]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_tables: add nft_set_elem_expr_alloc()
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
d2912cb1 1// SPDX-License-Identifier: GPL-2.0-only
96518518 2/*
20a69341 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518 4 *
96518518
PM		 5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8#include <linux/module.h>
9#include <linux/init.h>
10#include <linux/list.h>
11#include <linux/skbuff.h>
12#include <linux/netlink.h>
1ff75a3e 13#include <linux/vmalloc.h>
0eb71a9d 14#include <linux/rhashtable.h>
96518518
PM		 15#include <linux/netfilter.h>
16#include <linux/netfilter/nfnetlink.h>
17#include <linux/netfilter/nf_tables.h>
3b49e2e9 18#include <net/netfilter/nf_flow_table.h>
96518518
PM		 19#include <net/netfilter/nf_tables_core.h>
20#include <net/netfilter/nf_tables.h>
c9626a2c 21#include <net/netfilter/nf_tables_offload.h>
99633ab2 22#include <net/net_namespace.h>
96518518
PM		 23#include <net/sock.h>
24
9332d27d
FW		 25#define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
26
96518518 27static LIST_HEAD(nf_tables_expressions);
e5009240 28static LIST_HEAD(nf_tables_objects);
3b49e2e9 29static LIST_HEAD(nf_tables_flowtables);
0935d558
FW		 30static LIST_HEAD(nf_tables_destroy_list);
31static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
3ecbfd65 32static u64 table_handle;
96518518 33
a654de8f
PNA		 34enum {
35 NFT_VALIDATE_SKIP = 0,
36 NFT_VALIDATE_NEED,
37 NFT_VALIDATE_DO,
38};
39
4d44175a
FW		 40static struct rhltable nft_objname_ht;
41
1b2470e5
FW		 42static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
43static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
44static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
45
4d44175a
FW		 46static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
47static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
48static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
49
1b2470e5
FW		 50static const struct rhashtable_params nft_chain_ht_params = {
51 .head_offset = offsetof(struct nft_chain, rhlhead),
52 .key_offset = offsetof(struct nft_chain, name),
53 .hashfn = nft_chain_hash,
54 .obj_hashfn = nft_chain_hash_obj,
55 .obj_cmpfn = nft_chain_hash_cmp,
1b2470e5
FW		 56 .automatic_shrinking = true,
57};
58
4d44175a
FW		 59static const struct rhashtable_params nft_objname_ht_params = {
60 .head_offset = offsetof(struct nft_object, rhlhead),
61 .key_offset = offsetof(struct nft_object, key),
62 .hashfn = nft_objname_hash,
63 .obj_hashfn = nft_objname_hash_obj,
64 .obj_cmpfn = nft_objname_hash_cmp,
65 .automatic_shrinking = true,
66};
67
a654de8f
PNA		 68static void nft_validate_state_update(struct net *net, u8 new_validate_state)
69{
70 switch (net->nft.validate_state) {
71 case NFT_VALIDATE_SKIP:
72 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
73 break;
74 case NFT_VALIDATE_NEED:
75 break;
76 case NFT_VALIDATE_DO:
77 if (new_validate_state == NFT_VALIDATE_NEED)
78 return;
79 }
80
81 net->nft.validate_state = new_validate_state;
82}
0935d558
FW		 83static void nf_tables_trans_destroy_work(struct work_struct *w);
84static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
a654de8f 85
7c95f6d8 86static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 87 struct net *net,
7c95f6d8
PNA		 88 const struct sk_buff *skb,
89 const struct nlmsghdr *nlh,
36596dad 90 u8 family,
7c95f6d8
PNA		 91 struct nft_table *table,
92 struct nft_chain *chain,
93 const struct nlattr * const *nla)
94{
633c9a84 95 ctx->net = net;
36596dad 96 ctx->family = family;
26b2f552 97 ctx->level = 0;
128ad332
PNA		 98 ctx->table = table;
99 ctx->chain = chain;
100 ctx->nla = nla;
101 ctx->portid = NETLINK_CB(skb).portid;
102 ctx->report = nlmsg_report(nlh);
c9626a2c 103 ctx->flags = nlh->nlmsg_flags;
128ad332 104 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 105}
106
8411b644
PNA		 107static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
108 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 109{
110 struct nft_trans *trans;
111
8411b644 112 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 113 if (trans == NULL)
114 return NULL;
115
b380e5c7 116 trans->msg_type = msg_type;
1081d11b
PNA		 117 trans->ctx = *ctx;
118
119 return trans;
120}
121
8411b644
PNA		 122static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
123 int msg_type, u32 size)
124{
125 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
126}
127
1081d11b
PNA		 128static void nft_trans_destroy(struct nft_trans *trans)
129{
130 list_del(&trans->list);
131 kfree(trans);
132}
133
f6ac8585
PNA		 134static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
135{
136 struct net *net = ctx->net;
137 struct nft_trans *trans;
138
139 if (!nft_set_is_anonymous(set))
140 return;
141
142 list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
6a0a8d10
PNA		 143 switch (trans->msg_type) {
144 case NFT_MSG_NEWSET:
145 if (nft_trans_set(trans) == set)
146 nft_trans_set_bound(trans) = true;
147 break;
148 case NFT_MSG_NEWSETELEM:
149 if (nft_trans_elem_set(trans) == set)
150 nft_trans_elem_set_bound(trans) = true;
f6ac8585
PNA		 151 break;
152 }
153 }
154}
155
d54725cd
PNA		 156static int nft_netdev_register_hooks(struct net *net,
157 struct list_head *hook_list)
158{
159 struct nft_hook *hook;
160 int err, j;
161
162 j = 0;
163 list_for_each_entry(hook, hook_list, list) {
164 err = nf_register_net_hook(net, &hook->ops);
165 if (err < 0)
166 goto err_register;
167
168 j++;
169 }
170 return 0;
171
172err_register:
173 list_for_each_entry(hook, hook_list, list) {
174 if (j-- <= 0)
175 break;
176
177 nf_unregister_net_hook(net, &hook->ops);
178 }
179 return err;
180}
181
182static void nft_netdev_unregister_hooks(struct net *net,
183 struct list_head *hook_list)
184{
185 struct nft_hook *hook;
186
187 list_for_each_entry(hook, hook_list, list)
188 nf_unregister_net_hook(net, &hook->ops);
189}
190
191static int nft_register_basechain_hooks(struct net *net, int family,
192 struct nft_base_chain *basechain)
193{
194 if (family == NFPROTO_NETDEV)
195 return nft_netdev_register_hooks(net, &basechain->hook_list);
196
197 return nf_register_net_hook(net, &basechain->ops);
198}
199
200static void nft_unregister_basechain_hooks(struct net *net, int family,
201 struct nft_base_chain *basechain)
202{
203 if (family == NFPROTO_NETDEV)
204 nft_netdev_unregister_hooks(net, &basechain->hook_list);
205 else
206 nf_unregister_net_hook(net, &basechain->ops);
207}
208
c974a3a3
PNA		 209static int nf_tables_register_hook(struct net *net,
210 const struct nft_table *table,
211 struct nft_chain *chain)
d8ee8f7c 212{
d54725cd 213 struct nft_base_chain *basechain;
a37061a6 214 const struct nf_hook_ops *ops;
ae6153b5 215
d8ee8f7c 216 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 217 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 218 return 0;
219
4e25ceb8
FW		 220 basechain = nft_base_chain(chain);
221 ops = &basechain->ops;
ae6153b5 222
4e25ceb8
FW		 223 if (basechain->type->ops_register)
224 return basechain->type->ops_register(net, ops);
225
d54725cd 226 return nft_register_basechain_hooks(net, table->family, basechain);
d8ee8f7c
PNA		 227}
228
c974a3a3
PNA		 229static void nf_tables_unregister_hook(struct net *net,
230 const struct nft_table *table,
231 struct nft_chain *chain)
c5598794 232{
d54725cd 233 struct nft_base_chain *basechain;
4e25ceb8
FW		 234 const struct nf_hook_ops *ops;
235
d8ee8f7c 236 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 237 !nft_is_base_chain(chain))
d8ee8f7c 238 return;
4e25ceb8
FW		 239 basechain = nft_base_chain(chain);
240 ops = &basechain->ops;
d8ee8f7c 241
4e25ceb8
FW		 242 if (basechain->type->ops_unregister)
243 return basechain->type->ops_unregister(net, ops);
244
d54725cd 245 nft_unregister_basechain_hooks(net, table->family, basechain);
c5598794
AB		 246}
247
ee01d542
AB		 248static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
249{
250 struct nft_trans *trans;
251
252 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
253 if (trans == NULL)
254 return -ENOMEM;
255
256 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 257 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 258
259 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
260 return 0;
261}
262
263static int nft_deltable(struct nft_ctx *ctx)
264{
265 int err;
266
267 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
268 if (err < 0)
269 return err;
270
f2a6d766 271 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 272 return err;
273}
274
66293c46 275static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
ee01d542
AB		 276{
277 struct nft_trans *trans;
278
279 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
280 if (trans == NULL)
66293c46 281 return ERR_PTR(-ENOMEM);
ee01d542
AB		 282
283 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 284 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 285
286 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
66293c46 287 return trans;
ee01d542
AB		 288}
289
290static int nft_delchain(struct nft_ctx *ctx)
291{
66293c46 292 struct nft_trans *trans;
ee01d542 293
66293c46
FW		 294 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
295 if (IS_ERR(trans))
296 return PTR_ERR(trans);
ee01d542
AB		 297
298 ctx->table->use--;
664b0f8c 299 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542 300
66293c46 301 return 0;
ee01d542
AB		 302}
303
bb7b40ae
PNA		 304static void nft_rule_expr_activate(const struct nft_ctx *ctx,
305 struct nft_rule *rule)
306{
307 struct nft_expr *expr;
308
309 expr = nft_expr_first(rule);
310 while (expr != nft_expr_last(rule) && expr->ops) {
311 if (expr->ops->activate)
312 expr->ops->activate(ctx, expr);
313
314 expr = nft_expr_next(expr);
315 }
316}
317
318static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
f6ac8585
PNA		 319 struct nft_rule *rule,
320 enum nft_trans_phase phase)
bb7b40ae
PNA		 321{
322 struct nft_expr *expr;
323
324 expr = nft_expr_first(rule);
325 while (expr != nft_expr_last(rule) && expr->ops) {
326 if (expr->ops->deactivate)
f6ac8585 327 expr->ops->deactivate(ctx, expr, phase);
bb7b40ae
PNA		 328
329 expr = nft_expr_next(expr);
330 }
331}
332
ee01d542
AB		 333static int
334nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
335{
336 /* You cannot delete the same rule twice */
889f7ee7
PNA		 337 if (nft_is_active_next(ctx->net, rule)) {
338 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 339 ctx->chain->use--;
340 return 0;
341 }
342 return -ENOENT;
343}
344
345static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
346 struct nft_rule *rule)
347{
348 struct nft_trans *trans;
349
350 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
351 if (trans == NULL)
352 return NULL;
353
1a94e38d
PNA		 354 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
355 nft_trans_rule_id(trans) =
356 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
357 }
ee01d542
AB		 358 nft_trans_rule(trans) = rule;
359 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
360
361 return trans;
362}
363
364static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
365{
63b48c73 366 struct nft_flow_rule *flow;
ee01d542
AB		 367 struct nft_trans *trans;
368 int err;
369
370 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
371 if (trans == NULL)
372 return -ENOMEM;
373
63b48c73
PNA		 374 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
375 flow = nft_flow_rule_create(ctx->net, rule);
376 if (IS_ERR(flow)) {
377 nft_trans_destroy(trans);
378 return PTR_ERR(flow);
379 }
380
381 nft_trans_flow_rule(trans) = flow;
382 }
383
ee01d542
AB		 384 err = nf_tables_delrule_deactivate(ctx, rule);
385 if (err < 0) {
386 nft_trans_destroy(trans);
387 return err;
388 }
f6ac8585 389 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
ee01d542
AB		 390
391 return 0;
392}
393
394static int nft_delrule_by_chain(struct nft_ctx *ctx)
395{
396 struct nft_rule *rule;
397 int err;
398
399 list_for_each_entry(rule, &ctx->chain->rules, list) {
23b7ca4f
PNA		 400 if (!nft_is_active_next(ctx->net, rule))
401 continue;
402
ee01d542
AB		 403 err = nft_delrule(ctx, rule);
404 if (err < 0)
405 return err;
406 }
407 return 0;
408}
409
cd5125d8 410static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
ee01d542
AB		 411 struct nft_set *set)
412{
413 struct nft_trans *trans;
414
415 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
416 if (trans == NULL)
417 return -ENOMEM;
418
419 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
420 nft_trans_set_id(trans) =
421 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 422 nft_activate_next(ctx->net, set);
ee01d542
AB		 423 }
424 nft_trans_set(trans) = set;
425 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
426
427 return 0;
428}
429
cd5125d8 430static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
ee01d542
AB		 431{
432 int err;
433
434 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
435 if (err < 0)
436 return err;
437
37a9cc52 438 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 439 ctx->table->use--;
440
441 return err;
442}
443
e5009240
PNA		 444static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
445 struct nft_object *obj)
446{
447 struct nft_trans *trans;
448
449 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
450 if (trans == NULL)
451 return -ENOMEM;
452
453 if (msg_type == NFT_MSG_NEWOBJ)
454 nft_activate_next(ctx->net, obj);
455
456 nft_trans_obj(trans) = obj;
457 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
458
459 return 0;
460}
461
462static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
463{
464 int err;
465
466 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
467 if (err < 0)
468 return err;
469
470 nft_deactivate_next(ctx->net, obj);
471 ctx->table->use--;
472
473 return err;
474}
475
3b49e2e9
PNA		 476static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
477 struct nft_flowtable *flowtable)
478{
479 struct nft_trans *trans;
480
481 trans = nft_trans_alloc(ctx, msg_type,
482 sizeof(struct nft_trans_flowtable));
483 if (trans == NULL)
484 return -ENOMEM;
485
486 if (msg_type == NFT_MSG_NEWFLOWTABLE)
487 nft_activate_next(ctx->net, flowtable);
488
489 nft_trans_flowtable(trans) = flowtable;
490 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
491
492 return 0;
493}
494
495static int nft_delflowtable(struct nft_ctx *ctx,
496 struct nft_flowtable *flowtable)
497{
498 int err;
499
500 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
501 if (err < 0)
502 return err;
503
504 nft_deactivate_next(ctx->net, flowtable);
505 ctx->table->use--;
506
507 return err;
508}
509
96518518
PM		 510/*
511 * Tables
512 */
513
36596dad 514static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 515 const struct nlattr *nla,
36596dad 516 u8 family, u8 genmask)
96518518
PM		 517{
518 struct nft_table *table;
519
cac20fcd
PNA		 520 if (nla == NULL)
521 return ERR_PTR(-EINVAL);
522
d9adf22a 523 list_for_each_entry_rcu(table, &net->nft.tables, list) {
f2a6d766 524 if (!nla_strcmp(nla, table->name) &&
98319cb9 525 table->family == family &&
f2a6d766 526 nft_active_genmask(table, genmask))
96518518
PM		 527 return table;
528 }
cac20fcd
PNA		 529
530 return ERR_PTR(-ENOENT);
96518518
PM		 531}
532
3ecbfd65
HS		 533static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
534 const struct nlattr *nla,
535 u8 genmask)
536{
537 struct nft_table *table;
538
539 list_for_each_entry(table, &net->nft.tables, list) {
540 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
541 nft_active_genmask(table, genmask))
542 return table;
543 }
3ecbfd65
HS		 544
545 return ERR_PTR(-ENOENT);
546}
547
96518518
PM		 548static inline u64 nf_tables_alloc_handle(struct nft_table *table)
549{
550 return ++table->hgenerator;
551}
552
32537e91 553static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 554
82603549
PNA		 555static const struct nft_chain_type *
556__nft_chain_type_get(u8 family, enum nft_chain_types type)
557{
558 if (family >= NFPROTO_NUMPROTO ||
559 type >= NFT_CHAIN_T_MAX)
560 return NULL;
561
562 return chain_type[family][type];
563}
564
32537e91 565static const struct nft_chain_type *
1ea26cca 566__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c 567{
82603549 568 const struct nft_chain_type *type;
9370761c
PNA		 569 int i;
570
baae3e62 571 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
82603549
PNA		 572 type = __nft_chain_type_get(family, i);
573 if (!type)
574 continue;
575 if (!nla_strcmp(nla, type->name))
576 return type;
9370761c 577 }
baae3e62 578 return NULL;
9370761c
PNA		 579}
580
eb014de4
PNA		 581struct nft_module_request {
582 struct list_head list;
583 char module[MODULE_NAME_LEN];
584 bool done;
585};
586
452238e8 587#ifdef CONFIG_MODULES
eb014de4 588static int nft_request_module(struct net *net, const char *fmt, ...)
452238e8
FW		 589{
590 char module_name[MODULE_NAME_LEN];
eb014de4 591 struct nft_module_request *req;
452238e8
FW		 592 va_list args;
593 int ret;
594
452238e8
FW		 595 va_start(args, fmt);
596 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
597 va_end(args);
9332d27d 598 if (ret >= MODULE_NAME_LEN)
eb014de4 599 return 0;
452238e8 600
eb014de4
PNA		 601 list_for_each_entry(req, &net->nft.module_list, list) {
602 if (!strcmp(req->module, module_name)) {
603 if (req->done)
604 return 0;
ec7470b8 605
eb014de4
PNA		 606 /* A request to load this module already exists. */
607 return -EAGAIN;
608 }
609 }
610
611 req = kmalloc(sizeof(*req), GFP_KERNEL);
612 if (!req)
613 return -ENOMEM;
614
615 req->done = false;
616 strlcpy(req->module, module_name, MODULE_NAME_LEN);
617 list_add_tail(&req->list, &net->nft.module_list);
618
619 return -EAGAIN;
452238e8
FW		 620}
621#endif
622
f102d66b
FW		 623static void lockdep_nfnl_nft_mutex_not_held(void)
624{
625#ifdef CONFIG_PROVE_LOCKING
626 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
627#endif
628}
629
32537e91 630static const struct nft_chain_type *
452238e8
FW		 631nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
632 u8 family, bool autoload)
9370761c 633{
32537e91 634 const struct nft_chain_type *type;
9370761c 635
1ea26cca 636 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 637 if (type != NULL)
638 return type;
f102d66b
FW		 639
640 lockdep_nfnl_nft_mutex_not_held();
9370761c 641#ifdef CONFIG_MODULES
93b0806f 642 if (autoload) {
eb014de4
PNA		 643 if (nft_request_module(net, "nft-chain-%u-%.*s", family,
644 nla_len(nla),
645 (const char *)nla_data(nla)) == -EAGAIN)
93b0806f 646 return ERR_PTR(-EAGAIN);
9370761c
PNA		 647 }
648#endif
93b0806f 649 return ERR_PTR(-ENOENT);
9370761c
PNA		 650}
651
96518518 652static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 653 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
654 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 655 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 656 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 657};
658
84d7fce6
PNA		 659static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
660 u32 portid, u32 seq, int event, u32 flags,
661 int family, const struct nft_table *table)
96518518
PM		 662{
663 struct nlmsghdr *nlh;
664 struct nfgenmsg *nfmsg;
665
dedb67c4 666 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 667 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
668 if (nlh == NULL)
669 goto nla_put_failure;
670
671 nfmsg = nlmsg_data(nlh);
672 nfmsg->nfgen_family = family;
673 nfmsg->version = NFNETLINK_V0;
84d7fce6 674 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 675
9ddf6323 676 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 677 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 678 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
679 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
680 NFTA_TABLE_PAD))
96518518
PM		 681 goto nla_put_failure;
682
053c095a
JB		 683 nlmsg_end(skb, nlh);
684 return 0;
96518518
PM		 685
686nla_put_failure:
687 nlmsg_trim(skb, nlh);
688 return -1;
689}
690
25e94a99 691static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 692{
693 struct sk_buff *skb;
96518518
PM		 694 int err;
695
128ad332
PNA		 696 if (!ctx->report &&
697 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 698 return;
96518518 699
96518518
PM		 700 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
701 if (skb == NULL)
702 goto err;
703
84d7fce6 704 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 705 event, 0, ctx->family, ctx->table);
96518518
PM		 706 if (err < 0) {
707 kfree_skb(skb);
708 goto err;
709 }
710
25e94a99
PNA		 711 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
712 ctx->report, GFP_KERNEL);
713 return;
96518518 714err:
25e94a99 715 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 716}
717
718static int nf_tables_dump_tables(struct sk_buff *skb,
719 struct netlink_callback *cb)
720{
721 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 722 const struct nft_table *table;
723 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 724 struct net *net = sock_net(skb->sk);
96518518
PM		 725 int family = nfmsg->nfgen_family;
726
e688a7f8 727 rcu_read_lock();
38e029f1
PNA		 728 cb->seq = net->nft.base_seq;
729
36596dad 730 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 731 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 732 continue;
733
36596dad
PNA		 734 if (idx < s_idx)
735 goto cont;
736 if (idx > s_idx)
737 memset(&cb->args[1], 0,
738 sizeof(cb->args) - sizeof(cb->args[0]));
739 if (!nft_is_active(net, table))
740 continue;
741 if (nf_tables_fill_table_info(skb, net,
742 NETLINK_CB(cb->skb).portid,
743 cb->nlh->nlmsg_seq,
744 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 745 table->family, table) < 0)
36596dad
PNA		 746 goto done;
747
748 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 749cont:
36596dad 750 idx++;
96518518
PM		 751 }
752done:
e688a7f8 753 rcu_read_unlock();
96518518
PM		 754 cb->args[0] = idx;
755 return skb->len;
756}
757
d9adf22a
FW		 758static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
759 const struct nlmsghdr *nlh,
760 struct netlink_dump_control *c)
761{
762 int err;
763
764 if (!try_module_get(THIS_MODULE))
765 return -EINVAL;
766
767 rcu_read_unlock();
768 err = netlink_dump_start(nlsk, skb, nlh, c);
769 rcu_read_lock();
770 module_put(THIS_MODULE);
771
772 return err;
773}
774
775/* called with rcu_read_lock held */
7b8002a1
PNA		 776static int nf_tables_gettable(struct net *net, struct sock *nlsk,
777 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 778 const struct nlattr * const nla[],
779 struct netlink_ext_ack *extack)
96518518
PM		 780{
781 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 782 u8 genmask = nft_genmask_cur(net);
96518518
PM		 783 const struct nft_table *table;
784 struct sk_buff *skb2;
785 int family = nfmsg->nfgen_family;
786 int err;
787
788 if (nlh->nlmsg_flags & NLM_F_DUMP) {
789 struct netlink_dump_control c = {
790 .dump = nf_tables_dump_tables,
d9adf22a 791 .module = THIS_MODULE,
96518518 792 };
d9adf22a
FW		 793
794 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 795 }
796
cac20fcd 797 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 798 if (IS_ERR(table)) {
799 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 800 return PTR_ERR(table);
36dd1bcc 801 }
96518518 802
d9adf22a 803 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 804 if (!skb2)
805 return -ENOMEM;
806
84d7fce6 807 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 808 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
809 family, table);
810 if (err < 0)
811 goto err;
812
813 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
814
815err:
816 kfree_skb(skb2);
817 return err;
818}
819
c9c17211 820static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 821{
822 struct nft_chain *chain;
823 u32 i = 0;
824
825 list_for_each_entry(chain, &table->chains, list) {
826 if (!nft_is_active_next(net, chain))
827 continue;
f323d954 828 if (!nft_is_base_chain(chain))
10435c11
F		 829 continue;
830
831 if (cnt && i++ == cnt)
832 break;
833
d54725cd
PNA		 834 nft_unregister_basechain_hooks(net, table->family,
835 nft_base_chain(chain));
10435c11
F		 836 }
837}
838
c9c17211 839static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 840{
841 struct nft_chain *chain;
842 int err, i = 0;
843
844 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 845 if (!nft_is_active_next(net, chain))
846 continue;
f323d954 847 if (!nft_is_base_chain(chain))
d2012975
PNA		 848 continue;
849
d54725cd
PNA		 850 err = nft_register_basechain_hooks(net, table->family,
851 nft_base_chain(chain));
9ddf6323 852 if (err < 0)
d54725cd 853 goto err_register_hooks;
9ddf6323
PNA		 854
855 i++;
856 }
857 return 0;
d54725cd
PNA		 858
859err_register_hooks:
10435c11 860 if (i)
c9c17211 861 nft_table_disable(net, table, i);
9ddf6323
PNA		 862 return err;
863}
864
c9c17211 865static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 866{
c9c17211 867 nft_table_disable(net, table, 0);
9ddf6323
PNA		 868}
869
e1aaca93 870static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 871{
55dd6f93 872 struct nft_trans *trans;
e1aaca93 873 u32 flags;
55dd6f93 874 int ret = 0;
9ddf6323 875
e1aaca93
PNA		 876 if (!ctx->nla[NFTA_TABLE_FLAGS])
877 return 0;
9ddf6323 878
e1aaca93
PNA		 879 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
880 if (flags & ~NFT_TABLE_F_DORMANT)
881 return -EINVAL;
882
63283dd2
PNA		 883 if (flags == ctx->table->flags)
884 return 0;
885
55dd6f93
PNA		 886 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
887 sizeof(struct nft_trans_table));
888 if (trans == NULL)
889 return -ENOMEM;
9ddf6323 890
e1aaca93
PNA		 891 if ((flags & NFT_TABLE_F_DORMANT) &&
892 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 893 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 894 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
895 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 896 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 897 if (ret >= 0) {
e1aaca93 898 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 899 nft_trans_table_enable(trans) = true;
9ddf6323 900 }
9ddf6323 901 }
e1aaca93
PNA		 902 if (ret < 0)
903 goto err;
9ddf6323 904
55dd6f93
PNA		 905 nft_trans_table_update(trans) = true;
906 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
907 return 0;
9ddf6323 908err:
55dd6f93 909 nft_trans_destroy(trans);
9ddf6323
PNA		 910 return ret;
911}
912
1b2470e5
FW		 913static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
914{
915 const char *name = data;
916
917 return jhash(name, strlen(name), seed);
918}
919
920static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
921{
922 const struct nft_chain *chain = data;
923
924 return nft_chain_hash(chain->name, 0, seed);
925}
926
927static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
928 const void *ptr)
929{
930 const struct nft_chain *chain = ptr;
931 const char *name = arg->key;
932
933 return strcmp(chain->name, name);
934}
935
4d44175a
FW		 936static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
937{
938 const struct nft_object_hash_key *k = data;
939
940 seed ^= hash_ptr(k->table, 32);
941
942 return jhash(k->name, strlen(k->name), seed);
943}
944
945static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
946{
947 const struct nft_object *obj = data;
948
949 return nft_objname_hash(&obj->key, 0, seed);
950}
951
952static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
953 const void *ptr)
954{
955 const struct nft_object_hash_key *k = arg->key;
956 const struct nft_object *obj = ptr;
957
958 if (obj->key.table != k->table)
959 return -1;
960
961 return strcmp(obj->key.name, k->name);
962}
963
633c9a84
PNA		 964static int nf_tables_newtable(struct net *net, struct sock *nlsk,
965 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 966 const struct nlattr * const nla[],
967 struct netlink_ext_ack *extack)
96518518
PM		 968{
969 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 970 u8 genmask = nft_genmask_next(net);
96518518 971 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 972 const struct nlattr *attr;
973 struct nft_table *table;
c5c1f975 974 u32 flags = 0;
e1aaca93 975 struct nft_ctx ctx;
55dd6f93 976 int err;
96518518 977
f102d66b 978 lockdep_assert_held(&net->nft.commit_mutex);
36dd1bcc
PNA		 979 attr = nla[NFTA_TABLE_NAME];
980 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 981 if (IS_ERR(table)) {
982 if (PTR_ERR(table) != -ENOENT)
983 return PTR_ERR(table);
1a28ad74 984 } else {
36dd1bcc
PNA		 985 if (nlh->nlmsg_flags & NLM_F_EXCL) {
986 NL_SET_BAD_ATTR(extack, attr);
96518518 987 return -EEXIST;
36dd1bcc 988 }
96518518
PM		 989 if (nlh->nlmsg_flags & NLM_F_REPLACE)
990 return -EOPNOTSUPP;
e1aaca93 991
98319cb9 992 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 993 return nf_tables_updtable(&ctx);
96518518
PM		 994 }
995
c5c1f975
PM		 996 if (nla[NFTA_TABLE_FLAGS]) {
997 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
998 if (flags & ~NFT_TABLE_F_DORMANT)
999 return -EINVAL;
1000 }
1001
ffdb210e 1002 err = -ENOMEM;
1cae565e 1003 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 1004 if (table == NULL)
98319cb9 1005 goto err_kzalloc;
96518518 1006
36dd1bcc 1007 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 1008 if (table->name == NULL)
98319cb9 1009 goto err_strdup;
e46abbcc 1010
1b2470e5
FW		 1011 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
1012 if (err)
1013 goto err_chain_ht;
1014
96518518 1015 INIT_LIST_HEAD(&table->chains);
20a69341 1016 INIT_LIST_HEAD(&table->sets);
e5009240 1017 INIT_LIST_HEAD(&table->objects);
3b49e2e9 1018 INIT_LIST_HEAD(&table->flowtables);
98319cb9 1019 table->family = family;
c5c1f975 1020 table->flags = flags;
3ecbfd65 1021 table->handle = ++table_handle;
9ddf6323 1022
98319cb9 1023 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 1024 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 1025 if (err < 0)
98319cb9 1026 goto err_trans;
ffdb210e 1027
36596dad 1028 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 1029 return 0;
98319cb9 1030err_trans:
1b2470e5
FW		 1031 rhltable_destroy(&table->chains_ht);
1032err_chain_ht:
e46abbcc 1033 kfree(table->name);
98319cb9 1034err_strdup:
ffdb210e 1035 kfree(table);
98319cb9 1036err_kzalloc:
ffdb210e 1037 return err;
96518518
PM		 1038}
1039
b9ac12ef
AB		 1040static int nft_flush_table(struct nft_ctx *ctx)
1041{
3b49e2e9 1042 struct nft_flowtable *flowtable, *nft;
b9ac12ef 1043 struct nft_chain *chain, *nc;
e5009240 1044 struct nft_object *obj, *ne;
b9ac12ef 1045 struct nft_set *set, *ns;
3b49e2e9 1046 int err;
b9ac12ef 1047
a2f18db0 1048 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 1049 if (!nft_is_active_next(ctx->net, chain))
1050 continue;
1051
b9ac12ef
AB		 1052 ctx->chain = chain;
1053
1054 err = nft_delrule_by_chain(ctx);
1055 if (err < 0)
1056 goto out;
b9ac12ef
AB		 1057 }
1058
1059 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 1060 if (!nft_is_active_next(ctx->net, set))
1061 continue;
1062
408070d6 1063 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 1064 !list_empty(&set->bindings))
1065 continue;
1066
1067 err = nft_delset(ctx, set);
1068 if (err < 0)
1069 goto out;
1070 }
1071
3b49e2e9 1072 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
335178d5
FW		 1073 if (!nft_is_active_next(ctx->net, flowtable))
1074 continue;
1075
3b49e2e9
PNA		 1076 err = nft_delflowtable(ctx, flowtable);
1077 if (err < 0)
1078 goto out;
1079 }
1080
e5009240 1081 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
335178d5
FW		 1082 if (!nft_is_active_next(ctx->net, obj))
1083 continue;
1084
e5009240
PNA		 1085 err = nft_delobj(ctx, obj);
1086 if (err < 0)
1087 goto out;
1088 }
1089
a2f18db0 1090 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 1091 if (!nft_is_active_next(ctx->net, chain))
1092 continue;
1093
a2f18db0
PNA		 1094 ctx->chain = chain;
1095
1096 err = nft_delchain(ctx);
1097 if (err < 0)
1098 goto out;
1099 }
1100
b9ac12ef
AB		 1101 err = nft_deltable(ctx);
1102out:
1103 return err;
1104}
1105
1106static int nft_flush(struct nft_ctx *ctx, int family)
1107{
b9ac12ef
AB		 1108 struct nft_table *table, *nt;
1109 const struct nlattr * const *nla = ctx->nla;
1110 int err = 0;
1111
36596dad 1112 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 1113 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 1114 continue;
1115
98319cb9 1116 ctx->family = table->family;
f2a6d766 1117
36596dad
PNA		 1118 if (!nft_is_active_next(ctx->net, table))
1119 continue;
b9ac12ef 1120
36596dad
PNA		 1121 if (nla[NFTA_TABLE_NAME] &&
1122 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1123 continue;
b9ac12ef 1124
36596dad
PNA		 1125 ctx->table = table;
1126
1127 err = nft_flush_table(ctx);
1128 if (err < 0)
1129 goto out;
b9ac12ef
AB		 1130 }
1131out:
1132 return err;
1133}
1134
633c9a84
PNA		 1135static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1136 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1137 const struct nlattr * const nla[],
1138 struct netlink_ext_ack *extack)
96518518
PM		 1139{
1140 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1141 u8 genmask = nft_genmask_next(net);
ee01d542 1142 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 1143 const struct nlattr *attr;
1144 struct nft_table *table;
55dd6f93 1145 struct nft_ctx ctx;
96518518 1146
36596dad 1147 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 1148 if (family == AF_UNSPEC ||
1149 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 1150 return nft_flush(&ctx, family);
1151
36dd1bcc
PNA		 1152 if (nla[NFTA_TABLE_HANDLE]) {
1153 attr = nla[NFTA_TABLE_HANDLE];
1154 table = nft_table_lookup_byhandle(net, attr, genmask);
1155 } else {
1156 attr = nla[NFTA_TABLE_NAME];
1157 table = nft_table_lookup(net, attr, family, genmask);
1158 }
3ecbfd65 1159
36dd1bcc
PNA		 1160 if (IS_ERR(table)) {
1161 NL_SET_BAD_ATTR(extack, attr);
96518518 1162 return PTR_ERR(table);
36dd1bcc 1163 }
96518518 1164
a8278400
PNA		 1165 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1166 table->use > 0)
1167 return -EBUSY;
1168
98319cb9 1169 ctx.family = family;
b9ac12ef 1170 ctx.table = table;
55dd6f93 1171
b9ac12ef 1172 return nft_flush_table(&ctx);
96518518
PM		 1173}
1174
55dd6f93
PNA		 1175static void nf_tables_table_destroy(struct nft_ctx *ctx)
1176{
fa5950e4
FW		 1177 if (WARN_ON(ctx->table->use > 0))
1178 return;
4fefee57 1179
1b2470e5 1180 rhltable_destroy(&ctx->table->chains_ht);
e46abbcc 1181 kfree(ctx->table->name);
55dd6f93 1182 kfree(ctx->table);
55dd6f93
PNA		 1183}
1184
cc07eeb0 1185void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 1186{
96518518 1187 nfnl_lock(NFNL_SUBSYS_NFTABLES);
82603549 1188 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
cc07eeb0
PNA		 1189 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1190 return;
96518518 1191 }
9370761c 1192 chain_type[ctype->family][ctype->type] = ctype;
96518518 1193 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 1194}
9370761c 1195EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 1196
32537e91 1197void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 1198{
96518518 1199 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 1200 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 1201 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1202}
9370761c 1203EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 1204
1205/*
1206 * Chains
1207 */
1208
1209static struct nft_chain *
cac20fcd 1210nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 1211{
1212 struct nft_chain *chain;
1213
1214 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 1215 if (chain->handle == handle &&
1216 nft_active_genmask(chain, genmask))
96518518
PM		 1217 return chain;
1218 }
1219
1220 return ERR_PTR(-ENOENT);
1221}
1222
4d44175a 1223static bool lockdep_commit_lock_is_held(const struct net *net)
f102d66b
FW		 1224{
1225#ifdef CONFIG_PROVE_LOCKING
1226 return lockdep_is_held(&net->nft.commit_mutex);
1227#else
1228 return true;
1229#endif
1230}
1231
1232static struct nft_chain *nft_chain_lookup(struct net *net,
1233 struct nft_table *table,
cac20fcd 1234 const struct nlattr *nla, u8 genmask)
96518518 1235{
1b2470e5
FW		 1236 char search[NFT_CHAIN_MAXNAMELEN + 1];
1237 struct rhlist_head *tmp, *list;
96518518
PM		 1238 struct nft_chain *chain;
1239
1240 if (nla == NULL)
1241 return ERR_PTR(-EINVAL);
1242
1b2470e5 1243 nla_strlcpy(search, nla, sizeof(search));
96518518 1244
1b2470e5 1245 WARN_ON(!rcu_read_lock_held() &&
f102d66b 1246 !lockdep_commit_lock_is_held(net));
1b2470e5
FW		 1247
1248 chain = ERR_PTR(-ENOENT);
1249 rcu_read_lock();
1250 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1251 if (!list)
1252 goto out_unlock;
1253
1254 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1255 if (nft_active_genmask(chain, genmask))
1256 goto out_unlock;
1257 }
1258 chain = ERR_PTR(-ENOENT);
1259out_unlock:
1260 rcu_read_unlock();
1261 return chain;
96518518
PM		 1262}
1263
1264static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 1265 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1266 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1267 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1268 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1269 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1270 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 1271 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
9332d27d
FW		 1272 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING,
1273 .len = NFT_MODULE_AUTOLOAD_LIMIT },
0ca743a5 1274 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
c9626a2c 1275 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
96518518
PM		 1276};
1277
1278static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1279 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1280 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1281 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1282 .len = IFNAMSIZ - 1 },
96518518
PM		 1283};
1284
0ca743a5
PNA		 1285static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1286{
1287 struct nft_stats *cpu_stats, total;
1288 struct nlattr *nest;
ce355e20
ED		 1289 unsigned int seq;
1290 u64 pkts, bytes;
0ca743a5
PNA		 1291 int cpu;
1292
edbd82c5
FW		 1293 if (!stats)
1294 return 0;
1295
0ca743a5
PNA		 1296 memset(&total, 0, sizeof(total));
1297 for_each_possible_cpu(cpu) {
1298 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1299 do {
1300 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1301 pkts = cpu_stats->pkts;
1302 bytes = cpu_stats->bytes;
1303 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1304 total.pkts += pkts;
1305 total.bytes += bytes;
0ca743a5 1306 }
ae0be8de 1307 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
0ca743a5
PNA		 1308 if (nest == NULL)
1309 goto nla_put_failure;
1310
b46f6ded
ND		 1311 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1312 NFTA_COUNTER_PAD) ||
1313 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1314 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1315 goto nla_put_failure;
1316
1317 nla_nest_end(skb, nest);
1318 return 0;
1319
1320nla_put_failure:
1321 return -ENOSPC;
1322}
1323
d54725cd
PNA		 1324static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
1325 const struct nft_base_chain *basechain)
1326{
1327 const struct nf_hook_ops *ops = &basechain->ops;
1328 struct nft_hook *hook, *first = NULL;
1329 struct nlattr *nest, *nest_devs;
1330 int n = 0;
1331
1332 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1333 if (nest == NULL)
1334 goto nla_put_failure;
1335 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1336 goto nla_put_failure;
1337 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1338 goto nla_put_failure;
1339
1340 if (family == NFPROTO_NETDEV) {
1341 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
1342 list_for_each_entry(hook, &basechain->hook_list, list) {
1343 if (!first)
1344 first = hook;
1345
1346 if (nla_put_string(skb, NFTA_DEVICE_NAME,
1347 hook->ops.dev->name))
1348 goto nla_put_failure;
1349 n++;
1350 }
1351 nla_nest_end(skb, nest_devs);
1352
1353 if (n == 1 &&
1354 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name))
1355 goto nla_put_failure;
1356 }
1357 nla_nest_end(skb, nest);
1358
1359 return 0;
1360nla_put_failure:
1361 return -1;
1362}
1363
84d7fce6
PNA		 1364static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1365 u32 portid, u32 seq, int event, u32 flags,
1366 int family, const struct nft_table *table,
96518518
PM		 1367 const struct nft_chain *chain)
1368{
1369 struct nlmsghdr *nlh;
1370 struct nfgenmsg *nfmsg;
1371
dedb67c4 1372 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1373 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1374 if (nlh == NULL)
1375 goto nla_put_failure;
1376
1377 nfmsg = nlmsg_data(nlh);
1378 nfmsg->nfgen_family = family;
1379 nfmsg->version = NFNETLINK_V0;
84d7fce6 1380 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1381
1382 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1383 goto nla_put_failure;
b46f6ded
ND		 1384 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1385 NFTA_CHAIN_PAD))
96518518
PM		 1386 goto nla_put_failure;
1387 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1388 goto nla_put_failure;
1389
f323d954 1390 if (nft_is_base_chain(chain)) {
0ca743a5 1391 const struct nft_base_chain *basechain = nft_base_chain(chain);
edbd82c5 1392 struct nft_stats __percpu *stats;
0ca743a5 1393
d54725cd 1394 if (nft_dump_basechain_hook(skb, family, basechain))
2cbce139 1395 goto nla_put_failure;
9370761c 1396
0ca743a5
PNA		 1397 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1398 htonl(basechain->policy)))
1399 goto nla_put_failure;
1400
baae3e62
PM		 1401 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1402 goto nla_put_failure;
0ca743a5 1403
edbd82c5
FW		 1404 stats = rcu_dereference_check(basechain->stats,
1405 lockdep_commit_lock_is_held(net));
1406 if (nft_dump_stats(skb, stats))
0ca743a5 1407 goto nla_put_failure;
d78008de
PNA		 1408
1409 if ((chain->flags & NFT_CHAIN_HW_OFFLOAD) &&
1410 nla_put_be32(skb, NFTA_CHAIN_FLAGS,
1411 htonl(NFT_CHAIN_HW_OFFLOAD)))
1412 goto nla_put_failure;
96518518
PM		 1413 }
1414
0ca743a5
PNA		 1415 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1416 goto nla_put_failure;
1417
053c095a
JB		 1418 nlmsg_end(skb, nlh);
1419 return 0;
96518518
PM		 1420
1421nla_put_failure:
1422 nlmsg_trim(skb, nlh);
1423 return -1;
1424}
1425
25e94a99 1426static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1427{
1428 struct sk_buff *skb;
96518518
PM		 1429 int err;
1430
128ad332
PNA		 1431 if (!ctx->report &&
1432 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1433 return;
96518518 1434
96518518
PM		 1435 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1436 if (skb == NULL)
1437 goto err;
1438
84d7fce6 1439 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1440 event, 0, ctx->family, ctx->table,
35151d84 1441 ctx->chain);
96518518
PM		 1442 if (err < 0) {
1443 kfree_skb(skb);
1444 goto err;
1445 }
1446
25e94a99
PNA		 1447 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1448 ctx->report, GFP_KERNEL);
1449 return;
96518518 1450err:
25e94a99 1451 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1452}
1453
1454static int nf_tables_dump_chains(struct sk_buff *skb,
1455 struct netlink_callback *cb)
1456{
1457 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1458 const struct nft_table *table;
1459 const struct nft_chain *chain;
1460 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1461 struct net *net = sock_net(skb->sk);
96518518
PM		 1462 int family = nfmsg->nfgen_family;
1463
e688a7f8 1464 rcu_read_lock();
38e029f1
PNA		 1465 cb->seq = net->nft.base_seq;
1466
36596dad 1467 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1468 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1469 continue;
1470
36596dad
PNA		 1471 list_for_each_entry_rcu(chain, &table->chains, list) {
1472 if (idx < s_idx)
1473 goto cont;
1474 if (idx > s_idx)
1475 memset(&cb->args[1], 0,
1476 sizeof(cb->args) - sizeof(cb->args[0]));
1477 if (!nft_is_active(net, chain))
1478 continue;
1479 if (nf_tables_fill_chain_info(skb, net,
1480 NETLINK_CB(cb->skb).portid,
1481 cb->nlh->nlmsg_seq,
1482 NFT_MSG_NEWCHAIN,
1483 NLM_F_MULTI,
98319cb9 1484 table->family, table,
36596dad
PNA		 1485 chain) < 0)
1486 goto done;
38e029f1 1487
36596dad 1488 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1489cont:
36596dad 1490 idx++;
96518518
PM		 1491 }
1492 }
1493done:
e688a7f8 1494 rcu_read_unlock();
96518518
PM		 1495 cb->args[0] = idx;
1496 return skb->len;
1497}
1498
d9adf22a 1499/* called with rcu_read_lock held */
7b8002a1
PNA		 1500static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1501 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1502 const struct nlattr * const nla[],
1503 struct netlink_ext_ack *extack)
96518518
PM		 1504{
1505 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1506 u8 genmask = nft_genmask_cur(net);
96518518 1507 const struct nft_chain *chain;
1b2470e5 1508 struct nft_table *table;
96518518
PM		 1509 struct sk_buff *skb2;
1510 int family = nfmsg->nfgen_family;
1511 int err;
1512
1513 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1514 struct netlink_dump_control c = {
1515 .dump = nf_tables_dump_chains,
d9adf22a 1516 .module = THIS_MODULE,
96518518 1517 };
d9adf22a
FW		 1518
1519 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 1520 }
1521
cac20fcd 1522 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1523 if (IS_ERR(table)) {
1524 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1525 return PTR_ERR(table);
36dd1bcc 1526 }
96518518 1527
f102d66b 1528 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1529 if (IS_ERR(chain)) {
1530 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1531 return PTR_ERR(chain);
36dd1bcc 1532 }
96518518 1533
d9adf22a 1534 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 1535 if (!skb2)
1536 return -ENOMEM;
1537
84d7fce6 1538 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1539 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1540 family, table, chain);
1541 if (err < 0)
1542 goto err;
1543
1544 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1545
1546err:
1547 kfree_skb(skb2);
1548 return err;
1549}
1550
0ca743a5
PNA		 1551static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1552 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1553 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1554};
1555
ff3cd7b3 1556static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1557{
1558 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1559 struct nft_stats __percpu *newstats;
1560 struct nft_stats *stats;
1561 int err;
1562
8cb08174
JB		 1563 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1564 nft_counter_policy, NULL);
0ca743a5 1565 if (err < 0)
ff3cd7b3 1566 return ERR_PTR(err);
0ca743a5
PNA		 1567
1568 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1569 return ERR_PTR(-EINVAL);
0ca743a5 1570
ce355e20 1571 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1572 if (newstats == NULL)
ff3cd7b3 1573 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1574
1575 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1576 * are not exposed to userspace.
1577 */
e8781f70 1578 preempt_disable();
0ca743a5
PNA		 1579 stats = this_cpu_ptr(newstats);
1580 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1581 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1582 preempt_enable();
0ca743a5 1583
ff3cd7b3
PNA		 1584 return newstats;
1585}
1586
53315ac6 1587static void nft_chain_stats_replace(struct nft_trans *trans)
ff3cd7b3 1588{
53315ac6 1589 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
0befd061 1590
53315ac6 1591 if (!nft_trans_chain_stats(trans))
b88825de
PNA		 1592 return;
1593
b685b534
PM		 1594 nft_trans_chain_stats(trans) =
1595 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans),
1596 lockdep_commit_lock_is_held(trans->ctx.net));
53315ac6
FW		 1597
1598 if (!nft_trans_chain_stats(trans))
bbb8c61f 1599 static_branch_inc(&nft_counters_enabled);
0ca743a5
PNA		 1600}
1601
0cbc06b3
FW		 1602static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1603{
1604 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1605 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1606
1607 if (g0 != g1)
1608 kvfree(g1);
1609 kvfree(g0);
1610
1611 /* should be NULL either via abort or via successful commit */
1612 WARN_ON_ONCE(chain->rules_next);
1613 kvfree(chain->rules_next);
1614}
1615
43a605f2 1616static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1617{
43a605f2 1618 struct nft_chain *chain = ctx->chain;
d54725cd 1619 struct nft_hook *hook, *next;
43a605f2 1620
fa5950e4
FW		 1621 if (WARN_ON(chain->use > 0))
1622 return;
91c7b38d 1623
0cbc06b3
FW		 1624 /* no concurrent access possible anymore */
1625 nf_tables_chain_free_chain_rules(chain);
1626
f323d954 1627 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1628 struct nft_base_chain *basechain = nft_base_chain(chain);
1629
d54725cd
PNA		 1630 if (ctx->family == NFPROTO_NETDEV) {
1631 list_for_each_entry_safe(hook, next,
1632 &basechain->hook_list, list) {
1633 list_del_rcu(&hook->list);
1634 kfree_rcu(hook, rcu);
1635 }
1636 }
2cbce139 1637 module_put(basechain->type->owner);
4c05ec47 1638 if (rcu_access_pointer(basechain->stats)) {
9f08ea84 1639 static_branch_dec(&nft_counters_enabled);
4c05ec47
TY		 1640 free_percpu(rcu_dereference_raw(basechain->stats));
1641 }
b7263e07 1642 kfree(chain->name);
2cbce139 1643 kfree(basechain);
91c7b38d 1644 } else {
b7263e07 1645 kfree(chain->name);
91c7b38d
PNA		 1646 kfree(chain);
1647 }
1648}
1649
3f0465a9
PNA		 1650static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
1651 const struct nlattr *attr)
1652{
1653 struct net_device *dev;
1654 char ifname[IFNAMSIZ];
1655 struct nft_hook *hook;
1656 int err;
1657
1658 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1659 if (!hook) {
1660 err = -ENOMEM;
1661 goto err_hook_alloc;
1662 }
1663
1664 nla_strlcpy(ifname, attr, IFNAMSIZ);
1665 dev = __dev_get_by_name(net, ifname);
1666 if (!dev) {
1667 err = -ENOENT;
1668 goto err_hook_dev;
1669 }
1670 hook->ops.dev = dev;
1671
1672 return hook;
1673
1674err_hook_dev:
1675 kfree(hook);
1676err_hook_alloc:
1677 return ERR_PTR(err);
1678}
1679
b75a3e83
PNA		 1680static bool nft_hook_list_find(struct list_head *hook_list,
1681 const struct nft_hook *this)
1682{
1683 struct nft_hook *hook;
1684
1685 list_for_each_entry(hook, hook_list, list) {
1686 if (this->ops.dev == hook->ops.dev)
1687 return true;
1688 }
1689
1690 return false;
1691}
1692
3f0465a9
PNA		 1693static int nf_tables_parse_netdev_hooks(struct net *net,
1694 const struct nlattr *attr,
1695 struct list_head *hook_list)
1696{
1697 struct nft_hook *hook, *next;
1698 const struct nlattr *tmp;
1699 int rem, n = 0, err;
1700
1701 nla_for_each_nested(tmp, attr, rem) {
1702 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
1703 err = -EINVAL;
1704 goto err_hook;
1705 }
1706
1707 hook = nft_netdev_hook_alloc(net, tmp);
1708 if (IS_ERR(hook)) {
1709 err = PTR_ERR(hook);
1710 goto err_hook;
1711 }
b75a3e83 1712 if (nft_hook_list_find(hook_list, hook)) {
cd77e75b 1713 kfree(hook);
b75a3e83
PNA		 1714 err = -EEXIST;
1715 goto err_hook;
1716 }
3f0465a9
PNA		 1717 list_add_tail(&hook->list, hook_list);
1718 n++;
1719
cb662ac6 1720 if (n == NFT_NETDEVICE_MAX) {
3f0465a9
PNA		 1721 err = -EFBIG;
1722 goto err_hook;
1723 }
1724 }
1725 if (!n)
1726 return -EINVAL;
1727
1728 return 0;
1729
1730err_hook:
1731 list_for_each_entry_safe(hook, next, hook_list, list) {
1732 list_del(&hook->list);
1733 kfree(hook);
1734 }
1735 return err;
1736}
1737
508f8ccd
PNA		 1738struct nft_chain_hook {
1739 u32 num;
84ba7dd7 1740 s32 priority;
32537e91 1741 const struct nft_chain_type *type;
d54725cd 1742 struct list_head list;
508f8ccd
PNA		 1743};
1744
d54725cd
PNA		 1745static int nft_chain_parse_netdev(struct net *net,
1746 struct nlattr *tb[],
1747 struct list_head *hook_list)
1748{
1749 struct nft_hook *hook;
1750 int err;
1751
1752 if (tb[NFTA_HOOK_DEV]) {
1753 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
1754 if (IS_ERR(hook))
1755 return PTR_ERR(hook);
1756
1757 list_add_tail(&hook->list, hook_list);
1758 } else if (tb[NFTA_HOOK_DEVS]) {
1759 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
1760 hook_list);
1761 if (err < 0)
1762 return err;
1763 } else {
1764 return -EINVAL;
1765 }
1766
1767 return 0;
1768}
1769
508f8ccd
PNA		 1770static int nft_chain_parse_hook(struct net *net,
1771 const struct nlattr * const nla[],
36596dad 1772 struct nft_chain_hook *hook, u8 family,
445509eb 1773 bool autoload)
508f8ccd
PNA		 1774{
1775 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1776 const struct nft_chain_type *type;
508f8ccd
PNA		 1777 int err;
1778
f102d66b
FW		 1779 lockdep_assert_held(&net->nft.commit_mutex);
1780 lockdep_nfnl_nft_mutex_not_held();
1781
8cb08174
JB		 1782 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
1783 nla[NFTA_CHAIN_HOOK],
1784 nft_hook_policy, NULL);
508f8ccd
PNA		 1785 if (err < 0)
1786 return err;
1787
1788 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1789 ha[NFTA_HOOK_PRIORITY] == NULL)
1790 return -EINVAL;
1791
1792 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1793 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1794
82603549
PNA		 1795 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
1796 if (!type)
1797 return -EOPNOTSUPP;
1798
508f8ccd 1799 if (nla[NFTA_CHAIN_TYPE]) {
452238e8 1800 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
445509eb 1801 family, autoload);
508f8ccd
PNA		 1802 if (IS_ERR(type))
1803 return PTR_ERR(type);
1804 }
33d1c018 1805 if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
508f8ccd 1806 return -EOPNOTSUPP;
84ba7dd7
FW		 1807
1808 if (type->type == NFT_CHAIN_T_NAT &&
1809 hook->priority <= NF_IP_PRI_CONNTRACK)
1810 return -EOPNOTSUPP;
1811
508f8ccd
PNA		 1812 if (!try_module_get(type->owner))
1813 return -ENOENT;
1814
1815 hook->type = type;
1816
d54725cd 1817 INIT_LIST_HEAD(&hook->list);
36596dad 1818 if (family == NFPROTO_NETDEV) {
d54725cd
PNA		 1819 err = nft_chain_parse_netdev(net, ha, &hook->list);
1820 if (err < 0) {
508f8ccd 1821 module_put(type->owner);
d54725cd 1822 return err;
508f8ccd 1823 }
d54725cd 1824 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) {
508f8ccd
PNA		 1825 module_put(type->owner);
1826 return -EOPNOTSUPP;
1827 }
1828
1829 return 0;
1830}
1831
1832static void nft_chain_release_hook(struct nft_chain_hook *hook)
1833{
d54725cd
PNA		 1834 struct nft_hook *h, *next;
1835
1836 list_for_each_entry_safe(h, next, &hook->list, list) {
1837 list_del(&h->list);
1838 kfree(h);
1839 }
508f8ccd 1840 module_put(hook->type->owner);
508f8ccd
PNA		 1841}
1842
0cbc06b3
FW		 1843struct nft_rules_old {
1844 struct rcu_head h;
1845 struct nft_rule **start;
1846};
1847
1848static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1849 unsigned int alloc)
1850{
1851 if (alloc > INT_MAX)
1852 return NULL;
1853
1854 alloc += 1; /* NULL, ends rules */
1855 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1856 return NULL;
1857
1858 alloc *= sizeof(struct nft_rule *);
1859 alloc += sizeof(struct nft_rules_old);
1860
1861 return kvmalloc(alloc, GFP_KERNEL);
1862}
1863
d54725cd
PNA		 1864static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family,
1865 const struct nft_chain_hook *hook,
1866 struct nft_chain *chain)
1867{
1868 ops->pf = family;
1869 ops->hooknum = hook->num;
1870 ops->priority = hook->priority;
1871 ops->priv = chain;
1872 ops->hook = hook->type->hooks[ops->hooknum];
1873}
1874
1875static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
1876 struct nft_chain_hook *hook, u32 flags)
1877{
1878 struct nft_chain *chain;
1879 struct nft_hook *h;
1880
1881 basechain->type = hook->type;
1882 INIT_LIST_HEAD(&basechain->hook_list);
1883 chain = &basechain->chain;
1884
1885 if (family == NFPROTO_NETDEV) {
1886 list_splice_init(&hook->list, &basechain->hook_list);
1887 list_for_each_entry(h, &basechain->hook_list, list)
1888 nft_basechain_hook_init(&h->ops, family, hook, chain);
1889
1890 basechain->ops.hooknum = hook->num;
1891 basechain->ops.priority = hook->priority;
1892 } else {
1893 nft_basechain_hook_init(&basechain->ops, family, hook, chain);
1894 }
1895
1896 chain->flags |= NFT_BASE_CHAIN | flags;
1897 basechain->policy = NF_ACCEPT;
1898 if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
1899 nft_chain_offload_priority(basechain) < 0)
1900 return -EOPNOTSUPP;
1901
1902 flow_block_init(&basechain->flow_block);
1903
1904 return 0;
1905}
1906
4035285f 1907static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
c9626a2c 1908 u8 policy, u32 flags)
4035285f
PNA		 1909{
1910 const struct nlattr * const *nla = ctx->nla;
1911 struct nft_table *table = ctx->table;
4035285f
PNA		 1912 struct nft_base_chain *basechain;
1913 struct nft_stats __percpu *stats;
1914 struct net *net = ctx->net;
66293c46 1915 struct nft_trans *trans;
4035285f 1916 struct nft_chain *chain;
0cbc06b3 1917 struct nft_rule **rules;
4035285f
PNA		 1918 int err;
1919
1920 if (table->use == UINT_MAX)
1921 return -EOVERFLOW;
1922
1923 if (nla[NFTA_CHAIN_HOOK]) {
1924 struct nft_chain_hook hook;
4035285f 1925
445509eb 1926 err = nft_chain_parse_hook(net, nla, &hook, family, true);
4035285f
PNA		 1927 if (err < 0)
1928 return err;
1929
1930 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1931 if (basechain == NULL) {
1932 nft_chain_release_hook(&hook);
1933 return -ENOMEM;
1934 }
d54725cd 1935 chain = &basechain->chain;
4035285f
PNA		 1936
1937 if (nla[NFTA_CHAIN_COUNTERS]) {
1938 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1939 if (IS_ERR(stats)) {
1940 nft_chain_release_hook(&hook);
1941 kfree(basechain);
1942 return PTR_ERR(stats);
1943 }
4c05ec47 1944 rcu_assign_pointer(basechain->stats, stats);
4035285f
PNA		 1945 static_branch_inc(&nft_counters_enabled);
1946 }
1947
d54725cd
PNA		 1948 err = nft_basechain_init(basechain, family, &hook, flags);
1949 if (err < 0) {
1950 nft_chain_release_hook(&hook);
1951 kfree(basechain);
1952 return err;
1953 }
4035285f
PNA		 1954 } else {
1955 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1956 if (chain == NULL)
1957 return -ENOMEM;
1958 }
43a605f2
PNA		 1959 ctx->chain = chain;
1960
4035285f
PNA		 1961 INIT_LIST_HEAD(&chain->rules);
1962 chain->handle = nf_tables_alloc_handle(table);
1963 chain->table = table;
1964 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1965 if (!chain->name) {
1966 err = -ENOMEM;
1967 goto err1;
1968 }
1969
0cbc06b3
FW		 1970 rules = nf_tables_chain_alloc_rules(chain, 0);
1971 if (!rules) {
1972 err = -ENOMEM;
1973 goto err1;
1974 }
1975
1976 *rules = NULL;
1977 rcu_assign_pointer(chain->rules_gen_0, rules);
1978 rcu_assign_pointer(chain->rules_gen_1, rules);
1979
c974a3a3 1980 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1981 if (err < 0)
1982 goto err1;
1983
1b2470e5
FW		 1984 err = rhltable_insert_key(&table->chains_ht, chain->name,
1985 &chain->rhlhead, nft_chain_ht_params);
1986 if (err)
1987 goto err2;
1988
66293c46
FW		 1989 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1990 if (IS_ERR(trans)) {
1991 err = PTR_ERR(trans);
1b2470e5
FW		 1992 rhltable_remove(&table->chains_ht, &chain->rhlhead,
1993 nft_chain_ht_params);
4035285f 1994 goto err2;
1b2470e5 1995 }
4035285f 1996
ad652f38 1997 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
66293c46
FW		 1998 if (nft_is_base_chain(chain))
1999 nft_trans_chain_policy(trans) = policy;
2000
4035285f
PNA		 2001 table->use++;
2002 list_add_tail_rcu(&chain->list, &table->chains);
2003
2004 return 0;
2005err2:
c974a3a3 2006 nf_tables_unregister_hook(net, table, chain);
4035285f 2007err1:
43a605f2 2008 nf_tables_chain_destroy(ctx);
4035285f
PNA		 2009
2010 return err;
2011}
2012
d54725cd
PNA		 2013static bool nft_hook_list_equal(struct list_head *hook_list1,
2014 struct list_head *hook_list2)
2015{
2016 struct nft_hook *hook;
2017 int n = 0, m = 0;
2018
2019 n = 0;
2020 list_for_each_entry(hook, hook_list2, list) {
2021 if (!nft_hook_list_find(hook_list1, hook))
2022 return false;
2023
2024 n++;
2025 }
2026 list_for_each_entry(hook, hook_list1, list)
2027 m++;
2028
2029 return n == m;
2030}
2031
c9626a2c
PNA		 2032static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
2033 u32 flags)
2c4a488a
PNA		 2034{
2035 const struct nlattr * const *nla = ctx->nla;
2036 struct nft_table *table = ctx->table;
2037 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 2038 struct nft_base_chain *basechain;
2039 struct nft_stats *stats = NULL;
2040 struct nft_chain_hook hook;
2c4a488a
PNA		 2041 struct nf_hook_ops *ops;
2042 struct nft_trans *trans;
c974a3a3 2043 int err;
2c4a488a 2044
c9626a2c
PNA		 2045 if (chain->flags ^ flags)
2046 return -EOPNOTSUPP;
2047
2c4a488a
PNA		 2048 if (nla[NFTA_CHAIN_HOOK]) {
2049 if (!nft_is_base_chain(chain))
2050 return -EBUSY;
2051
36596dad 2052 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
445509eb 2053 false);
2c4a488a
PNA		 2054 if (err < 0)
2055 return err;
2056
2057 basechain = nft_base_chain(chain);
2058 if (basechain->type != hook.type) {
2059 nft_chain_release_hook(&hook);
2060 return -EBUSY;
2061 }
2062
d54725cd
PNA		 2063 if (ctx->family == NFPROTO_NETDEV) {
2064 if (!nft_hook_list_equal(&basechain->hook_list,
2065 &hook.list)) {
2066 nft_chain_release_hook(&hook);
2067 return -EBUSY;
2068 }
2069 } else {
2070 ops = &basechain->ops;
2071 if (ops->hooknum != hook.num ||
2072 ops->priority != hook.priority) {
2073 nft_chain_release_hook(&hook);
2074 return -EBUSY;
2075 }
2c4a488a
PNA		 2076 }
2077 nft_chain_release_hook(&hook);
2078 }
2079
2080 if (nla[NFTA_CHAIN_HANDLE] &&
2081 nla[NFTA_CHAIN_NAME]) {
2082 struct nft_chain *chain2;
2083
f102d66b
FW		 2084 chain2 = nft_chain_lookup(ctx->net, table,
2085 nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 2086 if (!IS_ERR(chain2))
2087 return -EEXIST;
2c4a488a
PNA		 2088 }
2089
2090 if (nla[NFTA_CHAIN_COUNTERS]) {
2091 if (!nft_is_base_chain(chain))
2092 return -EOPNOTSUPP;
2093
2094 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2095 if (IS_ERR(stats))
2096 return PTR_ERR(stats);
2097 }
2098
c6cc94df 2099 err = -ENOMEM;
2c4a488a
PNA		 2100 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
2101 sizeof(struct nft_trans_chain));
c6cc94df
FW		 2102 if (trans == NULL)
2103 goto err;
2c4a488a
PNA		 2104
2105 nft_trans_chain_stats(trans) = stats;
2106 nft_trans_chain_update(trans) = true;
2107
2108 if (nla[NFTA_CHAIN_POLICY])
2109 nft_trans_chain_policy(trans) = policy;
2110 else
2111 nft_trans_chain_policy(trans) = -1;
2112
c6cc94df
FW		 2113 if (nla[NFTA_CHAIN_HANDLE] &&
2114 nla[NFTA_CHAIN_NAME]) {
2115 struct nft_trans *tmp;
2116 char *name;
2117
2118 err = -ENOMEM;
2119 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2120 if (!name)
2121 goto err;
2122
2123 err = -EEXIST;
2124 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
2125 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
2126 tmp->ctx.table == table &&
2127 nft_trans_chain_update(tmp) &&
2128 nft_trans_chain_name(tmp) &&
2129 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
2130 kfree(name);
2131 goto err;
2132 }
2c4a488a 2133 }
c6cc94df
FW		 2134
2135 nft_trans_chain_name(trans) = name;
2c4a488a
PNA		 2136 }
2137 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
2138
2139 return 0;
c6cc94df
FW		 2140err:
2141 free_percpu(stats);
2142 kfree(trans);
2143 return err;
2c4a488a
PNA		 2144}
2145
633c9a84
PNA		 2146static int nf_tables_newchain(struct net *net, struct sock *nlsk,
2147 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2148 const struct nlattr * const nla[],
2149 struct netlink_ext_ack *extack)
96518518
PM		 2150{
2151 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 2152 u8 genmask = nft_genmask_next(net);
2153 int family = nfmsg->nfgen_family;
36dd1bcc 2154 const struct nlattr *attr;
96518518
PM		 2155 struct nft_table *table;
2156 struct nft_chain *chain;
57de2a0c 2157 u8 policy = NF_ACCEPT;
4035285f 2158 struct nft_ctx ctx;
96518518 2159 u64 handle = 0;
c9626a2c 2160 u32 flags = 0;
96518518 2161
f102d66b
FW		 2162 lockdep_assert_held(&net->nft.commit_mutex);
2163
cac20fcd 2164 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 2165 if (IS_ERR(table)) {
2166 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 2167 return PTR_ERR(table);
36dd1bcc 2168 }
96518518 2169
96518518 2170 chain = NULL;
36dd1bcc 2171 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 2172
2173 if (nla[NFTA_CHAIN_HANDLE]) {
2174 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 2175 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 2176 if (IS_ERR(chain)) {
2177 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 2178 return PTR_ERR(chain);
36dd1bcc
PNA		 2179 }
2180 attr = nla[NFTA_CHAIN_HANDLE];
96518518 2181 } else {
f102d66b 2182 chain = nft_chain_lookup(net, table, attr, genmask);
96518518 2183 if (IS_ERR(chain)) {
36dd1bcc
PNA		 2184 if (PTR_ERR(chain) != -ENOENT) {
2185 NL_SET_BAD_ATTR(extack, attr);
96518518 2186 return PTR_ERR(chain);
36dd1bcc 2187 }
96518518
PM		 2188 chain = NULL;
2189 }
2190 }
2191
57de2a0c 2192 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 2193 if (chain != NULL &&
36dd1bcc
PNA		 2194 !nft_is_base_chain(chain)) {
2195 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 2196 return -EOPNOTSUPP;
36dd1bcc 2197 }
d6b6cb1d
PNA		 2198
2199 if (chain == NULL &&
36dd1bcc
PNA		 2200 nla[NFTA_CHAIN_HOOK] == NULL) {
2201 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 2202 return -EOPNOTSUPP;
36dd1bcc 2203 }
57de2a0c 2204
8f46df18 2205 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 2206 switch (policy) {
2207 case NF_DROP:
2208 case NF_ACCEPT:
2209 break;
2210 default:
2211 return -EINVAL;
2212 }
2213 }
2214
c9626a2c
PNA		 2215 if (nla[NFTA_CHAIN_FLAGS])
2216 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
b717273d
FW		 2217 else if (chain)
2218 flags = chain->flags;
c9626a2c 2219
98319cb9 2220 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 2221
96518518 2222 if (chain != NULL) {
36dd1bcc
PNA		 2223 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2224 NL_SET_BAD_ATTR(extack, attr);
96518518 2225 return -EEXIST;
36dd1bcc 2226 }
96518518
PM		 2227 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2228 return -EOPNOTSUPP;
2229
1ed012f6 2230 flags |= chain->flags & NFT_BASE_CHAIN;
c9626a2c 2231 return nf_tables_updchain(&ctx, genmask, policy, flags);
96518518
PM		 2232 }
2233
c9626a2c 2234 return nf_tables_addchain(&ctx, family, genmask, policy, flags);
96518518
PM		 2235}
2236
633c9a84
PNA		 2237static int nf_tables_delchain(struct net *net, struct sock *nlsk,
2238 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2239 const struct nlattr * const nla[],
2240 struct netlink_ext_ack *extack)
96518518
PM		 2241{
2242 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2243 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 2244 int family = nfmsg->nfgen_family;
2245 const struct nlattr *attr;
96518518
PM		 2246 struct nft_table *table;
2247 struct nft_chain *chain;
9dee1474 2248 struct nft_rule *rule;
91c7b38d 2249 struct nft_ctx ctx;
3ecbfd65 2250 u64 handle;
9dee1474
PNA		 2251 u32 use;
2252 int err;
96518518 2253
cac20fcd 2254 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 2255 if (IS_ERR(table)) {
2256 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 2257 return PTR_ERR(table);
36dd1bcc 2258 }
96518518 2259
3ecbfd65 2260 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 2261 attr = nla[NFTA_CHAIN_HANDLE];
2262 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 2263 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 2264 } else {
36dd1bcc 2265 attr = nla[NFTA_CHAIN_NAME];
f102d66b 2266 chain = nft_chain_lookup(net, table, attr, genmask);
3ecbfd65 2267 }
36dd1bcc
PNA		 2268 if (IS_ERR(chain)) {
2269 NL_SET_BAD_ATTR(extack, attr);
96518518 2270 return PTR_ERR(chain);
36dd1bcc 2271 }
9dee1474
PNA		 2272
2273 if (nlh->nlmsg_flags & NLM_F_NONREC &&
2274 chain->use > 0)
96518518
PM		 2275 return -EBUSY;
2276
98319cb9 2277 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 2278
9dee1474
PNA		 2279 use = chain->use;
2280 list_for_each_entry(rule, &chain->rules, list) {
2281 if (!nft_is_active_next(net, rule))
2282 continue;
2283 use--;
2284
2285 err = nft_delrule(&ctx, rule);
2286 if (err < 0)
2287 return err;
2288 }
2289
2290 /* There are rules and elements that are still holding references to us,
2291 * we cannot do a recursive removal in this case.
2292 */
36dd1bcc
PNA		 2293 if (use > 0) {
2294 NL_SET_BAD_ATTR(extack, attr);
9dee1474 2295 return -EBUSY;
36dd1bcc 2296 }
9dee1474 2297
ee01d542 2298 return nft_delchain(&ctx);
96518518
PM		 2299}
2300
96518518
PM		 2301/*
2302 * Expressions
2303 */
2304
2305/**
ef1f7df9
PM		 2306 * nft_register_expr - register nf_tables expr type
2307 * @ops: expr type
96518518 2308 *
ef1f7df9 2309 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 2310 * success or a negative errno code otherwise.
2311 */
ef1f7df9 2312int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 2313{
2314 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 2315 if (type->family == NFPROTO_UNSPEC)
e688a7f8 2316 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 2317 else
e688a7f8 2318 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 2319 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2320 return 0;
2321}
2322EXPORT_SYMBOL_GPL(nft_register_expr);
2323
2324/**
ef1f7df9
PM		 2325 * nft_unregister_expr - unregister nf_tables expr type
2326 * @ops: expr type
96518518 2327 *
ef1f7df9 2328 * Unregisters the expr typefor use with nf_tables.
96518518 2329 */
ef1f7df9 2330void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 2331{
2332 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 2333 list_del_rcu(&type->list);
96518518
PM		 2334 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2335}
2336EXPORT_SYMBOL_GPL(nft_unregister_expr);
2337
64d46806
PM		 2338static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2339 struct nlattr *nla)
96518518 2340{
9cff126f 2341 const struct nft_expr_type *type, *candidate = NULL;
96518518 2342
ef1f7df9 2343 list_for_each_entry(type, &nf_tables_expressions, list) {
9cff126f
PNA		 2344 if (!nla_strcmp(nla, type->name)) {
2345 if (!type->family && !candidate)
2346 candidate = type;
2347 else if (type->family == family)
2348 candidate = type;
2349 }
96518518 2350 }
9cff126f 2351 return candidate;
96518518
PM		 2352}
2353
b9c04ae7
PNA		 2354#ifdef CONFIG_MODULES
2355static int nft_expr_type_request_module(struct net *net, u8 family,
2356 struct nlattr *nla)
2357{
eb014de4
PNA		 2358 if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2359 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
b9c04ae7
PNA		 2360 return -EAGAIN;
2361
2362 return 0;
2363}
2364#endif
2365
452238e8
FW		 2366static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2367 u8 family,
64d46806 2368 struct nlattr *nla)
96518518 2369{
ef1f7df9 2370 const struct nft_expr_type *type;
96518518
PM		 2371
2372 if (nla == NULL)
2373 return ERR_PTR(-EINVAL);
2374
64d46806 2375 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 2376 if (type != NULL && try_module_get(type->owner))
2377 return type;
96518518 2378
f102d66b 2379 lockdep_nfnl_nft_mutex_not_held();
96518518 2380#ifdef CONFIG_MODULES
ef1f7df9 2381 if (type == NULL) {
b9c04ae7 2382 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
64d46806
PM		 2383 return ERR_PTR(-EAGAIN);
2384
eb014de4
PNA		 2385 if (nft_request_module(net, "nft-expr-%.*s",
2386 nla_len(nla),
2387 (char *)nla_data(nla)) == -EAGAIN)
96518518
PM		 2388 return ERR_PTR(-EAGAIN);
2389 }
2390#endif
2391 return ERR_PTR(-ENOENT);
2392}
2393
2394static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
9332d27d
FW		 2395 [NFTA_EXPR_NAME] = { .type = NLA_STRING,
2396 .len = NFT_MODULE_AUTOLOAD_LIMIT },
96518518
PM		 2397 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2398};
2399
2400static int nf_tables_fill_expr_info(struct sk_buff *skb,
2401 const struct nft_expr *expr)
2402{
ef1f7df9 2403 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 2404 goto nla_put_failure;
2405
2406 if (expr->ops->dump) {
ae0be8de
MK		 2407 struct nlattr *data = nla_nest_start_noflag(skb,
2408 NFTA_EXPR_DATA);
96518518
PM		 2409 if (data == NULL)
2410 goto nla_put_failure;
2411 if (expr->ops->dump(skb, expr) < 0)
2412 goto nla_put_failure;
2413 nla_nest_end(skb, data);
2414 }
2415
2416 return skb->len;
2417
2418nla_put_failure:
2419 return -1;
2420};
2421
0b2d8a7b
PM		 2422int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2423 const struct nft_expr *expr)
2424{
2425 struct nlattr *nest;
2426
ae0be8de 2427 nest = nla_nest_start_noflag(skb, attr);
0b2d8a7b
PM		 2428 if (!nest)
2429 goto nla_put_failure;
2430 if (nf_tables_fill_expr_info(skb, expr) < 0)
2431 goto nla_put_failure;
2432 nla_nest_end(skb, nest);
2433 return 0;
2434
2435nla_put_failure:
2436 return -1;
2437}
2438
96518518
PM		 2439struct nft_expr_info {
2440 const struct nft_expr_ops *ops;
ef1f7df9 2441 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 2442};
2443
0ca743a5
PNA		 2444static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2445 const struct nlattr *nla,
96518518
PM		 2446 struct nft_expr_info *info)
2447{
ef1f7df9 2448 const struct nft_expr_type *type;
96518518 2449 const struct nft_expr_ops *ops;
ef1f7df9 2450 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 2451 int err;
2452
8cb08174
JB		 2453 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2454 nft_expr_policy, NULL);
96518518
PM		 2455 if (err < 0)
2456 return err;
2457
452238e8 2458 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 2459 if (IS_ERR(type))
2460 return PTR_ERR(type);
2461
2462 if (tb[NFTA_EXPR_DATA]) {
8cb08174
JB		 2463 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2464 tb[NFTA_EXPR_DATA],
2465 type->policy, NULL);
ef1f7df9
PM		 2466 if (err < 0)
2467 goto err1;
2468 } else
2469 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2470
2471 if (type->select_ops != NULL) {
0ca743a5
PNA		 2472 ops = type->select_ops(ctx,
2473 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 2474 if (IS_ERR(ops)) {
2475 err = PTR_ERR(ops);
0ef1efd1
PNA		 2476#ifdef CONFIG_MODULES
2477 if (err == -EAGAIN)
eb014de4
PNA		 2478 if (nft_expr_type_request_module(ctx->net,
2479 ctx->family,
2480 tb[NFTA_EXPR_NAME]) != -EAGAIN)
2481 err = -ENOENT;
0ef1efd1 2482#endif
ef1f7df9
PM		 2483 goto err1;
2484 }
2485 } else
2486 ops = type->ops;
2487
96518518
PM		 2488 info->ops = ops;
2489 return 0;
ef1f7df9
PM		 2490
2491err1:
2492 module_put(type->owner);
2493 return err;
96518518
PM		 2494}
2495
2496static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 2497 const struct nft_expr_info *info,
96518518
PM		 2498 struct nft_expr *expr)
2499{
2500 const struct nft_expr_ops *ops = info->ops;
2501 int err;
2502
2503 expr->ops = ops;
2504 if (ops->init) {
ef1f7df9 2505 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 2506 if (err < 0)
2507 goto err1;
2508 }
2509
96518518 2510 return 0;
96518518
PM		 2511err1:
2512 expr->ops = NULL;
2513 return err;
2514}
2515
62472bce
PM		 2516static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2517 struct nft_expr *expr)
96518518 2518{
3f3a390d
PNA		 2519 const struct nft_expr_type *type = expr->ops->type;
2520
96518518 2521 if (expr->ops->destroy)
62472bce 2522 expr->ops->destroy(ctx, expr);
3f3a390d 2523 module_put(type->owner);
96518518
PM		 2524}
2525
0b2d8a7b
PM		 2526struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2527 const struct nlattr *nla)
2528{
2529 struct nft_expr_info info;
2530 struct nft_expr *expr;
b8e20400 2531 struct module *owner;
0b2d8a7b
PM		 2532 int err;
2533
2534 err = nf_tables_expr_parse(ctx, nla, &info);
2535 if (err < 0)
2536 goto err1;
2537
2538 err = -ENOMEM;
2539 expr = kzalloc(info.ops->size, GFP_KERNEL);
2540 if (expr == NULL)
2541 goto err2;
2542
2543 err = nf_tables_newexpr(ctx, &info, expr);
2544 if (err < 0)
6cafaf47 2545 goto err3;
0b2d8a7b
PM		 2546
2547 return expr;
6cafaf47
LZ		 2548err3:
2549 kfree(expr);
0b2d8a7b 2550err2:
b8e20400
PNA		 2551 owner = info.ops->type->owner;
2552 if (info.ops->type->release_ops)
2553 info.ops->type->release_ops(info.ops);
2554
2555 module_put(owner);
0b2d8a7b
PM		 2556err1:
2557 return ERR_PTR(err);
2558}
2559
2560void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2561{
2562 nf_tables_expr_destroy(ctx, expr);
2563 kfree(expr);
2564}
2565
96518518
PM		 2566/*
2567 * Rules
2568 */
2569
cac20fcd
PNA		 2570static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2571 u64 handle)
96518518
PM		 2572{
2573 struct nft_rule *rule;
2574
2575 // FIXME: this sucks
d9adf22a 2576 list_for_each_entry_rcu(rule, &chain->rules, list) {
96518518
PM		 2577 if (handle == rule->handle)
2578 return rule;
2579 }
2580
2581 return ERR_PTR(-ENOENT);
2582}
2583
cac20fcd
PNA		 2584static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2585 const struct nlattr *nla)
96518518
PM		 2586{
2587 if (nla == NULL)
2588 return ERR_PTR(-EINVAL);
2589
cac20fcd 2590 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 2591}
2592
2593static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 2594 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2595 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 2596 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2597 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2598 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2599 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 2600 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 2601 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 2602 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2603 .len = NFT_USERDATA_MAXLEN },
467697d2 2604 [NFTA_RULE_ID] = { .type = NLA_U32 },
0604628b 2605 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
96518518
PM		 2606};
2607
84d7fce6
PNA		 2608static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2609 u32 portid, u32 seq, int event,
2610 u32 flags, int family,
96518518
PM		 2611 const struct nft_table *table,
2612 const struct nft_chain *chain,
2c82c7e7
FW		 2613 const struct nft_rule *rule,
2614 const struct nft_rule *prule)
96518518
PM		 2615{
2616 struct nlmsghdr *nlh;
2617 struct nfgenmsg *nfmsg;
2618 const struct nft_expr *expr, *next;
2619 struct nlattr *list;
dedb67c4 2620 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 2621
dedb67c4 2622 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 2623 if (nlh == NULL)
2624 goto nla_put_failure;
2625
2626 nfmsg = nlmsg_data(nlh);
2627 nfmsg->nfgen_family = family;
2628 nfmsg->version = NFNETLINK_V0;
84d7fce6 2629 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2630
2631 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2632 goto nla_put_failure;
2633 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2634 goto nla_put_failure;
b46f6ded
ND		 2635 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2636 NFTA_RULE_PAD))
96518518
PM		 2637 goto nla_put_failure;
2638
2c82c7e7 2639 if (event != NFT_MSG_DELRULE && prule) {
5e948466 2640 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2641 cpu_to_be64(prule->handle),
2642 NFTA_RULE_PAD))
5e948466
EL		 2643 goto nla_put_failure;
2644 }
2645
ae0be8de 2646 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
96518518
PM		 2647 if (list == NULL)
2648 goto nla_put_failure;
2649 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2650 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2651 goto nla_put_failure;
96518518
PM		 2652 }
2653 nla_nest_end(skb, list);
2654
86f1ec32
PM		 2655 if (rule->udata) {
2656 struct nft_userdata *udata = nft_userdata(rule);
2657 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2658 udata->data) < 0)
2659 goto nla_put_failure;
2660 }
0768b3b3 2661
053c095a
JB		 2662 nlmsg_end(skb, nlh);
2663 return 0;
96518518
PM		 2664
2665nla_put_failure:
2666 nlmsg_trim(skb, nlh);
2667 return -1;
2668}
2669
25e94a99
PNA		 2670static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2671 const struct nft_rule *rule, int event)
96518518
PM		 2672{
2673 struct sk_buff *skb;
96518518
PM		 2674 int err;
2675
128ad332
PNA		 2676 if (!ctx->report &&
2677 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2678 return;
96518518 2679
96518518
PM		 2680 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2681 if (skb == NULL)
2682 goto err;
2683
84d7fce6 2684 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2685 event, 0, ctx->family, ctx->table,
2c82c7e7 2686 ctx->chain, rule, NULL);
96518518
PM		 2687 if (err < 0) {
2688 kfree_skb(skb);
2689 goto err;
2690 }
2691
25e94a99
PNA		 2692 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2693 ctx->report, GFP_KERNEL);
2694 return;
96518518 2695err:
25e94a99 2696 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2697}
2698
6e1f760e 2699struct nft_rule_dump_ctx {
e46abbcc 2700 char *table;
b7263e07 2701 char *chain;
6e1f760e
PNA		 2702};
2703
241faece
PS		 2704static int __nf_tables_dump_rules(struct sk_buff *skb,
2705 unsigned int *idx,
2706 struct netlink_callback *cb,
2707 const struct nft_table *table,
2708 const struct nft_chain *chain)
2709{
2710 struct net *net = sock_net(skb->sk);
2c82c7e7 2711 const struct nft_rule *rule, *prule;
241faece 2712 unsigned int s_idx = cb->args[0];
241faece 2713
2c82c7e7 2714 prule = NULL;
241faece
PS		 2715 list_for_each_entry_rcu(rule, &chain->rules, list) {
2716 if (!nft_is_active(net, rule))
2c82c7e7 2717 goto cont_skip;
241faece
PS		 2718 if (*idx < s_idx)
2719 goto cont;
2720 if (*idx > s_idx) {
2721 memset(&cb->args[1], 0,
2722 sizeof(cb->args) - sizeof(cb->args[0]));
2723 }
2724 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2725 cb->nlh->nlmsg_seq,
2726 NFT_MSG_NEWRULE,
2727 NLM_F_MULTI | NLM_F_APPEND,
2728 table->family,
2c82c7e7 2729 table, chain, rule, prule) < 0)
310529e6 2730 return 1;
241faece
PS		 2731
2732 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2733cont:
2c82c7e7
FW		 2734 prule = rule;
2735cont_skip:
241faece
PS		 2736 (*idx)++;
2737 }
310529e6 2738 return 0;
241faece
PS		 2739}
2740
96518518
PM		 2741static int nf_tables_dump_rules(struct sk_buff *skb,
2742 struct netlink_callback *cb)
2743{
2744 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2745 const struct nft_rule_dump_ctx *ctx = cb->data;
241faece 2746 struct nft_table *table;
96518518 2747 const struct nft_chain *chain;
241faece 2748 unsigned int idx = 0;
99633ab2 2749 struct net *net = sock_net(skb->sk);
96518518
PM		 2750 int family = nfmsg->nfgen_family;
2751
e688a7f8 2752 rcu_read_lock();
38e029f1
PNA		 2753 cb->seq = net->nft.base_seq;
2754
36596dad 2755 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2756 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2757 continue;
2758
2759 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2760 continue;
2761
715849ab 2762 if (ctx && ctx->table && ctx->chain) {
241faece 2763 struct rhlist_head *list, *tmp;
6e1f760e 2764
241faece
PS		 2765 list = rhltable_lookup(&table->chains_ht, ctx->chain,
2766 nft_chain_ht_params);
2767 if (!list)
2768 goto done;
2769
2770 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2771 if (!nft_is_active(net, chain))
2772 continue;
2773 __nf_tables_dump_rules(skb, &idx,
2774 cb, table, chain);
2775 break;
96518518 2776 }
241faece 2777 goto done;
96518518 2778 }
241faece
PS		 2779
2780 list_for_each_entry_rcu(chain, &table->chains, list) {
2781 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2782 goto done;
2783 }
2784
2785 if (ctx && ctx->table)
2786 break;
96518518
PM		 2787 }
2788done:
e688a7f8 2789 rcu_read_unlock();
310529e6
PS		 2790
2791 cb->args[0] = idx;
96518518
PM		 2792 return skb->len;
2793}
2794
90fd131a
FW		 2795static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2796{
2797 const struct nlattr * const *nla = cb->data;
2798 struct nft_rule_dump_ctx *ctx = NULL;
2799
2800 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2801 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2802 if (!ctx)
2803 return -ENOMEM;
2804
2805 if (nla[NFTA_RULE_TABLE]) {
2806 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2807 GFP_ATOMIC);
2808 if (!ctx->table) {
2809 kfree(ctx);
2810 return -ENOMEM;
2811 }
2812 }
2813 if (nla[NFTA_RULE_CHAIN]) {
2814 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2815 GFP_ATOMIC);
2816 if (!ctx->chain) {
2817 kfree(ctx->table);
2818 kfree(ctx);
2819 return -ENOMEM;
2820 }
2821 }
2822 }
2823
2824 cb->data = ctx;
2825 return 0;
2826}
2827
6e1f760e
PNA		 2828static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2829{
e46abbcc
PS		 2830 struct nft_rule_dump_ctx *ctx = cb->data;
2831
2832 if (ctx) {
2833 kfree(ctx->table);
b7263e07 2834 kfree(ctx->chain);
e46abbcc
PS		 2835 kfree(ctx);
2836 }
6e1f760e
PNA		 2837 return 0;
2838}
2839
d9adf22a 2840/* called with rcu_read_lock held */
7b8002a1
PNA		 2841static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2842 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2843 const struct nlattr * const nla[],
2844 struct netlink_ext_ack *extack)
96518518
PM		 2845{
2846 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2847 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2848 const struct nft_chain *chain;
2849 const struct nft_rule *rule;
1b2470e5 2850 struct nft_table *table;
96518518
PM		 2851 struct sk_buff *skb2;
2852 int family = nfmsg->nfgen_family;
2853 int err;
2854
2855 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2856 struct netlink_dump_control c = {
90fd131a 2857 .start= nf_tables_dump_rules_start,
96518518 2858 .dump = nf_tables_dump_rules,
6e1f760e 2859 .done = nf_tables_dump_rules_done,
d9adf22a 2860 .module = THIS_MODULE,
90fd131a 2861 .data = (void *)nla,
96518518 2862 };
6e1f760e 2863
d9adf22a 2864 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 2865 }
2866
cac20fcd 2867 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2868 if (IS_ERR(table)) {
2869 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2870 return PTR_ERR(table);
36dd1bcc 2871 }
96518518 2872
f102d66b 2873 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2874 if (IS_ERR(chain)) {
2875 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2876 return PTR_ERR(chain);
36dd1bcc 2877 }
96518518 2878
cac20fcd 2879 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2880 if (IS_ERR(rule)) {
2881 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2882 return PTR_ERR(rule);
36dd1bcc 2883 }
96518518 2884
d9adf22a 2885 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 2886 if (!skb2)
2887 return -ENOMEM;
2888
84d7fce6 2889 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518 2890 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2c82c7e7 2891 family, table, chain, rule, NULL);
96518518
PM		 2892 if (err < 0)
2893 goto err;
2894
2895 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2896
2897err:
2898 kfree_skb(skb2);
2899 return err;
2900}
2901
62472bce
PM		 2902static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2903 struct nft_rule *rule)
96518518 2904{
29e38801 2905 struct nft_expr *expr, *next;
96518518
PM		 2906
2907 /*
2908 * Careful: some expressions might not be initialized in case this
2909 * is called on error from nf_tables_newrule().
2910 */
2911 expr = nft_expr_first(rule);
3e38df13 2912 while (expr != nft_expr_last(rule) && expr->ops) {
29e38801 2913 next = nft_expr_next(expr);
62472bce 2914 nf_tables_expr_destroy(ctx, expr);
29e38801 2915 expr = next;
96518518
PM		 2916 }
2917 kfree(rule);
2918}
2919
bb7b40ae
PNA		 2920static void nf_tables_rule_release(const struct nft_ctx *ctx,
2921 struct nft_rule *rule)
2922{
f6ac8585 2923 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
bb7b40ae
PNA		 2924 nf_tables_rule_destroy(ctx, rule);
2925}
2926
a654de8f
PNA		 2927int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2928{
2929 struct nft_expr *expr, *last;
2930 const struct nft_data *data;
2931 struct nft_rule *rule;
2932 int err;
2933
26b2f552
TY		 2934 if (ctx->level == NFT_JUMP_STACK_SIZE)
2935 return -EMLINK;
2936
a654de8f
PNA		 2937 list_for_each_entry(rule, &chain->rules, list) {
2938 if (!nft_is_active_next(ctx->net, rule))
2939 continue;
2940
2941 nft_rule_for_each_expr(expr, last, rule) {
2942 if (!expr->ops->validate)
2943 continue;
2944
2945 err = expr->ops->validate(ctx, expr, &data);
2946 if (err < 0)
2947 return err;
2948 }
2949 }
2950
2951 return 0;
2952}
2953EXPORT_SYMBOL_GPL(nft_chain_validate);
2954
2955static int nft_table_validate(struct net *net, const struct nft_table *table)
2956{
2957 struct nft_chain *chain;
2958 struct nft_ctx ctx = {
2959 .net = net,
2960 .family = table->family,
2961 };
2962 int err;
2963
2964 list_for_each_entry(chain, &table->chains, list) {
2965 if (!nft_is_base_chain(chain))
2966 continue;
2967
2968 ctx.chain = chain;
2969 err = nft_chain_validate(&ctx, chain);
2970 if (err < 0)
2971 return err;
2972 }
2973
2974 return 0;
2975}
2976
75dd48e2
PS		 2977static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2978 const struct nlattr *nla);
2979
1081d11b
PNA		 2980#define NFT_RULE_MAXEXPRS 128
2981
633c9a84
PNA		 2982static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2983 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2984 const struct nlattr * const nla[],
2985 struct netlink_ext_ack *extack)
96518518
PM		 2986{
2987 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2988 u8 genmask = nft_genmask_next(net);
2a43ecf9 2989 struct nft_expr_info *info = NULL;
98319cb9 2990 int family = nfmsg->nfgen_family;
c9626a2c 2991 struct nft_flow_rule *flow;
96518518
PM		 2992 struct nft_table *table;
2993 struct nft_chain *chain;
2994 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2995 struct nft_userdata *udata;
1081d11b 2996 struct nft_trans *trans = NULL;
96518518
PM		 2997 struct nft_expr *expr;
2998 struct nft_ctx ctx;
2999 struct nlattr *tmp;
86f1ec32 3000 unsigned int size, i, n, ulen = 0, usize = 0;
96518518 3001 int err, rem;
5e948466 3002 u64 handle, pos_handle;
96518518 3003
f102d66b
FW		 3004 lockdep_assert_held(&net->nft.commit_mutex);
3005
cac20fcd 3006 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 3007 if (IS_ERR(table)) {
3008 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 3009 return PTR_ERR(table);
36dd1bcc 3010 }
96518518 3011
f102d66b 3012 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 3013 if (IS_ERR(chain)) {
3014 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 3015 return PTR_ERR(chain);
36dd1bcc 3016 }
96518518
PM		 3017
3018 if (nla[NFTA_RULE_HANDLE]) {
3019 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 3020 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 3021 if (IS_ERR(rule)) {
3022 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 3023 return PTR_ERR(rule);
36dd1bcc 3024 }
96518518 3025
36dd1bcc
PNA		 3026 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3027 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 3028 return -EEXIST;
36dd1bcc 3029 }
96518518
PM		 3030 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3031 old_rule = rule;
3032 else
3033 return -EOPNOTSUPP;
3034 } else {
445509eb
PNA		 3035 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
3036 nlh->nlmsg_flags & NLM_F_REPLACE)
96518518
PM		 3037 return -EINVAL;
3038 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 3039
3040 if (chain->use == UINT_MAX)
3041 return -EOVERFLOW;
5e948466 3042
447750f2
FW		 3043 if (nla[NFTA_RULE_POSITION]) {
3044 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
3045 old_rule = __nft_rule_lookup(chain, pos_handle);
3046 if (IS_ERR(old_rule)) {
3047 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
3048 return PTR_ERR(old_rule);
3049 }
75dd48e2
PS		 3050 } else if (nla[NFTA_RULE_POSITION_ID]) {
3051 old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
3052 if (IS_ERR(old_rule)) {
3053 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
3054 return PTR_ERR(old_rule);
3055 }
36dd1bcc 3056 }
5e948466
EL		 3057 }
3058
98319cb9 3059 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 3060
96518518
PM		 3061 n = 0;
3062 size = 0;
3063 if (nla[NFTA_RULE_EXPRESSIONS]) {
2a43ecf9
FW		 3064 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
3065 sizeof(struct nft_expr_info),
3066 GFP_KERNEL);
3067 if (!info)
3068 return -ENOMEM;
3069
96518518
PM		 3070 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
3071 err = -EINVAL;
3072 if (nla_type(tmp) != NFTA_LIST_ELEM)
3073 goto err1;
3074 if (n == NFT_RULE_MAXEXPRS)
3075 goto err1;
0ca743a5 3076 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 3077 if (err < 0)
3078 goto err1;
3079 size += info[n].ops->size;
3080 n++;
3081 }
3082 }
9889840f
PM		 3083 /* Check for overflow of dlen field */
3084 err = -EFBIG;
3085 if (size >= 1 << 12)
3086 goto err1;
96518518 3087
86f1ec32 3088 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 3089 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 3090 if (ulen > 0)
3091 usize = sizeof(struct nft_userdata) + ulen;
3092 }
0768b3b3 3093
96518518 3094 err = -ENOMEM;
86f1ec32 3095 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 3096 if (rule == NULL)
3097 goto err1;
3098
889f7ee7 3099 nft_activate_next(net, rule);
0628b123 3100
96518518
PM		 3101 rule->handle = handle;
3102 rule->dlen = size;
86f1ec32 3103 rule->udata = ulen ? 1 : 0;
0768b3b3 3104
86f1ec32
PM		 3105 if (ulen) {
3106 udata = nft_userdata(rule);
3107 udata->len = ulen - 1;
3108 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
3109 }
96518518 3110
96518518
PM		 3111 expr = nft_expr_first(rule);
3112 for (i = 0; i < n; i++) {
3113 err = nf_tables_newexpr(&ctx, &info[i], expr);
3114 if (err < 0)
3115 goto err2;
a654de8f
PNA		 3116
3117 if (info[i].ops->validate)
3118 nft_validate_state_update(net, NFT_VALIDATE_NEED);
3119
ef1f7df9 3120 info[i].ops = NULL;
96518518
PM		 3121 expr = nft_expr_next(expr);
3122 }
3123
96518518 3124 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
ca089878 3125 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
569ccae6
FW		 3126 if (trans == NULL) {
3127 err = -ENOMEM;
3128 goto err2;
3129 }
ca089878
TY		 3130 err = nft_delrule(&ctx, old_rule);
3131 if (err < 0) {
3132 nft_trans_destroy(trans);
569ccae6
FW		 3133 goto err2;
3134 }
3135
3136 list_add_tail_rcu(&rule->list, &old_rule->list);
3137 } else {
c9626a2c
PNA		 3138 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3139 if (!trans) {
569ccae6
FW		 3140 err = -ENOMEM;
3141 goto err2;
3142 }
3143
3144 if (nlh->nlmsg_flags & NLM_F_APPEND) {
3145 if (old_rule)
3146 list_add_rcu(&rule->list, &old_rule->list);
3147 else
3148 list_add_tail_rcu(&rule->list, &chain->rules);
3149 } else {
3150 if (old_rule)
3151 list_add_tail_rcu(&rule->list, &old_rule->list);
3152 else
3153 list_add_rcu(&rule->list, &chain->rules);
3154 }
0628b123 3155 }
2a43ecf9 3156 kvfree(info);
4fefee57 3157 chain->use++;
96518518 3158
a654de8f
PNA		 3159 if (net->nft.validate_state == NFT_VALIDATE_DO)
3160 return nft_table_validate(net, table);
3161
c9626a2c 3162 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
be2861dc 3163 flow = nft_flow_rule_create(net, rule);
c9626a2c
PNA		 3164 if (IS_ERR(flow))
3165 return PTR_ERR(flow);
3166
3167 nft_trans_flow_rule(trans) = flow;
3168 }
3169
a654de8f 3170 return 0;
96518518 3171err2:
bb7b40ae 3172 nf_tables_rule_release(&ctx, rule);
96518518
PM		 3173err1:
3174 for (i = 0; i < n; i++) {
b25a31bf 3175 if (info[i].ops) {
ef1f7df9 3176 module_put(info[i].ops->type->owner);
b25a31bf
TY		 3177 if (info[i].ops->type->release_ops)
3178 info[i].ops->type->release_ops(info[i].ops);
3179 }
96518518 3180 }
2a43ecf9 3181 kvfree(info);
96518518
PM		 3182 return err;
3183}
3184
1a94e38d
PNA		 3185static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3186 const struct nlattr *nla)
3187{
3188 u32 id = ntohl(nla_get_be32(nla));
3189 struct nft_trans *trans;
3190
3191 list_for_each_entry(trans, &net->nft.commit_list, list) {
3192 struct nft_rule *rule = nft_trans_rule(trans);
3193
3194 if (trans->msg_type == NFT_MSG_NEWRULE &&
3195 id == nft_trans_rule_id(trans))
3196 return rule;
3197 }
3198 return ERR_PTR(-ENOENT);
3199}
3200
633c9a84
PNA		 3201static int nf_tables_delrule(struct net *net, struct sock *nlsk,
3202 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3203 const struct nlattr * const nla[],
3204 struct netlink_ext_ack *extack)
96518518
PM		 3205{
3206 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3207 u8 genmask = nft_genmask_next(net);
7c95f6d8 3208 struct nft_table *table;
cf9dc09d
PNA		 3209 struct nft_chain *chain = NULL;
3210 struct nft_rule *rule;
0628b123
PNA		 3211 int family = nfmsg->nfgen_family, err = 0;
3212 struct nft_ctx ctx;
96518518 3213
cac20fcd 3214 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 3215 if (IS_ERR(table)) {
3216 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 3217 return PTR_ERR(table);
36dd1bcc 3218 }
96518518 3219
cf9dc09d 3220 if (nla[NFTA_RULE_CHAIN]) {
f102d66b
FW		 3221 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3222 genmask);
36dd1bcc
PNA		 3223 if (IS_ERR(chain)) {
3224 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 3225 return PTR_ERR(chain);
36dd1bcc 3226 }
cf9dc09d 3227 }
96518518 3228
98319cb9 3229 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 3230
cf9dc09d
PNA		 3231 if (chain) {
3232 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 3233 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 3234 if (IS_ERR(rule)) {
3235 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 3236 return PTR_ERR(rule);
36dd1bcc 3237 }
96518518 3238
1a94e38d
PNA		 3239 err = nft_delrule(&ctx, rule);
3240 } else if (nla[NFTA_RULE_ID]) {
3241 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 3242 if (IS_ERR(rule)) {
3243 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 3244 return PTR_ERR(rule);
36dd1bcc 3245 }
1a94e38d 3246
5e266fe7 3247 err = nft_delrule(&ctx, rule);
cf9dc09d 3248 } else {
ce24b721 3249 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 3250 }
3251 } else {
3252 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 3253 if (!nft_is_active_next(net, chain))
3254 continue;
3255
cf9dc09d 3256 ctx.chain = chain;
ce24b721 3257 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 3258 if (err < 0)
3259 break;
3260 }
3261 }
3262
3263 return err;
3264}
3265
20a69341
PM		 3266/*
3267 * Sets
3268 */
e32a4dc6
FW		 3269static const struct nft_set_type *nft_set_types[] = {
3270 &nft_set_hash_fast_type,
3271 &nft_set_hash_type,
3272 &nft_set_rhash_type,
3273 &nft_set_bitmap_type,
3274 &nft_set_rbtree_type,
7400b063
SB		 3275#if defined(CONFIG_X86_64) && defined(CONFIG_AS_AVX2)
3276 &nft_set_pipapo_avx2_type,
3277#endif
e32a4dc6
FW		 3278 &nft_set_pipapo_type,
3279};
20a69341 3280
2b664957 3281#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 3282 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3283 NFT_SET_EVAL)
2b664957 3284
71cc0873 3285static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 3286{
71cc0873 3287 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 3288}
3289
c50b960c
PM		 3290/*
3291 * Select a set implementation based on the data characteristics and the
3292 * given policy. The total memory use might not be known if no size is
3293 * given, in that case the amount of memory per element is used.
3294 */
3295static const struct nft_set_ops *
2b664957
PNA		 3296nft_select_set_ops(const struct nft_ctx *ctx,
3297 const struct nlattr * const nla[],
c50b960c
PM		 3298 const struct nft_set_desc *desc,
3299 enum nft_set_policies policy)
20a69341 3300{
c50b960c
PM		 3301 const struct nft_set_ops *ops, *bops;
3302 struct nft_set_estimate est, best;
2b664957
PNA		 3303 const struct nft_set_type *type;
3304 u32 flags = 0;
e32a4dc6 3305 int i;
20a69341 3306
f102d66b
FW		 3307 lockdep_assert_held(&ctx->net->nft.commit_mutex);
3308 lockdep_nfnl_nft_mutex_not_held();
e32a4dc6 3309
2b664957
PNA		 3310 if (nla[NFTA_SET_FLAGS] != NULL)
3311 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 3312
55af753c
PNA		 3313 bops = NULL;
3314 best.size = ~0;
3315 best.lookup = ~0;
0b5a7874 3316 best.space = ~0;
c50b960c 3317
e32a4dc6
FW		 3318 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) {
3319 type = nft_set_types[i];
71cc0873 3320 ops = &type->ops;
2b664957 3321
71cc0873 3322 if (!nft_set_ops_candidate(type, flags))
20a69341 3323 continue;
2b664957 3324 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 3325 continue;
3326
3327 switch (policy) {
3328 case NFT_SET_POL_PERFORMANCE:
55af753c 3329 if (est.lookup < best.lookup)
c50b960c 3330 break;
644e334e
PNA		 3331 if (est.lookup == best.lookup &&
3332 est.space < best.space)
3333 break;
c50b960c
PM		 3334 continue;
3335 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 3336 if (!desc->size) {
3337 if (est.space < best.space)
3338 break;
3339 if (est.space == best.space &&
3340 est.lookup < best.lookup)
3341 break;
4f2921ca 3342 } else if (est.size < best.size || !bops) {
c50b960c 3343 break;
0b5a7874 3344 }
c50b960c
PM		 3345 continue;
3346 default:
3347 break;
3348 }
3349
c50b960c
PM		 3350 bops = ops;
3351 best = est;
20a69341
PM		 3352 }
3353
c50b960c
PM		 3354 if (bops != NULL)
3355 return bops;
3356
20a69341
PM		 3357 return ERR_PTR(-EOPNOTSUPP);
3358}
3359
3360static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 3361 [NFTA_SET_TABLE] = { .type = NLA_STRING,
3362 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 3363 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 3364 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 3365 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
3366 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
3367 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
3368 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
3369 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 3370 [NFTA_SET_POLICY] = { .type = NLA_U32 },
3371 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 3372 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 3373 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
3374 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 3375 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
3376 .len = NFT_USERDATA_MAXLEN },
8aeff920 3377 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 3378 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 3379};
3380
3381static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3382 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
f3a2181e 3383 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED },
20a69341
PM		 3384};
3385
633c9a84 3386static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3387 const struct sk_buff *skb,
3388 const struct nlmsghdr *nlh,
f2a6d766 3389 const struct nlattr * const nla[],
36dd1bcc 3390 struct netlink_ext_ack *extack,
f2a6d766 3391 u8 genmask)
20a69341
PM		 3392{
3393 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3394 int family = nfmsg->nfgen_family;
7c95f6d8 3395 struct nft_table *table = NULL;
20a69341 3396
20a69341 3397 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 3398 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3399 genmask);
36dd1bcc
PNA		 3400 if (IS_ERR(table)) {
3401 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3402 return PTR_ERR(table);
36dd1bcc 3403 }
20a69341
PM		 3404 }
3405
98319cb9 3406 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3407 return 0;
3408}
3409
cac20fcd
PNA		 3410static struct nft_set *nft_set_lookup(const struct nft_table *table,
3411 const struct nlattr *nla, u8 genmask)
20a69341
PM		 3412{
3413 struct nft_set *set;
3414
3415 if (nla == NULL)
3416 return ERR_PTR(-EINVAL);
3417
d9adf22a 3418 list_for_each_entry_rcu(set, &table->sets, list) {
37a9cc52
PNA		 3419 if (!nla_strcmp(nla, set->name) &&
3420 nft_active_genmask(set, genmask))
20a69341
PM		 3421 return set;
3422 }
3423 return ERR_PTR(-ENOENT);
3424}
3425
cac20fcd
PNA		 3426static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3427 const struct nlattr *nla,
3428 u8 genmask)
3ecbfd65
HS		 3429{
3430 struct nft_set *set;
3431
3ecbfd65
HS		 3432 list_for_each_entry(set, &table->sets, list) {
3433 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3434 nft_active_genmask(set, genmask))
3435 return set;
3436 }
3437 return ERR_PTR(-ENOENT);
3438}
3439
cac20fcd
PNA		 3440static struct nft_set *nft_set_lookup_byid(const struct net *net,
3441 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 3442{
3443 struct nft_trans *trans;
3444 u32 id = ntohl(nla_get_be32(nla));
3445
3446 list_for_each_entry(trans, &net->nft.commit_list, list) {
9c7f96fd
AK		 3447 if (trans->msg_type == NFT_MSG_NEWSET) {
3448 struct nft_set *set = nft_trans_set(trans);
37a9cc52 3449
9c7f96fd
AK		 3450 if (id == nft_trans_set_id(trans) &&
3451 nft_active_genmask(set, genmask))
3452 return set;
3453 }
958bee14
PNA		 3454 }
3455 return ERR_PTR(-ENOENT);
3456}
c7a72e3f 3457
10659cba
PNA		 3458struct nft_set *nft_set_lookup_global(const struct net *net,
3459 const struct nft_table *table,
3460 const struct nlattr *nla_set_name,
3461 const struct nlattr *nla_set_id,
3462 u8 genmask)
c7a72e3f
PNA		 3463{
3464 struct nft_set *set;
3465
cac20fcd 3466 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 3467 if (IS_ERR(set)) {
3468 if (!nla_set_id)
3469 return set;
3470
cac20fcd 3471 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 3472 }
3473 return set;
3474}
10659cba 3475EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 3476
20a69341
PM		 3477static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3478 const char *name)
3479{
3480 const struct nft_set *i;
3481 const char *p;
3482 unsigned long *inuse;
60eb1894 3483 unsigned int n = 0, min = 0;
20a69341 3484
38745490 3485 p = strchr(name, '%');
20a69341
PM		 3486 if (p != NULL) {
3487 if (p[1] != 'd' || strchr(p + 2, '%'))
3488 return -EINVAL;
3489
3490 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3491 if (inuse == NULL)
3492 return -ENOMEM;
60eb1894 3493cont:
20a69341 3494 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 3495 int tmp;
3496
37a9cc52
PNA		 3497 if (!nft_is_active_next(ctx->net, set))
3498 continue;
14662917 3499 if (!sscanf(i->name, name, &tmp))
20a69341 3500 continue;
60eb1894 3501 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 3502 continue;
14662917 3503
60eb1894 3504 set_bit(tmp - min, inuse);
20a69341
PM		 3505 }
3506
53b70287 3507 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 3508 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3509 min += BITS_PER_BYTE * PAGE_SIZE;
3510 memset(inuse, 0, PAGE_SIZE);
3511 goto cont;
3512 }
20a69341
PM		 3513 free_page((unsigned long)inuse);
3514 }
3515
38745490
PS		 3516 set->name = kasprintf(GFP_KERNEL, name, min + n);
3517 if (!set->name)
3518 return -ENOMEM;
3519
20a69341 3520 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 3521 if (!nft_is_active_next(ctx->net, i))
3522 continue;
e63aaaa6
AY		 3523 if (!strcmp(set->name, i->name)) {
3524 kfree(set->name);
20a69341 3525 return -ENFILE;
e63aaaa6 3526 }
20a69341
PM		 3527 }
3528 return 0;
3529}
3530
8e1102d5
FW		 3531static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3532{
3533 u64 ms = be64_to_cpu(nla_get_be64(nla));
3534 u64 max = (u64)(~((u64)0));
3535
3536 max = div_u64(max, NSEC_PER_MSEC);
3537 if (ms >= max)
3538 return -ERANGE;
3539
3540 ms *= NSEC_PER_MSEC;
3541 *result = nsecs_to_jiffies64(ms);
3542 return 0;
3543}
3544
d6501de8 3545static __be64 nf_jiffies64_to_msecs(u64 input)
8e1102d5 3546{
3b15d09f 3547 return cpu_to_be64(jiffies64_to_msecs(input));
8e1102d5
FW		 3548}
3549
f3a2181e
SB		 3550static int nf_tables_fill_set_concat(struct sk_buff *skb,
3551 const struct nft_set *set)
3552{
3553 struct nlattr *concat, *field;
3554 int i;
3555
3556 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT);
3557 if (!concat)
3558 return -ENOMEM;
3559
3560 for (i = 0; i < set->field_count; i++) {
3561 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
3562 if (!field)
3563 return -ENOMEM;
3564
3565 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN,
3566 htonl(set->field_len[i])))
3567 return -ENOMEM;
3568
3569 nla_nest_end(skb, field);
3570 }
3571
3572 nla_nest_end(skb, concat);
3573
3574 return 0;
3575}
3576
20a69341
PM		 3577static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3578 const struct nft_set *set, u16 event, u16 flags)
3579{
3580 struct nfgenmsg *nfmsg;
3581 struct nlmsghdr *nlh;
c50b960c 3582 struct nlattr *desc;
128ad332
PNA		 3583 u32 portid = ctx->portid;
3584 u32 seq = ctx->seq;
20a69341 3585
dedb67c4 3586 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 3587 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3588 flags);
3589 if (nlh == NULL)
3590 goto nla_put_failure;
3591
3592 nfmsg = nlmsg_data(nlh);
36596dad 3593 nfmsg->nfgen_family = ctx->family;
20a69341 3594 nfmsg->version = NFNETLINK_V0;
84d7fce6 3595 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 3596
3597 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3598 goto nla_put_failure;
3599 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3600 goto nla_put_failure;
3ecbfd65
HS		 3601 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3602 NFTA_SET_PAD))
3603 goto nla_put_failure;
20a69341
PM		 3604 if (set->flags != 0)
3605 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3606 goto nla_put_failure;
3607
3608 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3609 goto nla_put_failure;
3610 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3611 goto nla_put_failure;
3612 if (set->flags & NFT_SET_MAP) {
3613 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3614 goto nla_put_failure;
3615 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3616 goto nla_put_failure;
3617 }
8aeff920
PNA		 3618 if (set->flags & NFT_SET_OBJECT &&
3619 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3620 goto nla_put_failure;
20a69341 3621
761da293 3622 if (set->timeout &&
d3e2a111 3623 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 3624 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 3625 NFTA_SET_PAD))
761da293
PM		 3626 goto nla_put_failure;
3627 if (set->gc_int &&
3628 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3629 goto nla_put_failure;
3630
9363dc4b
AB		 3631 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3632 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3633 goto nla_put_failure;
3634 }
3635
e6d8ecac
CFG		 3636 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3637 goto nla_put_failure;
3638
ae0be8de 3639 desc = nla_nest_start_noflag(skb, NFTA_SET_DESC);
f3a2181e 3640
c50b960c
PM		 3641 if (desc == NULL)
3642 goto nla_put_failure;
3643 if (set->size &&
3644 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3645 goto nla_put_failure;
f3a2181e
SB		 3646
3647 if (set->field_count > 1 &&
3648 nf_tables_fill_set_concat(skb, set))
3649 goto nla_put_failure;
3650
c50b960c
PM		 3651 nla_nest_end(skb, desc);
3652
053c095a
JB		 3653 nlmsg_end(skb, nlh);
3654 return 0;
20a69341
PM		 3655
3656nla_put_failure:
3657 nlmsg_trim(skb, nlh);
3658 return -1;
3659}
3660
25e94a99
PNA		 3661static void nf_tables_set_notify(const struct nft_ctx *ctx,
3662 const struct nft_set *set, int event,
3663 gfp_t gfp_flags)
20a69341
PM		 3664{
3665 struct sk_buff *skb;
128ad332 3666 u32 portid = ctx->portid;
20a69341
PM		 3667 int err;
3668
128ad332
PNA		 3669 if (!ctx->report &&
3670 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 3671 return;
20a69341 3672
31f8441c 3673 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 3674 if (skb == NULL)
3675 goto err;
3676
3677 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3678 if (err < 0) {
3679 kfree_skb(skb);
3680 goto err;
3681 }
3682
25e94a99
PNA		 3683 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3684 gfp_flags);
3685 return;
20a69341 3686err:
25e94a99 3687 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 3688}
3689
5b96af77 3690static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 3691{
3692 const struct nft_set *set;
3693 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 3694 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3695 struct net *net = sock_net(skb->sk);
5b96af77 3696 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 3697
3698 if (cb->args[1])
3699 return skb->len;
3700
e688a7f8 3701 rcu_read_lock();
38e029f1
PNA		 3702 cb->seq = net->nft.base_seq;
3703
36596dad
PNA		 3704 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3705 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 3706 ctx->family != table->family)
36596dad
PNA		 3707 continue;
3708
3709 if (ctx->table && ctx->table != table)
5b96af77
PNA		 3710 continue;
3711
36596dad
PNA		 3712 if (cur_table) {
3713 if (cur_table != table)
c9c8e485
PNA		 3714 continue;
3715
36596dad 3716 cur_table = NULL;
c9c8e485 3717 }
36596dad
PNA		 3718 idx = 0;
3719 list_for_each_entry_rcu(set, &table->sets, list) {
3720 if (idx < s_idx)
3721 goto cont;
3722 if (!nft_is_active(net, set))
3723 goto cont;
5b96af77 3724
36596dad
PNA		 3725 ctx_set = *ctx;
3726 ctx_set.table = table;
98319cb9 3727 ctx_set.family = table->family;
c9c8e485 3728
36596dad
PNA		 3729 if (nf_tables_fill_set(skb, &ctx_set, set,
3730 NFT_MSG_NEWSET,
3731 NLM_F_MULTI) < 0) {
3732 cb->args[0] = idx;
3733 cb->args[2] = (unsigned long) table;
3734 goto done;
c9c8e485 3735 }
36596dad 3736 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 3737cont:
36596dad 3738 idx++;
c9c8e485 3739 }
36596dad
PNA		 3740 if (s_idx)
3741 s_idx = 0;
c9c8e485
PNA		 3742 }
3743 cb->args[1] = 1;
3744done:
e688a7f8 3745 rcu_read_unlock();
c9c8e485
PNA		 3746 return skb->len;
3747}
3748
90fd131a
FW		 3749static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3750{
3751 struct nft_ctx *ctx_dump = NULL;
3752
3753 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3754 if (ctx_dump == NULL)
3755 return -ENOMEM;
3756
3757 cb->data = ctx_dump;
3758 return 0;
3759}
3760
5b96af77 3761static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 3762{
5b96af77
PNA		 3763 kfree(cb->data);
3764 return 0;
20a69341
PM		 3765}
3766
d9adf22a 3767/* called with rcu_read_lock held */
7b8002a1
PNA		 3768static int nf_tables_getset(struct net *net, struct sock *nlsk,
3769 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3770 const struct nlattr * const nla[],
3771 struct netlink_ext_ack *extack)
20a69341 3772{
f2a6d766 3773 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3774 const struct nft_set *set;
3775 struct nft_ctx ctx;
3776 struct sk_buff *skb2;
c9c8e485 3777 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 3778 int err;
3779
01cfa0a4 3780 /* Verify existence before starting dump */
36dd1bcc
PNA		 3781 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3782 genmask);
20a69341
PM		 3783 if (err < 0)
3784 return err;
3785
3786 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3787 struct netlink_dump_control c = {
90fd131a 3788 .start = nf_tables_dump_sets_start,
20a69341 3789 .dump = nf_tables_dump_sets,
5b96af77 3790 .done = nf_tables_dump_sets_done,
90fd131a 3791 .data = &ctx,
d9adf22a 3792 .module = THIS_MODULE,
20a69341 3793 };
5b96af77 3794
d9adf22a 3795 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
20a69341
PM		 3796 }
3797
c9c8e485
PNA		 3798 /* Only accept unspec with dump */
3799 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3800 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3801 if (!nla[NFTA_SET_TABLE])
3802 return -EINVAL;
c9c8e485 3803
cac20fcd 3804 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3805 if (IS_ERR(set))
3806 return PTR_ERR(set);
3807
d9adf22a 3808 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
20a69341
PM		 3809 if (skb2 == NULL)
3810 return -ENOMEM;
3811
3812 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3813 if (err < 0)
3814 goto err;
3815
3816 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3817
3818err:
3819 kfree_skb(skb2);
3820 return err;
3821}
3822
f3a2181e
SB		 3823static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = {
3824 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 },
3825};
3826
3827static int nft_set_desc_concat_parse(const struct nlattr *attr,
3828 struct nft_set_desc *desc)
3829{
3830 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1];
3831 u32 len;
3832 int err;
3833
3834 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr,
3835 nft_concat_policy, NULL);
3836 if (err < 0)
3837 return err;
3838
3839 if (!tb[NFTA_SET_FIELD_LEN])
3840 return -EINVAL;
3841
3842 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN]));
3843
3844 if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT)
3845 return -E2BIG;
3846
3847 desc->field_len[desc->field_count++] = len;
3848
3849 return 0;
3850}
3851
3852static int nft_set_desc_concat(struct nft_set_desc *desc,
3853 const struct nlattr *nla)
3854{
3855 struct nlattr *attr;
3856 int rem, err;
3857
3858 nla_for_each_nested(attr, nla, rem) {
3859 if (nla_type(attr) != NFTA_LIST_ELEM)
3860 return -EINVAL;
3861
3862 err = nft_set_desc_concat_parse(attr, desc);
3863 if (err < 0)
3864 return err;
3865 }
3866
3867 return 0;
3868}
3869
f7e840ee 3870static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
c50b960c
PM		 3871 const struct nlattr *nla)
3872{
3873 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3874 int err;
3875
8cb08174
JB		 3876 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
3877 nft_set_desc_policy, NULL);
c50b960c
PM		 3878 if (err < 0)
3879 return err;
3880
3881 if (da[NFTA_SET_DESC_SIZE] != NULL)
3882 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
f3a2181e
SB		 3883 if (da[NFTA_SET_DESC_CONCAT])
3884 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]);
c50b960c 3885
f3a2181e 3886 return err;
c50b960c
PM		 3887}
3888
633c9a84
PNA		 3889static int nf_tables_newset(struct net *net, struct sock *nlsk,
3890 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3891 const struct nlattr * const nla[],
3892 struct netlink_ext_ack *extack)
20a69341
PM		 3893{
3894 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3895 u8 genmask = nft_genmask_next(net);
98319cb9 3896 int family = nfmsg->nfgen_family;
20a69341 3897 const struct nft_set_ops *ops;
20a69341
PM		 3898 struct nft_table *table;
3899 struct nft_set *set;
3900 struct nft_ctx ctx;
38745490 3901 char *name;
4ef360dd 3902 u64 size;
761da293 3903 u64 timeout;
8aeff920 3904 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3905 struct nft_set_desc desc;
e6d8ecac
CFG		 3906 unsigned char *udata;
3907 u16 udlen;
20a69341 3908 int err;
f3a2181e 3909 int i;
20a69341
PM		 3910
3911 if (nla[NFTA_SET_TABLE] == NULL ||
3912 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3913 nla[NFTA_SET_KEY_LEN] == NULL ||
3914 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3915 return -EINVAL;
3916
c50b960c
PM		 3917 memset(&desc, 0, sizeof(desc));
3918
20a69341
PM		 3919 ktype = NFT_DATA_VALUE;
3920 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3921 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3922 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3923 return -EINVAL;
3924 }
3925
c50b960c 3926 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3927 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3928 return -EINVAL;
3929
3930 flags = 0;
3931 if (nla[NFTA_SET_FLAGS] != NULL) {
3932 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3933 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3934 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3935 NFT_SET_MAP | NFT_SET_EVAL |
3936 NFT_SET_OBJECT))
20a69341 3937 return -EINVAL;
8aeff920 3938 /* Only one of these operations is supported */
acab7131
FW		 3939 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
3940 (NFT_SET_MAP | NFT_SET_OBJECT))
3941 return -EOPNOTSUPP;
3942 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3943 (NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3944 return -EOPNOTSUPP;
20a69341
PM		 3945 }
3946
3947 dtype = 0;
20a69341
PM		 3948 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3949 if (!(flags & NFT_SET_MAP))
3950 return -EINVAL;
3951
3952 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3953 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3954 dtype != NFT_DATA_VERDICT)
3955 return -EINVAL;
3956
3957 if (dtype != NFT_DATA_VERDICT) {
3958 if (nla[NFTA_SET_DATA_LEN] == NULL)
3959 return -EINVAL;
c50b960c 3960 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3961 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3962 return -EINVAL;
3963 } else
7d740264 3964 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3965 } else if (flags & NFT_SET_MAP)
3966 return -EINVAL;
3967
8aeff920
PNA		 3968 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3969 if (!(flags & NFT_SET_OBJECT))
3970 return -EINVAL;
3971
3972 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3973 if (objtype == NFT_OBJECT_UNSPEC ||
3974 objtype > NFT_OBJECT_MAX)
3975 return -EINVAL;
3976 } else if (flags & NFT_SET_OBJECT)
3977 return -EINVAL;
3978 else
3979 objtype = NFT_OBJECT_UNSPEC;
3980
761da293
PM		 3981 timeout = 0;
3982 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3983 if (!(flags & NFT_SET_TIMEOUT))
3984 return -EINVAL;
8e1102d5
FW		 3985
3986 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3987 if (err)
3988 return err;
761da293
PM		 3989 }
3990 gc_int = 0;
3991 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3992 if (!(flags & NFT_SET_TIMEOUT))
3993 return -EINVAL;
3994 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3995 }
3996
c50b960c
PM		 3997 policy = NFT_SET_POL_PERFORMANCE;
3998 if (nla[NFTA_SET_POLICY] != NULL)
3999 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
4000
4001 if (nla[NFTA_SET_DESC] != NULL) {
f7e840ee 4002 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
c50b960c
PM		 4003 if (err < 0)
4004 return err;
4005 }
4006
cac20fcd 4007 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 4008 if (IS_ERR(table)) {
4009 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 4010 return PTR_ERR(table);
36dd1bcc 4011 }
20a69341 4012
98319cb9 4013 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 4014
cac20fcd 4015 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 4016 if (IS_ERR(set)) {
36dd1bcc
PNA		 4017 if (PTR_ERR(set) != -ENOENT) {
4018 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 4019 return PTR_ERR(set);
36dd1bcc 4020 }
1a28ad74 4021 } else {
36dd1bcc
PNA		 4022 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4023 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 4024 return -EEXIST;
36dd1bcc 4025 }
20a69341
PM		 4026 if (nlh->nlmsg_flags & NLM_F_REPLACE)
4027 return -EOPNOTSUPP;
36dd1bcc 4028
20a69341
PM		 4029 return 0;
4030 }
4031
4032 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
4033 return -ENOENT;
4034
2b664957 4035 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 4036 if (IS_ERR(ops))
4037 return PTR_ERR(ops);
4038
e6d8ecac
CFG		 4039 udlen = 0;
4040 if (nla[NFTA_SET_USERDATA])
4041 udlen = nla_len(nla[NFTA_SET_USERDATA]);
4042
20a69341
PM		 4043 size = 0;
4044 if (ops->privsize != NULL)
347b408d 4045 size = ops->privsize(nla, &desc);
20a69341 4046
1ff75a3e 4047 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
24d19826
FW		 4048 if (!set)
4049 return -ENOMEM;
20a69341 4050
38745490
PS		 4051 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
4052 if (!name) {
4053 err = -ENOMEM;
4054 goto err2;
4055 }
4056
20a69341 4057 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 4058 kfree(name);
20a69341
PM		 4059 if (err < 0)
4060 goto err2;
4061
e6d8ecac
CFG		 4062 udata = NULL;
4063 if (udlen) {
4064 udata = set->data + size;
4065 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
4066 }
4067
20a69341 4068 INIT_LIST_HEAD(&set->bindings);
3453c927
PNA		 4069 set->table = table;
4070 write_pnet(&set->net, net);
20a69341
PM		 4071 set->ops = ops;
4072 set->ktype = ktype;
c50b960c 4073 set->klen = desc.klen;
20a69341 4074 set->dtype = dtype;
8aeff920 4075 set->objtype = objtype;
c50b960c 4076 set->dlen = desc.dlen;
20a69341 4077 set->flags = flags;
c50b960c 4078 set->size = desc.size;
9363dc4b 4079 set->policy = policy;
e6d8ecac
CFG		 4080 set->udlen = udlen;
4081 set->udata = udata;
761da293
PM		 4082 set->timeout = timeout;
4083 set->gc_int = gc_int;
3ecbfd65 4084 set->handle = nf_tables_alloc_handle(table);
20a69341 4085
f3a2181e
SB		 4086 set->field_count = desc.field_count;
4087 for (i = 0; i < desc.field_count; i++)
4088 set->field_len[i] = desc.field_len[i];
4089
c50b960c 4090 err = ops->init(set, &desc, nla);
20a69341 4091 if (err < 0)
2f6adf48 4092 goto err3;
20a69341 4093
958bee14 4094 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 4095 if (err < 0)
2f6adf48 4096 goto err4;
20a69341 4097
e688a7f8 4098 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 4099 table->use++;
20a69341
PM		 4100 return 0;
4101
2f6adf48 4102err4:
c17c3cdf 4103 ops->destroy(set);
2f6adf48
FW		 4104err3:
4105 kfree(set->name);
20a69341 4106err2:
1ff75a3e 4107 kvfree(set);
20a69341
PM		 4108 return err;
4109}
4110
958bee14 4111static void nft_set_destroy(struct nft_set *set)
20a69341 4112{
273fe3f1
PNA		 4113 if (WARN_ON(set->use > 0))
4114 return;
4115
20a69341 4116 set->ops->destroy(set);
38745490 4117 kfree(set->name);
1ff75a3e 4118 kvfree(set);
20a69341
PM		 4119}
4120
633c9a84
PNA		 4121static int nf_tables_delset(struct net *net, struct sock *nlsk,
4122 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4123 const struct nlattr * const nla[],
4124 struct netlink_ext_ack *extack)
20a69341 4125{
c9c8e485 4126 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 4127 u8 genmask = nft_genmask_next(net);
36dd1bcc 4128 const struct nlattr *attr;
20a69341
PM		 4129 struct nft_set *set;
4130 struct nft_ctx ctx;
4131 int err;
4132
ec2c9935
PM		 4133 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4134 return -EAFNOSUPPORT;
20a69341
PM		 4135 if (nla[NFTA_SET_TABLE] == NULL)
4136 return -EINVAL;
4137
36dd1bcc
PNA		 4138 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
4139 genmask);
20a69341
PM		 4140 if (err < 0)
4141 return err;
4142
36dd1bcc
PNA		 4143 if (nla[NFTA_SET_HANDLE]) {
4144 attr = nla[NFTA_SET_HANDLE];
4145 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
4146 } else {
4147 attr = nla[NFTA_SET_NAME];
4148 set = nft_set_lookup(ctx.table, attr, genmask);
4149 }
a8278400 4150
36dd1bcc
PNA		 4151 if (IS_ERR(set)) {
4152 NL_SET_BAD_ATTR(extack, attr);
4153 return PTR_ERR(set);
4154 }
273fe3f1 4155 if (set->use ||
36dd1bcc
PNA		 4156 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
4157 NL_SET_BAD_ATTR(extack, attr);
20a69341 4158 return -EBUSY;
36dd1bcc 4159 }
20a69341 4160
ee01d542 4161 return nft_delset(&ctx, set);
20a69341
PM		 4162}
4163
4164static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 4165 struct nft_set *set,
20a69341 4166 const struct nft_set_iter *iter,
de70185d 4167 struct nft_set_elem *elem)
20a69341 4168{
fe2811eb 4169 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 4170 enum nft_registers dreg;
4171
4172 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 4173 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
4174 set->dtype == NFT_DATA_VERDICT ?
4175 NFT_DATA_VERDICT : NFT_DATA_VALUE,
4176 set->dlen);
20a69341
PM		 4177}
4178
4179int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
4180 struct nft_set_binding *binding)
4181{
4182 struct nft_set_binding *i;
4183 struct nft_set_iter iter;
4184
273fe3f1
PNA		 4185 if (set->use == UINT_MAX)
4186 return -EOVERFLOW;
4187
408070d6 4188 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 4189 return -EBUSY;
4190
11113e19 4191 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 4192 /* If the set is already bound to the same chain all
4193 * jumps are already validated for that chain.
4194 */
4195 list_for_each_entry(i, &set->bindings, list) {
a4684402 4196 if (i->flags & NFT_SET_MAP &&
11113e19 4197 i->chain == binding->chain)
20a69341
PM		 4198 goto bind;
4199 }
4200
8588ac09 4201 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 4202 iter.skip = 0;
4203 iter.count = 0;
4204 iter.err = 0;
4205 iter.fn = nf_tables_bind_check_setelem;
4206
4207 set->ops->walk(ctx, set, &iter);
a02f4248 4208 if (iter.err < 0)
20a69341 4209 return iter.err;
20a69341
PM		 4210 }
4211bind:
4212 binding->chain = ctx->chain;
e688a7f8 4213 list_add_tail_rcu(&binding->list, &set->bindings);
f6ac8585 4214 nft_set_trans_bind(ctx, set);
273fe3f1 4215 set->use++;
f6ac8585 4216
20a69341
PM		 4217 return 0;
4218}
63aea290 4219EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341 4220
3b0a081d
FW		 4221static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
4222 struct nft_set_binding *binding, bool event)
20a69341 4223{
e688a7f8 4224 list_del_rcu(&binding->list);
20a69341 4225
f6ac8585 4226 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
cd5125d8 4227 list_del_rcu(&set->list);
f6ac8585
PNA		 4228 if (event)
4229 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
4230 GFP_KERNEL);
4231 }
20a69341
PM		 4232}
4233
273fe3f1
PNA		 4234void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
4235 struct nft_set_binding *binding,
4236 enum nft_trans_phase phase)
4237{
4238 switch (phase) {
4239 case NFT_TRANS_PREPARE:
4240 set->use--;
4241 return;
4242 case NFT_TRANS_ABORT:
4243 case NFT_TRANS_RELEASE:
4244 set->use--;
4245 /* fall through */
4246 default:
4247 nf_tables_unbind_set(ctx, set, binding,
4248 phase == NFT_TRANS_COMMIT);
4249 }
4250}
4251EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
4252
cd5125d8
FW		 4253void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
4254{
f6ac8585 4255 if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
cd5125d8 4256 nft_set_destroy(set);
cd5125d8
FW		 4257}
4258EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
4259
3ac4c07a
PM		 4260const struct nft_set_ext_type nft_set_ext_types[] = {
4261 [NFT_SET_EXT_KEY] = {
7d740264 4262 .align = __alignof__(u32),
3ac4c07a
PM		 4263 },
4264 [NFT_SET_EXT_DATA] = {
7d740264 4265 .align = __alignof__(u32),
3ac4c07a 4266 },
f25ad2e9
PM		 4267 [NFT_SET_EXT_EXPR] = {
4268 .align = __alignof__(struct nft_expr),
4269 },
8aeff920
PNA		 4270 [NFT_SET_EXT_OBJREF] = {
4271 .len = sizeof(struct nft_object *),
4272 .align = __alignof__(struct nft_object *),
4273 },
3ac4c07a
PM		 4274 [NFT_SET_EXT_FLAGS] = {
4275 .len = sizeof(u8),
4276 .align = __alignof__(u8),
4277 },
c3e1b005
PM		 4278 [NFT_SET_EXT_TIMEOUT] = {
4279 .len = sizeof(u64),
4280 .align = __alignof__(u64),
4281 },
4282 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 4283 .len = sizeof(u64),
4284 .align = __alignof__(u64),
c3e1b005 4285 },
68e942e8
PM		 4286 [NFT_SET_EXT_USERDATA] = {
4287 .len = sizeof(struct nft_userdata),
4288 .align = __alignof__(struct nft_userdata),
4289 },
7b225d0b
PNA		 4290 [NFT_SET_EXT_KEY_END] = {
4291 .align = __alignof__(u32),
4292 },
3ac4c07a 4293};
3ac4c07a 4294
20a69341
PM		 4295/*
4296 * Set elements
4297 */
4298
4299static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
4300 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
4301 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
4302 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 4303 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
79ebb5bb 4304 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 },
68e942e8
PM		 4305 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
4306 .len = NFT_USERDATA_MAXLEN },
467697d2 4307 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
9332d27d
FW		 4308 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING,
4309 .len = NFT_OBJ_MAXNAMELEN - 1 },
7b225d0b 4310 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED },
20a69341
PM		 4311};
4312
4313static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 4314 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
4315 .len = NFT_TABLE_MAXNAMELEN - 1 },
4316 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
4317 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 4318 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 4319 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 4320};
4321
633c9a84 4322static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 4323 const struct sk_buff *skb,
4324 const struct nlmsghdr *nlh,
f2a6d766 4325 const struct nlattr * const nla[],
36dd1bcc 4326 struct netlink_ext_ack *extack,
f2a6d766 4327 u8 genmask)
20a69341
PM		 4328{
4329 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 4330 int family = nfmsg->nfgen_family;
7c95f6d8 4331 struct nft_table *table;
20a69341 4332
cac20fcd
PNA		 4333 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
4334 genmask);
36dd1bcc
PNA		 4335 if (IS_ERR(table)) {
4336 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 4337 return PTR_ERR(table);
36dd1bcc 4338 }
20a69341 4339
98319cb9 4340 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 4341 return 0;
4342}
4343
4344static int nf_tables_fill_setelem(struct sk_buff *skb,
4345 const struct nft_set *set,
4346 const struct nft_set_elem *elem)
4347{
fe2811eb 4348 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 4349 unsigned char *b = skb_tail_pointer(skb);
4350 struct nlattr *nest;
4351
ae0be8de 4352 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
20a69341
PM		 4353 if (nest == NULL)
4354 goto nla_put_failure;
4355
fe2811eb
PM		 4356 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4357 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 4358 goto nla_put_failure;
4359
7b225d0b
PNA		 4360 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) &&
4361 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext),
4362 NFT_DATA_VALUE, set->klen) < 0)
4363 goto nla_put_failure;
4364
fe2811eb
PM		 4365 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4366 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 4367 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4368 set->dlen) < 0)
4369 goto nla_put_failure;
4370
f25ad2e9
PM		 4371 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
4372 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
4373 goto nla_put_failure;
4374
8aeff920
PNA		 4375 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4376 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
d152159b 4377 (*nft_set_ext_obj(ext))->key.name) < 0)
8aeff920
PNA		 4378 goto nla_put_failure;
4379
fe2811eb
PM		 4380 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4381 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4382 htonl(*nft_set_ext_flags(ext))))
4383 goto nla_put_failure;
20a69341 4384
c3e1b005
PM		 4385 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4386 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 4387 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 4388 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 4389 goto nla_put_failure;
4390
4391 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 4392 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 4393
4394 expires = *nft_set_ext_expiration(ext);
8e1102d5 4395 if (time_before64(now, expires))
c3e1b005
PM		 4396 expires -= now;
4397 else
4398 expires = 0;
4399
4400 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 4401 nf_jiffies64_to_msecs(expires),
b46f6ded 4402 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 4403 goto nla_put_failure;
4404 }
4405
68e942e8
PM		 4406 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4407 struct nft_userdata *udata;
4408
4409 udata = nft_set_ext_userdata(ext);
4410 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4411 udata->len + 1, udata->data))
4412 goto nla_put_failure;
4413 }
4414
20a69341
PM		 4415 nla_nest_end(skb, nest);
4416 return 0;
4417
4418nla_put_failure:
4419 nlmsg_trim(skb, b);
4420 return -EMSGSIZE;
4421}
4422
4423struct nft_set_dump_args {
4424 const struct netlink_callback *cb;
4425 struct nft_set_iter iter;
4426 struct sk_buff *skb;
4427};
4428
4429static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 4430 struct nft_set *set,
20a69341 4431 const struct nft_set_iter *iter,
de70185d 4432 struct nft_set_elem *elem)
20a69341
PM		 4433{
4434 struct nft_set_dump_args *args;
4435
4436 args = container_of(iter, struct nft_set_dump_args, iter);
4437 return nf_tables_fill_setelem(args->skb, set, elem);
4438}
4439
fa803605
LZ		 4440struct nft_set_dump_ctx {
4441 const struct nft_set *set;
4442 struct nft_ctx ctx;
4443};
4444
20a69341
PM		 4445static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4446{
fa803605 4447 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 4448 struct net *net = sock_net(skb->sk);
fa803605 4449 struct nft_table *table;
de70185d 4450 struct nft_set *set;
20a69341 4451 struct nft_set_dump_args args;
fa803605 4452 bool set_found = false;
20a69341
PM		 4453 struct nfgenmsg *nfmsg;
4454 struct nlmsghdr *nlh;
4455 struct nlattr *nest;
4456 u32 portid, seq;
fa803605 4457 int event;
20a69341 4458
fa803605 4459 rcu_read_lock();
36596dad
PNA		 4460 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4461 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 4462 dump_ctx->ctx.family != table->family)
fa803605 4463 continue;
20a69341 4464
36596dad
PNA		 4465 if (table != dump_ctx->ctx.table)
4466 continue;
20a69341 4467
36596dad
PNA		 4468 list_for_each_entry_rcu(set, &table->sets, list) {
4469 if (set == dump_ctx->set) {
4470 set_found = true;
4471 break;
fa803605 4472 }
fa803605
LZ		 4473 }
4474 break;
4475 }
4476
4477 if (!set_found) {
4478 rcu_read_unlock();
4479 return -ENOENT;
4480 }
20a69341 4481
dedb67c4 4482 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 4483 portid = NETLINK_CB(cb->skb).portid;
4484 seq = cb->nlh->nlmsg_seq;
4485
4486 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4487 NLM_F_MULTI);
4488 if (nlh == NULL)
4489 goto nla_put_failure;
4490
4491 nfmsg = nlmsg_data(nlh);
98319cb9 4492 nfmsg->nfgen_family = table->family;
20a69341 4493 nfmsg->version = NFNETLINK_V0;
fa803605 4494 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 4495
fa803605 4496 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 4497 goto nla_put_failure;
4498 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4499 goto nla_put_failure;
4500
ae0be8de 4501 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
20a69341
PM		 4502 if (nest == NULL)
4503 goto nla_put_failure;
4504
8588ac09
PNA		 4505 args.cb = cb;
4506 args.skb = skb;
fa803605 4507 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 4508 args.iter.skip = cb->args[0];
4509 args.iter.count = 0;
4510 args.iter.err = 0;
4511 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 4512 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4513 rcu_read_unlock();
20a69341
PM		 4514
4515 nla_nest_end(skb, nest);
4516 nlmsg_end(skb, nlh);
4517
4518 if (args.iter.err && args.iter.err != -EMSGSIZE)
4519 return args.iter.err;
4520 if (args.iter.count == cb->args[0])
4521 return 0;
4522
4523 cb->args[0] = args.iter.count;
4524 return skb->len;
4525
4526nla_put_failure:
fa803605 4527 rcu_read_unlock();
20a69341
PM		 4528 return -ENOSPC;
4529}
4530
90fd131a
FW		 4531static int nf_tables_dump_set_start(struct netlink_callback *cb)
4532{
4533 struct nft_set_dump_ctx *dump_ctx = cb->data;
4534
4535 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4536
4537 return cb->data ? 0 : -ENOMEM;
4538}
4539
fa803605
LZ		 4540static int nf_tables_dump_set_done(struct netlink_callback *cb)
4541{
4542 kfree(cb->data);
4543 return 0;
4544}
4545
d60ce62f
AB		 4546static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4547 const struct nft_ctx *ctx, u32 seq,
4548 u32 portid, int event, u16 flags,
4549 const struct nft_set *set,
4550 const struct nft_set_elem *elem)
4551{
4552 struct nfgenmsg *nfmsg;
4553 struct nlmsghdr *nlh;
4554 struct nlattr *nest;
4555 int err;
4556
dedb67c4 4557 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 4558 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4559 flags);
4560 if (nlh == NULL)
4561 goto nla_put_failure;
4562
4563 nfmsg = nlmsg_data(nlh);
36596dad 4564 nfmsg->nfgen_family = ctx->family;
d60ce62f 4565 nfmsg->version = NFNETLINK_V0;
84d7fce6 4566 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 4567
4568 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4569 goto nla_put_failure;
4570 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4571 goto nla_put_failure;
4572
ae0be8de 4573 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
d60ce62f
AB		 4574 if (nest == NULL)
4575 goto nla_put_failure;
4576
4577 err = nf_tables_fill_setelem(skb, set, elem);
4578 if (err < 0)
4579 goto nla_put_failure;
4580
4581 nla_nest_end(skb, nest);
4582
053c095a
JB		 4583 nlmsg_end(skb, nlh);
4584 return 0;
d60ce62f
AB		 4585
4586nla_put_failure:
4587 nlmsg_trim(skb, nlh);
4588 return -1;
4589}
4590
ba0e4d99
PNA		 4591static int nft_setelem_parse_flags(const struct nft_set *set,
4592 const struct nlattr *attr, u32 *flags)
4593{
4594 if (attr == NULL)
4595 return 0;
4596
4597 *flags = ntohl(nla_get_be32(attr));
4598 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4599 return -EINVAL;
4600 if (!(set->flags & NFT_SET_INTERVAL) &&
4601 *flags & NFT_SET_ELEM_INTERVAL_END)
4602 return -EINVAL;
4603
4604 return 0;
4605}
4606
20a1452c
PNA		 4607static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
4608 struct nft_data *key, struct nlattr *attr)
4609{
4610 struct nft_data_desc desc;
4611 int err;
4612
4613 err = nft_data_init(ctx, key, NFT_DATA_VALUE_MAXLEN, &desc, attr);
4614 if (err < 0)
4615 return err;
4616
4617 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
4618 nft_data_release(key, desc.type);
4619 return -EINVAL;
4620 }
4621
4622 return 0;
4623}
4624
ba0e4d99
PNA		 4625static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4626 const struct nlattr *attr)
4627{
4628 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
ba0e4d99
PNA		 4629 struct nft_set_elem elem;
4630 struct sk_buff *skb;
4631 uint32_t flags = 0;
4632 void *priv;
4633 int err;
4634
8cb08174
JB		 4635 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4636 nft_set_elem_policy, NULL);
ba0e4d99
PNA		 4637 if (err < 0)
4638 return err;
4639
4640 if (!nla[NFTA_SET_ELEM_KEY])
4641 return -EINVAL;
4642
4643 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4644 if (err < 0)
4645 return err;
4646
20a1452c
PNA		 4647 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
4648 nla[NFTA_SET_ELEM_KEY]);
ba0e4d99
PNA		 4649 if (err < 0)
4650 return err;
4651
7b225d0b
PNA		 4652 if (nla[NFTA_SET_ELEM_KEY_END]) {
4653 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
4654 nla[NFTA_SET_ELEM_KEY_END]);
4655 if (err < 0)
4656 return err;
4657 }
4658
ba0e4d99
PNA		 4659 priv = set->ops->get(ctx->net, set, &elem, flags);
4660 if (IS_ERR(priv))
4661 return PTR_ERR(priv);
4662
4663 elem.priv = priv;
ba0e4d99
PNA		 4664
4665 err = -ENOMEM;
d9adf22a 4666 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
ba0e4d99
PNA		 4667 if (skb == NULL)
4668 goto err1;
4669
4670 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4671 NFT_MSG_NEWSETELEM, 0, set, &elem);
4672 if (err < 0)
4673 goto err2;
4674
4675 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4676 /* This avoids a loop in nfnetlink. */
4677 if (err < 0)
4678 goto err1;
4679
4680 return 0;
4681err2:
4682 kfree_skb(skb);
4683err1:
4684 /* this avoids a loop in nfnetlink. */
4685 return err == -EAGAIN ? -ENOBUFS : err;
4686}
4687
d9adf22a 4688/* called with rcu_read_lock held */
ba0e4d99
PNA		 4689static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4690 struct sk_buff *skb, const struct nlmsghdr *nlh,
4691 const struct nlattr * const nla[],
4692 struct netlink_ext_ack *extack)
4693{
4694 u8 genmask = nft_genmask_cur(net);
4695 struct nft_set *set;
4696 struct nlattr *attr;
4697 struct nft_ctx ctx;
4698 int rem, err = 0;
4699
36dd1bcc
PNA		 4700 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4701 genmask);
ba0e4d99
PNA		 4702 if (err < 0)
4703 return err;
4704
cac20fcd 4705 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 4706 if (IS_ERR(set))
4707 return PTR_ERR(set);
4708
4709 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4710 struct netlink_dump_control c = {
90fd131a 4711 .start = nf_tables_dump_set_start,
ba0e4d99
PNA		 4712 .dump = nf_tables_dump_set,
4713 .done = nf_tables_dump_set_done,
d9adf22a 4714 .module = THIS_MODULE,
ba0e4d99 4715 };
90fd131a
FW		 4716 struct nft_set_dump_ctx dump_ctx = {
4717 .set = set,
4718 .ctx = ctx,
4719 };
ba0e4d99 4720
90fd131a 4721 c.data = &dump_ctx;
d9adf22a 4722 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
ba0e4d99
PNA		 4723 }
4724
4725 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4726 return -EINVAL;
4727
4728 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4729 err = nft_get_set_elem(&ctx, set, attr);
4730 if (err < 0)
4731 break;
4732 }
4733
4734 return err;
4735}
4736
25e94a99
PNA		 4737static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4738 const struct nft_set *set,
4739 const struct nft_set_elem *elem,
4740 int event, u16 flags)
d60ce62f 4741{
128ad332
PNA		 4742 struct net *net = ctx->net;
4743 u32 portid = ctx->portid;
d60ce62f
AB		 4744 struct sk_buff *skb;
4745 int err;
4746
128ad332 4747 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4748 return;
d60ce62f 4749
d60ce62f
AB		 4750 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4751 if (skb == NULL)
4752 goto err;
4753
4754 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4755 set, elem);
4756 if (err < 0) {
4757 kfree_skb(skb);
4758 goto err;
4759 }
4760
25e94a99
PNA		 4761 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4762 GFP_KERNEL);
4763 return;
d60ce62f 4764err:
25e94a99 4765 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 4766}
4767
60319eb1
PNA		 4768static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4769 int msg_type,
4770 struct nft_set *set)
4771{
4772 struct nft_trans *trans;
4773
4774 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4775 if (trans == NULL)
4776 return NULL;
4777
4778 nft_trans_elem_set(trans) = set;
4779 return trans;
4780}
4781
a7fc9368
PNA		 4782struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
4783 const struct nft_set *set,
4784 const struct nlattr *attr)
4785{
4786 struct nft_expr *expr;
4787 int err;
4788
4789 expr = nft_expr_init(ctx, attr);
4790 if (IS_ERR(expr))
4791 return expr;
4792
4793 err = -EOPNOTSUPP;
4794 if (!(expr->ops->type->flags & NFT_EXPR_STATEFUL))
4795 goto err_set_elem_expr;
4796
4797 if (expr->ops->type->flags & NFT_EXPR_GC) {
4798 if (set->flags & NFT_SET_TIMEOUT)
4799 goto err_set_elem_expr;
4800 if (!set->ops->gc_init)
4801 goto err_set_elem_expr;
4802 set->ops->gc_init(set);
4803 }
4804
4805 return expr;
4806
4807err_set_elem_expr:
4808 nft_expr_destroy(ctx, expr);
4809 return ERR_PTR(err);
4810}
4811
22fe54d5
PM		 4812void *nft_set_elem_init(const struct nft_set *set,
4813 const struct nft_set_ext_tmpl *tmpl,
7b225d0b
PNA		 4814 const u32 *key, const u32 *key_end,
4815 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp)
fe2811eb
PM		 4816{
4817 struct nft_set_ext *ext;
4818 void *elem;
4819
4820 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4821 if (elem == NULL)
4822 return NULL;
4823
4824 ext = nft_set_elem_ext(set, elem);
4825 nft_set_ext_init(ext, tmpl);
4826
4827 memcpy(nft_set_ext_key(ext), key, set->klen);
7b225d0b
PNA		 4828 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
4829 memcpy(nft_set_ext_key_end(ext), key_end, set->klen);
fe2811eb
PM		 4830 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4831 memcpy(nft_set_ext_data(ext), data, set->dlen);
79ebb5bb
LGL		 4832 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4833 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
4834 if (expiration == 0)
4835 *nft_set_ext_expiration(ext) += timeout;
4836 }
c3e1b005
PM		 4837 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4838 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 4839
4840 return elem;
4841}
4842
61f9e292
LZ		 4843void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4844 bool destroy_expr)
61edafbb
PM		 4845{
4846 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3453c927
PNA		 4847 struct nft_ctx ctx = {
4848 .net = read_pnet(&set->net),
4849 .family = set->table->family,
4850 };
61edafbb 4851
59105446 4852 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 4853 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 4854 nft_data_release(nft_set_ext_data(ext), set->dtype);
371ebcbb
PNA		 4855 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4856 struct nft_expr *expr = nft_set_ext_expr(ext);
4857
4858 if (expr->ops->destroy_clone) {
4859 expr->ops->destroy_clone(&ctx, expr);
4860 module_put(expr->ops->type->owner);
4861 } else {
4862 nf_tables_expr_destroy(&ctx, expr);
4863 }
4864 }
8aeff920
PNA		 4865 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4866 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 4867 kfree(elem);
4868}
4869EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4870
59105446
PNA		 4871/* Only called from commit path, nft_set_elem_deactivate() already deals with
4872 * the refcounting from the preparation phase.
4873 */
3453c927
PNA		 4874static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4875 const struct nft_set *set, void *elem)
59105446
PNA		 4876{
4877 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4878
4879 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3453c927 4880 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
59105446
PNA		 4881 kfree(elem);
4882}
4883
60319eb1 4884static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 4885 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 4886{
4887 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 4888 u8 genmask = nft_genmask_next(ctx->net);
fe2811eb 4889 struct nft_set_ext_tmpl tmpl;
c016c7e4 4890 struct nft_set_ext *ext, *ext2;
20a69341
PM		 4891 struct nft_set_elem elem;
4892 struct nft_set_binding *binding;
8aeff920 4893 struct nft_object *obj = NULL;
68e942e8 4894 struct nft_userdata *udata;
20a1452c 4895 struct nft_data_desc desc;
fe2811eb 4896 struct nft_data data;
20a69341 4897 enum nft_registers dreg;
60319eb1 4898 struct nft_trans *trans;
0e9091d6 4899 u32 flags = 0;
c3e1b005 4900 u64 timeout;
79ebb5bb 4901 u64 expiration;
68e942e8 4902 u8 ulen;
20a69341
PM		 4903 int err;
4904
8cb08174
JB		 4905 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4906 nft_set_elem_policy, NULL);
20a69341
PM		 4907 if (err < 0)
4908 return err;
4909
4910 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4911 return -EINVAL;
4912
fe2811eb
PM		 4913 nft_set_ext_prepare(&tmpl);
4914
0e9091d6
PNA		 4915 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4916 if (err < 0)
4917 return err;
4918 if (flags != 0)
4919 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 4920
4921 if (set->flags & NFT_SET_MAP) {
4922 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 4923 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341
PM		 4924 return -EINVAL;
4925 } else {
4926 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4927 return -EINVAL;
4928 }
4929
bffc124b
PNA		 4930 if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
4931 (nla[NFTA_SET_ELEM_DATA] ||
4932 nla[NFTA_SET_ELEM_OBJREF] ||
4933 nla[NFTA_SET_ELEM_TIMEOUT] ||
4934 nla[NFTA_SET_ELEM_EXPIRATION] ||
4935 nla[NFTA_SET_ELEM_USERDATA] ||
4936 nla[NFTA_SET_ELEM_EXPR]))
4937 return -EINVAL;
4938
c3e1b005
PM		 4939 timeout = 0;
4940 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4941 if (!(set->flags & NFT_SET_TIMEOUT))
4942 return -EINVAL;
8e1102d5
FW		 4943 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4944 &timeout);
4945 if (err)
4946 return err;
c3e1b005
PM		 4947 } else if (set->flags & NFT_SET_TIMEOUT) {
4948 timeout = set->timeout;
4949 }
4950
79ebb5bb
LGL		 4951 expiration = 0;
4952 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
4953 if (!(set->flags & NFT_SET_TIMEOUT))
4954 return -EINVAL;
4955 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
4956 &expiration);
4957 if (err)
4958 return err;
4959 }
4960
20a1452c
PNA		 4961 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
4962 nla[NFTA_SET_ELEM_KEY]);
20a69341 4963 if (err < 0)
7b225d0b 4964 return err;
20a69341 4965
20a1452c 4966 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
7b225d0b
PNA		 4967
4968 if (nla[NFTA_SET_ELEM_KEY_END]) {
4969 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
4970 nla[NFTA_SET_ELEM_KEY_END]);
4971 if (err < 0)
4972 goto err_parse_key;
4973
4974 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
4975 }
4976
c3e1b005
PM		 4977 if (timeout > 0) {
4978 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4979 if (timeout != set->timeout)
4980 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4981 }
fe2811eb 4982
8aeff920
PNA		 4983 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4984 if (!(set->flags & NFT_SET_OBJECT)) {
4985 err = -EINVAL;
7b225d0b 4986 goto err_parse_key_end;
8aeff920 4987 }
4d44175a
FW		 4988 obj = nft_obj_lookup(ctx->net, ctx->table,
4989 nla[NFTA_SET_ELEM_OBJREF],
cac20fcd 4990 set->objtype, genmask);
8aeff920
PNA		 4991 if (IS_ERR(obj)) {
4992 err = PTR_ERR(obj);
7b225d0b 4993 goto err_parse_key_end;
8aeff920
PNA		 4994 }
4995 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4996 }
4997
20a69341 4998 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
20a1452c 4999 err = nft_data_init(ctx, &data, sizeof(data), &desc,
d0a11fc3 5000 nla[NFTA_SET_ELEM_DATA]);
20a69341 5001 if (err < 0)
7b225d0b 5002 goto err_parse_key_end;
20a69341
PM		 5003
5004 err = -EINVAL;
20a1452c 5005 if (set->dtype != NFT_DATA_VERDICT && desc.len != set->dlen)
7b225d0b 5006 goto err_parse_data;
20a69341
PM		 5007
5008 dreg = nft_type_to_reg(set->dtype);
5009 list_for_each_entry(binding, &set->bindings, list) {
5010 struct nft_ctx bind_ctx = {
58c78e10 5011 .net = ctx->net,
36596dad 5012 .family = ctx->family,
20a69341 5013 .table = ctx->table,
7c95f6d8 5014 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 5015 };
5016
11113e19
PM		 5017 if (!(binding->flags & NFT_SET_MAP))
5018 continue;
5019
1ec10212
PM		 5020 err = nft_validate_register_store(&bind_ctx, dreg,
5021 &data,
20a1452c 5022 desc.type, desc.len);
20a69341 5023 if (err < 0)
7b225d0b 5024 goto err_parse_data;
a654de8f 5025
20a1452c 5026 if (desc.type == NFT_DATA_VERDICT &&
a654de8f
PNA		 5027 (data.verdict.code == NFT_GOTO ||
5028 data.verdict.code == NFT_JUMP))
5029 nft_validate_state_update(ctx->net,
5030 NFT_VALIDATE_NEED);
20a69341 5031 }
fe2811eb 5032
20a1452c 5033 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len);
20a69341
PM		 5034 }
5035
68e942e8
PM		 5036 /* The full maximum length of userdata can exceed the maximum
5037 * offset value (U8_MAX) for following extensions, therefor it
5038 * must be the last extension added.
5039 */
5040 ulen = 0;
5041 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
5042 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
5043 if (ulen > 0)
5044 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
5045 ulen);
5046 }
5047
fe2811eb 5048 err = -ENOMEM;
7b225d0b
PNA		 5049 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5050 elem.key_end.val.data, data.data,
79ebb5bb 5051 timeout, expiration, GFP_KERNEL);
fe2811eb 5052 if (elem.priv == NULL)
7b225d0b 5053 goto err_parse_data;
fe2811eb
PM		 5054
5055 ext = nft_set_elem_ext(set, elem.priv);
5056 if (flags)
5057 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 5058 if (ulen > 0) {
5059 udata = nft_set_ext_userdata(ext);
5060 udata->len = ulen - 1;
5061 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
5062 }
8aeff920
PNA		 5063 if (obj) {
5064 *nft_set_ext_obj(ext) = obj;
5065 obj->use++;
5066 }
fe2811eb 5067
60319eb1
PNA		 5068 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
5069 if (trans == NULL)
7b225d0b 5070 goto err_trans;
60319eb1 5071
69086658 5072 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 5073 err = set->ops->insert(ctx->net, set, &elem, &ext2);
5074 if (err) {
5075 if (err == -EEXIST) {
9744a6fc
PNA		 5076 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
5077 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
5078 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
f0dfd7a2
CIK		 5079 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
5080 err = -EBUSY;
7b225d0b 5081 goto err_element_clash;
f0dfd7a2 5082 }
8aeff920
PNA		 5083 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
5084 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
5085 memcmp(nft_set_ext_data(ext),
5086 nft_set_ext_data(ext2), set->dlen) != 0) ||
5087 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
5088 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
5089 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 5090 err = -EBUSY;
5091 else if (!(nlmsg_flags & NLM_F_EXCL))
5092 err = 0;
5093 }
7b225d0b 5094 goto err_element_clash;
c016c7e4 5095 }
20a69341 5096
35d0ac90
PNA		 5097 if (set->size &&
5098 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
5099 err = -ENFILE;
7b225d0b 5100 goto err_set_full;
35d0ac90
PNA		 5101 }
5102
60319eb1 5103 nft_trans_elem(trans) = elem;
46bbafce 5104 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 5105 return 0;
5106
7b225d0b 5107err_set_full:
5cb82a38 5108 set->ops->remove(ctx->net, set, &elem);
7b225d0b 5109err_element_clash:
60319eb1 5110 kfree(trans);
7b225d0b 5111err_trans:
b91d9036
TY		 5112 if (obj)
5113 obj->use--;
fe2811eb 5114 kfree(elem.priv);
7b225d0b 5115err_parse_data:
20a69341 5116 if (nla[NFTA_SET_ELEM_DATA] != NULL)
20a1452c 5117 nft_data_release(&data, desc.type);
7b225d0b
PNA		 5118err_parse_key_end:
5119 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
5120err_parse_key:
20a1452c 5121 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
7b225d0b 5122
20a69341
PM		 5123 return err;
5124}
5125
633c9a84
PNA		 5126static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
5127 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5128 const struct nlattr * const nla[],
5129 struct netlink_ext_ack *extack)
20a69341 5130{
f2a6d766 5131 u8 genmask = nft_genmask_next(net);
20a69341
PM		 5132 const struct nlattr *attr;
5133 struct nft_set *set;
5134 struct nft_ctx ctx;
a654de8f 5135 int rem, err;
20a69341 5136
7d5570ca
PNA		 5137 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
5138 return -EINVAL;
5139
36dd1bcc
PNA		 5140 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5141 genmask);
20a69341
PM		 5142 if (err < 0)
5143 return err;
5144
a3073c17
PNA		 5145 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
5146 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
5147 if (IS_ERR(set))
5148 return PTR_ERR(set);
958bee14 5149
20a69341
PM		 5150 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5151 return -EBUSY;
5152
5153 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 5154 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 5155 if (err < 0)
a654de8f 5156 return err;
20a69341 5157 }
a654de8f
PNA		 5158
5159 if (net->nft.validate_state == NFT_VALIDATE_DO)
5160 return nft_table_validate(net, ctx.table);
5161
5162 return 0;
20a69341
PM		 5163}
5164
59105446
PNA		 5165/**
5166 * nft_data_hold - hold a nft_data item
5167 *
5168 * @data: struct nft_data to release
5169 * @type: type of data
5170 *
5171 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5172 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
5173 * NFT_GOTO verdicts. This function must be called on active data objects
5174 * from the second phase of the commit protocol.
5175 */
bb7b40ae 5176void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
59105446
PNA		 5177{
5178 if (type == NFT_DATA_VERDICT) {
5179 switch (data->verdict.code) {
5180 case NFT_JUMP:
5181 case NFT_GOTO:
5182 data->verdict.chain->use++;
5183 break;
5184 }
5185 }
5186}
5187
5188static void nft_set_elem_activate(const struct net *net,
5189 const struct nft_set *set,
5190 struct nft_set_elem *elem)
5191{
5192 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5193
5194 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5195 nft_data_hold(nft_set_ext_data(ext), set->dtype);
5196 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5197 (*nft_set_ext_obj(ext))->use++;
5198}
5199
5200static void nft_set_elem_deactivate(const struct net *net,
5201 const struct nft_set *set,
5202 struct nft_set_elem *elem)
5203{
5204 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5205
5206 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5207 nft_data_release(nft_set_ext_data(ext), set->dtype);
5208 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5209 (*nft_set_ext_obj(ext))->use--;
5210}
5211
60319eb1 5212static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 5213 const struct nlattr *attr)
5214{
5215 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 5216 struct nft_set_ext_tmpl tmpl;
20a69341 5217 struct nft_set_elem elem;
3971ca14 5218 struct nft_set_ext *ext;
60319eb1 5219 struct nft_trans *trans;
3971ca14
PNA		 5220 u32 flags = 0;
5221 void *priv;
20a69341
PM		 5222 int err;
5223
8cb08174
JB		 5224 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5225 nft_set_elem_policy, NULL);
20a69341 5226 if (err < 0)
20a1452c 5227 return err;
20a69341 5228
20a69341 5229 if (nla[NFTA_SET_ELEM_KEY] == NULL)
20a1452c 5230 return -EINVAL;
20a69341 5231
3971ca14
PNA		 5232 nft_set_ext_prepare(&tmpl);
5233
5234 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5235 if (err < 0)
5236 return err;
5237 if (flags != 0)
5238 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5239
20a1452c
PNA		 5240 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5241 nla[NFTA_SET_ELEM_KEY]);
20a69341 5242 if (err < 0)
20a1452c 5243 return err;
20a69341 5244
20a1452c 5245 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
3971ca14 5246
7b225d0b
PNA		 5247 if (nla[NFTA_SET_ELEM_KEY_END]) {
5248 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5249 nla[NFTA_SET_ELEM_KEY_END]);
5250 if (err < 0)
5251 return err;
5252
5253 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5254 }
5255
3971ca14 5256 err = -ENOMEM;
7b225d0b
PNA		 5257 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5258 elem.key_end.val.data, NULL, 0, 0,
5259 GFP_KERNEL);
3971ca14 5260 if (elem.priv == NULL)
20a1452c 5261 goto fail_elem;
3971ca14
PNA		 5262
5263 ext = nft_set_elem_ext(set, elem.priv);
5264 if (flags)
5265 *nft_set_ext_flags(ext) = flags;
5266
60319eb1 5267 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
20a1452c
PNA		 5268 if (trans == NULL)
5269 goto fail_trans;
20a69341 5270
42a55769 5271 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 5272 if (priv == NULL) {
cc02e457 5273 err = -ENOENT;
20a1452c 5274 goto fail_ops;
cc02e457 5275 }
3971ca14
PNA		 5276 kfree(elem.priv);
5277 elem.priv = priv;
cc02e457 5278
59105446
PNA		 5279 nft_set_elem_deactivate(ctx->net, set, &elem);
5280
60319eb1 5281 nft_trans_elem(trans) = elem;
46bbafce 5282 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 5283 return 0;
cc02e457 5284
20a1452c 5285fail_ops:
cc02e457 5286 kfree(trans);
20a1452c 5287fail_trans:
3971ca14 5288 kfree(elem.priv);
20a1452c
PNA		 5289fail_elem:
5290 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
20a69341
PM		 5291 return err;
5292}
5293
8411b644 5294static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 5295 struct nft_set *set,
8411b644 5296 const struct nft_set_iter *iter,
de70185d 5297 struct nft_set_elem *elem)
8411b644
PNA		 5298{
5299 struct nft_trans *trans;
5300 int err;
5301
5302 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
5303 sizeof(struct nft_trans_elem), GFP_ATOMIC);
5304 if (!trans)
5305 return -ENOMEM;
5306
1ba1c414 5307 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 5308 err = -ENOENT;
5309 goto err1;
5310 }
b2c11e4b 5311 set->ndeact++;
8411b644 5312
7acfda53 5313 nft_set_elem_deactivate(ctx->net, set, elem);
de70185d
PNA		 5314 nft_trans_elem_set(trans) = set;
5315 nft_trans_elem(trans) = *elem;
8411b644
PNA		 5316 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5317
5318 return 0;
5319err1:
5320 kfree(trans);
5321 return err;
5322}
5323
633c9a84
PNA		 5324static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
5325 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5326 const struct nlattr * const nla[],
5327 struct netlink_ext_ack *extack)
20a69341 5328{
f2a6d766 5329 u8 genmask = nft_genmask_next(net);
20a69341
PM		 5330 const struct nlattr *attr;
5331 struct nft_set *set;
5332 struct nft_ctx ctx;
60319eb1 5333 int rem, err = 0;
20a69341 5334
36dd1bcc
PNA		 5335 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5336 genmask);
20a69341
PM		 5337 if (err < 0)
5338 return err;
5339
cac20fcd 5340 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 5341 if (IS_ERR(set))
5342 return PTR_ERR(set);
5343 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5344 return -EBUSY;
5345
8411b644 5346 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 5347 struct nft_set_iter iter = {
5348 .genmask = genmask,
5349 .fn = nft_flush_set,
8411b644 5350 };
baa2d42c 5351 set->ops->walk(&ctx, set, &iter);
8411b644 5352
baa2d42c 5353 return iter.err;
8411b644
PNA		 5354 }
5355
20a69341
PM		 5356 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5357 err = nft_del_setelem(&ctx, set, attr);
5358 if (err < 0)
60319eb1 5359 break;
4fefee57 5360
3dd0673a 5361 set->ndeact++;
20a69341 5362 }
60319eb1 5363 return err;
20a69341
PM		 5364}
5365
cfed7e1b
PM		 5366void nft_set_gc_batch_release(struct rcu_head *rcu)
5367{
5368 struct nft_set_gc_batch *gcb;
5369 unsigned int i;
5370
5371 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
5372 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 5373 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 5374 kfree(gcb);
5375}
cfed7e1b
PM		 5376
5377struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
5378 gfp_t gfp)
5379{
5380 struct nft_set_gc_batch *gcb;
5381
5382 gcb = kzalloc(sizeof(*gcb), gfp);
5383 if (gcb == NULL)
5384 return gcb;
5385 gcb->head.set = set;
5386 return gcb;
5387}
cfed7e1b 5388
e5009240
PNA		 5389/*
5390 * Stateful objects
5391 */
5392
5393/**
5394 * nft_register_obj- register nf_tables stateful object type
5395 * @obj: object type
5396 *
5397 * Registers the object type for use with nf_tables. Returns zero on
5398 * success or a negative errno code otherwise.
5399 */
5400int nft_register_obj(struct nft_object_type *obj_type)
5401{
5402 if (obj_type->type == NFT_OBJECT_UNSPEC)
5403 return -EINVAL;
5404
5405 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5406 list_add_rcu(&obj_type->list, &nf_tables_objects);
5407 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5408 return 0;
5409}
5410EXPORT_SYMBOL_GPL(nft_register_obj);
5411
5412/**
5413 * nft_unregister_obj - unregister nf_tables object type
5414 * @obj: object type
5415 *
5416 * Unregisters the object type for use with nf_tables.
5417 */
5418void nft_unregister_obj(struct nft_object_type *obj_type)
5419{
5420 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5421 list_del_rcu(&obj_type->list);
5422 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5423}
5424EXPORT_SYMBOL_GPL(nft_unregister_obj);
5425
4d44175a
FW		 5426struct nft_object *nft_obj_lookup(const struct net *net,
5427 const struct nft_table *table,
cac20fcd
PNA		 5428 const struct nlattr *nla, u32 objtype,
5429 u8 genmask)
e5009240 5430{
4d44175a
FW		 5431 struct nft_object_hash_key k = { .table = table };
5432 char search[NFT_OBJ_MAXNAMELEN];
5433 struct rhlist_head *tmp, *list;
e5009240
PNA		 5434 struct nft_object *obj;
5435
4d44175a
FW		 5436 nla_strlcpy(search, nla, sizeof(search));
5437 k.name = search;
5438
5439 WARN_ON_ONCE(!rcu_read_lock_held() &&
5440 !lockdep_commit_lock_is_held(net));
5441
5442 rcu_read_lock();
5443 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
5444 if (!list)
5445 goto out;
5446
5447 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
5448 if (objtype == obj->ops->type->type &&
5449 nft_active_genmask(obj, genmask)) {
5450 rcu_read_unlock();
e5009240 5451 return obj;
4d44175a 5452 }
e5009240 5453 }
4d44175a
FW		 5454out:
5455 rcu_read_unlock();
e5009240
PNA		 5456 return ERR_PTR(-ENOENT);
5457}
cac20fcd 5458EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 5459
cac20fcd
PNA		 5460static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
5461 const struct nlattr *nla,
5462 u32 objtype, u8 genmask)
3ecbfd65
HS		 5463{
5464 struct nft_object *obj;
5465
5466 list_for_each_entry(obj, &table->objects, list) {
5467 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
5468 objtype == obj->ops->type->type &&
5469 nft_active_genmask(obj, genmask))
5470 return obj;
5471 }
5472 return ERR_PTR(-ENOENT);
5473}
5474
e5009240 5475static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 5476 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
5477 .len = NFT_TABLE_MAXNAMELEN - 1 },
5478 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
5479 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 5480 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
5481 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 5482 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 5483};
5484
84fba055
FW		 5485static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
5486 const struct nft_object_type *type,
e5009240
PNA		 5487 const struct nlattr *attr)
5488{
5b4c6e38 5489 struct nlattr **tb;
dfc46034 5490 const struct nft_object_ops *ops;
e5009240 5491 struct nft_object *obj;
5b4c6e38
GS		 5492 int err = -ENOMEM;
5493
5494 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
5495 if (!tb)
5496 goto err1;
e5009240
PNA		 5497
5498 if (attr) {
8cb08174
JB		 5499 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
5500 type->policy, NULL);
e5009240 5501 if (err < 0)
5b4c6e38 5502 goto err2;
e5009240
PNA		 5503 } else {
5504 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
5505 }
5506
dfc46034
PBG		 5507 if (type->select_ops) {
5508 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
5509 if (IS_ERR(ops)) {
5510 err = PTR_ERR(ops);
5b4c6e38 5511 goto err2;
dfc46034
PBG		 5512 }
5513 } else {
5514 ops = type->ops;
5515 }
5516
e5009240 5517 err = -ENOMEM;
dfc46034 5518 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 5519 if (!obj)
5520 goto err2;
e5009240 5521
dfc46034 5522 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 5523 if (err < 0)
5b4c6e38 5524 goto err3;
e5009240 5525
dfc46034
PBG		 5526 obj->ops = ops;
5527
5b4c6e38 5528 kfree(tb);
e5009240 5529 return obj;
5b4c6e38 5530err3:
e5009240 5531 kfree(obj);
5b4c6e38
GS		 5532err2:
5533 kfree(tb);
e5009240
PNA		 5534err1:
5535 return ERR_PTR(err);
5536}
5537
5538static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 5539 struct nft_object *obj, bool reset)
e5009240
PNA		 5540{
5541 struct nlattr *nest;
5542
ae0be8de 5543 nest = nla_nest_start_noflag(skb, attr);
e5009240
PNA		 5544 if (!nest)
5545 goto nla_put_failure;
dfc46034 5546 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 5547 goto nla_put_failure;
5548 nla_nest_end(skb, nest);
5549 return 0;
5550
5551nla_put_failure:
5552 return -1;
5553}
5554
5555static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5556{
5557 const struct nft_object_type *type;
5558
5559 list_for_each_entry(type, &nf_tables_objects, list) {
5560 if (objtype == type->type)
5561 return type;
5562 }
5563 return NULL;
5564}
5565
452238e8
FW		 5566static const struct nft_object_type *
5567nft_obj_type_get(struct net *net, u32 objtype)
e5009240
PNA		 5568{
5569 const struct nft_object_type *type;
5570
5571 type = __nft_obj_type_get(objtype);
5572 if (type != NULL && try_module_get(type->owner))
5573 return type;
5574
f102d66b 5575 lockdep_nfnl_nft_mutex_not_held();
e5009240
PNA		 5576#ifdef CONFIG_MODULES
5577 if (type == NULL) {
eb014de4 5578 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
e5009240
PNA		 5579 return ERR_PTR(-EAGAIN);
5580 }
5581#endif
5582 return ERR_PTR(-ENOENT);
5583}
5584
d62d0ba9
FFM		 5585static int nf_tables_updobj(const struct nft_ctx *ctx,
5586 const struct nft_object_type *type,
5587 const struct nlattr *attr,
5588 struct nft_object *obj)
5589{
5590 struct nft_object *newobj;
5591 struct nft_trans *trans;
5592 int err;
5593
5594 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
5595 sizeof(struct nft_trans_obj));
5596 if (!trans)
5597 return -ENOMEM;
5598
5599 newobj = nft_obj_init(ctx, type, attr);
5600 if (IS_ERR(newobj)) {
5601 err = PTR_ERR(newobj);
b74ae961 5602 goto err_free_trans;
d62d0ba9
FFM		 5603 }
5604
5605 nft_trans_obj(trans) = obj;
5606 nft_trans_obj_update(trans) = true;
5607 nft_trans_obj_newobj(trans) = newobj;
5608 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5609
5610 return 0;
b74ae961
DC		 5611
5612err_free_trans:
d62d0ba9 5613 kfree(trans);
d62d0ba9
FFM		 5614 return err;
5615}
5616
e5009240
PNA		 5617static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5618 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5619 const struct nlattr * const nla[],
5620 struct netlink_ext_ack *extack)
e5009240
PNA		 5621{
5622 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5623 const struct nft_object_type *type;
5624 u8 genmask = nft_genmask_next(net);
5625 int family = nfmsg->nfgen_family;
e5009240
PNA		 5626 struct nft_table *table;
5627 struct nft_object *obj;
5628 struct nft_ctx ctx;
5629 u32 objtype;
5630 int err;
5631
5632 if (!nla[NFTA_OBJ_TYPE] ||
5633 !nla[NFTA_OBJ_NAME] ||
5634 !nla[NFTA_OBJ_DATA])
5635 return -EINVAL;
5636
cac20fcd 5637 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5638 if (IS_ERR(table)) {
5639 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5640 return PTR_ERR(table);
36dd1bcc 5641 }
e5009240
PNA		 5642
5643 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5644 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 5645 if (IS_ERR(obj)) {
5646 err = PTR_ERR(obj);
36dd1bcc
PNA		 5647 if (err != -ENOENT) {
5648 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5649 return err;
36dd1bcc 5650 }
1a28ad74 5651 } else {
36dd1bcc
PNA		 5652 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5653 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5654 return -EEXIST;
36dd1bcc 5655 }
d62d0ba9
FFM		 5656 if (nlh->nlmsg_flags & NLM_F_REPLACE)
5657 return -EOPNOTSUPP;
5658
fd57d0cb 5659 type = __nft_obj_type_get(objtype);
d62d0ba9
FFM		 5660 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5661
5662 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
e5009240
PNA		 5663 }
5664
98319cb9 5665 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240 5666
452238e8 5667 type = nft_obj_type_get(net, objtype);
e5009240
PNA		 5668 if (IS_ERR(type))
5669 return PTR_ERR(type);
5670
84fba055 5671 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 5672 if (IS_ERR(obj)) {
5673 err = PTR_ERR(obj);
5674 goto err1;
5675 }
d152159b 5676 obj->key.table = table;
3ecbfd65
HS		 5677 obj->handle = nf_tables_alloc_handle(table);
5678
d152159b
FW		 5679 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5680 if (!obj->key.name) {
61509575
PS		 5681 err = -ENOMEM;
5682 goto err2;
5683 }
e5009240
PNA		 5684
5685 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5686 if (err < 0)
61509575 5687 goto err3;
e5009240 5688
4d44175a
FW		 5689 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
5690 nft_objname_ht_params);
5691 if (err < 0)
5692 goto err4;
5693
e5009240
PNA		 5694 list_add_tail_rcu(&obj->list, &table->objects);
5695 table->use++;
5696 return 0;
4d44175a
FW		 5697err4:
5698 /* queued in transaction log */
5699 INIT_LIST_HEAD(&obj->list);
5700 return err;
61509575 5701err3:
d152159b 5702 kfree(obj->key.name);
e5009240 5703err2:
dfc46034 5704 if (obj->ops->destroy)
00bfb320 5705 obj->ops->destroy(&ctx, obj);
e5009240
PNA		 5706 kfree(obj);
5707err1:
5708 module_put(type->owner);
5709 return err;
5710}
5711
5712static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5713 u32 portid, u32 seq, int event, u32 flags,
5714 int family, const struct nft_table *table,
43da04a5 5715 struct nft_object *obj, bool reset)
e5009240
PNA		 5716{
5717 struct nfgenmsg *nfmsg;
5718 struct nlmsghdr *nlh;
5719
dedb67c4 5720 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 5721 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5722 if (nlh == NULL)
5723 goto nla_put_failure;
5724
5725 nfmsg = nlmsg_data(nlh);
5726 nfmsg->nfgen_family = family;
5727 nfmsg->version = NFNETLINK_V0;
5728 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5729
5730 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
d152159b 5731 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
dfc46034 5732 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 5733 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 5734 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5735 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5736 NFTA_OBJ_PAD))
e5009240
PNA		 5737 goto nla_put_failure;
5738
5739 nlmsg_end(skb, nlh);
5740 return 0;
5741
5742nla_put_failure:
5743 nlmsg_trim(skb, nlh);
5744 return -1;
5745}
5746
a9fea2a3 5747struct nft_obj_filter {
e46abbcc 5748 char *table;
a9fea2a3
PNA		 5749 u32 type;
5750};
5751
e5009240
PNA		 5752static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
5753{
5754 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 5755 const struct nft_table *table;
e5009240 5756 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 5757 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 5758 struct net *net = sock_net(skb->sk);
5759 int family = nfmsg->nfgen_family;
43da04a5
PNA		 5760 struct nft_object *obj;
5761 bool reset = false;
5762
5763 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5764 reset = true;
e5009240
PNA		 5765
5766 rcu_read_lock();
5767 cb->seq = net->nft.base_seq;
5768
36596dad 5769 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5770 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 5771 continue;
5772
36596dad
PNA		 5773 list_for_each_entry_rcu(obj, &table->objects, list) {
5774 if (!nft_is_active(net, obj))
5775 goto cont;
5776 if (idx < s_idx)
5777 goto cont;
5778 if (idx > s_idx)
5779 memset(&cb->args[1], 0,
5780 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5781 if (filter && filter->table &&
36596dad
PNA		 5782 strcmp(filter->table, table->name))
5783 goto cont;
5784 if (filter &&
5785 filter->type != NFT_OBJECT_UNSPEC &&
5786 obj->ops->type->type != filter->type)
5787 goto cont;
a9fea2a3 5788
36596dad
PNA		 5789 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
5790 cb->nlh->nlmsg_seq,
5791 NFT_MSG_NEWOBJ,
5792 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5793 table->family, table,
36596dad
PNA		 5794 obj, reset) < 0)
5795 goto done;
e5009240 5796
36596dad 5797 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 5798cont:
36596dad 5799 idx++;
e5009240
PNA		 5800 }
5801 }
5802done:
5803 rcu_read_unlock();
5804
5805 cb->args[0] = idx;
5806 return skb->len;
5807}
5808
90fd131a 5809static int nf_tables_dump_obj_start(struct netlink_callback *cb)
a9fea2a3 5810{
90fd131a
FW		 5811 const struct nlattr * const *nla = cb->data;
5812 struct nft_obj_filter *filter = NULL;
e46abbcc 5813
90fd131a
FW		 5814 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
5815 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5816 if (!filter)
5817 return -ENOMEM;
5818
5819 if (nla[NFTA_OBJ_TABLE]) {
5820 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
5821 if (!filter->table) {
5822 kfree(filter);
5823 return -ENOMEM;
5824 }
5825 }
5826
5827 if (nla[NFTA_OBJ_TYPE])
5828 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
8bea728d 5829 }
a9fea2a3 5830
90fd131a 5831 cb->data = filter;
a9fea2a3
PNA		 5832 return 0;
5833}
5834
90fd131a 5835static int nf_tables_dump_obj_done(struct netlink_callback *cb)
a9fea2a3 5836{
90fd131a 5837 struct nft_obj_filter *filter = cb->data;
a9fea2a3 5838
90fd131a
FW		 5839 if (filter) {
5840 kfree(filter->table);
5841 kfree(filter);
e46abbcc 5842 }
a9fea2a3 5843
90fd131a 5844 return 0;
a9fea2a3
PNA		 5845}
5846
d9adf22a 5847/* called with rcu_read_lock held */
e5009240
PNA		 5848static int nf_tables_getobj(struct net *net, struct sock *nlsk,
5849 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5850 const struct nlattr * const nla[],
5851 struct netlink_ext_ack *extack)
e5009240
PNA		 5852{
5853 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5854 u8 genmask = nft_genmask_cur(net);
5855 int family = nfmsg->nfgen_family;
e5009240
PNA		 5856 const struct nft_table *table;
5857 struct nft_object *obj;
5858 struct sk_buff *skb2;
43da04a5 5859 bool reset = false;
e5009240
PNA		 5860 u32 objtype;
5861 int err;
5862
5863 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5864 struct netlink_dump_control c = {
90fd131a 5865 .start = nf_tables_dump_obj_start,
e5009240 5866 .dump = nf_tables_dump_obj,
a9fea2a3 5867 .done = nf_tables_dump_obj_done,
d9adf22a 5868 .module = THIS_MODULE,
90fd131a 5869 .data = (void *)nla,
e5009240 5870 };
a9fea2a3 5871
d9adf22a 5872 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
e5009240
PNA		 5873 }
5874
5875 if (!nla[NFTA_OBJ_NAME] ||
5876 !nla[NFTA_OBJ_TYPE])
5877 return -EINVAL;
5878
cac20fcd 5879 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5880 if (IS_ERR(table)) {
5881 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5882 return PTR_ERR(table);
36dd1bcc 5883 }
e5009240
PNA		 5884
5885 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5886 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 5887 if (IS_ERR(obj)) {
5888 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5889 return PTR_ERR(obj);
36dd1bcc 5890 }
e5009240 5891
d9adf22a 5892 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
e5009240
PNA		 5893 if (!skb2)
5894 return -ENOMEM;
5895
43da04a5
PNA		 5896 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5897 reset = true;
5898
e5009240
PNA		 5899 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5900 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 5901 family, table, obj, reset);
e5009240
PNA		 5902 if (err < 0)
5903 goto err;
5904
5905 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5906err:
5907 kfree_skb(skb2);
5908 return err;
e5009240
PNA		 5909}
5910
00bfb320 5911static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
e5009240 5912{
dfc46034 5913 if (obj->ops->destroy)
00bfb320 5914 obj->ops->destroy(ctx, obj);
e5009240 5915
dfc46034 5916 module_put(obj->ops->type->owner);
d152159b 5917 kfree(obj->key.name);
e5009240
PNA		 5918 kfree(obj);
5919}
5920
5921static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 5922 struct sk_buff *skb, const struct nlmsghdr *nlh,
5923 const struct nlattr * const nla[],
5924 struct netlink_ext_ack *extack)
e5009240
PNA		 5925{
5926 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5927 u8 genmask = nft_genmask_next(net);
5928 int family = nfmsg->nfgen_family;
36dd1bcc 5929 const struct nlattr *attr;
e5009240
PNA		 5930 struct nft_table *table;
5931 struct nft_object *obj;
5932 struct nft_ctx ctx;
5933 u32 objtype;
5934
5935 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 5936 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 5937 return -EINVAL;
5938
cac20fcd 5939 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5940 if (IS_ERR(table)) {
5941 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5942 return PTR_ERR(table);
36dd1bcc 5943 }
e5009240
PNA		 5944
5945 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 5946 if (nla[NFTA_OBJ_HANDLE]) {
5947 attr = nla[NFTA_OBJ_HANDLE];
5948 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5949 } else {
5950 attr = nla[NFTA_OBJ_NAME];
4d44175a 5951 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
36dd1bcc
PNA		 5952 }
5953
5954 if (IS_ERR(obj)) {
5955 NL_SET_BAD_ATTR(extack, attr);
e5009240 5956 return PTR_ERR(obj);
36dd1bcc
PNA		 5957 }
5958 if (obj->use > 0) {
5959 NL_SET_BAD_ATTR(extack, attr);
e5009240 5960 return -EBUSY;
36dd1bcc 5961 }
e5009240 5962
98319cb9 5963 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 5964
5965 return nft_delobj(&ctx, obj);
5966}
5967
d152159b 5968void nft_obj_notify(struct net *net, const struct nft_table *table,
25e94a99
PNA		 5969 struct nft_object *obj, u32 portid, u32 seq, int event,
5970 int family, int report, gfp_t gfp)
e5009240
PNA		 5971{
5972 struct sk_buff *skb;
5973 int err;
5974
2599e989
PNA		 5975 if (!report &&
5976 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5977 return;
e5009240 5978
2599e989 5979 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 5980 if (skb == NULL)
5981 goto err;
5982
2599e989
PNA		 5983 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5984 table, obj, false);
e5009240
PNA		 5985 if (err < 0) {
5986 kfree_skb(skb);
5987 goto err;
5988 }
5989
25e94a99
PNA		 5990 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5991 return;
e5009240 5992err:
25e94a99 5993 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 5994}
2599e989
PNA		 5995EXPORT_SYMBOL_GPL(nft_obj_notify);
5996
25e94a99
PNA		 5997static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5998 struct nft_object *obj, int event)
2599e989 5999{
25e94a99 6000 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 6001 ctx->family, ctx->report, GFP_KERNEL);
2599e989 6002}
e5009240 6003
3b49e2e9
PNA		 6004/*
6005 * Flow tables
6006 */
6007void nft_register_flowtable_type(struct nf_flowtable_type *type)
6008{
6009 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6010 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
6011 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6012}
6013EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
6014
6015void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
6016{
6017 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6018 list_del_rcu(&type->list);
6019 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6020}
6021EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
6022
6023static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
6024 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
6025 .len = NFT_NAME_MAXLEN - 1 },
6026 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
6027 .len = NFT_NAME_MAXLEN - 1 },
6028 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 6029 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
8bb69f3b 6030 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 },
3b49e2e9
PNA		 6031};
6032
cac20fcd
PNA		 6033struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
6034 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 6035{
6036 struct nft_flowtable *flowtable;
6037
d9adf22a 6038 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
3b49e2e9
PNA		 6039 if (!nla_strcmp(nla, flowtable->name) &&
6040 nft_active_genmask(flowtable, genmask))
6041 return flowtable;
6042 }
6043 return ERR_PTR(-ENOENT);
6044}
cac20fcd 6045EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 6046
9b05b6e1
LGL		 6047void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
6048 struct nft_flowtable *flowtable,
6049 enum nft_trans_phase phase)
6050{
6051 switch (phase) {
6052 case NFT_TRANS_PREPARE:
6053 case NFT_TRANS_ABORT:
6054 case NFT_TRANS_RELEASE:
6055 flowtable->use--;
6056 /* fall through */
6057 default:
6058 return;
6059 }
6060}
6061EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
6062
ae0662f8 6063static struct nft_flowtable *
cac20fcd
PNA		 6064nft_flowtable_lookup_byhandle(const struct nft_table *table,
6065 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 6066{
6067 struct nft_flowtable *flowtable;
6068
6069 list_for_each_entry(flowtable, &table->flowtables, list) {
6070 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
6071 nft_active_genmask(flowtable, genmask))
6072 return flowtable;
6073 }
6074 return ERR_PTR(-ENOENT);
6075}
6076
3b49e2e9
PNA		 6077static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
6078 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
6079 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
6080 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
6081};
6082
6083static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
6084 const struct nlattr *attr,
6085 struct nft_flowtable *flowtable)
6086{
3b49e2e9 6087 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
3f0465a9 6088 struct nft_hook *hook;
3b49e2e9 6089 int hooknum, priority;
3f0465a9 6090 int err;
3b49e2e9 6091
8cb08174
JB		 6092 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
6093 nft_flowtable_hook_policy, NULL);
3b49e2e9
PNA		 6094 if (err < 0)
6095 return err;
6096
6097 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
6098 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
6099 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
6100 return -EINVAL;
6101
6102 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 6103 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 6104 return -EINVAL;
6105
6106 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6107
3f0465a9
PNA		 6108 err = nf_tables_parse_netdev_hooks(ctx->net,
6109 tb[NFTA_FLOWTABLE_HOOK_DEVS],
6110 &flowtable->hook_list);
3b49e2e9 6111 if (err < 0)
d92191aa 6112 return err;
3b49e2e9 6113
71a8a63b
PNA		 6114 flowtable->hooknum = hooknum;
6115 flowtable->data.priority = priority;
3b49e2e9 6116
3f0465a9
PNA		 6117 list_for_each_entry(hook, &flowtable->hook_list, list) {
6118 hook->ops.pf = NFPROTO_NETDEV;
6119 hook->ops.hooknum = hooknum;
6120 hook->ops.priority = priority;
6121 hook->ops.priv = &flowtable->data;
6122 hook->ops.hook = flowtable->data.type->hook;
3b49e2e9
PNA		 6123 }
6124
3b49e2e9
PNA		 6125 return err;
6126}
6127
98319cb9 6128static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 6129{
6130 const struct nf_flowtable_type *type;
6131
6132 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 6133 if (family == type->family)
3b49e2e9
PNA		 6134 return type;
6135 }
6136 return NULL;
6137}
6138
452238e8
FW		 6139static const struct nf_flowtable_type *
6140nft_flowtable_type_get(struct net *net, u8 family)
3b49e2e9
PNA		 6141{
6142 const struct nf_flowtable_type *type;
6143
98319cb9 6144 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 6145 if (type != NULL && try_module_get(type->owner))
6146 return type;
6147
f102d66b 6148 lockdep_nfnl_nft_mutex_not_held();
3b49e2e9
PNA		 6149#ifdef CONFIG_MODULES
6150 if (type == NULL) {
eb014de4 6151 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
3b49e2e9
PNA		 6152 return ERR_PTR(-EAGAIN);
6153 }
6154#endif
6155 return ERR_PTR(-ENOENT);
6156}
6157
5acab914 6158/* Only called from error and netdev event paths. */
ff4bf2f4
PNA		 6159static void nft_unregister_flowtable_hook(struct net *net,
6160 struct nft_flowtable *flowtable,
6161 struct nft_hook *hook)
6162{
6163 nf_unregister_net_hook(net, &hook->ops);
6164 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
6165 FLOW_BLOCK_UNBIND);
6166}
6167
3b49e2e9
PNA		 6168static void nft_unregister_flowtable_net_hooks(struct net *net,
6169 struct nft_flowtable *flowtable)
6170{
3f0465a9 6171 struct nft_hook *hook;
3b49e2e9 6172
ff4bf2f4 6173 list_for_each_entry(hook, &flowtable->hook_list, list)
5acab914 6174 nf_unregister_net_hook(net, &hook->ops);
3f0465a9
PNA		 6175}
6176
6177static int nft_register_flowtable_net_hooks(struct net *net,
6178 struct nft_table *table,
6179 struct nft_flowtable *flowtable)
6180{
6181 struct nft_hook *hook, *hook2, *next;
6182 struct nft_flowtable *ft;
6183 int err, i = 0;
6184
6185 list_for_each_entry(hook, &flowtable->hook_list, list) {
6186 list_for_each_entry(ft, &table->flowtables, list) {
6187 list_for_each_entry(hook2, &ft->hook_list, list) {
6188 if (hook->ops.dev == hook2->ops.dev &&
6189 hook->ops.pf == hook2->ops.pf) {
6190 err = -EBUSY;
6191 goto err_unregister_net_hooks;
6192 }
6193 }
6194 }
3b49e2e9 6195
d7c03a9f 6196 err = flowtable->data.type->setup(&flowtable->data,
6197 hook->ops.dev,
6198 FLOW_BLOCK_BIND);
3f0465a9
PNA		 6199 if (err < 0)
6200 goto err_unregister_net_hooks;
6201
d7c03a9f 6202 err = nf_register_net_hook(net, &hook->ops);
6203 if (err < 0) {
6204 flowtable->data.type->setup(&flowtable->data,
6205 hook->ops.dev,
6206 FLOW_BLOCK_UNBIND);
6207 goto err_unregister_net_hooks;
6208 }
6209
3f0465a9 6210 i++;
3b49e2e9 6211 }
3f0465a9
PNA		 6212
6213 return 0;
6214
6215err_unregister_net_hooks:
6216 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
6217 if (i-- <= 0)
6218 break;
6219
ff4bf2f4 6220 nft_unregister_flowtable_hook(net, flowtable, hook);
3f0465a9
PNA		 6221 list_del_rcu(&hook->list);
6222 kfree_rcu(hook, rcu);
6223 }
6224
6225 return err;
3b49e2e9
PNA		 6226}
6227
6228static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
6229 struct sk_buff *skb,
6230 const struct nlmsghdr *nlh,
6231 const struct nlattr * const nla[],
6232 struct netlink_ext_ack *extack)
6233{
6234 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6235 const struct nf_flowtable_type *type;
6236 u8 genmask = nft_genmask_next(net);
6237 int family = nfmsg->nfgen_family;
3f0465a9
PNA		 6238 struct nft_flowtable *flowtable;
6239 struct nft_hook *hook, *next;
3b49e2e9
PNA		 6240 struct nft_table *table;
6241 struct nft_ctx ctx;
3f0465a9 6242 int err;
3b49e2e9
PNA		 6243
6244 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6245 !nla[NFTA_FLOWTABLE_NAME] ||
6246 !nla[NFTA_FLOWTABLE_HOOK])
6247 return -EINVAL;
6248
cac20fcd
PNA		 6249 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6250 genmask);
36dd1bcc
PNA		 6251 if (IS_ERR(table)) {
6252 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 6253 return PTR_ERR(table);
36dd1bcc 6254 }
3b49e2e9 6255
cac20fcd
PNA		 6256 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6257 genmask);
3b49e2e9
PNA		 6258 if (IS_ERR(flowtable)) {
6259 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 6260 if (err != -ENOENT) {
6261 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 6262 return err;
36dd1bcc 6263 }
3b49e2e9 6264 } else {
36dd1bcc
PNA		 6265 if (nlh->nlmsg_flags & NLM_F_EXCL) {
6266 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 6267 return -EEXIST;
36dd1bcc 6268 }
3b49e2e9
PNA		 6269
6270 return 0;
6271 }
6272
98319cb9 6273 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 6274
6275 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
6276 if (!flowtable)
6277 return -ENOMEM;
6278
6279 flowtable->table = table;
3ecbfd65 6280 flowtable->handle = nf_tables_alloc_handle(table);
3f0465a9 6281 INIT_LIST_HEAD(&flowtable->hook_list);
3ecbfd65 6282
3b49e2e9
PNA		 6283 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
6284 if (!flowtable->name) {
6285 err = -ENOMEM;
6286 goto err1;
6287 }
6288
452238e8 6289 type = nft_flowtable_type_get(net, family);
3b49e2e9
PNA		 6290 if (IS_ERR(type)) {
6291 err = PTR_ERR(type);
6292 goto err2;
6293 }
6294
8bb69f3b
PNA		 6295 if (nla[NFTA_FLOWTABLE_FLAGS]) {
6296 flowtable->data.flags =
6297 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
6298 if (flowtable->data.flags & ~NF_FLOWTABLE_HW_OFFLOAD)
6299 goto err3;
6300 }
6301
6302 write_pnet(&flowtable->data.net, net);
3b49e2e9 6303 flowtable->data.type = type;
a268de77 6304 err = type->init(&flowtable->data);
3b49e2e9
PNA		 6305 if (err < 0)
6306 goto err3;
6307
6308 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
6309 flowtable);
6310 if (err < 0)
a268de77 6311 goto err4;
3b49e2e9 6312
3f0465a9 6313 err = nft_register_flowtable_net_hooks(ctx.net, table, flowtable);
2d285f26
FW		 6314 if (err < 0) {
6315 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
6316 list_del_rcu(&hook->list);
6317 kfree_rcu(hook, rcu);
6318 }
3f0465a9 6319 goto err4;
2d285f26 6320 }
3b49e2e9
PNA		 6321
6322 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
6323 if (err < 0)
3f0465a9 6324 goto err5;
3b49e2e9
PNA		 6325
6326 list_add_tail_rcu(&flowtable->list, &table->flowtables);
6327 table->use++;
6328
6329 return 0;
a268de77 6330err5:
3f0465a9 6331 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
ff4bf2f4 6332 nft_unregister_flowtable_hook(net, flowtable, hook);
3f0465a9
PNA		 6333 list_del_rcu(&hook->list);
6334 kfree_rcu(hook, rcu);
6335 }
a268de77
FF		 6336err4:
6337 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 6338err3:
6339 module_put(type->owner);
6340err2:
6341 kfree(flowtable->name);
6342err1:
6343 kfree(flowtable);
6344 return err;
6345}
6346
6347static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
6348 struct sk_buff *skb,
6349 const struct nlmsghdr *nlh,
6350 const struct nlattr * const nla[],
6351 struct netlink_ext_ack *extack)
6352{
6353 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6354 u8 genmask = nft_genmask_next(net);
6355 int family = nfmsg->nfgen_family;
6356 struct nft_flowtable *flowtable;
36dd1bcc 6357 const struct nlattr *attr;
3b49e2e9
PNA		 6358 struct nft_table *table;
6359 struct nft_ctx ctx;
6360
e603ea4b
PNA		 6361 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6362 (!nla[NFTA_FLOWTABLE_NAME] &&
6363 !nla[NFTA_FLOWTABLE_HANDLE]))
6364 return -EINVAL;
6365
cac20fcd
PNA		 6366 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6367 genmask);
36dd1bcc
PNA		 6368 if (IS_ERR(table)) {
6369 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 6370 return PTR_ERR(table);
36dd1bcc 6371 }
3b49e2e9 6372
36dd1bcc
PNA		 6373 if (nla[NFTA_FLOWTABLE_HANDLE]) {
6374 attr = nla[NFTA_FLOWTABLE_HANDLE];
6375 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
6376 } else {
6377 attr = nla[NFTA_FLOWTABLE_NAME];
6378 flowtable = nft_flowtable_lookup(table, attr, genmask);
6379 }
6380
6381 if (IS_ERR(flowtable)) {
6382 NL_SET_BAD_ATTR(extack, attr);
6383 return PTR_ERR(flowtable);
6384 }
6385 if (flowtable->use > 0) {
6386 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 6387 return -EBUSY;
36dd1bcc 6388 }
3b49e2e9 6389
98319cb9 6390 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 6391
6392 return nft_delflowtable(&ctx, flowtable);
6393}
6394
6395static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
6396 u32 portid, u32 seq, int event,
6397 u32 flags, int family,
6398 struct nft_flowtable *flowtable)
6399{
6400 struct nlattr *nest, *nest_devs;
6401 struct nfgenmsg *nfmsg;
3f0465a9 6402 struct nft_hook *hook;
3b49e2e9 6403 struct nlmsghdr *nlh;
3b49e2e9
PNA		 6404
6405 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6406 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
6407 if (nlh == NULL)
6408 goto nla_put_failure;
6409
6410 nfmsg = nlmsg_data(nlh);
6411 nfmsg->nfgen_family = family;
6412 nfmsg->version = NFNETLINK_V0;
6413 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
6414
6415 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
6416 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 6417 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
6418 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
8bb69f3b
PNA		 6419 NFTA_FLOWTABLE_PAD) ||
6420 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags)))
3b49e2e9
PNA		 6421 goto nla_put_failure;
6422
ae0be8de 6423 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
eb895086
KL		 6424 if (!nest)
6425 goto nla_put_failure;
3b49e2e9 6426 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
71a8a63b 6427 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority)))
3b49e2e9
PNA		 6428 goto nla_put_failure;
6429
ae0be8de 6430 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
3b49e2e9
PNA		 6431 if (!nest_devs)
6432 goto nla_put_failure;
6433
3f0465a9
PNA		 6434 list_for_each_entry_rcu(hook, &flowtable->hook_list, list) {
6435 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))
3b49e2e9
PNA		 6436 goto nla_put_failure;
6437 }
6438 nla_nest_end(skb, nest_devs);
6439 nla_nest_end(skb, nest);
6440
6441 nlmsg_end(skb, nlh);
6442 return 0;
6443
6444nla_put_failure:
6445 nlmsg_trim(skb, nlh);
6446 return -1;
6447}
6448
6449struct nft_flowtable_filter {
6450 char *table;
6451};
6452
6453static int nf_tables_dump_flowtable(struct sk_buff *skb,
6454 struct netlink_callback *cb)
6455{
6456 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6457 struct nft_flowtable_filter *filter = cb->data;
6458 unsigned int idx = 0, s_idx = cb->args[0];
6459 struct net *net = sock_net(skb->sk);
6460 int family = nfmsg->nfgen_family;
6461 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 6462 const struct nft_table *table;
6463
6464 rcu_read_lock();
6465 cb->seq = net->nft.base_seq;
6466
36596dad 6467 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 6468 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 6469 continue;
6470
36596dad
PNA		 6471 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6472 if (!nft_is_active(net, flowtable))
6473 goto cont;
6474 if (idx < s_idx)
6475 goto cont;
6476 if (idx > s_idx)
6477 memset(&cb->args[1], 0,
6478 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 6479 if (filter && filter->table &&
36596dad
PNA		 6480 strcmp(filter->table, table->name))
6481 goto cont;
3b49e2e9 6482
36596dad
PNA		 6483 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
6484 cb->nlh->nlmsg_seq,
6485 NFT_MSG_NEWFLOWTABLE,
6486 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 6487 table->family, flowtable) < 0)
36596dad 6488 goto done;
3b49e2e9 6489
36596dad 6490 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 6491cont:
36596dad 6492 idx++;
3b49e2e9
PNA		 6493 }
6494 }
6495done:
6496 rcu_read_unlock();
6497
6498 cb->args[0] = idx;
6499 return skb->len;
6500}
6501
90fd131a 6502static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
3b49e2e9 6503{
90fd131a
FW		 6504 const struct nlattr * const *nla = cb->data;
6505 struct nft_flowtable_filter *filter = NULL;
3b49e2e9 6506
90fd131a
FW		 6507 if (nla[NFTA_FLOWTABLE_TABLE]) {
6508 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6509 if (!filter)
6510 return -ENOMEM;
3b49e2e9 6511
90fd131a
FW		 6512 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
6513 GFP_ATOMIC);
6514 if (!filter->table) {
6515 kfree(filter);
6516 return -ENOMEM;
6517 }
6518 }
3b49e2e9 6519
90fd131a 6520 cb->data = filter;
3b49e2e9
PNA		 6521 return 0;
6522}
6523
90fd131a 6524static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
3b49e2e9 6525{
90fd131a 6526 struct nft_flowtable_filter *filter = cb->data;
3b49e2e9 6527
3b49e2e9 6528 if (!filter)
90fd131a 6529 return 0;
3b49e2e9 6530
90fd131a
FW		 6531 kfree(filter->table);
6532 kfree(filter);
6533
6534 return 0;
3b49e2e9
PNA		 6535}
6536
d9adf22a 6537/* called with rcu_read_lock held */
3b49e2e9
PNA		 6538static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
6539 struct sk_buff *skb,
6540 const struct nlmsghdr *nlh,
6541 const struct nlattr * const nla[],
6542 struct netlink_ext_ack *extack)
6543{
6544 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6545 u8 genmask = nft_genmask_cur(net);
6546 int family = nfmsg->nfgen_family;
6547 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 6548 const struct nft_table *table;
6549 struct sk_buff *skb2;
6550 int err;
6551
6552 if (nlh->nlmsg_flags & NLM_F_DUMP) {
6553 struct netlink_dump_control c = {
90fd131a 6554 .start = nf_tables_dump_flowtable_start,
3b49e2e9
PNA		 6555 .dump = nf_tables_dump_flowtable,
6556 .done = nf_tables_dump_flowtable_done,
d9adf22a 6557 .module = THIS_MODULE,
90fd131a 6558 .data = (void *)nla,
3b49e2e9
PNA		 6559 };
6560
d9adf22a 6561 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3b49e2e9
PNA		 6562 }
6563
6564 if (!nla[NFTA_FLOWTABLE_NAME])
6565 return -EINVAL;
6566
cac20fcd
PNA		 6567 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6568 genmask);
3b49e2e9
PNA		 6569 if (IS_ERR(table))
6570 return PTR_ERR(table);
6571
cac20fcd
PNA		 6572 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6573 genmask);
03a0120f 6574 if (IS_ERR(flowtable))
3b49e2e9
PNA		 6575 return PTR_ERR(flowtable);
6576
d9adf22a 6577 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3b49e2e9
PNA		 6578 if (!skb2)
6579 return -ENOMEM;
6580
6581 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
6582 nlh->nlmsg_seq,
6583 NFT_MSG_NEWFLOWTABLE, 0, family,
6584 flowtable);
6585 if (err < 0)
6586 goto err;
6587
6588 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6589err:
6590 kfree_skb(skb2);
6591 return err;
6592}
6593
6594static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
6595 struct nft_flowtable *flowtable,
6596 int event)
6597{
6598 struct sk_buff *skb;
6599 int err;
6600
6601 if (ctx->report &&
6602 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
6603 return;
6604
6605 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6606 if (skb == NULL)
6607 goto err;
6608
6609 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
6610 ctx->seq, event, 0,
36596dad 6611 ctx->family, flowtable);
3b49e2e9
PNA		 6612 if (err < 0) {
6613 kfree_skb(skb);
6614 goto err;
6615 }
6616
6617 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
6618 ctx->report, GFP_KERNEL);
6619 return;
6620err:
6621 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
6622}
6623
3b49e2e9
PNA		 6624static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
6625{
3f0465a9
PNA		 6626 struct nft_hook *hook, *next;
6627
5acab914 6628 flowtable->data.type->free(&flowtable->data);
3f0465a9 6629 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
5acab914
PNA		 6630 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
6631 FLOW_BLOCK_UNBIND);
3f0465a9
PNA		 6632 list_del_rcu(&hook->list);
6633 kfree(hook);
6634 }
3b49e2e9 6635 kfree(flowtable->name);
3b49e2e9 6636 module_put(flowtable->data.type->owner);
a12486eb 6637 kfree(flowtable);
3b49e2e9
PNA		 6638}
6639
84d7fce6
PNA		 6640static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
6641 u32 portid, u32 seq)
6642{
6643 struct nlmsghdr *nlh;
6644 struct nfgenmsg *nfmsg;
784b4e61 6645 char buf[TASK_COMM_LEN];
dedb67c4 6646 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 6647
6648 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
6649 if (nlh == NULL)
6650 goto nla_put_failure;
6651
6652 nfmsg = nlmsg_data(nlh);
6653 nfmsg->nfgen_family = AF_UNSPEC;
6654 nfmsg->version = NFNETLINK_V0;
6655 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
6656
784b4e61
PS		 6657 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
6658 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
6659 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 6660 goto nla_put_failure;
6661
053c095a
JB		 6662 nlmsg_end(skb, nlh);
6663 return 0;
84d7fce6
PNA		 6664
6665nla_put_failure:
6666 nlmsg_trim(skb, nlh);
6667 return -EMSGSIZE;
6668}
6669
3b49e2e9
PNA		 6670static void nft_flowtable_event(unsigned long event, struct net_device *dev,
6671 struct nft_flowtable *flowtable)
6672{
3f0465a9 6673 struct nft_hook *hook;
3b49e2e9 6674
3f0465a9
PNA		 6675 list_for_each_entry(hook, &flowtable->hook_list, list) {
6676 if (hook->ops.dev != dev)
3b49e2e9
PNA		 6677 continue;
6678
5acab914 6679 /* flow_offload_netdev_event() cleans up entries for us. */
ff4bf2f4 6680 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook);
3f0465a9
PNA		 6681 list_del_rcu(&hook->list);
6682 kfree_rcu(hook, rcu);
3b49e2e9
PNA		 6683 break;
6684 }
6685}
6686
6687static int nf_tables_flowtable_event(struct notifier_block *this,
6688 unsigned long event, void *ptr)
6689{
6690 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
6691 struct nft_flowtable *flowtable;
6692 struct nft_table *table;
0a2cf5ee 6693 struct net *net;
3b49e2e9
PNA		 6694
6695 if (event != NETDEV_UNREGISTER)
6696 return 0;
6697
6a48de01 6698 net = dev_net(dev);
9e619d87 6699 mutex_lock(&net->nft.commit_mutex);
0a2cf5ee 6700 list_for_each_entry(table, &net->nft.tables, list) {
36596dad
PNA		 6701 list_for_each_entry(flowtable, &table->flowtables, list) {
6702 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 6703 }
6704 }
9e619d87 6705 mutex_unlock(&net->nft.commit_mutex);
6a48de01 6706
3b49e2e9
PNA		 6707 return NOTIFY_DONE;
6708}
6709
6710static struct notifier_block nf_tables_flowtable_notifier = {
6711 .notifier_call = nf_tables_flowtable_event,
6712};
6713
25e94a99
PNA		 6714static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
6715 int event)
84d7fce6
PNA		 6716{
6717 struct nlmsghdr *nlh = nlmsg_hdr(skb);
6718 struct sk_buff *skb2;
6719 int err;
6720
6721 if (nlmsg_report(nlh) &&
6722 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 6723 return;
84d7fce6 6724
84d7fce6
PNA		 6725 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6726 if (skb2 == NULL)
6727 goto err;
6728
6729 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6730 nlh->nlmsg_seq);
6731 if (err < 0) {
6732 kfree_skb(skb2);
6733 goto err;
6734 }
6735
25e94a99
PNA		 6736 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6737 nlmsg_report(nlh), GFP_KERNEL);
6738 return;
84d7fce6 6739err:
25e94a99
PNA		 6740 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6741 -ENOBUFS);
84d7fce6
PNA		 6742}
6743
7b8002a1
PNA		 6744static int nf_tables_getgen(struct net *net, struct sock *nlsk,
6745 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 6746 const struct nlattr * const nla[],
6747 struct netlink_ext_ack *extack)
84d7fce6 6748{
84d7fce6
PNA		 6749 struct sk_buff *skb2;
6750 int err;
6751
d9adf22a 6752 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
84d7fce6
PNA		 6753 if (skb2 == NULL)
6754 return -ENOMEM;
6755
6756 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6757 nlh->nlmsg_seq);
6758 if (err < 0)
6759 goto err;
6760
6761 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6762err:
6763 kfree_skb(skb2);
6764 return err;
6765}
6766
96518518
PM		 6767static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
6768 [NFT_MSG_NEWTABLE] = {
55dd6f93 6769 .call_batch = nf_tables_newtable,
96518518
PM		 6770 .attr_count = NFTA_TABLE_MAX,
6771 .policy = nft_table_policy,
6772 },
6773 [NFT_MSG_GETTABLE] = {
d9adf22a 6774 .call_rcu = nf_tables_gettable,
96518518
PM		 6775 .attr_count = NFTA_TABLE_MAX,
6776 .policy = nft_table_policy,
6777 },
6778 [NFT_MSG_DELTABLE] = {
55dd6f93 6779 .call_batch = nf_tables_deltable,
96518518
PM		 6780 .attr_count = NFTA_TABLE_MAX,
6781 .policy = nft_table_policy,
6782 },
6783 [NFT_MSG_NEWCHAIN] = {
91c7b38d 6784 .call_batch = nf_tables_newchain,
96518518
PM		 6785 .attr_count = NFTA_CHAIN_MAX,
6786 .policy = nft_chain_policy,
6787 },
6788 [NFT_MSG_GETCHAIN] = {
d9adf22a 6789 .call_rcu = nf_tables_getchain,
96518518
PM		 6790 .attr_count = NFTA_CHAIN_MAX,
6791 .policy = nft_chain_policy,
6792 },
6793 [NFT_MSG_DELCHAIN] = {
91c7b38d 6794 .call_batch = nf_tables_delchain,
96518518
PM		 6795 .attr_count = NFTA_CHAIN_MAX,
6796 .policy = nft_chain_policy,
6797 },
6798 [NFT_MSG_NEWRULE] = {
0628b123 6799 .call_batch = nf_tables_newrule,
96518518
PM		 6800 .attr_count = NFTA_RULE_MAX,
6801 .policy = nft_rule_policy,
6802 },
6803 [NFT_MSG_GETRULE] = {
d9adf22a 6804 .call_rcu = nf_tables_getrule,
96518518
PM		 6805 .attr_count = NFTA_RULE_MAX,
6806 .policy = nft_rule_policy,
6807 },
6808 [NFT_MSG_DELRULE] = {
0628b123 6809 .call_batch = nf_tables_delrule,
96518518
PM		 6810 .attr_count = NFTA_RULE_MAX,
6811 .policy = nft_rule_policy,
6812 },
20a69341 6813 [NFT_MSG_NEWSET] = {
958bee14 6814 .call_batch = nf_tables_newset,
20a69341
PM		 6815 .attr_count = NFTA_SET_MAX,
6816 .policy = nft_set_policy,
6817 },
6818 [NFT_MSG_GETSET] = {
d9adf22a 6819 .call_rcu = nf_tables_getset,
20a69341
PM		 6820 .attr_count = NFTA_SET_MAX,
6821 .policy = nft_set_policy,
6822 },
6823 [NFT_MSG_DELSET] = {
958bee14 6824 .call_batch = nf_tables_delset,
20a69341
PM		 6825 .attr_count = NFTA_SET_MAX,
6826 .policy = nft_set_policy,
6827 },
6828 [NFT_MSG_NEWSETELEM] = {
958bee14 6829 .call_batch = nf_tables_newsetelem,
20a69341
PM		 6830 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6831 .policy = nft_set_elem_list_policy,
6832 },
6833 [NFT_MSG_GETSETELEM] = {
d9adf22a 6834 .call_rcu = nf_tables_getsetelem,
20a69341
PM		 6835 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6836 .policy = nft_set_elem_list_policy,
6837 },
6838 [NFT_MSG_DELSETELEM] = {
958bee14 6839 .call_batch = nf_tables_delsetelem,
20a69341
PM		 6840 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6841 .policy = nft_set_elem_list_policy,
6842 },
84d7fce6 6843 [NFT_MSG_GETGEN] = {
d9adf22a 6844 .call_rcu = nf_tables_getgen,
84d7fce6 6845 },
e5009240
PNA		 6846 [NFT_MSG_NEWOBJ] = {
6847 .call_batch = nf_tables_newobj,
6848 .attr_count = NFTA_OBJ_MAX,
6849 .policy = nft_obj_policy,
6850 },
6851 [NFT_MSG_GETOBJ] = {
d9adf22a 6852 .call_rcu = nf_tables_getobj,
e5009240
PNA		 6853 .attr_count = NFTA_OBJ_MAX,
6854 .policy = nft_obj_policy,
6855 },
6856 [NFT_MSG_DELOBJ] = {
6857 .call_batch = nf_tables_delobj,
6858 .attr_count = NFTA_OBJ_MAX,
6859 .policy = nft_obj_policy,
6860 },
43da04a5 6861 [NFT_MSG_GETOBJ_RESET] = {
d9adf22a 6862 .call_rcu = nf_tables_getobj,
43da04a5
PNA		 6863 .attr_count = NFTA_OBJ_MAX,
6864 .policy = nft_obj_policy,
6865 },
3b49e2e9
PNA		 6866 [NFT_MSG_NEWFLOWTABLE] = {
6867 .call_batch = nf_tables_newflowtable,
6868 .attr_count = NFTA_FLOWTABLE_MAX,
6869 .policy = nft_flowtable_policy,
6870 },
6871 [NFT_MSG_GETFLOWTABLE] = {
d9adf22a 6872 .call_rcu = nf_tables_getflowtable,
3b49e2e9
PNA		 6873 .attr_count = NFTA_FLOWTABLE_MAX,
6874 .policy = nft_flowtable_policy,
6875 },
6876 [NFT_MSG_DELFLOWTABLE] = {
6877 .call_batch = nf_tables_delflowtable,
6878 .attr_count = NFTA_FLOWTABLE_MAX,
6879 .policy = nft_flowtable_policy,
6880 },
96518518
PM		 6881};
6882
a654de8f
PNA		 6883static int nf_tables_validate(struct net *net)
6884{
6885 struct nft_table *table;
6886
6887 switch (net->nft.validate_state) {
6888 case NFT_VALIDATE_SKIP:
6889 break;
6890 case NFT_VALIDATE_NEED:
6891 nft_validate_state_update(net, NFT_VALIDATE_DO);
6892 /* fall through */
6893 case NFT_VALIDATE_DO:
6894 list_for_each_entry(table, &net->nft.tables, list) {
6895 if (nft_table_validate(net, table) < 0)
6896 return -EAGAIN;
6897 }
6898 break;
6899 }
6900
6901 return 0;
6902}
6903
66293c46
FW		 6904/* a drop policy has to be deferred until all rules have been activated,
6905 * otherwise a large ruleset that contains a drop-policy base chain will
6906 * cause all packets to get dropped until the full transaction has been
6907 * processed.
6908 *
6909 * We defer the drop policy until the transaction has been finalized.
6910 */
6911static void nft_chain_commit_drop_policy(struct nft_trans *trans)
6912{
6913 struct nft_base_chain *basechain;
6914
6915 if (nft_trans_chain_policy(trans) != NF_DROP)
6916 return;
6917
6918 if (!nft_is_base_chain(trans->ctx.chain))
6919 return;
6920
6921 basechain = nft_base_chain(trans->ctx.chain);
6922 basechain->policy = NF_DROP;
6923}
6924
91c7b38d
PNA		 6925static void nft_chain_commit_update(struct nft_trans *trans)
6926{
6927 struct nft_base_chain *basechain;
6928
1b2470e5
FW		 6929 if (nft_trans_chain_name(trans)) {
6930 rhltable_remove(&trans->ctx.table->chains_ht,
6931 &trans->ctx.chain->rhlhead,
6932 nft_chain_ht_params);
d71efb59 6933 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
1b2470e5
FW		 6934 rhltable_insert_key(&trans->ctx.table->chains_ht,
6935 trans->ctx.chain->name,
6936 &trans->ctx.chain->rhlhead,
6937 nft_chain_ht_params);
6938 }
91c7b38d 6939
f323d954 6940 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 6941 return;
6942
53315ac6
FW		 6943 nft_chain_stats_replace(trans);
6944
91c7b38d 6945 basechain = nft_base_chain(trans->ctx.chain);
91c7b38d
PNA		 6946
6947 switch (nft_trans_chain_policy(trans)) {
6948 case NF_DROP:
6949 case NF_ACCEPT:
6950 basechain->policy = nft_trans_chain_policy(trans);
6951 break;
6952 }
6953}
6954
d62d0ba9
FFM		 6955static void nft_obj_commit_update(struct nft_trans *trans)
6956{
6957 struct nft_object *newobj;
6958 struct nft_object *obj;
6959
6960 obj = nft_trans_obj(trans);
6961 newobj = nft_trans_obj_newobj(trans);
6962
9fedd894
FFM		 6963 if (obj->ops->update)
6964 obj->ops->update(obj, newobj);
d62d0ba9
FFM		 6965
6966 kfree(newobj);
6967}
6968
2f99aa31 6969static void nft_commit_release(struct nft_trans *trans)
c7c32e72 6970{
c7c32e72
PNA		 6971 switch (trans->msg_type) {
6972 case NFT_MSG_DELTABLE:
6973 nf_tables_table_destroy(&trans->ctx);
6974 break;
9f8aac0b 6975 case NFT_MSG_NEWCHAIN:
53315ac6 6976 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b
FW		 6977 kfree(nft_trans_chain_name(trans));
6978 break;
c7c32e72 6979 case NFT_MSG_DELCHAIN:
43a605f2 6980 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6981 break;
6982 case NFT_MSG_DELRULE:
6983 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6984 break;
6985 case NFT_MSG_DELSET:
6986 nft_set_destroy(nft_trans_set(trans));
6987 break;
61edafbb 6988 case NFT_MSG_DELSETELEM:
3453c927
PNA		 6989 nf_tables_set_elem_destroy(&trans->ctx,
6990 nft_trans_elem_set(trans),
59105446 6991 nft_trans_elem(trans).priv);
61edafbb 6992 break;
e5009240 6993 case NFT_MSG_DELOBJ:
00bfb320 6994 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6995 break;
3b49e2e9
PNA		 6996 case NFT_MSG_DELFLOWTABLE:
6997 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6998 break;
c7c32e72 6999 }
0935d558
FW		 7000
7001 if (trans->put_net)
7002 put_net(trans->ctx.net);
7003
c7c32e72
PNA		 7004 kfree(trans);
7005}
7006
0935d558 7007static void nf_tables_trans_destroy_work(struct work_struct *w)
2f99aa31
FW		 7008{
7009 struct nft_trans *trans, *next;
0935d558
FW		 7010 LIST_HEAD(head);
7011
7012 spin_lock(&nf_tables_destroy_list_lock);
7013 list_splice_init(&nf_tables_destroy_list, &head);
7014 spin_unlock(&nf_tables_destroy_list_lock);
2f99aa31 7015
0935d558 7016 if (list_empty(&head))
2f99aa31
FW		 7017 return;
7018
7019 synchronize_rcu();
7020
0935d558 7021 list_for_each_entry_safe(trans, next, &head, list) {
2f99aa31
FW		 7022 list_del(&trans->list);
7023 nft_commit_release(trans);
7024 }
7025}
7026
0cbc06b3
FW		 7027static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
7028{
7029 struct nft_rule *rule;
7030 unsigned int alloc = 0;
7031 int i;
7032
7033 /* already handled or inactive chain? */
7034 if (chain->rules_next || !nft_is_active_next(net, chain))
7035 return 0;
7036
7037 rule = list_entry(&chain->rules, struct nft_rule, list);
7038 i = 0;
7039
7040 list_for_each_entry_continue(rule, &chain->rules, list) {
7041 if (nft_is_active_next(net, rule))
7042 alloc++;
7043 }
7044
7045 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
7046 if (!chain->rules_next)
7047 return -ENOMEM;
7048
7049 list_for_each_entry_continue(rule, &chain->rules, list) {
7050 if (nft_is_active_next(net, rule))
7051 chain->rules_next[i++] = rule;
7052 }
7053
7054 chain->rules_next[i] = NULL;
7055 return 0;
7056}
7057
7058static void nf_tables_commit_chain_prepare_cancel(struct net *net)
7059{
7060 struct nft_trans *trans, *next;
7061
7062 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7063 struct nft_chain *chain = trans->ctx.chain;
7064
7065 if (trans->msg_type == NFT_MSG_NEWRULE ||
7066 trans->msg_type == NFT_MSG_DELRULE) {
7067 kvfree(chain->rules_next);
7068 chain->rules_next = NULL;
7069 }
7070 }
7071}
7072
7073static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
7074{
7075 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
7076
7077 kvfree(o->start);
7078}
7079
7080static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
7081{
7082 struct nft_rule **r = rules;
7083 struct nft_rules_old *old;
7084
7085 while (*r)
7086 r++;
7087
7088 r++; /* rcu_head is after end marker */
7089 old = (void *) r;
7090 old->start = rules;
7091
7092 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
7093}
7094
0fb39bbe 7095static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
0cbc06b3
FW		 7096{
7097 struct nft_rule **g0, **g1;
7098 bool next_genbit;
7099
7100 next_genbit = nft_gencursor_next(net);
7101
7102 g0 = rcu_dereference_protected(chain->rules_gen_0,
f102d66b 7103 lockdep_commit_lock_is_held(net));
0cbc06b3 7104 g1 = rcu_dereference_protected(chain->rules_gen_1,
f102d66b 7105 lockdep_commit_lock_is_held(net));
0cbc06b3
FW		 7106
7107 /* No changes to this chain? */
7108 if (chain->rules_next == NULL) {
7109 /* chain had no change in last or next generation */
7110 if (g0 == g1)
7111 return;
7112 /*
7113 * chain had no change in this generation; make sure next
7114 * one uses same rules as current generation.
7115 */
7116 if (next_genbit) {
7117 rcu_assign_pointer(chain->rules_gen_1, g0);
7118 nf_tables_commit_chain_free_rules_old(g1);
7119 } else {
7120 rcu_assign_pointer(chain->rules_gen_0, g1);
7121 nf_tables_commit_chain_free_rules_old(g0);
7122 }
7123
7124 return;
7125 }
7126
7127 if (next_genbit)
7128 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
7129 else
7130 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
7131
7132 chain->rules_next = NULL;
7133
7134 if (g0 == g1)
7135 return;
7136
7137 if (next_genbit)
7138 nf_tables_commit_chain_free_rules_old(g1);
7139 else
7140 nf_tables_commit_chain_free_rules_old(g0);
7141}
7142
d152159b
FW		 7143static void nft_obj_del(struct nft_object *obj)
7144{
4d44175a 7145 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
d152159b
FW		 7146 list_del_rcu(&obj->list);
7147}
7148
1b2470e5
FW		 7149static void nft_chain_del(struct nft_chain *chain)
7150{
7151 struct nft_table *table = chain->table;
7152
7153 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
7154 nft_chain_ht_params));
7155 list_del_rcu(&chain->list);
7156}
7157
eb014de4
PNA		 7158static void nf_tables_module_autoload_cleanup(struct net *net)
7159{
7160 struct nft_module_request *req, *next;
7161
7162 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
7163 list_for_each_entry_safe(req, next, &net->nft.module_list, list) {
7164 WARN_ON_ONCE(!req->done);
7165 list_del(&req->list);
7166 kfree(req);
7167 }
7168}
7169
0935d558
FW		 7170static void nf_tables_commit_release(struct net *net)
7171{
7172 struct nft_trans *trans;
7173
7174 /* all side effects have to be made visible.
7175 * For example, if a chain named 'foo' has been deleted, a
7176 * new transaction must not find it anymore.
7177 *
7178 * Memory reclaim happens asynchronously from work queue
7179 * to prevent expensive synchronize_rcu() in commit phase.
7180 */
7181 if (list_empty(&net->nft.commit_list)) {
eb014de4 7182 nf_tables_module_autoload_cleanup(net);
0935d558
FW		 7183 mutex_unlock(&net->nft.commit_mutex);
7184 return;
7185 }
7186
7187 trans = list_last_entry(&net->nft.commit_list,
7188 struct nft_trans, list);
7189 get_net(trans->ctx.net);
7190 WARN_ON_ONCE(trans->put_net);
7191
7192 trans->put_net = true;
7193 spin_lock(&nf_tables_destroy_list_lock);
7194 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
7195 spin_unlock(&nf_tables_destroy_list_lock);
7196
eb014de4 7197 nf_tables_module_autoload_cleanup(net);
0935d558
FW		 7198 mutex_unlock(&net->nft.commit_mutex);
7199
7200 schedule_work(&trans_destroy_work);
7201}
7202
5913beaf 7203static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 7204{
37082f93 7205 struct nft_trans *trans, *next;
a3716e70 7206 struct nft_trans_elem *te;
0cbc06b3
FW		 7207 struct nft_chain *chain;
7208 struct nft_table *table;
c9626a2c 7209 int err;
37082f93 7210
b8b27498
FW		 7211 if (list_empty(&net->nft.commit_list)) {
7212 mutex_unlock(&net->nft.commit_mutex);
7213 return 0;
7214 }
7215
a654de8f
PNA		 7216 /* 0. Validate ruleset, otherwise roll back for error reporting. */
7217 if (nf_tables_validate(net) < 0)
7218 return -EAGAIN;
7219
c9626a2c
PNA		 7220 err = nft_flow_rule_offload_commit(net);
7221 if (err < 0)
7222 return err;
7223
0cbc06b3
FW		 7224 /* 1. Allocate space for next generation rules_gen_X[] */
7225 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7226 int ret;
37082f93 7227
0cbc06b3
FW		 7228 if (trans->msg_type == NFT_MSG_NEWRULE ||
7229 trans->msg_type == NFT_MSG_DELRULE) {
7230 chain = trans->ctx.chain;
7231
7232 ret = nf_tables_commit_chain_prepare(net, chain);
7233 if (ret < 0) {
7234 nf_tables_commit_chain_prepare_cancel(net);
7235 return ret;
7236 }
7237 }
7238 }
37082f93 7239
0cbc06b3
FW		 7240 /* step 2. Make rules_gen_X visible to packet path */
7241 list_for_each_entry(table, &net->nft.tables, list) {
0fb39bbe
FW		 7242 list_for_each_entry(chain, &table->chains, list)
7243 nf_tables_commit_chain(net, chain);
0cbc06b3
FW		 7244 }
7245
7246 /*
7247 * Bump generation counter, invalidate any dump in progress.
7248 * Cannot fail after this point.
37082f93 7249 */
0cbc06b3
FW		 7250 while (++net->nft.base_seq == 0);
7251
7252 /* step 3. Start new generation, rules_gen_X now in use. */
7253 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 7254
7255 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 7256 switch (trans->msg_type) {
55dd6f93
PNA		 7257 case NFT_MSG_NEWTABLE:
7258 if (nft_trans_table_update(trans)) {
7259 if (!nft_trans_table_enable(trans)) {
664b0f8c 7260 nf_tables_table_disable(net,
55dd6f93
PNA		 7261 trans->ctx.table);
7262 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7263 }
7264 } else {
f2a6d766 7265 nft_clear(net, trans->ctx.table);
55dd6f93 7266 }
35151d84 7267 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 7268 nft_trans_destroy(trans);
7269 break;
7270 case NFT_MSG_DELTABLE:
f2a6d766 7271 list_del_rcu(&trans->ctx.table->list);
35151d84 7272 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 7273 break;
91c7b38d 7274 case NFT_MSG_NEWCHAIN:
9f8aac0b 7275 if (nft_trans_chain_update(trans)) {
91c7b38d 7276 nft_chain_commit_update(trans);
9f8aac0b
FW		 7277 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7278 /* trans destroyed after rcu grace period */
7279 } else {
66293c46 7280 nft_chain_commit_drop_policy(trans);
664b0f8c 7281 nft_clear(net, trans->ctx.chain);
9f8aac0b
FW		 7282 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7283 nft_trans_destroy(trans);
7284 }
91c7b38d
PNA		 7285 break;
7286 case NFT_MSG_DELCHAIN:
1b2470e5 7287 nft_chain_del(trans->ctx.chain);
35151d84 7288 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 7289 nf_tables_unregister_hook(trans->ctx.net,
7290 trans->ctx.table,
7291 trans->ctx.chain);
91c7b38d 7292 break;
b380e5c7 7293 case NFT_MSG_NEWRULE:
889f7ee7 7294 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 7295 nf_tables_rule_notify(&trans->ctx,
37082f93 7296 nft_trans_rule(trans),
35151d84 7297 NFT_MSG_NEWRULE);
37082f93 7298 nft_trans_destroy(trans);
b380e5c7
PNA		 7299 break;
7300 case NFT_MSG_DELRULE:
7301 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 7302 nf_tables_rule_notify(&trans->ctx,
7303 nft_trans_rule(trans),
7304 NFT_MSG_DELRULE);
f6ac8585
PNA		 7305 nft_rule_expr_deactivate(&trans->ctx,
7306 nft_trans_rule(trans),
7307 NFT_TRANS_COMMIT);
b380e5c7 7308 break;
958bee14 7309 case NFT_MSG_NEWSET:
37a9cc52 7310 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 7311 /* This avoids hitting -EBUSY when deleting the table
7312 * from the transaction.
7313 */
408070d6 7314 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 7315 !list_empty(&nft_trans_set(trans)->bindings))
7316 trans->ctx.table->use--;
7317
958bee14 7318 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 7319 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 7320 nft_trans_destroy(trans);
7321 break;
7322 case NFT_MSG_DELSET:
37a9cc52 7323 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 7324 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 7325 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 7326 break;
60319eb1 7327 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 7328 te = (struct nft_trans_elem *)trans->data;
7329
42a55769 7330 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 7331 nf_tables_setelem_notify(&trans->ctx, te->set,
7332 &te->elem,
60319eb1
PNA		 7333 NFT_MSG_NEWSETELEM, 0);
7334 nft_trans_destroy(trans);
7335 break;
7336 case NFT_MSG_DELSETELEM:
a3716e70 7337 te = (struct nft_trans_elem *)trans->data;
fe2811eb 7338
a3716e70
PNA		 7339 nf_tables_setelem_notify(&trans->ctx, te->set,
7340 &te->elem,
60319eb1 7341 NFT_MSG_DELSETELEM, 0);
5cb82a38 7342 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 7343 atomic_dec(&te->set->nelems);
7344 te->set->ndeact--;
60319eb1 7345 break;
e5009240 7346 case NFT_MSG_NEWOBJ:
d62d0ba9
FFM		 7347 if (nft_trans_obj_update(trans)) {
7348 nft_obj_commit_update(trans);
7349 nf_tables_obj_notify(&trans->ctx,
7350 nft_trans_obj(trans),
7351 NFT_MSG_NEWOBJ);
7352 } else {
7353 nft_clear(net, nft_trans_obj(trans));
7354 nf_tables_obj_notify(&trans->ctx,
7355 nft_trans_obj(trans),
7356 NFT_MSG_NEWOBJ);
7357 nft_trans_destroy(trans);
7358 }
e5009240
PNA		 7359 break;
7360 case NFT_MSG_DELOBJ:
d152159b 7361 nft_obj_del(nft_trans_obj(trans));
e5009240
PNA		 7362 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
7363 NFT_MSG_DELOBJ);
7364 break;
3b49e2e9
PNA		 7365 case NFT_MSG_NEWFLOWTABLE:
7366 nft_clear(net, nft_trans_flowtable(trans));
7367 nf_tables_flowtable_notify(&trans->ctx,
7368 nft_trans_flowtable(trans),
7369 NFT_MSG_NEWFLOWTABLE);
7370 nft_trans_destroy(trans);
7371 break;
7372 case NFT_MSG_DELFLOWTABLE:
7373 list_del_rcu(&nft_trans_flowtable(trans)->list);
7374 nf_tables_flowtable_notify(&trans->ctx,
7375 nft_trans_flowtable(trans),
7376 NFT_MSG_DELFLOWTABLE);
7377 nft_unregister_flowtable_net_hooks(net,
7378 nft_trans_flowtable(trans));
7379 break;
37082f93 7380 }
37082f93
PNA		 7381 }
7382
84d7fce6 7383 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
0935d558 7384 nf_tables_commit_release(net);
37082f93
PNA		 7385
7386 return 0;
7387}
7388
eb014de4
PNA		 7389static void nf_tables_module_autoload(struct net *net)
7390{
7391 struct nft_module_request *req, *next;
7392 LIST_HEAD(module_list);
7393
7394 list_splice_init(&net->nft.module_list, &module_list);
7395 mutex_unlock(&net->nft.commit_mutex);
7396 list_for_each_entry_safe(req, next, &module_list, list) {
1d305ba4
FW		 7397 request_module("%s", req->module);
7398 req->done = true;
eb014de4
PNA		 7399 }
7400 mutex_lock(&net->nft.commit_mutex);
7401 list_splice(&module_list, &net->nft.module_list);
7402}
7403
b326dd37 7404static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 7405{
c7c32e72
PNA		 7406 switch (trans->msg_type) {
7407 case NFT_MSG_NEWTABLE:
7408 nf_tables_table_destroy(&trans->ctx);
7409 break;
7410 case NFT_MSG_NEWCHAIN:
43a605f2 7411 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 7412 break;
7413 case NFT_MSG_NEWRULE:
7414 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
7415 break;
7416 case NFT_MSG_NEWSET:
40ba1d9b 7417 nft_set_destroy(nft_trans_set(trans));
c7c32e72 7418 break;
61edafbb
PM		 7419 case NFT_MSG_NEWSETELEM:
7420 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 7421 nft_trans_elem(trans).priv, true);
61edafbb 7422 break;
e5009240 7423 case NFT_MSG_NEWOBJ:
00bfb320 7424 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 7425 break;
3b49e2e9
PNA		 7426 case NFT_MSG_NEWFLOWTABLE:
7427 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
7428 break;
c7c32e72
PNA		 7429 }
7430 kfree(trans);
7431}
7432
eb014de4 7433static int __nf_tables_abort(struct net *net, bool autoload)
37082f93 7434{
37082f93 7435 struct nft_trans *trans, *next;
02263db0 7436 struct nft_trans_elem *te;
37082f93 7437
a907e36d
XL		 7438 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
7439 list) {
b380e5c7 7440 switch (trans->msg_type) {
55dd6f93
PNA		 7441 case NFT_MSG_NEWTABLE:
7442 if (nft_trans_table_update(trans)) {
7443 if (nft_trans_table_enable(trans)) {
664b0f8c 7444 nf_tables_table_disable(net,
55dd6f93
PNA		 7445 trans->ctx.table);
7446 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7447 }
7448 nft_trans_destroy(trans);
7449 } else {
e688a7f8 7450 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 7451 }
7452 break;
7453 case NFT_MSG_DELTABLE:
f2a6d766 7454 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 7455 nft_trans_destroy(trans);
7456 break;
91c7b38d
PNA		 7457 case NFT_MSG_NEWCHAIN:
7458 if (nft_trans_chain_update(trans)) {
982f4051 7459 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b 7460 kfree(nft_trans_chain_name(trans));
91c7b38d
PNA		 7461 nft_trans_destroy(trans);
7462 } else {
4fefee57 7463 trans->ctx.table->use--;
1b2470e5 7464 nft_chain_del(trans->ctx.chain);
c974a3a3
PNA		 7465 nf_tables_unregister_hook(trans->ctx.net,
7466 trans->ctx.table,
7467 trans->ctx.chain);
91c7b38d
PNA		 7468 }
7469 break;
7470 case NFT_MSG_DELCHAIN:
4fefee57 7471 trans->ctx.table->use++;
664b0f8c 7472 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 7473 nft_trans_destroy(trans);
7474 break;
b380e5c7 7475 case NFT_MSG_NEWRULE:
4fefee57 7476 trans->ctx.chain->use--;
b380e5c7 7477 list_del_rcu(&nft_trans_rule(trans)->list);
f6ac8585
PNA		 7478 nft_rule_expr_deactivate(&trans->ctx,
7479 nft_trans_rule(trans),
7480 NFT_TRANS_ABORT);
b380e5c7
PNA		 7481 break;
7482 case NFT_MSG_DELRULE:
4fefee57 7483 trans->ctx.chain->use++;
889f7ee7 7484 nft_clear(trans->ctx.net, nft_trans_rule(trans));
bb7b40ae 7485 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
37082f93 7486 nft_trans_destroy(trans);
b380e5c7 7487 break;
958bee14 7488 case NFT_MSG_NEWSET:
4fefee57 7489 trans->ctx.table->use--;
6a0a8d10 7490 if (nft_trans_set_bound(trans)) {
40ba1d9b
PNA		 7491 nft_trans_destroy(trans);
7492 break;
7493 }
7494 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 7495 break;
7496 case NFT_MSG_DELSET:
4fefee57 7497 trans->ctx.table->use++;
37a9cc52 7498 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 7499 nft_trans_destroy(trans);
7500 break;
60319eb1 7501 case NFT_MSG_NEWSETELEM:
6a0a8d10 7502 if (nft_trans_elem_set_bound(trans)) {
40ba1d9b
PNA		 7503 nft_trans_destroy(trans);
7504 break;
7505 }
02263db0 7506 te = (struct nft_trans_elem *)trans->data;
5cb82a38 7507 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 7508 atomic_dec(&te->set->nelems);
60319eb1
PNA		 7509 break;
7510 case NFT_MSG_DELSETELEM:
cc02e457
PM		 7511 te = (struct nft_trans_elem *)trans->data;
7512
59105446 7513 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 7514 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 7515 te->set->ndeact--;
cc02e457 7516
e5009240
PNA		 7517 nft_trans_destroy(trans);
7518 break;
7519 case NFT_MSG_NEWOBJ:
d62d0ba9
FFM		 7520 if (nft_trans_obj_update(trans)) {
7521 kfree(nft_trans_obj_newobj(trans));
7522 nft_trans_destroy(trans);
7523 } else {
7524 trans->ctx.table->use--;
7525 nft_obj_del(nft_trans_obj(trans));
7526 }
e5009240
PNA		 7527 break;
7528 case NFT_MSG_DELOBJ:
7529 trans->ctx.table->use++;
7530 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 7531 nft_trans_destroy(trans);
7532 break;
3b49e2e9
PNA		 7533 case NFT_MSG_NEWFLOWTABLE:
7534 trans->ctx.table->use--;
7535 list_del_rcu(&nft_trans_flowtable(trans)->list);
7536 nft_unregister_flowtable_net_hooks(net,
7537 nft_trans_flowtable(trans));
7538 break;
7539 case NFT_MSG_DELFLOWTABLE:
7540 trans->ctx.table->use++;
7541 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
7542 nft_trans_destroy(trans);
7543 break;
37082f93 7544 }
37082f93
PNA		 7545 }
7546
b326dd37
PNA		 7547 synchronize_rcu();
7548
a1cee076
PNA		 7549 list_for_each_entry_safe_reverse(trans, next,
7550 &net->nft.commit_list, list) {
c7c32e72 7551 list_del(&trans->list);
b326dd37 7552 nf_tables_abort_release(trans);
37082f93
PNA		 7553 }
7554
eb014de4
PNA		 7555 if (autoload)
7556 nf_tables_module_autoload(net);
7557 else
7558 nf_tables_module_autoload_cleanup(net);
7559
37082f93
PNA		 7560 return 0;
7561}
7562
a654de8f
PNA		 7563static void nf_tables_cleanup(struct net *net)
7564{
7565 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
7566}
7567
eb014de4 7568static int nf_tables_abort(struct net *net, struct sk_buff *skb, bool autoload)
71ad00c5 7569{
eb014de4 7570 int ret = __nf_tables_abort(net, autoload);
f102d66b
FW		 7571
7572 mutex_unlock(&net->nft.commit_mutex);
7573
7574 return ret;
71ad00c5
FW		 7575}
7576
74e8bcd2
PNA		 7577static bool nf_tables_valid_genid(struct net *net, u32 genid)
7578{
f102d66b
FW		 7579 bool genid_ok;
7580
7581 mutex_lock(&net->nft.commit_mutex);
7582
7583 genid_ok = genid == 0 || net->nft.base_seq == genid;
7584 if (!genid_ok)
7585 mutex_unlock(&net->nft.commit_mutex);
7586
7587 /* else, commit mutex has to be released by commit or abort function */
7588 return genid_ok;
74e8bcd2
PNA		 7589}
7590
96518518
PM		 7591static const struct nfnetlink_subsystem nf_tables_subsys = {
7592 .name = "nf_tables",
7593 .subsys_id = NFNL_SUBSYS_NFTABLES,
7594 .cb_count = NFT_MSG_MAX,
7595 .cb = nf_tables_cb,
0628b123
PNA		 7596 .commit = nf_tables_commit,
7597 .abort = nf_tables_abort,
a654de8f 7598 .cleanup = nf_tables_cleanup,
74e8bcd2 7599 .valid_genid = nf_tables_valid_genid,
be2ab5b4 7600 .owner = THIS_MODULE,
96518518
PM		 7601};
7602
7210e4e3 7603int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 7604 enum nft_chain_types type)
7210e4e3
PNA		 7605{
7606 const struct nft_base_chain *basechain;
7607
f323d954 7608 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 7609 basechain = nft_base_chain(chain);
7610 if (basechain->type->type != type)
7611 return -EOPNOTSUPP;
7612 }
7613 return 0;
7614}
7615EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
7616
75e8d06d
PNA		 7617int nft_chain_validate_hooks(const struct nft_chain *chain,
7618 unsigned int hook_flags)
7619{
7620 struct nft_base_chain *basechain;
7621
f323d954 7622 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 7623 basechain = nft_base_chain(chain);
7624
c974a3a3 7625 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 7626 return 0;
7627
7628 return -EOPNOTSUPP;
7629 }
7630
7631 return 0;
7632}
7633EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
7634
20a69341
PM		 7635/*
7636 * Loop detection - walk through the ruleset beginning at the destination chain
7637 * of a new jump until either the source chain is reached (loop) or all
7638 * reachable chains have been traversed.
7639 *
7640 * The loop check is performed whenever a new jump verdict is added to an
7641 * expression or verdict map or a verdict map is bound to a new chain.
7642 */
7643
7644static int nf_tables_check_loops(const struct nft_ctx *ctx,
7645 const struct nft_chain *chain);
7646
7647static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 7648 struct nft_set *set,
20a69341 7649 const struct nft_set_iter *iter,
de70185d 7650 struct nft_set_elem *elem)
20a69341 7651{
fe2811eb
PM		 7652 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
7653 const struct nft_data *data;
7654
7655 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
7656 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 7657 return 0;
7658
fe2811eb 7659 data = nft_set_ext_data(ext);
1ca2e170 7660 switch (data->verdict.code) {
20a69341
PM		 7661 case NFT_JUMP:
7662 case NFT_GOTO:
1ca2e170 7663 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7664 default:
7665 return 0;
7666 }
7667}
7668
7669static int nf_tables_check_loops(const struct nft_ctx *ctx,
7670 const struct nft_chain *chain)
7671{
7672 const struct nft_rule *rule;
7673 const struct nft_expr *expr, *last;
de70185d 7674 struct nft_set *set;
20a69341
PM		 7675 struct nft_set_binding *binding;
7676 struct nft_set_iter iter;
20a69341
PM		 7677
7678 if (ctx->chain == chain)
7679 return -ELOOP;
7680
7681 list_for_each_entry(rule, &chain->rules, list) {
7682 nft_rule_for_each_expr(expr, last, rule) {
a654de8f
PNA		 7683 struct nft_immediate_expr *priv;
7684 const struct nft_data *data;
0ca743a5
PNA		 7685 int err;
7686
a654de8f 7687 if (strcmp(expr->ops->type->name, "immediate"))
20a69341
PM		 7688 continue;
7689
a654de8f
PNA		 7690 priv = nft_expr_priv(expr);
7691 if (priv->dreg != NFT_REG_VERDICT)
0ca743a5 7692 continue;
20a69341 7693
a654de8f 7694 data = &priv->data;
1ca2e170 7695 switch (data->verdict.code) {
20a69341
PM		 7696 case NFT_JUMP:
7697 case NFT_GOTO:
1ca2e170
PM		 7698 err = nf_tables_check_loops(ctx,
7699 data->verdict.chain);
20a69341
PM		 7700 if (err < 0)
7701 return err;
7702 default:
7703 break;
7704 }
7705 }
7706 }
7707
7708 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 7709 if (!nft_is_active_next(ctx->net, set))
7710 continue;
20a69341
PM		 7711 if (!(set->flags & NFT_SET_MAP) ||
7712 set->dtype != NFT_DATA_VERDICT)
7713 continue;
7714
7715 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 7716 if (!(binding->flags & NFT_SET_MAP) ||
7717 binding->chain != chain)
20a69341
PM		 7718 continue;
7719
8588ac09 7720 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 7721 iter.skip = 0;
7722 iter.count = 0;
7723 iter.err = 0;
7724 iter.fn = nf_tables_loop_check_setelem;
7725
7726 set->ops->walk(ctx, set, &iter);
7727 if (iter.err < 0)
7728 return iter.err;
7729 }
7730 }
7731
7732 return 0;
7733}
7734
36b701fa
LGL		 7735/**
7736 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
7737 *
7738 * @attr: netlink attribute to fetch value from
7739 * @max: maximum value to be stored in dest
7740 * @dest: pointer to the variable
7741 *
7742 * Parse, check and store a given u32 netlink attribute into variable.
7743 * This function returns -ERANGE if the value goes over maximum value.
7744 * Otherwise a 0 is returned and the attribute value is stored in the
7745 * destination variable.
7746 */
f1d505bb 7747int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 7748{
09525a09 7749 u32 val;
36b701fa
LGL		 7750
7751 val = ntohl(nla_get_be32(attr));
7752 if (val > max)
7753 return -ERANGE;
7754
7755 *dest = val;
7756 return 0;
7757}
7758EXPORT_SYMBOL_GPL(nft_parse_u32_check);
7759
49499c3e
PM		 7760/**
7761 * nft_parse_register - parse a register value from a netlink attribute
7762 *
7763 * @attr: netlink attribute
7764 *
7765 * Parse and translate a register value from a netlink attribute.
7766 * Registers used to be 128 bit wide, these register numbers will be
7767 * mapped to the corresponding 32 bit register numbers.
7768 */
b1c96ed3
PM		 7769unsigned int nft_parse_register(const struct nlattr *attr)
7770{
49499c3e
PM		 7771 unsigned int reg;
7772
7773 reg = ntohl(nla_get_be32(attr));
7774 switch (reg) {
7775 case NFT_REG_VERDICT...NFT_REG_4:
7776 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
7777 default:
7778 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
7779 }
b1c96ed3
PM		 7780}
7781EXPORT_SYMBOL_GPL(nft_parse_register);
7782
49499c3e
PM		 7783/**
7784 * nft_dump_register - dump a register value to a netlink attribute
7785 *
7786 * @skb: socket buffer
7787 * @attr: attribute number
7788 * @reg: register number
7789 *
7790 * Construct a netlink attribute containing the register number. For
7791 * compatibility reasons, register numbers being a multiple of 4 are
7792 * translated to the corresponding 128 bit register numbers.
7793 */
b1c96ed3
PM		 7794int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
7795{
49499c3e
PM		 7796 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
7797 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
7798 else
7799 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
7800
b1c96ed3
PM		 7801 return nla_put_be32(skb, attr, htonl(reg));
7802}
7803EXPORT_SYMBOL_GPL(nft_dump_register);
7804
96518518 7805/**
d07db988 7806 * nft_validate_register_load - validate a load from a register
96518518
PM		 7807 *
7808 * @reg: the register number
d07db988 7809 * @len: the length of the data
96518518
PM		 7810 *
7811 * Validate that the input register is one of the general purpose
d07db988 7812 * registers and that the length of the load is within the bounds.
96518518 7813 */
d07db988 7814int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 7815{
49499c3e 7816 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 7817 return -EINVAL;
d07db988
PM		 7818 if (len == 0)
7819 return -EINVAL;
c593642c 7820 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data))
d07db988 7821 return -ERANGE;
49499c3e 7822
96518518
PM		 7823 return 0;
7824}
d07db988 7825EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 7826
96518518 7827/**
1ec10212 7828 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 7829 *
7830 * @ctx: context of the expression performing the load
7831 * @reg: the destination register number
7832 * @data: the data to load
7833 * @type: the data type
45d9bcda 7834 * @len: the length of the data
96518518
PM		 7835 *
7836 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 7837 * the destination register and the length is within the bounds.
7838 * A value of NULL for the data means that its runtime gathered
58f40ab6 7839 * data.
96518518 7840 */
1ec10212
PM		 7841int nft_validate_register_store(const struct nft_ctx *ctx,
7842 enum nft_registers reg,
7843 const struct nft_data *data,
7844 enum nft_data_types type, unsigned int len)
96518518 7845{
20a69341
PM		 7846 int err;
7847
96518518
PM		 7848 switch (reg) {
7849 case NFT_REG_VERDICT:
58f40ab6 7850 if (type != NFT_DATA_VERDICT)
96518518 7851 return -EINVAL;
20a69341 7852
58f40ab6 7853 if (data != NULL &&
1ca2e170
PM		 7854 (data->verdict.code == NFT_GOTO ||
7855 data->verdict.code == NFT_JUMP)) {
7856 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7857 if (err < 0)
7858 return err;
20a69341
PM		 7859 }
7860
96518518
PM		 7861 return 0;
7862 default:
49499c3e 7863 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 7864 return -EINVAL;
45d9bcda
PM		 7865 if (len == 0)
7866 return -EINVAL;
49499c3e 7867 if (reg * NFT_REG32_SIZE + len >
c593642c 7868 sizeof_field(struct nft_regs, data))
45d9bcda 7869 return -ERANGE;
27e6d201 7870
96518518
PM		 7871 if (data != NULL && type != NFT_DATA_VALUE)
7872 return -EINVAL;
7873 return 0;
7874 }
7875}
1ec10212 7876EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 7877
7878static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
7879 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
7880 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
7881 .len = NFT_CHAIN_MAXNAMELEN - 1 },
7882};
7883
7884static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
7885 struct nft_data_desc *desc, const struct nlattr *nla)
7886{
664b0f8c 7887 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 7888 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
7889 struct nft_chain *chain;
7890 int err;
7891
8cb08174
JB		 7892 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
7893 nft_verdict_policy, NULL);
96518518
PM		 7894 if (err < 0)
7895 return err;
7896
7897 if (!tb[NFTA_VERDICT_CODE])
7898 return -EINVAL;
1ca2e170 7899 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 7900
1ca2e170 7901 switch (data->verdict.code) {
e0abdadc 7902 default:
1ca2e170 7903 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 7904 case NF_ACCEPT:
7905 case NF_DROP:
7906 case NF_QUEUE:
7907 break;
7908 default:
7909 return -EINVAL;
7910 }
7911 /* fall through */
96518518
PM		 7912 case NFT_CONTINUE:
7913 case NFT_BREAK:
7914 case NFT_RETURN:
96518518
PM		 7915 break;
7916 case NFT_JUMP:
7917 case NFT_GOTO:
7918 if (!tb[NFTA_VERDICT_CHAIN])
7919 return -EINVAL;
f102d66b
FW		 7920 chain = nft_chain_lookup(ctx->net, ctx->table,
7921 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 7922 if (IS_ERR(chain))
7923 return PTR_ERR(chain);
f323d954 7924 if (nft_is_base_chain(chain))
96518518
PM		 7925 return -EOPNOTSUPP;
7926
96518518 7927 chain->use++;
1ca2e170 7928 data->verdict.chain = chain;
96518518 7929 break;
96518518
PM		 7930 }
7931
4c4ed074 7932 desc->len = sizeof(data->verdict);
96518518
PM		 7933 desc->type = NFT_DATA_VERDICT;
7934 return 0;
7935}
7936
7937static void nft_verdict_uninit(const struct nft_data *data)
7938{
1ca2e170 7939 switch (data->verdict.code) {
96518518
PM		 7940 case NFT_JUMP:
7941 case NFT_GOTO:
1ca2e170 7942 data->verdict.chain->use--;
96518518
PM		 7943 break;
7944 }
7945}
7946
33d5a7b1 7947int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 7948{
7949 struct nlattr *nest;
7950
ae0be8de 7951 nest = nla_nest_start_noflag(skb, type);
96518518
PM		 7952 if (!nest)
7953 goto nla_put_failure;
7954
33d5a7b1 7955 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 7956 goto nla_put_failure;
7957
33d5a7b1 7958 switch (v->code) {
96518518
PM		 7959 case NFT_JUMP:
7960 case NFT_GOTO:
1ca2e170 7961 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 7962 v->chain->name))
96518518
PM		 7963 goto nla_put_failure;
7964 }
7965 nla_nest_end(skb, nest);
7966 return 0;
7967
7968nla_put_failure:
7969 return -1;
7970}
7971
d0a11fc3
PM		 7972static int nft_value_init(const struct nft_ctx *ctx,
7973 struct nft_data *data, unsigned int size,
96518518
PM		 7974 struct nft_data_desc *desc, const struct nlattr *nla)
7975{
7976 unsigned int len;
7977
7978 len = nla_len(nla);
7979 if (len == 0)
7980 return -EINVAL;
d0a11fc3 7981 if (len > size)
96518518
PM		 7982 return -EOVERFLOW;
7983
d0a11fc3 7984 nla_memcpy(data->data, nla, len);
96518518
PM		 7985 desc->type = NFT_DATA_VALUE;
7986 desc->len = len;
7987 return 0;
7988}
7989
7990static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
7991 unsigned int len)
7992{
7993 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
7994}
7995
7996static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 7997 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 7998 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
7999};
8000
8001/**
8002 * nft_data_init - parse nf_tables data netlink attributes
8003 *
8004 * @ctx: context of the expression using the data
8005 * @data: destination struct nft_data
d0a11fc3 8006 * @size: maximum data length
96518518
PM		 8007 * @desc: data description
8008 * @nla: netlink attribute containing data
8009 *
8010 * Parse the netlink data attributes and initialize a struct nft_data.
8011 * The type and length of data are returned in the data description.
8012 *
8013 * The caller can indicate that it only wants to accept data of type
8014 * NFT_DATA_VALUE by passing NULL for the ctx argument.
8015 */
d0a11fc3
PM		 8016int nft_data_init(const struct nft_ctx *ctx,
8017 struct nft_data *data, unsigned int size,
96518518
PM		 8018 struct nft_data_desc *desc, const struct nlattr *nla)
8019{
8020 struct nlattr *tb[NFTA_DATA_MAX + 1];
8021 int err;
8022
8cb08174
JB		 8023 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
8024 nft_data_policy, NULL);
96518518
PM		 8025 if (err < 0)
8026 return err;
8027
8028 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 8029 return nft_value_init(ctx, data, size, desc,
8030 tb[NFTA_DATA_VALUE]);
96518518
PM		 8031 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
8032 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
8033 return -EINVAL;
8034}
8035EXPORT_SYMBOL_GPL(nft_data_init);
8036
8037/**
59105446 8038 * nft_data_release - release a nft_data item
96518518
PM		 8039 *
8040 * @data: struct nft_data to release
8041 * @type: type of data
8042 *
8043 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
8044 * all others need to be released by calling this function.
8045 */
59105446 8046void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 8047{
960bd2c2 8048 if (type < NFT_DATA_VERDICT)
96518518 8049 return;
960bd2c2 8050 switch (type) {
96518518
PM		 8051 case NFT_DATA_VERDICT:
8052 return nft_verdict_uninit(data);
8053 default:
8054 WARN_ON(1);
8055 }
8056}
59105446 8057EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 8058
8059int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
8060 enum nft_data_types type, unsigned int len)
8061{
8062 struct nlattr *nest;
8063 int err;
8064
ae0be8de 8065 nest = nla_nest_start_noflag(skb, attr);
96518518
PM		 8066 if (nest == NULL)
8067 return -1;
8068
8069 switch (type) {
8070 case NFT_DATA_VALUE:
8071 err = nft_value_dump(skb, data, len);
8072 break;
8073 case NFT_DATA_VERDICT:
33d5a7b1 8074 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 8075 break;
8076 default:
8077 err = -EINVAL;
8078 WARN_ON(1);
8079 }
8080
8081 nla_nest_end(skb, nest);
8082 return err;
8083}
8084EXPORT_SYMBOL_GPL(nft_data_dump);
8085
5ebe0b0e
PNA		 8086int __nft_release_basechain(struct nft_ctx *ctx)
8087{
8088 struct nft_rule *rule, *nr;
8089
fa5950e4
FW		 8090 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
8091 return 0;
5ebe0b0e 8092
c974a3a3 8093 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 8094 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
8095 list_del(&rule->list);
8096 ctx->chain->use--;
bb7b40ae 8097 nf_tables_rule_release(ctx, rule);
5ebe0b0e 8098 }
1b2470e5 8099 nft_chain_del(ctx->chain);
5ebe0b0e 8100 ctx->table->use--;
43a605f2 8101 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 8102
8103 return 0;
8104}
8105EXPORT_SYMBOL_GPL(__nft_release_basechain);
8106
98319cb9 8107static void __nft_release_tables(struct net *net)
df05ef87 8108{
3b49e2e9 8109 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 8110 struct nft_table *table, *nt;
8111 struct nft_chain *chain, *nc;
e5009240 8112 struct nft_object *obj, *ne;
df05ef87
PNA		 8113 struct nft_rule *rule, *nr;
8114 struct nft_set *set, *ns;
8115 struct nft_ctx ctx = {
8116 .net = net,
43a605f2 8117 .family = NFPROTO_NETDEV,
df05ef87
PNA		 8118 };
8119
36596dad 8120 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 8121 ctx.family = table->family;
dd4cbef7 8122
df05ef87 8123 list_for_each_entry(chain, &table->chains, list)
c974a3a3 8124 nf_tables_unregister_hook(net, table, chain);
df05ef87
PNA		 8125 /* No packets are walking on these chains anymore. */
8126 ctx.table = table;
8127 list_for_each_entry(chain, &table->chains, list) {
8128 ctx.chain = chain;
8129 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
8130 list_del(&rule->list);
8131 chain->use--;
bb7b40ae 8132 nf_tables_rule_release(&ctx, rule);
df05ef87
PNA		 8133 }
8134 }
3b49e2e9
PNA		 8135 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
8136 list_del(&flowtable->list);
8137 table->use--;
8138 nf_tables_flowtable_destroy(flowtable);
8139 }
df05ef87
PNA		 8140 list_for_each_entry_safe(set, ns, &table->sets, list) {
8141 list_del(&set->list);
8142 table->use--;
8143 nft_set_destroy(set);
8144 }
e5009240 8145 list_for_each_entry_safe(obj, ne, &table->objects, list) {
d152159b 8146 nft_obj_del(obj);
e5009240 8147 table->use--;
00bfb320 8148 nft_obj_destroy(&ctx, obj);
e5009240 8149 }
df05ef87 8150 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 8151 ctx.chain = chain;
1b2470e5 8152 nft_chain_del(chain);
df05ef87 8153 table->use--;
43a605f2 8154 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 8155 }
8156 list_del(&table->list);
8157 nf_tables_table_destroy(&ctx);
8158 }
8159}
8160
dd4cbef7
PNA		 8161static int __net_init nf_tables_init_net(struct net *net)
8162{
8163 INIT_LIST_HEAD(&net->nft.tables);
8164 INIT_LIST_HEAD(&net->nft.commit_list);
eb014de4 8165 INIT_LIST_HEAD(&net->nft.module_list);
f102d66b 8166 mutex_init(&net->nft.commit_mutex);
dd4cbef7 8167 net->nft.base_seq = 1;
a654de8f
PNA		 8168 net->nft.validate_state = NFT_VALIDATE_SKIP;
8169
dd4cbef7
PNA		 8170 return 0;
8171}
8172
8173static void __net_exit nf_tables_exit_net(struct net *net)
8174{
f102d66b 8175 mutex_lock(&net->nft.commit_mutex);
71ad00c5 8176 if (!list_empty(&net->nft.commit_list))
eb014de4 8177 __nf_tables_abort(net, false);
98319cb9 8178 __nft_release_tables(net);
f102d66b 8179 mutex_unlock(&net->nft.commit_mutex);
dd4cbef7 8180 WARN_ON_ONCE(!list_empty(&net->nft.tables));
1d305ba4 8181 WARN_ON_ONCE(!list_empty(&net->nft.module_list));
dd4cbef7
PNA		 8182}
8183
99633ab2
PNA		 8184static struct pernet_operations nf_tables_net_ops = {
8185 .init = nf_tables_init_net,
613d0776 8186 .exit = nf_tables_exit_net,
99633ab2
PNA		 8187};
8188
96518518
PM		 8189static int __init nf_tables_module_init(void)
8190{
8191 int err;
8192
0935d558 8193 spin_lock_init(&nf_tables_destroy_list_lock);
d209df3e
FW		 8194 err = register_pernet_subsys(&nf_tables_net_ops);
8195 if (err < 0)
8196 return err;
8197
8198 err = nft_chain_filter_init();
8199 if (err < 0)
8200 goto err1;
02c7b25e 8201
96518518
PM		 8202 err = nf_tables_core_module_init();
8203 if (err < 0)
d209df3e 8204 goto err2;
96518518 8205
d209df3e 8206 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
96518518 8207 if (err < 0)
d209df3e 8208 goto err3;
96518518 8209
4d44175a
FW		 8210 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
8211 if (err < 0)
8212 goto err4;
8213
06d392cb 8214 err = nft_offload_init();
8215 if (err < 0)
8216 goto err5;
8217
d209df3e
FW		 8218 /* must be last */
8219 err = nfnetlink_subsys_register(&nf_tables_subsys);
8220 if (err < 0)
06d392cb 8221 goto err6;
3b49e2e9 8222
c1deb065 8223 nft_chain_route_init();
3474a2c6 8224
d209df3e 8225 return err;
06d392cb 8226err6:
8227 nft_offload_exit();
4d44175a
FW		 8228err5:
8229 rhltable_destroy(&nft_objname_ht);
d209df3e
FW		 8230err4:
8231 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
8232err3:
96518518 8233 nf_tables_core_module_exit();
d209df3e
FW		 8234err2:
8235 nft_chain_filter_fini();
8236err1:
8237 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 8238 return err;
8239}
8240
8241static void __exit nf_tables_module_exit(void)
8242{
8243 nfnetlink_subsys_unregister(&nf_tables_subsys);
06d392cb 8244 nft_offload_exit();
3b49e2e9 8245 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
0a2cf5ee 8246 nft_chain_filter_fini();
c1deb065 8247 nft_chain_route_fini();
71ad00c5 8248 unregister_pernet_subsys(&nf_tables_net_ops);
0935d558 8249 cancel_work_sync(&trans_destroy_work);
1b1bc49c 8250 rcu_barrier();
4d44175a 8251 rhltable_destroy(&nft_objname_ht);
96518518 8252 nf_tables_core_module_exit();
96518518
PM		 8253}
8254
8255module_init(nf_tables_module_init);
8256module_exit(nf_tables_module_exit);
8257
8258MODULE_LICENSE("GPL");
8259MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
8260MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror