]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_tables: remove flag field from struct nft_af_info
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
96518518
PM		 17#include <linux/netfilter.h>
18#include <linux/netfilter/nfnetlink.h>
19#include <linux/netfilter/nf_tables.h>
3b49e2e9 20#include <net/netfilter/nf_flow_table.h>
96518518
PM		 21#include <net/netfilter/nf_tables_core.h>
22#include <net/netfilter/nf_tables.h>
99633ab2 23#include <net/net_namespace.h>
96518518
PM		 24#include <net/sock.h>
25
96518518 26static LIST_HEAD(nf_tables_expressions);
e5009240 27static LIST_HEAD(nf_tables_objects);
3b49e2e9 28static LIST_HEAD(nf_tables_flowtables);
96518518
PM		 29
30/**
31 * nft_register_afinfo - register nf_tables address family info
32 *
33 * @afi: address family info to register
34 *
35 * Register the address family for use with nf_tables. Returns zero on
36 * success or a negative errno code otherwise.
37 */
99633ab2 38int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 39{
40 INIT_LIST_HEAD(&afi->tables);
41 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 42 list_add_tail_rcu(&afi->list, &net->nft.af_info);
96518518
PM		 43 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
44 return 0;
45}
46EXPORT_SYMBOL_GPL(nft_register_afinfo);
47
df05ef87
PNA		 48static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi);
49
96518518
PM		 50/**
51 * nft_unregister_afinfo - unregister nf_tables address family info
52 *
53 * @afi: address family info to unregister
54 *
55 * Unregister the address family for use with nf_tables.
56 */
df05ef87 57void nft_unregister_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 58{
59 nfnl_lock(NFNL_SUBSYS_NFTABLES);
df05ef87 60 __nft_release_afinfo(net, afi);
e688a7f8 61 list_del_rcu(&afi->list);
96518518
PM		 62 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
63}
64EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
65
99633ab2 66static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
96518518
PM		 67{
68 struct nft_af_info *afi;
69
99633ab2 70 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 71 if (afi->family == family)
72 return afi;
73 }
74 return NULL;
75}
76
99633ab2
PNA		 77static struct nft_af_info *
78nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
96518518
PM		 79{
80 struct nft_af_info *afi;
81
99633ab2 82 afi = nft_afinfo_lookup(net, family);
96518518
PM		 83 if (afi != NULL)
84 return afi;
85#ifdef CONFIG_MODULES
86 if (autoload) {
87 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
88 request_module("nft-afinfo-%u", family);
89 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 90 afi = nft_afinfo_lookup(net, family);
96518518
PM		 91 if (afi != NULL)
92 return ERR_PTR(-EAGAIN);
93 }
94#endif
95 return ERR_PTR(-EAFNOSUPPORT);
96}
97
7c95f6d8 98static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 99 struct net *net,
7c95f6d8
PNA		 100 const struct sk_buff *skb,
101 const struct nlmsghdr *nlh,
102 struct nft_af_info *afi,
103 struct nft_table *table,
104 struct nft_chain *chain,
105 const struct nlattr * const *nla)
106{
633c9a84 107 ctx->net = net;
128ad332
PNA		 108 ctx->afi = afi;
109 ctx->table = table;
110 ctx->chain = chain;
111 ctx->nla = nla;
112 ctx->portid = NETLINK_CB(skb).portid;
113 ctx->report = nlmsg_report(nlh);
114 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 115}
116
8411b644
PNA		 117static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
118 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 119{
120 struct nft_trans *trans;
121
8411b644 122 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 123 if (trans == NULL)
124 return NULL;
125
b380e5c7 126 trans->msg_type = msg_type;
1081d11b
PNA		 127 trans->ctx = *ctx;
128
129 return trans;
130}
131
8411b644
PNA		 132static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
133 int msg_type, u32 size)
134{
135 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
136}
137
1081d11b
PNA		 138static void nft_trans_destroy(struct nft_trans *trans)
139{
140 list_del(&trans->list);
141 kfree(trans);
142}
143
c974a3a3
PNA		 144static int nf_tables_register_hook(struct net *net,
145 const struct nft_table *table,
146 struct nft_chain *chain)
d8ee8f7c
PNA		 147{
148 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 149 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 150 return 0;
151
c974a3a3 152 return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
d8ee8f7c
PNA		 153}
154
c974a3a3
PNA		 155static void nf_tables_unregister_hook(struct net *net,
156 const struct nft_table *table,
157 struct nft_chain *chain)
c5598794 158{
d8ee8f7c 159 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 160 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 161 return;
162
c974a3a3 163 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
c5598794
AB		 164}
165
ee01d542
AB		 166static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
167{
168 struct nft_trans *trans;
169
170 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
171 if (trans == NULL)
172 return -ENOMEM;
173
174 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 175 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 176
177 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
178 return 0;
179}
180
181static int nft_deltable(struct nft_ctx *ctx)
182{
183 int err;
184
185 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
186 if (err < 0)
187 return err;
188
f2a6d766 189 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 190 return err;
191}
192
193static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
194{
195 struct nft_trans *trans;
196
197 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
198 if (trans == NULL)
199 return -ENOMEM;
200
201 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 202 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 203
204 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
205 return 0;
206}
207
208static int nft_delchain(struct nft_ctx *ctx)
209{
210 int err;
211
212 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
213 if (err < 0)
214 return err;
215
216 ctx->table->use--;
664b0f8c 217 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 218
219 return err;
220}
221
ee01d542
AB		 222static int
223nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
224{
225 /* You cannot delete the same rule twice */
889f7ee7
PNA		 226 if (nft_is_active_next(ctx->net, rule)) {
227 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 228 ctx->chain->use--;
229 return 0;
230 }
231 return -ENOENT;
232}
233
234static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
235 struct nft_rule *rule)
236{
237 struct nft_trans *trans;
238
239 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
240 if (trans == NULL)
241 return NULL;
242
1a94e38d
PNA		 243 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
244 nft_trans_rule_id(trans) =
245 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
246 }
ee01d542
AB		 247 nft_trans_rule(trans) = rule;
248 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
249
250 return trans;
251}
252
253static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
254{
255 struct nft_trans *trans;
256 int err;
257
258 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
259 if (trans == NULL)
260 return -ENOMEM;
261
262 err = nf_tables_delrule_deactivate(ctx, rule);
263 if (err < 0) {
264 nft_trans_destroy(trans);
265 return err;
266 }
267
268 return 0;
269}
270
271static int nft_delrule_by_chain(struct nft_ctx *ctx)
272{
273 struct nft_rule *rule;
274 int err;
275
276 list_for_each_entry(rule, &ctx->chain->rules, list) {
277 err = nft_delrule(ctx, rule);
278 if (err < 0)
279 return err;
280 }
281 return 0;
282}
283
ee01d542
AB		 284static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
285 struct nft_set *set)
286{
287 struct nft_trans *trans;
288
289 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
290 if (trans == NULL)
291 return -ENOMEM;
292
293 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
294 nft_trans_set_id(trans) =
295 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 296 nft_activate_next(ctx->net, set);
ee01d542
AB		 297 }
298 nft_trans_set(trans) = set;
299 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
300
301 return 0;
302}
303
304static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
305{
306 int err;
307
308 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
309 if (err < 0)
310 return err;
311
37a9cc52 312 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 313 ctx->table->use--;
314
315 return err;
316}
317
e5009240
PNA		 318static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
319 struct nft_object *obj)
320{
321 struct nft_trans *trans;
322
323 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
324 if (trans == NULL)
325 return -ENOMEM;
326
327 if (msg_type == NFT_MSG_NEWOBJ)
328 nft_activate_next(ctx->net, obj);
329
330 nft_trans_obj(trans) = obj;
331 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
332
333 return 0;
334}
335
336static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
337{
338 int err;
339
340 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
341 if (err < 0)
342 return err;
343
344 nft_deactivate_next(ctx->net, obj);
345 ctx->table->use--;
346
347 return err;
348}
349
3b49e2e9
PNA		 350static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
351 struct nft_flowtable *flowtable)
352{
353 struct nft_trans *trans;
354
355 trans = nft_trans_alloc(ctx, msg_type,
356 sizeof(struct nft_trans_flowtable));
357 if (trans == NULL)
358 return -ENOMEM;
359
360 if (msg_type == NFT_MSG_NEWFLOWTABLE)
361 nft_activate_next(ctx->net, flowtable);
362
363 nft_trans_flowtable(trans) = flowtable;
364 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
365
366 return 0;
367}
368
369static int nft_delflowtable(struct nft_ctx *ctx,
370 struct nft_flowtable *flowtable)
371{
372 int err;
373
374 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
375 if (err < 0)
376 return err;
377
378 nft_deactivate_next(ctx->net, flowtable);
379 ctx->table->use--;
380
381 return err;
382}
383
96518518
PM		 384/*
385 * Tables
386 */
387
388static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
f2a6d766
PNA		 389 const struct nlattr *nla,
390 u8 genmask)
96518518
PM		 391{
392 struct nft_table *table;
393
394 list_for_each_entry(table, &afi->tables, list) {
f2a6d766
PNA		 395 if (!nla_strcmp(nla, table->name) &&
396 nft_active_genmask(table, genmask))
96518518
PM		 397 return table;
398 }
399 return NULL;
400}
401
402static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
f2a6d766
PNA		 403 const struct nlattr *nla,
404 u8 genmask)
96518518
PM		 405{
406 struct nft_table *table;
407
408 if (nla == NULL)
409 return ERR_PTR(-EINVAL);
410
f2a6d766 411 table = nft_table_lookup(afi, nla, genmask);
96518518
PM		 412 if (table != NULL)
413 return table;
414
96518518
PM		 415 return ERR_PTR(-ENOENT);
416}
417
418static inline u64 nf_tables_alloc_handle(struct nft_table *table)
419{
420 return ++table->hgenerator;
421}
422
d8297d4f 423static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 424
2a37d755 425static const struct nf_chain_type *
baae3e62 426__nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
9370761c
PNA		 427{
428 int i;
429
baae3e62 430 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 431 if (chain_type[family][i] != NULL &&
432 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 433 return chain_type[family][i];
9370761c 434 }
baae3e62 435 return NULL;
9370761c
PNA		 436}
437
2a37d755 438static const struct nf_chain_type *
baae3e62
PM		 439nf_tables_chain_type_lookup(const struct nft_af_info *afi,
440 const struct nlattr *nla,
441 bool autoload)
9370761c 442{
2a37d755 443 const struct nf_chain_type *type;
9370761c
PNA		 444
445 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 446 if (type != NULL)
447 return type;
9370761c 448#ifdef CONFIG_MODULES
93b0806f 449 if (autoload) {
9370761c 450 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2fec6bb6
PNA		 451 request_module("nft-chain-%u-%.*s", afi->family,
452 nla_len(nla), (const char *)nla_data(nla));
9370761c
PNA		 453 nfnl_lock(NFNL_SUBSYS_NFTABLES);
454 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 455 if (type != NULL)
456 return ERR_PTR(-EAGAIN);
9370761c
PNA		 457 }
458#endif
93b0806f 459 return ERR_PTR(-ENOENT);
9370761c
PNA		 460}
461
96518518 462static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 463 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
464 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 465 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
96518518
PM		 466};
467
84d7fce6
PNA		 468static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
469 u32 portid, u32 seq, int event, u32 flags,
470 int family, const struct nft_table *table)
96518518
PM		 471{
472 struct nlmsghdr *nlh;
473 struct nfgenmsg *nfmsg;
474
dedb67c4 475 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 476 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
477 if (nlh == NULL)
478 goto nla_put_failure;
479
480 nfmsg = nlmsg_data(nlh);
481 nfmsg->nfgen_family = family;
482 nfmsg->version = NFNETLINK_V0;
84d7fce6 483 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 484
9ddf6323 485 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768
TB		 486 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
487 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
96518518
PM		 488 goto nla_put_failure;
489
053c095a
JB		 490 nlmsg_end(skb, nlh);
491 return 0;
96518518
PM		 492
493nla_put_failure:
494 nlmsg_trim(skb, nlh);
495 return -1;
496}
497
25e94a99 498static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 499{
500 struct sk_buff *skb;
96518518
PM		 501 int err;
502
128ad332
PNA		 503 if (!ctx->report &&
504 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 505 return;
96518518 506
96518518
PM		 507 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
508 if (skb == NULL)
509 goto err;
510
84d7fce6
PNA		 511 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
512 event, 0, ctx->afi->family, ctx->table);
96518518
PM		 513 if (err < 0) {
514 kfree_skb(skb);
515 goto err;
516 }
517
25e94a99
PNA		 518 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
519 ctx->report, GFP_KERNEL);
520 return;
96518518 521err:
25e94a99 522 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 523}
524
525static int nf_tables_dump_tables(struct sk_buff *skb,
526 struct netlink_callback *cb)
527{
528 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
529 const struct nft_af_info *afi;
530 const struct nft_table *table;
531 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 532 struct net *net = sock_net(skb->sk);
96518518
PM		 533 int family = nfmsg->nfgen_family;
534
e688a7f8 535 rcu_read_lock();
38e029f1
PNA		 536 cb->seq = net->nft.base_seq;
537
e688a7f8 538 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 539 if (family != NFPROTO_UNSPEC && family != afi->family)
540 continue;
541
e688a7f8 542 list_for_each_entry_rcu(table, &afi->tables, list) {
96518518
PM		 543 if (idx < s_idx)
544 goto cont;
545 if (idx > s_idx)
546 memset(&cb->args[1], 0,
547 sizeof(cb->args) - sizeof(cb->args[0]));
f2a6d766
PNA		 548 if (!nft_is_active(net, table))
549 continue;
84d7fce6 550 if (nf_tables_fill_table_info(skb, net,
96518518
PM		 551 NETLINK_CB(cb->skb).portid,
552 cb->nlh->nlmsg_seq,
553 NFT_MSG_NEWTABLE,
554 NLM_F_MULTI,
555 afi->family, table) < 0)
556 goto done;
38e029f1
PNA		 557
558 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 559cont:
560 idx++;
561 }
562 }
563done:
e688a7f8 564 rcu_read_unlock();
96518518
PM		 565 cb->args[0] = idx;
566 return skb->len;
567}
568
7b8002a1
PNA		 569static int nf_tables_gettable(struct net *net, struct sock *nlsk,
570 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 571 const struct nlattr * const nla[],
572 struct netlink_ext_ack *extack)
96518518
PM		 573{
574 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 575 u8 genmask = nft_genmask_cur(net);
96518518
PM		 576 const struct nft_af_info *afi;
577 const struct nft_table *table;
578 struct sk_buff *skb2;
579 int family = nfmsg->nfgen_family;
580 int err;
581
582 if (nlh->nlmsg_flags & NLM_F_DUMP) {
583 struct netlink_dump_control c = {
584 .dump = nf_tables_dump_tables,
585 };
586 return netlink_dump_start(nlsk, skb, nlh, &c);
587 }
588
99633ab2 589 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 590 if (IS_ERR(afi))
591 return PTR_ERR(afi);
592
f2a6d766 593 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
96518518
PM		 594 if (IS_ERR(table))
595 return PTR_ERR(table);
596
597 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
598 if (!skb2)
599 return -ENOMEM;
600
84d7fce6 601 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 602 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
603 family, table);
604 if (err < 0)
605 goto err;
606
607 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
608
609err:
610 kfree_skb(skb2);
611 return err;
612}
613
10435c11
F		 614static void _nf_tables_table_disable(struct net *net,
615 const struct nft_af_info *afi,
616 struct nft_table *table,
617 u32 cnt)
618{
619 struct nft_chain *chain;
620 u32 i = 0;
621
622 list_for_each_entry(chain, &table->chains, list) {
623 if (!nft_is_active_next(net, chain))
624 continue;
f323d954 625 if (!nft_is_base_chain(chain))
10435c11
F		 626 continue;
627
628 if (cnt && i++ == cnt)
629 break;
630
c974a3a3 631 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 632 }
633}
634
664b0f8c
PNA		 635static int nf_tables_table_enable(struct net *net,
636 const struct nft_af_info *afi,
115a60b1 637 struct nft_table *table)
9ddf6323
PNA		 638{
639 struct nft_chain *chain;
640 int err, i = 0;
641
642 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 643 if (!nft_is_active_next(net, chain))
644 continue;
f323d954 645 if (!nft_is_base_chain(chain))
d2012975
PNA		 646 continue;
647
c974a3a3 648 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 649 if (err < 0)
650 goto err;
651
652 i++;
653 }
654 return 0;
655err:
10435c11
F		 656 if (i)
657 _nf_tables_table_disable(net, afi, table, i);
9ddf6323
PNA		 658 return err;
659}
660
664b0f8c
PNA		 661static void nf_tables_table_disable(struct net *net,
662 const struct nft_af_info *afi,
d8ee8f7c 663 struct nft_table *table)
9ddf6323 664{
10435c11 665 _nf_tables_table_disable(net, afi, table, 0);
9ddf6323
PNA		 666}
667
e1aaca93 668static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 669{
55dd6f93 670 struct nft_trans *trans;
e1aaca93 671 u32 flags;
55dd6f93 672 int ret = 0;
9ddf6323 673
e1aaca93
PNA		 674 if (!ctx->nla[NFTA_TABLE_FLAGS])
675 return 0;
9ddf6323 676
e1aaca93
PNA		 677 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
678 if (flags & ~NFT_TABLE_F_DORMANT)
679 return -EINVAL;
680
63283dd2
PNA		 681 if (flags == ctx->table->flags)
682 return 0;
683
55dd6f93
PNA		 684 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
685 sizeof(struct nft_trans_table));
686 if (trans == NULL)
687 return -ENOMEM;
9ddf6323 688
e1aaca93
PNA		 689 if ((flags & NFT_TABLE_F_DORMANT) &&
690 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 691 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 692 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
693 ctx->table->flags & NFT_TABLE_F_DORMANT) {
664b0f8c 694 ret = nf_tables_table_enable(ctx->net, ctx->afi, ctx->table);
55dd6f93 695 if (ret >= 0) {
e1aaca93 696 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 697 nft_trans_table_enable(trans) = true;
9ddf6323 698 }
9ddf6323 699 }
e1aaca93
PNA		 700 if (ret < 0)
701 goto err;
9ddf6323 702
55dd6f93
PNA		 703 nft_trans_table_update(trans) = true;
704 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
705 return 0;
9ddf6323 706err:
55dd6f93 707 nft_trans_destroy(trans);
9ddf6323
PNA		 708 return ret;
709}
710
633c9a84
PNA		 711static int nf_tables_newtable(struct net *net, struct sock *nlsk,
712 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 713 const struct nlattr * const nla[],
714 struct netlink_ext_ack *extack)
96518518
PM		 715{
716 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 717 u8 genmask = nft_genmask_next(net);
96518518
PM		 718 const struct nlattr *name;
719 struct nft_af_info *afi;
720 struct nft_table *table;
721 int family = nfmsg->nfgen_family;
c5c1f975 722 u32 flags = 0;
e1aaca93 723 struct nft_ctx ctx;
55dd6f93 724 int err;
96518518 725
99633ab2 726 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 727 if (IS_ERR(afi))
728 return PTR_ERR(afi);
729
730 name = nla[NFTA_TABLE_NAME];
f2a6d766 731 table = nf_tables_table_lookup(afi, name, genmask);
96518518
PM		 732 if (IS_ERR(table)) {
733 if (PTR_ERR(table) != -ENOENT)
734 return PTR_ERR(table);
1a28ad74 735 } else {
96518518
PM		 736 if (nlh->nlmsg_flags & NLM_F_EXCL)
737 return -EEXIST;
738 if (nlh->nlmsg_flags & NLM_F_REPLACE)
739 return -EOPNOTSUPP;
e1aaca93 740
633c9a84 741 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
e1aaca93 742 return nf_tables_updtable(&ctx);
96518518
PM		 743 }
744
c5c1f975
PM		 745 if (nla[NFTA_TABLE_FLAGS]) {
746 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
747 if (flags & ~NFT_TABLE_F_DORMANT)
748 return -EINVAL;
749 }
750
ebddf1a8 751 err = -EAFNOSUPPORT;
7047f9d0 752 if (!try_module_get(afi->owner))
ebddf1a8 753 goto err1;
7047f9d0 754
ffdb210e 755 err = -ENOMEM;
1cae565e 756 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 757 if (table == NULL)
ebddf1a8 758 goto err2;
96518518 759
e46abbcc
PS		 760 table->name = nla_strdup(name, GFP_KERNEL);
761 if (table->name == NULL)
762 goto err3;
763
96518518 764 INIT_LIST_HEAD(&table->chains);
20a69341 765 INIT_LIST_HEAD(&table->sets);
e5009240 766 INIT_LIST_HEAD(&table->objects);
3b49e2e9 767 INIT_LIST_HEAD(&table->flowtables);
c5c1f975 768 table->flags = flags;
9ddf6323 769
633c9a84 770 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
55dd6f93 771 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 772 if (err < 0)
e46abbcc 773 goto err4;
ffdb210e 774
e688a7f8 775 list_add_tail_rcu(&table->list, &afi->tables);
96518518 776 return 0;
e46abbcc
PS		 777err4:
778 kfree(table->name);
ebddf1a8 779err3:
ffdb210e 780 kfree(table);
ebddf1a8 781err2:
ffdb210e 782 module_put(afi->owner);
ebddf1a8 783err1:
ffdb210e 784 return err;
96518518
PM		 785}
786
b9ac12ef
AB		 787static int nft_flush_table(struct nft_ctx *ctx)
788{
3b49e2e9 789 struct nft_flowtable *flowtable, *nft;
b9ac12ef 790 struct nft_chain *chain, *nc;
e5009240 791 struct nft_object *obj, *ne;
b9ac12ef 792 struct nft_set *set, *ns;
3b49e2e9 793 int err;
b9ac12ef 794
a2f18db0 795 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 796 if (!nft_is_active_next(ctx->net, chain))
797 continue;
798
b9ac12ef
AB		 799 ctx->chain = chain;
800
801 err = nft_delrule_by_chain(ctx);
802 if (err < 0)
803 goto out;
b9ac12ef
AB		 804 }
805
806 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 807 if (!nft_is_active_next(ctx->net, set))
808 continue;
809
408070d6 810 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 811 !list_empty(&set->bindings))
812 continue;
813
814 err = nft_delset(ctx, set);
815 if (err < 0)
816 goto out;
817 }
818
3b49e2e9
PNA		 819 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
820 err = nft_delflowtable(ctx, flowtable);
821 if (err < 0)
822 goto out;
823 }
824
e5009240
PNA		 825 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
826 err = nft_delobj(ctx, obj);
827 if (err < 0)
828 goto out;
829 }
830
a2f18db0 831 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 832 if (!nft_is_active_next(ctx->net, chain))
833 continue;
834
a2f18db0
PNA		 835 ctx->chain = chain;
836
837 err = nft_delchain(ctx);
838 if (err < 0)
839 goto out;
840 }
841
b9ac12ef
AB		 842 err = nft_deltable(ctx);
843out:
844 return err;
845}
846
847static int nft_flush(struct nft_ctx *ctx, int family)
848{
849 struct nft_af_info *afi;
850 struct nft_table *table, *nt;
851 const struct nlattr * const *nla = ctx->nla;
852 int err = 0;
853
854 list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
855 if (family != AF_UNSPEC && afi->family != family)
856 continue;
857
858 ctx->afi = afi;
859 list_for_each_entry_safe(table, nt, &afi->tables, list) {
f2a6d766
PNA		 860 if (!nft_is_active_next(ctx->net, table))
861 continue;
862
b9ac12ef
AB		 863 if (nla[NFTA_TABLE_NAME] &&
864 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
865 continue;
866
867 ctx->table = table;
868
869 err = nft_flush_table(ctx);
870 if (err < 0)
871 goto out;
872 }
873 }
874out:
875 return err;
876}
877
633c9a84
PNA		 878static int nf_tables_deltable(struct net *net, struct sock *nlsk,
879 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 880 const struct nlattr * const nla[],
881 struct netlink_ext_ack *extack)
96518518
PM		 882{
883 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 884 u8 genmask = nft_genmask_next(net);
96518518
PM		 885 struct nft_af_info *afi;
886 struct nft_table *table;
ee01d542 887 int family = nfmsg->nfgen_family;
55dd6f93 888 struct nft_ctx ctx;
96518518 889
633c9a84 890 nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
b9ac12ef
AB		 891 if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
892 return nft_flush(&ctx, family);
893
99633ab2 894 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 895 if (IS_ERR(afi))
896 return PTR_ERR(afi);
897
f2a6d766 898 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
96518518
PM		 899 if (IS_ERR(table))
900 return PTR_ERR(table);
96518518 901
a8278400
PNA		 902 if (nlh->nlmsg_flags & NLM_F_NONREC &&
903 table->use > 0)
904 return -EBUSY;
905
b9ac12ef
AB		 906 ctx.afi = afi;
907 ctx.table = table;
55dd6f93 908
b9ac12ef 909 return nft_flush_table(&ctx);
96518518
PM		 910}
911
55dd6f93
PNA		 912static void nf_tables_table_destroy(struct nft_ctx *ctx)
913{
4fefee57
PNA		 914 BUG_ON(ctx->table->use > 0);
915
e46abbcc 916 kfree(ctx->table->name);
55dd6f93
PNA		 917 kfree(ctx->table);
918 module_put(ctx->afi->owner);
919}
920
2a37d755 921int nft_register_chain_type(const struct nf_chain_type *ctype)
96518518 922{
9370761c 923 int err = 0;
96518518 924
d8297d4f
FW		 925 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
926 return -EINVAL;
927
96518518 928 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c
PNA		 929 if (chain_type[ctype->family][ctype->type] != NULL) {
930 err = -EBUSY;
931 goto out;
96518518 932 }
9370761c
PNA		 933 chain_type[ctype->family][ctype->type] = ctype;
934out:
96518518
PM		 935 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
936 return err;
937}
9370761c 938EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 939
2a37d755 940void nft_unregister_chain_type(const struct nf_chain_type *ctype)
96518518 941{
96518518 942 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 943 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 944 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
945}
9370761c 946EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 947
948/*
949 * Chains
950 */
951
952static struct nft_chain *
664b0f8c
PNA		 953nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
954 u8 genmask)
96518518
PM		 955{
956 struct nft_chain *chain;
957
958 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 959 if (chain->handle == handle &&
960 nft_active_genmask(chain, genmask))
96518518
PM		 961 return chain;
962 }
963
964 return ERR_PTR(-ENOENT);
965}
966
967static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
664b0f8c
PNA		 968 const struct nlattr *nla,
969 u8 genmask)
96518518
PM		 970{
971 struct nft_chain *chain;
972
973 if (nla == NULL)
974 return ERR_PTR(-EINVAL);
975
976 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 977 if (!nla_strcmp(nla, chain->name) &&
978 nft_active_genmask(chain, genmask))
96518518
PM		 979 return chain;
980 }
981
982 return ERR_PTR(-ENOENT);
983}
984
985static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 986 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
987 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 988 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
989 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
990 .len = NFT_CHAIN_MAXNAMELEN - 1 },
991 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 992 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 993 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 994 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 995};
996
997static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
998 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
999 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1000 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1001 .len = IFNAMSIZ - 1 },
96518518
PM		 1002};
1003
0ca743a5
PNA		 1004static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1005{
1006 struct nft_stats *cpu_stats, total;
1007 struct nlattr *nest;
ce355e20
ED		 1008 unsigned int seq;
1009 u64 pkts, bytes;
0ca743a5
PNA		 1010 int cpu;
1011
1012 memset(&total, 0, sizeof(total));
1013 for_each_possible_cpu(cpu) {
1014 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1015 do {
1016 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1017 pkts = cpu_stats->pkts;
1018 bytes = cpu_stats->bytes;
1019 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1020 total.pkts += pkts;
1021 total.bytes += bytes;
0ca743a5
PNA		 1022 }
1023 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1024 if (nest == NULL)
1025 goto nla_put_failure;
1026
b46f6ded
ND		 1027 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1028 NFTA_COUNTER_PAD) ||
1029 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1030 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1031 goto nla_put_failure;
1032
1033 nla_nest_end(skb, nest);
1034 return 0;
1035
1036nla_put_failure:
1037 return -ENOSPC;
1038}
1039
84d7fce6
PNA		 1040static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1041 u32 portid, u32 seq, int event, u32 flags,
1042 int family, const struct nft_table *table,
96518518
PM		 1043 const struct nft_chain *chain)
1044{
1045 struct nlmsghdr *nlh;
1046 struct nfgenmsg *nfmsg;
1047
dedb67c4 1048 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1049 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1050 if (nlh == NULL)
1051 goto nla_put_failure;
1052
1053 nfmsg = nlmsg_data(nlh);
1054 nfmsg->nfgen_family = family;
1055 nfmsg->version = NFNETLINK_V0;
84d7fce6 1056 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1057
1058 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1059 goto nla_put_failure;
b46f6ded
ND		 1060 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1061 NFTA_CHAIN_PAD))
96518518
PM		 1062 goto nla_put_failure;
1063 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1064 goto nla_put_failure;
1065
f323d954 1066 if (nft_is_base_chain(chain)) {
0ca743a5 1067 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1068 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1069 struct nlattr *nest;
1070
1071 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1072 if (nest == NULL)
1073 goto nla_put_failure;
1074 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1075 goto nla_put_failure;
1076 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1077 goto nla_put_failure;
2cbce139
PNA		 1078 if (basechain->dev_name[0] &&
1079 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1080 goto nla_put_failure;
96518518 1081 nla_nest_end(skb, nest);
9370761c 1082
0ca743a5
PNA		 1083 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1084 htonl(basechain->policy)))
1085 goto nla_put_failure;
1086
baae3e62
PM		 1087 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1088 goto nla_put_failure;
0ca743a5 1089
5f9bfe0e 1090 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
0ca743a5 1091 goto nla_put_failure;
96518518
PM		 1092 }
1093
0ca743a5
PNA		 1094 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1095 goto nla_put_failure;
1096
053c095a
JB		 1097 nlmsg_end(skb, nlh);
1098 return 0;
96518518
PM		 1099
1100nla_put_failure:
1101 nlmsg_trim(skb, nlh);
1102 return -1;
1103}
1104
25e94a99 1105static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1106{
1107 struct sk_buff *skb;
96518518
PM		 1108 int err;
1109
128ad332
PNA		 1110 if (!ctx->report &&
1111 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1112 return;
96518518 1113
96518518
PM		 1114 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1115 if (skb == NULL)
1116 goto err;
1117
84d7fce6
PNA		 1118 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1119 event, 0, ctx->afi->family, ctx->table,
35151d84 1120 ctx->chain);
96518518
PM		 1121 if (err < 0) {
1122 kfree_skb(skb);
1123 goto err;
1124 }
1125
25e94a99
PNA		 1126 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1127 ctx->report, GFP_KERNEL);
1128 return;
96518518 1129err:
25e94a99 1130 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1131}
1132
1133static int nf_tables_dump_chains(struct sk_buff *skb,
1134 struct netlink_callback *cb)
1135{
1136 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1137 const struct nft_af_info *afi;
1138 const struct nft_table *table;
1139 const struct nft_chain *chain;
1140 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1141 struct net *net = sock_net(skb->sk);
96518518
PM		 1142 int family = nfmsg->nfgen_family;
1143
e688a7f8 1144 rcu_read_lock();
38e029f1
PNA		 1145 cb->seq = net->nft.base_seq;
1146
e688a7f8 1147 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 1148 if (family != NFPROTO_UNSPEC && family != afi->family)
1149 continue;
1150
e688a7f8
PNA		 1151 list_for_each_entry_rcu(table, &afi->tables, list) {
1152 list_for_each_entry_rcu(chain, &table->chains, list) {
96518518
PM		 1153 if (idx < s_idx)
1154 goto cont;
1155 if (idx > s_idx)
1156 memset(&cb->args[1], 0,
1157 sizeof(cb->args) - sizeof(cb->args[0]));
664b0f8c
PNA		 1158 if (!nft_is_active(net, chain))
1159 continue;
84d7fce6
PNA		 1160 if (nf_tables_fill_chain_info(skb, net,
1161 NETLINK_CB(cb->skb).portid,
96518518
PM		 1162 cb->nlh->nlmsg_seq,
1163 NFT_MSG_NEWCHAIN,
1164 NLM_F_MULTI,
1165 afi->family, table, chain) < 0)
1166 goto done;
38e029f1
PNA		 1167
1168 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 1169cont:
1170 idx++;
1171 }
1172 }
1173 }
1174done:
e688a7f8 1175 rcu_read_unlock();
96518518
PM		 1176 cb->args[0] = idx;
1177 return skb->len;
1178}
1179
7b8002a1
PNA		 1180static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1181 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1182 const struct nlattr * const nla[],
1183 struct netlink_ext_ack *extack)
96518518
PM		 1184{
1185 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1186 u8 genmask = nft_genmask_cur(net);
96518518
PM		 1187 const struct nft_af_info *afi;
1188 const struct nft_table *table;
1189 const struct nft_chain *chain;
1190 struct sk_buff *skb2;
1191 int family = nfmsg->nfgen_family;
1192 int err;
1193
1194 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1195 struct netlink_dump_control c = {
1196 .dump = nf_tables_dump_chains,
1197 };
1198 return netlink_dump_start(nlsk, skb, nlh, &c);
1199 }
1200
99633ab2 1201 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1202 if (IS_ERR(afi))
1203 return PTR_ERR(afi);
1204
f2a6d766 1205 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1206 if (IS_ERR(table))
1207 return PTR_ERR(table);
1208
664b0f8c 1209 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
96518518
PM		 1210 if (IS_ERR(chain))
1211 return PTR_ERR(chain);
1212
1213 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1214 if (!skb2)
1215 return -ENOMEM;
1216
84d7fce6 1217 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1218 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1219 family, table, chain);
1220 if (err < 0)
1221 goto err;
1222
1223 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1224
1225err:
1226 kfree_skb(skb2);
1227 return err;
1228}
1229
0ca743a5
PNA		 1230static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1231 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1232 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1233};
1234
ff3cd7b3 1235static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1236{
1237 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1238 struct nft_stats __percpu *newstats;
1239 struct nft_stats *stats;
1240 int err;
1241
fceb6435
JB		 1242 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1243 NULL);
0ca743a5 1244 if (err < 0)
ff3cd7b3 1245 return ERR_PTR(err);
0ca743a5
PNA		 1246
1247 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1248 return ERR_PTR(-EINVAL);
0ca743a5 1249
ce355e20 1250 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1251 if (newstats == NULL)
ff3cd7b3 1252 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1253
1254 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1255 * are not exposed to userspace.
1256 */
e8781f70 1257 preempt_disable();
0ca743a5
PNA		 1258 stats = this_cpu_ptr(newstats);
1259 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1260 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1261 preempt_enable();
0ca743a5 1262
ff3cd7b3
PNA		 1263 return newstats;
1264}
1265
1266static void nft_chain_stats_replace(struct nft_base_chain *chain,
1267 struct nft_stats __percpu *newstats)
1268{
0befd061
PNA		 1269 struct nft_stats __percpu *oldstats;
1270
b88825de
PNA		 1271 if (newstats == NULL)
1272 return;
1273
0ca743a5 1274 if (chain->stats) {
0befd061 1275 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
0ca743a5
PNA		 1276 rcu_assign_pointer(chain->stats, newstats);
1277 synchronize_rcu();
1278 free_percpu(oldstats);
1279 } else
1280 rcu_assign_pointer(chain->stats, newstats);
0ca743a5
PNA		 1281}
1282
91c7b38d
PNA		 1283static void nf_tables_chain_destroy(struct nft_chain *chain)
1284{
1285 BUG_ON(chain->use > 0);
1286
f323d954 1287 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1288 struct nft_base_chain *basechain = nft_base_chain(chain);
1289
1290 module_put(basechain->type->owner);
1291 free_percpu(basechain->stats);
9f08ea84
PNA		 1292 if (basechain->stats)
1293 static_branch_dec(&nft_counters_enabled);
c974a3a3
PNA		 1294 if (basechain->ops.dev != NULL)
1295 dev_put(basechain->ops.dev);
b7263e07 1296 kfree(chain->name);
2cbce139 1297 kfree(basechain);
91c7b38d 1298 } else {
b7263e07 1299 kfree(chain->name);
91c7b38d
PNA		 1300 kfree(chain);
1301 }
1302}
1303
508f8ccd
PNA		 1304struct nft_chain_hook {
1305 u32 num;
84ba7dd7 1306 s32 priority;
508f8ccd
PNA		 1307 const struct nf_chain_type *type;
1308 struct net_device *dev;
1309};
1310
1311static int nft_chain_parse_hook(struct net *net,
1312 const struct nlattr * const nla[],
1313 struct nft_af_info *afi,
1314 struct nft_chain_hook *hook, bool create)
1315{
1316 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1317 const struct nf_chain_type *type;
1318 struct net_device *dev;
1319 int err;
1320
1321 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1322 nft_hook_policy, NULL);
508f8ccd
PNA		 1323 if (err < 0)
1324 return err;
1325
1326 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1327 ha[NFTA_HOOK_PRIORITY] == NULL)
1328 return -EINVAL;
1329
1330 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1331 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1332
1333 type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
1334 if (nla[NFTA_CHAIN_TYPE]) {
1335 type = nf_tables_chain_type_lookup(afi, nla[NFTA_CHAIN_TYPE],
1336 create);
1337 if (IS_ERR(type))
1338 return PTR_ERR(type);
1339 }
1340 if (!(type->hook_mask & (1 << hook->num)))
1341 return -EOPNOTSUPP;
84ba7dd7
FW		 1342
1343 if (type->type == NFT_CHAIN_T_NAT &&
1344 hook->priority <= NF_IP_PRI_CONNTRACK)
1345 return -EOPNOTSUPP;
1346
508f8ccd
PNA		 1347 if (!try_module_get(type->owner))
1348 return -ENOENT;
1349
1350 hook->type = type;
1351
1352 hook->dev = NULL;
e7bb5c71 1353 if (afi->family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1354 char ifname[IFNAMSIZ];
1355
1356 if (!ha[NFTA_HOOK_DEV]) {
1357 module_put(type->owner);
1358 return -EOPNOTSUPP;
1359 }
1360
1361 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1362 dev = dev_get_by_name(net, ifname);
1363 if (!dev) {
1364 module_put(type->owner);
1365 return -ENOENT;
1366 }
1367 hook->dev = dev;
1368 } else if (ha[NFTA_HOOK_DEV]) {
1369 module_put(type->owner);
1370 return -EOPNOTSUPP;
1371 }
1372
1373 return 0;
1374}
1375
1376static void nft_chain_release_hook(struct nft_chain_hook *hook)
1377{
1378 module_put(hook->type->owner);
1379 if (hook->dev != NULL)
1380 dev_put(hook->dev);
1381}
1382
4035285f
PNA		 1383static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1384 u8 policy, bool create)
1385{
1386 const struct nlattr * const *nla = ctx->nla;
1387 struct nft_table *table = ctx->table;
1388 struct nft_af_info *afi = ctx->afi;
1389 struct nft_base_chain *basechain;
1390 struct nft_stats __percpu *stats;
1391 struct net *net = ctx->net;
1392 struct nft_chain *chain;
4035285f
PNA		 1393 int err;
1394
1395 if (table->use == UINT_MAX)
1396 return -EOVERFLOW;
1397
1398 if (nla[NFTA_CHAIN_HOOK]) {
1399 struct nft_chain_hook hook;
1400 struct nf_hook_ops *ops;
4035285f
PNA		 1401
1402 err = nft_chain_parse_hook(net, nla, afi, &hook, create);
1403 if (err < 0)
1404 return err;
1405
1406 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1407 if (basechain == NULL) {
1408 nft_chain_release_hook(&hook);
1409 return -ENOMEM;
1410 }
1411
1412 if (hook.dev != NULL)
1413 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1414
1415 if (nla[NFTA_CHAIN_COUNTERS]) {
1416 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1417 if (IS_ERR(stats)) {
1418 nft_chain_release_hook(&hook);
1419 kfree(basechain);
1420 return PTR_ERR(stats);
1421 }
1422 basechain->stats = stats;
1423 static_branch_inc(&nft_counters_enabled);
1424 }
1425
4035285f
PNA		 1426 basechain->type = hook.type;
1427 chain = &basechain->chain;
1428
c974a3a3
PNA		 1429 ops = &basechain->ops;
1430 ops->pf = family;
1431 ops->hooknum = hook.num;
1432 ops->priority = hook.priority;
1433 ops->priv = chain;
c2f9eafe 1434 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1435 ops->dev = hook.dev;
c974a3a3
PNA		 1436
1437 if (basechain->type->type == NFT_CHAIN_T_NAT)
1438 ops->nat_hook = true;
4035285f
PNA		 1439
1440 chain->flags |= NFT_BASE_CHAIN;
1441 basechain->policy = policy;
1442 } else {
1443 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1444 if (chain == NULL)
1445 return -ENOMEM;
1446 }
1447 INIT_LIST_HEAD(&chain->rules);
1448 chain->handle = nf_tables_alloc_handle(table);
1449 chain->table = table;
1450 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1451 if (!chain->name) {
1452 err = -ENOMEM;
1453 goto err1;
1454 }
1455
c974a3a3 1456 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1457 if (err < 0)
1458 goto err1;
1459
1460 ctx->chain = chain;
1461 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1462 if (err < 0)
1463 goto err2;
1464
1465 table->use++;
1466 list_add_tail_rcu(&chain->list, &table->chains);
1467
1468 return 0;
1469err2:
c974a3a3 1470 nf_tables_unregister_hook(net, table, chain);
4035285f
PNA		 1471err1:
1472 nf_tables_chain_destroy(chain);
1473
1474 return err;
1475}
1476
2c4a488a
PNA		 1477static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1478 bool create)
1479{
1480 const struct nlattr * const *nla = ctx->nla;
1481 struct nft_table *table = ctx->table;
1482 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1483 struct nft_base_chain *basechain;
1484 struct nft_stats *stats = NULL;
1485 struct nft_chain_hook hook;
1486 const struct nlattr *name;
1487 struct nf_hook_ops *ops;
1488 struct nft_trans *trans;
c974a3a3 1489 int err;
2c4a488a
PNA		 1490
1491 if (nla[NFTA_CHAIN_HOOK]) {
1492 if (!nft_is_base_chain(chain))
1493 return -EBUSY;
1494
1495 err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook,
1496 create);
1497 if (err < 0)
1498 return err;
1499
1500 basechain = nft_base_chain(chain);
1501 if (basechain->type != hook.type) {
1502 nft_chain_release_hook(&hook);
1503 return -EBUSY;
1504 }
1505
c974a3a3
PNA		 1506 ops = &basechain->ops;
1507 if (ops->hooknum != hook.num ||
1508 ops->priority != hook.priority ||
1509 ops->dev != hook.dev) {
1510 nft_chain_release_hook(&hook);
1511 return -EBUSY;
2c4a488a
PNA		 1512 }
1513 nft_chain_release_hook(&hook);
1514 }
1515
1516 if (nla[NFTA_CHAIN_HANDLE] &&
1517 nla[NFTA_CHAIN_NAME]) {
1518 struct nft_chain *chain2;
1519
1520 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
1521 genmask);
0d18779b
JC		 1522 if (!IS_ERR(chain2))
1523 return -EEXIST;
2c4a488a
PNA		 1524 }
1525
1526 if (nla[NFTA_CHAIN_COUNTERS]) {
1527 if (!nft_is_base_chain(chain))
1528 return -EOPNOTSUPP;
1529
1530 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1531 if (IS_ERR(stats))
1532 return PTR_ERR(stats);
1533 }
1534
1535 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1536 sizeof(struct nft_trans_chain));
1537 if (trans == NULL) {
1538 free_percpu(stats);
1539 return -ENOMEM;
1540 }
1541
1542 nft_trans_chain_stats(trans) = stats;
1543 nft_trans_chain_update(trans) = true;
1544
1545 if (nla[NFTA_CHAIN_POLICY])
1546 nft_trans_chain_policy(trans) = policy;
1547 else
1548 nft_trans_chain_policy(trans) = -1;
1549
1550 name = nla[NFTA_CHAIN_NAME];
1551 if (nla[NFTA_CHAIN_HANDLE] && name) {
1552 nft_trans_chain_name(trans) =
1553 nla_strdup(name, GFP_KERNEL);
1554 if (!nft_trans_chain_name(trans)) {
1555 kfree(trans);
1556 free_percpu(stats);
1557 return -ENOMEM;
1558 }
1559 }
1560 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1561
1562 return 0;
1563}
1564
633c9a84
PNA		 1565static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1566 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1567 const struct nlattr * const nla[],
1568 struct netlink_ext_ack *extack)
96518518
PM		 1569{
1570 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1571 const struct nlattr * uninitialized_var(name);
4035285f
PNA		 1572 u8 genmask = nft_genmask_next(net);
1573 int family = nfmsg->nfgen_family;
7c95f6d8 1574 struct nft_af_info *afi;
96518518
PM		 1575 struct nft_table *table;
1576 struct nft_chain *chain;
57de2a0c 1577 u8 policy = NF_ACCEPT;
4035285f 1578 struct nft_ctx ctx;
96518518 1579 u64 handle = 0;
96518518
PM		 1580 bool create;
1581
1582 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1583
99633ab2 1584 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 1585 if (IS_ERR(afi))
1586 return PTR_ERR(afi);
1587
f2a6d766 1588 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1589 if (IS_ERR(table))
1590 return PTR_ERR(table);
1591
96518518
PM		 1592 chain = NULL;
1593 name = nla[NFTA_CHAIN_NAME];
1594
1595 if (nla[NFTA_CHAIN_HANDLE]) {
1596 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
664b0f8c 1597 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
96518518
PM		 1598 if (IS_ERR(chain))
1599 return PTR_ERR(chain);
1600 } else {
664b0f8c 1601 chain = nf_tables_chain_lookup(table, name, genmask);
96518518
PM		 1602 if (IS_ERR(chain)) {
1603 if (PTR_ERR(chain) != -ENOENT)
1604 return PTR_ERR(chain);
1605 chain = NULL;
1606 }
1607 }
1608
57de2a0c 1609 if (nla[NFTA_CHAIN_POLICY]) {
f323d954
PNA		 1610 if (chain != NULL &&
1611 !nft_is_base_chain(chain))
d6b6cb1d
PNA		 1612 return -EOPNOTSUPP;
1613
1614 if (chain == NULL &&
57de2a0c
PM		 1615 nla[NFTA_CHAIN_HOOK] == NULL)
1616 return -EOPNOTSUPP;
1617
8f46df18 1618 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1619 switch (policy) {
1620 case NF_DROP:
1621 case NF_ACCEPT:
1622 break;
1623 default:
1624 return -EINVAL;
1625 }
1626 }
1627
4035285f
PNA		 1628 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
1629
96518518
PM		 1630 if (chain != NULL) {
1631 if (nlh->nlmsg_flags & NLM_F_EXCL)
1632 return -EEXIST;
1633 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1634 return -EOPNOTSUPP;
1635
2c4a488a 1636 return nf_tables_updchain(&ctx, genmask, policy, create);
96518518
PM		 1637 }
1638
4035285f 1639 return nf_tables_addchain(&ctx, family, genmask, policy, create);
96518518
PM		 1640}
1641
633c9a84
PNA		 1642static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1643 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1644 const struct nlattr * const nla[],
1645 struct netlink_ext_ack *extack)
96518518
PM		 1646{
1647 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1648 u8 genmask = nft_genmask_next(net);
7c95f6d8 1649 struct nft_af_info *afi;
96518518
PM		 1650 struct nft_table *table;
1651 struct nft_chain *chain;
9dee1474 1652 struct nft_rule *rule;
96518518 1653 int family = nfmsg->nfgen_family;
91c7b38d 1654 struct nft_ctx ctx;
9dee1474
PNA		 1655 u32 use;
1656 int err;
96518518 1657
99633ab2 1658 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1659 if (IS_ERR(afi))
1660 return PTR_ERR(afi);
1661
f2a6d766 1662 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1663 if (IS_ERR(table))
1664 return PTR_ERR(table);
1665
664b0f8c 1666 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
96518518
PM		 1667 if (IS_ERR(chain))
1668 return PTR_ERR(chain);
9dee1474
PNA		 1669
1670 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1671 chain->use > 0)
96518518
PM		 1672 return -EBUSY;
1673
633c9a84 1674 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0165d932 1675
9dee1474
PNA		 1676 use = chain->use;
1677 list_for_each_entry(rule, &chain->rules, list) {
1678 if (!nft_is_active_next(net, rule))
1679 continue;
1680 use--;
1681
1682 err = nft_delrule(&ctx, rule);
1683 if (err < 0)
1684 return err;
1685 }
1686
1687 /* There are rules and elements that are still holding references to us,
1688 * we cannot do a recursive removal in this case.
1689 */
1690 if (use > 0)
1691 return -EBUSY;
1692
ee01d542 1693 return nft_delchain(&ctx);
96518518
PM		 1694}
1695
96518518
PM		 1696/*
1697 * Expressions
1698 */
1699
1700/**
ef1f7df9
PM		 1701 * nft_register_expr - register nf_tables expr type
1702 * @ops: expr type
96518518 1703 *
ef1f7df9 1704 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1705 * success or a negative errno code otherwise.
1706 */
ef1f7df9 1707int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1708{
1709 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1710 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1711 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1712 else
e688a7f8 1713 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1714 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1715 return 0;
1716}
1717EXPORT_SYMBOL_GPL(nft_register_expr);
1718
1719/**
ef1f7df9
PM		 1720 * nft_unregister_expr - unregister nf_tables expr type
1721 * @ops: expr type
96518518 1722 *
ef1f7df9 1723 * Unregisters the expr typefor use with nf_tables.
96518518 1724 */
ef1f7df9 1725void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1726{
1727 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1728 list_del_rcu(&type->list);
96518518
PM		 1729 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1730}
1731EXPORT_SYMBOL_GPL(nft_unregister_expr);
1732
64d46806
PM		 1733static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1734 struct nlattr *nla)
96518518 1735{
ef1f7df9 1736 const struct nft_expr_type *type;
96518518 1737
ef1f7df9 1738 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1739 if (!nla_strcmp(nla, type->name) &&
1740 (!type->family || type->family == family))
ef1f7df9 1741 return type;
96518518
PM		 1742 }
1743 return NULL;
1744}
1745
64d46806
PM		 1746static const struct nft_expr_type *nft_expr_type_get(u8 family,
1747 struct nlattr *nla)
96518518 1748{
ef1f7df9 1749 const struct nft_expr_type *type;
96518518
PM		 1750
1751 if (nla == NULL)
1752 return ERR_PTR(-EINVAL);
1753
64d46806 1754 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1755 if (type != NULL && try_module_get(type->owner))
1756 return type;
96518518
PM		 1757
1758#ifdef CONFIG_MODULES
ef1f7df9 1759 if (type == NULL) {
64d46806
PM		 1760 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1761 request_module("nft-expr-%u-%.*s", family,
1762 nla_len(nla), (char *)nla_data(nla));
1763 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1764 if (__nft_expr_type_get(family, nla))
1765 return ERR_PTR(-EAGAIN);
1766
96518518
PM		 1767 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1768 request_module("nft-expr-%.*s",
1769 nla_len(nla), (char *)nla_data(nla));
1770 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1771 if (__nft_expr_type_get(family, nla))
96518518
PM		 1772 return ERR_PTR(-EAGAIN);
1773 }
1774#endif
1775 return ERR_PTR(-ENOENT);
1776}
1777
1778static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1779 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1780 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1781};
1782
1783static int nf_tables_fill_expr_info(struct sk_buff *skb,
1784 const struct nft_expr *expr)
1785{
ef1f7df9 1786 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1787 goto nla_put_failure;
1788
1789 if (expr->ops->dump) {
1790 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1791 if (data == NULL)
1792 goto nla_put_failure;
1793 if (expr->ops->dump(skb, expr) < 0)
1794 goto nla_put_failure;
1795 nla_nest_end(skb, data);
1796 }
1797
1798 return skb->len;
1799
1800nla_put_failure:
1801 return -1;
1802};
1803
0b2d8a7b
PM		 1804int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1805 const struct nft_expr *expr)
1806{
1807 struct nlattr *nest;
1808
1809 nest = nla_nest_start(skb, attr);
1810 if (!nest)
1811 goto nla_put_failure;
1812 if (nf_tables_fill_expr_info(skb, expr) < 0)
1813 goto nla_put_failure;
1814 nla_nest_end(skb, nest);
1815 return 0;
1816
1817nla_put_failure:
1818 return -1;
1819}
1820
96518518
PM		 1821struct nft_expr_info {
1822 const struct nft_expr_ops *ops;
ef1f7df9 1823 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1824};
1825
0ca743a5
PNA		 1826static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1827 const struct nlattr *nla,
96518518
PM		 1828 struct nft_expr_info *info)
1829{
ef1f7df9 1830 const struct nft_expr_type *type;
96518518 1831 const struct nft_expr_ops *ops;
ef1f7df9 1832 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1833 int err;
1834
fceb6435 1835 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 1836 if (err < 0)
1837 return err;
1838
64d46806 1839 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1840 if (IS_ERR(type))
1841 return PTR_ERR(type);
1842
1843 if (tb[NFTA_EXPR_DATA]) {
1844 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 1845 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 1846 if (err < 0)
1847 goto err1;
1848 } else
1849 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1850
1851 if (type->select_ops != NULL) {
0ca743a5
PNA		 1852 ops = type->select_ops(ctx,
1853 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1854 if (IS_ERR(ops)) {
1855 err = PTR_ERR(ops);
1856 goto err1;
1857 }
1858 } else
1859 ops = type->ops;
1860
96518518
PM		 1861 info->ops = ops;
1862 return 0;
ef1f7df9
PM		 1863
1864err1:
1865 module_put(type->owner);
1866 return err;
96518518
PM		 1867}
1868
1869static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1870 const struct nft_expr_info *info,
96518518
PM		 1871 struct nft_expr *expr)
1872{
1873 const struct nft_expr_ops *ops = info->ops;
1874 int err;
1875
1876 expr->ops = ops;
1877 if (ops->init) {
ef1f7df9 1878 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1879 if (err < 0)
1880 goto err1;
1881 }
1882
c56e3956
LZ		 1883 if (ops->validate) {
1884 const struct nft_data *data = NULL;
1885
1886 err = ops->validate(ctx, expr, &data);
1887 if (err < 0)
1888 goto err2;
1889 }
1890
96518518
PM		 1891 return 0;
1892
c56e3956
LZ		 1893err2:
1894 if (ops->destroy)
1895 ops->destroy(ctx, expr);
96518518
PM		 1896err1:
1897 expr->ops = NULL;
1898 return err;
1899}
1900
62472bce
PM		 1901static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1902 struct nft_expr *expr)
96518518
PM		 1903{
1904 if (expr->ops->destroy)
62472bce 1905 expr->ops->destroy(ctx, expr);
ef1f7df9 1906 module_put(expr->ops->type->owner);
96518518
PM		 1907}
1908
0b2d8a7b
PM		 1909struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1910 const struct nlattr *nla)
1911{
1912 struct nft_expr_info info;
1913 struct nft_expr *expr;
1914 int err;
1915
1916 err = nf_tables_expr_parse(ctx, nla, &info);
1917 if (err < 0)
1918 goto err1;
1919
1920 err = -ENOMEM;
1921 expr = kzalloc(info.ops->size, GFP_KERNEL);
1922 if (expr == NULL)
1923 goto err2;
1924
1925 err = nf_tables_newexpr(ctx, &info, expr);
1926 if (err < 0)
6cafaf47 1927 goto err3;
0b2d8a7b
PM		 1928
1929 return expr;
6cafaf47
LZ		 1930err3:
1931 kfree(expr);
0b2d8a7b
PM		 1932err2:
1933 module_put(info.ops->type->owner);
1934err1:
1935 return ERR_PTR(err);
1936}
1937
1938void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1939{
1940 nf_tables_expr_destroy(ctx, expr);
1941 kfree(expr);
1942}
1943
96518518
PM		 1944/*
1945 * Rules
1946 */
1947
1948static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1949 u64 handle)
1950{
1951 struct nft_rule *rule;
1952
1953 // FIXME: this sucks
1954 list_for_each_entry(rule, &chain->rules, list) {
1955 if (handle == rule->handle)
1956 return rule;
1957 }
1958
1959 return ERR_PTR(-ENOENT);
1960}
1961
1962static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1963 const struct nlattr *nla)
1964{
1965 if (nla == NULL)
1966 return ERR_PTR(-EINVAL);
1967
1968 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1969}
1970
1971static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 1972 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1973 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1974 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1975 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1976 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1977 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1978 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1979 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1980 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1981 .len = NFT_USERDATA_MAXLEN },
96518518
PM		 1982};
1983
84d7fce6
PNA		 1984static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1985 u32 portid, u32 seq, int event,
1986 u32 flags, int family,
96518518
PM		 1987 const struct nft_table *table,
1988 const struct nft_chain *chain,
1989 const struct nft_rule *rule)
1990{
1991 struct nlmsghdr *nlh;
1992 struct nfgenmsg *nfmsg;
1993 const struct nft_expr *expr, *next;
1994 struct nlattr *list;
5e948466 1995 const struct nft_rule *prule;
dedb67c4 1996 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 1997
dedb67c4 1998 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 1999 if (nlh == NULL)
2000 goto nla_put_failure;
2001
2002 nfmsg = nlmsg_data(nlh);
2003 nfmsg->nfgen_family = family;
2004 nfmsg->version = NFNETLINK_V0;
84d7fce6 2005 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2006
2007 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2008 goto nla_put_failure;
2009 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2010 goto nla_put_failure;
b46f6ded
ND		 2011 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2012 NFTA_RULE_PAD))
96518518
PM		 2013 goto nla_put_failure;
2014
5e948466 2015 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 2016 prule = list_prev_entry(rule, list);
5e948466 2017 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2018 cpu_to_be64(prule->handle),
2019 NFTA_RULE_PAD))
5e948466
EL		 2020 goto nla_put_failure;
2021 }
2022
96518518
PM		 2023 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2024 if (list == NULL)
2025 goto nla_put_failure;
2026 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2027 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2028 goto nla_put_failure;
96518518
PM		 2029 }
2030 nla_nest_end(skb, list);
2031
86f1ec32
PM		 2032 if (rule->udata) {
2033 struct nft_userdata *udata = nft_userdata(rule);
2034 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2035 udata->data) < 0)
2036 goto nla_put_failure;
2037 }
0768b3b3 2038
053c095a
JB		 2039 nlmsg_end(skb, nlh);
2040 return 0;
96518518
PM		 2041
2042nla_put_failure:
2043 nlmsg_trim(skb, nlh);
2044 return -1;
2045}
2046
25e94a99
PNA		 2047static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2048 const struct nft_rule *rule, int event)
96518518
PM		 2049{
2050 struct sk_buff *skb;
96518518
PM		 2051 int err;
2052
128ad332
PNA		 2053 if (!ctx->report &&
2054 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2055 return;
96518518 2056
96518518
PM		 2057 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2058 if (skb == NULL)
2059 goto err;
2060
84d7fce6
PNA		 2061 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2062 event, 0, ctx->afi->family, ctx->table,
35151d84 2063 ctx->chain, rule);
96518518
PM		 2064 if (err < 0) {
2065 kfree_skb(skb);
2066 goto err;
2067 }
2068
25e94a99
PNA		 2069 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2070 ctx->report, GFP_KERNEL);
2071 return;
96518518 2072err:
25e94a99 2073 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2074}
2075
6e1f760e 2076struct nft_rule_dump_ctx {
e46abbcc 2077 char *table;
b7263e07 2078 char *chain;
6e1f760e
PNA		 2079};
2080
96518518
PM		 2081static int nf_tables_dump_rules(struct sk_buff *skb,
2082 struct netlink_callback *cb)
2083{
2084 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2085 const struct nft_rule_dump_ctx *ctx = cb->data;
96518518
PM		 2086 const struct nft_af_info *afi;
2087 const struct nft_table *table;
2088 const struct nft_chain *chain;
2089 const struct nft_rule *rule;
2090 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 2091 struct net *net = sock_net(skb->sk);
96518518
PM		 2092 int family = nfmsg->nfgen_family;
2093
e688a7f8 2094 rcu_read_lock();
38e029f1
PNA		 2095 cb->seq = net->nft.base_seq;
2096
e688a7f8 2097 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 2098 if (family != NFPROTO_UNSPEC && family != afi->family)
2099 continue;
2100
e688a7f8 2101 list_for_each_entry_rcu(table, &afi->tables, list) {
e46abbcc 2102 if (ctx && ctx->table &&
6e1f760e
PNA		 2103 strcmp(ctx->table, table->name) != 0)
2104 continue;
2105
e688a7f8 2106 list_for_each_entry_rcu(chain, &table->chains, list) {
24c0df82 2107 if (ctx && ctx->chain &&
6e1f760e
PNA		 2108 strcmp(ctx->chain, chain->name) != 0)
2109 continue;
2110
e688a7f8 2111 list_for_each_entry_rcu(rule, &chain->rules, list) {
889f7ee7 2112 if (!nft_is_active(net, rule))
0628b123 2113 goto cont;
96518518
PM		 2114 if (idx < s_idx)
2115 goto cont;
2116 if (idx > s_idx)
2117 memset(&cb->args[1], 0,
2118 sizeof(cb->args) - sizeof(cb->args[0]));
84d7fce6 2119 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
96518518
PM		 2120 cb->nlh->nlmsg_seq,
2121 NFT_MSG_NEWRULE,
2122 NLM_F_MULTI | NLM_F_APPEND,
2123 afi->family, table, chain, rule) < 0)
2124 goto done;
38e029f1
PNA		 2125
2126 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 2127cont:
2128 idx++;
2129 }
2130 }
2131 }
2132 }
2133done:
e688a7f8
PNA		 2134 rcu_read_unlock();
2135
96518518
PM		 2136 cb->args[0] = idx;
2137 return skb->len;
2138}
2139
6e1f760e
PNA		 2140static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2141{
e46abbcc
PS		 2142 struct nft_rule_dump_ctx *ctx = cb->data;
2143
2144 if (ctx) {
2145 kfree(ctx->table);
b7263e07 2146 kfree(ctx->chain);
e46abbcc
PS		 2147 kfree(ctx);
2148 }
6e1f760e
PNA		 2149 return 0;
2150}
2151
7b8002a1
PNA		 2152static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2153 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2154 const struct nlattr * const nla[],
2155 struct netlink_ext_ack *extack)
96518518
PM		 2156{
2157 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2158 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2159 const struct nft_af_info *afi;
2160 const struct nft_table *table;
2161 const struct nft_chain *chain;
2162 const struct nft_rule *rule;
2163 struct sk_buff *skb2;
2164 int family = nfmsg->nfgen_family;
2165 int err;
2166
2167 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2168 struct netlink_dump_control c = {
2169 .dump = nf_tables_dump_rules,
6e1f760e 2170 .done = nf_tables_dump_rules_done,
96518518 2171 };
6e1f760e
PNA		 2172
2173 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2174 struct nft_rule_dump_ctx *ctx;
2175
2176 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2177 if (!ctx)
2178 return -ENOMEM;
2179
e46abbcc
PS		 2180 if (nla[NFTA_RULE_TABLE]) {
2181 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2182 GFP_KERNEL);
2183 if (!ctx->table) {
2184 kfree(ctx);
2185 return -ENOMEM;
2186 }
2187 }
b7263e07
PS		 2188 if (nla[NFTA_RULE_CHAIN]) {
2189 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2190 GFP_KERNEL);
2191 if (!ctx->chain) {
2192 kfree(ctx->table);
2193 kfree(ctx);
2194 return -ENOMEM;
2195 }
2196 }
6e1f760e
PNA		 2197 c.data = ctx;
2198 }
2199
96518518
PM		 2200 return netlink_dump_start(nlsk, skb, nlh, &c);
2201 }
2202
99633ab2 2203 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 2204 if (IS_ERR(afi))
2205 return PTR_ERR(afi);
2206
f2a6d766 2207 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2208 if (IS_ERR(table))
2209 return PTR_ERR(table);
2210
664b0f8c 2211 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2212 if (IS_ERR(chain))
2213 return PTR_ERR(chain);
2214
2215 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2216 if (IS_ERR(rule))
2217 return PTR_ERR(rule);
2218
2219 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2220 if (!skb2)
2221 return -ENOMEM;
2222
84d7fce6 2223 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2224 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2225 family, table, chain, rule);
2226 if (err < 0)
2227 goto err;
2228
2229 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2230
2231err:
2232 kfree_skb(skb2);
2233 return err;
2234}
2235
62472bce
PM		 2236static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2237 struct nft_rule *rule)
96518518 2238{
96518518
PM		 2239 struct nft_expr *expr;
2240
2241 /*
2242 * Careful: some expressions might not be initialized in case this
2243 * is called on error from nf_tables_newrule().
2244 */
2245 expr = nft_expr_first(rule);
3e38df13 2246 while (expr != nft_expr_last(rule) && expr->ops) {
62472bce 2247 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 2248 expr = nft_expr_next(expr);
2249 }
2250 kfree(rule);
2251}
2252
1081d11b
PNA		 2253#define NFT_RULE_MAXEXPRS 128
2254
2255static struct nft_expr_info *info;
2256
633c9a84
PNA		 2257static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2258 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2259 const struct nlattr * const nla[],
2260 struct netlink_ext_ack *extack)
96518518
PM		 2261{
2262 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2263 u8 genmask = nft_genmask_next(net);
7c95f6d8 2264 struct nft_af_info *afi;
96518518
PM		 2265 struct nft_table *table;
2266 struct nft_chain *chain;
2267 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2268 struct nft_userdata *udata;
1081d11b 2269 struct nft_trans *trans = NULL;
96518518
PM		 2270 struct nft_expr *expr;
2271 struct nft_ctx ctx;
2272 struct nlattr *tmp;
86f1ec32 2273 unsigned int size, i, n, ulen = 0, usize = 0;
96518518
PM		 2274 int err, rem;
2275 bool create;
5e948466 2276 u64 handle, pos_handle;
96518518
PM		 2277
2278 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2279
99633ab2 2280 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
96518518
PM		 2281 if (IS_ERR(afi))
2282 return PTR_ERR(afi);
2283
f2a6d766 2284 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2285 if (IS_ERR(table))
2286 return PTR_ERR(table);
2287
664b0f8c 2288 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2289 if (IS_ERR(chain))
2290 return PTR_ERR(chain);
2291
2292 if (nla[NFTA_RULE_HANDLE]) {
2293 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2294 rule = __nf_tables_rule_lookup(chain, handle);
2295 if (IS_ERR(rule))
2296 return PTR_ERR(rule);
2297
2298 if (nlh->nlmsg_flags & NLM_F_EXCL)
2299 return -EEXIST;
2300 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2301 old_rule = rule;
2302 else
2303 return -EOPNOTSUPP;
2304 } else {
2305 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2306 return -EINVAL;
2307 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2308
2309 if (chain->use == UINT_MAX)
2310 return -EOVERFLOW;
96518518
PM		 2311 }
2312
5e948466
EL		 2313 if (nla[NFTA_RULE_POSITION]) {
2314 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2315 return -EOPNOTSUPP;
2316
2317 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2318 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
2319 if (IS_ERR(old_rule))
2320 return PTR_ERR(old_rule);
2321 }
2322
633c9a84 2323 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0ca743a5 2324
96518518
PM		 2325 n = 0;
2326 size = 0;
2327 if (nla[NFTA_RULE_EXPRESSIONS]) {
2328 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2329 err = -EINVAL;
2330 if (nla_type(tmp) != NFTA_LIST_ELEM)
2331 goto err1;
2332 if (n == NFT_RULE_MAXEXPRS)
2333 goto err1;
0ca743a5 2334 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2335 if (err < 0)
2336 goto err1;
2337 size += info[n].ops->size;
2338 n++;
2339 }
2340 }
9889840f
PM		 2341 /* Check for overflow of dlen field */
2342 err = -EFBIG;
2343 if (size >= 1 << 12)
2344 goto err1;
96518518 2345
86f1ec32 2346 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2347 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2348 if (ulen > 0)
2349 usize = sizeof(struct nft_userdata) + ulen;
2350 }
0768b3b3 2351
96518518 2352 err = -ENOMEM;
86f1ec32 2353 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2354 if (rule == NULL)
2355 goto err1;
2356
889f7ee7 2357 nft_activate_next(net, rule);
0628b123 2358
96518518
PM		 2359 rule->handle = handle;
2360 rule->dlen = size;
86f1ec32 2361 rule->udata = ulen ? 1 : 0;
0768b3b3 2362
86f1ec32
PM		 2363 if (ulen) {
2364 udata = nft_userdata(rule);
2365 udata->len = ulen - 1;
2366 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2367 }
96518518 2368
96518518
PM		 2369 expr = nft_expr_first(rule);
2370 for (i = 0; i < n; i++) {
2371 err = nf_tables_newexpr(&ctx, &info[i], expr);
2372 if (err < 0)
2373 goto err2;
ef1f7df9 2374 info[i].ops = NULL;
96518518
PM		 2375 expr = nft_expr_next(expr);
2376 }
2377
96518518 2378 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
889f7ee7 2379 if (nft_is_active_next(net, old_rule)) {
ac904ac8 2380 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
b380e5c7 2381 old_rule);
1081d11b 2382 if (trans == NULL) {
0628b123
PNA		 2383 err = -ENOMEM;
2384 goto err2;
2385 }
889f7ee7 2386 nft_deactivate_next(net, old_rule);
ac34b861 2387 chain->use--;
5bc5c307 2388 list_add_tail_rcu(&rule->list, &old_rule->list);
0628b123
PNA		 2389 } else {
2390 err = -ENOENT;
2391 goto err2;
2392 }
96518518 2393 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 2394 if (old_rule)
2395 list_add_rcu(&rule->list, &old_rule->list);
2396 else
2397 list_add_tail_rcu(&rule->list, &chain->rules);
2398 else {
2399 if (old_rule)
2400 list_add_tail_rcu(&rule->list, &old_rule->list);
2401 else
2402 list_add_rcu(&rule->list, &chain->rules);
2403 }
96518518 2404
b380e5c7 2405 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 2406 err = -ENOMEM;
2407 goto err3;
2408 }
4fefee57 2409 chain->use++;
96518518
PM		 2410 return 0;
2411
0628b123
PNA		 2412err3:
2413 list_del_rcu(&rule->list);
96518518 2414err2:
62472bce 2415 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 2416err1:
2417 for (i = 0; i < n; i++) {
2418 if (info[i].ops != NULL)
ef1f7df9 2419 module_put(info[i].ops->type->owner);
96518518
PM		 2420 }
2421 return err;
2422}
2423
1a94e38d
PNA		 2424static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2425 const struct nlattr *nla)
2426{
2427 u32 id = ntohl(nla_get_be32(nla));
2428 struct nft_trans *trans;
2429
2430 list_for_each_entry(trans, &net->nft.commit_list, list) {
2431 struct nft_rule *rule = nft_trans_rule(trans);
2432
2433 if (trans->msg_type == NFT_MSG_NEWRULE &&
2434 id == nft_trans_rule_id(trans))
2435 return rule;
2436 }
2437 return ERR_PTR(-ENOENT);
2438}
2439
633c9a84
PNA		 2440static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2441 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2442 const struct nlattr * const nla[],
2443 struct netlink_ext_ack *extack)
96518518
PM		 2444{
2445 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2446 u8 genmask = nft_genmask_next(net);
7c95f6d8 2447 struct nft_af_info *afi;
7c95f6d8 2448 struct nft_table *table;
cf9dc09d
PNA		 2449 struct nft_chain *chain = NULL;
2450 struct nft_rule *rule;
0628b123
PNA		 2451 int family = nfmsg->nfgen_family, err = 0;
2452 struct nft_ctx ctx;
96518518 2453
99633ab2 2454 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 2455 if (IS_ERR(afi))
2456 return PTR_ERR(afi);
2457
f2a6d766 2458 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2459 if (IS_ERR(table))
2460 return PTR_ERR(table);
2461
cf9dc09d 2462 if (nla[NFTA_RULE_CHAIN]) {
664b0f8c
PNA		 2463 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN],
2464 genmask);
cf9dc09d
PNA		 2465 if (IS_ERR(chain))
2466 return PTR_ERR(chain);
2467 }
96518518 2468
633c9a84 2469 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0628b123 2470
cf9dc09d
PNA		 2471 if (chain) {
2472 if (nla[NFTA_RULE_HANDLE]) {
2473 rule = nf_tables_rule_lookup(chain,
2474 nla[NFTA_RULE_HANDLE]);
2475 if (IS_ERR(rule))
2476 return PTR_ERR(rule);
96518518 2477
1a94e38d
PNA		 2478 err = nft_delrule(&ctx, rule);
2479 } else if (nla[NFTA_RULE_ID]) {
2480 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2481 if (IS_ERR(rule))
2482 return PTR_ERR(rule);
2483
5e266fe7 2484 err = nft_delrule(&ctx, rule);
cf9dc09d 2485 } else {
ce24b721 2486 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2487 }
2488 } else {
2489 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2490 if (!nft_is_active_next(net, chain))
2491 continue;
2492
cf9dc09d 2493 ctx.chain = chain;
ce24b721 2494 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2495 if (err < 0)
2496 break;
2497 }
2498 }
2499
2500 return err;
2501}
2502
20a69341
PM		 2503/*
2504 * Sets
2505 */
2506
2b664957 2507static LIST_HEAD(nf_tables_set_types);
20a69341 2508
2b664957 2509int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2510{
2511 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2512 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2513 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2514 return 0;
2515}
2516EXPORT_SYMBOL_GPL(nft_register_set);
2517
2b664957 2518void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2519{
2520 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2521 list_del_rcu(&type->list);
20a69341
PM		 2522 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2523}
2524EXPORT_SYMBOL_GPL(nft_unregister_set);
2525
2b664957
PNA		 2526#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2527 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
2528
2529static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
2530{
2531 return (flags & ops->features) == (flags & NFT_SET_FEATURES);
2532}
2533
c50b960c
PM		 2534/*
2535 * Select a set implementation based on the data characteristics and the
2536 * given policy. The total memory use might not be known if no size is
2537 * given, in that case the amount of memory per element is used.
2538 */
2539static const struct nft_set_ops *
2b664957
PNA		 2540nft_select_set_ops(const struct nft_ctx *ctx,
2541 const struct nlattr * const nla[],
c50b960c
PM		 2542 const struct nft_set_desc *desc,
2543 enum nft_set_policies policy)
20a69341 2544{
c50b960c
PM		 2545 const struct nft_set_ops *ops, *bops;
2546 struct nft_set_estimate est, best;
2b664957
PNA		 2547 const struct nft_set_type *type;
2548 u32 flags = 0;
20a69341
PM		 2549
2550#ifdef CONFIG_MODULES
2b664957 2551 if (list_empty(&nf_tables_set_types)) {
20a69341
PM		 2552 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2553 request_module("nft-set");
2554 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2555 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2556 return ERR_PTR(-EAGAIN);
2557 }
2558#endif
2b664957
PNA		 2559 if (nla[NFTA_SET_FLAGS] != NULL)
2560 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2561
55af753c
PNA		 2562 bops = NULL;
2563 best.size = ~0;
2564 best.lookup = ~0;
0b5a7874 2565 best.space = ~0;
c50b960c 2566
2b664957
PNA		 2567 list_for_each_entry(type, &nf_tables_set_types, list) {
2568 if (!type->select_ops)
2569 ops = type->ops;
2570 else
2571 ops = type->select_ops(ctx, desc, flags);
2572 if (!ops)
2573 continue;
2574
2575 if (!nft_set_ops_candidate(ops, flags))
20a69341 2576 continue;
2b664957 2577 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2578 continue;
2579
2580 switch (policy) {
2581 case NFT_SET_POL_PERFORMANCE:
55af753c 2582 if (est.lookup < best.lookup)
c50b960c 2583 break;
644e334e
PNA		 2584 if (est.lookup == best.lookup &&
2585 est.space < best.space)
2586 break;
c50b960c
PM		 2587 continue;
2588 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2589 if (!desc->size) {
2590 if (est.space < best.space)
2591 break;
2592 if (est.space == best.space &&
2593 est.lookup < best.lookup)
2594 break;
2595 } else if (est.size < best.size) {
c50b960c 2596 break;
0b5a7874 2597 }
c50b960c
PM		 2598 continue;
2599 default:
2600 break;
2601 }
2602
2b664957 2603 if (!try_module_get(type->owner))
20a69341 2604 continue;
c50b960c 2605 if (bops != NULL)
2b664957 2606 module_put(bops->type->owner);
c50b960c
PM		 2607
2608 bops = ops;
2609 best = est;
20a69341
PM		 2610 }
2611
c50b960c
PM		 2612 if (bops != NULL)
2613 return bops;
2614
20a69341
PM		 2615 return ERR_PTR(-EOPNOTSUPP);
2616}
2617
2618static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2619 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2620 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2621 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2622 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2623 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2624 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2625 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2626 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2627 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2628 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2629 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2630 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2631 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2632 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2633 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2634 .len = NFT_USERDATA_MAXLEN },
8aeff920 2635 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
c50b960c
PM		 2636};
2637
2638static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2639 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2640};
2641
633c9a84 2642static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2643 const struct sk_buff *skb,
2644 const struct nlmsghdr *nlh,
f2a6d766
PNA		 2645 const struct nlattr * const nla[],
2646 u8 genmask)
20a69341
PM		 2647{
2648 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 2649 struct nft_af_info *afi = NULL;
2650 struct nft_table *table = NULL;
20a69341 2651
c9c8e485
PNA		 2652 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
2653 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
2654 if (IS_ERR(afi))
2655 return PTR_ERR(afi);
2656 }
20a69341
PM		 2657
2658 if (nla[NFTA_SET_TABLE] != NULL) {
ec2c9935
PM		 2659 if (afi == NULL)
2660 return -EAFNOSUPPORT;
2661
f2a6d766
PNA		 2662 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE],
2663 genmask);
20a69341
PM		 2664 if (IS_ERR(table))
2665 return PTR_ERR(table);
2666 }
2667
633c9a84 2668 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2669 return 0;
2670}
2671
c7a72e3f
PNA		 2672static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2673 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2674{
2675 struct nft_set *set;
2676
2677 if (nla == NULL)
2678 return ERR_PTR(-EINVAL);
2679
2680 list_for_each_entry(set, &table->sets, list) {
37a9cc52
PNA		 2681 if (!nla_strcmp(nla, set->name) &&
2682 nft_active_genmask(set, genmask))
20a69341
PM		 2683 return set;
2684 }
2685 return ERR_PTR(-ENOENT);
2686}
2687
c7a72e3f
PNA		 2688static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2689 const struct nlattr *nla,
2690 u8 genmask)
958bee14
PNA		 2691{
2692 struct nft_trans *trans;
2693 u32 id = ntohl(nla_get_be32(nla));
2694
2695 list_for_each_entry(trans, &net->nft.commit_list, list) {
37a9cc52
PNA		 2696 struct nft_set *set = nft_trans_set(trans);
2697
958bee14 2698 if (trans->msg_type == NFT_MSG_NEWSET &&
37a9cc52
PNA		 2699 id == nft_trans_set_id(trans) &&
2700 nft_active_genmask(set, genmask))
2701 return set;
958bee14
PNA		 2702 }
2703 return ERR_PTR(-ENOENT);
2704}
c7a72e3f
PNA		 2705
2706struct nft_set *nft_set_lookup(const struct net *net,
2707 const struct nft_table *table,
2708 const struct nlattr *nla_set_name,
2709 const struct nlattr *nla_set_id,
2710 u8 genmask)
2711{
2712 struct nft_set *set;
2713
2714 set = nf_tables_set_lookup(table, nla_set_name, genmask);
2715 if (IS_ERR(set)) {
2716 if (!nla_set_id)
2717 return set;
2718
2719 set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
2720 }
2721 return set;
2722}
2723EXPORT_SYMBOL_GPL(nft_set_lookup);
958bee14 2724
20a69341
PM		 2725static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2726 const char *name)
2727{
2728 const struct nft_set *i;
2729 const char *p;
2730 unsigned long *inuse;
60eb1894 2731 unsigned int n = 0, min = 0;
20a69341 2732
38745490 2733 p = strchr(name, '%');
20a69341
PM		 2734 if (p != NULL) {
2735 if (p[1] != 'd' || strchr(p + 2, '%'))
2736 return -EINVAL;
2737
2738 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2739 if (inuse == NULL)
2740 return -ENOMEM;
60eb1894 2741cont:
20a69341 2742 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2743 int tmp;
2744
37a9cc52
PNA		 2745 if (!nft_is_active_next(ctx->net, set))
2746 continue;
14662917 2747 if (!sscanf(i->name, name, &tmp))
20a69341 2748 continue;
60eb1894 2749 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2750 continue;
14662917 2751
60eb1894 2752 set_bit(tmp - min, inuse);
20a69341
PM		 2753 }
2754
53b70287 2755 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2756 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2757 min += BITS_PER_BYTE * PAGE_SIZE;
2758 memset(inuse, 0, PAGE_SIZE);
2759 goto cont;
2760 }
20a69341
PM		 2761 free_page((unsigned long)inuse);
2762 }
2763
38745490
PS		 2764 set->name = kasprintf(GFP_KERNEL, name, min + n);
2765 if (!set->name)
2766 return -ENOMEM;
2767
20a69341 2768 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 2769 if (!nft_is_active_next(ctx->net, i))
2770 continue;
e63aaaa6
AY		 2771 if (!strcmp(set->name, i->name)) {
2772 kfree(set->name);
20a69341 2773 return -ENFILE;
e63aaaa6 2774 }
20a69341
PM		 2775 }
2776 return 0;
2777}
2778
2779static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2780 const struct nft_set *set, u16 event, u16 flags)
2781{
2782 struct nfgenmsg *nfmsg;
2783 struct nlmsghdr *nlh;
c50b960c 2784 struct nlattr *desc;
128ad332
PNA		 2785 u32 portid = ctx->portid;
2786 u32 seq = ctx->seq;
20a69341 2787
dedb67c4 2788 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 2789 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2790 flags);
2791 if (nlh == NULL)
2792 goto nla_put_failure;
2793
2794 nfmsg = nlmsg_data(nlh);
2795 nfmsg->nfgen_family = ctx->afi->family;
2796 nfmsg->version = NFNETLINK_V0;
84d7fce6 2797 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 2798
2799 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2800 goto nla_put_failure;
2801 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2802 goto nla_put_failure;
2803 if (set->flags != 0)
2804 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2805 goto nla_put_failure;
2806
2807 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2808 goto nla_put_failure;
2809 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2810 goto nla_put_failure;
2811 if (set->flags & NFT_SET_MAP) {
2812 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2813 goto nla_put_failure;
2814 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2815 goto nla_put_failure;
2816 }
8aeff920
PNA		 2817 if (set->flags & NFT_SET_OBJECT &&
2818 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2819 goto nla_put_failure;
20a69341 2820
761da293 2821 if (set->timeout &&
d3e2a111
AP		 2822 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2823 cpu_to_be64(jiffies_to_msecs(set->timeout)),
b46f6ded 2824 NFTA_SET_PAD))
761da293
PM		 2825 goto nla_put_failure;
2826 if (set->gc_int &&
2827 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2828 goto nla_put_failure;
2829
9363dc4b
AB		 2830 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2831 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2832 goto nla_put_failure;
2833 }
2834
e6d8ecac
CFG		 2835 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2836 goto nla_put_failure;
2837
c50b960c
PM		 2838 desc = nla_nest_start(skb, NFTA_SET_DESC);
2839 if (desc == NULL)
2840 goto nla_put_failure;
2841 if (set->size &&
2842 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2843 goto nla_put_failure;
2844 nla_nest_end(skb, desc);
2845
053c095a
JB		 2846 nlmsg_end(skb, nlh);
2847 return 0;
20a69341
PM		 2848
2849nla_put_failure:
2850 nlmsg_trim(skb, nlh);
2851 return -1;
2852}
2853
25e94a99
PNA		 2854static void nf_tables_set_notify(const struct nft_ctx *ctx,
2855 const struct nft_set *set, int event,
2856 gfp_t gfp_flags)
20a69341
PM		 2857{
2858 struct sk_buff *skb;
128ad332 2859 u32 portid = ctx->portid;
20a69341
PM		 2860 int err;
2861
128ad332
PNA		 2862 if (!ctx->report &&
2863 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2864 return;
20a69341 2865
31f8441c 2866 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 2867 if (skb == NULL)
2868 goto err;
2869
2870 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2871 if (err < 0) {
2872 kfree_skb(skb);
2873 goto err;
2874 }
2875
25e94a99
PNA		 2876 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2877 gfp_flags);
2878 return;
20a69341 2879err:
25e94a99 2880 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 2881}
2882
5b96af77 2883static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 2884{
2885 const struct nft_set *set;
2886 unsigned int idx, s_idx = cb->args[0];
7c95f6d8 2887 struct nft_af_info *afi;
c9c8e485
PNA		 2888 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2889 struct net *net = sock_net(skb->sk);
2890 int cur_family = cb->args[3];
5b96af77 2891 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 2892
2893 if (cb->args[1])
2894 return skb->len;
2895
e688a7f8 2896 rcu_read_lock();
38e029f1
PNA		 2897 cb->seq = net->nft.base_seq;
2898
e688a7f8 2899 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
5b96af77
PNA		 2900 if (ctx->afi && ctx->afi != afi)
2901 continue;
2902
c9c8e485
PNA		 2903 if (cur_family) {
2904 if (afi->family != cur_family)
2905 continue;
2906
2907 cur_family = 0;
2908 }
e688a7f8 2909 list_for_each_entry_rcu(table, &afi->tables, list) {
5b96af77
PNA		 2910 if (ctx->table && ctx->table != table)
2911 continue;
2912
c9c8e485
PNA		 2913 if (cur_table) {
2914 if (cur_table != table)
2915 continue;
2916
2917 cur_table = NULL;
2918 }
c9c8e485 2919 idx = 0;
5b96af77 2920 list_for_each_entry_rcu(set, &table->sets, list) {
c9c8e485
PNA		 2921 if (idx < s_idx)
2922 goto cont;
37a9cc52
PNA		 2923 if (!nft_is_active(net, set))
2924 goto cont;
5b96af77
PNA		 2925
2926 ctx_set = *ctx;
2927 ctx_set.table = table;
2928 ctx_set.afi = afi;
2929 if (nf_tables_fill_set(skb, &ctx_set, set,
c9c8e485
PNA		 2930 NFT_MSG_NEWSET,
2931 NLM_F_MULTI) < 0) {
2932 cb->args[0] = idx;
2933 cb->args[2] = (unsigned long) table;
2934 cb->args[3] = afi->family;
2935 goto done;
2936 }
38e029f1 2937 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485
PNA		 2938cont:
2939 idx++;
2940 }
2941 if (s_idx)
2942 s_idx = 0;
2943 }
2944 }
2945 cb->args[1] = 1;
2946done:
e688a7f8 2947 rcu_read_unlock();
c9c8e485
PNA		 2948 return skb->len;
2949}
2950
5b96af77 2951static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 2952{
5b96af77
PNA		 2953 kfree(cb->data);
2954 return 0;
20a69341
PM		 2955}
2956
7b8002a1
PNA		 2957static int nf_tables_getset(struct net *net, struct sock *nlsk,
2958 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2959 const struct nlattr * const nla[],
2960 struct netlink_ext_ack *extack)
20a69341 2961{
f2a6d766 2962 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 2963 const struct nft_set *set;
2964 struct nft_ctx ctx;
2965 struct sk_buff *skb2;
c9c8e485 2966 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2967 int err;
2968
01cfa0a4 2969 /* Verify existence before starting dump */
f2a6d766 2970 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 2971 if (err < 0)
2972 return err;
2973
2974 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2975 struct netlink_dump_control c = {
2976 .dump = nf_tables_dump_sets,
5b96af77 2977 .done = nf_tables_dump_sets_done,
20a69341 2978 };
5b96af77
PNA		 2979 struct nft_ctx *ctx_dump;
2980
2981 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2982 if (ctx_dump == NULL)
2983 return -ENOMEM;
2984
2985 *ctx_dump = ctx;
2986 c.data = ctx_dump;
2987
20a69341
PM		 2988 return netlink_dump_start(nlsk, skb, nlh, &c);
2989 }
2990
c9c8e485
PNA		 2991 /* Only accept unspec with dump */
2992 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2993 return -EAFNOSUPPORT;
eaa2bcd6
PT		 2994 if (!nla[NFTA_SET_TABLE])
2995 return -EINVAL;
c9c8e485 2996
37a9cc52 2997 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 2998 if (IS_ERR(set))
2999 return PTR_ERR(set);
3000
3001 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
3002 if (skb2 == NULL)
3003 return -ENOMEM;
3004
3005 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3006 if (err < 0)
3007 goto err;
3008
3009 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3010
3011err:
3012 kfree_skb(skb2);
3013 return err;
3014}
3015
c50b960c
PM		 3016static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3017 struct nft_set_desc *desc,
3018 const struct nlattr *nla)
3019{
3020 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3021 int err;
3022
fceb6435
JB		 3023 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3024 nft_set_desc_policy, NULL);
c50b960c
PM		 3025 if (err < 0)
3026 return err;
3027
3028 if (da[NFTA_SET_DESC_SIZE] != NULL)
3029 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3030
3031 return 0;
3032}
3033
633c9a84
PNA		 3034static int nf_tables_newset(struct net *net, struct sock *nlsk,
3035 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3036 const struct nlattr * const nla[],
3037 struct netlink_ext_ack *extack)
20a69341
PM		 3038{
3039 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3040 u8 genmask = nft_genmask_next(net);
20a69341 3041 const struct nft_set_ops *ops;
7c95f6d8 3042 struct nft_af_info *afi;
20a69341
PM		 3043 struct nft_table *table;
3044 struct nft_set *set;
3045 struct nft_ctx ctx;
38745490 3046 char *name;
20a69341
PM		 3047 unsigned int size;
3048 bool create;
761da293 3049 u64 timeout;
8aeff920 3050 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3051 struct nft_set_desc desc;
e6d8ecac
CFG		 3052 unsigned char *udata;
3053 u16 udlen;
20a69341
PM		 3054 int err;
3055
3056 if (nla[NFTA_SET_TABLE] == NULL ||
3057 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3058 nla[NFTA_SET_KEY_LEN] == NULL ||
3059 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3060 return -EINVAL;
3061
c50b960c
PM		 3062 memset(&desc, 0, sizeof(desc));
3063
20a69341
PM		 3064 ktype = NFT_DATA_VALUE;
3065 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3066 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3067 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3068 return -EINVAL;
3069 }
3070
c50b960c 3071 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3072 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3073 return -EINVAL;
3074
3075 flags = 0;
3076 if (nla[NFTA_SET_FLAGS] != NULL) {
3077 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3078 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3079 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3080 NFT_SET_MAP | NFT_SET_EVAL |
3081 NFT_SET_OBJECT))
20a69341 3082 return -EINVAL;
8aeff920
PNA		 3083 /* Only one of these operations is supported */
3084 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3085 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3086 return -EOPNOTSUPP;
20a69341
PM		 3087 }
3088
3089 dtype = 0;
20a69341
PM		 3090 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3091 if (!(flags & NFT_SET_MAP))
3092 return -EINVAL;
3093
3094 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3095 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3096 dtype != NFT_DATA_VERDICT)
3097 return -EINVAL;
3098
3099 if (dtype != NFT_DATA_VERDICT) {
3100 if (nla[NFTA_SET_DATA_LEN] == NULL)
3101 return -EINVAL;
c50b960c 3102 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3103 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3104 return -EINVAL;
3105 } else
7d740264 3106 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3107 } else if (flags & NFT_SET_MAP)
3108 return -EINVAL;
3109
8aeff920
PNA		 3110 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3111 if (!(flags & NFT_SET_OBJECT))
3112 return -EINVAL;
3113
3114 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3115 if (objtype == NFT_OBJECT_UNSPEC ||
3116 objtype > NFT_OBJECT_MAX)
3117 return -EINVAL;
3118 } else if (flags & NFT_SET_OBJECT)
3119 return -EINVAL;
3120 else
3121 objtype = NFT_OBJECT_UNSPEC;
3122
761da293
PM		 3123 timeout = 0;
3124 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3125 if (!(flags & NFT_SET_TIMEOUT))
3126 return -EINVAL;
d3e2a111
AP		 3127 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3128 nla[NFTA_SET_TIMEOUT])));
761da293
PM		 3129 }
3130 gc_int = 0;
3131 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3132 if (!(flags & NFT_SET_TIMEOUT))
3133 return -EINVAL;
3134 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3135 }
3136
c50b960c
PM		 3137 policy = NFT_SET_POL_PERFORMANCE;
3138 if (nla[NFTA_SET_POLICY] != NULL)
3139 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3140
3141 if (nla[NFTA_SET_DESC] != NULL) {
3142 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3143 if (err < 0)
3144 return err;
3145 }
3146
20a69341
PM		 3147 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3148
99633ab2 3149 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
20a69341
PM		 3150 if (IS_ERR(afi))
3151 return PTR_ERR(afi);
3152
f2a6d766 3153 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask);
20a69341
PM		 3154 if (IS_ERR(table))
3155 return PTR_ERR(table);
3156
633c9a84 3157 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341 3158
37a9cc52 3159 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3160 if (IS_ERR(set)) {
3161 if (PTR_ERR(set) != -ENOENT)
3162 return PTR_ERR(set);
1a28ad74 3163 } else {
20a69341
PM		 3164 if (nlh->nlmsg_flags & NLM_F_EXCL)
3165 return -EEXIST;
3166 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3167 return -EOPNOTSUPP;
3168 return 0;
3169 }
3170
3171 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3172 return -ENOENT;
3173
2b664957 3174 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3175 if (IS_ERR(ops))
3176 return PTR_ERR(ops);
3177
e6d8ecac
CFG		 3178 udlen = 0;
3179 if (nla[NFTA_SET_USERDATA])
3180 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3181
20a69341
PM		 3182 size = 0;
3183 if (ops->privsize != NULL)
347b408d 3184 size = ops->privsize(nla, &desc);
20a69341 3185
1ff75a3e
PNA		 3186 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3187 if (!set) {
3188 err = -ENOMEM;
20a69341 3189 goto err1;
1ff75a3e 3190 }
20a69341 3191
38745490
PS		 3192 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3193 if (!name) {
3194 err = -ENOMEM;
3195 goto err2;
3196 }
3197
20a69341 3198 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3199 kfree(name);
20a69341
PM		 3200 if (err < 0)
3201 goto err2;
3202
e6d8ecac
CFG		 3203 udata = NULL;
3204 if (udlen) {
3205 udata = set->data + size;
3206 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3207 }
3208
20a69341
PM		 3209 INIT_LIST_HEAD(&set->bindings);
3210 set->ops = ops;
3211 set->ktype = ktype;
c50b960c 3212 set->klen = desc.klen;
20a69341 3213 set->dtype = dtype;
8aeff920 3214 set->objtype = objtype;
c50b960c 3215 set->dlen = desc.dlen;
20a69341 3216 set->flags = flags;
c50b960c 3217 set->size = desc.size;
9363dc4b 3218 set->policy = policy;
e6d8ecac
CFG		 3219 set->udlen = udlen;
3220 set->udata = udata;
761da293
PM		 3221 set->timeout = timeout;
3222 set->gc_int = gc_int;
20a69341 3223
c50b960c 3224 err = ops->init(set, &desc, nla);
20a69341
PM		 3225 if (err < 0)
3226 goto err2;
3227
958bee14 3228 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3229 if (err < 0)
c17c3cdf 3230 goto err3;
20a69341 3231
e688a7f8 3232 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3233 table->use++;
20a69341
PM		 3234 return 0;
3235
c17c3cdf
LZ		 3236err3:
3237 ops->destroy(set);
20a69341 3238err2:
1ff75a3e 3239 kvfree(set);
20a69341 3240err1:
2b664957 3241 module_put(ops->type->owner);
20a69341
PM		 3242 return err;
3243}
3244
958bee14 3245static void nft_set_destroy(struct nft_set *set)
20a69341 3246{
20a69341 3247 set->ops->destroy(set);
2b664957 3248 module_put(set->ops->type->owner);
38745490 3249 kfree(set->name);
1ff75a3e 3250 kvfree(set);
20a69341
PM		 3251}
3252
958bee14
PNA		 3253static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3254{
e688a7f8 3255 list_del_rcu(&set->list);
31f8441c 3256 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
958bee14
PNA		 3257 nft_set_destroy(set);
3258}
3259
633c9a84
PNA		 3260static int nf_tables_delset(struct net *net, struct sock *nlsk,
3261 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3262 const struct nlattr * const nla[],
3263 struct netlink_ext_ack *extack)
20a69341 3264{
c9c8e485 3265 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3266 u8 genmask = nft_genmask_next(net);
20a69341
PM		 3267 struct nft_set *set;
3268 struct nft_ctx ctx;
3269 int err;
3270
ec2c9935
PM		 3271 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3272 return -EAFNOSUPPORT;
20a69341
PM		 3273 if (nla[NFTA_SET_TABLE] == NULL)
3274 return -EINVAL;
3275
f2a6d766 3276 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 3277 if (err < 0)
3278 return err;
3279
37a9cc52 3280 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3281 if (IS_ERR(set))
3282 return PTR_ERR(set);
a8278400
PNA		 3283
3284 if (!list_empty(&set->bindings) ||
3285 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0))
20a69341
PM		 3286 return -EBUSY;
3287
ee01d542 3288 return nft_delset(&ctx, set);
20a69341
PM		 3289}
3290
3291static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3292 struct nft_set *set,
20a69341 3293 const struct nft_set_iter *iter,
de70185d 3294 struct nft_set_elem *elem)
20a69341 3295{
fe2811eb 3296 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3297 enum nft_registers dreg;
3298
3299 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3300 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3301 set->dtype == NFT_DATA_VERDICT ?
3302 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3303 set->dlen);
20a69341
PM		 3304}
3305
3306int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3307 struct nft_set_binding *binding)
3308{
3309 struct nft_set_binding *i;
3310 struct nft_set_iter iter;
3311
408070d6 3312 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3313 return -EBUSY;
3314
11113e19 3315 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3316 /* If the set is already bound to the same chain all
3317 * jumps are already validated for that chain.
3318 */
3319 list_for_each_entry(i, &set->bindings, list) {
a4684402 3320 if (i->flags & NFT_SET_MAP &&
11113e19 3321 i->chain == binding->chain)
20a69341
PM		 3322 goto bind;
3323 }
3324
8588ac09 3325 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3326 iter.skip = 0;
3327 iter.count = 0;
3328 iter.err = 0;
3329 iter.fn = nf_tables_bind_check_setelem;
3330
3331 set->ops->walk(ctx, set, &iter);
a02f4248 3332 if (iter.err < 0)
20a69341 3333 return iter.err;
20a69341
PM		 3334 }
3335bind:
3336 binding->chain = ctx->chain;
e688a7f8 3337 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3338 return 0;
3339}
63aea290 3340EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341
PM		 3341
3342void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3343 struct nft_set_binding *binding)
3344{
e688a7f8 3345 list_del_rcu(&binding->list);
20a69341 3346
408070d6 3347 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
37a9cc52 3348 nft_is_active(ctx->net, set))
20a69341
PM		 3349 nf_tables_set_destroy(ctx, set);
3350}
63aea290 3351EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3352
3ac4c07a
PM		 3353const struct nft_set_ext_type nft_set_ext_types[] = {
3354 [NFT_SET_EXT_KEY] = {
7d740264 3355 .align = __alignof__(u32),
3ac4c07a
PM		 3356 },
3357 [NFT_SET_EXT_DATA] = {
7d740264 3358 .align = __alignof__(u32),
3ac4c07a 3359 },
f25ad2e9
PM		 3360 [NFT_SET_EXT_EXPR] = {
3361 .align = __alignof__(struct nft_expr),
3362 },
8aeff920
PNA		 3363 [NFT_SET_EXT_OBJREF] = {
3364 .len = sizeof(struct nft_object *),
3365 .align = __alignof__(struct nft_object *),
3366 },
3ac4c07a
PM		 3367 [NFT_SET_EXT_FLAGS] = {
3368 .len = sizeof(u8),
3369 .align = __alignof__(u8),
3370 },
c3e1b005
PM		 3371 [NFT_SET_EXT_TIMEOUT] = {
3372 .len = sizeof(u64),
3373 .align = __alignof__(u64),
3374 },
3375 [NFT_SET_EXT_EXPIRATION] = {
3376 .len = sizeof(unsigned long),
3377 .align = __alignof__(unsigned long),
3378 },
68e942e8
PM		 3379 [NFT_SET_EXT_USERDATA] = {
3380 .len = sizeof(struct nft_userdata),
3381 .align = __alignof__(struct nft_userdata),
3382 },
3ac4c07a
PM		 3383};
3384EXPORT_SYMBOL_GPL(nft_set_ext_types);
3385
20a69341
PM		 3386/*
3387 * Set elements
3388 */
3389
3390static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3391 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3392 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3393 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3394 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3395 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3396 .len = NFT_USERDATA_MAXLEN },
20a69341
PM		 3397};
3398
3399static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3400 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3401 .len = NFT_TABLE_MAXNAMELEN - 1 },
3402 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3403 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3404 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3405 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3406};
3407
633c9a84 3408static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3409 const struct sk_buff *skb,
3410 const struct nlmsghdr *nlh,
f2a6d766
PNA		 3411 const struct nlattr * const nla[],
3412 u8 genmask)
20a69341
PM		 3413{
3414 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 3415 struct nft_af_info *afi;
3416 struct nft_table *table;
20a69341 3417
99633ab2 3418 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
20a69341
PM		 3419 if (IS_ERR(afi))
3420 return PTR_ERR(afi);
3421
f2a6d766
PNA		 3422 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE],
3423 genmask);
20a69341
PM		 3424 if (IS_ERR(table))
3425 return PTR_ERR(table);
3426
633c9a84 3427 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 3428 return 0;
3429}
3430
3431static int nf_tables_fill_setelem(struct sk_buff *skb,
3432 const struct nft_set *set,
3433 const struct nft_set_elem *elem)
3434{
fe2811eb 3435 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3436 unsigned char *b = skb_tail_pointer(skb);
3437 struct nlattr *nest;
3438
3439 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3440 if (nest == NULL)
3441 goto nla_put_failure;
3442
fe2811eb
PM		 3443 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3444 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3445 goto nla_put_failure;
3446
fe2811eb
PM		 3447 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3448 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3449 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3450 set->dlen) < 0)
3451 goto nla_put_failure;
3452
f25ad2e9
PM		 3453 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3454 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3455 goto nla_put_failure;
3456
8aeff920
PNA		 3457 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3458 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3459 (*nft_set_ext_obj(ext))->name) < 0)
3460 goto nla_put_failure;
3461
fe2811eb
PM		 3462 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3463 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3464 htonl(*nft_set_ext_flags(ext))))
3465 goto nla_put_failure;
20a69341 3466
c3e1b005
PM		 3467 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3468 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
d3e2a111
AP		 3469 cpu_to_be64(jiffies_to_msecs(
3470 *nft_set_ext_timeout(ext))),
b46f6ded 3471 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3472 goto nla_put_failure;
3473
3474 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3475 unsigned long expires, now = jiffies;
3476
3477 expires = *nft_set_ext_expiration(ext);
3478 if (time_before(now, expires))
3479 expires -= now;
3480 else
3481 expires = 0;
3482
3483 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
b46f6ded
ND		 3484 cpu_to_be64(jiffies_to_msecs(expires)),
3485 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3486 goto nla_put_failure;
3487 }
3488
68e942e8
PM		 3489 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3490 struct nft_userdata *udata;
3491
3492 udata = nft_set_ext_userdata(ext);
3493 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3494 udata->len + 1, udata->data))
3495 goto nla_put_failure;
3496 }
3497
20a69341
PM		 3498 nla_nest_end(skb, nest);
3499 return 0;
3500
3501nla_put_failure:
3502 nlmsg_trim(skb, b);
3503 return -EMSGSIZE;
3504}
3505
3506struct nft_set_dump_args {
3507 const struct netlink_callback *cb;
3508 struct nft_set_iter iter;
3509 struct sk_buff *skb;
3510};
3511
3512static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3513 struct nft_set *set,
20a69341 3514 const struct nft_set_iter *iter,
de70185d 3515 struct nft_set_elem *elem)
20a69341
PM		 3516{
3517 struct nft_set_dump_args *args;
3518
3519 args = container_of(iter, struct nft_set_dump_args, iter);
3520 return nf_tables_fill_setelem(args->skb, set, elem);
3521}
3522
fa803605
LZ		 3523struct nft_set_dump_ctx {
3524 const struct nft_set *set;
3525 struct nft_ctx ctx;
3526};
3527
20a69341
PM		 3528static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3529{
fa803605 3530 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3531 struct net *net = sock_net(skb->sk);
fa803605
LZ		 3532 struct nft_af_info *afi;
3533 struct nft_table *table;
de70185d 3534 struct nft_set *set;
20a69341 3535 struct nft_set_dump_args args;
fa803605 3536 bool set_found = false;
20a69341
PM		 3537 struct nfgenmsg *nfmsg;
3538 struct nlmsghdr *nlh;
3539 struct nlattr *nest;
3540 u32 portid, seq;
fa803605 3541 int event;
20a69341 3542
fa803605
LZ		 3543 rcu_read_lock();
3544 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
3545 if (afi != dump_ctx->ctx.afi)
3546 continue;
20a69341 3547
fa803605
LZ		 3548 list_for_each_entry_rcu(table, &afi->tables, list) {
3549 if (table != dump_ctx->ctx.table)
3550 continue;
20a69341 3551
fa803605
LZ		 3552 list_for_each_entry_rcu(set, &table->sets, list) {
3553 if (set == dump_ctx->set) {
3554 set_found = true;
3555 break;
3556 }
3557 }
3558 break;
3559 }
3560 break;
3561 }
3562
3563 if (!set_found) {
3564 rcu_read_unlock();
3565 return -ENOENT;
3566 }
20a69341 3567
dedb67c4 3568 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3569 portid = NETLINK_CB(cb->skb).portid;
3570 seq = cb->nlh->nlmsg_seq;
3571
3572 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3573 NLM_F_MULTI);
3574 if (nlh == NULL)
3575 goto nla_put_failure;
3576
3577 nfmsg = nlmsg_data(nlh);
fa803605 3578 nfmsg->nfgen_family = afi->family;
20a69341 3579 nfmsg->version = NFNETLINK_V0;
fa803605 3580 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3581
fa803605 3582 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3583 goto nla_put_failure;
3584 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3585 goto nla_put_failure;
3586
3587 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3588 if (nest == NULL)
3589 goto nla_put_failure;
3590
8588ac09
PNA		 3591 args.cb = cb;
3592 args.skb = skb;
fa803605 3593 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3594 args.iter.skip = cb->args[0];
3595 args.iter.count = 0;
3596 args.iter.err = 0;
3597 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3598 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3599 rcu_read_unlock();
20a69341
PM		 3600
3601 nla_nest_end(skb, nest);
3602 nlmsg_end(skb, nlh);
3603
3604 if (args.iter.err && args.iter.err != -EMSGSIZE)
3605 return args.iter.err;
3606 if (args.iter.count == cb->args[0])
3607 return 0;
3608
3609 cb->args[0] = args.iter.count;
3610 return skb->len;
3611
3612nla_put_failure:
fa803605 3613 rcu_read_unlock();
20a69341
PM		 3614 return -ENOSPC;
3615}
3616
fa803605
LZ		 3617static int nf_tables_dump_set_done(struct netlink_callback *cb)
3618{
3619 kfree(cb->data);
3620 return 0;
3621}
3622
d60ce62f
AB		 3623static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3624 const struct nft_ctx *ctx, u32 seq,
3625 u32 portid, int event, u16 flags,
3626 const struct nft_set *set,
3627 const struct nft_set_elem *elem)
3628{
3629 struct nfgenmsg *nfmsg;
3630 struct nlmsghdr *nlh;
3631 struct nlattr *nest;
3632 int err;
3633
dedb67c4 3634 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 3635 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3636 flags);
3637 if (nlh == NULL)
3638 goto nla_put_failure;
3639
3640 nfmsg = nlmsg_data(nlh);
3641 nfmsg->nfgen_family = ctx->afi->family;
3642 nfmsg->version = NFNETLINK_V0;
84d7fce6 3643 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 3644
3645 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3646 goto nla_put_failure;
3647 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3648 goto nla_put_failure;
3649
3650 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3651 if (nest == NULL)
3652 goto nla_put_failure;
3653
3654 err = nf_tables_fill_setelem(skb, set, elem);
3655 if (err < 0)
3656 goto nla_put_failure;
3657
3658 nla_nest_end(skb, nest);
3659
053c095a
JB		 3660 nlmsg_end(skb, nlh);
3661 return 0;
d60ce62f
AB		 3662
3663nla_put_failure:
3664 nlmsg_trim(skb, nlh);
3665 return -1;
3666}
3667
ba0e4d99
PNA		 3668static int nft_setelem_parse_flags(const struct nft_set *set,
3669 const struct nlattr *attr, u32 *flags)
3670{
3671 if (attr == NULL)
3672 return 0;
3673
3674 *flags = ntohl(nla_get_be32(attr));
3675 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3676 return -EINVAL;
3677 if (!(set->flags & NFT_SET_INTERVAL) &&
3678 *flags & NFT_SET_ELEM_INTERVAL_END)
3679 return -EINVAL;
3680
3681 return 0;
3682}
3683
3684static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3685 const struct nlattr *attr)
3686{
3687 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3688 const struct nft_set_ext *ext;
3689 struct nft_data_desc desc;
3690 struct nft_set_elem elem;
3691 struct sk_buff *skb;
3692 uint32_t flags = 0;
3693 void *priv;
3694 int err;
3695
3696 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3697 nft_set_elem_policy, NULL);
3698 if (err < 0)
3699 return err;
3700
3701 if (!nla[NFTA_SET_ELEM_KEY])
3702 return -EINVAL;
3703
3704 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3705 if (err < 0)
3706 return err;
3707
3708 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3709 nla[NFTA_SET_ELEM_KEY]);
3710 if (err < 0)
3711 return err;
3712
3713 err = -EINVAL;
3714 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3715 return err;
3716
3717 priv = set->ops->get(ctx->net, set, &elem, flags);
3718 if (IS_ERR(priv))
3719 return PTR_ERR(priv);
3720
3721 elem.priv = priv;
3722 ext = nft_set_elem_ext(set, &elem);
3723
3724 err = -ENOMEM;
3725 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3726 if (skb == NULL)
3727 goto err1;
3728
3729 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3730 NFT_MSG_NEWSETELEM, 0, set, &elem);
3731 if (err < 0)
3732 goto err2;
3733
3734 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3735 /* This avoids a loop in nfnetlink. */
3736 if (err < 0)
3737 goto err1;
3738
3739 return 0;
3740err2:
3741 kfree_skb(skb);
3742err1:
3743 /* this avoids a loop in nfnetlink. */
3744 return err == -EAGAIN ? -ENOBUFS : err;
3745}
3746
3747static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3748 struct sk_buff *skb, const struct nlmsghdr *nlh,
3749 const struct nlattr * const nla[],
3750 struct netlink_ext_ack *extack)
3751{
3752 u8 genmask = nft_genmask_cur(net);
3753 struct nft_set *set;
3754 struct nlattr *attr;
3755 struct nft_ctx ctx;
3756 int rem, err = 0;
3757
3758 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
3759 if (err < 0)
3760 return err;
3761
3762 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
3763 genmask);
3764 if (IS_ERR(set))
3765 return PTR_ERR(set);
3766
3767 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3768 struct netlink_dump_control c = {
3769 .dump = nf_tables_dump_set,
3770 .done = nf_tables_dump_set_done,
3771 };
3772 struct nft_set_dump_ctx *dump_ctx;
3773
3774 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3775 if (!dump_ctx)
3776 return -ENOMEM;
3777
3778 dump_ctx->set = set;
3779 dump_ctx->ctx = ctx;
3780
3781 c.data = dump_ctx;
3782 return netlink_dump_start(nlsk, skb, nlh, &c);
3783 }
3784
3785 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3786 return -EINVAL;
3787
3788 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3789 err = nft_get_set_elem(&ctx, set, attr);
3790 if (err < 0)
3791 break;
3792 }
3793
3794 return err;
3795}
3796
25e94a99
PNA		 3797static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3798 const struct nft_set *set,
3799 const struct nft_set_elem *elem,
3800 int event, u16 flags)
d60ce62f 3801{
128ad332
PNA		 3802 struct net *net = ctx->net;
3803 u32 portid = ctx->portid;
d60ce62f
AB		 3804 struct sk_buff *skb;
3805 int err;
3806
128ad332 3807 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 3808 return;
d60ce62f 3809
d60ce62f
AB		 3810 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3811 if (skb == NULL)
3812 goto err;
3813
3814 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3815 set, elem);
3816 if (err < 0) {
3817 kfree_skb(skb);
3818 goto err;
3819 }
3820
25e94a99
PNA		 3821 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3822 GFP_KERNEL);
3823 return;
d60ce62f 3824err:
25e94a99 3825 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 3826}
3827
60319eb1
PNA		 3828static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3829 int msg_type,
3830 struct nft_set *set)
3831{
3832 struct nft_trans *trans;
3833
3834 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3835 if (trans == NULL)
3836 return NULL;
3837
3838 nft_trans_elem_set(trans) = set;
3839 return trans;
3840}
3841
22fe54d5
PM		 3842void *nft_set_elem_init(const struct nft_set *set,
3843 const struct nft_set_ext_tmpl *tmpl,
49499c3e 3844 const u32 *key, const u32 *data,
22fe54d5 3845 u64 timeout, gfp_t gfp)
fe2811eb
PM		 3846{
3847 struct nft_set_ext *ext;
3848 void *elem;
3849
3850 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3851 if (elem == NULL)
3852 return NULL;
3853
3854 ext = nft_set_elem_ext(set, elem);
3855 nft_set_ext_init(ext, tmpl);
3856
3857 memcpy(nft_set_ext_key(ext), key, set->klen);
3858 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3859 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 3860 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3861 *nft_set_ext_expiration(ext) =
d3e2a111 3862 jiffies + timeout;
c3e1b005
PM		 3863 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3864 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 3865
3866 return elem;
3867}
3868
61f9e292
LZ		 3869void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3870 bool destroy_expr)
61edafbb
PM		 3871{
3872 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3873
59105446 3874 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 3875 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 3876 nft_data_release(nft_set_ext_data(ext), set->dtype);
61f9e292 3877 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
f25ad2e9 3878 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
8aeff920
PNA		 3879 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3880 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 3881 kfree(elem);
3882}
3883EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3884
59105446
PNA		 3885/* Only called from commit path, nft_set_elem_deactivate() already deals with
3886 * the refcounting from the preparation phase.
3887 */
3888static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3889{
3890 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3891
3892 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3893 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3894 kfree(elem);
3895}
3896
60319eb1 3897static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 3898 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 3899{
3900 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 3901 u8 genmask = nft_genmask_next(ctx->net);
20a69341 3902 struct nft_data_desc d1, d2;
fe2811eb 3903 struct nft_set_ext_tmpl tmpl;
c016c7e4 3904 struct nft_set_ext *ext, *ext2;
20a69341
PM		 3905 struct nft_set_elem elem;
3906 struct nft_set_binding *binding;
8aeff920 3907 struct nft_object *obj = NULL;
68e942e8 3908 struct nft_userdata *udata;
fe2811eb 3909 struct nft_data data;
20a69341 3910 enum nft_registers dreg;
60319eb1 3911 struct nft_trans *trans;
0e9091d6 3912 u32 flags = 0;
c3e1b005 3913 u64 timeout;
68e942e8 3914 u8 ulen;
20a69341
PM		 3915 int err;
3916
3917 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 3918 nft_set_elem_policy, NULL);
20a69341
PM		 3919 if (err < 0)
3920 return err;
3921
3922 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3923 return -EINVAL;
3924
fe2811eb
PM		 3925 nft_set_ext_prepare(&tmpl);
3926
0e9091d6
PNA		 3927 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3928 if (err < 0)
3929 return err;
3930 if (flags != 0)
3931 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 3932
3933 if (set->flags & NFT_SET_MAP) {
3934 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 3935 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 3936 return -EINVAL;
bd7fc645 3937 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 3938 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 3939 return -EINVAL;
20a69341
PM		 3940 } else {
3941 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3942 return -EINVAL;
3943 }
3944
c3e1b005
PM		 3945 timeout = 0;
3946 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3947 if (!(set->flags & NFT_SET_TIMEOUT))
3948 return -EINVAL;
d3e2a111
AP		 3949 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3950 nla[NFTA_SET_ELEM_TIMEOUT])));
c3e1b005
PM		 3951 } else if (set->flags & NFT_SET_TIMEOUT) {
3952 timeout = set->timeout;
3953 }
3954
7d740264 3955 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 3956 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 3957 if (err < 0)
3958 goto err1;
3959 err = -EINVAL;
3960 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3961 goto err2;
3962
7d740264 3963 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 3964 if (timeout > 0) {
3965 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
3966 if (timeout != set->timeout)
3967 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
3968 }
fe2811eb 3969
8aeff920
PNA		 3970 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
3971 if (!(set->flags & NFT_SET_OBJECT)) {
3972 err = -EINVAL;
3973 goto err2;
3974 }
3975 obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
3976 set->objtype, genmask);
3977 if (IS_ERR(obj)) {
3978 err = PTR_ERR(obj);
3979 goto err2;
3980 }
3981 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
3982 }
3983
20a69341 3984 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 3985 err = nft_data_init(ctx, &data, sizeof(data), &d2,
3986 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 3987 if (err < 0)
3988 goto err2;
3989
3990 err = -EINVAL;
3991 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3992 goto err3;
3993
3994 dreg = nft_type_to_reg(set->dtype);
3995 list_for_each_entry(binding, &set->bindings, list) {
3996 struct nft_ctx bind_ctx = {
58c78e10 3997 .net = ctx->net,
20a69341
PM		 3998 .afi = ctx->afi,
3999 .table = ctx->table,
7c95f6d8 4000 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4001 };
4002
11113e19
PM		 4003 if (!(binding->flags & NFT_SET_MAP))
4004 continue;
4005
1ec10212
PM		 4006 err = nft_validate_register_store(&bind_ctx, dreg,
4007 &data,
4008 d2.type, d2.len);
20a69341
PM		 4009 if (err < 0)
4010 goto err3;
4011 }
fe2811eb 4012
7d740264 4013 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4014 }
4015
68e942e8
PM		 4016 /* The full maximum length of userdata can exceed the maximum
4017 * offset value (U8_MAX) for following extensions, therefor it
4018 * must be the last extension added.
4019 */
4020 ulen = 0;
4021 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4022 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4023 if (ulen > 0)
4024 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4025 ulen);
4026 }
4027
fe2811eb 4028 err = -ENOMEM;
7d740264 4029 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 4030 timeout, GFP_KERNEL);
fe2811eb
PM		 4031 if (elem.priv == NULL)
4032 goto err3;
4033
4034 ext = nft_set_elem_ext(set, elem.priv);
4035 if (flags)
4036 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4037 if (ulen > 0) {
4038 udata = nft_set_ext_userdata(ext);
4039 udata->len = ulen - 1;
4040 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4041 }
8aeff920
PNA		 4042 if (obj) {
4043 *nft_set_ext_obj(ext) = obj;
4044 obj->use++;
4045 }
fe2811eb 4046
60319eb1
PNA		 4047 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4048 if (trans == NULL)
fe2811eb 4049 goto err4;
60319eb1 4050
69086658 4051 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4052 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4053 if (err) {
4054 if (err == -EEXIST) {
9744a6fc
PNA		 4055 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4056 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4057 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4058 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
4059 return -EBUSY;
8aeff920
PNA		 4060 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4061 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4062 memcmp(nft_set_ext_data(ext),
4063 nft_set_ext_data(ext2), set->dlen) != 0) ||
4064 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4065 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4066 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4067 err = -EBUSY;
4068 else if (!(nlmsg_flags & NLM_F_EXCL))
4069 err = 0;
4070 }
fe2811eb 4071 goto err5;
c016c7e4 4072 }
20a69341 4073
35d0ac90
PNA		 4074 if (set->size &&
4075 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4076 err = -ENFILE;
4077 goto err6;
4078 }
4079
60319eb1 4080 nft_trans_elem(trans) = elem;
46bbafce 4081 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4082 return 0;
4083
35d0ac90 4084err6:
5cb82a38 4085 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4086err5:
60319eb1 4087 kfree(trans);
fe2811eb
PM		 4088err4:
4089 kfree(elem.priv);
20a69341
PM		 4090err3:
4091 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4092 nft_data_release(&data, d2.type);
20a69341 4093err2:
59105446 4094 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4095err1:
4096 return err;
4097}
4098
633c9a84
PNA		 4099static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4100 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4101 const struct nlattr * const nla[],
4102 struct netlink_ext_ack *extack)
20a69341 4103{
f2a6d766 4104 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4105 const struct nlattr *attr;
4106 struct nft_set *set;
4107 struct nft_ctx ctx;
60319eb1 4108 int rem, err = 0;
20a69341 4109
7d5570ca
PNA		 4110 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4111 return -EINVAL;
4112
f2a6d766 4113 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 4114 if (err < 0)
4115 return err;
4116
37a9cc52
PNA		 4117 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4118 genmask);
958bee14
PNA		 4119 if (IS_ERR(set)) {
4120 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
4121 set = nf_tables_set_lookup_byid(net,
37a9cc52
PNA		 4122 nla[NFTA_SET_ELEM_LIST_SET_ID],
4123 genmask);
958bee14
PNA		 4124 }
4125 if (IS_ERR(set))
4126 return PTR_ERR(set);
4127 }
4128
20a69341
PM		 4129 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4130 return -EBUSY;
4131
4132 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4133 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4134 if (err < 0)
60319eb1 4135 break;
20a69341 4136 }
60319eb1 4137 return err;
20a69341
PM		 4138}
4139
59105446
PNA		 4140/**
4141 * nft_data_hold - hold a nft_data item
4142 *
4143 * @data: struct nft_data to release
4144 * @type: type of data
4145 *
4146 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4147 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4148 * NFT_GOTO verdicts. This function must be called on active data objects
4149 * from the second phase of the commit protocol.
4150 */
4151static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4152{
4153 if (type == NFT_DATA_VERDICT) {
4154 switch (data->verdict.code) {
4155 case NFT_JUMP:
4156 case NFT_GOTO:
4157 data->verdict.chain->use++;
4158 break;
4159 }
4160 }
4161}
4162
4163static void nft_set_elem_activate(const struct net *net,
4164 const struct nft_set *set,
4165 struct nft_set_elem *elem)
4166{
4167 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4168
4169 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4170 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4171 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4172 (*nft_set_ext_obj(ext))->use++;
4173}
4174
4175static void nft_set_elem_deactivate(const struct net *net,
4176 const struct nft_set *set,
4177 struct nft_set_elem *elem)
4178{
4179 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4180
4181 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4182 nft_data_release(nft_set_ext_data(ext), set->dtype);
4183 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4184 (*nft_set_ext_obj(ext))->use--;
4185}
4186
60319eb1 4187static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4188 const struct nlattr *attr)
4189{
4190 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4191 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4192 struct nft_data_desc desc;
4193 struct nft_set_elem elem;
3971ca14 4194 struct nft_set_ext *ext;
60319eb1 4195 struct nft_trans *trans;
3971ca14
PNA		 4196 u32 flags = 0;
4197 void *priv;
20a69341
PM		 4198 int err;
4199
4200 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4201 nft_set_elem_policy, NULL);
20a69341
PM		 4202 if (err < 0)
4203 goto err1;
4204
4205 err = -EINVAL;
4206 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4207 goto err1;
4208
3971ca14
PNA		 4209 nft_set_ext_prepare(&tmpl);
4210
4211 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4212 if (err < 0)
4213 return err;
4214 if (flags != 0)
4215 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4216
7d740264 4217 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4218 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4219 if (err < 0)
4220 goto err1;
4221
4222 err = -EINVAL;
4223 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4224 goto err2;
4225
3971ca14
PNA		 4226 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4227
4228 err = -ENOMEM;
4229 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4230 GFP_KERNEL);
4231 if (elem.priv == NULL)
4232 goto err2;
4233
4234 ext = nft_set_elem_ext(set, elem.priv);
4235 if (flags)
4236 *nft_set_ext_flags(ext) = flags;
4237
60319eb1 4238 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4239 if (trans == NULL) {
4240 err = -ENOMEM;
3971ca14 4241 goto err3;
609ccf08 4242 }
20a69341 4243
42a55769 4244 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4245 if (priv == NULL) {
cc02e457 4246 err = -ENOENT;
3971ca14 4247 goto err4;
cc02e457 4248 }
3971ca14
PNA		 4249 kfree(elem.priv);
4250 elem.priv = priv;
cc02e457 4251
59105446
PNA		 4252 nft_set_elem_deactivate(ctx->net, set, &elem);
4253
60319eb1 4254 nft_trans_elem(trans) = elem;
46bbafce 4255 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4256 return 0;
cc02e457 4257
3971ca14 4258err4:
cc02e457 4259 kfree(trans);
3971ca14
PNA		 4260err3:
4261 kfree(elem.priv);
20a69341 4262err2:
59105446 4263 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4264err1:
4265 return err;
4266}
4267
8411b644 4268static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4269 struct nft_set *set,
8411b644 4270 const struct nft_set_iter *iter,
de70185d 4271 struct nft_set_elem *elem)
8411b644
PNA		 4272{
4273 struct nft_trans *trans;
4274 int err;
4275
4276 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4277 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4278 if (!trans)
4279 return -ENOMEM;
4280
1ba1c414 4281 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4282 err = -ENOENT;
4283 goto err1;
4284 }
b2c11e4b 4285 set->ndeact++;
8411b644 4286
de70185d
PNA		 4287 nft_trans_elem_set(trans) = set;
4288 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4289 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4290
4291 return 0;
4292err1:
4293 kfree(trans);
4294 return err;
4295}
4296
633c9a84
PNA		 4297static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4298 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4299 const struct nlattr * const nla[],
4300 struct netlink_ext_ack *extack)
20a69341 4301{
f2a6d766 4302 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4303 const struct nlattr *attr;
4304 struct nft_set *set;
4305 struct nft_ctx ctx;
60319eb1 4306 int rem, err = 0;
20a69341 4307
f2a6d766 4308 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 4309 if (err < 0)
4310 return err;
4311
37a9cc52
PNA		 4312 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4313 genmask);
20a69341
PM		 4314 if (IS_ERR(set))
4315 return PTR_ERR(set);
4316 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4317 return -EBUSY;
4318
8411b644 4319 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4320 struct nft_set_iter iter = {
4321 .genmask = genmask,
4322 .fn = nft_flush_set,
8411b644 4323 };
baa2d42c 4324 set->ops->walk(&ctx, set, &iter);
8411b644 4325
baa2d42c 4326 return iter.err;
8411b644
PNA		 4327 }
4328
20a69341
PM		 4329 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4330 err = nft_del_setelem(&ctx, set, attr);
4331 if (err < 0)
60319eb1 4332 break;
4fefee57 4333
3dd0673a 4334 set->ndeact++;
20a69341 4335 }
60319eb1 4336 return err;
20a69341
PM		 4337}
4338
cfed7e1b
PM		 4339void nft_set_gc_batch_release(struct rcu_head *rcu)
4340{
4341 struct nft_set_gc_batch *gcb;
4342 unsigned int i;
4343
4344 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4345 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4346 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4347 kfree(gcb);
4348}
4349EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4350
4351struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4352 gfp_t gfp)
4353{
4354 struct nft_set_gc_batch *gcb;
4355
4356 gcb = kzalloc(sizeof(*gcb), gfp);
4357 if (gcb == NULL)
4358 return gcb;
4359 gcb->head.set = set;
4360 return gcb;
4361}
4362EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4363
e5009240
PNA		 4364/*
4365 * Stateful objects
4366 */
4367
4368/**
4369 * nft_register_obj- register nf_tables stateful object type
4370 * @obj: object type
4371 *
4372 * Registers the object type for use with nf_tables. Returns zero on
4373 * success or a negative errno code otherwise.
4374 */
4375int nft_register_obj(struct nft_object_type *obj_type)
4376{
4377 if (obj_type->type == NFT_OBJECT_UNSPEC)
4378 return -EINVAL;
4379
4380 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4381 list_add_rcu(&obj_type->list, &nf_tables_objects);
4382 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4383 return 0;
4384}
4385EXPORT_SYMBOL_GPL(nft_register_obj);
4386
4387/**
4388 * nft_unregister_obj - unregister nf_tables object type
4389 * @obj: object type
4390 *
4391 * Unregisters the object type for use with nf_tables.
4392 */
4393void nft_unregister_obj(struct nft_object_type *obj_type)
4394{
4395 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4396 list_del_rcu(&obj_type->list);
4397 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4398}
4399EXPORT_SYMBOL_GPL(nft_unregister_obj);
4400
4401struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
4402 const struct nlattr *nla,
4403 u32 objtype, u8 genmask)
4404{
4405 struct nft_object *obj;
4406
4407 list_for_each_entry(obj, &table->objects, list) {
4408 if (!nla_strcmp(nla, obj->name) &&
dfc46034 4409 objtype == obj->ops->type->type &&
e5009240
PNA		 4410 nft_active_genmask(obj, genmask))
4411 return obj;
4412 }
4413 return ERR_PTR(-ENOENT);
4414}
4415EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
4416
4417static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4418 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4419 .len = NFT_TABLE_MAXNAMELEN - 1 },
4420 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4421 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4422 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4423 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4424};
4425
84fba055
FW		 4426static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4427 const struct nft_object_type *type,
e5009240
PNA		 4428 const struct nlattr *attr)
4429{
4430 struct nlattr *tb[type->maxattr + 1];
dfc46034 4431 const struct nft_object_ops *ops;
e5009240
PNA		 4432 struct nft_object *obj;
4433 int err;
4434
4435 if (attr) {
fceb6435
JB		 4436 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4437 NULL);
e5009240
PNA		 4438 if (err < 0)
4439 goto err1;
4440 } else {
4441 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4442 }
4443
dfc46034
PBG		 4444 if (type->select_ops) {
4445 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4446 if (IS_ERR(ops)) {
4447 err = PTR_ERR(ops);
4448 goto err1;
4449 }
4450 } else {
4451 ops = type->ops;
4452 }
4453
e5009240 4454 err = -ENOMEM;
dfc46034 4455 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
e5009240
PNA		 4456 if (obj == NULL)
4457 goto err1;
4458
dfc46034 4459 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240
PNA		 4460 if (err < 0)
4461 goto err2;
4462
dfc46034
PBG		 4463 obj->ops = ops;
4464
e5009240
PNA		 4465 return obj;
4466err2:
4467 kfree(obj);
4468err1:
4469 return ERR_PTR(err);
4470}
4471
4472static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4473 struct nft_object *obj, bool reset)
e5009240
PNA		 4474{
4475 struct nlattr *nest;
4476
4477 nest = nla_nest_start(skb, attr);
4478 if (!nest)
4479 goto nla_put_failure;
dfc46034 4480 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 4481 goto nla_put_failure;
4482 nla_nest_end(skb, nest);
4483 return 0;
4484
4485nla_put_failure:
4486 return -1;
4487}
4488
4489static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4490{
4491 const struct nft_object_type *type;
4492
4493 list_for_each_entry(type, &nf_tables_objects, list) {
4494 if (objtype == type->type)
4495 return type;
4496 }
4497 return NULL;
4498}
4499
4500static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4501{
4502 const struct nft_object_type *type;
4503
4504 type = __nft_obj_type_get(objtype);
4505 if (type != NULL && try_module_get(type->owner))
4506 return type;
4507
4508#ifdef CONFIG_MODULES
4509 if (type == NULL) {
4510 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4511 request_module("nft-obj-%u", objtype);
4512 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4513 if (__nft_obj_type_get(objtype))
4514 return ERR_PTR(-EAGAIN);
4515 }
4516#endif
4517 return ERR_PTR(-ENOENT);
4518}
4519
4520static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4521 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4522 const struct nlattr * const nla[],
4523 struct netlink_ext_ack *extack)
e5009240
PNA		 4524{
4525 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4526 const struct nft_object_type *type;
4527 u8 genmask = nft_genmask_next(net);
4528 int family = nfmsg->nfgen_family;
4529 struct nft_af_info *afi;
4530 struct nft_table *table;
4531 struct nft_object *obj;
4532 struct nft_ctx ctx;
4533 u32 objtype;
4534 int err;
4535
4536 if (!nla[NFTA_OBJ_TYPE] ||
4537 !nla[NFTA_OBJ_NAME] ||
4538 !nla[NFTA_OBJ_DATA])
4539 return -EINVAL;
4540
4541 afi = nf_tables_afinfo_lookup(net, family, true);
4542 if (IS_ERR(afi))
4543 return PTR_ERR(afi);
4544
4545 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4546 if (IS_ERR(table))
4547 return PTR_ERR(table);
4548
4549 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4550 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4551 if (IS_ERR(obj)) {
4552 err = PTR_ERR(obj);
4553 if (err != -ENOENT)
4554 return err;
4555
1a28ad74 4556 } else {
e5009240
PNA		 4557 if (nlh->nlmsg_flags & NLM_F_EXCL)
4558 return -EEXIST;
4559
4560 return 0;
4561 }
4562
4563 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4564
4565 type = nft_obj_type_get(objtype);
4566 if (IS_ERR(type))
4567 return PTR_ERR(type);
4568
84fba055 4569 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 4570 if (IS_ERR(obj)) {
4571 err = PTR_ERR(obj);
4572 goto err1;
4573 }
18965317 4574 obj->table = table;
61509575
PS		 4575 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4576 if (!obj->name) {
4577 err = -ENOMEM;
4578 goto err2;
4579 }
e5009240
PNA		 4580
4581 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4582 if (err < 0)
61509575 4583 goto err3;
e5009240
PNA		 4584
4585 list_add_tail_rcu(&obj->list, &table->objects);
4586 table->use++;
4587 return 0;
61509575
PS		 4588err3:
4589 kfree(obj->name);
e5009240 4590err2:
dfc46034
PBG		 4591 if (obj->ops->destroy)
4592 obj->ops->destroy(obj);
e5009240
PNA		 4593 kfree(obj);
4594err1:
4595 module_put(type->owner);
4596 return err;
4597}
4598
4599static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4600 u32 portid, u32 seq, int event, u32 flags,
4601 int family, const struct nft_table *table,
43da04a5 4602 struct nft_object *obj, bool reset)
e5009240
PNA		 4603{
4604 struct nfgenmsg *nfmsg;
4605 struct nlmsghdr *nlh;
4606
dedb67c4 4607 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 4608 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4609 if (nlh == NULL)
4610 goto nla_put_failure;
4611
4612 nfmsg = nlmsg_data(nlh);
4613 nfmsg->nfgen_family = family;
4614 nfmsg->version = NFNETLINK_V0;
4615 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4616
4617 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4618 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
dfc46034 4619 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 4620 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
43da04a5 4621 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset))
e5009240
PNA		 4622 goto nla_put_failure;
4623
4624 nlmsg_end(skb, nlh);
4625 return 0;
4626
4627nla_put_failure:
4628 nlmsg_trim(skb, nlh);
4629 return -1;
4630}
4631
a9fea2a3 4632struct nft_obj_filter {
e46abbcc 4633 char *table;
a9fea2a3
PNA		 4634 u32 type;
4635};
4636
e5009240
PNA		 4637static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4638{
4639 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
4640 const struct nft_af_info *afi;
4641 const struct nft_table *table;
e5009240 4642 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 4643 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 4644 struct net *net = sock_net(skb->sk);
4645 int family = nfmsg->nfgen_family;
43da04a5
PNA		 4646 struct nft_object *obj;
4647 bool reset = false;
4648
4649 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4650 reset = true;
e5009240
PNA		 4651
4652 rcu_read_lock();
4653 cb->seq = net->nft.base_seq;
4654
4655 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
4656 if (family != NFPROTO_UNSPEC && family != afi->family)
4657 continue;
4658
4659 list_for_each_entry_rcu(table, &afi->tables, list) {
4660 list_for_each_entry_rcu(obj, &table->objects, list) {
4661 if (!nft_is_active(net, obj))
4662 goto cont;
4663 if (idx < s_idx)
4664 goto cont;
4665 if (idx > s_idx)
4666 memset(&cb->args[1], 0,
4667 sizeof(cb->args) - sizeof(cb->args[0]));
d21e540b 4668 if (filter && filter->table[0] &&
a9fea2a3
PNA		 4669 strcmp(filter->table, table->name))
4670 goto cont;
d21e540b
LZ		 4671 if (filter &&
4672 filter->type != NFT_OBJECT_UNSPEC &&
dfc46034 4673 obj->ops->type->type != filter->type)
a9fea2a3
PNA		 4674 goto cont;
4675
e5009240
PNA		 4676 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4677 cb->nlh->nlmsg_seq,
4678 NFT_MSG_NEWOBJ,
4679 NLM_F_MULTI | NLM_F_APPEND,
43da04a5 4680 afi->family, table, obj, reset) < 0)
e5009240
PNA		 4681 goto done;
4682
4683 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4684cont:
4685 idx++;
4686 }
4687 }
4688 }
4689done:
4690 rcu_read_unlock();
4691
4692 cb->args[0] = idx;
4693 return skb->len;
4694}
4695
a9fea2a3
PNA		 4696static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4697{
e46abbcc
PS		 4698 struct nft_obj_filter *filter = cb->data;
4699
8bea728d
HL		 4700 if (filter) {
4701 kfree(filter->table);
4702 kfree(filter);
4703 }
a9fea2a3
PNA		 4704
4705 return 0;
4706}
4707
4708static struct nft_obj_filter *
4709nft_obj_filter_alloc(const struct nlattr * const nla[])
4710{
4711 struct nft_obj_filter *filter;
4712
4713 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4714 if (!filter)
4715 return ERR_PTR(-ENOMEM);
4716
e46abbcc
PS		 4717 if (nla[NFTA_OBJ_TABLE]) {
4718 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL);
4719 if (!filter->table) {
4720 kfree(filter);
4721 return ERR_PTR(-ENOMEM);
4722 }
4723 }
a9fea2a3
PNA		 4724 if (nla[NFTA_OBJ_TYPE])
4725 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4726
4727 return filter;
4728}
4729
e5009240
PNA		 4730static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4731 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4732 const struct nlattr * const nla[],
4733 struct netlink_ext_ack *extack)
e5009240
PNA		 4734{
4735 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4736 u8 genmask = nft_genmask_cur(net);
4737 int family = nfmsg->nfgen_family;
4738 const struct nft_af_info *afi;
4739 const struct nft_table *table;
4740 struct nft_object *obj;
4741 struct sk_buff *skb2;
43da04a5 4742 bool reset = false;
e5009240
PNA		 4743 u32 objtype;
4744 int err;
4745
4746 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4747 struct netlink_dump_control c = {
4748 .dump = nf_tables_dump_obj,
a9fea2a3 4749 .done = nf_tables_dump_obj_done,
e5009240 4750 };
a9fea2a3
PNA		 4751
4752 if (nla[NFTA_OBJ_TABLE] ||
4753 nla[NFTA_OBJ_TYPE]) {
4754 struct nft_obj_filter *filter;
4755
4756 filter = nft_obj_filter_alloc(nla);
4757 if (IS_ERR(filter))
4758 return -ENOMEM;
4759
4760 c.data = filter;
4761 }
e5009240
PNA		 4762 return netlink_dump_start(nlsk, skb, nlh, &c);
4763 }
4764
4765 if (!nla[NFTA_OBJ_NAME] ||
4766 !nla[NFTA_OBJ_TYPE])
4767 return -EINVAL;
4768
4769 afi = nf_tables_afinfo_lookup(net, family, false);
4770 if (IS_ERR(afi))
4771 return PTR_ERR(afi);
4772
4773 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4774 if (IS_ERR(table))
4775 return PTR_ERR(table);
4776
4777 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4778 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4779 if (IS_ERR(obj))
4780 return PTR_ERR(obj);
4781
4782 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4783 if (!skb2)
4784 return -ENOMEM;
4785
43da04a5
PNA		 4786 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4787 reset = true;
4788
e5009240
PNA		 4789 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4790 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 4791 family, table, obj, reset);
e5009240
PNA		 4792 if (err < 0)
4793 goto err;
4794
4795 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4796err:
4797 kfree_skb(skb2);
4798 return err;
e5009240
PNA		 4799}
4800
4801static void nft_obj_destroy(struct nft_object *obj)
4802{
dfc46034
PBG		 4803 if (obj->ops->destroy)
4804 obj->ops->destroy(obj);
e5009240 4805
dfc46034 4806 module_put(obj->ops->type->owner);
61509575 4807 kfree(obj->name);
e5009240
PNA		 4808 kfree(obj);
4809}
4810
4811static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 4812 struct sk_buff *skb, const struct nlmsghdr *nlh,
4813 const struct nlattr * const nla[],
4814 struct netlink_ext_ack *extack)
e5009240
PNA		 4815{
4816 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4817 u8 genmask = nft_genmask_next(net);
4818 int family = nfmsg->nfgen_family;
4819 struct nft_af_info *afi;
4820 struct nft_table *table;
4821 struct nft_object *obj;
4822 struct nft_ctx ctx;
4823 u32 objtype;
4824
4825 if (!nla[NFTA_OBJ_TYPE] ||
4826 !nla[NFTA_OBJ_NAME])
4827 return -EINVAL;
4828
4829 afi = nf_tables_afinfo_lookup(net, family, true);
4830 if (IS_ERR(afi))
4831 return PTR_ERR(afi);
4832
4833 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4834 if (IS_ERR(table))
4835 return PTR_ERR(table);
4836
4837 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4838 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4839 if (IS_ERR(obj))
4840 return PTR_ERR(obj);
4841 if (obj->use > 0)
4842 return -EBUSY;
4843
4844 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4845
4846 return nft_delobj(&ctx, obj);
4847}
4848
25e94a99
PNA		 4849void nft_obj_notify(struct net *net, struct nft_table *table,
4850 struct nft_object *obj, u32 portid, u32 seq, int event,
4851 int family, int report, gfp_t gfp)
e5009240
PNA		 4852{
4853 struct sk_buff *skb;
4854 int err;
4855
2599e989
PNA		 4856 if (!report &&
4857 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4858 return;
e5009240 4859
2599e989 4860 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 4861 if (skb == NULL)
4862 goto err;
4863
2599e989
PNA		 4864 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4865 table, obj, false);
e5009240
PNA		 4866 if (err < 0) {
4867 kfree_skb(skb);
4868 goto err;
4869 }
4870
25e94a99
PNA		 4871 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4872 return;
e5009240 4873err:
25e94a99 4874 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 4875}
2599e989
PNA		 4876EXPORT_SYMBOL_GPL(nft_obj_notify);
4877
25e94a99
PNA		 4878static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4879 struct nft_object *obj, int event)
2599e989 4880{
25e94a99
PNA		 4881 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
4882 ctx->afi->family, ctx->report, GFP_KERNEL);
2599e989 4883}
e5009240 4884
3b49e2e9
PNA		 4885/*
4886 * Flow tables
4887 */
4888void nft_register_flowtable_type(struct nf_flowtable_type *type)
4889{
4890 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4891 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
4892 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4893}
4894EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
4895
4896void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
4897{
4898 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4899 list_del_rcu(&type->list);
4900 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4901}
4902EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
4903
4904static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
4905 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
4906 .len = NFT_NAME_MAXLEN - 1 },
4907 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
4908 .len = NFT_NAME_MAXLEN - 1 },
4909 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
4910};
4911
4912struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
4913 const struct nlattr *nla,
4914 u8 genmask)
4915{
4916 struct nft_flowtable *flowtable;
4917
4918 list_for_each_entry(flowtable, &table->flowtables, list) {
4919 if (!nla_strcmp(nla, flowtable->name) &&
4920 nft_active_genmask(flowtable, genmask))
4921 return flowtable;
4922 }
4923 return ERR_PTR(-ENOENT);
4924}
4925EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
4926
4927#define NFT_FLOWTABLE_DEVICE_MAX 8
4928
4929static int nf_tables_parse_devices(const struct nft_ctx *ctx,
4930 const struct nlattr *attr,
4931 struct net_device *dev_array[], int *len)
4932{
4933 const struct nlattr *tmp;
4934 struct net_device *dev;
4935 char ifname[IFNAMSIZ];
4936 int rem, n = 0, err;
4937
4938 nla_for_each_nested(tmp, attr, rem) {
4939 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
4940 err = -EINVAL;
4941 goto err1;
4942 }
4943
4944 nla_strlcpy(ifname, tmp, IFNAMSIZ);
4945 dev = dev_get_by_name(ctx->net, ifname);
4946 if (!dev) {
4947 err = -ENOENT;
4948 goto err1;
4949 }
4950
4951 dev_array[n++] = dev;
4952 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
4953 err = -EFBIG;
4954 goto err1;
4955 }
4956 }
4957 if (!len)
4958 return -EINVAL;
4959
4960 err = 0;
4961err1:
4962 *len = n;
4963 return err;
4964}
4965
4966static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
4967 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
4968 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
4969 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
4970};
4971
4972static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
4973 const struct nlattr *attr,
4974 struct nft_flowtable *flowtable)
4975{
4976 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
4977 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
4978 struct nf_hook_ops *ops;
4979 int hooknum, priority;
4980 int err, n = 0, i;
4981
4982 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
4983 nft_flowtable_hook_policy, NULL);
4984 if (err < 0)
4985 return err;
4986
4987 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
4988 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
4989 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
4990 return -EINVAL;
4991
4992 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 4993 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 4994 return -EINVAL;
4995
4996 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
4997
4998 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
4999 dev_array, &n);
5000 if (err < 0)
5001 goto err1;
5002
5003 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
5004 if (!ops) {
5005 err = -ENOMEM;
5006 goto err1;
5007 }
5008
5009 flowtable->ops = ops;
5010 flowtable->ops_len = n;
5011
5012 for (i = 0; i < n; i++) {
5013 flowtable->ops[i].pf = NFPROTO_NETDEV;
5014 flowtable->ops[i].hooknum = hooknum;
5015 flowtable->ops[i].priority = priority;
5016 flowtable->ops[i].priv = &flowtable->data.rhashtable;
5017 flowtable->ops[i].hook = flowtable->data.type->hook;
5018 flowtable->ops[i].dev = dev_array[i];
5019 }
5020
5021 err = 0;
5022err1:
5023 for (i = 0; i < n; i++)
5024 dev_put(dev_array[i]);
5025
5026 return err;
5027}
5028
5029static const struct nf_flowtable_type *
5030__nft_flowtable_type_get(const struct nft_af_info *afi)
5031{
5032 const struct nf_flowtable_type *type;
5033
5034 list_for_each_entry(type, &nf_tables_flowtables, list) {
5035 if (afi->family == type->family)
5036 return type;
5037 }
5038 return NULL;
5039}
5040
5041static const struct nf_flowtable_type *
5042nft_flowtable_type_get(const struct nft_af_info *afi)
5043{
5044 const struct nf_flowtable_type *type;
5045
5046 type = __nft_flowtable_type_get(afi);
5047 if (type != NULL && try_module_get(type->owner))
5048 return type;
5049
5050#ifdef CONFIG_MODULES
5051 if (type == NULL) {
5052 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5053 request_module("nf-flowtable-%u", afi->family);
5054 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5055 if (__nft_flowtable_type_get(afi))
5056 return ERR_PTR(-EAGAIN);
5057 }
5058#endif
5059 return ERR_PTR(-ENOENT);
5060}
5061
5062void nft_flow_table_iterate(struct net *net,
5063 void (*iter)(struct nf_flowtable *flowtable, void *data),
5064 void *data)
5065{
5066 struct nft_flowtable *flowtable;
5067 const struct nft_af_info *afi;
5068 const struct nft_table *table;
5069
5070 rcu_read_lock();
5071 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
5072 list_for_each_entry_rcu(table, &afi->tables, list) {
5073 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5074 iter(&flowtable->data, data);
5075 }
5076 }
5077 }
5078 rcu_read_unlock();
5079}
5080EXPORT_SYMBOL_GPL(nft_flow_table_iterate);
5081
5082static void nft_unregister_flowtable_net_hooks(struct net *net,
5083 struct nft_flowtable *flowtable)
5084{
5085 int i;
5086
5087 for (i = 0; i < flowtable->ops_len; i++) {
5088 if (!flowtable->ops[i].dev)
5089 continue;
5090
5091 nf_unregister_net_hook(net, &flowtable->ops[i]);
5092 }
5093}
5094
5095static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5096 struct sk_buff *skb,
5097 const struct nlmsghdr *nlh,
5098 const struct nlattr * const nla[],
5099 struct netlink_ext_ack *extack)
5100{
5101 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5102 const struct nf_flowtable_type *type;
5103 u8 genmask = nft_genmask_next(net);
5104 int family = nfmsg->nfgen_family;
5105 struct nft_flowtable *flowtable;
5106 struct nft_af_info *afi;
5107 struct nft_table *table;
5108 struct nft_ctx ctx;
5109 int err, i, k;
5110
5111 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5112 !nla[NFTA_FLOWTABLE_NAME] ||
5113 !nla[NFTA_FLOWTABLE_HOOK])
5114 return -EINVAL;
5115
5116 afi = nf_tables_afinfo_lookup(net, family, true);
5117 if (IS_ERR(afi))
5118 return PTR_ERR(afi);
5119
5120 table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
5121 if (IS_ERR(table))
5122 return PTR_ERR(table);
5123
5124 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5125 genmask);
5126 if (IS_ERR(flowtable)) {
5127 err = PTR_ERR(flowtable);
5128 if (err != -ENOENT)
5129 return err;
5130 } else {
5131 if (nlh->nlmsg_flags & NLM_F_EXCL)
5132 return -EEXIST;
5133
5134 return 0;
5135 }
5136
5137 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
5138
5139 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5140 if (!flowtable)
5141 return -ENOMEM;
5142
5143 flowtable->table = table;
5144 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5145 if (!flowtable->name) {
5146 err = -ENOMEM;
5147 goto err1;
5148 }
5149
5150 type = nft_flowtable_type_get(afi);
5151 if (IS_ERR(type)) {
5152 err = PTR_ERR(type);
5153 goto err2;
5154 }
5155
5156 flowtable->data.type = type;
5157 err = rhashtable_init(&flowtable->data.rhashtable, type->params);
5158 if (err < 0)
5159 goto err3;
5160
5161 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5162 flowtable);
5163 if (err < 0)
5164 goto err3;
5165
5166 for (i = 0; i < flowtable->ops_len; i++) {
5167 err = nf_register_net_hook(net, &flowtable->ops[i]);
5168 if (err < 0)
5169 goto err4;
5170 }
5171
5172 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5173 if (err < 0)
5174 goto err5;
5175
5176 INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc);
5177 queue_delayed_work(system_power_efficient_wq,
5178 &flowtable->data.gc_work, HZ);
5179
5180 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5181 table->use++;
5182
5183 return 0;
5184err5:
5185 i = flowtable->ops_len;
5186err4:
5187 for (k = i - 1; k >= 0; k--)
5188 nf_unregister_net_hook(net, &flowtable->ops[i]);
5189
5190 kfree(flowtable->ops);
5191err3:
5192 module_put(type->owner);
5193err2:
5194 kfree(flowtable->name);
5195err1:
5196 kfree(flowtable);
5197 return err;
5198}
5199
5200static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5201 struct sk_buff *skb,
5202 const struct nlmsghdr *nlh,
5203 const struct nlattr * const nla[],
5204 struct netlink_ext_ack *extack)
5205{
5206 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5207 u8 genmask = nft_genmask_next(net);
5208 int family = nfmsg->nfgen_family;
5209 struct nft_flowtable *flowtable;
5210 struct nft_af_info *afi;
5211 struct nft_table *table;
5212 struct nft_ctx ctx;
5213
5214 afi = nf_tables_afinfo_lookup(net, family, true);
5215 if (IS_ERR(afi))
5216 return PTR_ERR(afi);
5217
5218 table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
5219 if (IS_ERR(table))
5220 return PTR_ERR(table);
5221
5222 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5223 genmask);
5224 if (IS_ERR(flowtable))
5225 return PTR_ERR(flowtable);
5226 if (flowtable->use > 0)
5227 return -EBUSY;
5228
5229 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
5230
5231 return nft_delflowtable(&ctx, flowtable);
5232}
5233
5234static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5235 u32 portid, u32 seq, int event,
5236 u32 flags, int family,
5237 struct nft_flowtable *flowtable)
5238{
5239 struct nlattr *nest, *nest_devs;
5240 struct nfgenmsg *nfmsg;
5241 struct nlmsghdr *nlh;
5242 int i;
5243
5244 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5245 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5246 if (nlh == NULL)
5247 goto nla_put_failure;
5248
5249 nfmsg = nlmsg_data(nlh);
5250 nfmsg->nfgen_family = family;
5251 nfmsg->version = NFNETLINK_V0;
5252 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5253
5254 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5255 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
5256 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)))
5257 goto nla_put_failure;
5258
5259 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5260 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5261 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5262 goto nla_put_failure;
5263
5264 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5265 if (!nest_devs)
5266 goto nla_put_failure;
5267
5268 for (i = 0; i < flowtable->ops_len; i++) {
5269 if (flowtable->ops[i].dev &&
5270 nla_put_string(skb, NFTA_DEVICE_NAME,
5271 flowtable->ops[i].dev->name))
5272 goto nla_put_failure;
5273 }
5274 nla_nest_end(skb, nest_devs);
5275 nla_nest_end(skb, nest);
5276
5277 nlmsg_end(skb, nlh);
5278 return 0;
5279
5280nla_put_failure:
5281 nlmsg_trim(skb, nlh);
5282 return -1;
5283}
5284
5285struct nft_flowtable_filter {
5286 char *table;
5287};
5288
5289static int nf_tables_dump_flowtable(struct sk_buff *skb,
5290 struct netlink_callback *cb)
5291{
5292 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5293 struct nft_flowtable_filter *filter = cb->data;
5294 unsigned int idx = 0, s_idx = cb->args[0];
5295 struct net *net = sock_net(skb->sk);
5296 int family = nfmsg->nfgen_family;
5297 struct nft_flowtable *flowtable;
5298 const struct nft_af_info *afi;
5299 const struct nft_table *table;
5300
5301 rcu_read_lock();
5302 cb->seq = net->nft.base_seq;
5303
5304 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
5305 if (family != NFPROTO_UNSPEC && family != afi->family)
5306 continue;
5307
5308 list_for_each_entry_rcu(table, &afi->tables, list) {
5309 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5310 if (!nft_is_active(net, flowtable))
5311 goto cont;
5312 if (idx < s_idx)
5313 goto cont;
5314 if (idx > s_idx)
5315 memset(&cb->args[1], 0,
5316 sizeof(cb->args) - sizeof(cb->args[0]));
5317 if (filter && filter->table[0] &&
5318 strcmp(filter->table, table->name))
5319 goto cont;
5320
5321 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5322 cb->nlh->nlmsg_seq,
5323 NFT_MSG_NEWFLOWTABLE,
5324 NLM_F_MULTI | NLM_F_APPEND,
5325 afi->family, flowtable) < 0)
5326 goto done;
5327
5328 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
5329cont:
5330 idx++;
5331 }
5332 }
5333 }
5334done:
5335 rcu_read_unlock();
5336
5337 cb->args[0] = idx;
5338 return skb->len;
5339}
5340
5341static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
5342{
5343 struct nft_flowtable_filter *filter = cb->data;
5344
5345 if (!filter)
5346 return 0;
5347
5348 kfree(filter->table);
5349 kfree(filter);
5350
5351 return 0;
5352}
5353
5354static struct nft_flowtable_filter *
5355nft_flowtable_filter_alloc(const struct nlattr * const nla[])
5356{
5357 struct nft_flowtable_filter *filter;
5358
5359 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
5360 if (!filter)
5361 return ERR_PTR(-ENOMEM);
5362
5363 if (nla[NFTA_FLOWTABLE_TABLE]) {
5364 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5365 GFP_KERNEL);
5366 if (!filter->table) {
5367 kfree(filter);
5368 return ERR_PTR(-ENOMEM);
5369 }
5370 }
5371 return filter;
5372}
5373
5374static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5375 struct sk_buff *skb,
5376 const struct nlmsghdr *nlh,
5377 const struct nlattr * const nla[],
5378 struct netlink_ext_ack *extack)
5379{
5380 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5381 u8 genmask = nft_genmask_cur(net);
5382 int family = nfmsg->nfgen_family;
5383 struct nft_flowtable *flowtable;
5384 const struct nft_af_info *afi;
5385 const struct nft_table *table;
5386 struct sk_buff *skb2;
5387 int err;
5388
5389 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5390 struct netlink_dump_control c = {
5391 .dump = nf_tables_dump_flowtable,
5392 .done = nf_tables_dump_flowtable_done,
5393 };
5394
5395 if (nla[NFTA_FLOWTABLE_TABLE]) {
5396 struct nft_flowtable_filter *filter;
5397
5398 filter = nft_flowtable_filter_alloc(nla);
5399 if (IS_ERR(filter))
5400 return -ENOMEM;
5401
5402 c.data = filter;
5403 }
5404 return netlink_dump_start(nlsk, skb, nlh, &c);
5405 }
5406
5407 if (!nla[NFTA_FLOWTABLE_NAME])
5408 return -EINVAL;
5409
5410 afi = nf_tables_afinfo_lookup(net, family, false);
5411 if (IS_ERR(afi))
5412 return PTR_ERR(afi);
5413
5414 table = nf_tables_table_lookup(afi, nla[NFTA_FLOWTABLE_TABLE], genmask);
5415 if (IS_ERR(table))
5416 return PTR_ERR(table);
5417
5418 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5419 genmask);
5420 if (IS_ERR(table))
5421 return PTR_ERR(flowtable);
5422
5423 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5424 if (!skb2)
5425 return -ENOMEM;
5426
5427 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5428 nlh->nlmsg_seq,
5429 NFT_MSG_NEWFLOWTABLE, 0, family,
5430 flowtable);
5431 if (err < 0)
5432 goto err;
5433
5434 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5435err:
5436 kfree_skb(skb2);
5437 return err;
5438}
5439
5440static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5441 struct nft_flowtable *flowtable,
5442 int event)
5443{
5444 struct sk_buff *skb;
5445 int err;
5446
5447 if (ctx->report &&
5448 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5449 return;
5450
5451 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5452 if (skb == NULL)
5453 goto err;
5454
5455 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5456 ctx->seq, event, 0,
5457 ctx->afi->family, flowtable);
5458 if (err < 0) {
5459 kfree_skb(skb);
5460 goto err;
5461 }
5462
5463 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5464 ctx->report, GFP_KERNEL);
5465 return;
5466err:
5467 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5468}
5469
5470static void nft_flowtable_destroy(void *ptr, void *arg)
5471{
5472 kfree(ptr);
5473}
5474
5475static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5476{
5477 cancel_delayed_work_sync(&flowtable->data.gc_work);
5478 kfree(flowtable->name);
5479 rhashtable_free_and_destroy(&flowtable->data.rhashtable,
5480 nft_flowtable_destroy, NULL);
5481 module_put(flowtable->data.type->owner);
5482}
5483
84d7fce6
PNA		 5484static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5485 u32 portid, u32 seq)
5486{
5487 struct nlmsghdr *nlh;
5488 struct nfgenmsg *nfmsg;
784b4e61 5489 char buf[TASK_COMM_LEN];
dedb67c4 5490 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 5491
5492 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5493 if (nlh == NULL)
5494 goto nla_put_failure;
5495
5496 nfmsg = nlmsg_data(nlh);
5497 nfmsg->nfgen_family = AF_UNSPEC;
5498 nfmsg->version = NFNETLINK_V0;
5499 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5500
784b4e61
PS		 5501 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5502 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5503 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 5504 goto nla_put_failure;
5505
053c095a
JB		 5506 nlmsg_end(skb, nlh);
5507 return 0;
84d7fce6
PNA		 5508
5509nla_put_failure:
5510 nlmsg_trim(skb, nlh);
5511 return -EMSGSIZE;
5512}
5513
3b49e2e9
PNA		 5514static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5515 struct nft_flowtable *flowtable)
5516{
5517 int i;
5518
5519 for (i = 0; i < flowtable->ops_len; i++) {
5520 if (flowtable->ops[i].dev != dev)
5521 continue;
5522
5523 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
5524 flowtable->ops[i].dev = NULL;
5525 break;
5526 }
5527}
5528
5529static int nf_tables_flowtable_event(struct notifier_block *this,
5530 unsigned long event, void *ptr)
5531{
5532 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5533 struct nft_flowtable *flowtable;
5534 struct nft_table *table;
5535 struct nft_af_info *afi;
5536
5537 if (event != NETDEV_UNREGISTER)
5538 return 0;
5539
5540 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5541 list_for_each_entry(afi, &dev_net(dev)->nft.af_info, list) {
5542 list_for_each_entry(table, &afi->tables, list) {
5543 list_for_each_entry(flowtable, &table->flowtables, list) {
5544 nft_flowtable_event(event, dev, flowtable);
5545 }
5546 }
5547 }
5548 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5549
5550 return NOTIFY_DONE;
5551}
5552
5553static struct notifier_block nf_tables_flowtable_notifier = {
5554 .notifier_call = nf_tables_flowtable_event,
5555};
5556
25e94a99
PNA		 5557static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5558 int event)
84d7fce6
PNA		 5559{
5560 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5561 struct sk_buff *skb2;
5562 int err;
5563
5564 if (nlmsg_report(nlh) &&
5565 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5566 return;
84d7fce6 5567
84d7fce6
PNA		 5568 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5569 if (skb2 == NULL)
5570 goto err;
5571
5572 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5573 nlh->nlmsg_seq);
5574 if (err < 0) {
5575 kfree_skb(skb2);
5576 goto err;
5577 }
5578
25e94a99
PNA		 5579 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5580 nlmsg_report(nlh), GFP_KERNEL);
5581 return;
84d7fce6 5582err:
25e94a99
PNA		 5583 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5584 -ENOBUFS);
84d7fce6
PNA		 5585}
5586
7b8002a1
PNA		 5587static int nf_tables_getgen(struct net *net, struct sock *nlsk,
5588 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5589 const struct nlattr * const nla[],
5590 struct netlink_ext_ack *extack)
84d7fce6 5591{
84d7fce6
PNA		 5592 struct sk_buff *skb2;
5593 int err;
5594
5595 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5596 if (skb2 == NULL)
5597 return -ENOMEM;
5598
5599 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5600 nlh->nlmsg_seq);
5601 if (err < 0)
5602 goto err;
5603
5604 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5605err:
5606 kfree_skb(skb2);
5607 return err;
5608}
5609
96518518
PM		 5610static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
5611 [NFT_MSG_NEWTABLE] = {
55dd6f93 5612 .call_batch = nf_tables_newtable,
96518518
PM		 5613 .attr_count = NFTA_TABLE_MAX,
5614 .policy = nft_table_policy,
5615 },
5616 [NFT_MSG_GETTABLE] = {
5617 .call = nf_tables_gettable,
5618 .attr_count = NFTA_TABLE_MAX,
5619 .policy = nft_table_policy,
5620 },
5621 [NFT_MSG_DELTABLE] = {
55dd6f93 5622 .call_batch = nf_tables_deltable,
96518518
PM		 5623 .attr_count = NFTA_TABLE_MAX,
5624 .policy = nft_table_policy,
5625 },
5626 [NFT_MSG_NEWCHAIN] = {
91c7b38d 5627 .call_batch = nf_tables_newchain,
96518518
PM		 5628 .attr_count = NFTA_CHAIN_MAX,
5629 .policy = nft_chain_policy,
5630 },
5631 [NFT_MSG_GETCHAIN] = {
5632 .call = nf_tables_getchain,
5633 .attr_count = NFTA_CHAIN_MAX,
5634 .policy = nft_chain_policy,
5635 },
5636 [NFT_MSG_DELCHAIN] = {
91c7b38d 5637 .call_batch = nf_tables_delchain,
96518518
PM		 5638 .attr_count = NFTA_CHAIN_MAX,
5639 .policy = nft_chain_policy,
5640 },
5641 [NFT_MSG_NEWRULE] = {
0628b123 5642 .call_batch = nf_tables_newrule,
96518518
PM		 5643 .attr_count = NFTA_RULE_MAX,
5644 .policy = nft_rule_policy,
5645 },
5646 [NFT_MSG_GETRULE] = {
5647 .call = nf_tables_getrule,
5648 .attr_count = NFTA_RULE_MAX,
5649 .policy = nft_rule_policy,
5650 },
5651 [NFT_MSG_DELRULE] = {
0628b123 5652 .call_batch = nf_tables_delrule,
96518518
PM		 5653 .attr_count = NFTA_RULE_MAX,
5654 .policy = nft_rule_policy,
5655 },
20a69341 5656 [NFT_MSG_NEWSET] = {
958bee14 5657 .call_batch = nf_tables_newset,
20a69341
PM		 5658 .attr_count = NFTA_SET_MAX,
5659 .policy = nft_set_policy,
5660 },
5661 [NFT_MSG_GETSET] = {
5662 .call = nf_tables_getset,
5663 .attr_count = NFTA_SET_MAX,
5664 .policy = nft_set_policy,
5665 },
5666 [NFT_MSG_DELSET] = {
958bee14 5667 .call_batch = nf_tables_delset,
20a69341
PM		 5668 .attr_count = NFTA_SET_MAX,
5669 .policy = nft_set_policy,
5670 },
5671 [NFT_MSG_NEWSETELEM] = {
958bee14 5672 .call_batch = nf_tables_newsetelem,
20a69341
PM		 5673 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5674 .policy = nft_set_elem_list_policy,
5675 },
5676 [NFT_MSG_GETSETELEM] = {
5677 .call = nf_tables_getsetelem,
5678 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5679 .policy = nft_set_elem_list_policy,
5680 },
5681 [NFT_MSG_DELSETELEM] = {
958bee14 5682 .call_batch = nf_tables_delsetelem,
20a69341
PM		 5683 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5684 .policy = nft_set_elem_list_policy,
5685 },
84d7fce6
PNA		 5686 [NFT_MSG_GETGEN] = {
5687 .call = nf_tables_getgen,
5688 },
e5009240
PNA		 5689 [NFT_MSG_NEWOBJ] = {
5690 .call_batch = nf_tables_newobj,
5691 .attr_count = NFTA_OBJ_MAX,
5692 .policy = nft_obj_policy,
5693 },
5694 [NFT_MSG_GETOBJ] = {
5695 .call = nf_tables_getobj,
5696 .attr_count = NFTA_OBJ_MAX,
5697 .policy = nft_obj_policy,
5698 },
5699 [NFT_MSG_DELOBJ] = {
5700 .call_batch = nf_tables_delobj,
5701 .attr_count = NFTA_OBJ_MAX,
5702 .policy = nft_obj_policy,
5703 },
43da04a5
PNA		 5704 [NFT_MSG_GETOBJ_RESET] = {
5705 .call = nf_tables_getobj,
5706 .attr_count = NFTA_OBJ_MAX,
5707 .policy = nft_obj_policy,
5708 },
3b49e2e9
PNA		 5709 [NFT_MSG_NEWFLOWTABLE] = {
5710 .call_batch = nf_tables_newflowtable,
5711 .attr_count = NFTA_FLOWTABLE_MAX,
5712 .policy = nft_flowtable_policy,
5713 },
5714 [NFT_MSG_GETFLOWTABLE] = {
5715 .call = nf_tables_getflowtable,
5716 .attr_count = NFTA_FLOWTABLE_MAX,
5717 .policy = nft_flowtable_policy,
5718 },
5719 [NFT_MSG_DELFLOWTABLE] = {
5720 .call_batch = nf_tables_delflowtable,
5721 .attr_count = NFTA_FLOWTABLE_MAX,
5722 .policy = nft_flowtable_policy,
5723 },
96518518
PM		 5724};
5725
91c7b38d
PNA		 5726static void nft_chain_commit_update(struct nft_trans *trans)
5727{
5728 struct nft_base_chain *basechain;
5729
b7263e07 5730 if (nft_trans_chain_name(trans))
91c7b38d
PNA		 5731 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
5732
f323d954 5733 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 5734 return;
5735
5736 basechain = nft_base_chain(trans->ctx.chain);
5737 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5738
5739 switch (nft_trans_chain_policy(trans)) {
5740 case NF_DROP:
5741 case NF_ACCEPT:
5742 basechain->policy = nft_trans_chain_policy(trans);
5743 break;
5744 }
5745}
5746
b326dd37 5747static void nf_tables_commit_release(struct nft_trans *trans)
c7c32e72 5748{
c7c32e72
PNA		 5749 switch (trans->msg_type) {
5750 case NFT_MSG_DELTABLE:
5751 nf_tables_table_destroy(&trans->ctx);
5752 break;
5753 case NFT_MSG_DELCHAIN:
5754 nf_tables_chain_destroy(trans->ctx.chain);
5755 break;
5756 case NFT_MSG_DELRULE:
5757 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5758 break;
5759 case NFT_MSG_DELSET:
5760 nft_set_destroy(nft_trans_set(trans));
5761 break;
61edafbb 5762 case NFT_MSG_DELSETELEM:
59105446
PNA		 5763 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
5764 nft_trans_elem(trans).priv);
61edafbb 5765 break;
e5009240
PNA		 5766 case NFT_MSG_DELOBJ:
5767 nft_obj_destroy(nft_trans_obj(trans));
5768 break;
3b49e2e9
PNA		 5769 case NFT_MSG_DELFLOWTABLE:
5770 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5771 break;
c7c32e72
PNA		 5772 }
5773 kfree(trans);
5774}
5775
5913beaf 5776static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 5777{
37082f93 5778 struct nft_trans *trans, *next;
a3716e70 5779 struct nft_trans_elem *te;
37082f93
PNA		 5780
5781 /* Bump generation counter, invalidate any dump in progress */
38e029f1 5782 while (++net->nft.base_seq == 0);
37082f93
PNA		 5783
5784 /* A new generation has just started */
ea4bd995 5785 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 5786
5787 /* Make sure all packets have left the previous generation before
5788 * purging old rules.
5789 */
5790 synchronize_rcu();
5791
5792 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 5793 switch (trans->msg_type) {
55dd6f93
PNA		 5794 case NFT_MSG_NEWTABLE:
5795 if (nft_trans_table_update(trans)) {
5796 if (!nft_trans_table_enable(trans)) {
664b0f8c
PNA		 5797 nf_tables_table_disable(net,
5798 trans->ctx.afi,
55dd6f93
PNA		 5799 trans->ctx.table);
5800 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5801 }
5802 } else {
f2a6d766 5803 nft_clear(net, trans->ctx.table);
55dd6f93 5804 }
35151d84 5805 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 5806 nft_trans_destroy(trans);
5807 break;
5808 case NFT_MSG_DELTABLE:
f2a6d766 5809 list_del_rcu(&trans->ctx.table->list);
35151d84 5810 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 5811 break;
91c7b38d
PNA		 5812 case NFT_MSG_NEWCHAIN:
5813 if (nft_trans_chain_update(trans))
5814 nft_chain_commit_update(trans);
4fefee57 5815 else
664b0f8c 5816 nft_clear(net, trans->ctx.chain);
4fefee57 5817
35151d84 5818 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
91c7b38d
PNA		 5819 nft_trans_destroy(trans);
5820 break;
5821 case NFT_MSG_DELCHAIN:
664b0f8c 5822 list_del_rcu(&trans->ctx.chain->list);
35151d84 5823 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 5824 nf_tables_unregister_hook(trans->ctx.net,
5825 trans->ctx.table,
5826 trans->ctx.chain);
91c7b38d 5827 break;
b380e5c7 5828 case NFT_MSG_NEWRULE:
889f7ee7 5829 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 5830 nf_tables_rule_notify(&trans->ctx,
37082f93 5831 nft_trans_rule(trans),
35151d84 5832 NFT_MSG_NEWRULE);
37082f93 5833 nft_trans_destroy(trans);
b380e5c7
PNA		 5834 break;
5835 case NFT_MSG_DELRULE:
5836 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 5837 nf_tables_rule_notify(&trans->ctx,
5838 nft_trans_rule(trans),
5839 NFT_MSG_DELRULE);
b380e5c7 5840 break;
958bee14 5841 case NFT_MSG_NEWSET:
37a9cc52 5842 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 5843 /* This avoids hitting -EBUSY when deleting the table
5844 * from the transaction.
5845 */
408070d6 5846 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 5847 !list_empty(&nft_trans_set(trans)->bindings))
5848 trans->ctx.table->use--;
5849
958bee14 5850 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5851 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 5852 nft_trans_destroy(trans);
5853 break;
5854 case NFT_MSG_DELSET:
37a9cc52 5855 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 5856 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5857 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 5858 break;
60319eb1 5859 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 5860 te = (struct nft_trans_elem *)trans->data;
5861
42a55769 5862 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 5863 nf_tables_setelem_notify(&trans->ctx, te->set,
5864 &te->elem,
60319eb1
PNA		 5865 NFT_MSG_NEWSETELEM, 0);
5866 nft_trans_destroy(trans);
5867 break;
5868 case NFT_MSG_DELSETELEM:
a3716e70 5869 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5870
a3716e70
PNA		 5871 nf_tables_setelem_notify(&trans->ctx, te->set,
5872 &te->elem,
60319eb1 5873 NFT_MSG_DELSETELEM, 0);
5cb82a38 5874 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 5875 atomic_dec(&te->set->nelems);
5876 te->set->ndeact--;
60319eb1 5877 break;
e5009240
PNA		 5878 case NFT_MSG_NEWOBJ:
5879 nft_clear(net, nft_trans_obj(trans));
5880 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5881 NFT_MSG_NEWOBJ);
5882 nft_trans_destroy(trans);
5883 break;
5884 case NFT_MSG_DELOBJ:
5885 list_del_rcu(&nft_trans_obj(trans)->list);
5886 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5887 NFT_MSG_DELOBJ);
5888 break;
3b49e2e9
PNA		 5889 case NFT_MSG_NEWFLOWTABLE:
5890 nft_clear(net, nft_trans_flowtable(trans));
5891 nf_tables_flowtable_notify(&trans->ctx,
5892 nft_trans_flowtable(trans),
5893 NFT_MSG_NEWFLOWTABLE);
5894 nft_trans_destroy(trans);
5895 break;
5896 case NFT_MSG_DELFLOWTABLE:
5897 list_del_rcu(&nft_trans_flowtable(trans)->list);
5898 nf_tables_flowtable_notify(&trans->ctx,
5899 nft_trans_flowtable(trans),
5900 NFT_MSG_DELFLOWTABLE);
5901 nft_unregister_flowtable_net_hooks(net,
5902 nft_trans_flowtable(trans));
5903 break;
37082f93 5904 }
37082f93
PNA		 5905 }
5906
b326dd37
PNA		 5907 synchronize_rcu();
5908
37082f93 5909 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
c7c32e72 5910 list_del(&trans->list);
b326dd37 5911 nf_tables_commit_release(trans);
37082f93 5912 }
84d7fce6
PNA		 5913
5914 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
37082f93
PNA		 5915
5916 return 0;
5917}
5918
b326dd37 5919static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 5920{
c7c32e72
PNA		 5921 switch (trans->msg_type) {
5922 case NFT_MSG_NEWTABLE:
5923 nf_tables_table_destroy(&trans->ctx);
5924 break;
5925 case NFT_MSG_NEWCHAIN:
5926 nf_tables_chain_destroy(trans->ctx.chain);
5927 break;
5928 case NFT_MSG_NEWRULE:
5929 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5930 break;
5931 case NFT_MSG_NEWSET:
5932 nft_set_destroy(nft_trans_set(trans));
5933 break;
61edafbb
PM		 5934 case NFT_MSG_NEWSETELEM:
5935 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 5936 nft_trans_elem(trans).priv, true);
61edafbb 5937 break;
e5009240
PNA		 5938 case NFT_MSG_NEWOBJ:
5939 nft_obj_destroy(nft_trans_obj(trans));
5940 break;
3b49e2e9
PNA		 5941 case NFT_MSG_NEWFLOWTABLE:
5942 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5943 break;
c7c32e72
PNA		 5944 }
5945 kfree(trans);
5946}
5947
5913beaf 5948static int nf_tables_abort(struct net *net, struct sk_buff *skb)
37082f93 5949{
37082f93 5950 struct nft_trans *trans, *next;
02263db0 5951 struct nft_trans_elem *te;
37082f93 5952
a907e36d
XL		 5953 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
5954 list) {
b380e5c7 5955 switch (trans->msg_type) {
55dd6f93
PNA		 5956 case NFT_MSG_NEWTABLE:
5957 if (nft_trans_table_update(trans)) {
5958 if (nft_trans_table_enable(trans)) {
664b0f8c
PNA		 5959 nf_tables_table_disable(net,
5960 trans->ctx.afi,
55dd6f93
PNA		 5961 trans->ctx.table);
5962 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5963 }
5964 nft_trans_destroy(trans);
5965 } else {
e688a7f8 5966 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 5967 }
5968 break;
5969 case NFT_MSG_DELTABLE:
f2a6d766 5970 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 5971 nft_trans_destroy(trans);
5972 break;
91c7b38d
PNA		 5973 case NFT_MSG_NEWCHAIN:
5974 if (nft_trans_chain_update(trans)) {
982f4051 5975 free_percpu(nft_trans_chain_stats(trans));
91c7b38d
PNA		 5976
5977 nft_trans_destroy(trans);
5978 } else {
4fefee57 5979 trans->ctx.table->use--;
e688a7f8 5980 list_del_rcu(&trans->ctx.chain->list);
c974a3a3
PNA		 5981 nf_tables_unregister_hook(trans->ctx.net,
5982 trans->ctx.table,
5983 trans->ctx.chain);
91c7b38d
PNA		 5984 }
5985 break;
5986 case NFT_MSG_DELCHAIN:
4fefee57 5987 trans->ctx.table->use++;
664b0f8c 5988 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 5989 nft_trans_destroy(trans);
5990 break;
b380e5c7 5991 case NFT_MSG_NEWRULE:
4fefee57 5992 trans->ctx.chain->use--;
b380e5c7
PNA		 5993 list_del_rcu(&nft_trans_rule(trans)->list);
5994 break;
5995 case NFT_MSG_DELRULE:
4fefee57 5996 trans->ctx.chain->use++;
889f7ee7 5997 nft_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 5998 nft_trans_destroy(trans);
b380e5c7 5999 break;
958bee14 6000 case NFT_MSG_NEWSET:
4fefee57 6001 trans->ctx.table->use--;
e688a7f8 6002 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 6003 break;
6004 case NFT_MSG_DELSET:
4fefee57 6005 trans->ctx.table->use++;
37a9cc52 6006 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 6007 nft_trans_destroy(trans);
6008 break;
60319eb1 6009 case NFT_MSG_NEWSETELEM:
02263db0 6010 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6011
5cb82a38 6012 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 6013 atomic_dec(&te->set->nelems);
60319eb1
PNA		 6014 break;
6015 case NFT_MSG_DELSETELEM:
cc02e457
PM		 6016 te = (struct nft_trans_elem *)trans->data;
6017
59105446 6018 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 6019 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 6020 te->set->ndeact--;
cc02e457 6021
e5009240
PNA		 6022 nft_trans_destroy(trans);
6023 break;
6024 case NFT_MSG_NEWOBJ:
6025 trans->ctx.table->use--;
6026 list_del_rcu(&nft_trans_obj(trans)->list);
6027 break;
6028 case NFT_MSG_DELOBJ:
6029 trans->ctx.table->use++;
6030 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 6031 nft_trans_destroy(trans);
6032 break;
3b49e2e9
PNA		 6033 case NFT_MSG_NEWFLOWTABLE:
6034 trans->ctx.table->use--;
6035 list_del_rcu(&nft_trans_flowtable(trans)->list);
6036 nft_unregister_flowtable_net_hooks(net,
6037 nft_trans_flowtable(trans));
6038 break;
6039 case NFT_MSG_DELFLOWTABLE:
6040 trans->ctx.table->use++;
6041 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6042 nft_trans_destroy(trans);
6043 break;
37082f93 6044 }
37082f93
PNA		 6045 }
6046
b326dd37
PNA		 6047 synchronize_rcu();
6048
a1cee076
PNA		 6049 list_for_each_entry_safe_reverse(trans, next,
6050 &net->nft.commit_list, list) {
c7c32e72 6051 list_del(&trans->list);
b326dd37 6052 nf_tables_abort_release(trans);
37082f93
PNA		 6053 }
6054
6055 return 0;
6056}
6057
74e8bcd2
PNA		 6058static bool nf_tables_valid_genid(struct net *net, u32 genid)
6059{
6060 return net->nft.base_seq == genid;
6061}
6062
96518518
PM		 6063static const struct nfnetlink_subsystem nf_tables_subsys = {
6064 .name = "nf_tables",
6065 .subsys_id = NFNL_SUBSYS_NFTABLES,
6066 .cb_count = NFT_MSG_MAX,
6067 .cb = nf_tables_cb,
0628b123
PNA		 6068 .commit = nf_tables_commit,
6069 .abort = nf_tables_abort,
74e8bcd2 6070 .valid_genid = nf_tables_valid_genid,
96518518
PM		 6071};
6072
7210e4e3
PNA		 6073int nft_chain_validate_dependency(const struct nft_chain *chain,
6074 enum nft_chain_type type)
6075{
6076 const struct nft_base_chain *basechain;
6077
f323d954 6078 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6079 basechain = nft_base_chain(chain);
6080 if (basechain->type->type != type)
6081 return -EOPNOTSUPP;
6082 }
6083 return 0;
6084}
6085EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6086
75e8d06d
PNA		 6087int nft_chain_validate_hooks(const struct nft_chain *chain,
6088 unsigned int hook_flags)
6089{
6090 struct nft_base_chain *basechain;
6091
f323d954 6092 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6093 basechain = nft_base_chain(chain);
6094
c974a3a3 6095 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6096 return 0;
6097
6098 return -EOPNOTSUPP;
6099 }
6100
6101 return 0;
6102}
6103EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6104
20a69341
PM		 6105/*
6106 * Loop detection - walk through the ruleset beginning at the destination chain
6107 * of a new jump until either the source chain is reached (loop) or all
6108 * reachable chains have been traversed.
6109 *
6110 * The loop check is performed whenever a new jump verdict is added to an
6111 * expression or verdict map or a verdict map is bound to a new chain.
6112 */
6113
6114static int nf_tables_check_loops(const struct nft_ctx *ctx,
6115 const struct nft_chain *chain);
6116
6117static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6118 struct nft_set *set,
20a69341 6119 const struct nft_set_iter *iter,
de70185d 6120 struct nft_set_elem *elem)
20a69341 6121{
fe2811eb
PM		 6122 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6123 const struct nft_data *data;
6124
6125 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6126 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 6127 return 0;
6128
fe2811eb 6129 data = nft_set_ext_data(ext);
1ca2e170 6130 switch (data->verdict.code) {
20a69341
PM		 6131 case NFT_JUMP:
6132 case NFT_GOTO:
1ca2e170 6133 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6134 default:
6135 return 0;
6136 }
6137}
6138
6139static int nf_tables_check_loops(const struct nft_ctx *ctx,
6140 const struct nft_chain *chain)
6141{
6142 const struct nft_rule *rule;
6143 const struct nft_expr *expr, *last;
de70185d 6144 struct nft_set *set;
20a69341
PM		 6145 struct nft_set_binding *binding;
6146 struct nft_set_iter iter;
20a69341
PM		 6147
6148 if (ctx->chain == chain)
6149 return -ELOOP;
6150
6151 list_for_each_entry(rule, &chain->rules, list) {
6152 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 6153 const struct nft_data *data = NULL;
6154 int err;
6155
6156 if (!expr->ops->validate)
20a69341
PM		 6157 continue;
6158
0ca743a5
PNA		 6159 err = expr->ops->validate(ctx, expr, &data);
6160 if (err < 0)
6161 return err;
6162
20a69341 6163 if (data == NULL)
0ca743a5 6164 continue;
20a69341 6165
1ca2e170 6166 switch (data->verdict.code) {
20a69341
PM		 6167 case NFT_JUMP:
6168 case NFT_GOTO:
1ca2e170
PM		 6169 err = nf_tables_check_loops(ctx,
6170 data->verdict.chain);
20a69341
PM		 6171 if (err < 0)
6172 return err;
6173 default:
6174 break;
6175 }
6176 }
6177 }
6178
6179 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 6180 if (!nft_is_active_next(ctx->net, set))
6181 continue;
20a69341
PM		 6182 if (!(set->flags & NFT_SET_MAP) ||
6183 set->dtype != NFT_DATA_VERDICT)
6184 continue;
6185
6186 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 6187 if (!(binding->flags & NFT_SET_MAP) ||
6188 binding->chain != chain)
20a69341
PM		 6189 continue;
6190
8588ac09 6191 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 6192 iter.skip = 0;
6193 iter.count = 0;
6194 iter.err = 0;
6195 iter.fn = nf_tables_loop_check_setelem;
6196
6197 set->ops->walk(ctx, set, &iter);
6198 if (iter.err < 0)
6199 return iter.err;
6200 }
6201 }
6202
6203 return 0;
6204}
6205
36b701fa
LGL		 6206/**
6207 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6208 *
6209 * @attr: netlink attribute to fetch value from
6210 * @max: maximum value to be stored in dest
6211 * @dest: pointer to the variable
6212 *
6213 * Parse, check and store a given u32 netlink attribute into variable.
6214 * This function returns -ERANGE if the value goes over maximum value.
6215 * Otherwise a 0 is returned and the attribute value is stored in the
6216 * destination variable.
6217 */
f1d505bb 6218int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 6219{
09525a09 6220 u32 val;
36b701fa
LGL		 6221
6222 val = ntohl(nla_get_be32(attr));
6223 if (val > max)
6224 return -ERANGE;
6225
6226 *dest = val;
6227 return 0;
6228}
6229EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6230
49499c3e
PM		 6231/**
6232 * nft_parse_register - parse a register value from a netlink attribute
6233 *
6234 * @attr: netlink attribute
6235 *
6236 * Parse and translate a register value from a netlink attribute.
6237 * Registers used to be 128 bit wide, these register numbers will be
6238 * mapped to the corresponding 32 bit register numbers.
6239 */
b1c96ed3
PM		 6240unsigned int nft_parse_register(const struct nlattr *attr)
6241{
49499c3e
PM		 6242 unsigned int reg;
6243
6244 reg = ntohl(nla_get_be32(attr));
6245 switch (reg) {
6246 case NFT_REG_VERDICT...NFT_REG_4:
6247 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6248 default:
6249 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6250 }
b1c96ed3
PM		 6251}
6252EXPORT_SYMBOL_GPL(nft_parse_register);
6253
49499c3e
PM		 6254/**
6255 * nft_dump_register - dump a register value to a netlink attribute
6256 *
6257 * @skb: socket buffer
6258 * @attr: attribute number
6259 * @reg: register number
6260 *
6261 * Construct a netlink attribute containing the register number. For
6262 * compatibility reasons, register numbers being a multiple of 4 are
6263 * translated to the corresponding 128 bit register numbers.
6264 */
b1c96ed3
PM		 6265int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6266{
49499c3e
PM		 6267 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6268 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6269 else
6270 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6271
b1c96ed3
PM		 6272 return nla_put_be32(skb, attr, htonl(reg));
6273}
6274EXPORT_SYMBOL_GPL(nft_dump_register);
6275
96518518 6276/**
d07db988 6277 * nft_validate_register_load - validate a load from a register
96518518
PM		 6278 *
6279 * @reg: the register number
d07db988 6280 * @len: the length of the data
96518518
PM		 6281 *
6282 * Validate that the input register is one of the general purpose
d07db988 6283 * registers and that the length of the load is within the bounds.
96518518 6284 */
d07db988 6285int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 6286{
49499c3e 6287 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 6288 return -EINVAL;
d07db988
PM		 6289 if (len == 0)
6290 return -EINVAL;
49499c3e 6291 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 6292 return -ERANGE;
49499c3e 6293
96518518
PM		 6294 return 0;
6295}
d07db988 6296EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 6297
96518518 6298/**
1ec10212 6299 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 6300 *
6301 * @ctx: context of the expression performing the load
6302 * @reg: the destination register number
6303 * @data: the data to load
6304 * @type: the data type
45d9bcda 6305 * @len: the length of the data
96518518
PM		 6306 *
6307 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 6308 * the destination register and the length is within the bounds.
6309 * A value of NULL for the data means that its runtime gathered
58f40ab6 6310 * data.
96518518 6311 */
1ec10212
PM		 6312int nft_validate_register_store(const struct nft_ctx *ctx,
6313 enum nft_registers reg,
6314 const struct nft_data *data,
6315 enum nft_data_types type, unsigned int len)
96518518 6316{
20a69341
PM		 6317 int err;
6318
96518518
PM		 6319 switch (reg) {
6320 case NFT_REG_VERDICT:
58f40ab6 6321 if (type != NFT_DATA_VERDICT)
96518518 6322 return -EINVAL;
20a69341 6323
58f40ab6 6324 if (data != NULL &&
1ca2e170
PM		 6325 (data->verdict.code == NFT_GOTO ||
6326 data->verdict.code == NFT_JUMP)) {
6327 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 6328 if (err < 0)
6329 return err;
6330
1ca2e170
PM		 6331 if (ctx->chain->level + 1 >
6332 data->verdict.chain->level) {
20a69341
PM		 6333 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
6334 return -EMLINK;
1ca2e170 6335 data->verdict.chain->level = ctx->chain->level + 1;
20a69341
PM		 6336 }
6337 }
6338
96518518
PM		 6339 return 0;
6340 default:
49499c3e 6341 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 6342 return -EINVAL;
45d9bcda
PM		 6343 if (len == 0)
6344 return -EINVAL;
49499c3e
PM		 6345 if (reg * NFT_REG32_SIZE + len >
6346 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 6347 return -ERANGE;
27e6d201 6348
96518518
PM		 6349 if (data != NULL && type != NFT_DATA_VALUE)
6350 return -EINVAL;
6351 return 0;
6352 }
6353}
1ec10212 6354EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 6355
6356static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
6357 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
6358 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
6359 .len = NFT_CHAIN_MAXNAMELEN - 1 },
6360};
6361
6362static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
6363 struct nft_data_desc *desc, const struct nlattr *nla)
6364{
664b0f8c 6365 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 6366 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
6367 struct nft_chain *chain;
6368 int err;
6369
fceb6435
JB		 6370 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
6371 NULL);
96518518
PM		 6372 if (err < 0)
6373 return err;
6374
6375 if (!tb[NFTA_VERDICT_CODE])
6376 return -EINVAL;
1ca2e170 6377 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 6378
1ca2e170 6379 switch (data->verdict.code) {
e0abdadc 6380 default:
1ca2e170 6381 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 6382 case NF_ACCEPT:
6383 case NF_DROP:
6384 case NF_QUEUE:
6385 break;
6386 default:
6387 return -EINVAL;
6388 }
6389 /* fall through */
96518518
PM		 6390 case NFT_CONTINUE:
6391 case NFT_BREAK:
6392 case NFT_RETURN:
96518518
PM		 6393 break;
6394 case NFT_JUMP:
6395 case NFT_GOTO:
6396 if (!tb[NFTA_VERDICT_CHAIN])
6397 return -EINVAL;
6398 chain = nf_tables_chain_lookup(ctx->table,
664b0f8c 6399 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 6400 if (IS_ERR(chain))
6401 return PTR_ERR(chain);
f323d954 6402 if (nft_is_base_chain(chain))
96518518
PM		 6403 return -EOPNOTSUPP;
6404
96518518 6405 chain->use++;
1ca2e170 6406 data->verdict.chain = chain;
96518518 6407 break;
96518518
PM		 6408 }
6409
4c4ed074 6410 desc->len = sizeof(data->verdict);
96518518
PM		 6411 desc->type = NFT_DATA_VERDICT;
6412 return 0;
6413}
6414
6415static void nft_verdict_uninit(const struct nft_data *data)
6416{
1ca2e170 6417 switch (data->verdict.code) {
96518518
PM		 6418 case NFT_JUMP:
6419 case NFT_GOTO:
1ca2e170 6420 data->verdict.chain->use--;
96518518
PM		 6421 break;
6422 }
6423}
6424
33d5a7b1 6425int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 6426{
6427 struct nlattr *nest;
6428
33d5a7b1 6429 nest = nla_nest_start(skb, type);
96518518
PM		 6430 if (!nest)
6431 goto nla_put_failure;
6432
33d5a7b1 6433 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 6434 goto nla_put_failure;
6435
33d5a7b1 6436 switch (v->code) {
96518518
PM		 6437 case NFT_JUMP:
6438 case NFT_GOTO:
1ca2e170 6439 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 6440 v->chain->name))
96518518
PM		 6441 goto nla_put_failure;
6442 }
6443 nla_nest_end(skb, nest);
6444 return 0;
6445
6446nla_put_failure:
6447 return -1;
6448}
6449
d0a11fc3
PM		 6450static int nft_value_init(const struct nft_ctx *ctx,
6451 struct nft_data *data, unsigned int size,
96518518
PM		 6452 struct nft_data_desc *desc, const struct nlattr *nla)
6453{
6454 unsigned int len;
6455
6456 len = nla_len(nla);
6457 if (len == 0)
6458 return -EINVAL;
d0a11fc3 6459 if (len > size)
96518518
PM		 6460 return -EOVERFLOW;
6461
d0a11fc3 6462 nla_memcpy(data->data, nla, len);
96518518
PM		 6463 desc->type = NFT_DATA_VALUE;
6464 desc->len = len;
6465 return 0;
6466}
6467
6468static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
6469 unsigned int len)
6470{
6471 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
6472}
6473
6474static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 6475 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 6476 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
6477};
6478
6479/**
6480 * nft_data_init - parse nf_tables data netlink attributes
6481 *
6482 * @ctx: context of the expression using the data
6483 * @data: destination struct nft_data
d0a11fc3 6484 * @size: maximum data length
96518518
PM		 6485 * @desc: data description
6486 * @nla: netlink attribute containing data
6487 *
6488 * Parse the netlink data attributes and initialize a struct nft_data.
6489 * The type and length of data are returned in the data description.
6490 *
6491 * The caller can indicate that it only wants to accept data of type
6492 * NFT_DATA_VALUE by passing NULL for the ctx argument.
6493 */
d0a11fc3
PM		 6494int nft_data_init(const struct nft_ctx *ctx,
6495 struct nft_data *data, unsigned int size,
96518518
PM		 6496 struct nft_data_desc *desc, const struct nlattr *nla)
6497{
6498 struct nlattr *tb[NFTA_DATA_MAX + 1];
6499 int err;
6500
fceb6435 6501 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 6502 if (err < 0)
6503 return err;
6504
6505 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 6506 return nft_value_init(ctx, data, size, desc,
6507 tb[NFTA_DATA_VALUE]);
96518518
PM		 6508 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
6509 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
6510 return -EINVAL;
6511}
6512EXPORT_SYMBOL_GPL(nft_data_init);
6513
6514/**
59105446 6515 * nft_data_release - release a nft_data item
96518518
PM		 6516 *
6517 * @data: struct nft_data to release
6518 * @type: type of data
6519 *
6520 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6521 * all others need to be released by calling this function.
6522 */
59105446 6523void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 6524{
960bd2c2 6525 if (type < NFT_DATA_VERDICT)
96518518 6526 return;
960bd2c2 6527 switch (type) {
96518518
PM		 6528 case NFT_DATA_VERDICT:
6529 return nft_verdict_uninit(data);
6530 default:
6531 WARN_ON(1);
6532 }
6533}
59105446 6534EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 6535
6536int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
6537 enum nft_data_types type, unsigned int len)
6538{
6539 struct nlattr *nest;
6540 int err;
6541
6542 nest = nla_nest_start(skb, attr);
6543 if (nest == NULL)
6544 return -1;
6545
6546 switch (type) {
6547 case NFT_DATA_VALUE:
6548 err = nft_value_dump(skb, data, len);
6549 break;
6550 case NFT_DATA_VERDICT:
33d5a7b1 6551 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 6552 break;
6553 default:
6554 err = -EINVAL;
6555 WARN_ON(1);
6556 }
6557
6558 nla_nest_end(skb, nest);
6559 return err;
6560}
6561EXPORT_SYMBOL_GPL(nft_data_dump);
6562
df05ef87 6563static int __net_init nf_tables_init_net(struct net *net)
99633ab2
PNA		 6564{
6565 INIT_LIST_HEAD(&net->nft.af_info);
0628b123 6566 INIT_LIST_HEAD(&net->nft.commit_list);
38e029f1 6567 net->nft.base_seq = 1;
99633ab2
PNA		 6568 return 0;
6569}
6570
613d0776
VA		 6571static void __net_exit nf_tables_exit_net(struct net *net)
6572{
6573 WARN_ON_ONCE(!list_empty(&net->nft.af_info));
6574 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
6575}
6576
5ebe0b0e
PNA		 6577int __nft_release_basechain(struct nft_ctx *ctx)
6578{
6579 struct nft_rule *rule, *nr;
6580
f323d954 6581 BUG_ON(!nft_is_base_chain(ctx->chain));
5ebe0b0e 6582
c974a3a3 6583 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 6584 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6585 list_del(&rule->list);
6586 ctx->chain->use--;
6587 nf_tables_rule_destroy(ctx, rule);
6588 }
6589 list_del(&ctx->chain->list);
6590 ctx->table->use--;
6591 nf_tables_chain_destroy(ctx->chain);
6592
6593 return 0;
6594}
6595EXPORT_SYMBOL_GPL(__nft_release_basechain);
6596
df05ef87
PNA		 6597/* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */
6598static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
6599{
3b49e2e9 6600 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 6601 struct nft_table *table, *nt;
6602 struct nft_chain *chain, *nc;
e5009240 6603 struct nft_object *obj, *ne;
df05ef87
PNA		 6604 struct nft_rule *rule, *nr;
6605 struct nft_set *set, *ns;
6606 struct nft_ctx ctx = {
6607 .net = net,
6608 .afi = afi,
6609 };
6610
6611 list_for_each_entry_safe(table, nt, &afi->tables, list) {
6612 list_for_each_entry(chain, &table->chains, list)
c974a3a3 6613 nf_tables_unregister_hook(net, table, chain);
3b49e2e9
PNA		 6614 list_for_each_entry(flowtable, &table->flowtables, list)
6615 nf_unregister_net_hooks(net, flowtable->ops,
6616 flowtable->ops_len);
df05ef87
PNA		 6617 /* No packets are walking on these chains anymore. */
6618 ctx.table = table;
6619 list_for_each_entry(chain, &table->chains, list) {
6620 ctx.chain = chain;
6621 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
6622 list_del(&rule->list);
6623 chain->use--;
6624 nf_tables_rule_destroy(&ctx, rule);
6625 }
6626 }
3b49e2e9
PNA		 6627 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
6628 list_del(&flowtable->list);
6629 table->use--;
6630 nf_tables_flowtable_destroy(flowtable);
6631 }
df05ef87
PNA		 6632 list_for_each_entry_safe(set, ns, &table->sets, list) {
6633 list_del(&set->list);
6634 table->use--;
6635 nft_set_destroy(set);
6636 }
e5009240
PNA		 6637 list_for_each_entry_safe(obj, ne, &table->objects, list) {
6638 list_del(&obj->list);
6639 table->use--;
6640 nft_obj_destroy(obj);
6641 }
df05ef87
PNA		 6642 list_for_each_entry_safe(chain, nc, &table->chains, list) {
6643 list_del(&chain->list);
6644 table->use--;
6645 nf_tables_chain_destroy(chain);
6646 }
6647 list_del(&table->list);
6648 nf_tables_table_destroy(&ctx);
6649 }
6650}
6651
99633ab2
PNA		 6652static struct pernet_operations nf_tables_net_ops = {
6653 .init = nf_tables_init_net,
613d0776 6654 .exit = nf_tables_exit_net,
99633ab2
PNA		 6655};
6656
96518518
PM		 6657static int __init nf_tables_module_init(void)
6658{
6659 int err;
6660
6661 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
6662 GFP_KERNEL);
6663 if (info == NULL) {
6664 err = -ENOMEM;
6665 goto err1;
6666 }
6667
6668 err = nf_tables_core_module_init();
6669 if (err < 0)
6670 goto err2;
6671
6672 err = nfnetlink_subsys_register(&nf_tables_subsys);
6673 if (err < 0)
6674 goto err3;
6675
3b49e2e9
PNA		 6676 register_netdevice_notifier(&nf_tables_flowtable_notifier);
6677
96518518 6678 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
99633ab2 6679 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 6680err3:
6681 nf_tables_core_module_exit();
6682err2:
6683 kfree(info);
6684err1:
6685 return err;
6686}
6687
6688static void __exit nf_tables_module_exit(void)
6689{
99633ab2 6690 unregister_pernet_subsys(&nf_tables_net_ops);
96518518 6691 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 6692 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
1b1bc49c 6693 rcu_barrier();
96518518
PM		 6694 nf_tables_core_module_exit();
6695 kfree(info);
6696}
6697
6698module_init(nf_tables_module_init);
6699module_exit(nf_tables_module_exit);
6700
6701MODULE_LICENSE("GPL");
6702MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
6703MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror