctx->report &&
2271 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2272 return;
96518518 2273
96518518
PM		 2274 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2275 if (skb == NULL)
2276 goto err;
2277
84d7fce6 2278 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2279 event, 0, ctx->family, ctx->table,
35151d84 2280 ctx->chain, rule);
96518518
PM		 2281 if (err < 0) {
2282 kfree_skb(skb);
2283 goto err;
2284 }
2285
25e94a99
PNA		 2286 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2287 ctx->report, GFP_KERNEL);
2288 return;
96518518 2289err:
25e94a99 2290 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2291}
2292
6e1f760e 2293struct nft_rule_dump_ctx {
e46abbcc 2294 char *table;
b7263e07 2295 char *chain;
6e1f760e
PNA		 2296};
2297
241faece
PS		 2298static int __nf_tables_dump_rules(struct sk_buff *skb,
2299 unsigned int *idx,
2300 struct netlink_callback *cb,
2301 const struct nft_table *table,
2302 const struct nft_chain *chain)
2303{
2304 struct net *net = sock_net(skb->sk);
2305 unsigned int s_idx = cb->args[0];
2306 const struct nft_rule *rule;
2307 int rc = 1;
2308
2309 list_for_each_entry_rcu(rule, &chain->rules, list) {
2310 if (!nft_is_active(net, rule))
2311 goto cont;
2312 if (*idx < s_idx)
2313 goto cont;
2314 if (*idx > s_idx) {
2315 memset(&cb->args[1], 0,
2316 sizeof(cb->args) - sizeof(cb->args[0]));
2317 }
2318 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2319 cb->nlh->nlmsg_seq,
2320 NFT_MSG_NEWRULE,
2321 NLM_F_MULTI | NLM_F_APPEND,
2322 table->family,
2323 table, chain, rule) < 0)
2324 goto out_unfinished;
2325
2326 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2327cont:
2328 (*idx)++;
2329 }
2330 rc = 0;
2331out_unfinished:
2332 cb->args[0] = *idx;
2333 return rc;
2334}
2335
96518518
PM		 2336static int nf_tables_dump_rules(struct sk_buff *skb,
2337 struct netlink_callback *cb)
2338{
2339 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2340 const struct nft_rule_dump_ctx *ctx = cb->data;
241faece 2341 struct nft_table *table;
96518518 2342 const struct nft_chain *chain;
241faece 2343 unsigned int idx = 0;
99633ab2 2344 struct net *net = sock_net(skb->sk);
96518518
PM		 2345 int family = nfmsg->nfgen_family;
2346
e688a7f8 2347 rcu_read_lock();
38e029f1
PNA		 2348 cb->seq = net->nft.base_seq;
2349
36596dad 2350 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2351 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2352 continue;
2353
2354 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2355 continue;
2356
241faece
PS		 2357 if (ctx && ctx->chain) {
2358 struct rhlist_head *list, *tmp;
6e1f760e 2359
241faece
PS		 2360 list = rhltable_lookup(&table->chains_ht, ctx->chain,
2361 nft_chain_ht_params);
2362 if (!list)
2363 goto done;
2364
2365 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2366 if (!nft_is_active(net, chain))
2367 continue;
2368 __nf_tables_dump_rules(skb, &idx,
2369 cb, table, chain);
2370 break;
96518518 2371 }
241faece 2372 goto done;
96518518 2373 }
241faece
PS		 2374
2375 list_for_each_entry_rcu(chain, &table->chains, list) {
2376 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2377 goto done;
2378 }
2379
2380 if (ctx && ctx->table)
2381 break;
96518518
PM		 2382 }
2383done:
e688a7f8 2384 rcu_read_unlock();
96518518
PM		 2385 return skb->len;
2386}
2387
90fd131a
FW		 2388static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2389{
2390 const struct nlattr * const *nla = cb->data;
2391 struct nft_rule_dump_ctx *ctx = NULL;
2392
2393 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2394 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2395 if (!ctx)
2396 return -ENOMEM;
2397
2398 if (nla[NFTA_RULE_TABLE]) {
2399 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2400 GFP_ATOMIC);
2401 if (!ctx->table) {
2402 kfree(ctx);
2403 return -ENOMEM;
2404 }
2405 }
2406 if (nla[NFTA_RULE_CHAIN]) {
2407 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2408 GFP_ATOMIC);
2409 if (!ctx->chain) {
2410 kfree(ctx->table);
2411 kfree(ctx);
2412 return -ENOMEM;
2413 }
2414 }
2415 }
2416
2417 cb->data = ctx;
2418 return 0;
2419}
2420
6e1f760e
PNA		 2421static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2422{
e46abbcc
PS		 2423 struct nft_rule_dump_ctx *ctx = cb->data;
2424
2425 if (ctx) {
2426 kfree(ctx->table);
b7263e07 2427 kfree(ctx->chain);
e46abbcc
PS		 2428 kfree(ctx);
2429 }
6e1f760e
PNA		 2430 return 0;
2431}
2432
d9adf22a 2433/* called with rcu_read_lock held */
7b8002a1
PNA		 2434static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2435 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2436 const struct nlattr * const nla[],
2437 struct netlink_ext_ack *extack)
96518518
PM		 2438{
2439 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2440 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2441 const struct nft_chain *chain;
2442 const struct nft_rule *rule;
1b2470e5 2443 struct nft_table *table;
96518518
PM		 2444 struct sk_buff *skb2;
2445 int family = nfmsg->nfgen_family;
2446 int err;
2447
2448 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2449 struct netlink_dump_control c = {
90fd131a 2450 .start= nf_tables_dump_rules_start,
96518518 2451 .dump = nf_tables_dump_rules,
6e1f760e 2452 .done = nf_tables_dump_rules_done,
d9adf22a 2453 .module = THIS_MODULE,
90fd131a 2454 .data = (void *)nla,
96518518 2455 };
6e1f760e 2456
d9adf22a 2457 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 2458 }
2459
cac20fcd 2460 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2461 if (IS_ERR(table)) {
2462 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2463 return PTR_ERR(table);
36dd1bcc 2464 }
96518518 2465
f102d66b 2466 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2467 if (IS_ERR(chain)) {
2468 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2469 return PTR_ERR(chain);
36dd1bcc 2470 }
96518518 2471
cac20fcd 2472 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2473 if (IS_ERR(rule)) {
2474 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2475 return PTR_ERR(rule);
36dd1bcc 2476 }
96518518 2477
d9adf22a 2478 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 2479 if (!skb2)
2480 return -ENOMEM;
2481
84d7fce6 2482 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2483 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2484 family, table, chain, rule);
2485 if (err < 0)
2486 goto err;
2487
2488 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2489
2490err:
2491 kfree_skb(skb2);
2492 return err;
2493}
2494
62472bce
PM		 2495static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2496 struct nft_rule *rule)
96518518 2497{
29e38801 2498 struct nft_expr *expr, *next;
96518518
PM		 2499
2500 /*
2501 * Careful: some expressions might not be initialized in case this
2502 * is called on error from nf_tables_newrule().
2503 */
2504 expr = nft_expr_first(rule);
3e38df13 2505 while (expr != nft_expr_last(rule) && expr->ops) {
29e38801 2506 next = nft_expr_next(expr);
62472bce 2507 nf_tables_expr_destroy(ctx, expr);
29e38801 2508 expr = next;
96518518
PM		 2509 }
2510 kfree(rule);
2511}
2512
bb7b40ae
PNA		 2513static void nf_tables_rule_release(const struct nft_ctx *ctx,
2514 struct nft_rule *rule)
2515{
2516 nft_rule_expr_deactivate(ctx, rule);
2517 nf_tables_rule_destroy(ctx, rule);
2518}
2519
a654de8f
PNA		 2520int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2521{
2522 struct nft_expr *expr, *last;
2523 const struct nft_data *data;
2524 struct nft_rule *rule;
2525 int err;
2526
26b2f552
TY		 2527 if (ctx->level == NFT_JUMP_STACK_SIZE)
2528 return -EMLINK;
2529
a654de8f
PNA		 2530 list_for_each_entry(rule, &chain->rules, list) {
2531 if (!nft_is_active_next(ctx->net, rule))
2532 continue;
2533
2534 nft_rule_for_each_expr(expr, last, rule) {
2535 if (!expr->ops->validate)
2536 continue;
2537
2538 err = expr->ops->validate(ctx, expr, &data);
2539 if (err < 0)
2540 return err;
2541 }
2542 }
2543
2544 return 0;
2545}
2546EXPORT_SYMBOL_GPL(nft_chain_validate);
2547
2548static int nft_table_validate(struct net *net, const struct nft_table *table)
2549{
2550 struct nft_chain *chain;
2551 struct nft_ctx ctx = {
2552 .net = net,
2553 .family = table->family,
2554 };
2555 int err;
2556
2557 list_for_each_entry(chain, &table->chains, list) {
2558 if (!nft_is_base_chain(chain))
2559 continue;
2560
2561 ctx.chain = chain;
2562 err = nft_chain_validate(&ctx, chain);
2563 if (err < 0)
2564 return err;
2565 }
2566
2567 return 0;
2568}
2569
1081d11b
PNA		 2570#define NFT_RULE_MAXEXPRS 128
2571
633c9a84
PNA		 2572static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2573 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2574 const struct nlattr * const nla[],
2575 struct netlink_ext_ack *extack)
96518518
PM		 2576{
2577 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2578 u8 genmask = nft_genmask_next(net);
2a43ecf9 2579 struct nft_expr_info *info = NULL;
98319cb9 2580 int family = nfmsg->nfgen_family;
96518518
PM		 2581 struct nft_table *table;
2582 struct nft_chain *chain;
2583 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2584 struct nft_userdata *udata;
1081d11b 2585 struct nft_trans *trans = NULL;
96518518
PM		 2586 struct nft_expr *expr;
2587 struct nft_ctx ctx;
2588 struct nlattr *tmp;
86f1ec32 2589 unsigned int size, i, n, ulen = 0, usize = 0;
96518518 2590 int err, rem;
5e948466 2591 u64 handle, pos_handle;
96518518 2592
f102d66b
FW		 2593 lockdep_assert_held(&net->nft.commit_mutex);
2594
cac20fcd 2595 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2596 if (IS_ERR(table)) {
2597 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2598 return PTR_ERR(table);
36dd1bcc 2599 }
96518518 2600
f102d66b 2601 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2602 if (IS_ERR(chain)) {
2603 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2604 return PTR_ERR(chain);
36dd1bcc 2605 }
96518518
PM		 2606
2607 if (nla[NFTA_RULE_HANDLE]) {
2608 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 2609 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 2610 if (IS_ERR(rule)) {
2611 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2612 return PTR_ERR(rule);
36dd1bcc 2613 }
96518518 2614
36dd1bcc
PNA		 2615 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2616 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2617 return -EEXIST;
36dd1bcc 2618 }
96518518
PM		 2619 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2620 old_rule = rule;
2621 else
2622 return -EOPNOTSUPP;
2623 } else {
445509eb
PNA		 2624 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
2625 nlh->nlmsg_flags & NLM_F_REPLACE)
96518518
PM		 2626 return -EINVAL;
2627 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2628
2629 if (chain->use == UINT_MAX)
2630 return -EOVERFLOW;
5e948466 2631
447750f2
FW		 2632 if (nla[NFTA_RULE_POSITION]) {
2633 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2634 old_rule = __nft_rule_lookup(chain, pos_handle);
2635 if (IS_ERR(old_rule)) {
2636 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
2637 return PTR_ERR(old_rule);
2638 }
36dd1bcc 2639 }
5e948466
EL		 2640 }
2641
98319cb9 2642 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 2643
96518518
PM		 2644 n = 0;
2645 size = 0;
2646 if (nla[NFTA_RULE_EXPRESSIONS]) {
2a43ecf9
FW		 2647 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
2648 sizeof(struct nft_expr_info),
2649 GFP_KERNEL);
2650 if (!info)
2651 return -ENOMEM;
2652
96518518
PM		 2653 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2654 err = -EINVAL;
2655 if (nla_type(tmp) != NFTA_LIST_ELEM)
2656 goto err1;
2657 if (n == NFT_RULE_MAXEXPRS)
2658 goto err1;
0ca743a5 2659 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2660 if (err < 0)
2661 goto err1;
2662 size += info[n].ops->size;
2663 n++;
2664 }
2665 }
9889840f
PM		 2666 /* Check for overflow of dlen field */
2667 err = -EFBIG;
2668 if (size >= 1 << 12)
2669 goto err1;
96518518 2670
86f1ec32 2671 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2672 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2673 if (ulen > 0)
2674 usize = sizeof(struct nft_userdata) + ulen;
2675 }
0768b3b3 2676
96518518 2677 err = -ENOMEM;
86f1ec32 2678 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2679 if (rule == NULL)
2680 goto err1;
2681
889f7ee7 2682 nft_activate_next(net, rule);
0628b123 2683
96518518
PM		 2684 rule->handle = handle;
2685 rule->dlen = size;
86f1ec32 2686 rule->udata = ulen ? 1 : 0;
0768b3b3 2687
86f1ec32
PM		 2688 if (ulen) {
2689 udata = nft_userdata(rule);
2690 udata->len = ulen - 1;
2691 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2692 }
96518518 2693
96518518
PM		 2694 expr = nft_expr_first(rule);
2695 for (i = 0; i < n; i++) {
2696 err = nf_tables_newexpr(&ctx, &info[i], expr);
2697 if (err < 0)
2698 goto err2;
a654de8f
PNA		 2699
2700 if (info[i].ops->validate)
2701 nft_validate_state_update(net, NFT_VALIDATE_NEED);
2702
ef1f7df9 2703 info[i].ops = NULL;
96518518
PM		 2704 expr = nft_expr_next(expr);
2705 }
2706
96518518 2707 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
ca089878 2708 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
569ccae6
FW		 2709 if (trans == NULL) {
2710 err = -ENOMEM;
2711 goto err2;
2712 }
ca089878
TY		 2713 err = nft_delrule(&ctx, old_rule);
2714 if (err < 0) {
2715 nft_trans_destroy(trans);
569ccae6
FW		 2716 goto err2;
2717 }
2718
2719 list_add_tail_rcu(&rule->list, &old_rule->list);
2720 } else {
2721 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2722 err = -ENOMEM;
2723 goto err2;
2724 }
2725
2726 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2727 if (old_rule)
2728 list_add_rcu(&rule->list, &old_rule->list);
2729 else
2730 list_add_tail_rcu(&rule->list, &chain->rules);
2731 } else {
2732 if (old_rule)
2733 list_add_tail_rcu(&rule->list, &old_rule->list);
2734 else
2735 list_add_rcu(&rule->list, &chain->rules);
2736 }
0628b123 2737 }
2a43ecf9 2738 kvfree(info);
4fefee57 2739 chain->use++;
96518518 2740
a654de8f
PNA		 2741 if (net->nft.validate_state == NFT_VALIDATE_DO)
2742 return nft_table_validate(net, table);
2743
2744 return 0;
96518518 2745err2:
bb7b40ae 2746 nf_tables_rule_release(&ctx, rule);
96518518
PM		 2747err1:
2748 for (i = 0; i < n; i++) {
2749 if (info[i].ops != NULL)
ef1f7df9 2750 module_put(info[i].ops->type->owner);
96518518 2751 }
2a43ecf9 2752 kvfree(info);
96518518
PM		 2753 return err;
2754}
2755
1a94e38d
PNA		 2756static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2757 const struct nlattr *nla)
2758{
2759 u32 id = ntohl(nla_get_be32(nla));
2760 struct nft_trans *trans;
2761
2762 list_for_each_entry(trans, &net->nft.commit_list, list) {
2763 struct nft_rule *rule = nft_trans_rule(trans);
2764
2765 if (trans->msg_type == NFT_MSG_NEWRULE &&
2766 id == nft_trans_rule_id(trans))
2767 return rule;
2768 }
2769 return ERR_PTR(-ENOENT);
2770}
2771
633c9a84
PNA		 2772static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2773 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2774 const struct nlattr * const nla[],
2775 struct netlink_ext_ack *extack)
96518518
PM		 2776{
2777 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2778 u8 genmask = nft_genmask_next(net);
7c95f6d8 2779 struct nft_table *table;
cf9dc09d
PNA		 2780 struct nft_chain *chain = NULL;
2781 struct nft_rule *rule;
0628b123
PNA		 2782 int family = nfmsg->nfgen_family, err = 0;
2783 struct nft_ctx ctx;
96518518 2784
cac20fcd 2785 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2786 if (IS_ERR(table)) {
2787 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2788 return PTR_ERR(table);
36dd1bcc 2789 }
96518518 2790
cf9dc09d 2791 if (nla[NFTA_RULE_CHAIN]) {
f102d66b
FW		 2792 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
2793 genmask);
36dd1bcc
PNA		 2794 if (IS_ERR(chain)) {
2795 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 2796 return PTR_ERR(chain);
36dd1bcc 2797 }
cf9dc09d 2798 }
96518518 2799
98319cb9 2800 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 2801
cf9dc09d
PNA		 2802 if (chain) {
2803 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 2804 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2805 if (IS_ERR(rule)) {
2806 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 2807 return PTR_ERR(rule);
36dd1bcc 2808 }
96518518 2809
1a94e38d
PNA		 2810 err = nft_delrule(&ctx, rule);
2811 } else if (nla[NFTA_RULE_ID]) {
2812 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 2813 if (IS_ERR(rule)) {
2814 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 2815 return PTR_ERR(rule);
36dd1bcc 2816 }
1a94e38d 2817
5e266fe7 2818 err = nft_delrule(&ctx, rule);
cf9dc09d 2819 } else {
ce24b721 2820 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2821 }
2822 } else {
2823 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2824 if (!nft_is_active_next(net, chain))
2825 continue;
2826
cf9dc09d 2827 ctx.chain = chain;
ce24b721 2828 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2829 if (err < 0)
2830 break;
2831 }
2832 }
2833
2834 return err;
2835}
2836
20a69341
PM		 2837/*
2838 * Sets
2839 */
2840
2b664957 2841static LIST_HEAD(nf_tables_set_types);
20a69341 2842
2b664957 2843int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2844{
2845 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2846 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2847 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2848 return 0;
2849}
2850EXPORT_SYMBOL_GPL(nft_register_set);
2851
2b664957 2852void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2853{
2854 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2855 list_del_rcu(&type->list);
20a69341
PM		 2856 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2857}
2858EXPORT_SYMBOL_GPL(nft_unregister_set);
2859
2b664957 2860#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 2861 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
2862 NFT_SET_EVAL)
2b664957 2863
71cc0873 2864static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 2865{
71cc0873 2866 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 2867}
2868
c50b960c
PM		 2869/*
2870 * Select a set implementation based on the data characteristics and the
2871 * given policy. The total memory use might not be known if no size is
2872 * given, in that case the amount of memory per element is used.
2873 */
2874static const struct nft_set_ops *
2b664957
PNA		 2875nft_select_set_ops(const struct nft_ctx *ctx,
2876 const struct nlattr * const nla[],
c50b960c
PM		 2877 const struct nft_set_desc *desc,
2878 enum nft_set_policies policy)
20a69341 2879{
c50b960c
PM		 2880 const struct nft_set_ops *ops, *bops;
2881 struct nft_set_estimate est, best;
2b664957
PNA		 2882 const struct nft_set_type *type;
2883 u32 flags = 0;
20a69341 2884
f102d66b
FW		 2885 lockdep_assert_held(&ctx->net->nft.commit_mutex);
2886 lockdep_nfnl_nft_mutex_not_held();
20a69341 2887#ifdef CONFIG_MODULES
2b664957 2888 if (list_empty(&nf_tables_set_types)) {
452238e8 2889 nft_request_module(ctx->net, "nft-set");
2b664957 2890 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2891 return ERR_PTR(-EAGAIN);
2892 }
2893#endif
2b664957
PNA		 2894 if (nla[NFTA_SET_FLAGS] != NULL)
2895 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2896
55af753c
PNA		 2897 bops = NULL;
2898 best.size = ~0;
2899 best.lookup = ~0;
0b5a7874 2900 best.space = ~0;
c50b960c 2901
2b664957 2902 list_for_each_entry(type, &nf_tables_set_types, list) {
71cc0873 2903 ops = &type->ops;
2b664957 2904
71cc0873 2905 if (!nft_set_ops_candidate(type, flags))
20a69341 2906 continue;
2b664957 2907 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2908 continue;
2909
2910 switch (policy) {
2911 case NFT_SET_POL_PERFORMANCE:
55af753c 2912 if (est.lookup < best.lookup)
c50b960c 2913 break;
644e334e
PNA		 2914 if (est.lookup == best.lookup &&
2915 est.space < best.space)
2916 break;
c50b960c
PM		 2917 continue;
2918 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2919 if (!desc->size) {
2920 if (est.space < best.space)
2921 break;
2922 if (est.space == best.space &&
2923 est.lookup < best.lookup)
2924 break;
4f2921ca 2925 } else if (est.size < best.size || !bops) {
c50b960c 2926 break;
0b5a7874 2927 }
c50b960c
PM		 2928 continue;
2929 default:
2930 break;
2931 }
2932
2b664957 2933 if (!try_module_get(type->owner))
20a69341 2934 continue;
c50b960c 2935 if (bops != NULL)
71cc0873 2936 module_put(to_set_type(bops)->owner);
c50b960c
PM		 2937
2938 bops = ops;
2939 best = est;
20a69341
PM		 2940 }
2941
c50b960c
PM		 2942 if (bops != NULL)
2943 return bops;
2944
20a69341
PM		 2945 return ERR_PTR(-EOPNOTSUPP);
2946}
2947
2948static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2949 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2950 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2951 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2952 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2953 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2954 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2955 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2956 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2957 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2958 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2959 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2960 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2961 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2962 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2963 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2964 .len = NFT_USERDATA_MAXLEN },
8aeff920 2965 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 2966 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 2967};
2968
2969static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2970 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2971};
2972
633c9a84 2973static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2974 const struct sk_buff *skb,
2975 const struct nlmsghdr *nlh,
f2a6d766 2976 const struct nlattr * const nla[],
36dd1bcc 2977 struct netlink_ext_ack *extack,
f2a6d766 2978 u8 genmask)
20a69341
PM		 2979{
2980 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 2981 int family = nfmsg->nfgen_family;
7c95f6d8 2982 struct nft_table *table = NULL;
20a69341 2983
20a69341 2984 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 2985 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
2986 genmask);
36dd1bcc
PNA		 2987 if (IS_ERR(table)) {
2988 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 2989 return PTR_ERR(table);
36dd1bcc 2990 }
20a69341
PM		 2991 }
2992
98319cb9 2993 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 2994 return 0;
2995}
2996
cac20fcd
PNA		 2997static struct nft_set *nft_set_lookup(const struct nft_table *table,
2998 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2999{
3000 struct nft_set *set;
3001
3002 if (nla == NULL)
3003 return ERR_PTR(-EINVAL);
3004
d9adf22a 3005 list_for_each_entry_rcu(set, &table->sets, list) {
37a9cc52
PNA		 3006 if (!nla_strcmp(nla, set->name) &&
3007 nft_active_genmask(set, genmask))
20a69341
PM		 3008 return set;
3009 }
3010 return ERR_PTR(-ENOENT);
3011}
3012
cac20fcd
PNA		 3013static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3014 const struct nlattr *nla,
3015 u8 genmask)
3ecbfd65
HS		 3016{
3017 struct nft_set *set;
3018
3ecbfd65
HS		 3019 list_for_each_entry(set, &table->sets, list) {
3020 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3021 nft_active_genmask(set, genmask))
3022 return set;
3023 }
3024 return ERR_PTR(-ENOENT);
3025}
3026
cac20fcd
PNA		 3027static struct nft_set *nft_set_lookup_byid(const struct net *net,
3028 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 3029{
3030 struct nft_trans *trans;
3031 u32 id = ntohl(nla_get_be32(nla));
3032
3033 list_for_each_entry(trans, &net->nft.commit_list, list) {
9c7f96fd
AK		 3034 if (trans->msg_type == NFT_MSG_NEWSET) {
3035 struct nft_set *set = nft_trans_set(trans);
37a9cc52 3036
9c7f96fd
AK		 3037 if (id == nft_trans_set_id(trans) &&
3038 nft_active_genmask(set, genmask))
3039 return set;
3040 }
958bee14
PNA		 3041 }
3042 return ERR_PTR(-ENOENT);
3043}
c7a72e3f 3044
10659cba
PNA		 3045struct nft_set *nft_set_lookup_global(const struct net *net,
3046 const struct nft_table *table,
3047 const struct nlattr *nla_set_name,
3048 const struct nlattr *nla_set_id,
3049 u8 genmask)
c7a72e3f
PNA		 3050{
3051 struct nft_set *set;
3052
cac20fcd 3053 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 3054 if (IS_ERR(set)) {
3055 if (!nla_set_id)
3056 return set;
3057
cac20fcd 3058 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 3059 }
3060 return set;
3061}
10659cba 3062EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 3063
20a69341
PM		 3064static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3065 const char *name)
3066{
3067 const struct nft_set *i;
3068 const char *p;
3069 unsigned long *inuse;
60eb1894 3070 unsigned int n = 0, min = 0;
20a69341 3071
38745490 3072 p = strchr(name, '%');
20a69341
PM		 3073 if (p != NULL) {
3074 if (p[1] != 'd' || strchr(p + 2, '%'))
3075 return -EINVAL;
3076
3077 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3078 if (inuse == NULL)
3079 return -ENOMEM;
60eb1894 3080cont:
20a69341 3081 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 3082 int tmp;
3083
37a9cc52
PNA		 3084 if (!nft_is_active_next(ctx->net, set))
3085 continue;
14662917 3086 if (!sscanf(i->name, name, &tmp))
20a69341 3087 continue;
60eb1894 3088 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 3089 continue;
14662917 3090
60eb1894 3091 set_bit(tmp - min, inuse);
20a69341
PM		 3092 }
3093
53b70287 3094 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 3095 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3096 min += BITS_PER_BYTE * PAGE_SIZE;
3097 memset(inuse, 0, PAGE_SIZE);
3098 goto cont;
3099 }
20a69341
PM		 3100 free_page((unsigned long)inuse);
3101 }
3102
38745490
PS		 3103 set->name = kasprintf(GFP_KERNEL, name, min + n);
3104 if (!set->name)
3105 return -ENOMEM;
3106
20a69341 3107 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 3108 if (!nft_is_active_next(ctx->net, i))
3109 continue;
e63aaaa6
AY		 3110 if (!strcmp(set->name, i->name)) {
3111 kfree(set->name);
20a69341 3112 return -ENFILE;
e63aaaa6 3113 }
20a69341
PM		 3114 }
3115 return 0;
3116}
3117
8e1102d5
FW		 3118static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3119{
3120 u64 ms = be64_to_cpu(nla_get_be64(nla));
3121 u64 max = (u64)(~((u64)0));
3122
3123 max = div_u64(max, NSEC_PER_MSEC);
3124 if (ms >= max)
3125 return -ERANGE;
3126
3127 ms *= NSEC_PER_MSEC;
3128 *result = nsecs_to_jiffies64(ms);
3129 return 0;
3130}
3131
d6501de8 3132static __be64 nf_jiffies64_to_msecs(u64 input)
8e1102d5
FW		 3133{
3134 u64 ms = jiffies64_to_nsecs(input);
3135
3136 return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
3137}
3138
20a69341
PM		 3139static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3140 const struct nft_set *set, u16 event, u16 flags)
3141{
3142 struct nfgenmsg *nfmsg;
3143 struct nlmsghdr *nlh;
c50b960c 3144 struct nlattr *desc;
128ad332
PNA		 3145 u32 portid = ctx->portid;
3146 u32 seq = ctx->seq;
20a69341 3147
dedb67c4 3148 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 3149 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3150 flags);
3151 if (nlh == NULL)
3152 goto nla_put_failure;
3153
3154 nfmsg = nlmsg_data(nlh);
36596dad 3155 nfmsg->nfgen_family = ctx->family;
20a69341 3156 nfmsg->version = NFNETLINK_V0;
84d7fce6 3157 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 3158
3159 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3160 goto nla_put_failure;
3161 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3162 goto nla_put_failure;
3ecbfd65
HS		 3163 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3164 NFTA_SET_PAD))
3165 goto nla_put_failure;
20a69341
PM		 3166 if (set->flags != 0)
3167 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3168 goto nla_put_failure;
3169
3170 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3171 goto nla_put_failure;
3172 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3173 goto nla_put_failure;
3174 if (set->flags & NFT_SET_MAP) {
3175 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3176 goto nla_put_failure;
3177 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3178 goto nla_put_failure;
3179 }
8aeff920
PNA		 3180 if (set->flags & NFT_SET_OBJECT &&
3181 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3182 goto nla_put_failure;
20a69341 3183
761da293 3184 if (set->timeout &&
d3e2a111 3185 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 3186 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 3187 NFTA_SET_PAD))
761da293
PM		 3188 goto nla_put_failure;
3189 if (set->gc_int &&
3190 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3191 goto nla_put_failure;
3192
9363dc4b
AB		 3193 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3194 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3195 goto nla_put_failure;
3196 }
3197
e6d8ecac
CFG		 3198 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3199 goto nla_put_failure;
3200
c50b960c
PM		 3201 desc = nla_nest_start(skb, NFTA_SET_DESC);
3202 if (desc == NULL)
3203 goto nla_put_failure;
3204 if (set->size &&
3205 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3206 goto nla_put_failure;
3207 nla_nest_end(skb, desc);
3208
053c095a
JB		 3209 nlmsg_end(skb, nlh);
3210 return 0;
20a69341
PM		 3211
3212nla_put_failure:
3213 nlmsg_trim(skb, nlh);
3214 return -1;
3215}
3216
25e94a99
PNA		 3217static void nf_tables_set_notify(const struct nft_ctx *ctx,
3218 const struct nft_set *set, int event,
3219 gfp_t gfp_flags)
20a69341
PM		 3220{
3221 struct sk_buff *skb;
128ad332 3222 u32 portid = ctx->portid;
20a69341
PM		 3223 int err;
3224
128ad332
PNA		 3225 if (!ctx->report &&
3226 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 3227 return;
20a69341 3228
31f8441c 3229 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 3230 if (skb == NULL)
3231 goto err;
3232
3233 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3234 if (err < 0) {
3235 kfree_skb(skb);
3236 goto err;
3237 }
3238
25e94a99
PNA		 3239 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3240 gfp_flags);
3241 return;
20a69341 3242err:
25e94a99 3243 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 3244}
3245
5b96af77 3246static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 3247{
3248 const struct nft_set *set;
3249 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 3250 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3251 struct net *net = sock_net(skb->sk);
5b96af77 3252 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 3253
3254 if (cb->args[1])
3255 return skb->len;
3256
e688a7f8 3257 rcu_read_lock();
38e029f1
PNA		 3258 cb->seq = net->nft.base_seq;
3259
36596dad
PNA		 3260 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3261 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 3262 ctx->family != table->family)
36596dad
PNA		 3263 continue;
3264
3265 if (ctx->table && ctx->table != table)
5b96af77
PNA		 3266 continue;
3267
36596dad
PNA		 3268 if (cur_table) {
3269 if (cur_table != table)
c9c8e485
PNA		 3270 continue;
3271
36596dad 3272 cur_table = NULL;
c9c8e485 3273 }
36596dad
PNA		 3274 idx = 0;
3275 list_for_each_entry_rcu(set, &table->sets, list) {
3276 if (idx < s_idx)
3277 goto cont;
3278 if (!nft_is_active(net, set))
3279 goto cont;
5b96af77 3280
36596dad
PNA		 3281 ctx_set = *ctx;
3282 ctx_set.table = table;
98319cb9 3283 ctx_set.family = table->family;
c9c8e485 3284
36596dad
PNA		 3285 if (nf_tables_fill_set(skb, &ctx_set, set,
3286 NFT_MSG_NEWSET,
3287 NLM_F_MULTI) < 0) {
3288 cb->args[0] = idx;
3289 cb->args[2] = (unsigned long) table;
3290 goto done;
c9c8e485 3291 }
36596dad 3292 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 3293cont:
36596dad 3294 idx++;
c9c8e485 3295 }
36596dad
PNA		 3296 if (s_idx)
3297 s_idx = 0;
c9c8e485
PNA		 3298 }
3299 cb->args[1] = 1;
3300done:
e688a7f8 3301 rcu_read_unlock();
c9c8e485
PNA		 3302 return skb->len;
3303}
3304
90fd131a
FW		 3305static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3306{
3307 struct nft_ctx *ctx_dump = NULL;
3308
3309 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3310 if (ctx_dump == NULL)
3311 return -ENOMEM;
3312
3313 cb->data = ctx_dump;
3314 return 0;
3315}
3316
5b96af77 3317static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 3318{
5b96af77
PNA		 3319 kfree(cb->data);
3320 return 0;
20a69341
PM		 3321}
3322
d9adf22a 3323/* called with rcu_read_lock held */
7b8002a1
PNA		 3324static int nf_tables_getset(struct net *net, struct sock *nlsk,
3325 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3326 const struct nlattr * const nla[],
3327 struct netlink_ext_ack *extack)
20a69341 3328{
f2a6d766 3329 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3330 const struct nft_set *set;
3331 struct nft_ctx ctx;
3332 struct sk_buff *skb2;
c9c8e485 3333 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 3334 int err;
3335
01cfa0a4 3336 /* Verify existence before starting dump */
36dd1bcc
PNA		 3337 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3338 genmask);
20a69341
PM		 3339 if (err < 0)
3340 return err;
3341
3342 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3343 struct netlink_dump_control c = {
90fd131a 3344 .start = nf_tables_dump_sets_start,
20a69341 3345 .dump = nf_tables_dump_sets,
5b96af77 3346 .done = nf_tables_dump_sets_done,
90fd131a 3347 .data = &ctx,
d9adf22a 3348 .module = THIS_MODULE,
20a69341 3349 };
5b96af77 3350
d9adf22a 3351 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
20a69341
PM		 3352 }
3353
c9c8e485
PNA		 3354 /* Only accept unspec with dump */
3355 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3356 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3357 if (!nla[NFTA_SET_TABLE])
3358 return -EINVAL;
c9c8e485 3359
cac20fcd 3360 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3361 if (IS_ERR(set))
3362 return PTR_ERR(set);
3363
d9adf22a 3364 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
20a69341
PM		 3365 if (skb2 == NULL)
3366 return -ENOMEM;
3367
3368 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3369 if (err < 0)
3370 goto err;
3371
3372 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3373
3374err:
3375 kfree_skb(skb2);
3376 return err;
3377}
3378
c50b960c
PM		 3379static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3380 struct nft_set_desc *desc,
3381 const struct nlattr *nla)
3382{
3383 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3384 int err;
3385
fceb6435
JB		 3386 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3387 nft_set_desc_policy, NULL);
c50b960c
PM		 3388 if (err < 0)
3389 return err;
3390
3391 if (da[NFTA_SET_DESC_SIZE] != NULL)
3392 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3393
3394 return 0;
3395}
3396
633c9a84
PNA		 3397static int nf_tables_newset(struct net *net, struct sock *nlsk,
3398 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3399 const struct nlattr * const nla[],
3400 struct netlink_ext_ack *extack)
20a69341
PM		 3401{
3402 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3403 u8 genmask = nft_genmask_next(net);
98319cb9 3404 int family = nfmsg->nfgen_family;
20a69341 3405 const struct nft_set_ops *ops;
20a69341
PM		 3406 struct nft_table *table;
3407 struct nft_set *set;
3408 struct nft_ctx ctx;
38745490 3409 char *name;
4ef360dd 3410 u64 size;
761da293 3411 u64 timeout;
8aeff920 3412 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3413 struct nft_set_desc desc;
e6d8ecac
CFG		 3414 unsigned char *udata;
3415 u16 udlen;
20a69341
PM		 3416 int err;
3417
3418 if (nla[NFTA_SET_TABLE] == NULL ||
3419 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3420 nla[NFTA_SET_KEY_LEN] == NULL ||
3421 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3422 return -EINVAL;
3423
c50b960c
PM		 3424 memset(&desc, 0, sizeof(desc));
3425
20a69341
PM		 3426 ktype = NFT_DATA_VALUE;
3427 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3428 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3429 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3430 return -EINVAL;
3431 }
3432
c50b960c 3433 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3434 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3435 return -EINVAL;
3436
3437 flags = 0;
3438 if (nla[NFTA_SET_FLAGS] != NULL) {
3439 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3440 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3441 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3442 NFT_SET_MAP | NFT_SET_EVAL |
3443 NFT_SET_OBJECT))
20a69341 3444 return -EINVAL;
8aeff920
PNA		 3445 /* Only one of these operations is supported */
3446 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3447 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3448 return -EOPNOTSUPP;
20a69341
PM		 3449 }
3450
3451 dtype = 0;
20a69341
PM		 3452 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3453 if (!(flags & NFT_SET_MAP))
3454 return -EINVAL;
3455
3456 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3457 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3458 dtype != NFT_DATA_VERDICT)
3459 return -EINVAL;
3460
3461 if (dtype != NFT_DATA_VERDICT) {
3462 if (nla[NFTA_SET_DATA_LEN] == NULL)
3463 return -EINVAL;
c50b960c 3464 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3465 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3466 return -EINVAL;
3467 } else
7d740264 3468 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3469 } else if (flags & NFT_SET_MAP)
3470 return -EINVAL;
3471
8aeff920
PNA		 3472 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3473 if (!(flags & NFT_SET_OBJECT))
3474 return -EINVAL;
3475
3476 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3477 if (objtype == NFT_OBJECT_UNSPEC ||
3478 objtype > NFT_OBJECT_MAX)
3479 return -EINVAL;
3480 } else if (flags & NFT_SET_OBJECT)
3481 return -EINVAL;
3482 else
3483 objtype = NFT_OBJECT_UNSPEC;
3484
761da293
PM		 3485 timeout = 0;
3486 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3487 if (!(flags & NFT_SET_TIMEOUT))
3488 return -EINVAL;
8e1102d5
FW		 3489
3490 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3491 if (err)
3492 return err;
761da293
PM		 3493 }
3494 gc_int = 0;
3495 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3496 if (!(flags & NFT_SET_TIMEOUT))
3497 return -EINVAL;
3498 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3499 }
3500
c50b960c
PM		 3501 policy = NFT_SET_POL_PERFORMANCE;
3502 if (nla[NFTA_SET_POLICY] != NULL)
3503 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3504
3505 if (nla[NFTA_SET_DESC] != NULL) {
3506 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3507 if (err < 0)
3508 return err;
3509 }
3510
cac20fcd 3511 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 3512 if (IS_ERR(table)) {
3513 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3514 return PTR_ERR(table);
36dd1bcc 3515 }
20a69341 3516
98319cb9 3517 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3518
cac20fcd 3519 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 3520 if (IS_ERR(set)) {
36dd1bcc
PNA		 3521 if (PTR_ERR(set) != -ENOENT) {
3522 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3523 return PTR_ERR(set);
36dd1bcc 3524 }
1a28ad74 3525 } else {
36dd1bcc
PNA		 3526 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3527 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3528 return -EEXIST;
36dd1bcc 3529 }
20a69341
PM		 3530 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3531 return -EOPNOTSUPP;
36dd1bcc 3532
20a69341
PM		 3533 return 0;
3534 }
3535
3536 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3537 return -ENOENT;
3538
2b664957 3539 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3540 if (IS_ERR(ops))
3541 return PTR_ERR(ops);
3542
e6d8ecac
CFG		 3543 udlen = 0;
3544 if (nla[NFTA_SET_USERDATA])
3545 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3546
20a69341
PM		 3547 size = 0;
3548 if (ops->privsize != NULL)
347b408d 3549 size = ops->privsize(nla, &desc);
20a69341 3550
1ff75a3e
PNA		 3551 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3552 if (!set) {
3553 err = -ENOMEM;
20a69341 3554 goto err1;
1ff75a3e 3555 }
20a69341 3556
38745490
PS		 3557 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3558 if (!name) {
3559 err = -ENOMEM;
3560 goto err2;
3561 }
3562
20a69341 3563 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3564 kfree(name);
20a69341
PM		 3565 if (err < 0)
3566 goto err2;
3567
e6d8ecac
CFG		 3568 udata = NULL;
3569 if (udlen) {
3570 udata = set->data + size;
3571 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3572 }
3573
20a69341 3574 INIT_LIST_HEAD(&set->bindings);
3453c927
PNA		 3575 set->table = table;
3576 write_pnet(&set->net, net);
20a69341
PM		 3577 set->ops = ops;
3578 set->ktype = ktype;
c50b960c 3579 set->klen = desc.klen;
20a69341 3580 set->dtype = dtype;
8aeff920 3581 set->objtype = objtype;
c50b960c 3582 set->dlen = desc.dlen;
20a69341 3583 set->flags = flags;
c50b960c 3584 set->size = desc.size;
9363dc4b 3585 set->policy = policy;
e6d8ecac
CFG		 3586 set->udlen = udlen;
3587 set->udata = udata;
761da293
PM		 3588 set->timeout = timeout;
3589 set->gc_int = gc_int;
3ecbfd65 3590 set->handle = nf_tables_alloc_handle(table);
20a69341 3591
c50b960c 3592 err = ops->init(set, &desc, nla);
20a69341 3593 if (err < 0)
2f6adf48 3594 goto err3;
20a69341 3595
958bee14 3596 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3597 if (err < 0)
2f6adf48 3598 goto err4;
20a69341 3599
e688a7f8 3600 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3601 table->use++;
20a69341
PM		 3602 return 0;
3603
2f6adf48 3604err4:
c17c3cdf 3605 ops->destroy(set);
2f6adf48
FW		 3606err3:
3607 kfree(set->name);
20a69341 3608err2:
1ff75a3e 3609 kvfree(set);
20a69341 3610err1:
71cc0873 3611 module_put(to_set_type(ops)->owner);
20a69341
PM		 3612 return err;
3613}
3614
958bee14 3615static void nft_set_destroy(struct nft_set *set)
20a69341 3616{
20a69341 3617 set->ops->destroy(set);
71cc0873 3618 module_put(to_set_type(set->ops)->owner);
38745490 3619 kfree(set->name);
1ff75a3e 3620 kvfree(set);
20a69341
PM		 3621}
3622
633c9a84
PNA		 3623static int nf_tables_delset(struct net *net, struct sock *nlsk,
3624 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3625 const struct nlattr * const nla[],
3626 struct netlink_ext_ack *extack)
20a69341 3627{
c9c8e485 3628 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3629 u8 genmask = nft_genmask_next(net);
36dd1bcc 3630 const struct nlattr *attr;
20a69341
PM		 3631 struct nft_set *set;
3632 struct nft_ctx ctx;
3633 int err;
3634
ec2c9935
PM		 3635 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3636 return -EAFNOSUPPORT;
20a69341
PM		 3637 if (nla[NFTA_SET_TABLE] == NULL)
3638 return -EINVAL;
3639
36dd1bcc
PNA		 3640 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3641 genmask);
20a69341
PM		 3642 if (err < 0)
3643 return err;
3644
36dd1bcc
PNA		 3645 if (nla[NFTA_SET_HANDLE]) {
3646 attr = nla[NFTA_SET_HANDLE];
3647 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3648 } else {
3649 attr = nla[NFTA_SET_NAME];
3650 set = nft_set_lookup(ctx.table, attr, genmask);
3651 }
a8278400 3652
36dd1bcc
PNA		 3653 if (IS_ERR(set)) {
3654 NL_SET_BAD_ATTR(extack, attr);
3655 return PTR_ERR(set);
3656 }
a8278400 3657 if (!list_empty(&set->bindings) ||
36dd1bcc
PNA		 3658 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3659 NL_SET_BAD_ATTR(extack, attr);
20a69341 3660 return -EBUSY;
36dd1bcc 3661 }
20a69341 3662
ee01d542 3663 return nft_delset(&ctx, set);
20a69341
PM		 3664}
3665
3666static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3667 struct nft_set *set,
20a69341 3668 const struct nft_set_iter *iter,
de70185d 3669 struct nft_set_elem *elem)
20a69341 3670{
fe2811eb 3671 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3672 enum nft_registers dreg;
3673
3674 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3675 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3676 set->dtype == NFT_DATA_VERDICT ?
3677 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3678 set->dlen);
20a69341
PM		 3679}
3680
3681int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3682 struct nft_set_binding *binding)
3683{
3684 struct nft_set_binding *i;
3685 struct nft_set_iter iter;
3686
408070d6 3687 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3688 return -EBUSY;
3689
11113e19 3690 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3691 /* If the set is already bound to the same chain all
3692 * jumps are already validated for that chain.
3693 */
3694 list_for_each_entry(i, &set->bindings, list) {
a4684402 3695 if (i->flags & NFT_SET_MAP &&
11113e19 3696 i->chain == binding->chain)
20a69341
PM		 3697 goto bind;
3698 }
3699
8588ac09 3700 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3701 iter.skip = 0;
3702 iter.count = 0;
3703 iter.err = 0;
3704 iter.fn = nf_tables_bind_check_setelem;
3705
3706 set->ops->walk(ctx, set, &iter);
a02f4248 3707 if (iter.err < 0)
20a69341 3708 return iter.err;
20a69341
PM		 3709 }
3710bind:
3711 binding->chain = ctx->chain;
e688a7f8 3712 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3713 return 0;
3714}
63aea290 3715EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341 3716
cd5125d8 3717void nf_tables_rebind_set(const struct nft_ctx *ctx, struct nft_set *set,
20a69341 3718 struct nft_set_binding *binding)
cd5125d8
FW		 3719{
3720 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
3721 nft_is_active(ctx->net, set))
3722 list_add_tail_rcu(&set->list, &ctx->table->sets);
3723
3724 list_add_tail_rcu(&binding->list, &set->bindings);
3725}
3726EXPORT_SYMBOL_GPL(nf_tables_rebind_set);
3727
3728void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3729 struct nft_set_binding *binding)
20a69341 3730{
e688a7f8 3731 list_del_rcu(&binding->list);
20a69341 3732
408070d6 3733 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
37a9cc52 3734 nft_is_active(ctx->net, set))
cd5125d8 3735 list_del_rcu(&set->list);
20a69341 3736}
63aea290 3737EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3738
cd5125d8
FW		 3739void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
3740{
3741 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
3742 nft_is_active(ctx->net, set)) {
3743 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
3744 nft_set_destroy(set);
3745 }
3746}
3747EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
3748
3ac4c07a
PM		 3749const struct nft_set_ext_type nft_set_ext_types[] = {
3750 [NFT_SET_EXT_KEY] = {
7d740264 3751 .align = __alignof__(u32),
3ac4c07a
PM		 3752 },
3753 [NFT_SET_EXT_DATA] = {
7d740264 3754 .align = __alignof__(u32),
3ac4c07a 3755 },
f25ad2e9
PM		 3756 [NFT_SET_EXT_EXPR] = {
3757 .align = __alignof__(struct nft_expr),
3758 },
8aeff920
PNA		 3759 [NFT_SET_EXT_OBJREF] = {
3760 .len = sizeof(struct nft_object *),
3761 .align = __alignof__(struct nft_object *),
3762 },
3ac4c07a
PM		 3763 [NFT_SET_EXT_FLAGS] = {
3764 .len = sizeof(u8),
3765 .align = __alignof__(u8),
3766 },
c3e1b005
PM		 3767 [NFT_SET_EXT_TIMEOUT] = {
3768 .len = sizeof(u64),
3769 .align = __alignof__(u64),
3770 },
3771 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 3772 .len = sizeof(u64),
3773 .align = __alignof__(u64),
c3e1b005 3774 },
68e942e8
PM		 3775 [NFT_SET_EXT_USERDATA] = {
3776 .len = sizeof(struct nft_userdata),
3777 .align = __alignof__(struct nft_userdata),
3778 },
3ac4c07a
PM		 3779};
3780EXPORT_SYMBOL_GPL(nft_set_ext_types);
3781
20a69341
PM		 3782/*
3783 * Set elements
3784 */
3785
3786static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3787 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3788 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3789 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3790 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3791 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3792 .len = NFT_USERDATA_MAXLEN },
467697d2
FW		 3793 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3794 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
20a69341
PM		 3795};
3796
3797static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3798 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3799 .len = NFT_TABLE_MAXNAMELEN - 1 },
3800 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3801 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3802 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3803 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3804};
3805
633c9a84 3806static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3807 const struct sk_buff *skb,
3808 const struct nlmsghdr *nlh,
f2a6d766 3809 const struct nlattr * const nla[],
36dd1bcc 3810 struct netlink_ext_ack *extack,
f2a6d766 3811 u8 genmask)
20a69341
PM		 3812{
3813 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3814 int family = nfmsg->nfgen_family;
7c95f6d8 3815 struct nft_table *table;
20a69341 3816
cac20fcd
PNA		 3817 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3818 genmask);
36dd1bcc
PNA		 3819 if (IS_ERR(table)) {
3820 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 3821 return PTR_ERR(table);
36dd1bcc 3822 }
20a69341 3823
98319cb9 3824 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3825 return 0;
3826}
3827
3828static int nf_tables_fill_setelem(struct sk_buff *skb,
3829 const struct nft_set *set,
3830 const struct nft_set_elem *elem)
3831{
fe2811eb 3832 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3833 unsigned char *b = skb_tail_pointer(skb);
3834 struct nlattr *nest;
3835
3836 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3837 if (nest == NULL)
3838 goto nla_put_failure;
3839
fe2811eb
PM		 3840 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3841 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3842 goto nla_put_failure;
3843
fe2811eb
PM		 3844 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3845 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3846 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3847 set->dlen) < 0)
3848 goto nla_put_failure;
3849
f25ad2e9
PM		 3850 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3851 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3852 goto nla_put_failure;
3853
8aeff920
PNA		 3854 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3855 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3856 (*nft_set_ext_obj(ext))->name) < 0)
3857 goto nla_put_failure;
3858
fe2811eb
PM		 3859 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3860 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3861 htonl(*nft_set_ext_flags(ext))))
3862 goto nla_put_failure;
20a69341 3863
c3e1b005
PM		 3864 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3865 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 3866 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 3867 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3868 goto nla_put_failure;
3869
3870 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 3871 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 3872
3873 expires = *nft_set_ext_expiration(ext);
8e1102d5 3874 if (time_before64(now, expires))
c3e1b005
PM		 3875 expires -= now;
3876 else
3877 expires = 0;
3878
3879 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 3880 nf_jiffies64_to_msecs(expires),
b46f6ded 3881 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3882 goto nla_put_failure;
3883 }
3884
68e942e8
PM		 3885 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3886 struct nft_userdata *udata;
3887
3888 udata = nft_set_ext_userdata(ext);
3889 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3890 udata->len + 1, udata->data))
3891 goto nla_put_failure;
3892 }
3893
20a69341
PM		 3894 nla_nest_end(skb, nest);
3895 return 0;
3896
3897nla_put_failure:
3898 nlmsg_trim(skb, b);
3899 return -EMSGSIZE;
3900}
3901
3902struct nft_set_dump_args {
3903 const struct netlink_callback *cb;
3904 struct nft_set_iter iter;
3905 struct sk_buff *skb;
3906};
3907
3908static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3909 struct nft_set *set,
20a69341 3910 const struct nft_set_iter *iter,
de70185d 3911 struct nft_set_elem *elem)
20a69341
PM		 3912{
3913 struct nft_set_dump_args *args;
3914
3915 args = container_of(iter, struct nft_set_dump_args, iter);
3916 return nf_tables_fill_setelem(args->skb, set, elem);
3917}
3918
fa803605
LZ		 3919struct nft_set_dump_ctx {
3920 const struct nft_set *set;
3921 struct nft_ctx ctx;
3922};
3923
20a69341
PM		 3924static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3925{
fa803605 3926 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3927 struct net *net = sock_net(skb->sk);
fa803605 3928 struct nft_table *table;
de70185d 3929 struct nft_set *set;
20a69341 3930 struct nft_set_dump_args args;
fa803605 3931 bool set_found = false;
20a69341
PM		 3932 struct nfgenmsg *nfmsg;
3933 struct nlmsghdr *nlh;
3934 struct nlattr *nest;
3935 u32 portid, seq;
fa803605 3936 int event;
20a69341 3937
fa803605 3938 rcu_read_lock();
36596dad
PNA		 3939 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3940 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 3941 dump_ctx->ctx.family != table->family)
fa803605 3942 continue;
20a69341 3943
36596dad
PNA		 3944 if (table != dump_ctx->ctx.table)
3945 continue;
20a69341 3946
36596dad
PNA		 3947 list_for_each_entry_rcu(set, &table->sets, list) {
3948 if (set == dump_ctx->set) {
3949 set_found = true;
3950 break;
fa803605 3951 }
fa803605
LZ		 3952 }
3953 break;
3954 }
3955
3956 if (!set_found) {
3957 rcu_read_unlock();
3958 return -ENOENT;
3959 }
20a69341 3960
dedb67c4 3961 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3962 portid = NETLINK_CB(cb->skb).portid;
3963 seq = cb->nlh->nlmsg_seq;
3964
3965 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3966 NLM_F_MULTI);
3967 if (nlh == NULL)
3968 goto nla_put_failure;
3969
3970 nfmsg = nlmsg_data(nlh);
98319cb9 3971 nfmsg->nfgen_family = table->family;
20a69341 3972 nfmsg->version = NFNETLINK_V0;
fa803605 3973 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3974
fa803605 3975 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3976 goto nla_put_failure;
3977 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3978 goto nla_put_failure;
3979
3980 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3981 if (nest == NULL)
3982 goto nla_put_failure;
3983
8588ac09
PNA		 3984 args.cb = cb;
3985 args.skb = skb;
fa803605 3986 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3987 args.iter.skip = cb->args[0];
3988 args.iter.count = 0;
3989 args.iter.err = 0;
3990 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3991 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3992 rcu_read_unlock();
20a69341
PM		 3993
3994 nla_nest_end(skb, nest);
3995 nlmsg_end(skb, nlh);
3996
3997 if (args.iter.err && args.iter.err != -EMSGSIZE)
3998 return args.iter.err;
3999 if (args.iter.count == cb->args[0])
4000 return 0;
4001
4002 cb->args[0] = args.iter.count;
4003 return skb->len;
4004
4005nla_put_failure:
fa803605 4006 rcu_read_unlock();
20a69341
PM		 4007 return -ENOSPC;
4008}
4009
90fd131a
FW		 4010static int nf_tables_dump_set_start(struct netlink_callback *cb)
4011{
4012 struct nft_set_dump_ctx *dump_ctx = cb->data;
4013
4014 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4015
4016 return cb->data ? 0 : -ENOMEM;
4017}
4018
fa803605
LZ		 4019static int nf_tables_dump_set_done(struct netlink_callback *cb)
4020{
4021 kfree(cb->data);
4022 return 0;
4023}
4024
d60ce62f
AB		 4025static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4026 const struct nft_ctx *ctx, u32 seq,
4027 u32 portid, int event, u16 flags,
4028 const struct nft_set *set,
4029 const struct nft_set_elem *elem)
4030{
4031 struct nfgenmsg *nfmsg;
4032 struct nlmsghdr *nlh;
4033 struct nlattr *nest;
4034 int err;
4035
dedb67c4 4036 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 4037 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4038 flags);
4039 if (nlh == NULL)
4040 goto nla_put_failure;
4041
4042 nfmsg = nlmsg_data(nlh);
36596dad 4043 nfmsg->nfgen_family = ctx->family;
d60ce62f 4044 nfmsg->version = NFNETLINK_V0;
84d7fce6 4045 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 4046
4047 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4048 goto nla_put_failure;
4049 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4050 goto nla_put_failure;
4051
4052 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4053 if (nest == NULL)
4054 goto nla_put_failure;
4055
4056 err = nf_tables_fill_setelem(skb, set, elem);
4057 if (err < 0)
4058 goto nla_put_failure;
4059
4060 nla_nest_end(skb, nest);
4061
053c095a
JB		 4062 nlmsg_end(skb, nlh);
4063 return 0;
d60ce62f
AB		 4064
4065nla_put_failure:
4066 nlmsg_trim(skb, nlh);
4067 return -1;
4068}
4069
ba0e4d99
PNA		 4070static int nft_setelem_parse_flags(const struct nft_set *set,
4071 const struct nlattr *attr, u32 *flags)
4072{
4073 if (attr == NULL)
4074 return 0;
4075
4076 *flags = ntohl(nla_get_be32(attr));
4077 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4078 return -EINVAL;
4079 if (!(set->flags & NFT_SET_INTERVAL) &&
4080 *flags & NFT_SET_ELEM_INTERVAL_END)
4081 return -EINVAL;
4082
4083 return 0;
4084}
4085
4086static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4087 const struct nlattr *attr)
4088{
4089 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
ba0e4d99
PNA		 4090 struct nft_data_desc desc;
4091 struct nft_set_elem elem;
4092 struct sk_buff *skb;
4093 uint32_t flags = 0;
4094 void *priv;
4095 int err;
4096
4097 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4098 nft_set_elem_policy, NULL);
4099 if (err < 0)
4100 return err;
4101
4102 if (!nla[NFTA_SET_ELEM_KEY])
4103 return -EINVAL;
4104
4105 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4106 if (err < 0)
4107 return err;
4108
4109 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4110 nla[NFTA_SET_ELEM_KEY]);
4111 if (err < 0)
4112 return err;
4113
4114 err = -EINVAL;
4115 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4116 return err;
4117
4118 priv = set->ops->get(ctx->net, set, &elem, flags);
4119 if (IS_ERR(priv))
4120 return PTR_ERR(priv);
4121
4122 elem.priv = priv;
ba0e4d99
PNA		 4123
4124 err = -ENOMEM;
d9adf22a 4125 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
ba0e4d99
PNA		 4126 if (skb == NULL)
4127 goto err1;
4128
4129 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4130 NFT_MSG_NEWSETELEM, 0, set, &elem);
4131 if (err < 0)
4132 goto err2;
4133
4134 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4135 /* This avoids a loop in nfnetlink. */
4136 if (err < 0)
4137 goto err1;
4138
4139 return 0;
4140err2:
4141 kfree_skb(skb);
4142err1:
4143 /* this avoids a loop in nfnetlink. */
4144 return err == -EAGAIN ? -ENOBUFS : err;
4145}
4146
d9adf22a 4147/* called with rcu_read_lock held */
ba0e4d99
PNA		 4148static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4149 struct sk_buff *skb, const struct nlmsghdr *nlh,
4150 const struct nlattr * const nla[],
4151 struct netlink_ext_ack *extack)
4152{
4153 u8 genmask = nft_genmask_cur(net);
4154 struct nft_set *set;
4155 struct nlattr *attr;
4156 struct nft_ctx ctx;
4157 int rem, err = 0;
4158
36dd1bcc
PNA		 4159 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4160 genmask);
ba0e4d99
PNA		 4161 if (err < 0)
4162 return err;
4163
cac20fcd 4164 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 4165 if (IS_ERR(set))
4166 return PTR_ERR(set);
4167
4168 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4169 struct netlink_dump_control c = {
90fd131a 4170 .start = nf_tables_dump_set_start,
ba0e4d99
PNA		 4171 .dump = nf_tables_dump_set,
4172 .done = nf_tables_dump_set_done,
d9adf22a 4173 .module = THIS_MODULE,
ba0e4d99 4174 };
90fd131a
FW		 4175 struct nft_set_dump_ctx dump_ctx = {
4176 .set = set,
4177 .ctx = ctx,
4178 };
ba0e4d99 4179
90fd131a 4180 c.data = &dump_ctx;
d9adf22a 4181 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
ba0e4d99
PNA		 4182 }
4183
4184 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4185 return -EINVAL;
4186
4187 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4188 err = nft_get_set_elem(&ctx, set, attr);
4189 if (err < 0)
4190 break;
4191 }
4192
4193 return err;
4194}
4195
25e94a99
PNA		 4196static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4197 const struct nft_set *set,
4198 const struct nft_set_elem *elem,
4199 int event, u16 flags)
d60ce62f 4200{
128ad332
PNA		 4201 struct net *net = ctx->net;
4202 u32 portid = ctx->portid;
d60ce62f
AB		 4203 struct sk_buff *skb;
4204 int err;
4205
128ad332 4206 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4207 return;
d60ce62f 4208
d60ce62f
AB		 4209 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4210 if (skb == NULL)
4211 goto err;
4212
4213 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4214 set, elem);
4215 if (err < 0) {
4216 kfree_skb(skb);
4217 goto err;
4218 }
4219
25e94a99
PNA		 4220 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4221 GFP_KERNEL);
4222 return;
d60ce62f 4223err:
25e94a99 4224 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 4225}
4226
60319eb1
PNA		 4227static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4228 int msg_type,
4229 struct nft_set *set)
4230{
4231 struct nft_trans *trans;
4232
4233 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4234 if (trans == NULL)
4235 return NULL;
4236
4237 nft_trans_elem_set(trans) = set;
4238 return trans;
4239}
4240
22fe54d5
PM		 4241void *nft_set_elem_init(const struct nft_set *set,
4242 const struct nft_set_ext_tmpl *tmpl,
49499c3e 4243 const u32 *key, const u32 *data,
22fe54d5 4244 u64 timeout, gfp_t gfp)
fe2811eb
PM		 4245{
4246 struct nft_set_ext *ext;
4247 void *elem;
4248
4249 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4250 if (elem == NULL)
4251 return NULL;
4252
4253 ext = nft_set_elem_ext(set, elem);
4254 nft_set_ext_init(ext, tmpl);
4255
4256 memcpy(nft_set_ext_key(ext), key, set->klen);
4257 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4258 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 4259 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
4260 *nft_set_ext_expiration(ext) =
8e1102d5 4261 get_jiffies_64() + timeout;
c3e1b005
PM		 4262 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4263 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 4264
4265 return elem;
4266}
4267
61f9e292
LZ		 4268void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4269 bool destroy_expr)
61edafbb
PM		 4270{
4271 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3453c927
PNA		 4272 struct nft_ctx ctx = {
4273 .net = read_pnet(&set->net),
4274 .family = set->table->family,
4275 };
61edafbb 4276
59105446 4277 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 4278 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 4279 nft_data_release(nft_set_ext_data(ext), set->dtype);
371ebcbb
PNA		 4280 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4281 struct nft_expr *expr = nft_set_ext_expr(ext);
4282
4283 if (expr->ops->destroy_clone) {
4284 expr->ops->destroy_clone(&ctx, expr);
4285 module_put(expr->ops->type->owner);
4286 } else {
4287 nf_tables_expr_destroy(&ctx, expr);
4288 }
4289 }
8aeff920
PNA		 4290 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4291 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 4292 kfree(elem);
4293}
4294EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4295
59105446
PNA		 4296/* Only called from commit path, nft_set_elem_deactivate() already deals with
4297 * the refcounting from the preparation phase.
4298 */
3453c927
PNA		 4299static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4300 const struct nft_set *set, void *elem)
59105446
PNA		 4301{
4302 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4303
4304 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3453c927 4305 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
59105446
PNA		 4306 kfree(elem);
4307}
4308
60319eb1 4309static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 4310 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 4311{
4312 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 4313 u8 genmask = nft_genmask_next(ctx->net);
20a69341 4314 struct nft_data_desc d1, d2;
fe2811eb 4315 struct nft_set_ext_tmpl tmpl;
c016c7e4 4316 struct nft_set_ext *ext, *ext2;
20a69341
PM		 4317 struct nft_set_elem elem;
4318 struct nft_set_binding *binding;
8aeff920 4319 struct nft_object *obj = NULL;
68e942e8 4320 struct nft_userdata *udata;
fe2811eb 4321 struct nft_data data;
20a69341 4322 enum nft_registers dreg;
60319eb1 4323 struct nft_trans *trans;
0e9091d6 4324 u32 flags = 0;
c3e1b005 4325 u64 timeout;
68e942e8 4326 u8 ulen;
20a69341
PM		 4327 int err;
4328
4329 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4330 nft_set_elem_policy, NULL);
20a69341
PM		 4331 if (err < 0)
4332 return err;
4333
4334 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4335 return -EINVAL;
4336
fe2811eb
PM		 4337 nft_set_ext_prepare(&tmpl);
4338
0e9091d6
PNA		 4339 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4340 if (err < 0)
4341 return err;
4342 if (flags != 0)
4343 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 4344
4345 if (set->flags & NFT_SET_MAP) {
4346 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 4347 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 4348 return -EINVAL;
bd7fc645 4349 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 4350 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 4351 return -EINVAL;
20a69341
PM		 4352 } else {
4353 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4354 return -EINVAL;
4355 }
4356
c3e1b005
PM		 4357 timeout = 0;
4358 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4359 if (!(set->flags & NFT_SET_TIMEOUT))
4360 return -EINVAL;
8e1102d5
FW		 4361 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4362 &timeout);
4363 if (err)
4364 return err;
c3e1b005
PM		 4365 } else if (set->flags & NFT_SET_TIMEOUT) {
4366 timeout = set->timeout;
4367 }
4368
7d740264 4369 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 4370 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4371 if (err < 0)
4372 goto err1;
4373 err = -EINVAL;
4374 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4375 goto err2;
4376
7d740264 4377 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 4378 if (timeout > 0) {
4379 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4380 if (timeout != set->timeout)
4381 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4382 }
fe2811eb 4383
8aeff920
PNA		 4384 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4385 if (!(set->flags & NFT_SET_OBJECT)) {
4386 err = -EINVAL;
4387 goto err2;
4388 }
cac20fcd
PNA		 4389 obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
4390 set->objtype, genmask);
8aeff920
PNA		 4391 if (IS_ERR(obj)) {
4392 err = PTR_ERR(obj);
4393 goto err2;
4394 }
4395 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4396 }
4397
20a69341 4398 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 4399 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4400 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 4401 if (err < 0)
4402 goto err2;
4403
4404 err = -EINVAL;
4405 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4406 goto err3;
4407
4408 dreg = nft_type_to_reg(set->dtype);
4409 list_for_each_entry(binding, &set->bindings, list) {
4410 struct nft_ctx bind_ctx = {
58c78e10 4411 .net = ctx->net,
36596dad 4412 .family = ctx->family,
20a69341 4413 .table = ctx->table,
7c95f6d8 4414 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4415 };
4416
11113e19
PM		 4417 if (!(binding->flags & NFT_SET_MAP))
4418 continue;
4419
1ec10212
PM		 4420 err = nft_validate_register_store(&bind_ctx, dreg,
4421 &data,
4422 d2.type, d2.len);
20a69341
PM		 4423 if (err < 0)
4424 goto err3;
a654de8f
PNA		 4425
4426 if (d2.type == NFT_DATA_VERDICT &&
4427 (data.verdict.code == NFT_GOTO ||
4428 data.verdict.code == NFT_JUMP))
4429 nft_validate_state_update(ctx->net,
4430 NFT_VALIDATE_NEED);
20a69341 4431 }
fe2811eb 4432
7d740264 4433 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4434 }
4435
68e942e8
PM		 4436 /* The full maximum length of userdata can exceed the maximum
4437 * offset value (U8_MAX) for following extensions, therefor it
4438 * must be the last extension added.
4439 */
4440 ulen = 0;
4441 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4442 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4443 if (ulen > 0)
4444 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4445 ulen);
4446 }
4447
fe2811eb 4448 err = -ENOMEM;
7d740264 4449 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 4450 timeout, GFP_KERNEL);
fe2811eb
PM		 4451 if (elem.priv == NULL)
4452 goto err3;
4453
4454 ext = nft_set_elem_ext(set, elem.priv);
4455 if (flags)
4456 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4457 if (ulen > 0) {
4458 udata = nft_set_ext_userdata(ext);
4459 udata->len = ulen - 1;
4460 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4461 }
8aeff920
PNA		 4462 if (obj) {
4463 *nft_set_ext_obj(ext) = obj;
4464 obj->use++;
4465 }
fe2811eb 4466
60319eb1
PNA		 4467 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4468 if (trans == NULL)
fe2811eb 4469 goto err4;
60319eb1 4470
69086658 4471 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4472 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4473 if (err) {
4474 if (err == -EEXIST) {
9744a6fc
PNA		 4475 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4476 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4477 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
f0dfd7a2
CIK		 4478 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4479 err = -EBUSY;
4480 goto err5;
4481 }
8aeff920
PNA		 4482 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4483 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4484 memcmp(nft_set_ext_data(ext),
4485 nft_set_ext_data(ext2), set->dlen) != 0) ||
4486 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4487 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4488 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4489 err = -EBUSY;
4490 else if (!(nlmsg_flags & NLM_F_EXCL))
4491 err = 0;
4492 }
fe2811eb 4493 goto err5;
c016c7e4 4494 }
20a69341 4495
35d0ac90
PNA		 4496 if (set->size &&
4497 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4498 err = -ENFILE;
4499 goto err6;
4500 }
4501
60319eb1 4502 nft_trans_elem(trans) = elem;
46bbafce 4503 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4504 return 0;
4505
35d0ac90 4506err6:
5cb82a38 4507 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4508err5:
60319eb1 4509 kfree(trans);
fe2811eb
PM		 4510err4:
4511 kfree(elem.priv);
20a69341
PM		 4512err3:
4513 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4514 nft_data_release(&data, d2.type);
20a69341 4515err2:
59105446 4516 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4517err1:
4518 return err;
4519}
4520
633c9a84
PNA		 4521static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4522 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4523 const struct nlattr * const nla[],
4524 struct netlink_ext_ack *extack)
20a69341 4525{
f2a6d766 4526 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4527 const struct nlattr *attr;
4528 struct nft_set *set;
4529 struct nft_ctx ctx;
a654de8f 4530 int rem, err;
20a69341 4531
7d5570ca
PNA		 4532 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4533 return -EINVAL;
4534
36dd1bcc
PNA		 4535 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4536 genmask);
20a69341
PM		 4537 if (err < 0)
4538 return err;
4539
a3073c17
PNA		 4540 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4541 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4542 if (IS_ERR(set))
4543 return PTR_ERR(set);
958bee14 4544
20a69341
PM		 4545 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4546 return -EBUSY;
4547
4548 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4549 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4550 if (err < 0)
a654de8f 4551 return err;
20a69341 4552 }
a654de8f
PNA		 4553
4554 if (net->nft.validate_state == NFT_VALIDATE_DO)
4555 return nft_table_validate(net, ctx.table);
4556
4557 return 0;
20a69341
PM		 4558}
4559
59105446
PNA		 4560/**
4561 * nft_data_hold - hold a nft_data item
4562 *
4563 * @data: struct nft_data to release
4564 * @type: type of data
4565 *
4566 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4567 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4568 * NFT_GOTO verdicts. This function must be called on active data objects
4569 * from the second phase of the commit protocol.
4570 */
bb7b40ae 4571void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
59105446
PNA		 4572{
4573 if (type == NFT_DATA_VERDICT) {
4574 switch (data->verdict.code) {
4575 case NFT_JUMP:
4576 case NFT_GOTO:
4577 data->verdict.chain->use++;
4578 break;
4579 }
4580 }
4581}
4582
4583static void nft_set_elem_activate(const struct net *net,
4584 const struct nft_set *set,
4585 struct nft_set_elem *elem)
4586{
4587 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4588
4589 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4590 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4591 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4592 (*nft_set_ext_obj(ext))->use++;
4593}
4594
4595static void nft_set_elem_deactivate(const struct net *net,
4596 const struct nft_set *set,
4597 struct nft_set_elem *elem)
4598{
4599 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4600
4601 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4602 nft_data_release(nft_set_ext_data(ext), set->dtype);
4603 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4604 (*nft_set_ext_obj(ext))->use--;
4605}
4606
60319eb1 4607static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4608 const struct nlattr *attr)
4609{
4610 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4611 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4612 struct nft_data_desc desc;
4613 struct nft_set_elem elem;
3971ca14 4614 struct nft_set_ext *ext;
60319eb1 4615 struct nft_trans *trans;
3971ca14
PNA		 4616 u32 flags = 0;
4617 void *priv;
20a69341
PM		 4618 int err;
4619
4620 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4621 nft_set_elem_policy, NULL);
20a69341
PM		 4622 if (err < 0)
4623 goto err1;
4624
4625 err = -EINVAL;
4626 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4627 goto err1;
4628
3971ca14
PNA		 4629 nft_set_ext_prepare(&tmpl);
4630
4631 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4632 if (err < 0)
4633 return err;
4634 if (flags != 0)
4635 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4636
7d740264 4637 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4638 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4639 if (err < 0)
4640 goto err1;
4641
4642 err = -EINVAL;
4643 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4644 goto err2;
4645
3971ca14
PNA		 4646 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4647
4648 err = -ENOMEM;
4649 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4650 GFP_KERNEL);
4651 if (elem.priv == NULL)
4652 goto err2;
4653
4654 ext = nft_set_elem_ext(set, elem.priv);
4655 if (flags)
4656 *nft_set_ext_flags(ext) = flags;
4657
60319eb1 4658 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4659 if (trans == NULL) {
4660 err = -ENOMEM;
3971ca14 4661 goto err3;
609ccf08 4662 }
20a69341 4663
42a55769 4664 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4665 if (priv == NULL) {
cc02e457 4666 err = -ENOENT;
3971ca14 4667 goto err4;
cc02e457 4668 }
3971ca14
PNA		 4669 kfree(elem.priv);
4670 elem.priv = priv;
cc02e457 4671
59105446
PNA		 4672 nft_set_elem_deactivate(ctx->net, set, &elem);
4673
60319eb1 4674 nft_trans_elem(trans) = elem;
46bbafce 4675 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4676 return 0;
cc02e457 4677
3971ca14 4678err4:
cc02e457 4679 kfree(trans);
3971ca14
PNA		 4680err3:
4681 kfree(elem.priv);
20a69341 4682err2:
59105446 4683 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4684err1:
4685 return err;
4686}
4687
8411b644 4688static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4689 struct nft_set *set,
8411b644 4690 const struct nft_set_iter *iter,
de70185d 4691 struct nft_set_elem *elem)
8411b644
PNA		 4692{
4693 struct nft_trans *trans;
4694 int err;
4695
4696 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4697 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4698 if (!trans)
4699 return -ENOMEM;
4700
1ba1c414 4701 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4702 err = -ENOENT;
4703 goto err1;
4704 }
b2c11e4b 4705 set->ndeact++;
8411b644 4706
7acfda53 4707 nft_set_elem_deactivate(ctx->net, set, elem);
de70185d
PNA		 4708 nft_trans_elem_set(trans) = set;
4709 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4710 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4711
4712 return 0;
4713err1:
4714 kfree(trans);
4715 return err;
4716}
4717
633c9a84
PNA		 4718static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4719 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4720 const struct nlattr * const nla[],
4721 struct netlink_ext_ack *extack)
20a69341 4722{
f2a6d766 4723 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4724 const struct nlattr *attr;
4725 struct nft_set *set;
4726 struct nft_ctx ctx;
60319eb1 4727 int rem, err = 0;
20a69341 4728
36dd1bcc
PNA		 4729 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4730 genmask);
20a69341
PM		 4731 if (err < 0)
4732 return err;
4733
cac20fcd 4734 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 4735 if (IS_ERR(set))
4736 return PTR_ERR(set);
4737 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4738 return -EBUSY;
4739
8411b644 4740 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4741 struct nft_set_iter iter = {
4742 .genmask = genmask,
4743 .fn = nft_flush_set,
8411b644 4744 };
baa2d42c 4745 set->ops->walk(&ctx, set, &iter);
8411b644 4746
baa2d42c 4747 return iter.err;
8411b644
PNA		 4748 }
4749
20a69341
PM		 4750 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4751 err = nft_del_setelem(&ctx, set, attr);
4752 if (err < 0)
60319eb1 4753 break;
4fefee57 4754
3dd0673a 4755 set->ndeact++;
20a69341 4756 }
60319eb1 4757 return err;
20a69341
PM		 4758}
4759
cfed7e1b
PM		 4760void nft_set_gc_batch_release(struct rcu_head *rcu)
4761{
4762 struct nft_set_gc_batch *gcb;
4763 unsigned int i;
4764
4765 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4766 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4767 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4768 kfree(gcb);
4769}
4770EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4771
4772struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4773 gfp_t gfp)
4774{
4775 struct nft_set_gc_batch *gcb;
4776
4777 gcb = kzalloc(sizeof(*gcb), gfp);
4778 if (gcb == NULL)
4779 return gcb;
4780 gcb->head.set = set;
4781 return gcb;
4782}
4783EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4784
e5009240
PNA		 4785/*
4786 * Stateful objects
4787 */
4788
4789/**
4790 * nft_register_obj- register nf_tables stateful object type
4791 * @obj: object type
4792 *
4793 * Registers the object type for use with nf_tables. Returns zero on
4794 * success or a negative errno code otherwise.
4795 */
4796int nft_register_obj(struct nft_object_type *obj_type)
4797{
4798 if (obj_type->type == NFT_OBJECT_UNSPEC)
4799 return -EINVAL;
4800
4801 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4802 list_add_rcu(&obj_type->list, &nf_tables_objects);
4803 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4804 return 0;
4805}
4806EXPORT_SYMBOL_GPL(nft_register_obj);
4807
4808/**
4809 * nft_unregister_obj - unregister nf_tables object type
4810 * @obj: object type
4811 *
4812 * Unregisters the object type for use with nf_tables.
4813 */
4814void nft_unregister_obj(struct nft_object_type *obj_type)
4815{
4816 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4817 list_del_rcu(&obj_type->list);
4818 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4819}
4820EXPORT_SYMBOL_GPL(nft_unregister_obj);
4821
cac20fcd
PNA		 4822struct nft_object *nft_obj_lookup(const struct nft_table *table,
4823 const struct nlattr *nla, u32 objtype,
4824 u8 genmask)
e5009240
PNA		 4825{
4826 struct nft_object *obj;
4827
d9adf22a 4828 list_for_each_entry_rcu(obj, &table->objects, list) {
e5009240 4829 if (!nla_strcmp(nla, obj->name) &&
dfc46034 4830 objtype == obj->ops->type->type &&
e5009240
PNA		 4831 nft_active_genmask(obj, genmask))
4832 return obj;
4833 }
4834 return ERR_PTR(-ENOENT);
4835}
cac20fcd 4836EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 4837
cac20fcd
PNA		 4838static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4839 const struct nlattr *nla,
4840 u32 objtype, u8 genmask)
3ecbfd65
HS		 4841{
4842 struct nft_object *obj;
4843
4844 list_for_each_entry(obj, &table->objects, list) {
4845 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4846 objtype == obj->ops->type->type &&
4847 nft_active_genmask(obj, genmask))
4848 return obj;
4849 }
4850 return ERR_PTR(-ENOENT);
4851}
4852
e5009240 4853static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4854 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4855 .len = NFT_TABLE_MAXNAMELEN - 1 },
4856 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4857 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4858 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4859 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 4860 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 4861};
4862
84fba055
FW		 4863static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4864 const struct nft_object_type *type,
e5009240
PNA		 4865 const struct nlattr *attr)
4866{
5b4c6e38 4867 struct nlattr **tb;
dfc46034 4868 const struct nft_object_ops *ops;
e5009240 4869 struct nft_object *obj;
5b4c6e38
GS		 4870 int err = -ENOMEM;
4871
4872 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4873 if (!tb)
4874 goto err1;
e5009240
PNA		 4875
4876 if (attr) {
fceb6435
JB		 4877 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4878 NULL);
e5009240 4879 if (err < 0)
5b4c6e38 4880 goto err2;
e5009240
PNA		 4881 } else {
4882 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4883 }
4884
dfc46034
PBG		 4885 if (type->select_ops) {
4886 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4887 if (IS_ERR(ops)) {
4888 err = PTR_ERR(ops);
5b4c6e38 4889 goto err2;
dfc46034
PBG		 4890 }
4891 } else {
4892 ops = type->ops;
4893 }
4894
e5009240 4895 err = -ENOMEM;
dfc46034 4896 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 4897 if (!obj)
4898 goto err2;
e5009240 4899
dfc46034 4900 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 4901 if (err < 0)
5b4c6e38 4902 goto err3;
e5009240 4903
dfc46034
PBG		 4904 obj->ops = ops;
4905
5b4c6e38 4906 kfree(tb);
e5009240 4907 return obj;
5b4c6e38 4908err3:
e5009240 4909 kfree(obj);
5b4c6e38
GS		 4910err2:
4911 kfree(tb);
e5009240
PNA		 4912err1:
4913 return ERR_PTR(err);
4914}
4915
4916static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4917 struct nft_object *obj, bool reset)
e5009240
PNA		 4918{
4919 struct nlattr *nest;
4920
4921 nest = nla_nest_start(skb, attr);
4922 if (!nest)
4923 goto nla_put_failure;
dfc46034 4924 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 4925 goto nla_put_failure;
4926 nla_nest_end(skb, nest);
4927 return 0;
4928
4929nla_put_failure:
4930 return -1;
4931}
4932
4933static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4934{
4935 const struct nft_object_type *type;
4936
4937 list_for_each_entry(type, &nf_tables_objects, list) {
4938 if (objtype == type->type)
4939 return type;
4940 }
4941 return NULL;
4942}
4943
452238e8
FW		 4944static const struct nft_object_type *
4945nft_obj_type_get(struct net *net, u32 objtype)
e5009240
PNA		 4946{
4947 const struct nft_object_type *type;
4948
4949 type = __nft_obj_type_get(objtype);
4950 if (type != NULL && try_module_get(type->owner))
4951 return type;
4952
f102d66b 4953 lockdep_nfnl_nft_mutex_not_held();
e5009240
PNA		 4954#ifdef CONFIG_MODULES
4955 if (type == NULL) {
452238e8 4956 nft_request_module(net, "nft-obj-%u", objtype);
e5009240
PNA		 4957 if (__nft_obj_type_get(objtype))
4958 return ERR_PTR(-EAGAIN);
4959 }
4960#endif
4961 return ERR_PTR(-ENOENT);
4962}
4963
4964static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4965 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4966 const struct nlattr * const nla[],
4967 struct netlink_ext_ack *extack)
e5009240
PNA		 4968{
4969 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4970 const struct nft_object_type *type;
4971 u8 genmask = nft_genmask_next(net);
4972 int family = nfmsg->nfgen_family;
e5009240
PNA		 4973 struct nft_table *table;
4974 struct nft_object *obj;
4975 struct nft_ctx ctx;
4976 u32 objtype;
4977 int err;
4978
4979 if (!nla[NFTA_OBJ_TYPE] ||
4980 !nla[NFTA_OBJ_NAME] ||
4981 !nla[NFTA_OBJ_DATA])
4982 return -EINVAL;
4983
cac20fcd 4984 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4985 if (IS_ERR(table)) {
4986 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4987 return PTR_ERR(table);
36dd1bcc 4988 }
e5009240
PNA		 4989
4990 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 4991 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 4992 if (IS_ERR(obj)) {
4993 err = PTR_ERR(obj);
36dd1bcc
PNA		 4994 if (err != -ENOENT) {
4995 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4996 return err;
36dd1bcc 4997 }
1a28ad74 4998 } else {
36dd1bcc
PNA		 4999 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5000 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5001 return -EEXIST;
36dd1bcc 5002 }
e5009240
PNA		 5003 return 0;
5004 }
5005
98319cb9 5006 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240 5007
452238e8 5008 type = nft_obj_type_get(net, objtype);
e5009240
PNA		 5009 if (IS_ERR(type))
5010 return PTR_ERR(type);
5011
84fba055 5012 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 5013 if (IS_ERR(obj)) {
5014 err = PTR_ERR(obj);
5015 goto err1;
5016 }
18965317 5017 obj->table = table;
3ecbfd65
HS		 5018 obj->handle = nf_tables_alloc_handle(table);
5019
61509575
PS		 5020 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5021 if (!obj->name) {
5022 err = -ENOMEM;
5023 goto err2;
5024 }
e5009240
PNA		 5025
5026 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5027 if (err < 0)
61509575 5028 goto err3;
e5009240
PNA		 5029
5030 list_add_tail_rcu(&obj->list, &table->objects);
5031 table->use++;
5032 return 0;
61509575
PS		 5033err3:
5034 kfree(obj->name);
e5009240 5035err2:
dfc46034 5036 if (obj->ops->destroy)
00bfb320 5037 obj->ops->destroy(&ctx, obj);
e5009240
PNA		 5038 kfree(obj);
5039err1:
5040 module_put(type->owner);
5041 return err;
5042}
5043
5044static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5045 u32 portid, u32 seq, int event, u32 flags,
5046 int family, const struct nft_table *table,
43da04a5 5047 struct nft_object *obj, bool reset)
e5009240
PNA		 5048{
5049 struct nfgenmsg *nfmsg;
5050 struct nlmsghdr *nlh;
5051
dedb67c4 5052 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 5053 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5054 if (nlh == NULL)
5055 goto nla_put_failure;
5056
5057 nfmsg = nlmsg_data(nlh);
5058 nfmsg->nfgen_family = family;
5059 nfmsg->version = NFNETLINK_V0;
5060 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5061
5062 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
5063 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
dfc46034 5064 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 5065 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 5066 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5067 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5068 NFTA_OBJ_PAD))
e5009240
PNA		 5069 goto nla_put_failure;
5070
5071 nlmsg_end(skb, nlh);
5072 return 0;
5073
5074nla_put_failure:
5075 nlmsg_trim(skb, nlh);
5076 return -1;
5077}
5078
a9fea2a3 5079struct nft_obj_filter {
e46abbcc 5080 char *table;
a9fea2a3
PNA		 5081 u32 type;
5082};
5083
e5009240
PNA		 5084static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
5085{
5086 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 5087 const struct nft_table *table;
e5009240 5088 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 5089 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 5090 struct net *net = sock_net(skb->sk);
5091 int family = nfmsg->nfgen_family;
43da04a5
PNA		 5092 struct nft_object *obj;
5093 bool reset = false;
5094
5095 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5096 reset = true;
e5009240
PNA		 5097
5098 rcu_read_lock();
5099 cb->seq = net->nft.base_seq;
5100
36596dad 5101 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5102 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 5103 continue;
5104
36596dad
PNA		 5105 list_for_each_entry_rcu(obj, &table->objects, list) {
5106 if (!nft_is_active(net, obj))
5107 goto cont;
5108 if (idx < s_idx)
5109 goto cont;
5110 if (idx > s_idx)
5111 memset(&cb->args[1], 0,
5112 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5113 if (filter && filter->table &&
36596dad
PNA		 5114 strcmp(filter->table, table->name))
5115 goto cont;
5116 if (filter &&
5117 filter->type != NFT_OBJECT_UNSPEC &&
5118 obj->ops->type->type != filter->type)
5119 goto cont;
a9fea2a3 5120
36596dad
PNA		 5121 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
5122 cb->nlh->nlmsg_seq,
5123 NFT_MSG_NEWOBJ,
5124 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5125 table->family, table,
36596dad
PNA		 5126 obj, reset) < 0)
5127 goto done;
e5009240 5128
36596dad 5129 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 5130cont:
36596dad 5131 idx++;
e5009240
PNA		 5132 }
5133 }
5134done:
5135 rcu_read_unlock();
5136
5137 cb->args[0] = idx;
5138 return skb->len;
5139}
5140
90fd131a 5141static int nf_tables_dump_obj_start(struct netlink_callback *cb)
a9fea2a3 5142{
90fd131a
FW		 5143 const struct nlattr * const *nla = cb->data;
5144 struct nft_obj_filter *filter = NULL;
e46abbcc 5145
90fd131a
FW		 5146 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
5147 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5148 if (!filter)
5149 return -ENOMEM;
5150
5151 if (nla[NFTA_OBJ_TABLE]) {
5152 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
5153 if (!filter->table) {
5154 kfree(filter);
5155 return -ENOMEM;
5156 }
5157 }
5158
5159 if (nla[NFTA_OBJ_TYPE])
5160 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
8bea728d 5161 }
a9fea2a3 5162
90fd131a 5163 cb->data = filter;
a9fea2a3
PNA		 5164 return 0;
5165}
5166
90fd131a 5167static int nf_tables_dump_obj_done(struct netlink_callback *cb)
a9fea2a3 5168{
90fd131a 5169 struct nft_obj_filter *filter = cb->data;
a9fea2a3 5170
90fd131a
FW		 5171 if (filter) {
5172 kfree(filter->table);
5173 kfree(filter);
e46abbcc 5174 }
a9fea2a3 5175
90fd131a 5176 return 0;
a9fea2a3
PNA		 5177}
5178
d9adf22a 5179/* called with rcu_read_lock held */
e5009240
PNA		 5180static int nf_tables_getobj(struct net *net, struct sock *nlsk,
5181 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5182 const struct nlattr * const nla[],
5183 struct netlink_ext_ack *extack)
e5009240
PNA		 5184{
5185 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5186 u8 genmask = nft_genmask_cur(net);
5187 int family = nfmsg->nfgen_family;
e5009240
PNA		 5188 const struct nft_table *table;
5189 struct nft_object *obj;
5190 struct sk_buff *skb2;
43da04a5 5191 bool reset = false;
e5009240
PNA		 5192 u32 objtype;
5193 int err;
5194
5195 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5196 struct netlink_dump_control c = {
90fd131a 5197 .start = nf_tables_dump_obj_start,
e5009240 5198 .dump = nf_tables_dump_obj,
a9fea2a3 5199 .done = nf_tables_dump_obj_done,
d9adf22a 5200 .module = THIS_MODULE,
90fd131a 5201 .data = (void *)nla,
e5009240 5202 };
a9fea2a3 5203
d9adf22a 5204 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
e5009240
PNA		 5205 }
5206
5207 if (!nla[NFTA_OBJ_NAME] ||
5208 !nla[NFTA_OBJ_TYPE])
5209 return -EINVAL;
5210
cac20fcd 5211 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5212 if (IS_ERR(table)) {
5213 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5214 return PTR_ERR(table);
36dd1bcc 5215 }
e5009240
PNA		 5216
5217 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 5218 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 5219 if (IS_ERR(obj)) {
5220 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5221 return PTR_ERR(obj);
36dd1bcc 5222 }
e5009240 5223
d9adf22a 5224 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
e5009240
PNA		 5225 if (!skb2)
5226 return -ENOMEM;
5227
43da04a5
PNA		 5228 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5229 reset = true;
5230
e5009240
PNA		 5231 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5232 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 5233 family, table, obj, reset);
e5009240
PNA		 5234 if (err < 0)
5235 goto err;
5236
5237 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5238err:
5239 kfree_skb(skb2);
5240 return err;
e5009240
PNA		 5241}
5242
00bfb320 5243static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
e5009240 5244{
dfc46034 5245 if (obj->ops->destroy)
00bfb320 5246 obj->ops->destroy(ctx, obj);
e5009240 5247
dfc46034 5248 module_put(obj->ops->type->owner);
61509575 5249 kfree(obj->name);
e5009240
PNA		 5250 kfree(obj);
5251}
5252
5253static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 5254 struct sk_buff *skb, const struct nlmsghdr *nlh,
5255 const struct nlattr * const nla[],
5256 struct netlink_ext_ack *extack)
e5009240
PNA		 5257{
5258 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5259 u8 genmask = nft_genmask_next(net);
5260 int family = nfmsg->nfgen_family;
36dd1bcc 5261 const struct nlattr *attr;
e5009240
PNA		 5262 struct nft_table *table;
5263 struct nft_object *obj;
5264 struct nft_ctx ctx;
5265 u32 objtype;
5266
5267 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 5268 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 5269 return -EINVAL;
5270
cac20fcd 5271 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5272 if (IS_ERR(table)) {
5273 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5274 return PTR_ERR(table);
36dd1bcc 5275 }
e5009240
PNA		 5276
5277 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 5278 if (nla[NFTA_OBJ_HANDLE]) {
5279 attr = nla[NFTA_OBJ_HANDLE];
5280 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5281 } else {
5282 attr = nla[NFTA_OBJ_NAME];
5283 obj = nft_obj_lookup(table, attr, objtype, genmask);
5284 }
5285
5286 if (IS_ERR(obj)) {
5287 NL_SET_BAD_ATTR(extack, attr);
e5009240 5288 return PTR_ERR(obj);
36dd1bcc
PNA		 5289 }
5290 if (obj->use > 0) {
5291 NL_SET_BAD_ATTR(extack, attr);
e5009240 5292 return -EBUSY;
36dd1bcc 5293 }
e5009240 5294
98319cb9 5295 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 5296
5297 return nft_delobj(&ctx, obj);
5298}
5299
25e94a99
PNA		 5300void nft_obj_notify(struct net *net, struct nft_table *table,
5301 struct nft_object *obj, u32 portid, u32 seq, int event,
5302 int family, int report, gfp_t gfp)
e5009240
PNA		 5303{
5304 struct sk_buff *skb;
5305 int err;
5306
2599e989
PNA		 5307 if (!report &&
5308 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5309 return;
e5009240 5310
2599e989 5311 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 5312 if (skb == NULL)
5313 goto err;
5314
2599e989
PNA		 5315 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5316 table, obj, false);
e5009240
PNA		 5317 if (err < 0) {
5318 kfree_skb(skb);
5319 goto err;
5320 }
5321
25e94a99
PNA		 5322 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5323 return;
e5009240 5324err:
25e94a99 5325 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 5326}
2599e989
PNA		 5327EXPORT_SYMBOL_GPL(nft_obj_notify);
5328
25e94a99
PNA		 5329static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5330 struct nft_object *obj, int event)
2599e989 5331{
25e94a99 5332 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 5333 ctx->family, ctx->report, GFP_KERNEL);
2599e989 5334}
e5009240 5335
3b49e2e9
PNA		 5336/*
5337 * Flow tables
5338 */
5339void nft_register_flowtable_type(struct nf_flowtable_type *type)
5340{
5341 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5342 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5343 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5344}
5345EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5346
5347void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5348{
5349 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5350 list_del_rcu(&type->list);
5351 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5352}
5353EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5354
5355static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5356 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
5357 .len = NFT_NAME_MAXLEN - 1 },
5358 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
5359 .len = NFT_NAME_MAXLEN - 1 },
5360 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 5361 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
3b49e2e9
PNA		 5362};
5363
cac20fcd
PNA		 5364struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5365 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 5366{
5367 struct nft_flowtable *flowtable;
5368
d9adf22a 5369 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
3b49e2e9
PNA		 5370 if (!nla_strcmp(nla, flowtable->name) &&
5371 nft_active_genmask(flowtable, genmask))
5372 return flowtable;
5373 }
5374 return ERR_PTR(-ENOENT);
5375}
cac20fcd 5376EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 5377
ae0662f8 5378static struct nft_flowtable *
cac20fcd
PNA		 5379nft_flowtable_lookup_byhandle(const struct nft_table *table,
5380 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 5381{
5382 struct nft_flowtable *flowtable;
5383
5384 list_for_each_entry(flowtable, &table->flowtables, list) {
5385 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5386 nft_active_genmask(flowtable, genmask))
5387 return flowtable;
5388 }
5389 return ERR_PTR(-ENOENT);
5390}
5391
3b49e2e9
PNA		 5392static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5393 const struct nlattr *attr,
5394 struct net_device *dev_array[], int *len)
5395{
5396 const struct nlattr *tmp;
5397 struct net_device *dev;
5398 char ifname[IFNAMSIZ];
5399 int rem, n = 0, err;
5400
5401 nla_for_each_nested(tmp, attr, rem) {
5402 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5403 err = -EINVAL;
5404 goto err1;
5405 }
5406
5407 nla_strlcpy(ifname, tmp, IFNAMSIZ);
90d2723c 5408 dev = __dev_get_by_name(ctx->net, ifname);
3b49e2e9
PNA		 5409 if (!dev) {
5410 err = -ENOENT;
5411 goto err1;
5412 }
5413
5414 dev_array[n++] = dev;
5415 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5416 err = -EFBIG;
5417 goto err1;
5418 }
5419 }
5420 if (!len)
5421 return -EINVAL;
5422
5423 err = 0;
5424err1:
5425 *len = n;
5426 return err;
5427}
5428
5429static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5430 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5431 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5432 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5433};
5434
5435static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5436 const struct nlattr *attr,
5437 struct nft_flowtable *flowtable)
5438{
5439 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5440 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5441 struct nf_hook_ops *ops;
5442 int hooknum, priority;
5443 int err, n = 0, i;
5444
5445 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5446 nft_flowtable_hook_policy, NULL);
5447 if (err < 0)
5448 return err;
5449
5450 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5451 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5452 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5453 return -EINVAL;
5454
5455 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 5456 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 5457 return -EINVAL;
5458
5459 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5460
5461 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5462 dev_array, &n);
5463 if (err < 0)
d92191aa 5464 return err;
3b49e2e9 5465
6396bb22 5466 ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
90d2723c
PNA		 5467 if (!ops)
5468 return -ENOMEM;
3b49e2e9 5469
0e839dfa
PNA		 5470 flowtable->hooknum = hooknum;
5471 flowtable->priority = priority;
3b49e2e9
PNA		 5472 flowtable->ops = ops;
5473 flowtable->ops_len = n;
5474
5475 for (i = 0; i < n; i++) {
5476 flowtable->ops[i].pf = NFPROTO_NETDEV;
5477 flowtable->ops[i].hooknum = hooknum;
5478 flowtable->ops[i].priority = priority;
17857d92 5479 flowtable->ops[i].priv = &flowtable->data;
3b49e2e9
PNA		 5480 flowtable->ops[i].hook = flowtable->data.type->hook;
5481 flowtable->ops[i].dev = dev_array[i];
5482 }
5483
3b49e2e9
PNA		 5484 return err;
5485}
5486
98319cb9 5487static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5488{
5489 const struct nf_flowtable_type *type;
5490
5491 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 5492 if (family == type->family)
3b49e2e9
PNA		 5493 return type;
5494 }
5495 return NULL;
5496}
5497
452238e8
FW		 5498static const struct nf_flowtable_type *
5499nft_flowtable_type_get(struct net *net, u8 family)
3b49e2e9
PNA		 5500{
5501 const struct nf_flowtable_type *type;
5502
98319cb9 5503 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 5504 if (type != NULL && try_module_get(type->owner))
5505 return type;
5506
f102d66b 5507 lockdep_nfnl_nft_mutex_not_held();
3b49e2e9
PNA		 5508#ifdef CONFIG_MODULES
5509 if (type == NULL) {
452238e8 5510 nft_request_module(net, "nf-flowtable-%u", family);
98319cb9 5511 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 5512 return ERR_PTR(-EAGAIN);
5513 }
5514#endif
5515 return ERR_PTR(-ENOENT);
5516}
5517
3b49e2e9
PNA		 5518static void nft_unregister_flowtable_net_hooks(struct net *net,
5519 struct nft_flowtable *flowtable)
5520{
5521 int i;
5522
5523 for (i = 0; i < flowtable->ops_len; i++) {
5524 if (!flowtable->ops[i].dev)
5525 continue;
5526
5527 nf_unregister_net_hook(net, &flowtable->ops[i]);
5528 }
5529}
5530
5531static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5532 struct sk_buff *skb,
5533 const struct nlmsghdr *nlh,
5534 const struct nlattr * const nla[],
5535 struct netlink_ext_ack *extack)
5536{
5537 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5538 const struct nf_flowtable_type *type;
32fc7187 5539 struct nft_flowtable *flowtable, *ft;
3b49e2e9
PNA		 5540 u8 genmask = nft_genmask_next(net);
5541 int family = nfmsg->nfgen_family;
3b49e2e9
PNA		 5542 struct nft_table *table;
5543 struct nft_ctx ctx;
5544 int err, i, k;
5545
5546 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5547 !nla[NFTA_FLOWTABLE_NAME] ||
5548 !nla[NFTA_FLOWTABLE_HOOK])
5549 return -EINVAL;
5550
cac20fcd
PNA		 5551 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5552 genmask);
36dd1bcc
PNA		 5553 if (IS_ERR(table)) {
5554 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5555 return PTR_ERR(table);
36dd1bcc 5556 }
3b49e2e9 5557
cac20fcd
PNA		 5558 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5559 genmask);
3b49e2e9
PNA		 5560 if (IS_ERR(flowtable)) {
5561 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 5562 if (err != -ENOENT) {
5563 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5564 return err;
36dd1bcc 5565 }
3b49e2e9 5566 } else {
36dd1bcc
PNA		 5567 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5568 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5569 return -EEXIST;
36dd1bcc 5570 }
3b49e2e9
PNA		 5571
5572 return 0;
5573 }
5574
98319cb9 5575 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5576
5577 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5578 if (!flowtable)
5579 return -ENOMEM;
5580
5581 flowtable->table = table;
3ecbfd65
HS		 5582 flowtable->handle = nf_tables_alloc_handle(table);
5583
3b49e2e9
PNA		 5584 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5585 if (!flowtable->name) {
5586 err = -ENOMEM;
5587 goto err1;
5588 }
5589
452238e8 5590 type = nft_flowtable_type_get(net, family);
3b49e2e9
PNA		 5591 if (IS_ERR(type)) {
5592 err = PTR_ERR(type);
5593 goto err2;
5594 }
5595
5596 flowtable->data.type = type;
a268de77 5597 err = type->init(&flowtable->data);
3b49e2e9
PNA		 5598 if (err < 0)
5599 goto err3;
5600
5601 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5602 flowtable);
5603 if (err < 0)
a268de77 5604 goto err4;
3b49e2e9
PNA		 5605
5606 for (i = 0; i < flowtable->ops_len; i++) {
32fc7187
PNA		 5607 if (!flowtable->ops[i].dev)
5608 continue;
5609
5610 list_for_each_entry(ft, &table->flowtables, list) {
5611 for (k = 0; k < ft->ops_len; k++) {
5612 if (!ft->ops[k].dev)
5613 continue;
5614
5615 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5616 flowtable->ops[i].pf == ft->ops[k].pf) {
5617 err = -EBUSY;
a268de77 5618 goto err5;
32fc7187
PNA		 5619 }
5620 }
5621 }
5622
3b49e2e9
PNA		 5623 err = nf_register_net_hook(net, &flowtable->ops[i]);
5624 if (err < 0)
a268de77 5625 goto err5;
3b49e2e9
PNA		 5626 }
5627
5628 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5629 if (err < 0)
a268de77 5630 goto err6;
3b49e2e9
PNA		 5631
5632 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5633 table->use++;
5634
5635 return 0;
a268de77 5636err6:
3b49e2e9 5637 i = flowtable->ops_len;
a268de77 5638err5:
b8088dda 5639 for (k = i - 1; k >= 0; k--)
0e0d5002 5640 nf_unregister_net_hook(net, &flowtable->ops[k]);
3b49e2e9
PNA		 5641
5642 kfree(flowtable->ops);
a268de77
FF		 5643err4:
5644 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5645err3:
5646 module_put(type->owner);
5647err2:
5648 kfree(flowtable->name);
5649err1:
5650 kfree(flowtable);
5651 return err;
5652}
5653
5654static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5655 struct sk_buff *skb,
5656 const struct nlmsghdr *nlh,
5657 const struct nlattr * const nla[],
5658 struct netlink_ext_ack *extack)
5659{
5660 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5661 u8 genmask = nft_genmask_next(net);
5662 int family = nfmsg->nfgen_family;
5663 struct nft_flowtable *flowtable;
36dd1bcc 5664 const struct nlattr *attr;
3b49e2e9
PNA		 5665 struct nft_table *table;
5666 struct nft_ctx ctx;
5667
e603ea4b
PNA		 5668 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5669 (!nla[NFTA_FLOWTABLE_NAME] &&
5670 !nla[NFTA_FLOWTABLE_HANDLE]))
5671 return -EINVAL;
5672
cac20fcd
PNA		 5673 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5674 genmask);
36dd1bcc
PNA		 5675 if (IS_ERR(table)) {
5676 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5677 return PTR_ERR(table);
36dd1bcc 5678 }
3b49e2e9 5679
36dd1bcc
PNA		 5680 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5681 attr = nla[NFTA_FLOWTABLE_HANDLE];
5682 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5683 } else {
5684 attr = nla[NFTA_FLOWTABLE_NAME];
5685 flowtable = nft_flowtable_lookup(table, attr, genmask);
5686 }
5687
5688 if (IS_ERR(flowtable)) {
5689 NL_SET_BAD_ATTR(extack, attr);
5690 return PTR_ERR(flowtable);
5691 }
5692 if (flowtable->use > 0) {
5693 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 5694 return -EBUSY;
36dd1bcc 5695 }
3b49e2e9 5696
98319cb9 5697 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5698
5699 return nft_delflowtable(&ctx, flowtable);
5700}
5701
5702static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5703 u32 portid, u32 seq, int event,
5704 u32 flags, int family,
5705 struct nft_flowtable *flowtable)
5706{
5707 struct nlattr *nest, *nest_devs;
5708 struct nfgenmsg *nfmsg;
5709 struct nlmsghdr *nlh;
5710 int i;
5711
5712 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5713 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5714 if (nlh == NULL)
5715 goto nla_put_failure;
5716
5717 nfmsg = nlmsg_data(nlh);
5718 nfmsg->nfgen_family = family;
5719 nfmsg->version = NFNETLINK_V0;
5720 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5721
5722 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5723 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 5724 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5725 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5726 NFTA_FLOWTABLE_PAD))
3b49e2e9
PNA		 5727 goto nla_put_failure;
5728
5729 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
eb895086
KL		 5730 if (!nest)
5731 goto nla_put_failure;
3b49e2e9
PNA		 5732 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5733 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5734 goto nla_put_failure;
5735
5736 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5737 if (!nest_devs)
5738 goto nla_put_failure;
5739
5740 for (i = 0; i < flowtable->ops_len; i++) {
b8088dda
FW		 5741 const struct net_device *dev = READ_ONCE(flowtable->ops[i].dev);
5742
5743 if (dev &&
5744 nla_put_string(skb, NFTA_DEVICE_NAME, dev->name))
3b49e2e9
PNA		 5745 goto nla_put_failure;
5746 }
5747 nla_nest_end(skb, nest_devs);
5748 nla_nest_end(skb, nest);
5749
5750 nlmsg_end(skb, nlh);
5751 return 0;
5752
5753nla_put_failure:
5754 nlmsg_trim(skb, nlh);
5755 return -1;
5756}
5757
5758struct nft_flowtable_filter {
5759 char *table;
5760};
5761
5762static int nf_tables_dump_flowtable(struct sk_buff *skb,
5763 struct netlink_callback *cb)
5764{
5765 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5766 struct nft_flowtable_filter *filter = cb->data;
5767 unsigned int idx = 0, s_idx = cb->args[0];
5768 struct net *net = sock_net(skb->sk);
5769 int family = nfmsg->nfgen_family;
5770 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5771 const struct nft_table *table;
5772
5773 rcu_read_lock();
5774 cb->seq = net->nft.base_seq;
5775
36596dad 5776 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5777 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 5778 continue;
5779
36596dad
PNA		 5780 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5781 if (!nft_is_active(net, flowtable))
5782 goto cont;
5783 if (idx < s_idx)
5784 goto cont;
5785 if (idx > s_idx)
5786 memset(&cb->args[1], 0,
5787 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5788 if (filter && filter->table &&
36596dad
PNA		 5789 strcmp(filter->table, table->name))
5790 goto cont;
3b49e2e9 5791
36596dad
PNA		 5792 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5793 cb->nlh->nlmsg_seq,
5794 NFT_MSG_NEWFLOWTABLE,
5795 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5796 table->family, flowtable) < 0)
36596dad 5797 goto done;
3b49e2e9 5798
36596dad 5799 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 5800cont:
36596dad 5801 idx++;
3b49e2e9
PNA		 5802 }
5803 }
5804done:
5805 rcu_read_unlock();
5806
5807 cb->args[0] = idx;
5808 return skb->len;
5809}
5810
90fd131a 5811static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
3b49e2e9 5812{
90fd131a
FW		 5813 const struct nlattr * const *nla = cb->data;
5814 struct nft_flowtable_filter *filter = NULL;
3b49e2e9 5815
90fd131a
FW		 5816 if (nla[NFTA_FLOWTABLE_TABLE]) {
5817 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5818 if (!filter)
5819 return -ENOMEM;
3b49e2e9 5820
90fd131a
FW		 5821 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5822 GFP_ATOMIC);
5823 if (!filter->table) {
5824 kfree(filter);
5825 return -ENOMEM;
5826 }
5827 }
3b49e2e9 5828
90fd131a 5829 cb->data = filter;
3b49e2e9
PNA		 5830 return 0;
5831}
5832
90fd131a 5833static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
3b49e2e9 5834{
90fd131a 5835 struct nft_flowtable_filter *filter = cb->data;
3b49e2e9 5836
3b49e2e9 5837 if (!filter)
90fd131a 5838 return 0;
3b49e2e9 5839
90fd131a
FW		 5840 kfree(filter->table);
5841 kfree(filter);
5842
5843 return 0;
3b49e2e9
PNA		 5844}
5845
d9adf22a 5846/* called with rcu_read_lock held */
3b49e2e9
PNA		 5847static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5848 struct sk_buff *skb,
5849 const struct nlmsghdr *nlh,
5850 const struct nlattr * const nla[],
5851 struct netlink_ext_ack *extack)
5852{
5853 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5854 u8 genmask = nft_genmask_cur(net);
5855 int family = nfmsg->nfgen_family;
5856 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5857 const struct nft_table *table;
5858 struct sk_buff *skb2;
5859 int err;
5860
5861 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5862 struct netlink_dump_control c = {
90fd131a 5863 .start = nf_tables_dump_flowtable_start,
3b49e2e9
PNA		 5864 .dump = nf_tables_dump_flowtable,
5865 .done = nf_tables_dump_flowtable_done,
d9adf22a 5866 .module = THIS_MODULE,
90fd131a 5867 .data = (void *)nla,
3b49e2e9
PNA		 5868 };
5869
d9adf22a 5870 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3b49e2e9
PNA		 5871 }
5872
5873 if (!nla[NFTA_FLOWTABLE_NAME])
5874 return -EINVAL;
5875
cac20fcd
PNA		 5876 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5877 genmask);
3b49e2e9
PNA		 5878 if (IS_ERR(table))
5879 return PTR_ERR(table);
5880
cac20fcd
PNA		 5881 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5882 genmask);
03a0120f 5883 if (IS_ERR(flowtable))
3b49e2e9
PNA		 5884 return PTR_ERR(flowtable);
5885
d9adf22a 5886 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3b49e2e9
PNA		 5887 if (!skb2)
5888 return -ENOMEM;
5889
5890 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5891 nlh->nlmsg_seq,
5892 NFT_MSG_NEWFLOWTABLE, 0, family,
5893 flowtable);
5894 if (err < 0)
5895 goto err;
5896
5897 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5898err:
5899 kfree_skb(skb2);
5900 return err;
5901}
5902
5903static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5904 struct nft_flowtable *flowtable,
5905 int event)
5906{
5907 struct sk_buff *skb;
5908 int err;
5909
5910 if (ctx->report &&
5911 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5912 return;
5913
5914 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5915 if (skb == NULL)
5916 goto err;
5917
5918 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5919 ctx->seq, event, 0,
36596dad 5920 ctx->family, flowtable);
3b49e2e9
PNA		 5921 if (err < 0) {
5922 kfree_skb(skb);
5923 goto err;
5924 }
5925
5926 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5927 ctx->report, GFP_KERNEL);
5928 return;
5929err:
5930 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5931}
5932
3b49e2e9
PNA		 5933static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5934{
c04a3f73 5935 kfree(flowtable->ops);
3b49e2e9 5936 kfree(flowtable->name);
b408c5b0 5937 flowtable->data.type->free(&flowtable->data);
3b49e2e9 5938 module_put(flowtable->data.type->owner);
a12486eb 5939 kfree(flowtable);
3b49e2e9
PNA		 5940}
5941
84d7fce6
PNA		 5942static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5943 u32 portid, u32 seq)
5944{
5945 struct nlmsghdr *nlh;
5946 struct nfgenmsg *nfmsg;
784b4e61 5947 char buf[TASK_COMM_LEN];
dedb67c4 5948 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 5949
5950 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5951 if (nlh == NULL)
5952 goto nla_put_failure;
5953
5954 nfmsg = nlmsg_data(nlh);
5955 nfmsg->nfgen_family = AF_UNSPEC;
5956 nfmsg->version = NFNETLINK_V0;
5957 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5958
784b4e61
PS		 5959 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5960 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5961 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 5962 goto nla_put_failure;
5963
053c095a
JB		 5964 nlmsg_end(skb, nlh);
5965 return 0;
84d7fce6
PNA		 5966
5967nla_put_failure:
5968 nlmsg_trim(skb, nlh);
5969 return -EMSGSIZE;
5970}
5971
3b49e2e9
PNA		 5972static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5973 struct nft_flowtable *flowtable)
5974{
5975 int i;
5976
5977 for (i = 0; i < flowtable->ops_len; i++) {
5978 if (flowtable->ops[i].dev != dev)
5979 continue;
5980
5981 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
5982 flowtable->ops[i].dev = NULL;
5983 break;
5984 }
5985}
5986
5987static int nf_tables_flowtable_event(struct notifier_block *this,
5988 unsigned long event, void *ptr)
5989{
5990 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5991 struct nft_flowtable *flowtable;
5992 struct nft_table *table;
0a2cf5ee 5993 struct net *net;
3b49e2e9
PNA		 5994
5995 if (event != NETDEV_UNREGISTER)
5996 return 0;
5997
6a48de01 5998 net = dev_net(dev);
9e619d87 5999 mutex_lock(&net->nft.commit_mutex);
0a2cf5ee 6000 list_for_each_entry(table, &net->nft.tables, list) {
36596dad
PNA		 6001 list_for_each_entry(flowtable, &table->flowtables, list) {
6002 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 6003 }
6004 }
9e619d87 6005 mutex_unlock(&net->nft.commit_mutex);
6a48de01 6006
3b49e2e9
PNA		 6007 return NOTIFY_DONE;
6008}
6009
6010static struct notifier_block nf_tables_flowtable_notifier = {
6011 .notifier_call = nf_tables_flowtable_event,
6012};
6013
25e94a99
PNA		 6014static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
6015 int event)
84d7fce6
PNA		 6016{
6017 struct nlmsghdr *nlh = nlmsg_hdr(skb);
6018 struct sk_buff *skb2;
6019 int err;
6020
6021 if (nlmsg_report(nlh) &&
6022 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 6023 return;
84d7fce6 6024
84d7fce6
PNA		 6025 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6026 if (skb2 == NULL)
6027 goto err;
6028
6029 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6030 nlh->nlmsg_seq);
6031 if (err < 0) {
6032 kfree_skb(skb2);
6033 goto err;
6034 }
6035
25e94a99
PNA		 6036 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6037 nlmsg_report(nlh), GFP_KERNEL);
6038 return;
84d7fce6 6039err:
25e94a99
PNA		 6040 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6041 -ENOBUFS);
84d7fce6
PNA		 6042}
6043
7b8002a1
PNA		 6044static int nf_tables_getgen(struct net *net, struct sock *nlsk,
6045 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 6046 const struct nlattr * const nla[],
6047 struct netlink_ext_ack *extack)
84d7fce6 6048{
84d7fce6
PNA		 6049 struct sk_buff *skb2;
6050 int err;
6051
d9adf22a 6052 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
84d7fce6
PNA		 6053 if (skb2 == NULL)
6054 return -ENOMEM;
6055
6056 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6057 nlh->nlmsg_seq);
6058 if (err < 0)
6059 goto err;
6060
6061 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6062err:
6063 kfree_skb(skb2);
6064 return err;
6065}
6066
96518518
PM		 6067static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
6068 [NFT_MSG_NEWTABLE] = {
55dd6f93 6069 .call_batch = nf_tables_newtable,
96518518
PM		 6070 .attr_count = NFTA_TABLE_MAX,
6071 .policy = nft_table_policy,
6072 },
6073 [NFT_MSG_GETTABLE] = {
d9adf22a 6074 .call_rcu = nf_tables_gettable,
96518518
PM		 6075 .attr_count = NFTA_TABLE_MAX,
6076 .policy = nft_table_policy,
6077 },
6078 [NFT_MSG_DELTABLE] = {
55dd6f93 6079 .call_batch = nf_tables_deltable,
96518518
PM		 6080 .attr_count = NFTA_TABLE_MAX,
6081 .policy = nft_table_policy,
6082 },
6083 [NFT_MSG_NEWCHAIN] = {
91c7b38d 6084 .call_batch = nf_tables_newchain,
96518518
PM		 6085 .attr_count = NFTA_CHAIN_MAX,
6086 .policy = nft_chain_policy,
6087 },
6088 [NFT_MSG_GETCHAIN] = {
d9adf22a 6089 .call_rcu = nf_tables_getchain,
96518518
PM		 6090 .attr_count = NFTA_CHAIN_MAX,
6091 .policy = nft_chain_policy,
6092 },
6093 [NFT_MSG_DELCHAIN] = {
91c7b38d 6094 .call_batch = nf_tables_delchain,
96518518
PM		 6095 .attr_count = NFTA_CHAIN_MAX,
6096 .policy = nft_chain_policy,
6097 },
6098 [NFT_MSG_NEWRULE] = {
0628b123 6099 .call_batch = nf_tables_newrule,
96518518
PM		 6100 .attr_count = NFTA_RULE_MAX,
6101 .policy = nft_rule_policy,
6102 },
6103 [NFT_MSG_GETRULE] = {
d9adf22a 6104 .call_rcu = nf_tables_getrule,
96518518
PM		 6105 .attr_count = NFTA_RULE_MAX,
6106 .policy = nft_rule_policy,
6107 },
6108 [NFT_MSG_DELRULE] = {
0628b123 6109 .call_batch = nf_tables_delrule,
96518518
PM		 6110 .attr_count = NFTA_RULE_MAX,
6111 .policy = nft_rule_policy,
6112 },
20a69341 6113 [NFT_MSG_NEWSET] = {
958bee14 6114 .call_batch = nf_tables_newset,
20a69341
PM		 6115 .attr_count = NFTA_SET_MAX,
6116 .policy = nft_set_policy,
6117 },
6118 [NFT_MSG_GETSET] = {
d9adf22a 6119 .call_rcu = nf_tables_getset,
20a69341
PM		 6120 .attr_count = NFTA_SET_MAX,
6121 .policy = nft_set_policy,
6122 },
6123 [NFT_MSG_DELSET] = {
958bee14 6124 .call_batch = nf_tables_delset,
20a69341
PM		 6125 .attr_count = NFTA_SET_MAX,
6126 .policy = nft_set_policy,
6127 },
6128 [NFT_MSG_NEWSETELEM] = {
958bee14 6129 .call_batch = nf_tables_newsetelem,
20a69341
PM		 6130 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6131 .policy = nft_set_elem_list_policy,
6132 },
6133 [NFT_MSG_GETSETELEM] = {
d9adf22a 6134 .call_rcu = nf_tables_getsetelem,
20a69341
PM		 6135 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6136 .policy = nft_set_elem_list_policy,
6137 },
6138 [NFT_MSG_DELSETELEM] = {
958bee14 6139 .call_batch = nf_tables_delsetelem,
20a69341
PM		 6140 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6141 .policy = nft_set_elem_list_policy,
6142 },
84d7fce6 6143 [NFT_MSG_GETGEN] = {
d9adf22a 6144 .call_rcu = nf_tables_getgen,
84d7fce6 6145 },
e5009240
PNA		 6146 [NFT_MSG_NEWOBJ] = {
6147 .call_batch = nf_tables_newobj,
6148 .attr_count = NFTA_OBJ_MAX,
6149 .policy = nft_obj_policy,
6150 },
6151 [NFT_MSG_GETOBJ] = {
d9adf22a 6152 .call_rcu = nf_tables_getobj,
e5009240
PNA		 6153 .attr_count = NFTA_OBJ_MAX,
6154 .policy = nft_obj_policy,
6155 },
6156 [NFT_MSG_DELOBJ] = {
6157 .call_batch = nf_tables_delobj,
6158 .attr_count = NFTA_OBJ_MAX,
6159 .policy = nft_obj_policy,
6160 },
43da04a5 6161 [NFT_MSG_GETOBJ_RESET] = {
d9adf22a 6162 .call_rcu = nf_tables_getobj,
43da04a5
PNA		 6163 .attr_count = NFTA_OBJ_MAX,
6164 .policy = nft_obj_policy,
6165 },
3b49e2e9
PNA		 6166 [NFT_MSG_NEWFLOWTABLE] = {
6167 .call_batch = nf_tables_newflowtable,
6168 .attr_count = NFTA_FLOWTABLE_MAX,
6169 .policy = nft_flowtable_policy,
6170 },
6171 [NFT_MSG_GETFLOWTABLE] = {
d9adf22a 6172 .call_rcu = nf_tables_getflowtable,
3b49e2e9
PNA		 6173 .attr_count = NFTA_FLOWTABLE_MAX,
6174 .policy = nft_flowtable_policy,
6175 },
6176 [NFT_MSG_DELFLOWTABLE] = {
6177 .call_batch = nf_tables_delflowtable,
6178 .attr_count = NFTA_FLOWTABLE_MAX,
6179 .policy = nft_flowtable_policy,
6180 },
96518518
PM		 6181};
6182
a654de8f
PNA		 6183static int nf_tables_validate(struct net *net)
6184{
6185 struct nft_table *table;
6186
6187 switch (net->nft.validate_state) {
6188 case NFT_VALIDATE_SKIP:
6189 break;
6190 case NFT_VALIDATE_NEED:
6191 nft_validate_state_update(net, NFT_VALIDATE_DO);
6192 /* fall through */
6193 case NFT_VALIDATE_DO:
6194 list_for_each_entry(table, &net->nft.tables, list) {
6195 if (nft_table_validate(net, table) < 0)
6196 return -EAGAIN;
6197 }
6198 break;
6199 }
6200
6201 return 0;
6202}
6203
91c7b38d
PNA		 6204static void nft_chain_commit_update(struct nft_trans *trans)
6205{
6206 struct nft_base_chain *basechain;
6207
1b2470e5
FW		 6208 if (nft_trans_chain_name(trans)) {
6209 rhltable_remove(&trans->ctx.table->chains_ht,
6210 &trans->ctx.chain->rhlhead,
6211 nft_chain_ht_params);
d71efb59 6212 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
1b2470e5
FW		 6213 rhltable_insert_key(&trans->ctx.table->chains_ht,
6214 trans->ctx.chain->name,
6215 &trans->ctx.chain->rhlhead,
6216 nft_chain_ht_params);
6217 }
91c7b38d 6218
f323d954 6219 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 6220 return;
6221
6222 basechain = nft_base_chain(trans->ctx.chain);
4c05ec47
TY		 6223 nft_chain_stats_replace(trans->ctx.net, basechain,
6224 nft_trans_chain_stats(trans));
91c7b38d
PNA		 6225
6226 switch (nft_trans_chain_policy(trans)) {
6227 case NF_DROP:
6228 case NF_ACCEPT:
6229 basechain->policy = nft_trans_chain_policy(trans);
6230 break;
6231 }
6232}
6233
2f99aa31 6234static void nft_commit_release(struct nft_trans *trans)
c7c32e72 6235{
c7c32e72
PNA		 6236 switch (trans->msg_type) {
6237 case NFT_MSG_DELTABLE:
6238 nf_tables_table_destroy(&trans->ctx);
6239 break;
9f8aac0b
FW		 6240 case NFT_MSG_NEWCHAIN:
6241 kfree(nft_trans_chain_name(trans));
6242 break;
c7c32e72 6243 case NFT_MSG_DELCHAIN:
43a605f2 6244 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6245 break;
6246 case NFT_MSG_DELRULE:
6247 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6248 break;
6249 case NFT_MSG_DELSET:
6250 nft_set_destroy(nft_trans_set(trans));
6251 break;
61edafbb 6252 case NFT_MSG_DELSETELEM:
3453c927
PNA		 6253 nf_tables_set_elem_destroy(&trans->ctx,
6254 nft_trans_elem_set(trans),
59105446 6255 nft_trans_elem(trans).priv);
61edafbb 6256 break;
e5009240 6257 case NFT_MSG_DELOBJ:
00bfb320 6258 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6259 break;
3b49e2e9
PNA		 6260 case NFT_MSG_DELFLOWTABLE:
6261 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6262 break;
c7c32e72 6263 }
0935d558
FW		 6264
6265 if (trans->put_net)
6266 put_net(trans->ctx.net);
6267
c7c32e72
PNA		 6268 kfree(trans);
6269}
6270
0935d558 6271static void nf_tables_trans_destroy_work(struct work_struct *w)
2f99aa31
FW		 6272{
6273 struct nft_trans *trans, *next;
0935d558
FW		 6274 LIST_HEAD(head);
6275
6276 spin_lock(&nf_tables_destroy_list_lock);
6277 list_splice_init(&nf_tables_destroy_list, &head);
6278 spin_unlock(&nf_tables_destroy_list_lock);
2f99aa31 6279
0935d558 6280 if (list_empty(&head))
2f99aa31
FW		 6281 return;
6282
6283 synchronize_rcu();
6284
0935d558 6285 list_for_each_entry_safe(trans, next, &head, list) {
2f99aa31
FW		 6286 list_del(&trans->list);
6287 nft_commit_release(trans);
6288 }
6289}
6290
0cbc06b3
FW		 6291static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6292{
6293 struct nft_rule *rule;
6294 unsigned int alloc = 0;
6295 int i;
6296
6297 /* already handled or inactive chain? */
6298 if (chain->rules_next || !nft_is_active_next(net, chain))
6299 return 0;
6300
6301 rule = list_entry(&chain->rules, struct nft_rule, list);
6302 i = 0;
6303
6304 list_for_each_entry_continue(rule, &chain->rules, list) {
6305 if (nft_is_active_next(net, rule))
6306 alloc++;
6307 }
6308
6309 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6310 if (!chain->rules_next)
6311 return -ENOMEM;
6312
6313 list_for_each_entry_continue(rule, &chain->rules, list) {
6314 if (nft_is_active_next(net, rule))
6315 chain->rules_next[i++] = rule;
6316 }
6317
6318 chain->rules_next[i] = NULL;
6319 return 0;
6320}
6321
6322static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6323{
6324 struct nft_trans *trans, *next;
6325
6326 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6327 struct nft_chain *chain = trans->ctx.chain;
6328
6329 if (trans->msg_type == NFT_MSG_NEWRULE ||
6330 trans->msg_type == NFT_MSG_DELRULE) {
6331 kvfree(chain->rules_next);
6332 chain->rules_next = NULL;
6333 }
6334 }
6335}
6336
6337static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6338{
6339 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6340
6341 kvfree(o->start);
6342}
6343
6344static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6345{
6346 struct nft_rule **r = rules;
6347 struct nft_rules_old *old;
6348
6349 while (*r)
6350 r++;
6351
6352 r++; /* rcu_head is after end marker */
6353 old = (void *) r;
6354 old->start = rules;
6355
6356 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6357}
6358
0fb39bbe 6359static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
0cbc06b3
FW		 6360{
6361 struct nft_rule **g0, **g1;
6362 bool next_genbit;
6363
6364 next_genbit = nft_gencursor_next(net);
6365
6366 g0 = rcu_dereference_protected(chain->rules_gen_0,
f102d66b 6367 lockdep_commit_lock_is_held(net));
0cbc06b3 6368 g1 = rcu_dereference_protected(chain->rules_gen_1,
f102d66b 6369 lockdep_commit_lock_is_held(net));
0cbc06b3
FW		 6370
6371 /* No changes to this chain? */
6372 if (chain->rules_next == NULL) {
6373 /* chain had no change in last or next generation */
6374 if (g0 == g1)
6375 return;
6376 /*
6377 * chain had no change in this generation; make sure next
6378 * one uses same rules as current generation.
6379 */
6380 if (next_genbit) {
6381 rcu_assign_pointer(chain->rules_gen_1, g0);
6382 nf_tables_commit_chain_free_rules_old(g1);
6383 } else {
6384 rcu_assign_pointer(chain->rules_gen_0, g1);
6385 nf_tables_commit_chain_free_rules_old(g0);
6386 }
6387
6388 return;
6389 }
6390
6391 if (next_genbit)
6392 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6393 else
6394 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6395
6396 chain->rules_next = NULL;
6397
6398 if (g0 == g1)
6399 return;
6400
6401 if (next_genbit)
6402 nf_tables_commit_chain_free_rules_old(g1);
6403 else
6404 nf_tables_commit_chain_free_rules_old(g0);
6405}
6406
1b2470e5
FW		 6407static void nft_chain_del(struct nft_chain *chain)
6408{
6409 struct nft_table *table = chain->table;
6410
6411 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
6412 nft_chain_ht_params));
6413 list_del_rcu(&chain->list);
6414}
6415
0935d558
FW		 6416static void nf_tables_commit_release(struct net *net)
6417{
6418 struct nft_trans *trans;
6419
6420 /* all side effects have to be made visible.
6421 * For example, if a chain named 'foo' has been deleted, a
6422 * new transaction must not find it anymore.
6423 *
6424 * Memory reclaim happens asynchronously from work queue
6425 * to prevent expensive synchronize_rcu() in commit phase.
6426 */
6427 if (list_empty(&net->nft.commit_list)) {
6428 mutex_unlock(&net->nft.commit_mutex);
6429 return;
6430 }
6431
6432 trans = list_last_entry(&net->nft.commit_list,
6433 struct nft_trans, list);
6434 get_net(trans->ctx.net);
6435 WARN_ON_ONCE(trans->put_net);
6436
6437 trans->put_net = true;
6438 spin_lock(&nf_tables_destroy_list_lock);
6439 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
6440 spin_unlock(&nf_tables_destroy_list_lock);
6441
6442 mutex_unlock(&net->nft.commit_mutex);
6443
6444 schedule_work(&trans_destroy_work);
6445}
6446
5913beaf 6447static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 6448{
37082f93 6449 struct nft_trans *trans, *next;
a3716e70 6450 struct nft_trans_elem *te;
0cbc06b3
FW		 6451 struct nft_chain *chain;
6452 struct nft_table *table;
37082f93 6453
a654de8f
PNA		 6454 /* 0. Validate ruleset, otherwise roll back for error reporting. */
6455 if (nf_tables_validate(net) < 0)
6456 return -EAGAIN;
6457
0cbc06b3
FW		 6458 /* 1. Allocate space for next generation rules_gen_X[] */
6459 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6460 int ret;
37082f93 6461
0cbc06b3
FW		 6462 if (trans->msg_type == NFT_MSG_NEWRULE ||
6463 trans->msg_type == NFT_MSG_DELRULE) {
6464 chain = trans->ctx.chain;
6465
6466 ret = nf_tables_commit_chain_prepare(net, chain);
6467 if (ret < 0) {
6468 nf_tables_commit_chain_prepare_cancel(net);
6469 return ret;
6470 }
6471 }
6472 }
37082f93 6473
0cbc06b3
FW		 6474 /* step 2. Make rules_gen_X visible to packet path */
6475 list_for_each_entry(table, &net->nft.tables, list) {
0fb39bbe
FW		 6476 list_for_each_entry(chain, &table->chains, list)
6477 nf_tables_commit_chain(net, chain);
0cbc06b3
FW		 6478 }
6479
6480 /*
6481 * Bump generation counter, invalidate any dump in progress.
6482 * Cannot fail after this point.
37082f93 6483 */
0cbc06b3
FW		 6484 while (++net->nft.base_seq == 0);
6485
6486 /* step 3. Start new generation, rules_gen_X now in use. */
6487 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 6488
6489 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 6490 switch (trans->msg_type) {
55dd6f93
PNA		 6491 case NFT_MSG_NEWTABLE:
6492 if (nft_trans_table_update(trans)) {
6493 if (!nft_trans_table_enable(trans)) {
664b0f8c 6494 nf_tables_table_disable(net,
55dd6f93
PNA		 6495 trans->ctx.table);
6496 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6497 }
6498 } else {
f2a6d766 6499 nft_clear(net, trans->ctx.table);
55dd6f93 6500 }
35151d84 6501 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 6502 nft_trans_destroy(trans);
6503 break;
6504 case NFT_MSG_DELTABLE:
f2a6d766 6505 list_del_rcu(&trans->ctx.table->list);
35151d84 6506 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 6507 break;
91c7b38d 6508 case NFT_MSG_NEWCHAIN:
9f8aac0b 6509 if (nft_trans_chain_update(trans)) {
91c7b38d 6510 nft_chain_commit_update(trans);
9f8aac0b
FW		 6511 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6512 /* trans destroyed after rcu grace period */
6513 } else {
664b0f8c 6514 nft_clear(net, trans->ctx.chain);
9f8aac0b
FW		 6515 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6516 nft_trans_destroy(trans);
6517 }
91c7b38d
PNA		 6518 break;
6519 case NFT_MSG_DELCHAIN:
1b2470e5 6520 nft_chain_del(trans->ctx.chain);
35151d84 6521 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 6522 nf_tables_unregister_hook(trans->ctx.net,
6523 trans->ctx.table,
6524 trans->ctx.chain);
91c7b38d 6525 break;
b380e5c7 6526 case NFT_MSG_NEWRULE:
889f7ee7 6527 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 6528 nf_tables_rule_notify(&trans->ctx,
37082f93 6529 nft_trans_rule(trans),
35151d84 6530 NFT_MSG_NEWRULE);
37082f93 6531 nft_trans_destroy(trans);
b380e5c7
PNA		 6532 break;
6533 case NFT_MSG_DELRULE:
6534 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 6535 nf_tables_rule_notify(&trans->ctx,
6536 nft_trans_rule(trans),
6537 NFT_MSG_DELRULE);
b380e5c7 6538 break;
958bee14 6539 case NFT_MSG_NEWSET:
37a9cc52 6540 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 6541 /* This avoids hitting -EBUSY when deleting the table
6542 * from the transaction.
6543 */
408070d6 6544 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 6545 !list_empty(&nft_trans_set(trans)->bindings))
6546 trans->ctx.table->use--;
6547
958bee14 6548 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6549 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 6550 nft_trans_destroy(trans);
6551 break;
6552 case NFT_MSG_DELSET:
37a9cc52 6553 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 6554 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6555 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 6556 break;
60319eb1 6557 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 6558 te = (struct nft_trans_elem *)trans->data;
6559
42a55769 6560 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 6561 nf_tables_setelem_notify(&trans->ctx, te->set,
6562 &te->elem,
60319eb1
PNA		 6563 NFT_MSG_NEWSETELEM, 0);
6564 nft_trans_destroy(trans);
6565 break;
6566 case NFT_MSG_DELSETELEM:
a3716e70 6567 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6568
a3716e70
PNA		 6569 nf_tables_setelem_notify(&trans->ctx, te->set,
6570 &te->elem,
60319eb1 6571 NFT_MSG_DELSETELEM, 0);
5cb82a38 6572 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 6573 atomic_dec(&te->set->nelems);
6574 te->set->ndeact--;
60319eb1 6575 break;
e5009240
PNA		 6576 case NFT_MSG_NEWOBJ:
6577 nft_clear(net, nft_trans_obj(trans));
6578 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6579 NFT_MSG_NEWOBJ);
6580 nft_trans_destroy(trans);
6581 break;
6582 case NFT_MSG_DELOBJ:
6583 list_del_rcu(&nft_trans_obj(trans)->list);
6584 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6585 NFT_MSG_DELOBJ);
6586 break;
3b49e2e9
PNA		 6587 case NFT_MSG_NEWFLOWTABLE:
6588 nft_clear(net, nft_trans_flowtable(trans));
6589 nf_tables_flowtable_notify(&trans->ctx,
6590 nft_trans_flowtable(trans),
6591 NFT_MSG_NEWFLOWTABLE);
6592 nft_trans_destroy(trans);
6593 break;
6594 case NFT_MSG_DELFLOWTABLE:
6595 list_del_rcu(&nft_trans_flowtable(trans)->list);
6596 nf_tables_flowtable_notify(&trans->ctx,
6597 nft_trans_flowtable(trans),
6598 NFT_MSG_DELFLOWTABLE);
6599 nft_unregister_flowtable_net_hooks(net,
6600 nft_trans_flowtable(trans));
6601 break;
37082f93 6602 }
37082f93
PNA		 6603 }
6604
84d7fce6 6605 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
0935d558 6606 nf_tables_commit_release(net);
37082f93
PNA		 6607
6608 return 0;
6609}
6610
b326dd37 6611static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 6612{
c7c32e72
PNA		 6613 switch (trans->msg_type) {
6614 case NFT_MSG_NEWTABLE:
6615 nf_tables_table_destroy(&trans->ctx);
6616 break;
6617 case NFT_MSG_NEWCHAIN:
43a605f2 6618 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6619 break;
6620 case NFT_MSG_NEWRULE:
6621 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6622 break;
6623 case NFT_MSG_NEWSET:
6624 nft_set_destroy(nft_trans_set(trans));
6625 break;
61edafbb
PM		 6626 case NFT_MSG_NEWSETELEM:
6627 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 6628 nft_trans_elem(trans).priv, true);
61edafbb 6629 break;
e5009240 6630 case NFT_MSG_NEWOBJ:
00bfb320 6631 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6632 break;
3b49e2e9
PNA		 6633 case NFT_MSG_NEWFLOWTABLE:
6634 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6635 break;
c7c32e72
PNA		 6636 }
6637 kfree(trans);
6638}
6639
71ad00c5 6640static int __nf_tables_abort(struct net *net)
37082f93 6641{
37082f93 6642 struct nft_trans *trans, *next;
02263db0 6643 struct nft_trans_elem *te;
37082f93 6644
a907e36d
XL		 6645 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6646 list) {
b380e5c7 6647 switch (trans->msg_type) {
55dd6f93
PNA		 6648 case NFT_MSG_NEWTABLE:
6649 if (nft_trans_table_update(trans)) {
6650 if (nft_trans_table_enable(trans)) {
664b0f8c 6651 nf_tables_table_disable(net,
55dd6f93
PNA		 6652 trans->ctx.table);
6653 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6654 }
6655 nft_trans_destroy(trans);
6656 } else {
e688a7f8 6657 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 6658 }
6659 break;
6660 case NFT_MSG_DELTABLE:
f2a6d766 6661 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 6662 nft_trans_destroy(trans);
6663 break;
91c7b38d
PNA		 6664 case NFT_MSG_NEWCHAIN:
6665 if (nft_trans_chain_update(trans)) {
982f4051 6666 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b 6667 kfree(nft_trans_chain_name(trans));
91c7b38d
PNA		 6668 nft_trans_destroy(trans);
6669 } else {
4fefee57 6670 trans->ctx.table->use--;
1b2470e5 6671 nft_chain_del(trans->ctx.chain);
c974a3a3
PNA		 6672 nf_tables_unregister_hook(trans->ctx.net,
6673 trans->ctx.table,
6674 trans->ctx.chain);
91c7b38d
PNA		 6675 }
6676 break;
6677 case NFT_MSG_DELCHAIN:
4fefee57 6678 trans->ctx.table->use++;
664b0f8c 6679 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 6680 nft_trans_destroy(trans);
6681 break;
b380e5c7 6682 case NFT_MSG_NEWRULE:
4fefee57 6683 trans->ctx.chain->use--;
b380e5c7 6684 list_del_rcu(&nft_trans_rule(trans)->list);
bb7b40ae 6685 nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
b380e5c7
PNA		 6686 break;
6687 case NFT_MSG_DELRULE:
4fefee57 6688 trans->ctx.chain->use++;
889f7ee7 6689 nft_clear(trans->ctx.net, nft_trans_rule(trans));
bb7b40ae 6690 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
37082f93 6691 nft_trans_destroy(trans);
b380e5c7 6692 break;
958bee14 6693 case NFT_MSG_NEWSET:
4fefee57 6694 trans->ctx.table->use--;
e688a7f8 6695 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 6696 break;
6697 case NFT_MSG_DELSET:
4fefee57 6698 trans->ctx.table->use++;
37a9cc52 6699 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 6700 nft_trans_destroy(trans);
6701 break;
60319eb1 6702 case NFT_MSG_NEWSETELEM:
02263db0 6703 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6704
5cb82a38 6705 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 6706 atomic_dec(&te->set->nelems);
60319eb1
PNA		 6707 break;
6708 case NFT_MSG_DELSETELEM:
cc02e457
PM		 6709 te = (struct nft_trans_elem *)trans->data;
6710
59105446 6711 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 6712 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 6713 te->set->ndeact--;
cc02e457 6714
e5009240
PNA		 6715 nft_trans_destroy(trans);
6716 break;
6717 case NFT_MSG_NEWOBJ:
6718 trans->ctx.table->use--;
6719 list_del_rcu(&nft_trans_obj(trans)->list);
6720 break;
6721 case NFT_MSG_DELOBJ:
6722 trans->ctx.table->use++;
6723 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 6724 nft_trans_destroy(trans);
6725 break;
3b49e2e9
PNA		 6726 case NFT_MSG_NEWFLOWTABLE:
6727 trans->ctx.table->use--;
6728 list_del_rcu(&nft_trans_flowtable(trans)->list);
6729 nft_unregister_flowtable_net_hooks(net,
6730 nft_trans_flowtable(trans));
6731 break;
6732 case NFT_MSG_DELFLOWTABLE:
6733 trans->ctx.table->use++;
6734 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6735 nft_trans_destroy(trans);
6736 break;
37082f93 6737 }
37082f93
PNA		 6738 }
6739
b326dd37
PNA		 6740 synchronize_rcu();
6741
a1cee076
PNA		 6742 list_for_each_entry_safe_reverse(trans, next,
6743 &net->nft.commit_list, list) {
c7c32e72 6744 list_del(&trans->list);
b326dd37 6745 nf_tables_abort_release(trans);
37082f93
PNA		 6746 }
6747
6748 return 0;
6749}
6750
a654de8f
PNA		 6751static void nf_tables_cleanup(struct net *net)
6752{
6753 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
6754}
6755
71ad00c5
FW		 6756static int nf_tables_abort(struct net *net, struct sk_buff *skb)
6757{
f102d66b
FW		 6758 int ret = __nf_tables_abort(net);
6759
6760 mutex_unlock(&net->nft.commit_mutex);
6761
6762 return ret;
71ad00c5
FW		 6763}
6764
74e8bcd2
PNA		 6765static bool nf_tables_valid_genid(struct net *net, u32 genid)
6766{
f102d66b
FW		 6767 bool genid_ok;
6768
6769 mutex_lock(&net->nft.commit_mutex);
6770
6771 genid_ok = genid == 0 || net->nft.base_seq == genid;
6772 if (!genid_ok)
6773 mutex_unlock(&net->nft.commit_mutex);
6774
6775 /* else, commit mutex has to be released by commit or abort function */
6776 return genid_ok;
74e8bcd2
PNA		 6777}
6778
96518518
PM		 6779static const struct nfnetlink_subsystem nf_tables_subsys = {
6780 .name = "nf_tables",
6781 .subsys_id = NFNL_SUBSYS_NFTABLES,
6782 .cb_count = NFT_MSG_MAX,
6783 .cb = nf_tables_cb,
0628b123
PNA		 6784 .commit = nf_tables_commit,
6785 .abort = nf_tables_abort,
a654de8f 6786 .cleanup = nf_tables_cleanup,
74e8bcd2 6787 .valid_genid = nf_tables_valid_genid,
be2ab5b4 6788 .owner = THIS_MODULE,
96518518
PM		 6789};
6790
7210e4e3 6791int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 6792 enum nft_chain_types type)
7210e4e3
PNA		 6793{
6794 const struct nft_base_chain *basechain;
6795
f323d954 6796 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6797 basechain = nft_base_chain(chain);
6798 if (basechain->type->type != type)
6799 return -EOPNOTSUPP;
6800 }
6801 return 0;
6802}
6803EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6804
75e8d06d
PNA		 6805int nft_chain_validate_hooks(const struct nft_chain *chain,
6806 unsigned int hook_flags)
6807{
6808 struct nft_base_chain *basechain;
6809
f323d954 6810 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6811 basechain = nft_base_chain(chain);
6812
c974a3a3 6813 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6814 return 0;
6815
6816 return -EOPNOTSUPP;
6817 }
6818
6819 return 0;
6820}
6821EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6822
20a69341
PM		 6823/*
6824 * Loop detection - walk through the ruleset beginning at the destination chain
6825 * of a new jump until either the source chain is reached (loop) or all
6826 * reachable chains have been traversed.
6827 *
6828 * The loop check is performed whenever a new jump verdict is added to an
6829 * expression or verdict map or a verdict map is bound to a new chain.
6830 */
6831
6832static int nf_tables_check_loops(const struct nft_ctx *ctx,
6833 const struct nft_chain *chain);
6834
6835static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6836 struct nft_set *set,
20a69341 6837 const struct nft_set_iter *iter,
de70185d 6838 struct nft_set_elem *elem)
20a69341 6839{
fe2811eb
PM		 6840 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6841 const struct nft_data *data;
6842
6843 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6844 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 6845 return 0;
6846
fe2811eb 6847 data = nft_set_ext_data(ext);
1ca2e170 6848 switch (data->verdict.code) {
20a69341
PM		 6849 case NFT_JUMP:
6850 case NFT_GOTO:
1ca2e170 6851 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6852 default:
6853 return 0;
6854 }
6855}
6856
6857static int nf_tables_check_loops(const struct nft_ctx *ctx,
6858 const struct nft_chain *chain)
6859{
6860 const struct nft_rule *rule;
6861 const struct nft_expr *expr, *last;
de70185d 6862 struct nft_set *set;
20a69341
PM		 6863 struct nft_set_binding *binding;
6864 struct nft_set_iter iter;
20a69341
PM		 6865
6866 if (ctx->chain == chain)
6867 return -ELOOP;
6868
6869 list_for_each_entry(rule, &chain->rules, list) {
6870 nft_rule_for_each_expr(expr, last, rule) {
a654de8f
PNA		 6871 struct nft_immediate_expr *priv;
6872 const struct nft_data *data;
0ca743a5
PNA		 6873 int err;
6874
a654de8f 6875 if (strcmp(expr->ops->type->name, "immediate"))
20a69341
PM		 6876 continue;
6877
a654de8f
PNA		 6878 priv = nft_expr_priv(expr);
6879 if (priv->dreg != NFT_REG_VERDICT)
0ca743a5 6880 continue;
20a69341 6881
a654de8f 6882 data = &priv->data;
1ca2e170 6883 switch (data->verdict.code) {
20a69341
PM		 6884 case NFT_JUMP:
6885 case NFT_GOTO:
1ca2e170
PM		 6886 err = nf_tables_check_loops(ctx,
6887 data->verdict.chain);
20a69341
PM		 6888 if (err < 0)
6889 return err;
6890 default:
6891 break;
6892 }
6893 }
6894 }
6895
6896 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 6897 if (!nft_is_active_next(ctx->net, set))
6898 continue;
20a69341
PM		 6899 if (!(set->flags & NFT_SET_MAP) ||
6900 set->dtype != NFT_DATA_VERDICT)
6901 continue;
6902
6903 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 6904 if (!(binding->flags & NFT_SET_MAP) ||
6905 binding->chain != chain)
20a69341
PM		 6906 continue;
6907
8588ac09 6908 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 6909 iter.skip = 0;
6910 iter.count = 0;
6911 iter.err = 0;
6912 iter.fn = nf_tables_loop_check_setelem;
6913
6914 set->ops->walk(ctx, set, &iter);
6915 if (iter.err < 0)
6916 return iter.err;
6917 }
6918 }
6919
6920 return 0;
6921}
6922
36b701fa
LGL		 6923/**
6924 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6925 *
6926 * @attr: netlink attribute to fetch value from
6927 * @max: maximum value to be stored in dest
6928 * @dest: pointer to the variable
6929 *
6930 * Parse, check and store a given u32 netlink attribute into variable.
6931 * This function returns -ERANGE if the value goes over maximum value.
6932 * Otherwise a 0 is returned and the attribute value is stored in the
6933 * destination variable.
6934 */
f1d505bb 6935int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 6936{
09525a09 6937 u32 val;
36b701fa
LGL		 6938
6939 val = ntohl(nla_get_be32(attr));
6940 if (val > max)
6941 return -ERANGE;
6942
6943 *dest = val;
6944 return 0;
6945}
6946EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6947
49499c3e
PM		 6948/**
6949 * nft_parse_register - parse a register value from a netlink attribute
6950 *
6951 * @attr: netlink attribute
6952 *
6953 * Parse and translate a register value from a netlink attribute.
6954 * Registers used to be 128 bit wide, these register numbers will be
6955 * mapped to the corresponding 32 bit register numbers.
6956 */
b1c96ed3
PM		 6957unsigned int nft_parse_register(const struct nlattr *attr)
6958{
49499c3e
PM		 6959 unsigned int reg;
6960
6961 reg = ntohl(nla_get_be32(attr));
6962 switch (reg) {
6963 case NFT_REG_VERDICT...NFT_REG_4:
6964 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6965 default:
6966 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6967 }
b1c96ed3
PM		 6968}
6969EXPORT_SYMBOL_GPL(nft_parse_register);
6970
49499c3e
PM		 6971/**
6972 * nft_dump_register - dump a register value to a netlink attribute
6973 *
6974 * @skb: socket buffer
6975 * @attr: attribute number
6976 * @reg: register number
6977 *
6978 * Construct a netlink attribute containing the register number. For
6979 * compatibility reasons, register numbers being a multiple of 4 are
6980 * translated to the corresponding 128 bit register numbers.
6981 */
b1c96ed3
PM		 6982int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6983{
49499c3e
PM		 6984 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6985 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6986 else
6987 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6988
b1c96ed3
PM		 6989 return nla_put_be32(skb, attr, htonl(reg));
6990}
6991EXPORT_SYMBOL_GPL(nft_dump_register);
6992
96518518 6993/**
d07db988 6994 * nft_validate_register_load - validate a load from a register
96518518
PM		 6995 *
6996 * @reg: the register number
d07db988 6997 * @len: the length of the data
96518518
PM		 6998 *
6999 * Validate that the input register is one of the general purpose
d07db988 7000 * registers and that the length of the load is within the bounds.
96518518 7001 */
d07db988 7002int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 7003{
49499c3e 7004 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 7005 return -EINVAL;
d07db988
PM		 7006 if (len == 0)
7007 return -EINVAL;
49499c3e 7008 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 7009 return -ERANGE;
49499c3e 7010
96518518
PM		 7011 return 0;
7012}
d07db988 7013EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 7014
96518518 7015/**
1ec10212 7016 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 7017 *
7018 * @ctx: context of the expression performing the load
7019 * @reg: the destination register number
7020 * @data: the data to load
7021 * @type: the data type
45d9bcda 7022 * @len: the length of the data
96518518
PM		 7023 *
7024 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 7025 * the destination register and the length is within the bounds.
7026 * A value of NULL for the data means that its runtime gathered
58f40ab6 7027 * data.
96518518 7028 */
1ec10212
PM		 7029int nft_validate_register_store(const struct nft_ctx *ctx,
7030 enum nft_registers reg,
7031 const struct nft_data *data,
7032 enum nft_data_types type, unsigned int len)
96518518 7033{
20a69341
PM		 7034 int err;
7035
96518518
PM		 7036 switch (reg) {
7037 case NFT_REG_VERDICT:
58f40ab6 7038 if (type != NFT_DATA_VERDICT)
96518518 7039 return -EINVAL;
20a69341 7040
58f40ab6 7041 if (data != NULL &&
1ca2e170
PM		 7042 (data->verdict.code == NFT_GOTO ||
7043 data->verdict.code == NFT_JUMP)) {
7044 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7045 if (err < 0)
7046 return err;
20a69341
PM		 7047 }
7048
96518518
PM		 7049 return 0;
7050 default:
49499c3e 7051 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 7052 return -EINVAL;
45d9bcda
PM		 7053 if (len == 0)
7054 return -EINVAL;
49499c3e
PM		 7055 if (reg * NFT_REG32_SIZE + len >
7056 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 7057 return -ERANGE;
27e6d201 7058
96518518
PM		 7059 if (data != NULL && type != NFT_DATA_VALUE)
7060 return -EINVAL;
7061 return 0;
7062 }
7063}
1ec10212 7064EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 7065
7066static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
7067 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
7068 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
7069 .len = NFT_CHAIN_MAXNAMELEN - 1 },
7070};
7071
7072static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
7073 struct nft_data_desc *desc, const struct nlattr *nla)
7074{
664b0f8c 7075 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 7076 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
7077 struct nft_chain *chain;
7078 int err;
7079
fceb6435
JB		 7080 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
7081 NULL);
96518518
PM		 7082 if (err < 0)
7083 return err;
7084
7085 if (!tb[NFTA_VERDICT_CODE])
7086 return -EINVAL;
1ca2e170 7087 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 7088
1ca2e170 7089 switch (data->verdict.code) {
e0abdadc 7090 default:
1ca2e170 7091 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 7092 case NF_ACCEPT:
7093 case NF_DROP:
7094 case NF_QUEUE:
7095 break;
7096 default:
7097 return -EINVAL;
7098 }
7099 /* fall through */
96518518
PM		 7100 case NFT_CONTINUE:
7101 case NFT_BREAK:
7102 case NFT_RETURN:
96518518
PM		 7103 break;
7104 case NFT_JUMP:
7105 case NFT_GOTO:
7106 if (!tb[NFTA_VERDICT_CHAIN])
7107 return -EINVAL;
f102d66b
FW		 7108 chain = nft_chain_lookup(ctx->net, ctx->table,
7109 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 7110 if (IS_ERR(chain))
7111 return PTR_ERR(chain);
f323d954 7112 if (nft_is_base_chain(chain))
96518518
PM		 7113 return -EOPNOTSUPP;
7114
96518518 7115 chain->use++;
1ca2e170 7116 data->verdict.chain = chain;
96518518 7117 break;
96518518
PM		 7118 }
7119
4c4ed074 7120 desc->len = sizeof(data->verdict);
96518518
PM		 7121 desc->type = NFT_DATA_VERDICT;
7122 return 0;
7123}
7124
7125static void nft_verdict_uninit(const struct nft_data *data)
7126{
1ca2e170 7127 switch (data->verdict.code) {
96518518
PM		 7128 case NFT_JUMP:
7129 case NFT_GOTO:
1ca2e170 7130 data->verdict.chain->use--;
96518518
PM		 7131 break;
7132 }
7133}
7134
33d5a7b1 7135int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 7136{
7137 struct nlattr *nest;
7138
33d5a7b1 7139 nest = nla_nest_start(skb, type);
96518518
PM		 7140 if (!nest)
7141 goto nla_put_failure;
7142
33d5a7b1 7143 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 7144 goto nla_put_failure;
7145
33d5a7b1 7146 switch (v->code) {
96518518
PM		 7147 case NFT_JUMP:
7148 case NFT_GOTO:
1ca2e170 7149 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 7150 v->chain->name))
96518518
PM		 7151 goto nla_put_failure;
7152 }
7153 nla_nest_end(skb, nest);
7154 return 0;
7155
7156nla_put_failure:
7157 return -1;
7158}
7159
d0a11fc3
PM		 7160static int nft_value_init(const struct nft_ctx *ctx,
7161 struct nft_data *data, unsigned int size,
96518518
PM		 7162 struct nft_data_desc *desc, const struct nlattr *nla)
7163{
7164 unsigned int len;
7165
7166 len = nla_len(nla);
7167 if (len == 0)
7168 return -EINVAL;
d0a11fc3 7169 if (len > size)
96518518
PM		 7170 return -EOVERFLOW;
7171
d0a11fc3 7172 nla_memcpy(data->data, nla, len);
96518518
PM		 7173 desc->type = NFT_DATA_VALUE;
7174 desc->len = len;
7175 return 0;
7176}
7177
7178static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
7179 unsigned int len)
7180{
7181 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
7182}
7183
7184static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 7185 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 7186 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
7187};
7188
7189/**
7190 * nft_data_init - parse nf_tables data netlink attributes
7191 *
7192 * @ctx: context of the expression using the data
7193 * @data: destination struct nft_data
d0a11fc3 7194 * @size: maximum data length
96518518
PM		 7195 * @desc: data description
7196 * @nla: netlink attribute containing data
7197 *
7198 * Parse the netlink data attributes and initialize a struct nft_data.
7199 * The type and length of data are returned in the data description.
7200 *
7201 * The caller can indicate that it only wants to accept data of type
7202 * NFT_DATA_VALUE by passing NULL for the ctx argument.
7203 */
d0a11fc3
PM		 7204int nft_data_init(const struct nft_ctx *ctx,
7205 struct nft_data *data, unsigned int size,
96518518
PM		 7206 struct nft_data_desc *desc, const struct nlattr *nla)
7207{
7208 struct nlattr *tb[NFTA_DATA_MAX + 1];
7209 int err;
7210
fceb6435 7211 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 7212 if (err < 0)
7213 return err;
7214
7215 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 7216 return nft_value_init(ctx, data, size, desc,
7217 tb[NFTA_DATA_VALUE]);
96518518
PM		 7218 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
7219 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
7220 return -EINVAL;
7221}
7222EXPORT_SYMBOL_GPL(nft_data_init);
7223
7224/**
59105446 7225 * nft_data_release - release a nft_data item
96518518
PM		 7226 *
7227 * @data: struct nft_data to release
7228 * @type: type of data
7229 *
7230 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
7231 * all others need to be released by calling this function.
7232 */
59105446 7233void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 7234{
960bd2c2 7235 if (type < NFT_DATA_VERDICT)
96518518 7236 return;
960bd2c2 7237 switch (type) {
96518518
PM		 7238 case NFT_DATA_VERDICT:
7239 return nft_verdict_uninit(data);
7240 default:
7241 WARN_ON(1);
7242 }
7243}
59105446 7244EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 7245
7246int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
7247 enum nft_data_types type, unsigned int len)
7248{
7249 struct nlattr *nest;
7250 int err;
7251
7252 nest = nla_nest_start(skb, attr);
7253 if (nest == NULL)
7254 return -1;
7255
7256 switch (type) {
7257 case NFT_DATA_VALUE:
7258 err = nft_value_dump(skb, data, len);
7259 break;
7260 case NFT_DATA_VERDICT:
33d5a7b1 7261 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 7262 break;
7263 default:
7264 err = -EINVAL;
7265 WARN_ON(1);
7266 }
7267
7268 nla_nest_end(skb, nest);
7269 return err;
7270}
7271EXPORT_SYMBOL_GPL(nft_data_dump);
7272
5ebe0b0e
PNA		 7273int __nft_release_basechain(struct nft_ctx *ctx)
7274{
7275 struct nft_rule *rule, *nr;
7276
fa5950e4
FW		 7277 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
7278 return 0;
5ebe0b0e 7279
c974a3a3 7280 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 7281 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
7282 list_del(&rule->list);
7283 ctx->chain->use--;
bb7b40ae 7284 nf_tables_rule_release(ctx, rule);
5ebe0b0e 7285 }
1b2470e5 7286 nft_chain_del(ctx->chain);
5ebe0b0e 7287 ctx->table->use--;
43a605f2 7288 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 7289
7290 return 0;
7291}
7292EXPORT_SYMBOL_GPL(__nft_release_basechain);
7293
98319cb9 7294static void __nft_release_tables(struct net *net)
df05ef87 7295{
3b49e2e9 7296 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 7297 struct nft_table *table, *nt;
7298 struct nft_chain *chain, *nc;
e5009240 7299 struct nft_object *obj, *ne;
df05ef87
PNA		 7300 struct nft_rule *rule, *nr;
7301 struct nft_set *set, *ns;
7302 struct nft_ctx ctx = {
7303 .net = net,
43a605f2 7304 .family = NFPROTO_NETDEV,
df05ef87
PNA		 7305 };
7306
36596dad 7307 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 7308 ctx.family = table->family;
dd4cbef7 7309
df05ef87 7310 list_for_each_entry(chain, &table->chains, list)
c974a3a3 7311 nf_tables_unregister_hook(net, table, chain);
df05ef87
PNA		 7312 /* No packets are walking on these chains anymore. */
7313 ctx.table = table;
7314 list_for_each_entry(chain, &table->chains, list) {
7315 ctx.chain = chain;
7316 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7317 list_del(&rule->list);
7318 chain->use--;
bb7b40ae 7319 nf_tables_rule_release(&ctx, rule);
df05ef87
PNA		 7320 }
7321 }
3b49e2e9
PNA		 7322 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7323 list_del(&flowtable->list);
7324 table->use--;
7325 nf_tables_flowtable_destroy(flowtable);
7326 }
df05ef87
PNA		 7327 list_for_each_entry_safe(set, ns, &table->sets, list) {
7328 list_del(&set->list);
7329 table->use--;
7330 nft_set_destroy(set);
7331 }
e5009240
PNA		 7332 list_for_each_entry_safe(obj, ne, &table->objects, list) {
7333 list_del(&obj->list);
7334 table->use--;
00bfb320 7335 nft_obj_destroy(&ctx, obj);
e5009240 7336 }
df05ef87 7337 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 7338 ctx.chain = chain;
1b2470e5 7339 nft_chain_del(chain);
df05ef87 7340 table->use--;
43a605f2 7341 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 7342 }
7343 list_del(&table->list);
7344 nf_tables_table_destroy(&ctx);
7345 }
7346}
7347
dd4cbef7
PNA		 7348static int __net_init nf_tables_init_net(struct net *net)
7349{
7350 INIT_LIST_HEAD(&net->nft.tables);
7351 INIT_LIST_HEAD(&net->nft.commit_list);
f102d66b 7352 mutex_init(&net->nft.commit_mutex);
dd4cbef7 7353 net->nft.base_seq = 1;
a654de8f
PNA		 7354 net->nft.validate_state = NFT_VALIDATE_SKIP;
7355
dd4cbef7
PNA		 7356 return 0;
7357}
7358
7359static void __net_exit nf_tables_exit_net(struct net *net)
7360{
f102d66b 7361 mutex_lock(&net->nft.commit_mutex);
71ad00c5
FW		 7362 if (!list_empty(&net->nft.commit_list))
7363 __nf_tables_abort(net);
98319cb9 7364 __nft_release_tables(net);
f102d66b 7365 mutex_unlock(&net->nft.commit_mutex);
dd4cbef7 7366 WARN_ON_ONCE(!list_empty(&net->nft.tables));
dd4cbef7
PNA		 7367}
7368
99633ab2
PNA		 7369static struct pernet_operations nf_tables_net_ops = {
7370 .init = nf_tables_init_net,
613d0776 7371 .exit = nf_tables_exit_net,
99633ab2
PNA		 7372};
7373
96518518
PM		 7374static int __init nf_tables_module_init(void)
7375{
7376 int err;
7377
0935d558 7378 spin_lock_init(&nf_tables_destroy_list_lock);
d209df3e
FW		 7379 err = register_pernet_subsys(&nf_tables_net_ops);
7380 if (err < 0)
7381 return err;
7382
7383 err = nft_chain_filter_init();
7384 if (err < 0)
7385 goto err1;
02c7b25e 7386
96518518
PM		 7387 err = nf_tables_core_module_init();
7388 if (err < 0)
d209df3e 7389 goto err2;
96518518 7390
d209df3e 7391 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
96518518 7392 if (err < 0)
d209df3e 7393 goto err3;
96518518 7394
d209df3e
FW		 7395 /* must be last */
7396 err = nfnetlink_subsys_register(&nf_tables_subsys);
7397 if (err < 0)
7398 goto err4;
3b49e2e9 7399
d209df3e
FW		 7400 return err;
7401err4:
7402 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7403err3:
96518518 7404 nf_tables_core_module_exit();
d209df3e
FW		 7405err2:
7406 nft_chain_filter_fini();
7407err1:
7408 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 7409 return err;
7410}
7411
7412static void __exit nf_tables_module_exit(void)
7413{
7414 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 7415 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
0a2cf5ee 7416 nft_chain_filter_fini();
71ad00c5 7417 unregister_pernet_subsys(&nf_tables_net_ops);
0935d558 7418 cancel_work_sync(&trans_destroy_work);
1b1bc49c 7419 rcu_barrier();
96518518 7420 nf_tables_core_module_exit();
96518518
PM		 7421}
7422
7423module_init(nf_tables_module_init);
7424module_exit(nf_tables_module_exit);
7425
7426MODULE_LICENSE("GPL");
7427MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
7428MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror