]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: xtables: allow table definitions not backed by hook_ops
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
96518518
PM		 17#include <linux/netfilter.h>
18#include <linux/netfilter/nfnetlink.h>
19#include <linux/netfilter/nf_tables.h>
3b49e2e9 20#include <net/netfilter/nf_flow_table.h>
96518518
PM		 21#include <net/netfilter/nf_tables_core.h>
22#include <net/netfilter/nf_tables.h>
99633ab2 23#include <net/net_namespace.h>
96518518
PM		 24#include <net/sock.h>
25
96518518 26static LIST_HEAD(nf_tables_expressions);
e5009240 27static LIST_HEAD(nf_tables_objects);
3b49e2e9 28static LIST_HEAD(nf_tables_flowtables);
3ecbfd65 29static u64 table_handle;
96518518 30
7c95f6d8 31static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 32 struct net *net,
7c95f6d8
PNA		 33 const struct sk_buff *skb,
34 const struct nlmsghdr *nlh,
36596dad 35 u8 family,
7c95f6d8
PNA		 36 struct nft_table *table,
37 struct nft_chain *chain,
38 const struct nlattr * const *nla)
39{
633c9a84 40 ctx->net = net;
36596dad 41 ctx->family = family;
128ad332
PNA		 42 ctx->table = table;
43 ctx->chain = chain;
44 ctx->nla = nla;
45 ctx->portid = NETLINK_CB(skb).portid;
46 ctx->report = nlmsg_report(nlh);
47 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 48}
49
8411b644
PNA		 50static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
51 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 52{
53 struct nft_trans *trans;
54
8411b644 55 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 56 if (trans == NULL)
57 return NULL;
58
b380e5c7 59 trans->msg_type = msg_type;
1081d11b
PNA		 60 trans->ctx = *ctx;
61
62 return trans;
63}
64
8411b644
PNA		 65static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
66 int msg_type, u32 size)
67{
68 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
69}
70
1081d11b
PNA		 71static void nft_trans_destroy(struct nft_trans *trans)
72{
73 list_del(&trans->list);
74 kfree(trans);
75}
76
ae6153b5
FW		 77/* removal requests are queued in the commit_list, but not acted upon
78 * until after all new rules are in place.
79 *
80 * Therefore, nf_register_net_hook(net, &nat_hook) runs before pending
81 * nf_unregister_net_hook().
82 *
83 * nf_register_net_hook thus fails if a nat hook is already in place
84 * even if the conflicting hook is about to be removed.
85 *
86 * If collision is detected, search commit_log for DELCHAIN matching
87 * the new nat hooknum; if we find one collision is temporary:
88 *
89 * Either transaction is aborted (new/colliding hook is removed), or
90 * transaction is committed (old hook is removed).
91 */
92static bool nf_tables_allow_nat_conflict(const struct net *net,
93 const struct nf_hook_ops *ops)
94{
95 const struct nft_trans *trans;
96 bool ret = false;
97
98 if (!ops->nat_hook)
99 return false;
100
101 list_for_each_entry(trans, &net->nft.commit_list, list) {
102 const struct nf_hook_ops *pending_ops;
103 const struct nft_chain *pending;
104
105 if (trans->msg_type != NFT_MSG_NEWCHAIN &&
106 trans->msg_type != NFT_MSG_DELCHAIN)
107 continue;
108
109 pending = trans->ctx.chain;
110 if (!nft_is_base_chain(pending))
111 continue;
112
113 pending_ops = &nft_base_chain(pending)->ops;
114 if (pending_ops->nat_hook &&
115 pending_ops->pf == ops->pf &&
116 pending_ops->hooknum == ops->hooknum) {
117 /* other hook registration already pending? */
118 if (trans->msg_type == NFT_MSG_NEWCHAIN)
119 return false;
120
121 ret = true;
122 }
123 }
124
125 return ret;
126}
127
c974a3a3
PNA		 128static int nf_tables_register_hook(struct net *net,
129 const struct nft_table *table,
130 struct nft_chain *chain)
d8ee8f7c 131{
ae6153b5
FW		 132 struct nf_hook_ops *ops;
133 int ret;
134
d8ee8f7c 135 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 136 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 137 return 0;
138
ae6153b5
FW		 139 ops = &nft_base_chain(chain)->ops;
140 ret = nf_register_net_hook(net, ops);
141 if (ret == -EBUSY && nf_tables_allow_nat_conflict(net, ops)) {
142 ops->nat_hook = false;
143 ret = nf_register_net_hook(net, ops);
144 ops->nat_hook = true;
145 }
146
147 return ret;
d8ee8f7c
PNA		 148}
149
c974a3a3
PNA		 150static void nf_tables_unregister_hook(struct net *net,
151 const struct nft_table *table,
152 struct nft_chain *chain)
c5598794 153{
d8ee8f7c 154 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 155 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 156 return;
157
c974a3a3 158 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
c5598794
AB		 159}
160
ee01d542
AB		 161static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
162{
163 struct nft_trans *trans;
164
165 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
166 if (trans == NULL)
167 return -ENOMEM;
168
169 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 170 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 171
172 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
173 return 0;
174}
175
176static int nft_deltable(struct nft_ctx *ctx)
177{
178 int err;
179
180 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
181 if (err < 0)
182 return err;
183
f2a6d766 184 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 185 return err;
186}
187
188static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
189{
190 struct nft_trans *trans;
191
192 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
193 if (trans == NULL)
194 return -ENOMEM;
195
196 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 197 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 198
199 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
200 return 0;
201}
202
203static int nft_delchain(struct nft_ctx *ctx)
204{
205 int err;
206
207 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
208 if (err < 0)
209 return err;
210
211 ctx->table->use--;
664b0f8c 212 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 213
214 return err;
215}
216
ee01d542
AB		 217static int
218nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
219{
220 /* You cannot delete the same rule twice */
889f7ee7
PNA		 221 if (nft_is_active_next(ctx->net, rule)) {
222 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 223 ctx->chain->use--;
224 return 0;
225 }
226 return -ENOENT;
227}
228
229static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
230 struct nft_rule *rule)
231{
232 struct nft_trans *trans;
233
234 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
235 if (trans == NULL)
236 return NULL;
237
1a94e38d
PNA		 238 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
239 nft_trans_rule_id(trans) =
240 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
241 }
ee01d542
AB		 242 nft_trans_rule(trans) = rule;
243 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
244
245 return trans;
246}
247
248static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
249{
250 struct nft_trans *trans;
251 int err;
252
253 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
254 if (trans == NULL)
255 return -ENOMEM;
256
257 err = nf_tables_delrule_deactivate(ctx, rule);
258 if (err < 0) {
259 nft_trans_destroy(trans);
260 return err;
261 }
262
263 return 0;
264}
265
266static int nft_delrule_by_chain(struct nft_ctx *ctx)
267{
268 struct nft_rule *rule;
269 int err;
270
271 list_for_each_entry(rule, &ctx->chain->rules, list) {
272 err = nft_delrule(ctx, rule);
273 if (err < 0)
274 return err;
275 }
276 return 0;
277}
278
ee01d542
AB		 279static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
280 struct nft_set *set)
281{
282 struct nft_trans *trans;
283
284 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
285 if (trans == NULL)
286 return -ENOMEM;
287
288 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
289 nft_trans_set_id(trans) =
290 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 291 nft_activate_next(ctx->net, set);
ee01d542
AB		 292 }
293 nft_trans_set(trans) = set;
294 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
295
296 return 0;
297}
298
299static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
300{
301 int err;
302
303 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
304 if (err < 0)
305 return err;
306
37a9cc52 307 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 308 ctx->table->use--;
309
310 return err;
311}
312
e5009240
PNA		 313static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
314 struct nft_object *obj)
315{
316 struct nft_trans *trans;
317
318 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
319 if (trans == NULL)
320 return -ENOMEM;
321
322 if (msg_type == NFT_MSG_NEWOBJ)
323 nft_activate_next(ctx->net, obj);
324
325 nft_trans_obj(trans) = obj;
326 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
327
328 return 0;
329}
330
331static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
332{
333 int err;
334
335 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
336 if (err < 0)
337 return err;
338
339 nft_deactivate_next(ctx->net, obj);
340 ctx->table->use--;
341
342 return err;
343}
344
3b49e2e9
PNA		 345static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
346 struct nft_flowtable *flowtable)
347{
348 struct nft_trans *trans;
349
350 trans = nft_trans_alloc(ctx, msg_type,
351 sizeof(struct nft_trans_flowtable));
352 if (trans == NULL)
353 return -ENOMEM;
354
355 if (msg_type == NFT_MSG_NEWFLOWTABLE)
356 nft_activate_next(ctx->net, flowtable);
357
358 nft_trans_flowtable(trans) = flowtable;
359 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
360
361 return 0;
362}
363
364static int nft_delflowtable(struct nft_ctx *ctx,
365 struct nft_flowtable *flowtable)
366{
367 int err;
368
369 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
370 if (err < 0)
371 return err;
372
373 nft_deactivate_next(ctx->net, flowtable);
374 ctx->table->use--;
375
376 return err;
377}
378
96518518
PM		 379/*
380 * Tables
381 */
382
36596dad 383static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 384 const struct nlattr *nla,
36596dad 385 u8 family, u8 genmask)
96518518
PM		 386{
387 struct nft_table *table;
388
cac20fcd
PNA		 389 if (nla == NULL)
390 return ERR_PTR(-EINVAL);
391
36596dad 392 list_for_each_entry(table, &net->nft.tables, list) {
f2a6d766 393 if (!nla_strcmp(nla, table->name) &&
98319cb9 394 table->family == family &&
f2a6d766 395 nft_active_genmask(table, genmask))
96518518
PM		 396 return table;
397 }
cac20fcd
PNA		 398
399 return ERR_PTR(-ENOENT);
96518518
PM		 400}
401
3ecbfd65
HS		 402static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
403 const struct nlattr *nla,
404 u8 genmask)
405{
406 struct nft_table *table;
407
408 list_for_each_entry(table, &net->nft.tables, list) {
409 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
410 nft_active_genmask(table, genmask))
411 return table;
412 }
3ecbfd65
HS		 413
414 return ERR_PTR(-ENOENT);
415}
416
96518518
PM		 417static inline u64 nf_tables_alloc_handle(struct nft_table *table)
418{
419 return ++table->hgenerator;
420}
421
32537e91 422static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 423
32537e91 424static const struct nft_chain_type *
1ea26cca 425__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 426{
427 int i;
428
baae3e62 429 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 430 if (chain_type[family][i] != NULL &&
431 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 432 return chain_type[family][i];
9370761c 433 }
baae3e62 434 return NULL;
9370761c
PNA		 435}
436
32537e91 437static const struct nft_chain_type *
1ea26cca 438nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload)
9370761c 439{
32537e91 440 const struct nft_chain_type *type;
9370761c 441
1ea26cca 442 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 443 if (type != NULL)
444 return type;
9370761c 445#ifdef CONFIG_MODULES
93b0806f 446 if (autoload) {
9370761c 447 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1ea26cca 448 request_module("nft-chain-%u-%.*s", family,
2fec6bb6 449 nla_len(nla), (const char *)nla_data(nla));
9370761c 450 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1ea26cca 451 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 452 if (type != NULL)
453 return ERR_PTR(-EAGAIN);
9370761c
PNA		 454 }
455#endif
93b0806f 456 return ERR_PTR(-ENOENT);
9370761c
PNA		 457}
458
96518518 459static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 460 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
461 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 462 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 463 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 464};
465
84d7fce6
PNA		 466static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
467 u32 portid, u32 seq, int event, u32 flags,
468 int family, const struct nft_table *table)
96518518
PM		 469{
470 struct nlmsghdr *nlh;
471 struct nfgenmsg *nfmsg;
472
dedb67c4 473 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 474 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
475 if (nlh == NULL)
476 goto nla_put_failure;
477
478 nfmsg = nlmsg_data(nlh);
479 nfmsg->nfgen_family = family;
480 nfmsg->version = NFNETLINK_V0;
84d7fce6 481 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 482
9ddf6323 483 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 484 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 485 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
486 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
487 NFTA_TABLE_PAD))
96518518
PM		 488 goto nla_put_failure;
489
053c095a
JB		 490 nlmsg_end(skb, nlh);
491 return 0;
96518518
PM		 492
493nla_put_failure:
494 nlmsg_trim(skb, nlh);
495 return -1;
496}
497
25e94a99 498static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 499{
500 struct sk_buff *skb;
96518518
PM		 501 int err;
502
128ad332
PNA		 503 if (!ctx->report &&
504 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 505 return;
96518518 506
96518518
PM		 507 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
508 if (skb == NULL)
509 goto err;
510
84d7fce6 511 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 512 event, 0, ctx->family, ctx->table);
96518518
PM		 513 if (err < 0) {
514 kfree_skb(skb);
515 goto err;
516 }
517
25e94a99
PNA		 518 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
519 ctx->report, GFP_KERNEL);
520 return;
96518518 521err:
25e94a99 522 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 523}
524
525static int nf_tables_dump_tables(struct sk_buff *skb,
526 struct netlink_callback *cb)
527{
528 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 529 const struct nft_table *table;
530 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 531 struct net *net = sock_net(skb->sk);
96518518
PM		 532 int family = nfmsg->nfgen_family;
533
e688a7f8 534 rcu_read_lock();
38e029f1
PNA		 535 cb->seq = net->nft.base_seq;
536
36596dad 537 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 538 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 539 continue;
540
36596dad
PNA		 541 if (idx < s_idx)
542 goto cont;
543 if (idx > s_idx)
544 memset(&cb->args[1], 0,
545 sizeof(cb->args) - sizeof(cb->args[0]));
546 if (!nft_is_active(net, table))
547 continue;
548 if (nf_tables_fill_table_info(skb, net,
549 NETLINK_CB(cb->skb).portid,
550 cb->nlh->nlmsg_seq,
551 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 552 table->family, table) < 0)
36596dad
PNA		 553 goto done;
554
555 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 556cont:
36596dad 557 idx++;
96518518
PM		 558 }
559done:
e688a7f8 560 rcu_read_unlock();
96518518
PM		 561 cb->args[0] = idx;
562 return skb->len;
563}
564
7b8002a1
PNA		 565static int nf_tables_gettable(struct net *net, struct sock *nlsk,
566 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 567 const struct nlattr * const nla[],
568 struct netlink_ext_ack *extack)
96518518
PM		 569{
570 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 571 u8 genmask = nft_genmask_cur(net);
96518518
PM		 572 const struct nft_table *table;
573 struct sk_buff *skb2;
574 int family = nfmsg->nfgen_family;
575 int err;
576
577 if (nlh->nlmsg_flags & NLM_F_DUMP) {
578 struct netlink_dump_control c = {
579 .dump = nf_tables_dump_tables,
580 };
581 return netlink_dump_start(nlsk, skb, nlh, &c);
582 }
583
cac20fcd 584 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 585 if (IS_ERR(table)) {
586 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 587 return PTR_ERR(table);
36dd1bcc 588 }
96518518
PM		 589
590 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
591 if (!skb2)
592 return -ENOMEM;
593
84d7fce6 594 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 595 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
596 family, table);
597 if (err < 0)
598 goto err;
599
600 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
601
602err:
603 kfree_skb(skb2);
604 return err;
605}
606
c9c17211 607static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 608{
609 struct nft_chain *chain;
610 u32 i = 0;
611
612 list_for_each_entry(chain, &table->chains, list) {
613 if (!nft_is_active_next(net, chain))
614 continue;
f323d954 615 if (!nft_is_base_chain(chain))
10435c11
F		 616 continue;
617
618 if (cnt && i++ == cnt)
619 break;
620
c974a3a3 621 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 622 }
623}
624
c9c17211 625static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 626{
627 struct nft_chain *chain;
628 int err, i = 0;
629
630 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 631 if (!nft_is_active_next(net, chain))
632 continue;
f323d954 633 if (!nft_is_base_chain(chain))
d2012975
PNA		 634 continue;
635
c974a3a3 636 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 637 if (err < 0)
638 goto err;
639
640 i++;
641 }
642 return 0;
643err:
10435c11 644 if (i)
c9c17211 645 nft_table_disable(net, table, i);
9ddf6323
PNA		 646 return err;
647}
648
c9c17211 649static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 650{
c9c17211 651 nft_table_disable(net, table, 0);
9ddf6323
PNA		 652}
653
e1aaca93 654static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 655{
55dd6f93 656 struct nft_trans *trans;
e1aaca93 657 u32 flags;
55dd6f93 658 int ret = 0;
9ddf6323 659
e1aaca93
PNA		 660 if (!ctx->nla[NFTA_TABLE_FLAGS])
661 return 0;
9ddf6323 662
e1aaca93
PNA		 663 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
664 if (flags & ~NFT_TABLE_F_DORMANT)
665 return -EINVAL;
666
63283dd2
PNA		 667 if (flags == ctx->table->flags)
668 return 0;
669
55dd6f93
PNA		 670 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
671 sizeof(struct nft_trans_table));
672 if (trans == NULL)
673 return -ENOMEM;
9ddf6323 674
e1aaca93
PNA		 675 if ((flags & NFT_TABLE_F_DORMANT) &&
676 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 677 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 678 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
679 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 680 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 681 if (ret >= 0) {
e1aaca93 682 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 683 nft_trans_table_enable(trans) = true;
9ddf6323 684 }
9ddf6323 685 }
e1aaca93
PNA		 686 if (ret < 0)
687 goto err;
9ddf6323 688
55dd6f93
PNA		 689 nft_trans_table_update(trans) = true;
690 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
691 return 0;
9ddf6323 692err:
55dd6f93 693 nft_trans_destroy(trans);
9ddf6323
PNA		 694 return ret;
695}
696
633c9a84
PNA		 697static int nf_tables_newtable(struct net *net, struct sock *nlsk,
698 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 699 const struct nlattr * const nla[],
700 struct netlink_ext_ack *extack)
96518518
PM		 701{
702 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 703 u8 genmask = nft_genmask_next(net);
96518518 704 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 705 const struct nlattr *attr;
706 struct nft_table *table;
c5c1f975 707 u32 flags = 0;
e1aaca93 708 struct nft_ctx ctx;
55dd6f93 709 int err;
96518518 710
36dd1bcc
PNA		 711 attr = nla[NFTA_TABLE_NAME];
712 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 713 if (IS_ERR(table)) {
714 if (PTR_ERR(table) != -ENOENT)
715 return PTR_ERR(table);
1a28ad74 716 } else {
36dd1bcc
PNA		 717 if (nlh->nlmsg_flags & NLM_F_EXCL) {
718 NL_SET_BAD_ATTR(extack, attr);
96518518 719 return -EEXIST;
36dd1bcc 720 }
96518518
PM		 721 if (nlh->nlmsg_flags & NLM_F_REPLACE)
722 return -EOPNOTSUPP;
e1aaca93 723
98319cb9 724 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 725 return nf_tables_updtable(&ctx);
96518518
PM		 726 }
727
c5c1f975
PM		 728 if (nla[NFTA_TABLE_FLAGS]) {
729 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
730 if (flags & ~NFT_TABLE_F_DORMANT)
731 return -EINVAL;
732 }
733
ffdb210e 734 err = -ENOMEM;
1cae565e 735 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 736 if (table == NULL)
98319cb9 737 goto err_kzalloc;
96518518 738
36dd1bcc 739 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 740 if (table->name == NULL)
98319cb9 741 goto err_strdup;
e46abbcc 742
96518518 743 INIT_LIST_HEAD(&table->chains);
20a69341 744 INIT_LIST_HEAD(&table->sets);
e5009240 745 INIT_LIST_HEAD(&table->objects);
3b49e2e9 746 INIT_LIST_HEAD(&table->flowtables);
98319cb9 747 table->family = family;
c5c1f975 748 table->flags = flags;
3ecbfd65 749 table->handle = ++table_handle;
9ddf6323 750
98319cb9 751 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 752 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 753 if (err < 0)
98319cb9 754 goto err_trans;
ffdb210e 755
36596dad 756 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 757 return 0;
98319cb9 758err_trans:
e46abbcc 759 kfree(table->name);
98319cb9 760err_strdup:
ffdb210e 761 kfree(table);
98319cb9 762err_kzalloc:
ffdb210e 763 return err;
96518518
PM		 764}
765
b9ac12ef
AB		 766static int nft_flush_table(struct nft_ctx *ctx)
767{
3b49e2e9 768 struct nft_flowtable *flowtable, *nft;
b9ac12ef 769 struct nft_chain *chain, *nc;
e5009240 770 struct nft_object *obj, *ne;
b9ac12ef 771 struct nft_set *set, *ns;
3b49e2e9 772 int err;
b9ac12ef 773
a2f18db0 774 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 775 if (!nft_is_active_next(ctx->net, chain))
776 continue;
777
b9ac12ef
AB		 778 ctx->chain = chain;
779
780 err = nft_delrule_by_chain(ctx);
781 if (err < 0)
782 goto out;
b9ac12ef
AB		 783 }
784
785 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 786 if (!nft_is_active_next(ctx->net, set))
787 continue;
788
408070d6 789 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 790 !list_empty(&set->bindings))
791 continue;
792
793 err = nft_delset(ctx, set);
794 if (err < 0)
795 goto out;
796 }
797
3b49e2e9
PNA		 798 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
799 err = nft_delflowtable(ctx, flowtable);
800 if (err < 0)
801 goto out;
802 }
803
e5009240
PNA		 804 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
805 err = nft_delobj(ctx, obj);
806 if (err < 0)
807 goto out;
808 }
809
a2f18db0 810 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 811 if (!nft_is_active_next(ctx->net, chain))
812 continue;
813
a2f18db0
PNA		 814 ctx->chain = chain;
815
816 err = nft_delchain(ctx);
817 if (err < 0)
818 goto out;
819 }
820
b9ac12ef
AB		 821 err = nft_deltable(ctx);
822out:
823 return err;
824}
825
826static int nft_flush(struct nft_ctx *ctx, int family)
827{
b9ac12ef
AB		 828 struct nft_table *table, *nt;
829 const struct nlattr * const *nla = ctx->nla;
830 int err = 0;
831
36596dad 832 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 833 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 834 continue;
835
98319cb9 836 ctx->family = table->family;
f2a6d766 837
36596dad
PNA		 838 if (!nft_is_active_next(ctx->net, table))
839 continue;
b9ac12ef 840
36596dad
PNA		 841 if (nla[NFTA_TABLE_NAME] &&
842 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
843 continue;
b9ac12ef 844
36596dad
PNA		 845 ctx->table = table;
846
847 err = nft_flush_table(ctx);
848 if (err < 0)
849 goto out;
b9ac12ef
AB		 850 }
851out:
852 return err;
853}
854
633c9a84
PNA		 855static int nf_tables_deltable(struct net *net, struct sock *nlsk,
856 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 857 const struct nlattr * const nla[],
858 struct netlink_ext_ack *extack)
96518518
PM		 859{
860 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 861 u8 genmask = nft_genmask_next(net);
ee01d542 862 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 863 const struct nlattr *attr;
864 struct nft_table *table;
55dd6f93 865 struct nft_ctx ctx;
96518518 866
36596dad 867 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 868 if (family == AF_UNSPEC ||
869 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 870 return nft_flush(&ctx, family);
871
36dd1bcc
PNA		 872 if (nla[NFTA_TABLE_HANDLE]) {
873 attr = nla[NFTA_TABLE_HANDLE];
874 table = nft_table_lookup_byhandle(net, attr, genmask);
875 } else {
876 attr = nla[NFTA_TABLE_NAME];
877 table = nft_table_lookup(net, attr, family, genmask);
878 }
3ecbfd65 879
36dd1bcc
PNA		 880 if (IS_ERR(table)) {
881 NL_SET_BAD_ATTR(extack, attr);
96518518 882 return PTR_ERR(table);
36dd1bcc 883 }
96518518 884
a8278400
PNA		 885 if (nlh->nlmsg_flags & NLM_F_NONREC &&
886 table->use > 0)
887 return -EBUSY;
888
98319cb9 889 ctx.family = family;
b9ac12ef 890 ctx.table = table;
55dd6f93 891
b9ac12ef 892 return nft_flush_table(&ctx);
96518518
PM		 893}
894
55dd6f93
PNA		 895static void nf_tables_table_destroy(struct nft_ctx *ctx)
896{
4fefee57
PNA		 897 BUG_ON(ctx->table->use > 0);
898
e46abbcc 899 kfree(ctx->table->name);
55dd6f93 900 kfree(ctx->table);
55dd6f93
PNA		 901}
902
cc07eeb0 903void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 904{
d8297d4f 905 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
cc07eeb0 906 return;
d8297d4f 907
96518518 908 nfnl_lock(NFNL_SUBSYS_NFTABLES);
cc07eeb0
PNA		 909 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
910 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
911 return;
96518518 912 }
9370761c 913 chain_type[ctype->family][ctype->type] = ctype;
96518518 914 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 915}
9370761c 916EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 917
32537e91 918void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 919{
96518518 920 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 921 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 922 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
923}
9370761c 924EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 925
926/*
927 * Chains
928 */
929
930static struct nft_chain *
cac20fcd 931nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 932{
933 struct nft_chain *chain;
934
935 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 936 if (chain->handle == handle &&
937 nft_active_genmask(chain, genmask))
96518518
PM		 938 return chain;
939 }
940
941 return ERR_PTR(-ENOENT);
942}
943
cac20fcd
PNA		 944static struct nft_chain *nft_chain_lookup(const struct nft_table *table,
945 const struct nlattr *nla, u8 genmask)
96518518
PM		 946{
947 struct nft_chain *chain;
948
949 if (nla == NULL)
950 return ERR_PTR(-EINVAL);
951
952 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 953 if (!nla_strcmp(nla, chain->name) &&
954 nft_active_genmask(chain, genmask))
96518518
PM		 955 return chain;
956 }
957
958 return ERR_PTR(-ENOENT);
959}
960
961static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 962 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
963 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 964 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
965 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
966 .len = NFT_CHAIN_MAXNAMELEN - 1 },
967 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 968 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 969 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 970 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 971};
972
973static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
974 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
975 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 976 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
977 .len = IFNAMSIZ - 1 },
96518518
PM		 978};
979
0ca743a5
PNA		 980static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
981{
982 struct nft_stats *cpu_stats, total;
983 struct nlattr *nest;
ce355e20
ED		 984 unsigned int seq;
985 u64 pkts, bytes;
0ca743a5
PNA		 986 int cpu;
987
988 memset(&total, 0, sizeof(total));
989 for_each_possible_cpu(cpu) {
990 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 991 do {
992 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
993 pkts = cpu_stats->pkts;
994 bytes = cpu_stats->bytes;
995 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
996 total.pkts += pkts;
997 total.bytes += bytes;
0ca743a5
PNA		 998 }
999 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1000 if (nest == NULL)
1001 goto nla_put_failure;
1002
b46f6ded
ND		 1003 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1004 NFTA_COUNTER_PAD) ||
1005 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1006 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1007 goto nla_put_failure;
1008
1009 nla_nest_end(skb, nest);
1010 return 0;
1011
1012nla_put_failure:
1013 return -ENOSPC;
1014}
1015
84d7fce6
PNA		 1016static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1017 u32 portid, u32 seq, int event, u32 flags,
1018 int family, const struct nft_table *table,
96518518
PM		 1019 const struct nft_chain *chain)
1020{
1021 struct nlmsghdr *nlh;
1022 struct nfgenmsg *nfmsg;
1023
dedb67c4 1024 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1025 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1026 if (nlh == NULL)
1027 goto nla_put_failure;
1028
1029 nfmsg = nlmsg_data(nlh);
1030 nfmsg->nfgen_family = family;
1031 nfmsg->version = NFNETLINK_V0;
84d7fce6 1032 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1033
1034 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1035 goto nla_put_failure;
b46f6ded
ND		 1036 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1037 NFTA_CHAIN_PAD))
96518518
PM		 1038 goto nla_put_failure;
1039 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1040 goto nla_put_failure;
1041
f323d954 1042 if (nft_is_base_chain(chain)) {
0ca743a5 1043 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1044 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1045 struct nlattr *nest;
1046
1047 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1048 if (nest == NULL)
1049 goto nla_put_failure;
1050 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1051 goto nla_put_failure;
1052 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1053 goto nla_put_failure;
2cbce139
PNA		 1054 if (basechain->dev_name[0] &&
1055 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1056 goto nla_put_failure;
96518518 1057 nla_nest_end(skb, nest);
9370761c 1058
0ca743a5
PNA		 1059 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1060 htonl(basechain->policy)))
1061 goto nla_put_failure;
1062
baae3e62
PM		 1063 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1064 goto nla_put_failure;
0ca743a5 1065
5f9bfe0e 1066 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
0ca743a5 1067 goto nla_put_failure;
96518518
PM		 1068 }
1069
0ca743a5
PNA		 1070 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1071 goto nla_put_failure;
1072
053c095a
JB		 1073 nlmsg_end(skb, nlh);
1074 return 0;
96518518
PM		 1075
1076nla_put_failure:
1077 nlmsg_trim(skb, nlh);
1078 return -1;
1079}
1080
25e94a99 1081static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1082{
1083 struct sk_buff *skb;
96518518
PM		 1084 int err;
1085
128ad332
PNA		 1086 if (!ctx->report &&
1087 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1088 return;
96518518 1089
96518518
PM		 1090 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1091 if (skb == NULL)
1092 goto err;
1093
84d7fce6 1094 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1095 event, 0, ctx->family, ctx->table,
35151d84 1096 ctx->chain);
96518518
PM		 1097 if (err < 0) {
1098 kfree_skb(skb);
1099 goto err;
1100 }
1101
25e94a99
PNA		 1102 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1103 ctx->report, GFP_KERNEL);
1104 return;
96518518 1105err:
25e94a99 1106 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1107}
1108
1109static int nf_tables_dump_chains(struct sk_buff *skb,
1110 struct netlink_callback *cb)
1111{
1112 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1113 const struct nft_table *table;
1114 const struct nft_chain *chain;
1115 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1116 struct net *net = sock_net(skb->sk);
96518518
PM		 1117 int family = nfmsg->nfgen_family;
1118
e688a7f8 1119 rcu_read_lock();
38e029f1
PNA		 1120 cb->seq = net->nft.base_seq;
1121
36596dad 1122 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1123 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1124 continue;
1125
36596dad
PNA		 1126 list_for_each_entry_rcu(chain, &table->chains, list) {
1127 if (idx < s_idx)
1128 goto cont;
1129 if (idx > s_idx)
1130 memset(&cb->args[1], 0,
1131 sizeof(cb->args) - sizeof(cb->args[0]));
1132 if (!nft_is_active(net, chain))
1133 continue;
1134 if (nf_tables_fill_chain_info(skb, net,
1135 NETLINK_CB(cb->skb).portid,
1136 cb->nlh->nlmsg_seq,
1137 NFT_MSG_NEWCHAIN,
1138 NLM_F_MULTI,
98319cb9 1139 table->family, table,
36596dad
PNA		 1140 chain) < 0)
1141 goto done;
38e029f1 1142
36596dad 1143 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1144cont:
36596dad 1145 idx++;
96518518
PM		 1146 }
1147 }
1148done:
e688a7f8 1149 rcu_read_unlock();
96518518
PM		 1150 cb->args[0] = idx;
1151 return skb->len;
1152}
1153
7b8002a1
PNA		 1154static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1155 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1156 const struct nlattr * const nla[],
1157 struct netlink_ext_ack *extack)
96518518
PM		 1158{
1159 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1160 u8 genmask = nft_genmask_cur(net);
96518518
PM		 1161 const struct nft_table *table;
1162 const struct nft_chain *chain;
1163 struct sk_buff *skb2;
1164 int family = nfmsg->nfgen_family;
1165 int err;
1166
1167 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1168 struct netlink_dump_control c = {
1169 .dump = nf_tables_dump_chains,
1170 };
1171 return netlink_dump_start(nlsk, skb, nlh, &c);
1172 }
1173
cac20fcd 1174 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1175 if (IS_ERR(table)) {
1176 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1177 return PTR_ERR(table);
36dd1bcc 1178 }
96518518 1179
cac20fcd 1180 chain = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1181 if (IS_ERR(chain)) {
1182 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1183 return PTR_ERR(chain);
36dd1bcc 1184 }
96518518
PM		 1185
1186 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1187 if (!skb2)
1188 return -ENOMEM;
1189
84d7fce6 1190 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1191 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1192 family, table, chain);
1193 if (err < 0)
1194 goto err;
1195
1196 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1197
1198err:
1199 kfree_skb(skb2);
1200 return err;
1201}
1202
0ca743a5
PNA		 1203static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1204 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1205 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1206};
1207
ff3cd7b3 1208static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1209{
1210 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1211 struct nft_stats __percpu *newstats;
1212 struct nft_stats *stats;
1213 int err;
1214
fceb6435
JB		 1215 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1216 NULL);
0ca743a5 1217 if (err < 0)
ff3cd7b3 1218 return ERR_PTR(err);
0ca743a5
PNA		 1219
1220 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1221 return ERR_PTR(-EINVAL);
0ca743a5 1222
ce355e20 1223 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1224 if (newstats == NULL)
ff3cd7b3 1225 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1226
1227 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1228 * are not exposed to userspace.
1229 */
e8781f70 1230 preempt_disable();
0ca743a5
PNA		 1231 stats = this_cpu_ptr(newstats);
1232 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1233 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1234 preempt_enable();
0ca743a5 1235
ff3cd7b3
PNA		 1236 return newstats;
1237}
1238
1239static void nft_chain_stats_replace(struct nft_base_chain *chain,
1240 struct nft_stats __percpu *newstats)
1241{
0befd061
PNA		 1242 struct nft_stats __percpu *oldstats;
1243
b88825de
PNA		 1244 if (newstats == NULL)
1245 return;
1246
0ca743a5 1247 if (chain->stats) {
0befd061 1248 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
0ca743a5
PNA		 1249 rcu_assign_pointer(chain->stats, newstats);
1250 synchronize_rcu();
1251 free_percpu(oldstats);
1252 } else
1253 rcu_assign_pointer(chain->stats, newstats);
0ca743a5
PNA		 1254}
1255
43a605f2 1256static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1257{
43a605f2
PNA		 1258 struct nft_chain *chain = ctx->chain;
1259
91c7b38d
PNA		 1260 BUG_ON(chain->use > 0);
1261
f323d954 1262 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1263 struct nft_base_chain *basechain = nft_base_chain(chain);
1264
43a605f2
PNA		 1265 if (basechain->type->free)
1266 basechain->type->free(ctx);
2cbce139
PNA		 1267 module_put(basechain->type->owner);
1268 free_percpu(basechain->stats);
9f08ea84
PNA		 1269 if (basechain->stats)
1270 static_branch_dec(&nft_counters_enabled);
b7263e07 1271 kfree(chain->name);
2cbce139 1272 kfree(basechain);
91c7b38d 1273 } else {
b7263e07 1274 kfree(chain->name);
91c7b38d
PNA		 1275 kfree(chain);
1276 }
1277}
1278
508f8ccd
PNA		 1279struct nft_chain_hook {
1280 u32 num;
84ba7dd7 1281 s32 priority;
32537e91 1282 const struct nft_chain_type *type;
508f8ccd
PNA		 1283 struct net_device *dev;
1284};
1285
1286static int nft_chain_parse_hook(struct net *net,
1287 const struct nlattr * const nla[],
36596dad
PNA		 1288 struct nft_chain_hook *hook, u8 family,
1289 bool create)
508f8ccd
PNA		 1290{
1291 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1292 const struct nft_chain_type *type;
508f8ccd
PNA		 1293 struct net_device *dev;
1294 int err;
1295
1296 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1297 nft_hook_policy, NULL);
508f8ccd
PNA		 1298 if (err < 0)
1299 return err;
1300
1301 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1302 ha[NFTA_HOOK_PRIORITY] == NULL)
1303 return -EINVAL;
1304
1305 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1306 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1307
36596dad 1308 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1309 if (nla[NFTA_CHAIN_TYPE]) {
1ea26cca 1310 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
36596dad 1311 family, create);
508f8ccd
PNA		 1312 if (IS_ERR(type))
1313 return PTR_ERR(type);
1314 }
1315 if (!(type->hook_mask & (1 << hook->num)))
1316 return -EOPNOTSUPP;
84ba7dd7
FW		 1317
1318 if (type->type == NFT_CHAIN_T_NAT &&
1319 hook->priority <= NF_IP_PRI_CONNTRACK)
1320 return -EOPNOTSUPP;
1321
508f8ccd
PNA		 1322 if (!try_module_get(type->owner))
1323 return -ENOENT;
1324
1325 hook->type = type;
1326
1327 hook->dev = NULL;
36596dad 1328 if (family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1329 char ifname[IFNAMSIZ];
1330
1331 if (!ha[NFTA_HOOK_DEV]) {
1332 module_put(type->owner);
1333 return -EOPNOTSUPP;
1334 }
1335
1336 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
90d2723c 1337 dev = __dev_get_by_name(net, ifname);
508f8ccd
PNA		 1338 if (!dev) {
1339 module_put(type->owner);
1340 return -ENOENT;
1341 }
1342 hook->dev = dev;
1343 } else if (ha[NFTA_HOOK_DEV]) {
1344 module_put(type->owner);
1345 return -EOPNOTSUPP;
1346 }
1347
1348 return 0;
1349}
1350
1351static void nft_chain_release_hook(struct nft_chain_hook *hook)
1352{
1353 module_put(hook->type->owner);
508f8ccd
PNA		 1354}
1355
4035285f
PNA		 1356static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1357 u8 policy, bool create)
1358{
1359 const struct nlattr * const *nla = ctx->nla;
1360 struct nft_table *table = ctx->table;
4035285f
PNA		 1361 struct nft_base_chain *basechain;
1362 struct nft_stats __percpu *stats;
1363 struct net *net = ctx->net;
1364 struct nft_chain *chain;
4035285f
PNA		 1365 int err;
1366
1367 if (table->use == UINT_MAX)
1368 return -EOVERFLOW;
1369
1370 if (nla[NFTA_CHAIN_HOOK]) {
1371 struct nft_chain_hook hook;
1372 struct nf_hook_ops *ops;
4035285f 1373
36596dad 1374 err = nft_chain_parse_hook(net, nla, &hook, family, create);
4035285f
PNA		 1375 if (err < 0)
1376 return err;
1377
1378 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1379 if (basechain == NULL) {
1380 nft_chain_release_hook(&hook);
1381 return -ENOMEM;
1382 }
1383
1384 if (hook.dev != NULL)
1385 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1386
1387 if (nla[NFTA_CHAIN_COUNTERS]) {
1388 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1389 if (IS_ERR(stats)) {
1390 nft_chain_release_hook(&hook);
1391 kfree(basechain);
1392 return PTR_ERR(stats);
1393 }
1394 basechain->stats = stats;
1395 static_branch_inc(&nft_counters_enabled);
1396 }
1397
4035285f 1398 basechain->type = hook.type;
43a605f2
PNA		 1399 if (basechain->type->init)
1400 basechain->type->init(ctx);
1401
4035285f
PNA		 1402 chain = &basechain->chain;
1403
c974a3a3
PNA		 1404 ops = &basechain->ops;
1405 ops->pf = family;
1406 ops->hooknum = hook.num;
1407 ops->priority = hook.priority;
1408 ops->priv = chain;
c2f9eafe 1409 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1410 ops->dev = hook.dev;
c974a3a3
PNA		 1411
1412 if (basechain->type->type == NFT_CHAIN_T_NAT)
1413 ops->nat_hook = true;
4035285f
PNA		 1414
1415 chain->flags |= NFT_BASE_CHAIN;
1416 basechain->policy = policy;
1417 } else {
1418 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1419 if (chain == NULL)
1420 return -ENOMEM;
1421 }
43a605f2
PNA		 1422 ctx->chain = chain;
1423
4035285f
PNA		 1424 INIT_LIST_HEAD(&chain->rules);
1425 chain->handle = nf_tables_alloc_handle(table);
1426 chain->table = table;
1427 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1428 if (!chain->name) {
1429 err = -ENOMEM;
1430 goto err1;
1431 }
1432
c974a3a3 1433 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1434 if (err < 0)
1435 goto err1;
1436
4035285f
PNA		 1437 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1438 if (err < 0)
1439 goto err2;
1440
1441 table->use++;
1442 list_add_tail_rcu(&chain->list, &table->chains);
1443
1444 return 0;
1445err2:
c974a3a3 1446 nf_tables_unregister_hook(net, table, chain);
4035285f 1447err1:
43a605f2 1448 nf_tables_chain_destroy(ctx);
4035285f
PNA		 1449
1450 return err;
1451}
1452
2c4a488a
PNA		 1453static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1454 bool create)
1455{
1456 const struct nlattr * const *nla = ctx->nla;
1457 struct nft_table *table = ctx->table;
1458 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1459 struct nft_base_chain *basechain;
1460 struct nft_stats *stats = NULL;
1461 struct nft_chain_hook hook;
1462 const struct nlattr *name;
1463 struct nf_hook_ops *ops;
1464 struct nft_trans *trans;
c974a3a3 1465 int err;
2c4a488a
PNA		 1466
1467 if (nla[NFTA_CHAIN_HOOK]) {
1468 if (!nft_is_base_chain(chain))
1469 return -EBUSY;
1470
36596dad 1471 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
2c4a488a
PNA		 1472 create);
1473 if (err < 0)
1474 return err;
1475
1476 basechain = nft_base_chain(chain);
1477 if (basechain->type != hook.type) {
1478 nft_chain_release_hook(&hook);
1479 return -EBUSY;
1480 }
1481
c974a3a3
PNA		 1482 ops = &basechain->ops;
1483 if (ops->hooknum != hook.num ||
1484 ops->priority != hook.priority ||
1485 ops->dev != hook.dev) {
1486 nft_chain_release_hook(&hook);
1487 return -EBUSY;
2c4a488a
PNA		 1488 }
1489 nft_chain_release_hook(&hook);
1490 }
1491
1492 if (nla[NFTA_CHAIN_HANDLE] &&
1493 nla[NFTA_CHAIN_NAME]) {
1494 struct nft_chain *chain2;
1495
cac20fcd 1496 chain2 = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 1497 if (!IS_ERR(chain2))
1498 return -EEXIST;
2c4a488a
PNA		 1499 }
1500
1501 if (nla[NFTA_CHAIN_COUNTERS]) {
1502 if (!nft_is_base_chain(chain))
1503 return -EOPNOTSUPP;
1504
1505 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1506 if (IS_ERR(stats))
1507 return PTR_ERR(stats);
1508 }
1509
1510 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1511 sizeof(struct nft_trans_chain));
1512 if (trans == NULL) {
1513 free_percpu(stats);
1514 return -ENOMEM;
1515 }
1516
1517 nft_trans_chain_stats(trans) = stats;
1518 nft_trans_chain_update(trans) = true;
1519
1520 if (nla[NFTA_CHAIN_POLICY])
1521 nft_trans_chain_policy(trans) = policy;
1522 else
1523 nft_trans_chain_policy(trans) = -1;
1524
1525 name = nla[NFTA_CHAIN_NAME];
1526 if (nla[NFTA_CHAIN_HANDLE] && name) {
1527 nft_trans_chain_name(trans) =
1528 nla_strdup(name, GFP_KERNEL);
1529 if (!nft_trans_chain_name(trans)) {
1530 kfree(trans);
1531 free_percpu(stats);
1532 return -ENOMEM;
1533 }
1534 }
1535 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1536
1537 return 0;
1538}
1539
633c9a84
PNA		 1540static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1541 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1542 const struct nlattr * const nla[],
1543 struct netlink_ext_ack *extack)
96518518
PM		 1544{
1545 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 1546 u8 genmask = nft_genmask_next(net);
1547 int family = nfmsg->nfgen_family;
36dd1bcc 1548 const struct nlattr *attr;
96518518
PM		 1549 struct nft_table *table;
1550 struct nft_chain *chain;
57de2a0c 1551 u8 policy = NF_ACCEPT;
4035285f 1552 struct nft_ctx ctx;
96518518 1553 u64 handle = 0;
96518518
PM		 1554 bool create;
1555
1556 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1557
cac20fcd 1558 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1559 if (IS_ERR(table)) {
1560 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1561 return PTR_ERR(table);
36dd1bcc 1562 }
96518518 1563
96518518 1564 chain = NULL;
36dd1bcc 1565 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 1566
1567 if (nla[NFTA_CHAIN_HANDLE]) {
1568 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 1569 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 1570 if (IS_ERR(chain)) {
1571 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 1572 return PTR_ERR(chain);
36dd1bcc
PNA		 1573 }
1574 attr = nla[NFTA_CHAIN_HANDLE];
96518518 1575 } else {
36dd1bcc 1576 chain = nft_chain_lookup(table, attr, genmask);
96518518 1577 if (IS_ERR(chain)) {
36dd1bcc
PNA		 1578 if (PTR_ERR(chain) != -ENOENT) {
1579 NL_SET_BAD_ATTR(extack, attr);
96518518 1580 return PTR_ERR(chain);
36dd1bcc 1581 }
96518518
PM		 1582 chain = NULL;
1583 }
1584 }
1585
57de2a0c 1586 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 1587 if (chain != NULL &&
36dd1bcc
PNA		 1588 !nft_is_base_chain(chain)) {
1589 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 1590 return -EOPNOTSUPP;
36dd1bcc 1591 }
d6b6cb1d
PNA		 1592
1593 if (chain == NULL &&
36dd1bcc
PNA		 1594 nla[NFTA_CHAIN_HOOK] == NULL) {
1595 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 1596 return -EOPNOTSUPP;
36dd1bcc 1597 }
57de2a0c 1598
8f46df18 1599 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1600 switch (policy) {
1601 case NF_DROP:
1602 case NF_ACCEPT:
1603 break;
1604 default:
1605 return -EINVAL;
1606 }
1607 }
1608
98319cb9 1609 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 1610
96518518 1611 if (chain != NULL) {
36dd1bcc
PNA		 1612 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1613 NL_SET_BAD_ATTR(extack, attr);
96518518 1614 return -EEXIST;
36dd1bcc 1615 }
96518518
PM		 1616 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1617 return -EOPNOTSUPP;
1618
2c4a488a 1619 return nf_tables_updchain(&ctx, genmask, policy, create);
96518518
PM		 1620 }
1621
4035285f 1622 return nf_tables_addchain(&ctx, family, genmask, policy, create);
96518518
PM		 1623}
1624
633c9a84
PNA		 1625static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1626 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1627 const struct nlattr * const nla[],
1628 struct netlink_ext_ack *extack)
96518518
PM		 1629{
1630 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1631 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 1632 int family = nfmsg->nfgen_family;
1633 const struct nlattr *attr;
96518518
PM		 1634 struct nft_table *table;
1635 struct nft_chain *chain;
9dee1474 1636 struct nft_rule *rule;
91c7b38d 1637 struct nft_ctx ctx;
3ecbfd65 1638 u64 handle;
9dee1474
PNA		 1639 u32 use;
1640 int err;
96518518 1641
cac20fcd 1642 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1643 if (IS_ERR(table)) {
1644 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1645 return PTR_ERR(table);
36dd1bcc 1646 }
96518518 1647
3ecbfd65 1648 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 1649 attr = nla[NFTA_CHAIN_HANDLE];
1650 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 1651 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 1652 } else {
36dd1bcc
PNA		 1653 attr = nla[NFTA_CHAIN_NAME];
1654 chain = nft_chain_lookup(table, attr, genmask);
3ecbfd65 1655 }
36dd1bcc
PNA		 1656 if (IS_ERR(chain)) {
1657 NL_SET_BAD_ATTR(extack, attr);
96518518 1658 return PTR_ERR(chain);
36dd1bcc 1659 }
9dee1474
PNA		 1660
1661 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1662 chain->use > 0)
96518518
PM		 1663 return -EBUSY;
1664
98319cb9 1665 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 1666
9dee1474
PNA		 1667 use = chain->use;
1668 list_for_each_entry(rule, &chain->rules, list) {
1669 if (!nft_is_active_next(net, rule))
1670 continue;
1671 use--;
1672
1673 err = nft_delrule(&ctx, rule);
1674 if (err < 0)
1675 return err;
1676 }
1677
1678 /* There are rules and elements that are still holding references to us,
1679 * we cannot do a recursive removal in this case.
1680 */
36dd1bcc
PNA		 1681 if (use > 0) {
1682 NL_SET_BAD_ATTR(extack, attr);
9dee1474 1683 return -EBUSY;
36dd1bcc 1684 }
9dee1474 1685
ee01d542 1686 return nft_delchain(&ctx);
96518518
PM		 1687}
1688
96518518
PM		 1689/*
1690 * Expressions
1691 */
1692
1693/**
ef1f7df9
PM		 1694 * nft_register_expr - register nf_tables expr type
1695 * @ops: expr type
96518518 1696 *
ef1f7df9 1697 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1698 * success or a negative errno code otherwise.
1699 */
ef1f7df9 1700int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1701{
1702 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1703 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1704 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1705 else
e688a7f8 1706 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1707 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1708 return 0;
1709}
1710EXPORT_SYMBOL_GPL(nft_register_expr);
1711
1712/**
ef1f7df9
PM		 1713 * nft_unregister_expr - unregister nf_tables expr type
1714 * @ops: expr type
96518518 1715 *
ef1f7df9 1716 * Unregisters the expr typefor use with nf_tables.
96518518 1717 */
ef1f7df9 1718void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1719{
1720 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1721 list_del_rcu(&type->list);
96518518
PM		 1722 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1723}
1724EXPORT_SYMBOL_GPL(nft_unregister_expr);
1725
64d46806
PM		 1726static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1727 struct nlattr *nla)
96518518 1728{
ef1f7df9 1729 const struct nft_expr_type *type;
96518518 1730
ef1f7df9 1731 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1732 if (!nla_strcmp(nla, type->name) &&
1733 (!type->family || type->family == family))
ef1f7df9 1734 return type;
96518518
PM		 1735 }
1736 return NULL;
1737}
1738
64d46806
PM		 1739static const struct nft_expr_type *nft_expr_type_get(u8 family,
1740 struct nlattr *nla)
96518518 1741{
ef1f7df9 1742 const struct nft_expr_type *type;
96518518
PM		 1743
1744 if (nla == NULL)
1745 return ERR_PTR(-EINVAL);
1746
64d46806 1747 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1748 if (type != NULL && try_module_get(type->owner))
1749 return type;
96518518
PM		 1750
1751#ifdef CONFIG_MODULES
ef1f7df9 1752 if (type == NULL) {
64d46806
PM		 1753 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1754 request_module("nft-expr-%u-%.*s", family,
1755 nla_len(nla), (char *)nla_data(nla));
1756 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1757 if (__nft_expr_type_get(family, nla))
1758 return ERR_PTR(-EAGAIN);
1759
96518518
PM		 1760 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1761 request_module("nft-expr-%.*s",
1762 nla_len(nla), (char *)nla_data(nla));
1763 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1764 if (__nft_expr_type_get(family, nla))
96518518
PM		 1765 return ERR_PTR(-EAGAIN);
1766 }
1767#endif
1768 return ERR_PTR(-ENOENT);
1769}
1770
1771static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1772 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1773 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1774};
1775
1776static int nf_tables_fill_expr_info(struct sk_buff *skb,
1777 const struct nft_expr *expr)
1778{
ef1f7df9 1779 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1780 goto nla_put_failure;
1781
1782 if (expr->ops->dump) {
1783 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1784 if (data == NULL)
1785 goto nla_put_failure;
1786 if (expr->ops->dump(skb, expr) < 0)
1787 goto nla_put_failure;
1788 nla_nest_end(skb, data);
1789 }
1790
1791 return skb->len;
1792
1793nla_put_failure:
1794 return -1;
1795};
1796
0b2d8a7b
PM		 1797int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1798 const struct nft_expr *expr)
1799{
1800 struct nlattr *nest;
1801
1802 nest = nla_nest_start(skb, attr);
1803 if (!nest)
1804 goto nla_put_failure;
1805 if (nf_tables_fill_expr_info(skb, expr) < 0)
1806 goto nla_put_failure;
1807 nla_nest_end(skb, nest);
1808 return 0;
1809
1810nla_put_failure:
1811 return -1;
1812}
1813
96518518
PM		 1814struct nft_expr_info {
1815 const struct nft_expr_ops *ops;
ef1f7df9 1816 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1817};
1818
0ca743a5
PNA		 1819static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1820 const struct nlattr *nla,
96518518
PM		 1821 struct nft_expr_info *info)
1822{
ef1f7df9 1823 const struct nft_expr_type *type;
96518518 1824 const struct nft_expr_ops *ops;
ef1f7df9 1825 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1826 int err;
1827
fceb6435 1828 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 1829 if (err < 0)
1830 return err;
1831
36596dad 1832 type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1833 if (IS_ERR(type))
1834 return PTR_ERR(type);
1835
1836 if (tb[NFTA_EXPR_DATA]) {
1837 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 1838 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 1839 if (err < 0)
1840 goto err1;
1841 } else
1842 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1843
1844 if (type->select_ops != NULL) {
0ca743a5
PNA		 1845 ops = type->select_ops(ctx,
1846 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1847 if (IS_ERR(ops)) {
1848 err = PTR_ERR(ops);
1849 goto err1;
1850 }
1851 } else
1852 ops = type->ops;
1853
96518518
PM		 1854 info->ops = ops;
1855 return 0;
ef1f7df9
PM		 1856
1857err1:
1858 module_put(type->owner);
1859 return err;
96518518
PM		 1860}
1861
1862static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1863 const struct nft_expr_info *info,
96518518
PM		 1864 struct nft_expr *expr)
1865{
1866 const struct nft_expr_ops *ops = info->ops;
1867 int err;
1868
1869 expr->ops = ops;
1870 if (ops->init) {
ef1f7df9 1871 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1872 if (err < 0)
1873 goto err1;
1874 }
1875
c56e3956
LZ		 1876 if (ops->validate) {
1877 const struct nft_data *data = NULL;
1878
1879 err = ops->validate(ctx, expr, &data);
1880 if (err < 0)
1881 goto err2;
1882 }
1883
96518518
PM		 1884 return 0;
1885
c56e3956
LZ		 1886err2:
1887 if (ops->destroy)
1888 ops->destroy(ctx, expr);
96518518
PM		 1889err1:
1890 expr->ops = NULL;
1891 return err;
1892}
1893
62472bce
PM		 1894static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1895 struct nft_expr *expr)
96518518
PM		 1896{
1897 if (expr->ops->destroy)
62472bce 1898 expr->ops->destroy(ctx, expr);
ef1f7df9 1899 module_put(expr->ops->type->owner);
96518518
PM		 1900}
1901
0b2d8a7b
PM		 1902struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1903 const struct nlattr *nla)
1904{
1905 struct nft_expr_info info;
1906 struct nft_expr *expr;
1907 int err;
1908
1909 err = nf_tables_expr_parse(ctx, nla, &info);
1910 if (err < 0)
1911 goto err1;
1912
1913 err = -ENOMEM;
1914 expr = kzalloc(info.ops->size, GFP_KERNEL);
1915 if (expr == NULL)
1916 goto err2;
1917
1918 err = nf_tables_newexpr(ctx, &info, expr);
1919 if (err < 0)
6cafaf47 1920 goto err3;
0b2d8a7b
PM		 1921
1922 return expr;
6cafaf47
LZ		 1923err3:
1924 kfree(expr);
0b2d8a7b
PM		 1925err2:
1926 module_put(info.ops->type->owner);
1927err1:
1928 return ERR_PTR(err);
1929}
1930
1931void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1932{
1933 nf_tables_expr_destroy(ctx, expr);
1934 kfree(expr);
1935}
1936
96518518
PM		 1937/*
1938 * Rules
1939 */
1940
cac20fcd
PNA		 1941static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
1942 u64 handle)
96518518
PM		 1943{
1944 struct nft_rule *rule;
1945
1946 // FIXME: this sucks
1947 list_for_each_entry(rule, &chain->rules, list) {
1948 if (handle == rule->handle)
1949 return rule;
1950 }
1951
1952 return ERR_PTR(-ENOENT);
1953}
1954
cac20fcd
PNA		 1955static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
1956 const struct nlattr *nla)
96518518
PM		 1957{
1958 if (nla == NULL)
1959 return ERR_PTR(-EINVAL);
1960
cac20fcd 1961 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 1962}
1963
1964static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 1965 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1966 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1967 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1968 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1969 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1970 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1971 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1972 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1973 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1974 .len = NFT_USERDATA_MAXLEN },
467697d2 1975 [NFTA_RULE_ID] = { .type = NLA_U32 },
96518518
PM		 1976};
1977
84d7fce6
PNA		 1978static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1979 u32 portid, u32 seq, int event,
1980 u32 flags, int family,
96518518
PM		 1981 const struct nft_table *table,
1982 const struct nft_chain *chain,
1983 const struct nft_rule *rule)
1984{
1985 struct nlmsghdr *nlh;
1986 struct nfgenmsg *nfmsg;
1987 const struct nft_expr *expr, *next;
1988 struct nlattr *list;
5e948466 1989 const struct nft_rule *prule;
dedb67c4 1990 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 1991
dedb67c4 1992 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 1993 if (nlh == NULL)
1994 goto nla_put_failure;
1995
1996 nfmsg = nlmsg_data(nlh);
1997 nfmsg->nfgen_family = family;
1998 nfmsg->version = NFNETLINK_V0;
84d7fce6 1999 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2000
2001 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2002 goto nla_put_failure;
2003 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2004 goto nla_put_failure;
b46f6ded
ND		 2005 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2006 NFTA_RULE_PAD))
96518518
PM		 2007 goto nla_put_failure;
2008
5e948466 2009 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 2010 prule = list_prev_entry(rule, list);
5e948466 2011 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2012 cpu_to_be64(prule->handle),
2013 NFTA_RULE_PAD))
5e948466
EL		 2014 goto nla_put_failure;
2015 }
2016
96518518
PM		 2017 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2018 if (list == NULL)
2019 goto nla_put_failure;
2020 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2021 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2022 goto nla_put_failure;
96518518
PM		 2023 }
2024 nla_nest_end(skb, list);
2025
86f1ec32
PM		 2026 if (rule->udata) {
2027 struct nft_userdata *udata = nft_userdata(rule);
2028 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2029 udata->data) < 0)
2030 goto nla_put_failure;
2031 }
0768b3b3 2032
053c095a
JB		 2033 nlmsg_end(skb, nlh);
2034 return 0;
96518518
PM		 2035
2036nla_put_failure:
2037 nlmsg_trim(skb, nlh);
2038 return -1;
2039}
2040
25e94a99
PNA		 2041static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2042 const struct nft_rule *rule, int event)
96518518
PM		 2043{
2044 struct sk_buff *skb;
96518518
PM		 2045 int err;
2046
128ad332
PNA		 2047 if (!ctx->report &&
2048 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2049 return;
96518518 2050
96518518
PM		 2051 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2052 if (skb == NULL)
2053 goto err;
2054
84d7fce6 2055 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2056 event, 0, ctx->family, ctx->table,
35151d84 2057 ctx->chain, rule);
96518518
PM		 2058 if (err < 0) {
2059 kfree_skb(skb);
2060 goto err;
2061 }
2062
25e94a99
PNA		 2063 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2064 ctx->report, GFP_KERNEL);
2065 return;
96518518 2066err:
25e94a99 2067 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2068}
2069
6e1f760e 2070struct nft_rule_dump_ctx {
e46abbcc 2071 char *table;
b7263e07 2072 char *chain;
6e1f760e
PNA		 2073};
2074
96518518
PM		 2075static int nf_tables_dump_rules(struct sk_buff *skb,
2076 struct netlink_callback *cb)
2077{
2078 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2079 const struct nft_rule_dump_ctx *ctx = cb->data;
96518518
PM		 2080 const struct nft_table *table;
2081 const struct nft_chain *chain;
2082 const struct nft_rule *rule;
2083 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 2084 struct net *net = sock_net(skb->sk);
96518518
PM		 2085 int family = nfmsg->nfgen_family;
2086
e688a7f8 2087 rcu_read_lock();
38e029f1
PNA		 2088 cb->seq = net->nft.base_seq;
2089
36596dad 2090 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2091 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2092 continue;
2093
2094 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2095 continue;
2096
36596dad
PNA		 2097 list_for_each_entry_rcu(chain, &table->chains, list) {
2098 if (ctx && ctx->chain &&
2099 strcmp(ctx->chain, chain->name) != 0)
6e1f760e
PNA		 2100 continue;
2101
36596dad
PNA		 2102 list_for_each_entry_rcu(rule, &chain->rules, list) {
2103 if (!nft_is_active(net, rule))
2104 goto cont;
2105 if (idx < s_idx)
2106 goto cont;
2107 if (idx > s_idx)
2108 memset(&cb->args[1], 0,
2109 sizeof(cb->args) - sizeof(cb->args[0]));
2110 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2111 cb->nlh->nlmsg_seq,
2112 NFT_MSG_NEWRULE,
2113 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 2114 table->family,
36596dad
PNA		 2115 table, chain, rule) < 0)
2116 goto done;
2117
2118 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 2119cont:
36596dad 2120 idx++;
96518518
PM		 2121 }
2122 }
2123 }
2124done:
e688a7f8
PNA		 2125 rcu_read_unlock();
2126
96518518
PM		 2127 cb->args[0] = idx;
2128 return skb->len;
2129}
2130
6e1f760e
PNA		 2131static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2132{
e46abbcc
PS		 2133 struct nft_rule_dump_ctx *ctx = cb->data;
2134
2135 if (ctx) {
2136 kfree(ctx->table);
b7263e07 2137 kfree(ctx->chain);
e46abbcc
PS		 2138 kfree(ctx);
2139 }
6e1f760e
PNA		 2140 return 0;
2141}
2142
7b8002a1
PNA		 2143static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2144 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2145 const struct nlattr * const nla[],
2146 struct netlink_ext_ack *extack)
96518518
PM		 2147{
2148 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2149 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2150 const struct nft_table *table;
2151 const struct nft_chain *chain;
2152 const struct nft_rule *rule;
2153 struct sk_buff *skb2;
2154 int family = nfmsg->nfgen_family;
2155 int err;
2156
2157 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2158 struct netlink_dump_control c = {
2159 .dump = nf_tables_dump_rules,
6e1f760e 2160 .done = nf_tables_dump_rules_done,
96518518 2161 };
6e1f760e
PNA		 2162
2163 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2164 struct nft_rule_dump_ctx *ctx;
2165
2166 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2167 if (!ctx)
2168 return -ENOMEM;
2169
e46abbcc
PS		 2170 if (nla[NFTA_RULE_TABLE]) {
2171 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2172 GFP_KERNEL);
2173 if (!ctx->table) {
2174 kfree(ctx);
2175 return -ENOMEM;
2176 }
2177 }
b7263e07
PS		 2178 if (nla[NFTA_RULE_CHAIN]) {
2179 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2180 GFP_KERNEL);
2181 if (!ctx->chain) {
2182 kfree(ctx->table);
2183 kfree(ctx);
2184 return -ENOMEM;
2185 }
2186 }
6e1f760e
PNA		 2187 c.data = ctx;
2188 }
2189
96518518
PM		 2190 return netlink_dump_start(nlsk, skb, nlh, &c);
2191 }
2192
cac20fcd 2193 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2194 if (IS_ERR(table)) {
2195 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2196 return PTR_ERR(table);
36dd1bcc 2197 }
96518518 2198
cac20fcd 2199 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2200 if (IS_ERR(chain)) {
2201 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2202 return PTR_ERR(chain);
36dd1bcc 2203 }
96518518 2204
cac20fcd 2205 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2206 if (IS_ERR(rule)) {
2207 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2208 return PTR_ERR(rule);
36dd1bcc 2209 }
96518518
PM		 2210
2211 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2212 if (!skb2)
2213 return -ENOMEM;
2214
84d7fce6 2215 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2216 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2217 family, table, chain, rule);
2218 if (err < 0)
2219 goto err;
2220
2221 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2222
2223err:
2224 kfree_skb(skb2);
2225 return err;
2226}
2227
62472bce
PM		 2228static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2229 struct nft_rule *rule)
96518518 2230{
96518518
PM		 2231 struct nft_expr *expr;
2232
2233 /*
2234 * Careful: some expressions might not be initialized in case this
2235 * is called on error from nf_tables_newrule().
2236 */
2237 expr = nft_expr_first(rule);
3e38df13 2238 while (expr != nft_expr_last(rule) && expr->ops) {
62472bce 2239 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 2240 expr = nft_expr_next(expr);
2241 }
2242 kfree(rule);
2243}
2244
1081d11b
PNA		 2245#define NFT_RULE_MAXEXPRS 128
2246
2247static struct nft_expr_info *info;
2248
633c9a84
PNA		 2249static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2250 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2251 const struct nlattr * const nla[],
2252 struct netlink_ext_ack *extack)
96518518
PM		 2253{
2254 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2255 u8 genmask = nft_genmask_next(net);
98319cb9 2256 int family = nfmsg->nfgen_family;
96518518
PM		 2257 struct nft_table *table;
2258 struct nft_chain *chain;
2259 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2260 struct nft_userdata *udata;
1081d11b 2261 struct nft_trans *trans = NULL;
96518518
PM		 2262 struct nft_expr *expr;
2263 struct nft_ctx ctx;
2264 struct nlattr *tmp;
86f1ec32 2265 unsigned int size, i, n, ulen = 0, usize = 0;
96518518
PM		 2266 int err, rem;
2267 bool create;
5e948466 2268 u64 handle, pos_handle;
96518518
PM		 2269
2270 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2271
cac20fcd 2272 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2273 if (IS_ERR(table)) {
2274 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2275 return PTR_ERR(table);
36dd1bcc 2276 }
96518518 2277
cac20fcd 2278 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2279 if (IS_ERR(chain)) {
2280 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2281 return PTR_ERR(chain);
36dd1bcc 2282 }
96518518
PM		 2283
2284 if (nla[NFTA_RULE_HANDLE]) {
2285 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 2286 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 2287 if (IS_ERR(rule)) {
2288 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2289 return PTR_ERR(rule);
36dd1bcc 2290 }
96518518 2291
36dd1bcc
PNA		 2292 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2293 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2294 return -EEXIST;
36dd1bcc 2295 }
96518518
PM		 2296 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2297 old_rule = rule;
2298 else
2299 return -EOPNOTSUPP;
2300 } else {
2301 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2302 return -EINVAL;
2303 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2304
2305 if (chain->use == UINT_MAX)
2306 return -EOVERFLOW;
96518518
PM		 2307 }
2308
5e948466
EL		 2309 if (nla[NFTA_RULE_POSITION]) {
2310 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2311 return -EOPNOTSUPP;
2312
2313 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
cac20fcd 2314 old_rule = __nft_rule_lookup(chain, pos_handle);
36dd1bcc
PNA		 2315 if (IS_ERR(old_rule)) {
2316 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
5e948466 2317 return PTR_ERR(old_rule);
36dd1bcc 2318 }
5e948466
EL		 2319 }
2320
98319cb9 2321 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 2322
96518518
PM		 2323 n = 0;
2324 size = 0;
2325 if (nla[NFTA_RULE_EXPRESSIONS]) {
2326 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2327 err = -EINVAL;
2328 if (nla_type(tmp) != NFTA_LIST_ELEM)
2329 goto err1;
2330 if (n == NFT_RULE_MAXEXPRS)
2331 goto err1;
0ca743a5 2332 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2333 if (err < 0)
2334 goto err1;
2335 size += info[n].ops->size;
2336 n++;
2337 }
2338 }
9889840f
PM		 2339 /* Check for overflow of dlen field */
2340 err = -EFBIG;
2341 if (size >= 1 << 12)
2342 goto err1;
96518518 2343
86f1ec32 2344 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2345 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2346 if (ulen > 0)
2347 usize = sizeof(struct nft_userdata) + ulen;
2348 }
0768b3b3 2349
96518518 2350 err = -ENOMEM;
86f1ec32 2351 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2352 if (rule == NULL)
2353 goto err1;
2354
889f7ee7 2355 nft_activate_next(net, rule);
0628b123 2356
96518518
PM		 2357 rule->handle = handle;
2358 rule->dlen = size;
86f1ec32 2359 rule->udata = ulen ? 1 : 0;
0768b3b3 2360
86f1ec32
PM		 2361 if (ulen) {
2362 udata = nft_userdata(rule);
2363 udata->len = ulen - 1;
2364 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2365 }
96518518 2366
96518518
PM		 2367 expr = nft_expr_first(rule);
2368 for (i = 0; i < n; i++) {
2369 err = nf_tables_newexpr(&ctx, &info[i], expr);
2370 if (err < 0)
2371 goto err2;
ef1f7df9 2372 info[i].ops = NULL;
96518518
PM		 2373 expr = nft_expr_next(expr);
2374 }
2375
96518518 2376 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
569ccae6 2377 if (!nft_is_active_next(net, old_rule)) {
0628b123
PNA		 2378 err = -ENOENT;
2379 goto err2;
2380 }
569ccae6
FW		 2381 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
2382 old_rule);
2383 if (trans == NULL) {
2384 err = -ENOMEM;
2385 goto err2;
2386 }
2387 nft_deactivate_next(net, old_rule);
2388 chain->use--;
96518518 2389
569ccae6
FW		 2390 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2391 err = -ENOMEM;
2392 goto err2;
2393 }
2394
2395 list_add_tail_rcu(&rule->list, &old_rule->list);
2396 } else {
2397 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2398 err = -ENOMEM;
2399 goto err2;
2400 }
2401
2402 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2403 if (old_rule)
2404 list_add_rcu(&rule->list, &old_rule->list);
2405 else
2406 list_add_tail_rcu(&rule->list, &chain->rules);
2407 } else {
2408 if (old_rule)
2409 list_add_tail_rcu(&rule->list, &old_rule->list);
2410 else
2411 list_add_rcu(&rule->list, &chain->rules);
2412 }
0628b123 2413 }
4fefee57 2414 chain->use++;
96518518
PM		 2415 return 0;
2416
2417err2:
62472bce 2418 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 2419err1:
2420 for (i = 0; i < n; i++) {
2421 if (info[i].ops != NULL)
ef1f7df9 2422 module_put(info[i].ops->type->owner);
96518518
PM		 2423 }
2424 return err;
2425}
2426
1a94e38d
PNA		 2427static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2428 const struct nlattr *nla)
2429{
2430 u32 id = ntohl(nla_get_be32(nla));
2431 struct nft_trans *trans;
2432
2433 list_for_each_entry(trans, &net->nft.commit_list, list) {
2434 struct nft_rule *rule = nft_trans_rule(trans);
2435
2436 if (trans->msg_type == NFT_MSG_NEWRULE &&
2437 id == nft_trans_rule_id(trans))
2438 return rule;
2439 }
2440 return ERR_PTR(-ENOENT);
2441}
2442
633c9a84
PNA		 2443static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2444 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2445 const struct nlattr * const nla[],
2446 struct netlink_ext_ack *extack)
96518518
PM		 2447{
2448 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2449 u8 genmask = nft_genmask_next(net);
7c95f6d8 2450 struct nft_table *table;
cf9dc09d
PNA		 2451 struct nft_chain *chain = NULL;
2452 struct nft_rule *rule;
0628b123
PNA		 2453 int family = nfmsg->nfgen_family, err = 0;
2454 struct nft_ctx ctx;
96518518 2455
cac20fcd 2456 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2457 if (IS_ERR(table)) {
2458 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2459 return PTR_ERR(table);
36dd1bcc 2460 }
96518518 2461
cf9dc09d 2462 if (nla[NFTA_RULE_CHAIN]) {
cac20fcd 2463 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2464 if (IS_ERR(chain)) {
2465 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 2466 return PTR_ERR(chain);
36dd1bcc 2467 }
cf9dc09d 2468 }
96518518 2469
98319cb9 2470 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 2471
cf9dc09d
PNA		 2472 if (chain) {
2473 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 2474 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2475 if (IS_ERR(rule)) {
2476 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 2477 return PTR_ERR(rule);
36dd1bcc 2478 }
96518518 2479
1a94e38d
PNA		 2480 err = nft_delrule(&ctx, rule);
2481 } else if (nla[NFTA_RULE_ID]) {
2482 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 2483 if (IS_ERR(rule)) {
2484 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 2485 return PTR_ERR(rule);
36dd1bcc 2486 }
1a94e38d 2487
5e266fe7 2488 err = nft_delrule(&ctx, rule);
cf9dc09d 2489 } else {
ce24b721 2490 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2491 }
2492 } else {
2493 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2494 if (!nft_is_active_next(net, chain))
2495 continue;
2496
cf9dc09d 2497 ctx.chain = chain;
ce24b721 2498 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2499 if (err < 0)
2500 break;
2501 }
2502 }
2503
2504 return err;
2505}
2506
20a69341
PM		 2507/*
2508 * Sets
2509 */
2510
2b664957 2511static LIST_HEAD(nf_tables_set_types);
20a69341 2512
2b664957 2513int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2514{
2515 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2516 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2517 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2518 return 0;
2519}
2520EXPORT_SYMBOL_GPL(nft_register_set);
2521
2b664957 2522void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2523{
2524 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2525 list_del_rcu(&type->list);
20a69341
PM		 2526 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2527}
2528EXPORT_SYMBOL_GPL(nft_unregister_set);
2529
2b664957 2530#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 2531 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
2532 NFT_SET_EVAL)
2b664957 2533
71cc0873 2534static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 2535{
71cc0873 2536 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 2537}
2538
c50b960c
PM		 2539/*
2540 * Select a set implementation based on the data characteristics and the
2541 * given policy. The total memory use might not be known if no size is
2542 * given, in that case the amount of memory per element is used.
2543 */
2544static const struct nft_set_ops *
2b664957
PNA		 2545nft_select_set_ops(const struct nft_ctx *ctx,
2546 const struct nlattr * const nla[],
c50b960c
PM		 2547 const struct nft_set_desc *desc,
2548 enum nft_set_policies policy)
20a69341 2549{
c50b960c
PM		 2550 const struct nft_set_ops *ops, *bops;
2551 struct nft_set_estimate est, best;
2b664957
PNA		 2552 const struct nft_set_type *type;
2553 u32 flags = 0;
20a69341
PM		 2554
2555#ifdef CONFIG_MODULES
2b664957 2556 if (list_empty(&nf_tables_set_types)) {
20a69341
PM		 2557 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2558 request_module("nft-set");
2559 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2560 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2561 return ERR_PTR(-EAGAIN);
2562 }
2563#endif
2b664957
PNA		 2564 if (nla[NFTA_SET_FLAGS] != NULL)
2565 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2566
55af753c
PNA		 2567 bops = NULL;
2568 best.size = ~0;
2569 best.lookup = ~0;
0b5a7874 2570 best.space = ~0;
c50b960c 2571
2b664957 2572 list_for_each_entry(type, &nf_tables_set_types, list) {
71cc0873 2573 ops = &type->ops;
2b664957 2574
71cc0873 2575 if (!nft_set_ops_candidate(type, flags))
20a69341 2576 continue;
2b664957 2577 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2578 continue;
2579
2580 switch (policy) {
2581 case NFT_SET_POL_PERFORMANCE:
55af753c 2582 if (est.lookup < best.lookup)
c50b960c 2583 break;
644e334e
PNA		 2584 if (est.lookup == best.lookup &&
2585 est.space < best.space)
2586 break;
c50b960c
PM		 2587 continue;
2588 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2589 if (!desc->size) {
2590 if (est.space < best.space)
2591 break;
2592 if (est.space == best.space &&
2593 est.lookup < best.lookup)
2594 break;
4f2921ca 2595 } else if (est.size < best.size || !bops) {
c50b960c 2596 break;
0b5a7874 2597 }
c50b960c
PM		 2598 continue;
2599 default:
2600 break;
2601 }
2602
2b664957 2603 if (!try_module_get(type->owner))
20a69341 2604 continue;
c50b960c 2605 if (bops != NULL)
71cc0873 2606 module_put(to_set_type(bops)->owner);
c50b960c
PM		 2607
2608 bops = ops;
2609 best = est;
20a69341
PM		 2610 }
2611
c50b960c
PM		 2612 if (bops != NULL)
2613 return bops;
2614
20a69341
PM		 2615 return ERR_PTR(-EOPNOTSUPP);
2616}
2617
2618static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2619 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2620 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2621 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2622 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2623 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2624 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2625 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2626 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2627 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2628 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2629 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2630 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2631 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2632 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2633 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2634 .len = NFT_USERDATA_MAXLEN },
8aeff920 2635 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 2636 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 2637};
2638
2639static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2640 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2641};
2642
633c9a84 2643static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2644 const struct sk_buff *skb,
2645 const struct nlmsghdr *nlh,
f2a6d766 2646 const struct nlattr * const nla[],
36dd1bcc 2647 struct netlink_ext_ack *extack,
f2a6d766 2648 u8 genmask)
20a69341
PM		 2649{
2650 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 2651 int family = nfmsg->nfgen_family;
7c95f6d8 2652 struct nft_table *table = NULL;
20a69341 2653
20a69341 2654 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 2655 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
2656 genmask);
36dd1bcc
PNA		 2657 if (IS_ERR(table)) {
2658 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 2659 return PTR_ERR(table);
36dd1bcc 2660 }
20a69341
PM		 2661 }
2662
98319cb9 2663 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 2664 return 0;
2665}
2666
cac20fcd
PNA		 2667static struct nft_set *nft_set_lookup(const struct nft_table *table,
2668 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2669{
2670 struct nft_set *set;
2671
2672 if (nla == NULL)
2673 return ERR_PTR(-EINVAL);
2674
2675 list_for_each_entry(set, &table->sets, list) {
37a9cc52
PNA		 2676 if (!nla_strcmp(nla, set->name) &&
2677 nft_active_genmask(set, genmask))
20a69341
PM		 2678 return set;
2679 }
2680 return ERR_PTR(-ENOENT);
2681}
2682
cac20fcd
PNA		 2683static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
2684 const struct nlattr *nla,
2685 u8 genmask)
3ecbfd65
HS		 2686{
2687 struct nft_set *set;
2688
3ecbfd65
HS		 2689 list_for_each_entry(set, &table->sets, list) {
2690 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2691 nft_active_genmask(set, genmask))
2692 return set;
2693 }
2694 return ERR_PTR(-ENOENT);
2695}
2696
cac20fcd
PNA		 2697static struct nft_set *nft_set_lookup_byid(const struct net *net,
2698 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 2699{
2700 struct nft_trans *trans;
2701 u32 id = ntohl(nla_get_be32(nla));
2702
2703 list_for_each_entry(trans, &net->nft.commit_list, list) {
37a9cc52
PNA		 2704 struct nft_set *set = nft_trans_set(trans);
2705
958bee14 2706 if (trans->msg_type == NFT_MSG_NEWSET &&
37a9cc52
PNA		 2707 id == nft_trans_set_id(trans) &&
2708 nft_active_genmask(set, genmask))
2709 return set;
958bee14
PNA		 2710 }
2711 return ERR_PTR(-ENOENT);
2712}
c7a72e3f 2713
10659cba
PNA		 2714struct nft_set *nft_set_lookup_global(const struct net *net,
2715 const struct nft_table *table,
2716 const struct nlattr *nla_set_name,
2717 const struct nlattr *nla_set_id,
2718 u8 genmask)
c7a72e3f
PNA		 2719{
2720 struct nft_set *set;
2721
cac20fcd 2722 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 2723 if (IS_ERR(set)) {
2724 if (!nla_set_id)
2725 return set;
2726
cac20fcd 2727 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 2728 }
2729 return set;
2730}
10659cba 2731EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 2732
20a69341
PM		 2733static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2734 const char *name)
2735{
2736 const struct nft_set *i;
2737 const char *p;
2738 unsigned long *inuse;
60eb1894 2739 unsigned int n = 0, min = 0;
20a69341 2740
38745490 2741 p = strchr(name, '%');
20a69341
PM		 2742 if (p != NULL) {
2743 if (p[1] != 'd' || strchr(p + 2, '%'))
2744 return -EINVAL;
2745
2746 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2747 if (inuse == NULL)
2748 return -ENOMEM;
60eb1894 2749cont:
20a69341 2750 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2751 int tmp;
2752
37a9cc52
PNA		 2753 if (!nft_is_active_next(ctx->net, set))
2754 continue;
14662917 2755 if (!sscanf(i->name, name, &tmp))
20a69341 2756 continue;
60eb1894 2757 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2758 continue;
14662917 2759
60eb1894 2760 set_bit(tmp - min, inuse);
20a69341
PM		 2761 }
2762
53b70287 2763 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2764 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2765 min += BITS_PER_BYTE * PAGE_SIZE;
2766 memset(inuse, 0, PAGE_SIZE);
2767 goto cont;
2768 }
20a69341
PM		 2769 free_page((unsigned long)inuse);
2770 }
2771
38745490
PS		 2772 set->name = kasprintf(GFP_KERNEL, name, min + n);
2773 if (!set->name)
2774 return -ENOMEM;
2775
20a69341 2776 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 2777 if (!nft_is_active_next(ctx->net, i))
2778 continue;
e63aaaa6
AY		 2779 if (!strcmp(set->name, i->name)) {
2780 kfree(set->name);
20a69341 2781 return -ENFILE;
e63aaaa6 2782 }
20a69341
PM		 2783 }
2784 return 0;
2785}
2786
8e1102d5
FW		 2787static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
2788{
2789 u64 ms = be64_to_cpu(nla_get_be64(nla));
2790 u64 max = (u64)(~((u64)0));
2791
2792 max = div_u64(max, NSEC_PER_MSEC);
2793 if (ms >= max)
2794 return -ERANGE;
2795
2796 ms *= NSEC_PER_MSEC;
2797 *result = nsecs_to_jiffies64(ms);
2798 return 0;
2799}
2800
2801static u64 nf_jiffies64_to_msecs(u64 input)
2802{
2803 u64 ms = jiffies64_to_nsecs(input);
2804
2805 return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
2806}
2807
20a69341
PM		 2808static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2809 const struct nft_set *set, u16 event, u16 flags)
2810{
2811 struct nfgenmsg *nfmsg;
2812 struct nlmsghdr *nlh;
c50b960c 2813 struct nlattr *desc;
128ad332
PNA		 2814 u32 portid = ctx->portid;
2815 u32 seq = ctx->seq;
20a69341 2816
dedb67c4 2817 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 2818 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2819 flags);
2820 if (nlh == NULL)
2821 goto nla_put_failure;
2822
2823 nfmsg = nlmsg_data(nlh);
36596dad 2824 nfmsg->nfgen_family = ctx->family;
20a69341 2825 nfmsg->version = NFNETLINK_V0;
84d7fce6 2826 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 2827
2828 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2829 goto nla_put_failure;
2830 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2831 goto nla_put_failure;
3ecbfd65
HS		 2832 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
2833 NFTA_SET_PAD))
2834 goto nla_put_failure;
20a69341
PM		 2835 if (set->flags != 0)
2836 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2837 goto nla_put_failure;
2838
2839 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2840 goto nla_put_failure;
2841 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2842 goto nla_put_failure;
2843 if (set->flags & NFT_SET_MAP) {
2844 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2845 goto nla_put_failure;
2846 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2847 goto nla_put_failure;
2848 }
8aeff920
PNA		 2849 if (set->flags & NFT_SET_OBJECT &&
2850 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2851 goto nla_put_failure;
20a69341 2852
761da293 2853 if (set->timeout &&
d3e2a111 2854 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 2855 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 2856 NFTA_SET_PAD))
761da293
PM		 2857 goto nla_put_failure;
2858 if (set->gc_int &&
2859 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2860 goto nla_put_failure;
2861
9363dc4b
AB		 2862 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2863 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2864 goto nla_put_failure;
2865 }
2866
e6d8ecac
CFG		 2867 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2868 goto nla_put_failure;
2869
c50b960c
PM		 2870 desc = nla_nest_start(skb, NFTA_SET_DESC);
2871 if (desc == NULL)
2872 goto nla_put_failure;
2873 if (set->size &&
2874 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2875 goto nla_put_failure;
2876 nla_nest_end(skb, desc);
2877
053c095a
JB		 2878 nlmsg_end(skb, nlh);
2879 return 0;
20a69341
PM		 2880
2881nla_put_failure:
2882 nlmsg_trim(skb, nlh);
2883 return -1;
2884}
2885
25e94a99
PNA		 2886static void nf_tables_set_notify(const struct nft_ctx *ctx,
2887 const struct nft_set *set, int event,
2888 gfp_t gfp_flags)
20a69341
PM		 2889{
2890 struct sk_buff *skb;
128ad332 2891 u32 portid = ctx->portid;
20a69341
PM		 2892 int err;
2893
128ad332
PNA		 2894 if (!ctx->report &&
2895 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2896 return;
20a69341 2897
31f8441c 2898 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 2899 if (skb == NULL)
2900 goto err;
2901
2902 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2903 if (err < 0) {
2904 kfree_skb(skb);
2905 goto err;
2906 }
2907
25e94a99
PNA		 2908 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2909 gfp_flags);
2910 return;
20a69341 2911err:
25e94a99 2912 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 2913}
2914
5b96af77 2915static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 2916{
2917 const struct nft_set *set;
2918 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 2919 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2920 struct net *net = sock_net(skb->sk);
5b96af77 2921 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 2922
2923 if (cb->args[1])
2924 return skb->len;
2925
e688a7f8 2926 rcu_read_lock();
38e029f1
PNA		 2927 cb->seq = net->nft.base_seq;
2928
36596dad
PNA		 2929 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2930 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 2931 ctx->family != table->family)
36596dad
PNA		 2932 continue;
2933
2934 if (ctx->table && ctx->table != table)
5b96af77
PNA		 2935 continue;
2936
36596dad
PNA		 2937 if (cur_table) {
2938 if (cur_table != table)
c9c8e485
PNA		 2939 continue;
2940
36596dad 2941 cur_table = NULL;
c9c8e485 2942 }
36596dad
PNA		 2943 idx = 0;
2944 list_for_each_entry_rcu(set, &table->sets, list) {
2945 if (idx < s_idx)
2946 goto cont;
2947 if (!nft_is_active(net, set))
2948 goto cont;
5b96af77 2949
36596dad
PNA		 2950 ctx_set = *ctx;
2951 ctx_set.table = table;
98319cb9 2952 ctx_set.family = table->family;
c9c8e485 2953
36596dad
PNA		 2954 if (nf_tables_fill_set(skb, &ctx_set, set,
2955 NFT_MSG_NEWSET,
2956 NLM_F_MULTI) < 0) {
2957 cb->args[0] = idx;
2958 cb->args[2] = (unsigned long) table;
2959 goto done;
c9c8e485 2960 }
36596dad 2961 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 2962cont:
36596dad 2963 idx++;
c9c8e485 2964 }
36596dad
PNA		 2965 if (s_idx)
2966 s_idx = 0;
c9c8e485
PNA		 2967 }
2968 cb->args[1] = 1;
2969done:
e688a7f8 2970 rcu_read_unlock();
c9c8e485
PNA		 2971 return skb->len;
2972}
2973
5b96af77 2974static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 2975{
5b96af77
PNA		 2976 kfree(cb->data);
2977 return 0;
20a69341
PM		 2978}
2979
7b8002a1
PNA		 2980static int nf_tables_getset(struct net *net, struct sock *nlsk,
2981 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2982 const struct nlattr * const nla[],
2983 struct netlink_ext_ack *extack)
20a69341 2984{
f2a6d766 2985 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 2986 const struct nft_set *set;
2987 struct nft_ctx ctx;
2988 struct sk_buff *skb2;
c9c8e485 2989 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2990 int err;
2991
01cfa0a4 2992 /* Verify existence before starting dump */
36dd1bcc
PNA		 2993 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
2994 genmask);
20a69341
PM		 2995 if (err < 0)
2996 return err;
2997
2998 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2999 struct netlink_dump_control c = {
3000 .dump = nf_tables_dump_sets,
5b96af77 3001 .done = nf_tables_dump_sets_done,
20a69341 3002 };
5b96af77
PNA		 3003 struct nft_ctx *ctx_dump;
3004
3005 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
3006 if (ctx_dump == NULL)
3007 return -ENOMEM;
3008
3009 *ctx_dump = ctx;
3010 c.data = ctx_dump;
3011
20a69341
PM		 3012 return netlink_dump_start(nlsk, skb, nlh, &c);
3013 }
3014
c9c8e485
PNA		 3015 /* Only accept unspec with dump */
3016 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3017 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3018 if (!nla[NFTA_SET_TABLE])
3019 return -EINVAL;
c9c8e485 3020
cac20fcd 3021 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3022 if (IS_ERR(set))
3023 return PTR_ERR(set);
3024
3025 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
3026 if (skb2 == NULL)
3027 return -ENOMEM;
3028
3029 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3030 if (err < 0)
3031 goto err;
3032
3033 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3034
3035err:
3036 kfree_skb(skb2);
3037 return err;
3038}
3039
c50b960c
PM		 3040static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3041 struct nft_set_desc *desc,
3042 const struct nlattr *nla)
3043{
3044 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3045 int err;
3046
fceb6435
JB		 3047 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3048 nft_set_desc_policy, NULL);
c50b960c
PM		 3049 if (err < 0)
3050 return err;
3051
3052 if (da[NFTA_SET_DESC_SIZE] != NULL)
3053 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3054
3055 return 0;
3056}
3057
633c9a84
PNA		 3058static int nf_tables_newset(struct net *net, struct sock *nlsk,
3059 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3060 const struct nlattr * const nla[],
3061 struct netlink_ext_ack *extack)
20a69341
PM		 3062{
3063 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3064 u8 genmask = nft_genmask_next(net);
98319cb9 3065 int family = nfmsg->nfgen_family;
20a69341 3066 const struct nft_set_ops *ops;
20a69341
PM		 3067 struct nft_table *table;
3068 struct nft_set *set;
3069 struct nft_ctx ctx;
38745490 3070 char *name;
20a69341
PM		 3071 unsigned int size;
3072 bool create;
761da293 3073 u64 timeout;
8aeff920 3074 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3075 struct nft_set_desc desc;
e6d8ecac
CFG		 3076 unsigned char *udata;
3077 u16 udlen;
20a69341
PM		 3078 int err;
3079
3080 if (nla[NFTA_SET_TABLE] == NULL ||
3081 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3082 nla[NFTA_SET_KEY_LEN] == NULL ||
3083 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3084 return -EINVAL;
3085
c50b960c
PM		 3086 memset(&desc, 0, sizeof(desc));
3087
20a69341
PM		 3088 ktype = NFT_DATA_VALUE;
3089 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3090 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3091 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3092 return -EINVAL;
3093 }
3094
c50b960c 3095 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3096 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3097 return -EINVAL;
3098
3099 flags = 0;
3100 if (nla[NFTA_SET_FLAGS] != NULL) {
3101 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3102 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3103 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3104 NFT_SET_MAP | NFT_SET_EVAL |
3105 NFT_SET_OBJECT))
20a69341 3106 return -EINVAL;
8aeff920
PNA		 3107 /* Only one of these operations is supported */
3108 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3109 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3110 return -EOPNOTSUPP;
20a69341
PM		 3111 }
3112
3113 dtype = 0;
20a69341
PM		 3114 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3115 if (!(flags & NFT_SET_MAP))
3116 return -EINVAL;
3117
3118 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3119 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3120 dtype != NFT_DATA_VERDICT)
3121 return -EINVAL;
3122
3123 if (dtype != NFT_DATA_VERDICT) {
3124 if (nla[NFTA_SET_DATA_LEN] == NULL)
3125 return -EINVAL;
c50b960c 3126 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3127 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3128 return -EINVAL;
3129 } else
7d740264 3130 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3131 } else if (flags & NFT_SET_MAP)
3132 return -EINVAL;
3133
8aeff920
PNA		 3134 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3135 if (!(flags & NFT_SET_OBJECT))
3136 return -EINVAL;
3137
3138 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3139 if (objtype == NFT_OBJECT_UNSPEC ||
3140 objtype > NFT_OBJECT_MAX)
3141 return -EINVAL;
3142 } else if (flags & NFT_SET_OBJECT)
3143 return -EINVAL;
3144 else
3145 objtype = NFT_OBJECT_UNSPEC;
3146
761da293
PM		 3147 timeout = 0;
3148 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3149 if (!(flags & NFT_SET_TIMEOUT))
3150 return -EINVAL;
8e1102d5
FW		 3151
3152 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3153 if (err)
3154 return err;
761da293
PM		 3155 }
3156 gc_int = 0;
3157 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3158 if (!(flags & NFT_SET_TIMEOUT))
3159 return -EINVAL;
3160 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3161 }
3162
c50b960c
PM		 3163 policy = NFT_SET_POL_PERFORMANCE;
3164 if (nla[NFTA_SET_POLICY] != NULL)
3165 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3166
3167 if (nla[NFTA_SET_DESC] != NULL) {
3168 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3169 if (err < 0)
3170 return err;
3171 }
3172
20a69341
PM		 3173 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3174
cac20fcd 3175 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 3176 if (IS_ERR(table)) {
3177 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3178 return PTR_ERR(table);
36dd1bcc 3179 }
20a69341 3180
98319cb9 3181 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3182
cac20fcd 3183 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 3184 if (IS_ERR(set)) {
36dd1bcc
PNA		 3185 if (PTR_ERR(set) != -ENOENT) {
3186 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3187 return PTR_ERR(set);
36dd1bcc 3188 }
1a28ad74 3189 } else {
36dd1bcc
PNA		 3190 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3191 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3192 return -EEXIST;
36dd1bcc 3193 }
20a69341
PM		 3194 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3195 return -EOPNOTSUPP;
36dd1bcc 3196
20a69341
PM		 3197 return 0;
3198 }
3199
3200 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3201 return -ENOENT;
3202
2b664957 3203 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3204 if (IS_ERR(ops))
3205 return PTR_ERR(ops);
3206
e6d8ecac
CFG		 3207 udlen = 0;
3208 if (nla[NFTA_SET_USERDATA])
3209 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3210
20a69341
PM		 3211 size = 0;
3212 if (ops->privsize != NULL)
347b408d 3213 size = ops->privsize(nla, &desc);
20a69341 3214
1ff75a3e
PNA		 3215 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3216 if (!set) {
3217 err = -ENOMEM;
20a69341 3218 goto err1;
1ff75a3e 3219 }
20a69341 3220
38745490
PS		 3221 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3222 if (!name) {
3223 err = -ENOMEM;
3224 goto err2;
3225 }
3226
20a69341 3227 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3228 kfree(name);
20a69341
PM		 3229 if (err < 0)
3230 goto err2;
3231
e6d8ecac
CFG		 3232 udata = NULL;
3233 if (udlen) {
3234 udata = set->data + size;
3235 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3236 }
3237
20a69341
PM		 3238 INIT_LIST_HEAD(&set->bindings);
3239 set->ops = ops;
3240 set->ktype = ktype;
c50b960c 3241 set->klen = desc.klen;
20a69341 3242 set->dtype = dtype;
8aeff920 3243 set->objtype = objtype;
c50b960c 3244 set->dlen = desc.dlen;
20a69341 3245 set->flags = flags;
c50b960c 3246 set->size = desc.size;
9363dc4b 3247 set->policy = policy;
e6d8ecac
CFG		 3248 set->udlen = udlen;
3249 set->udata = udata;
761da293
PM		 3250 set->timeout = timeout;
3251 set->gc_int = gc_int;
3ecbfd65 3252 set->handle = nf_tables_alloc_handle(table);
20a69341 3253
c50b960c 3254 err = ops->init(set, &desc, nla);
20a69341 3255 if (err < 0)
2f6adf48 3256 goto err3;
20a69341 3257
958bee14 3258 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3259 if (err < 0)
2f6adf48 3260 goto err4;
20a69341 3261
e688a7f8 3262 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3263 table->use++;
20a69341
PM		 3264 return 0;
3265
2f6adf48 3266err4:
c17c3cdf 3267 ops->destroy(set);
2f6adf48
FW		 3268err3:
3269 kfree(set->name);
20a69341 3270err2:
1ff75a3e 3271 kvfree(set);
20a69341 3272err1:
71cc0873 3273 module_put(to_set_type(ops)->owner);
20a69341
PM		 3274 return err;
3275}
3276
958bee14 3277static void nft_set_destroy(struct nft_set *set)
20a69341 3278{
20a69341 3279 set->ops->destroy(set);
71cc0873 3280 module_put(to_set_type(set->ops)->owner);
38745490 3281 kfree(set->name);
1ff75a3e 3282 kvfree(set);
20a69341
PM		 3283}
3284
958bee14
PNA		 3285static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3286{
e688a7f8 3287 list_del_rcu(&set->list);
31f8441c 3288 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
958bee14
PNA		 3289 nft_set_destroy(set);
3290}
3291
633c9a84
PNA		 3292static int nf_tables_delset(struct net *net, struct sock *nlsk,
3293 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3294 const struct nlattr * const nla[],
3295 struct netlink_ext_ack *extack)
20a69341 3296{
c9c8e485 3297 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3298 u8 genmask = nft_genmask_next(net);
36dd1bcc 3299 const struct nlattr *attr;
20a69341
PM		 3300 struct nft_set *set;
3301 struct nft_ctx ctx;
3302 int err;
3303
ec2c9935
PM		 3304 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3305 return -EAFNOSUPPORT;
20a69341
PM		 3306 if (nla[NFTA_SET_TABLE] == NULL)
3307 return -EINVAL;
3308
36dd1bcc
PNA		 3309 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3310 genmask);
20a69341
PM		 3311 if (err < 0)
3312 return err;
3313
36dd1bcc
PNA		 3314 if (nla[NFTA_SET_HANDLE]) {
3315 attr = nla[NFTA_SET_HANDLE];
3316 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3317 } else {
3318 attr = nla[NFTA_SET_NAME];
3319 set = nft_set_lookup(ctx.table, attr, genmask);
3320 }
a8278400 3321
36dd1bcc
PNA		 3322 if (IS_ERR(set)) {
3323 NL_SET_BAD_ATTR(extack, attr);
3324 return PTR_ERR(set);
3325 }
a8278400 3326 if (!list_empty(&set->bindings) ||
36dd1bcc
PNA		 3327 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3328 NL_SET_BAD_ATTR(extack, attr);
20a69341 3329 return -EBUSY;
36dd1bcc 3330 }
20a69341 3331
ee01d542 3332 return nft_delset(&ctx, set);
20a69341
PM		 3333}
3334
3335static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3336 struct nft_set *set,
20a69341 3337 const struct nft_set_iter *iter,
de70185d 3338 struct nft_set_elem *elem)
20a69341 3339{
fe2811eb 3340 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3341 enum nft_registers dreg;
3342
3343 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3344 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3345 set->dtype == NFT_DATA_VERDICT ?
3346 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3347 set->dlen);
20a69341
PM		 3348}
3349
3350int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3351 struct nft_set_binding *binding)
3352{
3353 struct nft_set_binding *i;
3354 struct nft_set_iter iter;
3355
408070d6 3356 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3357 return -EBUSY;
3358
11113e19 3359 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3360 /* If the set is already bound to the same chain all
3361 * jumps are already validated for that chain.
3362 */
3363 list_for_each_entry(i, &set->bindings, list) {
a4684402 3364 if (i->flags & NFT_SET_MAP &&
11113e19 3365 i->chain == binding->chain)
20a69341
PM		 3366 goto bind;
3367 }
3368
8588ac09 3369 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3370 iter.skip = 0;
3371 iter.count = 0;
3372 iter.err = 0;
3373 iter.fn = nf_tables_bind_check_setelem;
3374
3375 set->ops->walk(ctx, set, &iter);
a02f4248 3376 if (iter.err < 0)
20a69341 3377 return iter.err;
20a69341
PM		 3378 }
3379bind:
3380 binding->chain = ctx->chain;
e688a7f8 3381 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3382 return 0;
3383}
63aea290 3384EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341
PM		 3385
3386void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3387 struct nft_set_binding *binding)
3388{
e688a7f8 3389 list_del_rcu(&binding->list);
20a69341 3390
408070d6 3391 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
37a9cc52 3392 nft_is_active(ctx->net, set))
20a69341
PM		 3393 nf_tables_set_destroy(ctx, set);
3394}
63aea290 3395EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3396
3ac4c07a
PM		 3397const struct nft_set_ext_type nft_set_ext_types[] = {
3398 [NFT_SET_EXT_KEY] = {
7d740264 3399 .align = __alignof__(u32),
3ac4c07a
PM		 3400 },
3401 [NFT_SET_EXT_DATA] = {
7d740264 3402 .align = __alignof__(u32),
3ac4c07a 3403 },
f25ad2e9
PM		 3404 [NFT_SET_EXT_EXPR] = {
3405 .align = __alignof__(struct nft_expr),
3406 },
8aeff920
PNA		 3407 [NFT_SET_EXT_OBJREF] = {
3408 .len = sizeof(struct nft_object *),
3409 .align = __alignof__(struct nft_object *),
3410 },
3ac4c07a
PM		 3411 [NFT_SET_EXT_FLAGS] = {
3412 .len = sizeof(u8),
3413 .align = __alignof__(u8),
3414 },
c3e1b005
PM		 3415 [NFT_SET_EXT_TIMEOUT] = {
3416 .len = sizeof(u64),
3417 .align = __alignof__(u64),
3418 },
3419 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 3420 .len = sizeof(u64),
3421 .align = __alignof__(u64),
c3e1b005 3422 },
68e942e8
PM		 3423 [NFT_SET_EXT_USERDATA] = {
3424 .len = sizeof(struct nft_userdata),
3425 .align = __alignof__(struct nft_userdata),
3426 },
3ac4c07a
PM		 3427};
3428EXPORT_SYMBOL_GPL(nft_set_ext_types);
3429
20a69341
PM		 3430/*
3431 * Set elements
3432 */
3433
3434static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3435 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3436 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3437 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3438 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3439 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3440 .len = NFT_USERDATA_MAXLEN },
467697d2
FW		 3441 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3442 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
20a69341
PM		 3443};
3444
3445static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3446 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3447 .len = NFT_TABLE_MAXNAMELEN - 1 },
3448 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3449 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3450 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3451 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3452};
3453
633c9a84 3454static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3455 const struct sk_buff *skb,
3456 const struct nlmsghdr *nlh,
f2a6d766 3457 const struct nlattr * const nla[],
36dd1bcc 3458 struct netlink_ext_ack *extack,
f2a6d766 3459 u8 genmask)
20a69341
PM		 3460{
3461 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3462 int family = nfmsg->nfgen_family;
7c95f6d8 3463 struct nft_table *table;
20a69341 3464
cac20fcd
PNA		 3465 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3466 genmask);
36dd1bcc
PNA		 3467 if (IS_ERR(table)) {
3468 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 3469 return PTR_ERR(table);
36dd1bcc 3470 }
20a69341 3471
98319cb9 3472 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3473 return 0;
3474}
3475
3476static int nf_tables_fill_setelem(struct sk_buff *skb,
3477 const struct nft_set *set,
3478 const struct nft_set_elem *elem)
3479{
fe2811eb 3480 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3481 unsigned char *b = skb_tail_pointer(skb);
3482 struct nlattr *nest;
3483
3484 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3485 if (nest == NULL)
3486 goto nla_put_failure;
3487
fe2811eb
PM		 3488 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3489 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3490 goto nla_put_failure;
3491
fe2811eb
PM		 3492 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3493 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3494 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3495 set->dlen) < 0)
3496 goto nla_put_failure;
3497
f25ad2e9
PM		 3498 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3499 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3500 goto nla_put_failure;
3501
8aeff920
PNA		 3502 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3503 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3504 (*nft_set_ext_obj(ext))->name) < 0)
3505 goto nla_put_failure;
3506
fe2811eb
PM		 3507 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3508 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3509 htonl(*nft_set_ext_flags(ext))))
3510 goto nla_put_failure;
20a69341 3511
c3e1b005
PM		 3512 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3513 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 3514 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 3515 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3516 goto nla_put_failure;
3517
3518 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 3519 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 3520
3521 expires = *nft_set_ext_expiration(ext);
8e1102d5 3522 if (time_before64(now, expires))
c3e1b005
PM		 3523 expires -= now;
3524 else
3525 expires = 0;
3526
3527 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 3528 nf_jiffies64_to_msecs(expires),
b46f6ded 3529 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3530 goto nla_put_failure;
3531 }
3532
68e942e8
PM		 3533 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3534 struct nft_userdata *udata;
3535
3536 udata = nft_set_ext_userdata(ext);
3537 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3538 udata->len + 1, udata->data))
3539 goto nla_put_failure;
3540 }
3541
20a69341
PM		 3542 nla_nest_end(skb, nest);
3543 return 0;
3544
3545nla_put_failure:
3546 nlmsg_trim(skb, b);
3547 return -EMSGSIZE;
3548}
3549
3550struct nft_set_dump_args {
3551 const struct netlink_callback *cb;
3552 struct nft_set_iter iter;
3553 struct sk_buff *skb;
3554};
3555
3556static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3557 struct nft_set *set,
20a69341 3558 const struct nft_set_iter *iter,
de70185d 3559 struct nft_set_elem *elem)
20a69341
PM		 3560{
3561 struct nft_set_dump_args *args;
3562
3563 args = container_of(iter, struct nft_set_dump_args, iter);
3564 return nf_tables_fill_setelem(args->skb, set, elem);
3565}
3566
fa803605
LZ		 3567struct nft_set_dump_ctx {
3568 const struct nft_set *set;
3569 struct nft_ctx ctx;
3570};
3571
20a69341
PM		 3572static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3573{
fa803605 3574 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3575 struct net *net = sock_net(skb->sk);
fa803605 3576 struct nft_table *table;
de70185d 3577 struct nft_set *set;
20a69341 3578 struct nft_set_dump_args args;
fa803605 3579 bool set_found = false;
20a69341
PM		 3580 struct nfgenmsg *nfmsg;
3581 struct nlmsghdr *nlh;
3582 struct nlattr *nest;
3583 u32 portid, seq;
fa803605 3584 int event;
20a69341 3585
fa803605 3586 rcu_read_lock();
36596dad
PNA		 3587 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3588 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 3589 dump_ctx->ctx.family != table->family)
fa803605 3590 continue;
20a69341 3591
36596dad
PNA		 3592 if (table != dump_ctx->ctx.table)
3593 continue;
20a69341 3594
36596dad
PNA		 3595 list_for_each_entry_rcu(set, &table->sets, list) {
3596 if (set == dump_ctx->set) {
3597 set_found = true;
3598 break;
fa803605 3599 }
fa803605
LZ		 3600 }
3601 break;
3602 }
3603
3604 if (!set_found) {
3605 rcu_read_unlock();
3606 return -ENOENT;
3607 }
20a69341 3608
dedb67c4 3609 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3610 portid = NETLINK_CB(cb->skb).portid;
3611 seq = cb->nlh->nlmsg_seq;
3612
3613 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3614 NLM_F_MULTI);
3615 if (nlh == NULL)
3616 goto nla_put_failure;
3617
3618 nfmsg = nlmsg_data(nlh);
98319cb9 3619 nfmsg->nfgen_family = table->family;
20a69341 3620 nfmsg->version = NFNETLINK_V0;
fa803605 3621 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3622
fa803605 3623 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3624 goto nla_put_failure;
3625 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3626 goto nla_put_failure;
3627
3628 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3629 if (nest == NULL)
3630 goto nla_put_failure;
3631
8588ac09
PNA		 3632 args.cb = cb;
3633 args.skb = skb;
fa803605 3634 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3635 args.iter.skip = cb->args[0];
3636 args.iter.count = 0;
3637 args.iter.err = 0;
3638 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3639 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3640 rcu_read_unlock();
20a69341
PM		 3641
3642 nla_nest_end(skb, nest);
3643 nlmsg_end(skb, nlh);
3644
3645 if (args.iter.err && args.iter.err != -EMSGSIZE)
3646 return args.iter.err;
3647 if (args.iter.count == cb->args[0])
3648 return 0;
3649
3650 cb->args[0] = args.iter.count;
3651 return skb->len;
3652
3653nla_put_failure:
fa803605 3654 rcu_read_unlock();
20a69341
PM		 3655 return -ENOSPC;
3656}
3657
fa803605
LZ		 3658static int nf_tables_dump_set_done(struct netlink_callback *cb)
3659{
3660 kfree(cb->data);
3661 return 0;
3662}
3663
d60ce62f
AB		 3664static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3665 const struct nft_ctx *ctx, u32 seq,
3666 u32 portid, int event, u16 flags,
3667 const struct nft_set *set,
3668 const struct nft_set_elem *elem)
3669{
3670 struct nfgenmsg *nfmsg;
3671 struct nlmsghdr *nlh;
3672 struct nlattr *nest;
3673 int err;
3674
dedb67c4 3675 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 3676 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3677 flags);
3678 if (nlh == NULL)
3679 goto nla_put_failure;
3680
3681 nfmsg = nlmsg_data(nlh);
36596dad 3682 nfmsg->nfgen_family = ctx->family;
d60ce62f 3683 nfmsg->version = NFNETLINK_V0;
84d7fce6 3684 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 3685
3686 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3687 goto nla_put_failure;
3688 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3689 goto nla_put_failure;
3690
3691 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3692 if (nest == NULL)
3693 goto nla_put_failure;
3694
3695 err = nf_tables_fill_setelem(skb, set, elem);
3696 if (err < 0)
3697 goto nla_put_failure;
3698
3699 nla_nest_end(skb, nest);
3700
053c095a
JB		 3701 nlmsg_end(skb, nlh);
3702 return 0;
d60ce62f
AB		 3703
3704nla_put_failure:
3705 nlmsg_trim(skb, nlh);
3706 return -1;
3707}
3708
ba0e4d99
PNA		 3709static int nft_setelem_parse_flags(const struct nft_set *set,
3710 const struct nlattr *attr, u32 *flags)
3711{
3712 if (attr == NULL)
3713 return 0;
3714
3715 *flags = ntohl(nla_get_be32(attr));
3716 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3717 return -EINVAL;
3718 if (!(set->flags & NFT_SET_INTERVAL) &&
3719 *flags & NFT_SET_ELEM_INTERVAL_END)
3720 return -EINVAL;
3721
3722 return 0;
3723}
3724
3725static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3726 const struct nlattr *attr)
3727{
3728 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3729 const struct nft_set_ext *ext;
3730 struct nft_data_desc desc;
3731 struct nft_set_elem elem;
3732 struct sk_buff *skb;
3733 uint32_t flags = 0;
3734 void *priv;
3735 int err;
3736
3737 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3738 nft_set_elem_policy, NULL);
3739 if (err < 0)
3740 return err;
3741
3742 if (!nla[NFTA_SET_ELEM_KEY])
3743 return -EINVAL;
3744
3745 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3746 if (err < 0)
3747 return err;
3748
3749 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3750 nla[NFTA_SET_ELEM_KEY]);
3751 if (err < 0)
3752 return err;
3753
3754 err = -EINVAL;
3755 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3756 return err;
3757
3758 priv = set->ops->get(ctx->net, set, &elem, flags);
3759 if (IS_ERR(priv))
3760 return PTR_ERR(priv);
3761
3762 elem.priv = priv;
3763 ext = nft_set_elem_ext(set, &elem);
3764
3765 err = -ENOMEM;
3766 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3767 if (skb == NULL)
3768 goto err1;
3769
3770 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3771 NFT_MSG_NEWSETELEM, 0, set, &elem);
3772 if (err < 0)
3773 goto err2;
3774
3775 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3776 /* This avoids a loop in nfnetlink. */
3777 if (err < 0)
3778 goto err1;
3779
3780 return 0;
3781err2:
3782 kfree_skb(skb);
3783err1:
3784 /* this avoids a loop in nfnetlink. */
3785 return err == -EAGAIN ? -ENOBUFS : err;
3786}
3787
3788static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3789 struct sk_buff *skb, const struct nlmsghdr *nlh,
3790 const struct nlattr * const nla[],
3791 struct netlink_ext_ack *extack)
3792{
3793 u8 genmask = nft_genmask_cur(net);
3794 struct nft_set *set;
3795 struct nlattr *attr;
3796 struct nft_ctx ctx;
3797 int rem, err = 0;
3798
36dd1bcc
PNA		 3799 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
3800 genmask);
ba0e4d99
PNA		 3801 if (err < 0)
3802 return err;
3803
cac20fcd 3804 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 3805 if (IS_ERR(set))
3806 return PTR_ERR(set);
3807
3808 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3809 struct netlink_dump_control c = {
3810 .dump = nf_tables_dump_set,
3811 .done = nf_tables_dump_set_done,
3812 };
3813 struct nft_set_dump_ctx *dump_ctx;
3814
3815 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3816 if (!dump_ctx)
3817 return -ENOMEM;
3818
3819 dump_ctx->set = set;
3820 dump_ctx->ctx = ctx;
3821
3822 c.data = dump_ctx;
3823 return netlink_dump_start(nlsk, skb, nlh, &c);
3824 }
3825
3826 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3827 return -EINVAL;
3828
3829 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3830 err = nft_get_set_elem(&ctx, set, attr);
3831 if (err < 0)
3832 break;
3833 }
3834
3835 return err;
3836}
3837
25e94a99
PNA		 3838static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3839 const struct nft_set *set,
3840 const struct nft_set_elem *elem,
3841 int event, u16 flags)
d60ce62f 3842{
128ad332
PNA		 3843 struct net *net = ctx->net;
3844 u32 portid = ctx->portid;
d60ce62f
AB		 3845 struct sk_buff *skb;
3846 int err;
3847
128ad332 3848 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 3849 return;
d60ce62f 3850
d60ce62f
AB		 3851 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3852 if (skb == NULL)
3853 goto err;
3854
3855 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3856 set, elem);
3857 if (err < 0) {
3858 kfree_skb(skb);
3859 goto err;
3860 }
3861
25e94a99
PNA		 3862 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3863 GFP_KERNEL);
3864 return;
d60ce62f 3865err:
25e94a99 3866 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 3867}
3868
60319eb1
PNA		 3869static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3870 int msg_type,
3871 struct nft_set *set)
3872{
3873 struct nft_trans *trans;
3874
3875 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3876 if (trans == NULL)
3877 return NULL;
3878
3879 nft_trans_elem_set(trans) = set;
3880 return trans;
3881}
3882
22fe54d5
PM		 3883void *nft_set_elem_init(const struct nft_set *set,
3884 const struct nft_set_ext_tmpl *tmpl,
49499c3e 3885 const u32 *key, const u32 *data,
22fe54d5 3886 u64 timeout, gfp_t gfp)
fe2811eb
PM		 3887{
3888 struct nft_set_ext *ext;
3889 void *elem;
3890
3891 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3892 if (elem == NULL)
3893 return NULL;
3894
3895 ext = nft_set_elem_ext(set, elem);
3896 nft_set_ext_init(ext, tmpl);
3897
3898 memcpy(nft_set_ext_key(ext), key, set->klen);
3899 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3900 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 3901 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3902 *nft_set_ext_expiration(ext) =
8e1102d5 3903 get_jiffies_64() + timeout;
c3e1b005
PM		 3904 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3905 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 3906
3907 return elem;
3908}
3909
61f9e292
LZ		 3910void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3911 bool destroy_expr)
61edafbb
PM		 3912{
3913 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3914
59105446 3915 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 3916 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 3917 nft_data_release(nft_set_ext_data(ext), set->dtype);
61f9e292 3918 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
f25ad2e9 3919 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
8aeff920
PNA		 3920 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3921 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 3922 kfree(elem);
3923}
3924EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3925
59105446
PNA		 3926/* Only called from commit path, nft_set_elem_deactivate() already deals with
3927 * the refcounting from the preparation phase.
3928 */
3929static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3930{
3931 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3932
3933 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3934 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3935 kfree(elem);
3936}
3937
60319eb1 3938static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 3939 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 3940{
3941 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 3942 u8 genmask = nft_genmask_next(ctx->net);
20a69341 3943 struct nft_data_desc d1, d2;
fe2811eb 3944 struct nft_set_ext_tmpl tmpl;
c016c7e4 3945 struct nft_set_ext *ext, *ext2;
20a69341
PM		 3946 struct nft_set_elem elem;
3947 struct nft_set_binding *binding;
8aeff920 3948 struct nft_object *obj = NULL;
68e942e8 3949 struct nft_userdata *udata;
fe2811eb 3950 struct nft_data data;
20a69341 3951 enum nft_registers dreg;
60319eb1 3952 struct nft_trans *trans;
0e9091d6 3953 u32 flags = 0;
c3e1b005 3954 u64 timeout;
68e942e8 3955 u8 ulen;
20a69341
PM		 3956 int err;
3957
3958 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 3959 nft_set_elem_policy, NULL);
20a69341
PM		 3960 if (err < 0)
3961 return err;
3962
3963 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3964 return -EINVAL;
3965
fe2811eb
PM		 3966 nft_set_ext_prepare(&tmpl);
3967
0e9091d6
PNA		 3968 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3969 if (err < 0)
3970 return err;
3971 if (flags != 0)
3972 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 3973
3974 if (set->flags & NFT_SET_MAP) {
3975 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 3976 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 3977 return -EINVAL;
bd7fc645 3978 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 3979 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 3980 return -EINVAL;
20a69341
PM		 3981 } else {
3982 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3983 return -EINVAL;
3984 }
3985
c3e1b005
PM		 3986 timeout = 0;
3987 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3988 if (!(set->flags & NFT_SET_TIMEOUT))
3989 return -EINVAL;
8e1102d5
FW		 3990 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
3991 &timeout);
3992 if (err)
3993 return err;
c3e1b005
PM		 3994 } else if (set->flags & NFT_SET_TIMEOUT) {
3995 timeout = set->timeout;
3996 }
3997
7d740264 3998 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 3999 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4000 if (err < 0)
4001 goto err1;
4002 err = -EINVAL;
4003 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4004 goto err2;
4005
7d740264 4006 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 4007 if (timeout > 0) {
4008 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4009 if (timeout != set->timeout)
4010 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4011 }
fe2811eb 4012
8aeff920
PNA		 4013 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4014 if (!(set->flags & NFT_SET_OBJECT)) {
4015 err = -EINVAL;
4016 goto err2;
4017 }
cac20fcd
PNA		 4018 obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
4019 set->objtype, genmask);
8aeff920
PNA		 4020 if (IS_ERR(obj)) {
4021 err = PTR_ERR(obj);
4022 goto err2;
4023 }
4024 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4025 }
4026
20a69341 4027 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 4028 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4029 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 4030 if (err < 0)
4031 goto err2;
4032
4033 err = -EINVAL;
4034 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4035 goto err3;
4036
4037 dreg = nft_type_to_reg(set->dtype);
4038 list_for_each_entry(binding, &set->bindings, list) {
4039 struct nft_ctx bind_ctx = {
58c78e10 4040 .net = ctx->net,
36596dad 4041 .family = ctx->family,
20a69341 4042 .table = ctx->table,
7c95f6d8 4043 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4044 };
4045
11113e19
PM		 4046 if (!(binding->flags & NFT_SET_MAP))
4047 continue;
4048
1ec10212
PM		 4049 err = nft_validate_register_store(&bind_ctx, dreg,
4050 &data,
4051 d2.type, d2.len);
20a69341
PM		 4052 if (err < 0)
4053 goto err3;
4054 }
fe2811eb 4055
7d740264 4056 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4057 }
4058
68e942e8
PM		 4059 /* The full maximum length of userdata can exceed the maximum
4060 * offset value (U8_MAX) for following extensions, therefor it
4061 * must be the last extension added.
4062 */
4063 ulen = 0;
4064 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4065 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4066 if (ulen > 0)
4067 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4068 ulen);
4069 }
4070
fe2811eb 4071 err = -ENOMEM;
7d740264 4072 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 4073 timeout, GFP_KERNEL);
fe2811eb
PM		 4074 if (elem.priv == NULL)
4075 goto err3;
4076
4077 ext = nft_set_elem_ext(set, elem.priv);
4078 if (flags)
4079 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4080 if (ulen > 0) {
4081 udata = nft_set_ext_userdata(ext);
4082 udata->len = ulen - 1;
4083 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4084 }
8aeff920
PNA		 4085 if (obj) {
4086 *nft_set_ext_obj(ext) = obj;
4087 obj->use++;
4088 }
fe2811eb 4089
60319eb1
PNA		 4090 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4091 if (trans == NULL)
fe2811eb 4092 goto err4;
60319eb1 4093
69086658 4094 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4095 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4096 if (err) {
4097 if (err == -EEXIST) {
9744a6fc
PNA		 4098 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4099 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4100 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4101 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
4102 return -EBUSY;
8aeff920
PNA		 4103 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4104 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4105 memcmp(nft_set_ext_data(ext),
4106 nft_set_ext_data(ext2), set->dlen) != 0) ||
4107 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4108 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4109 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4110 err = -EBUSY;
4111 else if (!(nlmsg_flags & NLM_F_EXCL))
4112 err = 0;
4113 }
fe2811eb 4114 goto err5;
c016c7e4 4115 }
20a69341 4116
35d0ac90
PNA		 4117 if (set->size &&
4118 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4119 err = -ENFILE;
4120 goto err6;
4121 }
4122
60319eb1 4123 nft_trans_elem(trans) = elem;
46bbafce 4124 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4125 return 0;
4126
35d0ac90 4127err6:
5cb82a38 4128 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4129err5:
60319eb1 4130 kfree(trans);
fe2811eb
PM		 4131err4:
4132 kfree(elem.priv);
20a69341
PM		 4133err3:
4134 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4135 nft_data_release(&data, d2.type);
20a69341 4136err2:
59105446 4137 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4138err1:
4139 return err;
4140}
4141
633c9a84
PNA		 4142static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4143 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4144 const struct nlattr * const nla[],
4145 struct netlink_ext_ack *extack)
20a69341 4146{
f2a6d766 4147 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4148 const struct nlattr *attr;
4149 struct nft_set *set;
4150 struct nft_ctx ctx;
60319eb1 4151 int rem, err = 0;
20a69341 4152
7d5570ca
PNA		 4153 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4154 return -EINVAL;
4155
36dd1bcc
PNA		 4156 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4157 genmask);
20a69341
PM		 4158 if (err < 0)
4159 return err;
4160
a3073c17
PNA		 4161 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4162 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4163 if (IS_ERR(set))
4164 return PTR_ERR(set);
958bee14 4165
20a69341
PM		 4166 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4167 return -EBUSY;
4168
4169 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4170 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4171 if (err < 0)
60319eb1 4172 break;
20a69341 4173 }
60319eb1 4174 return err;
20a69341
PM		 4175}
4176
59105446
PNA		 4177/**
4178 * nft_data_hold - hold a nft_data item
4179 *
4180 * @data: struct nft_data to release
4181 * @type: type of data
4182 *
4183 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4184 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4185 * NFT_GOTO verdicts. This function must be called on active data objects
4186 * from the second phase of the commit protocol.
4187 */
4188static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4189{
4190 if (type == NFT_DATA_VERDICT) {
4191 switch (data->verdict.code) {
4192 case NFT_JUMP:
4193 case NFT_GOTO:
4194 data->verdict.chain->use++;
4195 break;
4196 }
4197 }
4198}
4199
4200static void nft_set_elem_activate(const struct net *net,
4201 const struct nft_set *set,
4202 struct nft_set_elem *elem)
4203{
4204 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4205
4206 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4207 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4208 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4209 (*nft_set_ext_obj(ext))->use++;
4210}
4211
4212static void nft_set_elem_deactivate(const struct net *net,
4213 const struct nft_set *set,
4214 struct nft_set_elem *elem)
4215{
4216 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4217
4218 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4219 nft_data_release(nft_set_ext_data(ext), set->dtype);
4220 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4221 (*nft_set_ext_obj(ext))->use--;
4222}
4223
60319eb1 4224static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4225 const struct nlattr *attr)
4226{
4227 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4228 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4229 struct nft_data_desc desc;
4230 struct nft_set_elem elem;
3971ca14 4231 struct nft_set_ext *ext;
60319eb1 4232 struct nft_trans *trans;
3971ca14
PNA		 4233 u32 flags = 0;
4234 void *priv;
20a69341
PM		 4235 int err;
4236
4237 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4238 nft_set_elem_policy, NULL);
20a69341
PM		 4239 if (err < 0)
4240 goto err1;
4241
4242 err = -EINVAL;
4243 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4244 goto err1;
4245
3971ca14
PNA		 4246 nft_set_ext_prepare(&tmpl);
4247
4248 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4249 if (err < 0)
4250 return err;
4251 if (flags != 0)
4252 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4253
7d740264 4254 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4255 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4256 if (err < 0)
4257 goto err1;
4258
4259 err = -EINVAL;
4260 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4261 goto err2;
4262
3971ca14
PNA		 4263 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4264
4265 err = -ENOMEM;
4266 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4267 GFP_KERNEL);
4268 if (elem.priv == NULL)
4269 goto err2;
4270
4271 ext = nft_set_elem_ext(set, elem.priv);
4272 if (flags)
4273 *nft_set_ext_flags(ext) = flags;
4274
60319eb1 4275 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4276 if (trans == NULL) {
4277 err = -ENOMEM;
3971ca14 4278 goto err3;
609ccf08 4279 }
20a69341 4280
42a55769 4281 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4282 if (priv == NULL) {
cc02e457 4283 err = -ENOENT;
3971ca14 4284 goto err4;
cc02e457 4285 }
3971ca14
PNA		 4286 kfree(elem.priv);
4287 elem.priv = priv;
cc02e457 4288
59105446
PNA		 4289 nft_set_elem_deactivate(ctx->net, set, &elem);
4290
60319eb1 4291 nft_trans_elem(trans) = elem;
46bbafce 4292 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4293 return 0;
cc02e457 4294
3971ca14 4295err4:
cc02e457 4296 kfree(trans);
3971ca14
PNA		 4297err3:
4298 kfree(elem.priv);
20a69341 4299err2:
59105446 4300 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4301err1:
4302 return err;
4303}
4304
8411b644 4305static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4306 struct nft_set *set,
8411b644 4307 const struct nft_set_iter *iter,
de70185d 4308 struct nft_set_elem *elem)
8411b644
PNA		 4309{
4310 struct nft_trans *trans;
4311 int err;
4312
4313 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4314 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4315 if (!trans)
4316 return -ENOMEM;
4317
1ba1c414 4318 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4319 err = -ENOENT;
4320 goto err1;
4321 }
b2c11e4b 4322 set->ndeact++;
8411b644 4323
de70185d
PNA		 4324 nft_trans_elem_set(trans) = set;
4325 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4326 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4327
4328 return 0;
4329err1:
4330 kfree(trans);
4331 return err;
4332}
4333
633c9a84
PNA		 4334static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4335 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4336 const struct nlattr * const nla[],
4337 struct netlink_ext_ack *extack)
20a69341 4338{
f2a6d766 4339 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4340 const struct nlattr *attr;
4341 struct nft_set *set;
4342 struct nft_ctx ctx;
60319eb1 4343 int rem, err = 0;
20a69341 4344
36dd1bcc
PNA		 4345 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4346 genmask);
20a69341
PM		 4347 if (err < 0)
4348 return err;
4349
cac20fcd 4350 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 4351 if (IS_ERR(set))
4352 return PTR_ERR(set);
4353 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4354 return -EBUSY;
4355
8411b644 4356 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4357 struct nft_set_iter iter = {
4358 .genmask = genmask,
4359 .fn = nft_flush_set,
8411b644 4360 };
baa2d42c 4361 set->ops->walk(&ctx, set, &iter);
8411b644 4362
baa2d42c 4363 return iter.err;
8411b644
PNA		 4364 }
4365
20a69341
PM		 4366 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4367 err = nft_del_setelem(&ctx, set, attr);
4368 if (err < 0)
60319eb1 4369 break;
4fefee57 4370
3dd0673a 4371 set->ndeact++;
20a69341 4372 }
60319eb1 4373 return err;
20a69341
PM		 4374}
4375
cfed7e1b
PM		 4376void nft_set_gc_batch_release(struct rcu_head *rcu)
4377{
4378 struct nft_set_gc_batch *gcb;
4379 unsigned int i;
4380
4381 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4382 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4383 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4384 kfree(gcb);
4385}
4386EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4387
4388struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4389 gfp_t gfp)
4390{
4391 struct nft_set_gc_batch *gcb;
4392
4393 gcb = kzalloc(sizeof(*gcb), gfp);
4394 if (gcb == NULL)
4395 return gcb;
4396 gcb->head.set = set;
4397 return gcb;
4398}
4399EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4400
e5009240
PNA		 4401/*
4402 * Stateful objects
4403 */
4404
4405/**
4406 * nft_register_obj- register nf_tables stateful object type
4407 * @obj: object type
4408 *
4409 * Registers the object type for use with nf_tables. Returns zero on
4410 * success or a negative errno code otherwise.
4411 */
4412int nft_register_obj(struct nft_object_type *obj_type)
4413{
4414 if (obj_type->type == NFT_OBJECT_UNSPEC)
4415 return -EINVAL;
4416
4417 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4418 list_add_rcu(&obj_type->list, &nf_tables_objects);
4419 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4420 return 0;
4421}
4422EXPORT_SYMBOL_GPL(nft_register_obj);
4423
4424/**
4425 * nft_unregister_obj - unregister nf_tables object type
4426 * @obj: object type
4427 *
4428 * Unregisters the object type for use with nf_tables.
4429 */
4430void nft_unregister_obj(struct nft_object_type *obj_type)
4431{
4432 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4433 list_del_rcu(&obj_type->list);
4434 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4435}
4436EXPORT_SYMBOL_GPL(nft_unregister_obj);
4437
cac20fcd
PNA		 4438struct nft_object *nft_obj_lookup(const struct nft_table *table,
4439 const struct nlattr *nla, u32 objtype,
4440 u8 genmask)
e5009240
PNA		 4441{
4442 struct nft_object *obj;
4443
4444 list_for_each_entry(obj, &table->objects, list) {
4445 if (!nla_strcmp(nla, obj->name) &&
dfc46034 4446 objtype == obj->ops->type->type &&
e5009240
PNA		 4447 nft_active_genmask(obj, genmask))
4448 return obj;
4449 }
4450 return ERR_PTR(-ENOENT);
4451}
cac20fcd 4452EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 4453
cac20fcd
PNA		 4454static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4455 const struct nlattr *nla,
4456 u32 objtype, u8 genmask)
3ecbfd65
HS		 4457{
4458 struct nft_object *obj;
4459
4460 list_for_each_entry(obj, &table->objects, list) {
4461 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4462 objtype == obj->ops->type->type &&
4463 nft_active_genmask(obj, genmask))
4464 return obj;
4465 }
4466 return ERR_PTR(-ENOENT);
4467}
4468
e5009240 4469static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4470 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4471 .len = NFT_TABLE_MAXNAMELEN - 1 },
4472 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4473 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4474 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4475 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 4476 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 4477};
4478
84fba055
FW		 4479static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4480 const struct nft_object_type *type,
e5009240
PNA		 4481 const struct nlattr *attr)
4482{
5b4c6e38 4483 struct nlattr **tb;
dfc46034 4484 const struct nft_object_ops *ops;
e5009240 4485 struct nft_object *obj;
5b4c6e38
GS		 4486 int err = -ENOMEM;
4487
4488 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4489 if (!tb)
4490 goto err1;
e5009240
PNA		 4491
4492 if (attr) {
fceb6435
JB		 4493 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4494 NULL);
e5009240 4495 if (err < 0)
5b4c6e38 4496 goto err2;
e5009240
PNA		 4497 } else {
4498 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4499 }
4500
dfc46034
PBG		 4501 if (type->select_ops) {
4502 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4503 if (IS_ERR(ops)) {
4504 err = PTR_ERR(ops);
5b4c6e38 4505 goto err2;
dfc46034
PBG		 4506 }
4507 } else {
4508 ops = type->ops;
4509 }
4510
e5009240 4511 err = -ENOMEM;
dfc46034 4512 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 4513 if (!obj)
4514 goto err2;
e5009240 4515
dfc46034 4516 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 4517 if (err < 0)
5b4c6e38 4518 goto err3;
e5009240 4519
dfc46034
PBG		 4520 obj->ops = ops;
4521
5b4c6e38 4522 kfree(tb);
e5009240 4523 return obj;
5b4c6e38 4524err3:
e5009240 4525 kfree(obj);
5b4c6e38
GS		 4526err2:
4527 kfree(tb);
e5009240
PNA		 4528err1:
4529 return ERR_PTR(err);
4530}
4531
4532static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4533 struct nft_object *obj, bool reset)
e5009240
PNA		 4534{
4535 struct nlattr *nest;
4536
4537 nest = nla_nest_start(skb, attr);
4538 if (!nest)
4539 goto nla_put_failure;
dfc46034 4540 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 4541 goto nla_put_failure;
4542 nla_nest_end(skb, nest);
4543 return 0;
4544
4545nla_put_failure:
4546 return -1;
4547}
4548
4549static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4550{
4551 const struct nft_object_type *type;
4552
4553 list_for_each_entry(type, &nf_tables_objects, list) {
4554 if (objtype == type->type)
4555 return type;
4556 }
4557 return NULL;
4558}
4559
4560static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4561{
4562 const struct nft_object_type *type;
4563
4564 type = __nft_obj_type_get(objtype);
4565 if (type != NULL && try_module_get(type->owner))
4566 return type;
4567
4568#ifdef CONFIG_MODULES
4569 if (type == NULL) {
4570 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4571 request_module("nft-obj-%u", objtype);
4572 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4573 if (__nft_obj_type_get(objtype))
4574 return ERR_PTR(-EAGAIN);
4575 }
4576#endif
4577 return ERR_PTR(-ENOENT);
4578}
4579
4580static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4581 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4582 const struct nlattr * const nla[],
4583 struct netlink_ext_ack *extack)
e5009240
PNA		 4584{
4585 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4586 const struct nft_object_type *type;
4587 u8 genmask = nft_genmask_next(net);
4588 int family = nfmsg->nfgen_family;
e5009240
PNA		 4589 struct nft_table *table;
4590 struct nft_object *obj;
4591 struct nft_ctx ctx;
4592 u32 objtype;
4593 int err;
4594
4595 if (!nla[NFTA_OBJ_TYPE] ||
4596 !nla[NFTA_OBJ_NAME] ||
4597 !nla[NFTA_OBJ_DATA])
4598 return -EINVAL;
4599
cac20fcd 4600 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4601 if (IS_ERR(table)) {
4602 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4603 return PTR_ERR(table);
36dd1bcc 4604 }
e5009240
PNA		 4605
4606 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 4607 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 4608 if (IS_ERR(obj)) {
4609 err = PTR_ERR(obj);
36dd1bcc
PNA		 4610 if (err != -ENOENT) {
4611 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4612 return err;
36dd1bcc 4613 }
1a28ad74 4614 } else {
36dd1bcc
PNA		 4615 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4616 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4617 return -EEXIST;
36dd1bcc 4618 }
e5009240
PNA		 4619 return 0;
4620 }
4621
98319cb9 4622 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 4623
4624 type = nft_obj_type_get(objtype);
4625 if (IS_ERR(type))
4626 return PTR_ERR(type);
4627
84fba055 4628 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 4629 if (IS_ERR(obj)) {
4630 err = PTR_ERR(obj);
4631 goto err1;
4632 }
18965317 4633 obj->table = table;
3ecbfd65
HS		 4634 obj->handle = nf_tables_alloc_handle(table);
4635
61509575
PS		 4636 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4637 if (!obj->name) {
4638 err = -ENOMEM;
4639 goto err2;
4640 }
e5009240
PNA		 4641
4642 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4643 if (err < 0)
61509575 4644 goto err3;
e5009240
PNA		 4645
4646 list_add_tail_rcu(&obj->list, &table->objects);
4647 table->use++;
4648 return 0;
61509575
PS		 4649err3:
4650 kfree(obj->name);
e5009240 4651err2:
dfc46034
PBG		 4652 if (obj->ops->destroy)
4653 obj->ops->destroy(obj);
e5009240
PNA		 4654 kfree(obj);
4655err1:
4656 module_put(type->owner);
4657 return err;
4658}
4659
4660static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4661 u32 portid, u32 seq, int event, u32 flags,
4662 int family, const struct nft_table *table,
43da04a5 4663 struct nft_object *obj, bool reset)
e5009240
PNA		 4664{
4665 struct nfgenmsg *nfmsg;
4666 struct nlmsghdr *nlh;
4667
dedb67c4 4668 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 4669 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4670 if (nlh == NULL)
4671 goto nla_put_failure;
4672
4673 nfmsg = nlmsg_data(nlh);
4674 nfmsg->nfgen_family = family;
4675 nfmsg->version = NFNETLINK_V0;
4676 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4677
4678 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4679 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
dfc46034 4680 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 4681 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 4682 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
4683 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
4684 NFTA_OBJ_PAD))
e5009240
PNA		 4685 goto nla_put_failure;
4686
4687 nlmsg_end(skb, nlh);
4688 return 0;
4689
4690nla_put_failure:
4691 nlmsg_trim(skb, nlh);
4692 return -1;
4693}
4694
a9fea2a3 4695struct nft_obj_filter {
e46abbcc 4696 char *table;
a9fea2a3
PNA		 4697 u32 type;
4698};
4699
e5009240
PNA		 4700static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4701{
4702 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 4703 const struct nft_table *table;
e5009240 4704 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 4705 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 4706 struct net *net = sock_net(skb->sk);
4707 int family = nfmsg->nfgen_family;
43da04a5
PNA		 4708 struct nft_object *obj;
4709 bool reset = false;
4710
4711 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4712 reset = true;
e5009240
PNA		 4713
4714 rcu_read_lock();
4715 cb->seq = net->nft.base_seq;
4716
36596dad 4717 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 4718 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 4719 continue;
4720
36596dad
PNA		 4721 list_for_each_entry_rcu(obj, &table->objects, list) {
4722 if (!nft_is_active(net, obj))
4723 goto cont;
4724 if (idx < s_idx)
4725 goto cont;
4726 if (idx > s_idx)
4727 memset(&cb->args[1], 0,
4728 sizeof(cb->args) - sizeof(cb->args[0]));
4729 if (filter && filter->table[0] &&
4730 strcmp(filter->table, table->name))
4731 goto cont;
4732 if (filter &&
4733 filter->type != NFT_OBJECT_UNSPEC &&
4734 obj->ops->type->type != filter->type)
4735 goto cont;
a9fea2a3 4736
36596dad
PNA		 4737 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4738 cb->nlh->nlmsg_seq,
4739 NFT_MSG_NEWOBJ,
4740 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 4741 table->family, table,
36596dad
PNA		 4742 obj, reset) < 0)
4743 goto done;
e5009240 4744
36596dad 4745 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 4746cont:
36596dad 4747 idx++;
e5009240
PNA		 4748 }
4749 }
4750done:
4751 rcu_read_unlock();
4752
4753 cb->args[0] = idx;
4754 return skb->len;
4755}
4756
a9fea2a3
PNA		 4757static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4758{
e46abbcc
PS		 4759 struct nft_obj_filter *filter = cb->data;
4760
8bea728d
HL		 4761 if (filter) {
4762 kfree(filter->table);
4763 kfree(filter);
4764 }
a9fea2a3
PNA		 4765
4766 return 0;
4767}
4768
4769static struct nft_obj_filter *
4770nft_obj_filter_alloc(const struct nlattr * const nla[])
4771{
4772 struct nft_obj_filter *filter;
4773
4774 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4775 if (!filter)
4776 return ERR_PTR(-ENOMEM);
4777
e46abbcc
PS		 4778 if (nla[NFTA_OBJ_TABLE]) {
4779 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL);
4780 if (!filter->table) {
4781 kfree(filter);
4782 return ERR_PTR(-ENOMEM);
4783 }
4784 }
a9fea2a3
PNA		 4785 if (nla[NFTA_OBJ_TYPE])
4786 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4787
4788 return filter;
4789}
4790
e5009240
PNA		 4791static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4792 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4793 const struct nlattr * const nla[],
4794 struct netlink_ext_ack *extack)
e5009240
PNA		 4795{
4796 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4797 u8 genmask = nft_genmask_cur(net);
4798 int family = nfmsg->nfgen_family;
e5009240
PNA		 4799 const struct nft_table *table;
4800 struct nft_object *obj;
4801 struct sk_buff *skb2;
43da04a5 4802 bool reset = false;
e5009240
PNA		 4803 u32 objtype;
4804 int err;
4805
4806 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4807 struct netlink_dump_control c = {
4808 .dump = nf_tables_dump_obj,
a9fea2a3 4809 .done = nf_tables_dump_obj_done,
e5009240 4810 };
a9fea2a3
PNA		 4811
4812 if (nla[NFTA_OBJ_TABLE] ||
4813 nla[NFTA_OBJ_TYPE]) {
4814 struct nft_obj_filter *filter;
4815
4816 filter = nft_obj_filter_alloc(nla);
4817 if (IS_ERR(filter))
4818 return -ENOMEM;
4819
4820 c.data = filter;
4821 }
e5009240
PNA		 4822 return netlink_dump_start(nlsk, skb, nlh, &c);
4823 }
4824
4825 if (!nla[NFTA_OBJ_NAME] ||
4826 !nla[NFTA_OBJ_TYPE])
4827 return -EINVAL;
4828
cac20fcd 4829 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4830 if (IS_ERR(table)) {
4831 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4832 return PTR_ERR(table);
36dd1bcc 4833 }
e5009240
PNA		 4834
4835 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
cac20fcd 4836 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 4837 if (IS_ERR(obj)) {
4838 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 4839 return PTR_ERR(obj);
36dd1bcc 4840 }
e5009240
PNA		 4841
4842 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4843 if (!skb2)
4844 return -ENOMEM;
4845
43da04a5
PNA		 4846 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4847 reset = true;
4848
e5009240
PNA		 4849 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4850 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 4851 family, table, obj, reset);
e5009240
PNA		 4852 if (err < 0)
4853 goto err;
4854
4855 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4856err:
4857 kfree_skb(skb2);
4858 return err;
e5009240
PNA		 4859}
4860
4861static void nft_obj_destroy(struct nft_object *obj)
4862{
dfc46034
PBG		 4863 if (obj->ops->destroy)
4864 obj->ops->destroy(obj);
e5009240 4865
dfc46034 4866 module_put(obj->ops->type->owner);
61509575 4867 kfree(obj->name);
e5009240
PNA		 4868 kfree(obj);
4869}
4870
4871static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 4872 struct sk_buff *skb, const struct nlmsghdr *nlh,
4873 const struct nlattr * const nla[],
4874 struct netlink_ext_ack *extack)
e5009240
PNA		 4875{
4876 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4877 u8 genmask = nft_genmask_next(net);
4878 int family = nfmsg->nfgen_family;
36dd1bcc 4879 const struct nlattr *attr;
e5009240
PNA		 4880 struct nft_table *table;
4881 struct nft_object *obj;
4882 struct nft_ctx ctx;
4883 u32 objtype;
4884
4885 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 4886 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 4887 return -EINVAL;
4888
cac20fcd 4889 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 4890 if (IS_ERR(table)) {
4891 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 4892 return PTR_ERR(table);
36dd1bcc 4893 }
e5009240
PNA		 4894
4895 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 4896 if (nla[NFTA_OBJ_HANDLE]) {
4897 attr = nla[NFTA_OBJ_HANDLE];
4898 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
4899 } else {
4900 attr = nla[NFTA_OBJ_NAME];
4901 obj = nft_obj_lookup(table, attr, objtype, genmask);
4902 }
4903
4904 if (IS_ERR(obj)) {
4905 NL_SET_BAD_ATTR(extack, attr);
e5009240 4906 return PTR_ERR(obj);
36dd1bcc
PNA		 4907 }
4908 if (obj->use > 0) {
4909 NL_SET_BAD_ATTR(extack, attr);
e5009240 4910 return -EBUSY;
36dd1bcc 4911 }
e5009240 4912
98319cb9 4913 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 4914
4915 return nft_delobj(&ctx, obj);
4916}
4917
25e94a99
PNA		 4918void nft_obj_notify(struct net *net, struct nft_table *table,
4919 struct nft_object *obj, u32 portid, u32 seq, int event,
4920 int family, int report, gfp_t gfp)
e5009240
PNA		 4921{
4922 struct sk_buff *skb;
4923 int err;
4924
2599e989
PNA		 4925 if (!report &&
4926 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4927 return;
e5009240 4928
2599e989 4929 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 4930 if (skb == NULL)
4931 goto err;
4932
2599e989
PNA		 4933 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4934 table, obj, false);
e5009240
PNA		 4935 if (err < 0) {
4936 kfree_skb(skb);
4937 goto err;
4938 }
4939
25e94a99
PNA		 4940 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4941 return;
e5009240 4942err:
25e94a99 4943 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 4944}
2599e989
PNA		 4945EXPORT_SYMBOL_GPL(nft_obj_notify);
4946
25e94a99
PNA		 4947static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4948 struct nft_object *obj, int event)
2599e989 4949{
25e94a99 4950 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 4951 ctx->family, ctx->report, GFP_KERNEL);
2599e989 4952}
e5009240 4953
3b49e2e9
PNA		 4954/*
4955 * Flow tables
4956 */
4957void nft_register_flowtable_type(struct nf_flowtable_type *type)
4958{
4959 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4960 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
4961 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4962}
4963EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
4964
4965void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
4966{
4967 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4968 list_del_rcu(&type->list);
4969 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4970}
4971EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
4972
4973static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
4974 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
4975 .len = NFT_NAME_MAXLEN - 1 },
4976 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
4977 .len = NFT_NAME_MAXLEN - 1 },
4978 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 4979 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
3b49e2e9
PNA		 4980};
4981
cac20fcd
PNA		 4982struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
4983 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 4984{
4985 struct nft_flowtable *flowtable;
4986
4987 list_for_each_entry(flowtable, &table->flowtables, list) {
4988 if (!nla_strcmp(nla, flowtable->name) &&
4989 nft_active_genmask(flowtable, genmask))
4990 return flowtable;
4991 }
4992 return ERR_PTR(-ENOENT);
4993}
cac20fcd 4994EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 4995
ae0662f8 4996static struct nft_flowtable *
cac20fcd
PNA		 4997nft_flowtable_lookup_byhandle(const struct nft_table *table,
4998 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 4999{
5000 struct nft_flowtable *flowtable;
5001
5002 list_for_each_entry(flowtable, &table->flowtables, list) {
5003 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5004 nft_active_genmask(flowtable, genmask))
5005 return flowtable;
5006 }
5007 return ERR_PTR(-ENOENT);
5008}
5009
3b49e2e9
PNA		 5010static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5011 const struct nlattr *attr,
5012 struct net_device *dev_array[], int *len)
5013{
5014 const struct nlattr *tmp;
5015 struct net_device *dev;
5016 char ifname[IFNAMSIZ];
5017 int rem, n = 0, err;
5018
5019 nla_for_each_nested(tmp, attr, rem) {
5020 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5021 err = -EINVAL;
5022 goto err1;
5023 }
5024
5025 nla_strlcpy(ifname, tmp, IFNAMSIZ);
90d2723c 5026 dev = __dev_get_by_name(ctx->net, ifname);
3b49e2e9
PNA		 5027 if (!dev) {
5028 err = -ENOENT;
5029 goto err1;
5030 }
5031
5032 dev_array[n++] = dev;
5033 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5034 err = -EFBIG;
5035 goto err1;
5036 }
5037 }
5038 if (!len)
5039 return -EINVAL;
5040
5041 err = 0;
5042err1:
5043 *len = n;
5044 return err;
5045}
5046
5047static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5048 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5049 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5050 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5051};
5052
5053static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5054 const struct nlattr *attr,
5055 struct nft_flowtable *flowtable)
5056{
5057 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5058 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5059 struct nf_hook_ops *ops;
5060 int hooknum, priority;
5061 int err, n = 0, i;
5062
5063 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5064 nft_flowtable_hook_policy, NULL);
5065 if (err < 0)
5066 return err;
5067
5068 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5069 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5070 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5071 return -EINVAL;
5072
5073 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 5074 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 5075 return -EINVAL;
5076
5077 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5078
5079 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5080 dev_array, &n);
5081 if (err < 0)
d92191aa 5082 return err;
3b49e2e9
PNA		 5083
5084 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
90d2723c
PNA		 5085 if (!ops)
5086 return -ENOMEM;
3b49e2e9 5087
0e839dfa
PNA		 5088 flowtable->hooknum = hooknum;
5089 flowtable->priority = priority;
3b49e2e9
PNA		 5090 flowtable->ops = ops;
5091 flowtable->ops_len = n;
5092
5093 for (i = 0; i < n; i++) {
5094 flowtable->ops[i].pf = NFPROTO_NETDEV;
5095 flowtable->ops[i].hooknum = hooknum;
5096 flowtable->ops[i].priority = priority;
17857d92 5097 flowtable->ops[i].priv = &flowtable->data;
3b49e2e9
PNA		 5098 flowtable->ops[i].hook = flowtable->data.type->hook;
5099 flowtable->ops[i].dev = dev_array[i];
d92191aa
PNA		 5100 flowtable->dev_name[i] = kstrdup(dev_array[i]->name,
5101 GFP_KERNEL);
3b49e2e9
PNA		 5102 }
5103
3b49e2e9
PNA		 5104 return err;
5105}
5106
98319cb9 5107static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5108{
5109 const struct nf_flowtable_type *type;
5110
5111 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 5112 if (family == type->family)
3b49e2e9
PNA		 5113 return type;
5114 }
5115 return NULL;
5116}
5117
98319cb9 5118static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5119{
5120 const struct nf_flowtable_type *type;
5121
98319cb9 5122 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 5123 if (type != NULL && try_module_get(type->owner))
5124 return type;
5125
5126#ifdef CONFIG_MODULES
5127 if (type == NULL) {
5128 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
98319cb9 5129 request_module("nf-flowtable-%u", family);
3b49e2e9 5130 nfnl_lock(NFNL_SUBSYS_NFTABLES);
98319cb9 5131 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 5132 return ERR_PTR(-EAGAIN);
5133 }
5134#endif
5135 return ERR_PTR(-ENOENT);
5136}
5137
3b49e2e9
PNA		 5138static void nft_unregister_flowtable_net_hooks(struct net *net,
5139 struct nft_flowtable *flowtable)
5140{
5141 int i;
5142
5143 for (i = 0; i < flowtable->ops_len; i++) {
5144 if (!flowtable->ops[i].dev)
5145 continue;
5146
5147 nf_unregister_net_hook(net, &flowtable->ops[i]);
5148 }
5149}
5150
5151static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5152 struct sk_buff *skb,
5153 const struct nlmsghdr *nlh,
5154 const struct nlattr * const nla[],
5155 struct netlink_ext_ack *extack)
5156{
5157 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5158 const struct nf_flowtable_type *type;
32fc7187 5159 struct nft_flowtable *flowtable, *ft;
3b49e2e9
PNA		 5160 u8 genmask = nft_genmask_next(net);
5161 int family = nfmsg->nfgen_family;
3b49e2e9
PNA		 5162 struct nft_table *table;
5163 struct nft_ctx ctx;
5164 int err, i, k;
5165
5166 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5167 !nla[NFTA_FLOWTABLE_NAME] ||
5168 !nla[NFTA_FLOWTABLE_HOOK])
5169 return -EINVAL;
5170
cac20fcd
PNA		 5171 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5172 genmask);
36dd1bcc
PNA		 5173 if (IS_ERR(table)) {
5174 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5175 return PTR_ERR(table);
36dd1bcc 5176 }
3b49e2e9 5177
cac20fcd
PNA		 5178 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5179 genmask);
3b49e2e9
PNA		 5180 if (IS_ERR(flowtable)) {
5181 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 5182 if (err != -ENOENT) {
5183 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5184 return err;
36dd1bcc 5185 }
3b49e2e9 5186 } else {
36dd1bcc
PNA		 5187 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5188 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5189 return -EEXIST;
36dd1bcc 5190 }
3b49e2e9
PNA		 5191
5192 return 0;
5193 }
5194
98319cb9 5195 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5196
5197 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5198 if (!flowtable)
5199 return -ENOMEM;
5200
5201 flowtable->table = table;
3ecbfd65
HS		 5202 flowtable->handle = nf_tables_alloc_handle(table);
5203
3b49e2e9
PNA		 5204 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5205 if (!flowtable->name) {
5206 err = -ENOMEM;
5207 goto err1;
5208 }
5209
98319cb9 5210 type = nft_flowtable_type_get(family);
3b49e2e9
PNA		 5211 if (IS_ERR(type)) {
5212 err = PTR_ERR(type);
5213 goto err2;
5214 }
5215
5216 flowtable->data.type = type;
a268de77 5217 err = type->init(&flowtable->data);
3b49e2e9
PNA		 5218 if (err < 0)
5219 goto err3;
5220
5221 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5222 flowtable);
5223 if (err < 0)
a268de77 5224 goto err4;
3b49e2e9
PNA		 5225
5226 for (i = 0; i < flowtable->ops_len; i++) {
32fc7187
PNA		 5227 if (!flowtable->ops[i].dev)
5228 continue;
5229
5230 list_for_each_entry(ft, &table->flowtables, list) {
5231 for (k = 0; k < ft->ops_len; k++) {
5232 if (!ft->ops[k].dev)
5233 continue;
5234
5235 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5236 flowtable->ops[i].pf == ft->ops[k].pf) {
5237 err = -EBUSY;
a268de77 5238 goto err5;
32fc7187
PNA		 5239 }
5240 }
5241 }
5242
3b49e2e9
PNA		 5243 err = nf_register_net_hook(net, &flowtable->ops[i]);
5244 if (err < 0)
a268de77 5245 goto err5;
3b49e2e9
PNA		 5246 }
5247
5248 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5249 if (err < 0)
a268de77 5250 goto err6;
3b49e2e9
PNA		 5251
5252 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5253 table->use++;
5254
5255 return 0;
a268de77 5256err6:
3b49e2e9 5257 i = flowtable->ops_len;
a268de77 5258err5:
d92191aa
PNA		 5259 for (k = i - 1; k >= 0; k--) {
5260 kfree(flowtable->dev_name[k]);
0e0d5002 5261 nf_unregister_net_hook(net, &flowtable->ops[k]);
d92191aa 5262 }
3b49e2e9
PNA		 5263
5264 kfree(flowtable->ops);
a268de77
FF		 5265err4:
5266 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5267err3:
5268 module_put(type->owner);
5269err2:
5270 kfree(flowtable->name);
5271err1:
5272 kfree(flowtable);
5273 return err;
5274}
5275
5276static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5277 struct sk_buff *skb,
5278 const struct nlmsghdr *nlh,
5279 const struct nlattr * const nla[],
5280 struct netlink_ext_ack *extack)
5281{
5282 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5283 u8 genmask = nft_genmask_next(net);
5284 int family = nfmsg->nfgen_family;
5285 struct nft_flowtable *flowtable;
36dd1bcc 5286 const struct nlattr *attr;
3b49e2e9
PNA		 5287 struct nft_table *table;
5288 struct nft_ctx ctx;
5289
e603ea4b
PNA		 5290 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5291 (!nla[NFTA_FLOWTABLE_NAME] &&
5292 !nla[NFTA_FLOWTABLE_HANDLE]))
5293 return -EINVAL;
5294
cac20fcd
PNA		 5295 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5296 genmask);
36dd1bcc
PNA		 5297 if (IS_ERR(table)) {
5298 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5299 return PTR_ERR(table);
36dd1bcc 5300 }
3b49e2e9 5301
36dd1bcc
PNA		 5302 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5303 attr = nla[NFTA_FLOWTABLE_HANDLE];
5304 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5305 } else {
5306 attr = nla[NFTA_FLOWTABLE_NAME];
5307 flowtable = nft_flowtable_lookup(table, attr, genmask);
5308 }
5309
5310 if (IS_ERR(flowtable)) {
5311 NL_SET_BAD_ATTR(extack, attr);
5312 return PTR_ERR(flowtable);
5313 }
5314 if (flowtable->use > 0) {
5315 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 5316 return -EBUSY;
36dd1bcc 5317 }
3b49e2e9 5318
98319cb9 5319 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5320
5321 return nft_delflowtable(&ctx, flowtable);
5322}
5323
5324static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5325 u32 portid, u32 seq, int event,
5326 u32 flags, int family,
5327 struct nft_flowtable *flowtable)
5328{
5329 struct nlattr *nest, *nest_devs;
5330 struct nfgenmsg *nfmsg;
5331 struct nlmsghdr *nlh;
5332 int i;
5333
5334 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5335 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5336 if (nlh == NULL)
5337 goto nla_put_failure;
5338
5339 nfmsg = nlmsg_data(nlh);
5340 nfmsg->nfgen_family = family;
5341 nfmsg->version = NFNETLINK_V0;
5342 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5343
5344 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5345 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 5346 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5347 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5348 NFTA_FLOWTABLE_PAD))
3b49e2e9
PNA		 5349 goto nla_put_failure;
5350
5351 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5352 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5353 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5354 goto nla_put_failure;
5355
5356 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5357 if (!nest_devs)
5358 goto nla_put_failure;
5359
5360 for (i = 0; i < flowtable->ops_len; i++) {
d92191aa 5361 if (flowtable->dev_name[i][0] &&
3b49e2e9 5362 nla_put_string(skb, NFTA_DEVICE_NAME,
d92191aa 5363 flowtable->dev_name[i]))
3b49e2e9
PNA		 5364 goto nla_put_failure;
5365 }
5366 nla_nest_end(skb, nest_devs);
5367 nla_nest_end(skb, nest);
5368
5369 nlmsg_end(skb, nlh);
5370 return 0;
5371
5372nla_put_failure:
5373 nlmsg_trim(skb, nlh);
5374 return -1;
5375}
5376
5377struct nft_flowtable_filter {
5378 char *table;
5379};
5380
5381static int nf_tables_dump_flowtable(struct sk_buff *skb,
5382 struct netlink_callback *cb)
5383{
5384 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5385 struct nft_flowtable_filter *filter = cb->data;
5386 unsigned int idx = 0, s_idx = cb->args[0];
5387 struct net *net = sock_net(skb->sk);
5388 int family = nfmsg->nfgen_family;
5389 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5390 const struct nft_table *table;
5391
5392 rcu_read_lock();
5393 cb->seq = net->nft.base_seq;
5394
36596dad 5395 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5396 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 5397 continue;
5398
36596dad
PNA		 5399 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5400 if (!nft_is_active(net, flowtable))
5401 goto cont;
5402 if (idx < s_idx)
5403 goto cont;
5404 if (idx > s_idx)
5405 memset(&cb->args[1], 0,
5406 sizeof(cb->args) - sizeof(cb->args[0]));
5407 if (filter && filter->table[0] &&
5408 strcmp(filter->table, table->name))
5409 goto cont;
3b49e2e9 5410
36596dad
PNA		 5411 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5412 cb->nlh->nlmsg_seq,
5413 NFT_MSG_NEWFLOWTABLE,
5414 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5415 table->family, flowtable) < 0)
36596dad 5416 goto done;
3b49e2e9 5417
36596dad 5418 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 5419cont:
36596dad 5420 idx++;
3b49e2e9
PNA		 5421 }
5422 }
5423done:
5424 rcu_read_unlock();
5425
5426 cb->args[0] = idx;
5427 return skb->len;
5428}
5429
5430static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
5431{
5432 struct nft_flowtable_filter *filter = cb->data;
5433
5434 if (!filter)
5435 return 0;
5436
5437 kfree(filter->table);
5438 kfree(filter);
5439
5440 return 0;
5441}
5442
5443static struct nft_flowtable_filter *
5444nft_flowtable_filter_alloc(const struct nlattr * const nla[])
5445{
5446 struct nft_flowtable_filter *filter;
5447
5448 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
5449 if (!filter)
5450 return ERR_PTR(-ENOMEM);
5451
5452 if (nla[NFTA_FLOWTABLE_TABLE]) {
5453 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5454 GFP_KERNEL);
5455 if (!filter->table) {
5456 kfree(filter);
5457 return ERR_PTR(-ENOMEM);
5458 }
5459 }
5460 return filter;
5461}
5462
5463static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5464 struct sk_buff *skb,
5465 const struct nlmsghdr *nlh,
5466 const struct nlattr * const nla[],
5467 struct netlink_ext_ack *extack)
5468{
5469 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5470 u8 genmask = nft_genmask_cur(net);
5471 int family = nfmsg->nfgen_family;
5472 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5473 const struct nft_table *table;
5474 struct sk_buff *skb2;
5475 int err;
5476
5477 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5478 struct netlink_dump_control c = {
5479 .dump = nf_tables_dump_flowtable,
5480 .done = nf_tables_dump_flowtable_done,
5481 };
5482
5483 if (nla[NFTA_FLOWTABLE_TABLE]) {
5484 struct nft_flowtable_filter *filter;
5485
5486 filter = nft_flowtable_filter_alloc(nla);
5487 if (IS_ERR(filter))
5488 return -ENOMEM;
5489
5490 c.data = filter;
5491 }
5492 return netlink_dump_start(nlsk, skb, nlh, &c);
5493 }
5494
5495 if (!nla[NFTA_FLOWTABLE_NAME])
5496 return -EINVAL;
5497
cac20fcd
PNA		 5498 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5499 genmask);
3b49e2e9
PNA		 5500 if (IS_ERR(table))
5501 return PTR_ERR(table);
5502
cac20fcd
PNA		 5503 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5504 genmask);
03a0120f 5505 if (IS_ERR(flowtable))
3b49e2e9
PNA		 5506 return PTR_ERR(flowtable);
5507
5508 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5509 if (!skb2)
5510 return -ENOMEM;
5511
5512 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5513 nlh->nlmsg_seq,
5514 NFT_MSG_NEWFLOWTABLE, 0, family,
5515 flowtable);
5516 if (err < 0)
5517 goto err;
5518
5519 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5520err:
5521 kfree_skb(skb2);
5522 return err;
5523}
5524
5525static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5526 struct nft_flowtable *flowtable,
5527 int event)
5528{
5529 struct sk_buff *skb;
5530 int err;
5531
5532 if (ctx->report &&
5533 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5534 return;
5535
5536 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5537 if (skb == NULL)
5538 goto err;
5539
5540 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5541 ctx->seq, event, 0,
36596dad 5542 ctx->family, flowtable);
3b49e2e9
PNA		 5543 if (err < 0) {
5544 kfree_skb(skb);
5545 goto err;
5546 }
5547
5548 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5549 ctx->report, GFP_KERNEL);
5550 return;
5551err:
5552 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5553}
5554
3b49e2e9
PNA		 5555static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5556{
c04a3f73 5557 kfree(flowtable->ops);
3b49e2e9 5558 kfree(flowtable->name);
b408c5b0 5559 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5560 module_put(flowtable->data.type->owner);
5561}
5562
84d7fce6
PNA		 5563static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5564 u32 portid, u32 seq)
5565{
5566 struct nlmsghdr *nlh;
5567 struct nfgenmsg *nfmsg;
784b4e61 5568 char buf[TASK_COMM_LEN];
dedb67c4 5569 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 5570
5571 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5572 if (nlh == NULL)
5573 goto nla_put_failure;
5574
5575 nfmsg = nlmsg_data(nlh);
5576 nfmsg->nfgen_family = AF_UNSPEC;
5577 nfmsg->version = NFNETLINK_V0;
5578 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5579
784b4e61
PS		 5580 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5581 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5582 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 5583 goto nla_put_failure;
5584
053c095a
JB		 5585 nlmsg_end(skb, nlh);
5586 return 0;
84d7fce6
PNA		 5587
5588nla_put_failure:
5589 nlmsg_trim(skb, nlh);
5590 return -EMSGSIZE;
5591}
5592
3b49e2e9
PNA		 5593static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5594 struct nft_flowtable *flowtable)
5595{
5596 int i;
5597
5598 for (i = 0; i < flowtable->ops_len; i++) {
5599 if (flowtable->ops[i].dev != dev)
5600 continue;
5601
5602 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
d92191aa 5603 flowtable->dev_name[i][0] = '\0';
3b49e2e9
PNA		 5604 flowtable->ops[i].dev = NULL;
5605 break;
5606 }
5607}
5608
5609static int nf_tables_flowtable_event(struct notifier_block *this,
5610 unsigned long event, void *ptr)
5611{
5612 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5613 struct nft_flowtable *flowtable;
5614 struct nft_table *table;
3b49e2e9
PNA		 5615
5616 if (event != NETDEV_UNREGISTER)
5617 return 0;
5618
5619 nfnl_lock(NFNL_SUBSYS_NFTABLES);
36596dad
PNA		 5620 list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
5621 list_for_each_entry(flowtable, &table->flowtables, list) {
5622 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 5623 }
5624 }
5625 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5626
5627 return NOTIFY_DONE;
5628}
5629
5630static struct notifier_block nf_tables_flowtable_notifier = {
5631 .notifier_call = nf_tables_flowtable_event,
5632};
5633
25e94a99
PNA		 5634static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5635 int event)
84d7fce6
PNA		 5636{
5637 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5638 struct sk_buff *skb2;
5639 int err;
5640
5641 if (nlmsg_report(nlh) &&
5642 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5643 return;
84d7fce6 5644
84d7fce6
PNA		 5645 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5646 if (skb2 == NULL)
5647 goto err;
5648
5649 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5650 nlh->nlmsg_seq);
5651 if (err < 0) {
5652 kfree_skb(skb2);
5653 goto err;
5654 }
5655
25e94a99
PNA		 5656 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5657 nlmsg_report(nlh), GFP_KERNEL);
5658 return;
84d7fce6 5659err:
25e94a99
PNA		 5660 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5661 -ENOBUFS);
84d7fce6
PNA		 5662}
5663
7b8002a1
PNA		 5664static int nf_tables_getgen(struct net *net, struct sock *nlsk,
5665 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5666 const struct nlattr * const nla[],
5667 struct netlink_ext_ack *extack)
84d7fce6 5668{
84d7fce6
PNA		 5669 struct sk_buff *skb2;
5670 int err;
5671
5672 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5673 if (skb2 == NULL)
5674 return -ENOMEM;
5675
5676 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5677 nlh->nlmsg_seq);
5678 if (err < 0)
5679 goto err;
5680
5681 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5682err:
5683 kfree_skb(skb2);
5684 return err;
5685}
5686
96518518
PM		 5687static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
5688 [NFT_MSG_NEWTABLE] = {
55dd6f93 5689 .call_batch = nf_tables_newtable,
96518518
PM		 5690 .attr_count = NFTA_TABLE_MAX,
5691 .policy = nft_table_policy,
5692 },
5693 [NFT_MSG_GETTABLE] = {
5694 .call = nf_tables_gettable,
5695 .attr_count = NFTA_TABLE_MAX,
5696 .policy = nft_table_policy,
5697 },
5698 [NFT_MSG_DELTABLE] = {
55dd6f93 5699 .call_batch = nf_tables_deltable,
96518518
PM		 5700 .attr_count = NFTA_TABLE_MAX,
5701 .policy = nft_table_policy,
5702 },
5703 [NFT_MSG_NEWCHAIN] = {
91c7b38d 5704 .call_batch = nf_tables_newchain,
96518518
PM		 5705 .attr_count = NFTA_CHAIN_MAX,
5706 .policy = nft_chain_policy,
5707 },
5708 [NFT_MSG_GETCHAIN] = {
5709 .call = nf_tables_getchain,
5710 .attr_count = NFTA_CHAIN_MAX,
5711 .policy = nft_chain_policy,
5712 },
5713 [NFT_MSG_DELCHAIN] = {
91c7b38d 5714 .call_batch = nf_tables_delchain,
96518518
PM		 5715 .attr_count = NFTA_CHAIN_MAX,
5716 .policy = nft_chain_policy,
5717 },
5718 [NFT_MSG_NEWRULE] = {
0628b123 5719 .call_batch = nf_tables_newrule,
96518518
PM		 5720 .attr_count = NFTA_RULE_MAX,
5721 .policy = nft_rule_policy,
5722 },
5723 [NFT_MSG_GETRULE] = {
5724 .call = nf_tables_getrule,
5725 .attr_count = NFTA_RULE_MAX,
5726 .policy = nft_rule_policy,
5727 },
5728 [NFT_MSG_DELRULE] = {
0628b123 5729 .call_batch = nf_tables_delrule,
96518518
PM		 5730 .attr_count = NFTA_RULE_MAX,
5731 .policy = nft_rule_policy,
5732 },
20a69341 5733 [NFT_MSG_NEWSET] = {
958bee14 5734 .call_batch = nf_tables_newset,
20a69341
PM		 5735 .attr_count = NFTA_SET_MAX,
5736 .policy = nft_set_policy,
5737 },
5738 [NFT_MSG_GETSET] = {
5739 .call = nf_tables_getset,
5740 .attr_count = NFTA_SET_MAX,
5741 .policy = nft_set_policy,
5742 },
5743 [NFT_MSG_DELSET] = {
958bee14 5744 .call_batch = nf_tables_delset,
20a69341
PM		 5745 .attr_count = NFTA_SET_MAX,
5746 .policy = nft_set_policy,
5747 },
5748 [NFT_MSG_NEWSETELEM] = {
958bee14 5749 .call_batch = nf_tables_newsetelem,
20a69341
PM		 5750 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5751 .policy = nft_set_elem_list_policy,
5752 },
5753 [NFT_MSG_GETSETELEM] = {
5754 .call = nf_tables_getsetelem,
5755 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5756 .policy = nft_set_elem_list_policy,
5757 },
5758 [NFT_MSG_DELSETELEM] = {
958bee14 5759 .call_batch = nf_tables_delsetelem,
20a69341
PM		 5760 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5761 .policy = nft_set_elem_list_policy,
5762 },
84d7fce6
PNA		 5763 [NFT_MSG_GETGEN] = {
5764 .call = nf_tables_getgen,
5765 },
e5009240
PNA		 5766 [NFT_MSG_NEWOBJ] = {
5767 .call_batch = nf_tables_newobj,
5768 .attr_count = NFTA_OBJ_MAX,
5769 .policy = nft_obj_policy,
5770 },
5771 [NFT_MSG_GETOBJ] = {
5772 .call = nf_tables_getobj,
5773 .attr_count = NFTA_OBJ_MAX,
5774 .policy = nft_obj_policy,
5775 },
5776 [NFT_MSG_DELOBJ] = {
5777 .call_batch = nf_tables_delobj,
5778 .attr_count = NFTA_OBJ_MAX,
5779 .policy = nft_obj_policy,
5780 },
43da04a5
PNA		 5781 [NFT_MSG_GETOBJ_RESET] = {
5782 .call = nf_tables_getobj,
5783 .attr_count = NFTA_OBJ_MAX,
5784 .policy = nft_obj_policy,
5785 },
3b49e2e9
PNA		 5786 [NFT_MSG_NEWFLOWTABLE] = {
5787 .call_batch = nf_tables_newflowtable,
5788 .attr_count = NFTA_FLOWTABLE_MAX,
5789 .policy = nft_flowtable_policy,
5790 },
5791 [NFT_MSG_GETFLOWTABLE] = {
5792 .call = nf_tables_getflowtable,
5793 .attr_count = NFTA_FLOWTABLE_MAX,
5794 .policy = nft_flowtable_policy,
5795 },
5796 [NFT_MSG_DELFLOWTABLE] = {
5797 .call_batch = nf_tables_delflowtable,
5798 .attr_count = NFTA_FLOWTABLE_MAX,
5799 .policy = nft_flowtable_policy,
5800 },
96518518
PM		 5801};
5802
91c7b38d
PNA		 5803static void nft_chain_commit_update(struct nft_trans *trans)
5804{
5805 struct nft_base_chain *basechain;
5806
b7263e07 5807 if (nft_trans_chain_name(trans))
d71efb59 5808 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
91c7b38d 5809
f323d954 5810 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 5811 return;
5812
5813 basechain = nft_base_chain(trans->ctx.chain);
5814 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5815
5816 switch (nft_trans_chain_policy(trans)) {
5817 case NF_DROP:
5818 case NF_ACCEPT:
5819 basechain->policy = nft_trans_chain_policy(trans);
5820 break;
5821 }
5822}
5823
b326dd37 5824static void nf_tables_commit_release(struct nft_trans *trans)
c7c32e72 5825{
c7c32e72
PNA		 5826 switch (trans->msg_type) {
5827 case NFT_MSG_DELTABLE:
5828 nf_tables_table_destroy(&trans->ctx);
5829 break;
5830 case NFT_MSG_DELCHAIN:
43a605f2 5831 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 5832 break;
5833 case NFT_MSG_DELRULE:
5834 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5835 break;
5836 case NFT_MSG_DELSET:
5837 nft_set_destroy(nft_trans_set(trans));
5838 break;
61edafbb 5839 case NFT_MSG_DELSETELEM:
59105446
PNA		 5840 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
5841 nft_trans_elem(trans).priv);
61edafbb 5842 break;
e5009240
PNA		 5843 case NFT_MSG_DELOBJ:
5844 nft_obj_destroy(nft_trans_obj(trans));
5845 break;
3b49e2e9
PNA		 5846 case NFT_MSG_DELFLOWTABLE:
5847 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5848 break;
c7c32e72
PNA		 5849 }
5850 kfree(trans);
5851}
5852
5913beaf 5853static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 5854{
37082f93 5855 struct nft_trans *trans, *next;
a3716e70 5856 struct nft_trans_elem *te;
37082f93
PNA		 5857
5858 /* Bump generation counter, invalidate any dump in progress */
38e029f1 5859 while (++net->nft.base_seq == 0);
37082f93
PNA		 5860
5861 /* A new generation has just started */
ea4bd995 5862 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 5863
5864 /* Make sure all packets have left the previous generation before
5865 * purging old rules.
5866 */
5867 synchronize_rcu();
5868
5869 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 5870 switch (trans->msg_type) {
55dd6f93
PNA		 5871 case NFT_MSG_NEWTABLE:
5872 if (nft_trans_table_update(trans)) {
5873 if (!nft_trans_table_enable(trans)) {
664b0f8c 5874 nf_tables_table_disable(net,
55dd6f93
PNA		 5875 trans->ctx.table);
5876 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5877 }
5878 } else {
f2a6d766 5879 nft_clear(net, trans->ctx.table);
55dd6f93 5880 }
35151d84 5881 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 5882 nft_trans_destroy(trans);
5883 break;
5884 case NFT_MSG_DELTABLE:
f2a6d766 5885 list_del_rcu(&trans->ctx.table->list);
35151d84 5886 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 5887 break;
91c7b38d
PNA		 5888 case NFT_MSG_NEWCHAIN:
5889 if (nft_trans_chain_update(trans))
5890 nft_chain_commit_update(trans);
4fefee57 5891 else
664b0f8c 5892 nft_clear(net, trans->ctx.chain);
4fefee57 5893
35151d84 5894 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
91c7b38d
PNA		 5895 nft_trans_destroy(trans);
5896 break;
5897 case NFT_MSG_DELCHAIN:
664b0f8c 5898 list_del_rcu(&trans->ctx.chain->list);
35151d84 5899 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 5900 nf_tables_unregister_hook(trans->ctx.net,
5901 trans->ctx.table,
5902 trans->ctx.chain);
91c7b38d 5903 break;
b380e5c7 5904 case NFT_MSG_NEWRULE:
889f7ee7 5905 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 5906 nf_tables_rule_notify(&trans->ctx,
37082f93 5907 nft_trans_rule(trans),
35151d84 5908 NFT_MSG_NEWRULE);
37082f93 5909 nft_trans_destroy(trans);
b380e5c7
PNA		 5910 break;
5911 case NFT_MSG_DELRULE:
5912 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 5913 nf_tables_rule_notify(&trans->ctx,
5914 nft_trans_rule(trans),
5915 NFT_MSG_DELRULE);
b380e5c7 5916 break;
958bee14 5917 case NFT_MSG_NEWSET:
37a9cc52 5918 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 5919 /* This avoids hitting -EBUSY when deleting the table
5920 * from the transaction.
5921 */
408070d6 5922 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 5923 !list_empty(&nft_trans_set(trans)->bindings))
5924 trans->ctx.table->use--;
5925
958bee14 5926 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5927 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 5928 nft_trans_destroy(trans);
5929 break;
5930 case NFT_MSG_DELSET:
37a9cc52 5931 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 5932 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5933 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 5934 break;
60319eb1 5935 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 5936 te = (struct nft_trans_elem *)trans->data;
5937
42a55769 5938 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 5939 nf_tables_setelem_notify(&trans->ctx, te->set,
5940 &te->elem,
60319eb1
PNA		 5941 NFT_MSG_NEWSETELEM, 0);
5942 nft_trans_destroy(trans);
5943 break;
5944 case NFT_MSG_DELSETELEM:
a3716e70 5945 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5946
a3716e70
PNA		 5947 nf_tables_setelem_notify(&trans->ctx, te->set,
5948 &te->elem,
60319eb1 5949 NFT_MSG_DELSETELEM, 0);
5cb82a38 5950 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 5951 atomic_dec(&te->set->nelems);
5952 te->set->ndeact--;
60319eb1 5953 break;
e5009240
PNA		 5954 case NFT_MSG_NEWOBJ:
5955 nft_clear(net, nft_trans_obj(trans));
5956 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5957 NFT_MSG_NEWOBJ);
5958 nft_trans_destroy(trans);
5959 break;
5960 case NFT_MSG_DELOBJ:
5961 list_del_rcu(&nft_trans_obj(trans)->list);
5962 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5963 NFT_MSG_DELOBJ);
5964 break;
3b49e2e9
PNA		 5965 case NFT_MSG_NEWFLOWTABLE:
5966 nft_clear(net, nft_trans_flowtable(trans));
5967 nf_tables_flowtable_notify(&trans->ctx,
5968 nft_trans_flowtable(trans),
5969 NFT_MSG_NEWFLOWTABLE);
5970 nft_trans_destroy(trans);
5971 break;
5972 case NFT_MSG_DELFLOWTABLE:
5973 list_del_rcu(&nft_trans_flowtable(trans)->list);
5974 nf_tables_flowtable_notify(&trans->ctx,
5975 nft_trans_flowtable(trans),
5976 NFT_MSG_DELFLOWTABLE);
5977 nft_unregister_flowtable_net_hooks(net,
5978 nft_trans_flowtable(trans));
5979 break;
37082f93 5980 }
37082f93
PNA		 5981 }
5982
b326dd37
PNA		 5983 synchronize_rcu();
5984
37082f93 5985 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
c7c32e72 5986 list_del(&trans->list);
b326dd37 5987 nf_tables_commit_release(trans);
37082f93 5988 }
84d7fce6
PNA		 5989
5990 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
37082f93
PNA		 5991
5992 return 0;
5993}
5994
b326dd37 5995static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 5996{
c7c32e72
PNA		 5997 switch (trans->msg_type) {
5998 case NFT_MSG_NEWTABLE:
5999 nf_tables_table_destroy(&trans->ctx);
6000 break;
6001 case NFT_MSG_NEWCHAIN:
43a605f2 6002 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6003 break;
6004 case NFT_MSG_NEWRULE:
6005 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6006 break;
6007 case NFT_MSG_NEWSET:
6008 nft_set_destroy(nft_trans_set(trans));
6009 break;
61edafbb
PM		 6010 case NFT_MSG_NEWSETELEM:
6011 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 6012 nft_trans_elem(trans).priv, true);
61edafbb 6013 break;
e5009240
PNA		 6014 case NFT_MSG_NEWOBJ:
6015 nft_obj_destroy(nft_trans_obj(trans));
6016 break;
3b49e2e9
PNA		 6017 case NFT_MSG_NEWFLOWTABLE:
6018 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6019 break;
c7c32e72
PNA		 6020 }
6021 kfree(trans);
6022}
6023
5913beaf 6024static int nf_tables_abort(struct net *net, struct sk_buff *skb)
37082f93 6025{
37082f93 6026 struct nft_trans *trans, *next;
02263db0 6027 struct nft_trans_elem *te;
37082f93 6028
a907e36d
XL		 6029 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6030 list) {
b380e5c7 6031 switch (trans->msg_type) {
55dd6f93
PNA		 6032 case NFT_MSG_NEWTABLE:
6033 if (nft_trans_table_update(trans)) {
6034 if (nft_trans_table_enable(trans)) {
664b0f8c 6035 nf_tables_table_disable(net,
55dd6f93
PNA		 6036 trans->ctx.table);
6037 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6038 }
6039 nft_trans_destroy(trans);
6040 } else {
e688a7f8 6041 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 6042 }
6043 break;
6044 case NFT_MSG_DELTABLE:
f2a6d766 6045 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 6046 nft_trans_destroy(trans);
6047 break;
91c7b38d
PNA		 6048 case NFT_MSG_NEWCHAIN:
6049 if (nft_trans_chain_update(trans)) {
982f4051 6050 free_percpu(nft_trans_chain_stats(trans));
91c7b38d
PNA		 6051
6052 nft_trans_destroy(trans);
6053 } else {
4fefee57 6054 trans->ctx.table->use--;
e688a7f8 6055 list_del_rcu(&trans->ctx.chain->list);
c974a3a3
PNA		 6056 nf_tables_unregister_hook(trans->ctx.net,
6057 trans->ctx.table,
6058 trans->ctx.chain);
91c7b38d
PNA		 6059 }
6060 break;
6061 case NFT_MSG_DELCHAIN:
4fefee57 6062 trans->ctx.table->use++;
664b0f8c 6063 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 6064 nft_trans_destroy(trans);
6065 break;
b380e5c7 6066 case NFT_MSG_NEWRULE:
4fefee57 6067 trans->ctx.chain->use--;
b380e5c7
PNA		 6068 list_del_rcu(&nft_trans_rule(trans)->list);
6069 break;
6070 case NFT_MSG_DELRULE:
4fefee57 6071 trans->ctx.chain->use++;
889f7ee7 6072 nft_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 6073 nft_trans_destroy(trans);
b380e5c7 6074 break;
958bee14 6075 case NFT_MSG_NEWSET:
4fefee57 6076 trans->ctx.table->use--;
e688a7f8 6077 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 6078 break;
6079 case NFT_MSG_DELSET:
4fefee57 6080 trans->ctx.table->use++;
37a9cc52 6081 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 6082 nft_trans_destroy(trans);
6083 break;
60319eb1 6084 case NFT_MSG_NEWSETELEM:
02263db0 6085 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6086
5cb82a38 6087 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 6088 atomic_dec(&te->set->nelems);
60319eb1
PNA		 6089 break;
6090 case NFT_MSG_DELSETELEM:
cc02e457
PM		 6091 te = (struct nft_trans_elem *)trans->data;
6092
59105446 6093 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 6094 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 6095 te->set->ndeact--;
cc02e457 6096
e5009240
PNA		 6097 nft_trans_destroy(trans);
6098 break;
6099 case NFT_MSG_NEWOBJ:
6100 trans->ctx.table->use--;
6101 list_del_rcu(&nft_trans_obj(trans)->list);
6102 break;
6103 case NFT_MSG_DELOBJ:
6104 trans->ctx.table->use++;
6105 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 6106 nft_trans_destroy(trans);
6107 break;
3b49e2e9
PNA		 6108 case NFT_MSG_NEWFLOWTABLE:
6109 trans->ctx.table->use--;
6110 list_del_rcu(&nft_trans_flowtable(trans)->list);
6111 nft_unregister_flowtable_net_hooks(net,
6112 nft_trans_flowtable(trans));
6113 break;
6114 case NFT_MSG_DELFLOWTABLE:
6115 trans->ctx.table->use++;
6116 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6117 nft_trans_destroy(trans);
6118 break;
37082f93 6119 }
37082f93
PNA		 6120 }
6121
b326dd37
PNA		 6122 synchronize_rcu();
6123
a1cee076
PNA		 6124 list_for_each_entry_safe_reverse(trans, next,
6125 &net->nft.commit_list, list) {
c7c32e72 6126 list_del(&trans->list);
b326dd37 6127 nf_tables_abort_release(trans);
37082f93
PNA		 6128 }
6129
6130 return 0;
6131}
6132
74e8bcd2
PNA		 6133static bool nf_tables_valid_genid(struct net *net, u32 genid)
6134{
6135 return net->nft.base_seq == genid;
6136}
6137
96518518
PM		 6138static const struct nfnetlink_subsystem nf_tables_subsys = {
6139 .name = "nf_tables",
6140 .subsys_id = NFNL_SUBSYS_NFTABLES,
6141 .cb_count = NFT_MSG_MAX,
6142 .cb = nf_tables_cb,
0628b123
PNA		 6143 .commit = nf_tables_commit,
6144 .abort = nf_tables_abort,
74e8bcd2 6145 .valid_genid = nf_tables_valid_genid,
96518518
PM		 6146};
6147
7210e4e3 6148int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 6149 enum nft_chain_types type)
7210e4e3
PNA		 6150{
6151 const struct nft_base_chain *basechain;
6152
f323d954 6153 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6154 basechain = nft_base_chain(chain);
6155 if (basechain->type->type != type)
6156 return -EOPNOTSUPP;
6157 }
6158 return 0;
6159}
6160EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6161
75e8d06d
PNA		 6162int nft_chain_validate_hooks(const struct nft_chain *chain,
6163 unsigned int hook_flags)
6164{
6165 struct nft_base_chain *basechain;
6166
f323d954 6167 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6168 basechain = nft_base_chain(chain);
6169
c974a3a3 6170 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6171 return 0;
6172
6173 return -EOPNOTSUPP;
6174 }
6175
6176 return 0;
6177}
6178EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6179
20a69341
PM		 6180/*
6181 * Loop detection - walk through the ruleset beginning at the destination chain
6182 * of a new jump until either the source chain is reached (loop) or all
6183 * reachable chains have been traversed.
6184 *
6185 * The loop check is performed whenever a new jump verdict is added to an
6186 * expression or verdict map or a verdict map is bound to a new chain.
6187 */
6188
6189static int nf_tables_check_loops(const struct nft_ctx *ctx,
6190 const struct nft_chain *chain);
6191
6192static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6193 struct nft_set *set,
20a69341 6194 const struct nft_set_iter *iter,
de70185d 6195 struct nft_set_elem *elem)
20a69341 6196{
fe2811eb
PM		 6197 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6198 const struct nft_data *data;
6199
6200 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6201 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 6202 return 0;
6203
fe2811eb 6204 data = nft_set_ext_data(ext);
1ca2e170 6205 switch (data->verdict.code) {
20a69341
PM		 6206 case NFT_JUMP:
6207 case NFT_GOTO:
1ca2e170 6208 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6209 default:
6210 return 0;
6211 }
6212}
6213
6214static int nf_tables_check_loops(const struct nft_ctx *ctx,
6215 const struct nft_chain *chain)
6216{
6217 const struct nft_rule *rule;
6218 const struct nft_expr *expr, *last;
de70185d 6219 struct nft_set *set;
20a69341
PM		 6220 struct nft_set_binding *binding;
6221 struct nft_set_iter iter;
20a69341
PM		 6222
6223 if (ctx->chain == chain)
6224 return -ELOOP;
6225
6226 list_for_each_entry(rule, &chain->rules, list) {
6227 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 6228 const struct nft_data *data = NULL;
6229 int err;
6230
6231 if (!expr->ops->validate)
20a69341
PM		 6232 continue;
6233
0ca743a5
PNA		 6234 err = expr->ops->validate(ctx, expr, &data);
6235 if (err < 0)
6236 return err;
6237
20a69341 6238 if (data == NULL)
0ca743a5 6239 continue;
20a69341 6240
1ca2e170 6241 switch (data->verdict.code) {
20a69341
PM		 6242 case NFT_JUMP:
6243 case NFT_GOTO:
1ca2e170
PM		 6244 err = nf_tables_check_loops(ctx,
6245 data->verdict.chain);
20a69341
PM		 6246 if (err < 0)
6247 return err;
6248 default:
6249 break;
6250 }
6251 }
6252 }
6253
6254 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 6255 if (!nft_is_active_next(ctx->net, set))
6256 continue;
20a69341
PM		 6257 if (!(set->flags & NFT_SET_MAP) ||
6258 set->dtype != NFT_DATA_VERDICT)
6259 continue;
6260
6261 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 6262 if (!(binding->flags & NFT_SET_MAP) ||
6263 binding->chain != chain)
20a69341
PM		 6264 continue;
6265
8588ac09 6266 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 6267 iter.skip = 0;
6268 iter.count = 0;
6269 iter.err = 0;
6270 iter.fn = nf_tables_loop_check_setelem;
6271
6272 set->ops->walk(ctx, set, &iter);
6273 if (iter.err < 0)
6274 return iter.err;
6275 }
6276 }
6277
6278 return 0;
6279}
6280
36b701fa
LGL		 6281/**
6282 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6283 *
6284 * @attr: netlink attribute to fetch value from
6285 * @max: maximum value to be stored in dest
6286 * @dest: pointer to the variable
6287 *
6288 * Parse, check and store a given u32 netlink attribute into variable.
6289 * This function returns -ERANGE if the value goes over maximum value.
6290 * Otherwise a 0 is returned and the attribute value is stored in the
6291 * destination variable.
6292 */
f1d505bb 6293int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 6294{
09525a09 6295 u32 val;
36b701fa
LGL		 6296
6297 val = ntohl(nla_get_be32(attr));
6298 if (val > max)
6299 return -ERANGE;
6300
6301 *dest = val;
6302 return 0;
6303}
6304EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6305
49499c3e
PM		 6306/**
6307 * nft_parse_register - parse a register value from a netlink attribute
6308 *
6309 * @attr: netlink attribute
6310 *
6311 * Parse and translate a register value from a netlink attribute.
6312 * Registers used to be 128 bit wide, these register numbers will be
6313 * mapped to the corresponding 32 bit register numbers.
6314 */
b1c96ed3
PM		 6315unsigned int nft_parse_register(const struct nlattr *attr)
6316{
49499c3e
PM		 6317 unsigned int reg;
6318
6319 reg = ntohl(nla_get_be32(attr));
6320 switch (reg) {
6321 case NFT_REG_VERDICT...NFT_REG_4:
6322 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6323 default:
6324 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6325 }
b1c96ed3
PM		 6326}
6327EXPORT_SYMBOL_GPL(nft_parse_register);
6328
49499c3e
PM		 6329/**
6330 * nft_dump_register - dump a register value to a netlink attribute
6331 *
6332 * @skb: socket buffer
6333 * @attr: attribute number
6334 * @reg: register number
6335 *
6336 * Construct a netlink attribute containing the register number. For
6337 * compatibility reasons, register numbers being a multiple of 4 are
6338 * translated to the corresponding 128 bit register numbers.
6339 */
b1c96ed3
PM		 6340int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6341{
49499c3e
PM		 6342 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6343 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6344 else
6345 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6346
b1c96ed3
PM		 6347 return nla_put_be32(skb, attr, htonl(reg));
6348}
6349EXPORT_SYMBOL_GPL(nft_dump_register);
6350
96518518 6351/**
d07db988 6352 * nft_validate_register_load - validate a load from a register
96518518
PM		 6353 *
6354 * @reg: the register number
d07db988 6355 * @len: the length of the data
96518518
PM		 6356 *
6357 * Validate that the input register is one of the general purpose
d07db988 6358 * registers and that the length of the load is within the bounds.
96518518 6359 */
d07db988 6360int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 6361{
49499c3e 6362 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 6363 return -EINVAL;
d07db988
PM		 6364 if (len == 0)
6365 return -EINVAL;
49499c3e 6366 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 6367 return -ERANGE;
49499c3e 6368
96518518
PM		 6369 return 0;
6370}
d07db988 6371EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 6372
96518518 6373/**
1ec10212 6374 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 6375 *
6376 * @ctx: context of the expression performing the load
6377 * @reg: the destination register number
6378 * @data: the data to load
6379 * @type: the data type
45d9bcda 6380 * @len: the length of the data
96518518
PM		 6381 *
6382 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 6383 * the destination register and the length is within the bounds.
6384 * A value of NULL for the data means that its runtime gathered
58f40ab6 6385 * data.
96518518 6386 */
1ec10212
PM		 6387int nft_validate_register_store(const struct nft_ctx *ctx,
6388 enum nft_registers reg,
6389 const struct nft_data *data,
6390 enum nft_data_types type, unsigned int len)
96518518 6391{
20a69341
PM		 6392 int err;
6393
96518518
PM		 6394 switch (reg) {
6395 case NFT_REG_VERDICT:
58f40ab6 6396 if (type != NFT_DATA_VERDICT)
96518518 6397 return -EINVAL;
20a69341 6398
58f40ab6 6399 if (data != NULL &&
1ca2e170
PM		 6400 (data->verdict.code == NFT_GOTO ||
6401 data->verdict.code == NFT_JUMP)) {
6402 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6403 if (err < 0)
6404 return err;
6405
1ca2e170
PM		 6406 if (ctx->chain->level + 1 >
6407 data->verdict.chain->level) {
20a69341
PM		 6408 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
6409 return -EMLINK;
1ca2e170 6410 data->verdict.chain->level = ctx->chain->level + 1;
20a69341
PM		 6411 }
6412 }
6413
96518518
PM		 6414 return 0;
6415 default:
49499c3e 6416 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 6417 return -EINVAL;
45d9bcda
PM		 6418 if (len == 0)
6419 return -EINVAL;
49499c3e
PM		 6420 if (reg * NFT_REG32_SIZE + len >
6421 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 6422 return -ERANGE;
27e6d201 6423
96518518
PM		 6424 if (data != NULL && type != NFT_DATA_VALUE)
6425 return -EINVAL;
6426 return 0;
6427 }
6428}
1ec10212 6429EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 6430
6431static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
6432 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
6433 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
6434 .len = NFT_CHAIN_MAXNAMELEN - 1 },
6435};
6436
6437static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
6438 struct nft_data_desc *desc, const struct nlattr *nla)
6439{
664b0f8c 6440 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 6441 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
6442 struct nft_chain *chain;
6443 int err;
6444
fceb6435
JB		 6445 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
6446 NULL);
96518518
PM		 6447 if (err < 0)
6448 return err;
6449
6450 if (!tb[NFTA_VERDICT_CODE])
6451 return -EINVAL;
1ca2e170 6452 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 6453
1ca2e170 6454 switch (data->verdict.code) {
e0abdadc 6455 default:
1ca2e170 6456 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 6457 case NF_ACCEPT:
6458 case NF_DROP:
6459 case NF_QUEUE:
6460 break;
6461 default:
6462 return -EINVAL;
6463 }
6464 /* fall through */
96518518
PM		 6465 case NFT_CONTINUE:
6466 case NFT_BREAK:
6467 case NFT_RETURN:
96518518
PM		 6468 break;
6469 case NFT_JUMP:
6470 case NFT_GOTO:
6471 if (!tb[NFTA_VERDICT_CHAIN])
6472 return -EINVAL;
cac20fcd
PNA		 6473 chain = nft_chain_lookup(ctx->table, tb[NFTA_VERDICT_CHAIN],
6474 genmask);
96518518
PM		 6475 if (IS_ERR(chain))
6476 return PTR_ERR(chain);
f323d954 6477 if (nft_is_base_chain(chain))
96518518
PM		 6478 return -EOPNOTSUPP;
6479
96518518 6480 chain->use++;
1ca2e170 6481 data->verdict.chain = chain;
96518518 6482 break;
96518518
PM		 6483 }
6484
4c4ed074 6485 desc->len = sizeof(data->verdict);
96518518
PM		 6486 desc->type = NFT_DATA_VERDICT;
6487 return 0;
6488}
6489
6490static void nft_verdict_uninit(const struct nft_data *data)
6491{
1ca2e170 6492 switch (data->verdict.code) {
96518518
PM		 6493 case NFT_JUMP:
6494 case NFT_GOTO:
1ca2e170 6495 data->verdict.chain->use--;
96518518
PM		 6496 break;
6497 }
6498}
6499
33d5a7b1 6500int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 6501{
6502 struct nlattr *nest;
6503
33d5a7b1 6504 nest = nla_nest_start(skb, type);
96518518
PM		 6505 if (!nest)
6506 goto nla_put_failure;
6507
33d5a7b1 6508 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 6509 goto nla_put_failure;
6510
33d5a7b1 6511 switch (v->code) {
96518518
PM		 6512 case NFT_JUMP:
6513 case NFT_GOTO:
1ca2e170 6514 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 6515 v->chain->name))
96518518
PM		 6516 goto nla_put_failure;
6517 }
6518 nla_nest_end(skb, nest);
6519 return 0;
6520
6521nla_put_failure:
6522 return -1;
6523}
6524
d0a11fc3
PM		 6525static int nft_value_init(const struct nft_ctx *ctx,
6526 struct nft_data *data, unsigned int size,
96518518
PM		 6527 struct nft_data_desc *desc, const struct nlattr *nla)
6528{
6529 unsigned int len;
6530
6531 len = nla_len(nla);
6532 if (len == 0)
6533 return -EINVAL;
d0a11fc3 6534 if (len > size)
96518518
PM		 6535 return -EOVERFLOW;
6536
d0a11fc3 6537 nla_memcpy(data->data, nla, len);
96518518
PM		 6538 desc->type = NFT_DATA_VALUE;
6539 desc->len = len;
6540 return 0;
6541}
6542
6543static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
6544 unsigned int len)
6545{
6546 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
6547}
6548
6549static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 6550 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 6551 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
6552};
6553
6554/**
6555 * nft_data_init - parse nf_tables data netlink attributes
6556 *
6557 * @ctx: context of the expression using the data
6558 * @data: destination struct nft_data
d0a11fc3 6559 * @size: maximum data length
96518518
PM		 6560 * @desc: data description
6561 * @nla: netlink attribute containing data
6562 *
6563 * Parse the netlink data attributes and initialize a struct nft_data.
6564 * The type and length of data are returned in the data description.
6565 *
6566 * The caller can indicate that it only wants to accept data of type
6567 * NFT_DATA_VALUE by passing NULL for the ctx argument.
6568 */
d0a11fc3
PM		 6569int nft_data_init(const struct nft_ctx *ctx,
6570 struct nft_data *data, unsigned int size,
96518518
PM		 6571 struct nft_data_desc *desc, const struct nlattr *nla)
6572{
6573 struct nlattr *tb[NFTA_DATA_MAX + 1];
6574 int err;
6575
fceb6435 6576 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 6577 if (err < 0)
6578 return err;
6579
6580 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 6581 return nft_value_init(ctx, data, size, desc,
6582 tb[NFTA_DATA_VALUE]);
96518518
PM		 6583 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
6584 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
6585 return -EINVAL;
6586}
6587EXPORT_SYMBOL_GPL(nft_data_init);
6588
6589/**
59105446 6590 * nft_data_release - release a nft_data item
96518518
PM		 6591 *
6592 * @data: struct nft_data to release
6593 * @type: type of data
6594 *
6595 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6596 * all others need to be released by calling this function.
6597 */
59105446 6598void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 6599{
960bd2c2 6600 if (type < NFT_DATA_VERDICT)
96518518 6601 return;
960bd2c2 6602 switch (type) {
96518518
PM		 6603 case NFT_DATA_VERDICT:
6604 return nft_verdict_uninit(data);
6605 default:
6606 WARN_ON(1);
6607 }
6608}
59105446 6609EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 6610
6611int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
6612 enum nft_data_types type, unsigned int len)
6613{
6614 struct nlattr *nest;
6615 int err;
6616
6617 nest = nla_nest_start(skb, attr);
6618 if (nest == NULL)
6619 return -1;
6620
6621 switch (type) {
6622 case NFT_DATA_VALUE:
6623 err = nft_value_dump(skb, data, len);
6624 break;
6625 case NFT_DATA_VERDICT:
33d5a7b1 6626 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 6627 break;
6628 default:
6629 err = -EINVAL;
6630 WARN_ON(1);
6631 }
6632
6633 nla_nest_end(skb, nest);
6634 return err;
6635}
6636EXPORT_SYMBOL_GPL(nft_data_dump);
6637
5ebe0b0e
PNA		 6638int __nft_release_basechain(struct nft_ctx *ctx)
6639{
6640 struct nft_rule *rule, *nr;
6641
f323d954 6642 BUG_ON(!nft_is_base_chain(ctx->chain));
5ebe0b0e 6643
c974a3a3 6644 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 6645 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6646 list_del(&rule->list);
6647 ctx->chain->use--;
6648 nf_tables_rule_destroy(ctx, rule);
6649 }
6650 list_del(&ctx->chain->list);
6651 ctx->table->use--;
43a605f2 6652 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 6653
6654 return 0;
6655}
6656EXPORT_SYMBOL_GPL(__nft_release_basechain);
6657
98319cb9 6658static void __nft_release_tables(struct net *net)
df05ef87 6659{
3b49e2e9 6660 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 6661 struct nft_table *table, *nt;
6662 struct nft_chain *chain, *nc;
e5009240 6663 struct nft_object *obj, *ne;
df05ef87
PNA		 6664 struct nft_rule *rule, *nr;
6665 struct nft_set *set, *ns;
6666 struct nft_ctx ctx = {
6667 .net = net,
43a605f2 6668 .family = NFPROTO_NETDEV,
df05ef87
PNA		 6669 };
6670
36596dad 6671 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 6672 ctx.family = table->family;
dd4cbef7 6673
df05ef87 6674 list_for_each_entry(chain, &table->chains, list)
c974a3a3 6675 nf_tables_unregister_hook(net, table, chain);
3b49e2e9
PNA		 6676 list_for_each_entry(flowtable, &table->flowtables, list)
6677 nf_unregister_net_hooks(net, flowtable->ops,
6678 flowtable->ops_len);
df05ef87
PNA		 6679 /* No packets are walking on these chains anymore. */
6680 ctx.table = table;
6681 list_for_each_entry(chain, &table->chains, list) {
6682 ctx.chain = chain;
6683 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
6684 list_del(&rule->list);
6685 chain->use--;
6686 nf_tables_rule_destroy(&ctx, rule);
6687 }
6688 }
3b49e2e9
PNA		 6689 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
6690 list_del(&flowtable->list);
6691 table->use--;
6692 nf_tables_flowtable_destroy(flowtable);
6693 }
df05ef87
PNA		 6694 list_for_each_entry_safe(set, ns, &table->sets, list) {
6695 list_del(&set->list);
6696 table->use--;
6697 nft_set_destroy(set);
6698 }
e5009240
PNA		 6699 list_for_each_entry_safe(obj, ne, &table->objects, list) {
6700 list_del(&obj->list);
6701 table->use--;
6702 nft_obj_destroy(obj);
6703 }
df05ef87 6704 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 6705 ctx.chain = chain;
df05ef87
PNA		 6706 list_del(&chain->list);
6707 table->use--;
43a605f2 6708 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 6709 }
6710 list_del(&table->list);
6711 nf_tables_table_destroy(&ctx);
6712 }
6713}
6714
dd4cbef7
PNA		 6715static int __net_init nf_tables_init_net(struct net *net)
6716{
6717 INIT_LIST_HEAD(&net->nft.tables);
6718 INIT_LIST_HEAD(&net->nft.commit_list);
6719 net->nft.base_seq = 1;
6720 return 0;
6721}
6722
6723static void __net_exit nf_tables_exit_net(struct net *net)
6724{
98319cb9 6725 __nft_release_tables(net);
dd4cbef7
PNA		 6726 WARN_ON_ONCE(!list_empty(&net->nft.tables));
6727 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
6728}
6729
99633ab2
PNA		 6730static struct pernet_operations nf_tables_net_ops = {
6731 .init = nf_tables_init_net,
613d0776 6732 .exit = nf_tables_exit_net,
99633ab2
PNA		 6733};
6734
96518518
PM		 6735static int __init nf_tables_module_init(void)
6736{
6737 int err;
6738
02c7b25e
PNA		 6739 nft_chain_filter_init();
6740
96518518
PM		 6741 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
6742 GFP_KERNEL);
6743 if (info == NULL) {
6744 err = -ENOMEM;
6745 goto err1;
6746 }
6747
6748 err = nf_tables_core_module_init();
6749 if (err < 0)
6750 goto err2;
6751
6752 err = nfnetlink_subsys_register(&nf_tables_subsys);
6753 if (err < 0)
6754 goto err3;
6755
3b49e2e9
PNA		 6756 register_netdevice_notifier(&nf_tables_flowtable_notifier);
6757
99633ab2 6758 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 6759err3:
6760 nf_tables_core_module_exit();
6761err2:
6762 kfree(info);
6763err1:
6764 return err;
6765}
6766
6767static void __exit nf_tables_module_exit(void)
6768{
99633ab2 6769 unregister_pernet_subsys(&nf_tables_net_ops);
96518518 6770 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 6771 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
1b1bc49c 6772 rcu_barrier();
96518518
PM		 6773 nf_tables_core_module_exit();
6774 kfree(info);
02c7b25e 6775 nft_chain_filter_fini();
96518518
PM		 6776}
6777
6778module_init(nf_tables_module_init);
6779module_exit(nf_tables_module_exit);
6780
6781MODULE_LICENSE("GPL");
6782MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
6783MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror