]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_conntrack_h323: restore boundary check correctness
[mirror_ubuntu-jammy-kernel.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
0eb71a9d 17#include <linux/rhashtable.h>
96518518
PM		 18#include <linux/netfilter.h>
19#include <linux/netfilter/nfnetlink.h>
20#include <linux/netfilter/nf_tables.h>
3b49e2e9 21#include <net/netfilter/nf_flow_table.h>
96518518
PM		 22#include <net/netfilter/nf_tables_core.h>
23#include <net/netfilter/nf_tables.h>
99633ab2 24#include <net/net_namespace.h>
96518518
PM		 25#include <net/sock.h>
26
96518518 27static LIST_HEAD(nf_tables_expressions);
e5009240 28static LIST_HEAD(nf_tables_objects);
3b49e2e9 29static LIST_HEAD(nf_tables_flowtables);
0935d558
FW		 30static LIST_HEAD(nf_tables_destroy_list);
31static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
3ecbfd65 32static u64 table_handle;
96518518 33
a654de8f
PNA		 34enum {
35 NFT_VALIDATE_SKIP = 0,
36 NFT_VALIDATE_NEED,
37 NFT_VALIDATE_DO,
38};
39
4d44175a
FW		 40static struct rhltable nft_objname_ht;
41
1b2470e5
FW		 42static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
43static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
44static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
45
4d44175a
FW		 46static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
47static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
48static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
49
1b2470e5
FW		 50static const struct rhashtable_params nft_chain_ht_params = {
51 .head_offset = offsetof(struct nft_chain, rhlhead),
52 .key_offset = offsetof(struct nft_chain, name),
53 .hashfn = nft_chain_hash,
54 .obj_hashfn = nft_chain_hash_obj,
55 .obj_cmpfn = nft_chain_hash_cmp,
56 .locks_mul = 1,
57 .automatic_shrinking = true,
58};
59
4d44175a
FW		 60static const struct rhashtable_params nft_objname_ht_params = {
61 .head_offset = offsetof(struct nft_object, rhlhead),
62 .key_offset = offsetof(struct nft_object, key),
63 .hashfn = nft_objname_hash,
64 .obj_hashfn = nft_objname_hash_obj,
65 .obj_cmpfn = nft_objname_hash_cmp,
66 .automatic_shrinking = true,
67};
68
a654de8f
PNA		 69static void nft_validate_state_update(struct net *net, u8 new_validate_state)
70{
71 switch (net->nft.validate_state) {
72 case NFT_VALIDATE_SKIP:
73 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
74 break;
75 case NFT_VALIDATE_NEED:
76 break;
77 case NFT_VALIDATE_DO:
78 if (new_validate_state == NFT_VALIDATE_NEED)
79 return;
80 }
81
82 net->nft.validate_state = new_validate_state;
83}
0935d558
FW		 84static void nf_tables_trans_destroy_work(struct work_struct *w);
85static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
a654de8f 86
7c95f6d8 87static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 88 struct net *net,
7c95f6d8
PNA		 89 const struct sk_buff *skb,
90 const struct nlmsghdr *nlh,
36596dad 91 u8 family,
7c95f6d8
PNA		 92 struct nft_table *table,
93 struct nft_chain *chain,
94 const struct nlattr * const *nla)
95{
633c9a84 96 ctx->net = net;
36596dad 97 ctx->family = family;
26b2f552 98 ctx->level = 0;
128ad332
PNA		 99 ctx->table = table;
100 ctx->chain = chain;
101 ctx->nla = nla;
102 ctx->portid = NETLINK_CB(skb).portid;
103 ctx->report = nlmsg_report(nlh);
104 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 105}
106
8411b644
PNA		 107static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
108 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 109{
110 struct nft_trans *trans;
111
8411b644 112 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 113 if (trans == NULL)
114 return NULL;
115
b380e5c7 116 trans->msg_type = msg_type;
1081d11b
PNA		 117 trans->ctx = *ctx;
118
119 return trans;
120}
121
8411b644
PNA		 122static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
123 int msg_type, u32 size)
124{
125 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
126}
127
1081d11b
PNA		 128static void nft_trans_destroy(struct nft_trans *trans)
129{
130 list_del(&trans->list);
131 kfree(trans);
132}
133
f6ac8585
PNA		 134static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
135{
136 struct net *net = ctx->net;
137 struct nft_trans *trans;
138
139 if (!nft_set_is_anonymous(set))
140 return;
141
142 list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
143 if (trans->msg_type == NFT_MSG_NEWSET &&
144 nft_trans_set(trans) == set) {
40ba1d9b 145 set->bound = true;
f6ac8585
PNA		 146 break;
147 }
148 }
149}
150
c974a3a3
PNA		 151static int nf_tables_register_hook(struct net *net,
152 const struct nft_table *table,
153 struct nft_chain *chain)
d8ee8f7c 154{
4e25ceb8 155 const struct nft_base_chain *basechain;
a37061a6 156 const struct nf_hook_ops *ops;
ae6153b5 157
d8ee8f7c 158 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 159 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 160 return 0;
161
4e25ceb8
FW		 162 basechain = nft_base_chain(chain);
163 ops = &basechain->ops;
ae6153b5 164
4e25ceb8
FW		 165 if (basechain->type->ops_register)
166 return basechain->type->ops_register(net, ops);
167
a37061a6 168 return nf_register_net_hook(net, ops);
d8ee8f7c
PNA		 169}
170
c974a3a3
PNA		 171static void nf_tables_unregister_hook(struct net *net,
172 const struct nft_table *table,
173 struct nft_chain *chain)
c5598794 174{
4e25ceb8
FW		 175 const struct nft_base_chain *basechain;
176 const struct nf_hook_ops *ops;
177
d8ee8f7c 178 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 179 !nft_is_base_chain(chain))
d8ee8f7c 180 return;
4e25ceb8
FW		 181 basechain = nft_base_chain(chain);
182 ops = &basechain->ops;
d8ee8f7c 183
4e25ceb8
FW		 184 if (basechain->type->ops_unregister)
185 return basechain->type->ops_unregister(net, ops);
186
187 nf_unregister_net_hook(net, ops);
c5598794
AB		 188}
189
ee01d542
AB		 190static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
191{
192 struct nft_trans *trans;
193
194 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
195 if (trans == NULL)
196 return -ENOMEM;
197
198 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 199 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 200
201 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
202 return 0;
203}
204
205static int nft_deltable(struct nft_ctx *ctx)
206{
207 int err;
208
209 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
210 if (err < 0)
211 return err;
212
f2a6d766 213 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 214 return err;
215}
216
66293c46 217static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
ee01d542
AB		 218{
219 struct nft_trans *trans;
220
221 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
222 if (trans == NULL)
66293c46 223 return ERR_PTR(-ENOMEM);
ee01d542
AB		 224
225 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 226 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 227
228 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
66293c46 229 return trans;
ee01d542
AB		 230}
231
232static int nft_delchain(struct nft_ctx *ctx)
233{
66293c46 234 struct nft_trans *trans;
ee01d542 235
66293c46
FW		 236 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
237 if (IS_ERR(trans))
238 return PTR_ERR(trans);
ee01d542
AB		 239
240 ctx->table->use--;
664b0f8c 241 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542 242
66293c46 243 return 0;
ee01d542
AB		 244}
245
bb7b40ae
PNA		 246static void nft_rule_expr_activate(const struct nft_ctx *ctx,
247 struct nft_rule *rule)
248{
249 struct nft_expr *expr;
250
251 expr = nft_expr_first(rule);
252 while (expr != nft_expr_last(rule) && expr->ops) {
253 if (expr->ops->activate)
254 expr->ops->activate(ctx, expr);
255
256 expr = nft_expr_next(expr);
257 }
258}
259
260static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
f6ac8585
PNA		 261 struct nft_rule *rule,
262 enum nft_trans_phase phase)
bb7b40ae
PNA		 263{
264 struct nft_expr *expr;
265
266 expr = nft_expr_first(rule);
267 while (expr != nft_expr_last(rule) && expr->ops) {
268 if (expr->ops->deactivate)
f6ac8585 269 expr->ops->deactivate(ctx, expr, phase);
bb7b40ae
PNA		 270
271 expr = nft_expr_next(expr);
272 }
273}
274
ee01d542
AB		 275static int
276nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
277{
278 /* You cannot delete the same rule twice */
889f7ee7
PNA		 279 if (nft_is_active_next(ctx->net, rule)) {
280 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 281 ctx->chain->use--;
282 return 0;
283 }
284 return -ENOENT;
285}
286
287static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
288 struct nft_rule *rule)
289{
290 struct nft_trans *trans;
291
292 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
293 if (trans == NULL)
294 return NULL;
295
1a94e38d
PNA		 296 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
297 nft_trans_rule_id(trans) =
298 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
299 }
ee01d542
AB		 300 nft_trans_rule(trans) = rule;
301 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
302
303 return trans;
304}
305
306static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
307{
308 struct nft_trans *trans;
309 int err;
310
311 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
312 if (trans == NULL)
313 return -ENOMEM;
314
315 err = nf_tables_delrule_deactivate(ctx, rule);
316 if (err < 0) {
317 nft_trans_destroy(trans);
318 return err;
319 }
f6ac8585 320 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
ee01d542
AB		 321
322 return 0;
323}
324
325static int nft_delrule_by_chain(struct nft_ctx *ctx)
326{
327 struct nft_rule *rule;
328 int err;
329
330 list_for_each_entry(rule, &ctx->chain->rules, list) {
23b7ca4f
PNA		 331 if (!nft_is_active_next(ctx->net, rule))
332 continue;
333
ee01d542
AB		 334 err = nft_delrule(ctx, rule);
335 if (err < 0)
336 return err;
337 }
338 return 0;
339}
340
cd5125d8 341static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
ee01d542
AB		 342 struct nft_set *set)
343{
344 struct nft_trans *trans;
345
346 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
347 if (trans == NULL)
348 return -ENOMEM;
349
350 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
351 nft_trans_set_id(trans) =
352 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 353 nft_activate_next(ctx->net, set);
ee01d542
AB		 354 }
355 nft_trans_set(trans) = set;
356 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
357
358 return 0;
359}
360
cd5125d8 361static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
ee01d542
AB		 362{
363 int err;
364
365 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
366 if (err < 0)
367 return err;
368
37a9cc52 369 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 370 ctx->table->use--;
371
372 return err;
373}
374
e5009240
PNA		 375static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
376 struct nft_object *obj)
377{
378 struct nft_trans *trans;
379
380 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
381 if (trans == NULL)
382 return -ENOMEM;
383
384 if (msg_type == NFT_MSG_NEWOBJ)
385 nft_activate_next(ctx->net, obj);
386
387 nft_trans_obj(trans) = obj;
388 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
389
390 return 0;
391}
392
393static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
394{
395 int err;
396
397 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
398 if (err < 0)
399 return err;
400
401 nft_deactivate_next(ctx->net, obj);
402 ctx->table->use--;
403
404 return err;
405}
406
3b49e2e9
PNA		 407static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
408 struct nft_flowtable *flowtable)
409{
410 struct nft_trans *trans;
411
412 trans = nft_trans_alloc(ctx, msg_type,
413 sizeof(struct nft_trans_flowtable));
414 if (trans == NULL)
415 return -ENOMEM;
416
417 if (msg_type == NFT_MSG_NEWFLOWTABLE)
418 nft_activate_next(ctx->net, flowtable);
419
420 nft_trans_flowtable(trans) = flowtable;
421 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
422
423 return 0;
424}
425
426static int nft_delflowtable(struct nft_ctx *ctx,
427 struct nft_flowtable *flowtable)
428{
429 int err;
430
431 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
432 if (err < 0)
433 return err;
434
435 nft_deactivate_next(ctx->net, flowtable);
436 ctx->table->use--;
437
438 return err;
439}
440
96518518
PM		 441/*
442 * Tables
443 */
444
36596dad 445static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 446 const struct nlattr *nla,
36596dad 447 u8 family, u8 genmask)
96518518
PM		 448{
449 struct nft_table *table;
450
cac20fcd
PNA		 451 if (nla == NULL)
452 return ERR_PTR(-EINVAL);
453
d9adf22a 454 list_for_each_entry_rcu(table, &net->nft.tables, list) {
f2a6d766 455 if (!nla_strcmp(nla, table->name) &&
98319cb9 456 table->family == family &&
f2a6d766 457 nft_active_genmask(table, genmask))
96518518
PM		 458 return table;
459 }
cac20fcd
PNA		 460
461 return ERR_PTR(-ENOENT);
96518518
PM		 462}
463
3ecbfd65
HS		 464static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
465 const struct nlattr *nla,
466 u8 genmask)
467{
468 struct nft_table *table;
469
470 list_for_each_entry(table, &net->nft.tables, list) {
471 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
472 nft_active_genmask(table, genmask))
473 return table;
474 }
3ecbfd65
HS		 475
476 return ERR_PTR(-ENOENT);
477}
478
96518518
PM		 479static inline u64 nf_tables_alloc_handle(struct nft_table *table)
480{
481 return ++table->hgenerator;
482}
483
32537e91 484static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 485
32537e91 486static const struct nft_chain_type *
1ea26cca 487__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 488{
489 int i;
490
baae3e62 491 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 492 if (chain_type[family][i] != NULL &&
493 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 494 return chain_type[family][i];
9370761c 495 }
baae3e62 496 return NULL;
9370761c
PNA		 497}
498
452238e8
FW		 499/*
500 * Loading a module requires dropping mutex that guards the
501 * transaction.
502 * We first need to abort any pending transactions as once
503 * mutex is unlocked a different client could start a new
504 * transaction. It must not see any 'future generation'
505 * changes * as these changes will never happen.
506 */
507#ifdef CONFIG_MODULES
508static int __nf_tables_abort(struct net *net);
509
510static void nft_request_module(struct net *net, const char *fmt, ...)
511{
512 char module_name[MODULE_NAME_LEN];
513 va_list args;
514 int ret;
515
516 __nf_tables_abort(net);
517
518 va_start(args, fmt);
519 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
520 va_end(args);
521 if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
522 return;
523
f102d66b 524 mutex_unlock(&net->nft.commit_mutex);
452238e8 525 request_module("%s", module_name);
f102d66b 526 mutex_lock(&net->nft.commit_mutex);
452238e8
FW		 527}
528#endif
529
f102d66b
FW		 530static void lockdep_nfnl_nft_mutex_not_held(void)
531{
532#ifdef CONFIG_PROVE_LOCKING
533 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
534#endif
535}
536
32537e91 537static const struct nft_chain_type *
452238e8
FW		 538nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
539 u8 family, bool autoload)
9370761c 540{
32537e91 541 const struct nft_chain_type *type;
9370761c 542
1ea26cca 543 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 544 if (type != NULL)
545 return type;
f102d66b
FW		 546
547 lockdep_nfnl_nft_mutex_not_held();
9370761c 548#ifdef CONFIG_MODULES
93b0806f 549 if (autoload) {
452238e8
FW		 550 nft_request_module(net, "nft-chain-%u-%.*s", family,
551 nla_len(nla), (const char *)nla_data(nla));
1ea26cca 552 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 553 if (type != NULL)
554 return ERR_PTR(-EAGAIN);
9370761c
PNA		 555 }
556#endif
93b0806f 557 return ERR_PTR(-ENOENT);
9370761c
PNA		 558}
559
96518518 560static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 561 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
562 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 563 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 564 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 565};
566
84d7fce6
PNA		 567static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
568 u32 portid, u32 seq, int event, u32 flags,
569 int family, const struct nft_table *table)
96518518
PM		 570{
571 struct nlmsghdr *nlh;
572 struct nfgenmsg *nfmsg;
573
dedb67c4 574 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 575 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
576 if (nlh == NULL)
577 goto nla_put_failure;
578
579 nfmsg = nlmsg_data(nlh);
580 nfmsg->nfgen_family = family;
581 nfmsg->version = NFNETLINK_V0;
84d7fce6 582 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 583
9ddf6323 584 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 585 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 586 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
587 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
588 NFTA_TABLE_PAD))
96518518
PM		 589 goto nla_put_failure;
590
053c095a
JB		 591 nlmsg_end(skb, nlh);
592 return 0;
96518518
PM		 593
594nla_put_failure:
595 nlmsg_trim(skb, nlh);
596 return -1;
597}
598
25e94a99 599static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 600{
601 struct sk_buff *skb;
96518518
PM		 602 int err;
603
128ad332
PNA		 604 if (!ctx->report &&
605 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 606 return;
96518518 607
96518518
PM		 608 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
609 if (skb == NULL)
610 goto err;
611
84d7fce6 612 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 613 event, 0, ctx->family, ctx->table);
96518518
PM		 614 if (err < 0) {
615 kfree_skb(skb);
616 goto err;
617 }
618
25e94a99
PNA		 619 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
620 ctx->report, GFP_KERNEL);
621 return;
96518518 622err:
25e94a99 623 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 624}
625
626static int nf_tables_dump_tables(struct sk_buff *skb,
627 struct netlink_callback *cb)
628{
629 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 630 const struct nft_table *table;
631 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 632 struct net *net = sock_net(skb->sk);
96518518
PM		 633 int family = nfmsg->nfgen_family;
634
e688a7f8 635 rcu_read_lock();
38e029f1
PNA		 636 cb->seq = net->nft.base_seq;
637
36596dad 638 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 639 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 640 continue;
641
36596dad
PNA		 642 if (idx < s_idx)
643 goto cont;
644 if (idx > s_idx)
645 memset(&cb->args[1], 0,
646 sizeof(cb->args) - sizeof(cb->args[0]));
647 if (!nft_is_active(net, table))
648 continue;
649 if (nf_tables_fill_table_info(skb, net,
650 NETLINK_CB(cb->skb).portid,
651 cb->nlh->nlmsg_seq,
652 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 653 table->family, table) < 0)
36596dad
PNA		 654 goto done;
655
656 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 657cont:
36596dad 658 idx++;
96518518
PM		 659 }
660done:
e688a7f8 661 rcu_read_unlock();
96518518
PM		 662 cb->args[0] = idx;
663 return skb->len;
664}
665
d9adf22a
FW		 666static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
667 const struct nlmsghdr *nlh,
668 struct netlink_dump_control *c)
669{
670 int err;
671
672 if (!try_module_get(THIS_MODULE))
673 return -EINVAL;
674
675 rcu_read_unlock();
676 err = netlink_dump_start(nlsk, skb, nlh, c);
677 rcu_read_lock();
678 module_put(THIS_MODULE);
679
680 return err;
681}
682
683/* called with rcu_read_lock held */
7b8002a1
PNA		 684static int nf_tables_gettable(struct net *net, struct sock *nlsk,
685 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 686 const struct nlattr * const nla[],
687 struct netlink_ext_ack *extack)
96518518
PM		 688{
689 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 690 u8 genmask = nft_genmask_cur(net);
96518518
PM		 691 const struct nft_table *table;
692 struct sk_buff *skb2;
693 int family = nfmsg->nfgen_family;
694 int err;
695
696 if (nlh->nlmsg_flags & NLM_F_DUMP) {
697 struct netlink_dump_control c = {
698 .dump = nf_tables_dump_tables,
d9adf22a 699 .module = THIS_MODULE,
96518518 700 };
d9adf22a
FW		 701
702 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 703 }
704
cac20fcd 705 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 706 if (IS_ERR(table)) {
707 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 708 return PTR_ERR(table);
36dd1bcc 709 }
96518518 710
d9adf22a 711 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 712 if (!skb2)
713 return -ENOMEM;
714
84d7fce6 715 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 716 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
717 family, table);
718 if (err < 0)
719 goto err;
720
721 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
722
723err:
724 kfree_skb(skb2);
725 return err;
726}
727
c9c17211 728static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 729{
730 struct nft_chain *chain;
731 u32 i = 0;
732
733 list_for_each_entry(chain, &table->chains, list) {
734 if (!nft_is_active_next(net, chain))
735 continue;
f323d954 736 if (!nft_is_base_chain(chain))
10435c11
F		 737 continue;
738
739 if (cnt && i++ == cnt)
740 break;
741
c974a3a3 742 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
10435c11
F		 743 }
744}
745
c9c17211 746static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 747{
748 struct nft_chain *chain;
749 int err, i = 0;
750
751 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 752 if (!nft_is_active_next(net, chain))
753 continue;
f323d954 754 if (!nft_is_base_chain(chain))
d2012975
PNA		 755 continue;
756
c974a3a3 757 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
9ddf6323
PNA		 758 if (err < 0)
759 goto err;
760
761 i++;
762 }
763 return 0;
764err:
10435c11 765 if (i)
c9c17211 766 nft_table_disable(net, table, i);
9ddf6323
PNA		 767 return err;
768}
769
c9c17211 770static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 771{
c9c17211 772 nft_table_disable(net, table, 0);
9ddf6323
PNA		 773}
774
e1aaca93 775static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 776{
55dd6f93 777 struct nft_trans *trans;
e1aaca93 778 u32 flags;
55dd6f93 779 int ret = 0;
9ddf6323 780
e1aaca93
PNA		 781 if (!ctx->nla[NFTA_TABLE_FLAGS])
782 return 0;
9ddf6323 783
e1aaca93
PNA		 784 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
785 if (flags & ~NFT_TABLE_F_DORMANT)
786 return -EINVAL;
787
63283dd2
PNA		 788 if (flags == ctx->table->flags)
789 return 0;
790
55dd6f93
PNA		 791 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
792 sizeof(struct nft_trans_table));
793 if (trans == NULL)
794 return -ENOMEM;
9ddf6323 795
e1aaca93
PNA		 796 if ((flags & NFT_TABLE_F_DORMANT) &&
797 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 798 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 799 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
800 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 801 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 802 if (ret >= 0) {
e1aaca93 803 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 804 nft_trans_table_enable(trans) = true;
9ddf6323 805 }
9ddf6323 806 }
e1aaca93
PNA		 807 if (ret < 0)
808 goto err;
9ddf6323 809
55dd6f93
PNA		 810 nft_trans_table_update(trans) = true;
811 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
812 return 0;
9ddf6323 813err:
55dd6f93 814 nft_trans_destroy(trans);
9ddf6323
PNA		 815 return ret;
816}
817
1b2470e5
FW		 818static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
819{
820 const char *name = data;
821
822 return jhash(name, strlen(name), seed);
823}
824
825static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
826{
827 const struct nft_chain *chain = data;
828
829 return nft_chain_hash(chain->name, 0, seed);
830}
831
832static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
833 const void *ptr)
834{
835 const struct nft_chain *chain = ptr;
836 const char *name = arg->key;
837
838 return strcmp(chain->name, name);
839}
840
4d44175a
FW		 841static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
842{
843 const struct nft_object_hash_key *k = data;
844
845 seed ^= hash_ptr(k->table, 32);
846
847 return jhash(k->name, strlen(k->name), seed);
848}
849
850static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
851{
852 const struct nft_object *obj = data;
853
854 return nft_objname_hash(&obj->key, 0, seed);
855}
856
857static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
858 const void *ptr)
859{
860 const struct nft_object_hash_key *k = arg->key;
861 const struct nft_object *obj = ptr;
862
863 if (obj->key.table != k->table)
864 return -1;
865
866 return strcmp(obj->key.name, k->name);
867}
868
633c9a84
PNA		 869static int nf_tables_newtable(struct net *net, struct sock *nlsk,
870 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 871 const struct nlattr * const nla[],
872 struct netlink_ext_ack *extack)
96518518
PM		 873{
874 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 875 u8 genmask = nft_genmask_next(net);
96518518 876 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 877 const struct nlattr *attr;
878 struct nft_table *table;
c5c1f975 879 u32 flags = 0;
e1aaca93 880 struct nft_ctx ctx;
55dd6f93 881 int err;
96518518 882
f102d66b 883 lockdep_assert_held(&net->nft.commit_mutex);
36dd1bcc
PNA		 884 attr = nla[NFTA_TABLE_NAME];
885 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 886 if (IS_ERR(table)) {
887 if (PTR_ERR(table) != -ENOENT)
888 return PTR_ERR(table);
1a28ad74 889 } else {
36dd1bcc
PNA		 890 if (nlh->nlmsg_flags & NLM_F_EXCL) {
891 NL_SET_BAD_ATTR(extack, attr);
96518518 892 return -EEXIST;
36dd1bcc 893 }
96518518
PM		 894 if (nlh->nlmsg_flags & NLM_F_REPLACE)
895 return -EOPNOTSUPP;
e1aaca93 896
98319cb9 897 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 898 return nf_tables_updtable(&ctx);
96518518
PM		 899 }
900
c5c1f975
PM		 901 if (nla[NFTA_TABLE_FLAGS]) {
902 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
903 if (flags & ~NFT_TABLE_F_DORMANT)
904 return -EINVAL;
905 }
906
ffdb210e 907 err = -ENOMEM;
1cae565e 908 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 909 if (table == NULL)
98319cb9 910 goto err_kzalloc;
96518518 911
36dd1bcc 912 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 913 if (table->name == NULL)
98319cb9 914 goto err_strdup;
e46abbcc 915
1b2470e5
FW		 916 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
917 if (err)
918 goto err_chain_ht;
919
96518518 920 INIT_LIST_HEAD(&table->chains);
20a69341 921 INIT_LIST_HEAD(&table->sets);
e5009240 922 INIT_LIST_HEAD(&table->objects);
3b49e2e9 923 INIT_LIST_HEAD(&table->flowtables);
98319cb9 924 table->family = family;
c5c1f975 925 table->flags = flags;
3ecbfd65 926 table->handle = ++table_handle;
9ddf6323 927
98319cb9 928 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 929 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 930 if (err < 0)
98319cb9 931 goto err_trans;
ffdb210e 932
36596dad 933 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 934 return 0;
98319cb9 935err_trans:
1b2470e5
FW		 936 rhltable_destroy(&table->chains_ht);
937err_chain_ht:
e46abbcc 938 kfree(table->name);
98319cb9 939err_strdup:
ffdb210e 940 kfree(table);
98319cb9 941err_kzalloc:
ffdb210e 942 return err;
96518518
PM		 943}
944
b9ac12ef
AB		 945static int nft_flush_table(struct nft_ctx *ctx)
946{
3b49e2e9 947 struct nft_flowtable *flowtable, *nft;
b9ac12ef 948 struct nft_chain *chain, *nc;
e5009240 949 struct nft_object *obj, *ne;
b9ac12ef 950 struct nft_set *set, *ns;
3b49e2e9 951 int err;
b9ac12ef 952
a2f18db0 953 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 954 if (!nft_is_active_next(ctx->net, chain))
955 continue;
956
b9ac12ef
AB		 957 ctx->chain = chain;
958
959 err = nft_delrule_by_chain(ctx);
960 if (err < 0)
961 goto out;
b9ac12ef
AB		 962 }
963
964 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 965 if (!nft_is_active_next(ctx->net, set))
966 continue;
967
408070d6 968 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 969 !list_empty(&set->bindings))
970 continue;
971
972 err = nft_delset(ctx, set);
973 if (err < 0)
974 goto out;
975 }
976
3b49e2e9
PNA		 977 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
978 err = nft_delflowtable(ctx, flowtable);
979 if (err < 0)
980 goto out;
981 }
982
e5009240
PNA		 983 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
984 err = nft_delobj(ctx, obj);
985 if (err < 0)
986 goto out;
987 }
988
a2f18db0 989 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 990 if (!nft_is_active_next(ctx->net, chain))
991 continue;
992
a2f18db0
PNA		 993 ctx->chain = chain;
994
995 err = nft_delchain(ctx);
996 if (err < 0)
997 goto out;
998 }
999
b9ac12ef
AB		 1000 err = nft_deltable(ctx);
1001out:
1002 return err;
1003}
1004
1005static int nft_flush(struct nft_ctx *ctx, int family)
1006{
b9ac12ef
AB		 1007 struct nft_table *table, *nt;
1008 const struct nlattr * const *nla = ctx->nla;
1009 int err = 0;
1010
36596dad 1011 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 1012 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 1013 continue;
1014
98319cb9 1015 ctx->family = table->family;
f2a6d766 1016
36596dad
PNA		 1017 if (!nft_is_active_next(ctx->net, table))
1018 continue;
b9ac12ef 1019
36596dad
PNA		 1020 if (nla[NFTA_TABLE_NAME] &&
1021 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1022 continue;
b9ac12ef 1023
36596dad
PNA		 1024 ctx->table = table;
1025
1026 err = nft_flush_table(ctx);
1027 if (err < 0)
1028 goto out;
b9ac12ef
AB		 1029 }
1030out:
1031 return err;
1032}
1033
633c9a84
PNA		 1034static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1035 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1036 const struct nlattr * const nla[],
1037 struct netlink_ext_ack *extack)
96518518
PM		 1038{
1039 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1040 u8 genmask = nft_genmask_next(net);
ee01d542 1041 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 1042 const struct nlattr *attr;
1043 struct nft_table *table;
55dd6f93 1044 struct nft_ctx ctx;
96518518 1045
36596dad 1046 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 1047 if (family == AF_UNSPEC ||
1048 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 1049 return nft_flush(&ctx, family);
1050
36dd1bcc
PNA		 1051 if (nla[NFTA_TABLE_HANDLE]) {
1052 attr = nla[NFTA_TABLE_HANDLE];
1053 table = nft_table_lookup_byhandle(net, attr, genmask);
1054 } else {
1055 attr = nla[NFTA_TABLE_NAME];
1056 table = nft_table_lookup(net, attr, family, genmask);
1057 }
3ecbfd65 1058
36dd1bcc
PNA		 1059 if (IS_ERR(table)) {
1060 NL_SET_BAD_ATTR(extack, attr);
96518518 1061 return PTR_ERR(table);
36dd1bcc 1062 }
96518518 1063
a8278400
PNA		 1064 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1065 table->use > 0)
1066 return -EBUSY;
1067
98319cb9 1068 ctx.family = family;
b9ac12ef 1069 ctx.table = table;
55dd6f93 1070
b9ac12ef 1071 return nft_flush_table(&ctx);
96518518
PM		 1072}
1073
55dd6f93
PNA		 1074static void nf_tables_table_destroy(struct nft_ctx *ctx)
1075{
fa5950e4
FW		 1076 if (WARN_ON(ctx->table->use > 0))
1077 return;
4fefee57 1078
1b2470e5 1079 rhltable_destroy(&ctx->table->chains_ht);
e46abbcc 1080 kfree(ctx->table->name);
55dd6f93 1081 kfree(ctx->table);
55dd6f93
PNA		 1082}
1083
cc07eeb0 1084void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 1085{
d8297d4f 1086 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
cc07eeb0 1087 return;
d8297d4f 1088
96518518 1089 nfnl_lock(NFNL_SUBSYS_NFTABLES);
cc07eeb0
PNA		 1090 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
1091 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1092 return;
96518518 1093 }
9370761c 1094 chain_type[ctype->family][ctype->type] = ctype;
96518518 1095 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 1096}
9370761c 1097EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 1098
32537e91 1099void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 1100{
96518518 1101 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 1102 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 1103 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1104}
9370761c 1105EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 1106
1107/*
1108 * Chains
1109 */
1110
1111static struct nft_chain *
cac20fcd 1112nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 1113{
1114 struct nft_chain *chain;
1115
1116 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 1117 if (chain->handle == handle &&
1118 nft_active_genmask(chain, genmask))
96518518
PM		 1119 return chain;
1120 }
1121
1122 return ERR_PTR(-ENOENT);
1123}
1124
4d44175a 1125static bool lockdep_commit_lock_is_held(const struct net *net)
f102d66b
FW		 1126{
1127#ifdef CONFIG_PROVE_LOCKING
1128 return lockdep_is_held(&net->nft.commit_mutex);
1129#else
1130 return true;
1131#endif
1132}
1133
1134static struct nft_chain *nft_chain_lookup(struct net *net,
1135 struct nft_table *table,
cac20fcd 1136 const struct nlattr *nla, u8 genmask)
96518518 1137{
1b2470e5
FW		 1138 char search[NFT_CHAIN_MAXNAMELEN + 1];
1139 struct rhlist_head *tmp, *list;
96518518
PM		 1140 struct nft_chain *chain;
1141
1142 if (nla == NULL)
1143 return ERR_PTR(-EINVAL);
1144
1b2470e5 1145 nla_strlcpy(search, nla, sizeof(search));
96518518 1146
1b2470e5 1147 WARN_ON(!rcu_read_lock_held() &&
f102d66b 1148 !lockdep_commit_lock_is_held(net));
1b2470e5
FW		 1149
1150 chain = ERR_PTR(-ENOENT);
1151 rcu_read_lock();
1152 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1153 if (!list)
1154 goto out_unlock;
1155
1156 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1157 if (nft_active_genmask(chain, genmask))
1158 goto out_unlock;
1159 }
1160 chain = ERR_PTR(-ENOENT);
1161out_unlock:
1162 rcu_read_unlock();
1163 return chain;
96518518
PM		 1164}
1165
1166static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 1167 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1168 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1169 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1170 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1171 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1172 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 1173 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 1174 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 1175 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 1176};
1177
1178static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1179 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1180 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1181 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1182 .len = IFNAMSIZ - 1 },
96518518
PM		 1183};
1184
0ca743a5
PNA		 1185static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1186{
1187 struct nft_stats *cpu_stats, total;
1188 struct nlattr *nest;
ce355e20
ED		 1189 unsigned int seq;
1190 u64 pkts, bytes;
0ca743a5
PNA		 1191 int cpu;
1192
1193 memset(&total, 0, sizeof(total));
1194 for_each_possible_cpu(cpu) {
1195 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1196 do {
1197 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1198 pkts = cpu_stats->pkts;
1199 bytes = cpu_stats->bytes;
1200 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1201 total.pkts += pkts;
1202 total.bytes += bytes;
0ca743a5
PNA		 1203 }
1204 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1205 if (nest == NULL)
1206 goto nla_put_failure;
1207
b46f6ded
ND		 1208 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1209 NFTA_COUNTER_PAD) ||
1210 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1211 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1212 goto nla_put_failure;
1213
1214 nla_nest_end(skb, nest);
1215 return 0;
1216
1217nla_put_failure:
1218 return -ENOSPC;
1219}
1220
84d7fce6
PNA		 1221static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1222 u32 portid, u32 seq, int event, u32 flags,
1223 int family, const struct nft_table *table,
96518518
PM		 1224 const struct nft_chain *chain)
1225{
1226 struct nlmsghdr *nlh;
1227 struct nfgenmsg *nfmsg;
1228
dedb67c4 1229 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1230 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1231 if (nlh == NULL)
1232 goto nla_put_failure;
1233
1234 nfmsg = nlmsg_data(nlh);
1235 nfmsg->nfgen_family = family;
1236 nfmsg->version = NFNETLINK_V0;
84d7fce6 1237 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1238
1239 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1240 goto nla_put_failure;
b46f6ded
ND		 1241 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1242 NFTA_CHAIN_PAD))
96518518
PM		 1243 goto nla_put_failure;
1244 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1245 goto nla_put_failure;
1246
f323d954 1247 if (nft_is_base_chain(chain)) {
0ca743a5 1248 const struct nft_base_chain *basechain = nft_base_chain(chain);
c974a3a3 1249 const struct nf_hook_ops *ops = &basechain->ops;
0ca743a5
PNA		 1250 struct nlattr *nest;
1251
1252 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1253 if (nest == NULL)
1254 goto nla_put_failure;
1255 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1256 goto nla_put_failure;
1257 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1258 goto nla_put_failure;
2cbce139
PNA		 1259 if (basechain->dev_name[0] &&
1260 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1261 goto nla_put_failure;
96518518 1262 nla_nest_end(skb, nest);
9370761c 1263
0ca743a5
PNA		 1264 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1265 htonl(basechain->policy)))
1266 goto nla_put_failure;
1267
baae3e62
PM		 1268 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1269 goto nla_put_failure;
0ca743a5 1270
4c05ec47
TY		 1271 if (rcu_access_pointer(basechain->stats) &&
1272 nft_dump_stats(skb, rcu_dereference(basechain->stats)))
0ca743a5 1273 goto nla_put_failure;
96518518
PM		 1274 }
1275
0ca743a5
PNA		 1276 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1277 goto nla_put_failure;
1278
053c095a
JB		 1279 nlmsg_end(skb, nlh);
1280 return 0;
96518518
PM		 1281
1282nla_put_failure:
1283 nlmsg_trim(skb, nlh);
1284 return -1;
1285}
1286
25e94a99 1287static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1288{
1289 struct sk_buff *skb;
96518518
PM		 1290 int err;
1291
128ad332
PNA		 1292 if (!ctx->report &&
1293 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1294 return;
96518518 1295
96518518
PM		 1296 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1297 if (skb == NULL)
1298 goto err;
1299
84d7fce6 1300 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1301 event, 0, ctx->family, ctx->table,
35151d84 1302 ctx->chain);
96518518
PM		 1303 if (err < 0) {
1304 kfree_skb(skb);
1305 goto err;
1306 }
1307
25e94a99
PNA		 1308 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1309 ctx->report, GFP_KERNEL);
1310 return;
96518518 1311err:
25e94a99 1312 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1313}
1314
1315static int nf_tables_dump_chains(struct sk_buff *skb,
1316 struct netlink_callback *cb)
1317{
1318 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1319 const struct nft_table *table;
1320 const struct nft_chain *chain;
1321 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1322 struct net *net = sock_net(skb->sk);
96518518
PM		 1323 int family = nfmsg->nfgen_family;
1324
e688a7f8 1325 rcu_read_lock();
38e029f1
PNA		 1326 cb->seq = net->nft.base_seq;
1327
36596dad 1328 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1329 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1330 continue;
1331
36596dad
PNA		 1332 list_for_each_entry_rcu(chain, &table->chains, list) {
1333 if (idx < s_idx)
1334 goto cont;
1335 if (idx > s_idx)
1336 memset(&cb->args[1], 0,
1337 sizeof(cb->args) - sizeof(cb->args[0]));
1338 if (!nft_is_active(net, chain))
1339 continue;
1340 if (nf_tables_fill_chain_info(skb, net,
1341 NETLINK_CB(cb->skb).portid,
1342 cb->nlh->nlmsg_seq,
1343 NFT_MSG_NEWCHAIN,
1344 NLM_F_MULTI,
98319cb9 1345 table->family, table,
36596dad
PNA		 1346 chain) < 0)
1347 goto done;
38e029f1 1348
36596dad 1349 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1350cont:
36596dad 1351 idx++;
96518518
PM		 1352 }
1353 }
1354done:
e688a7f8 1355 rcu_read_unlock();
96518518
PM		 1356 cb->args[0] = idx;
1357 return skb->len;
1358}
1359
d9adf22a 1360/* called with rcu_read_lock held */
7b8002a1
PNA		 1361static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1362 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1363 const struct nlattr * const nla[],
1364 struct netlink_ext_ack *extack)
96518518
PM		 1365{
1366 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1367 u8 genmask = nft_genmask_cur(net);
96518518 1368 const struct nft_chain *chain;
1b2470e5 1369 struct nft_table *table;
96518518
PM		 1370 struct sk_buff *skb2;
1371 int family = nfmsg->nfgen_family;
1372 int err;
1373
1374 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1375 struct netlink_dump_control c = {
1376 .dump = nf_tables_dump_chains,
d9adf22a 1377 .module = THIS_MODULE,
96518518 1378 };
d9adf22a
FW		 1379
1380 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 1381 }
1382
cac20fcd 1383 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1384 if (IS_ERR(table)) {
1385 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1386 return PTR_ERR(table);
36dd1bcc 1387 }
96518518 1388
f102d66b 1389 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1390 if (IS_ERR(chain)) {
1391 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1392 return PTR_ERR(chain);
36dd1bcc 1393 }
96518518 1394
d9adf22a 1395 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 1396 if (!skb2)
1397 return -ENOMEM;
1398
84d7fce6 1399 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1400 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1401 family, table, chain);
1402 if (err < 0)
1403 goto err;
1404
1405 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1406
1407err:
1408 kfree_skb(skb2);
1409 return err;
1410}
1411
0ca743a5
PNA		 1412static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1413 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1414 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1415};
1416
ff3cd7b3 1417static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1418{
1419 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1420 struct nft_stats __percpu *newstats;
1421 struct nft_stats *stats;
1422 int err;
1423
fceb6435
JB		 1424 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1425 NULL);
0ca743a5 1426 if (err < 0)
ff3cd7b3 1427 return ERR_PTR(err);
0ca743a5
PNA		 1428
1429 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1430 return ERR_PTR(-EINVAL);
0ca743a5 1431
ce355e20 1432 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1433 if (newstats == NULL)
ff3cd7b3 1434 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1435
1436 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1437 * are not exposed to userspace.
1438 */
e8781f70 1439 preempt_disable();
0ca743a5
PNA		 1440 stats = this_cpu_ptr(newstats);
1441 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1442 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1443 preempt_enable();
0ca743a5 1444
ff3cd7b3
PNA		 1445 return newstats;
1446}
1447
4c05ec47
TY		 1448static void nft_chain_stats_replace(struct net *net,
1449 struct nft_base_chain *chain,
ff3cd7b3
PNA		 1450 struct nft_stats __percpu *newstats)
1451{
0befd061
PNA		 1452 struct nft_stats __percpu *oldstats;
1453
b88825de
PNA		 1454 if (newstats == NULL)
1455 return;
1456
4c05ec47
TY		 1457 if (rcu_access_pointer(chain->stats)) {
1458 oldstats = rcu_dereference_protected(chain->stats,
1459 lockdep_commit_lock_is_held(net));
0ca743a5
PNA		 1460 rcu_assign_pointer(chain->stats, newstats);
1461 synchronize_rcu();
1462 free_percpu(oldstats);
bbb8c61f 1463 } else {
0ca743a5 1464 rcu_assign_pointer(chain->stats, newstats);
bbb8c61f
TY		 1465 static_branch_inc(&nft_counters_enabled);
1466 }
0ca743a5
PNA		 1467}
1468
0cbc06b3
FW		 1469static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1470{
1471 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1472 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1473
1474 if (g0 != g1)
1475 kvfree(g1);
1476 kvfree(g0);
1477
1478 /* should be NULL either via abort or via successful commit */
1479 WARN_ON_ONCE(chain->rules_next);
1480 kvfree(chain->rules_next);
1481}
1482
43a605f2 1483static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1484{
43a605f2
PNA		 1485 struct nft_chain *chain = ctx->chain;
1486
fa5950e4
FW		 1487 if (WARN_ON(chain->use > 0))
1488 return;
91c7b38d 1489
0cbc06b3
FW		 1490 /* no concurrent access possible anymore */
1491 nf_tables_chain_free_chain_rules(chain);
1492
f323d954 1493 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1494 struct nft_base_chain *basechain = nft_base_chain(chain);
1495
1496 module_put(basechain->type->owner);
4c05ec47 1497 if (rcu_access_pointer(basechain->stats)) {
9f08ea84 1498 static_branch_dec(&nft_counters_enabled);
4c05ec47
TY		 1499 free_percpu(rcu_dereference_raw(basechain->stats));
1500 }
b7263e07 1501 kfree(chain->name);
2cbce139 1502 kfree(basechain);
91c7b38d 1503 } else {
b7263e07 1504 kfree(chain->name);
91c7b38d
PNA		 1505 kfree(chain);
1506 }
1507}
1508
508f8ccd
PNA		 1509struct nft_chain_hook {
1510 u32 num;
84ba7dd7 1511 s32 priority;
32537e91 1512 const struct nft_chain_type *type;
508f8ccd
PNA		 1513 struct net_device *dev;
1514};
1515
1516static int nft_chain_parse_hook(struct net *net,
1517 const struct nlattr * const nla[],
36596dad 1518 struct nft_chain_hook *hook, u8 family,
445509eb 1519 bool autoload)
508f8ccd
PNA		 1520{
1521 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1522 const struct nft_chain_type *type;
508f8ccd
PNA		 1523 struct net_device *dev;
1524 int err;
1525
f102d66b
FW		 1526 lockdep_assert_held(&net->nft.commit_mutex);
1527 lockdep_nfnl_nft_mutex_not_held();
1528
508f8ccd 1529 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1530 nft_hook_policy, NULL);
508f8ccd
PNA		 1531 if (err < 0)
1532 return err;
1533
1534 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1535 ha[NFTA_HOOK_PRIORITY] == NULL)
1536 return -EINVAL;
1537
1538 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1539 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1540
36596dad 1541 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1542 if (nla[NFTA_CHAIN_TYPE]) {
452238e8 1543 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
445509eb 1544 family, autoload);
508f8ccd
PNA		 1545 if (IS_ERR(type))
1546 return PTR_ERR(type);
1547 }
33d1c018 1548 if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
508f8ccd 1549 return -EOPNOTSUPP;
84ba7dd7
FW		 1550
1551 if (type->type == NFT_CHAIN_T_NAT &&
1552 hook->priority <= NF_IP_PRI_CONNTRACK)
1553 return -EOPNOTSUPP;
1554
508f8ccd
PNA		 1555 if (!try_module_get(type->owner))
1556 return -ENOENT;
1557
1558 hook->type = type;
1559
1560 hook->dev = NULL;
36596dad 1561 if (family == NFPROTO_NETDEV) {
508f8ccd
PNA		 1562 char ifname[IFNAMSIZ];
1563
1564 if (!ha[NFTA_HOOK_DEV]) {
1565 module_put(type->owner);
1566 return -EOPNOTSUPP;
1567 }
1568
1569 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
90d2723c 1570 dev = __dev_get_by_name(net, ifname);
508f8ccd
PNA		 1571 if (!dev) {
1572 module_put(type->owner);
1573 return -ENOENT;
1574 }
1575 hook->dev = dev;
1576 } else if (ha[NFTA_HOOK_DEV]) {
1577 module_put(type->owner);
1578 return -EOPNOTSUPP;
1579 }
1580
1581 return 0;
1582}
1583
1584static void nft_chain_release_hook(struct nft_chain_hook *hook)
1585{
1586 module_put(hook->type->owner);
508f8ccd
PNA		 1587}
1588
0cbc06b3
FW		 1589struct nft_rules_old {
1590 struct rcu_head h;
1591 struct nft_rule **start;
1592};
1593
1594static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1595 unsigned int alloc)
1596{
1597 if (alloc > INT_MAX)
1598 return NULL;
1599
1600 alloc += 1; /* NULL, ends rules */
1601 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1602 return NULL;
1603
1604 alloc *= sizeof(struct nft_rule *);
1605 alloc += sizeof(struct nft_rules_old);
1606
1607 return kvmalloc(alloc, GFP_KERNEL);
1608}
1609
4035285f 1610static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
445509eb 1611 u8 policy)
4035285f
PNA		 1612{
1613 const struct nlattr * const *nla = ctx->nla;
1614 struct nft_table *table = ctx->table;
4035285f
PNA		 1615 struct nft_base_chain *basechain;
1616 struct nft_stats __percpu *stats;
1617 struct net *net = ctx->net;
66293c46 1618 struct nft_trans *trans;
4035285f 1619 struct nft_chain *chain;
0cbc06b3 1620 struct nft_rule **rules;
4035285f
PNA		 1621 int err;
1622
1623 if (table->use == UINT_MAX)
1624 return -EOVERFLOW;
1625
1626 if (nla[NFTA_CHAIN_HOOK]) {
1627 struct nft_chain_hook hook;
1628 struct nf_hook_ops *ops;
4035285f 1629
445509eb 1630 err = nft_chain_parse_hook(net, nla, &hook, family, true);
4035285f
PNA		 1631 if (err < 0)
1632 return err;
1633
1634 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1635 if (basechain == NULL) {
1636 nft_chain_release_hook(&hook);
1637 return -ENOMEM;
1638 }
1639
1640 if (hook.dev != NULL)
1641 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1642
1643 if (nla[NFTA_CHAIN_COUNTERS]) {
1644 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1645 if (IS_ERR(stats)) {
1646 nft_chain_release_hook(&hook);
1647 kfree(basechain);
1648 return PTR_ERR(stats);
1649 }
4c05ec47 1650 rcu_assign_pointer(basechain->stats, stats);
4035285f
PNA		 1651 static_branch_inc(&nft_counters_enabled);
1652 }
1653
4035285f
PNA		 1654 basechain->type = hook.type;
1655 chain = &basechain->chain;
1656
c974a3a3
PNA		 1657 ops = &basechain->ops;
1658 ops->pf = family;
1659 ops->hooknum = hook.num;
1660 ops->priority = hook.priority;
1661 ops->priv = chain;
c2f9eafe 1662 ops->hook = hook.type->hooks[ops->hooknum];
c974a3a3 1663 ops->dev = hook.dev;
c974a3a3 1664
4035285f 1665 chain->flags |= NFT_BASE_CHAIN;
66293c46 1666 basechain->policy = NF_ACCEPT;
4035285f
PNA		 1667 } else {
1668 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1669 if (chain == NULL)
1670 return -ENOMEM;
1671 }
43a605f2
PNA		 1672 ctx->chain = chain;
1673
4035285f
PNA		 1674 INIT_LIST_HEAD(&chain->rules);
1675 chain->handle = nf_tables_alloc_handle(table);
1676 chain->table = table;
1677 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1678 if (!chain->name) {
1679 err = -ENOMEM;
1680 goto err1;
1681 }
1682
0cbc06b3
FW		 1683 rules = nf_tables_chain_alloc_rules(chain, 0);
1684 if (!rules) {
1685 err = -ENOMEM;
1686 goto err1;
1687 }
1688
1689 *rules = NULL;
1690 rcu_assign_pointer(chain->rules_gen_0, rules);
1691 rcu_assign_pointer(chain->rules_gen_1, rules);
1692
c974a3a3 1693 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1694 if (err < 0)
1695 goto err1;
1696
1b2470e5
FW		 1697 err = rhltable_insert_key(&table->chains_ht, chain->name,
1698 &chain->rhlhead, nft_chain_ht_params);
1699 if (err)
1700 goto err2;
1701
66293c46
FW		 1702 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1703 if (IS_ERR(trans)) {
1704 err = PTR_ERR(trans);
1b2470e5
FW		 1705 rhltable_remove(&table->chains_ht, &chain->rhlhead,
1706 nft_chain_ht_params);
4035285f 1707 goto err2;
1b2470e5 1708 }
4035285f 1709
66293c46
FW		 1710 nft_trans_chain_policy(trans) = -1;
1711 if (nft_is_base_chain(chain))
1712 nft_trans_chain_policy(trans) = policy;
1713
4035285f
PNA		 1714 table->use++;
1715 list_add_tail_rcu(&chain->list, &table->chains);
1716
1717 return 0;
1718err2:
c974a3a3 1719 nf_tables_unregister_hook(net, table, chain);
4035285f 1720err1:
43a605f2 1721 nf_tables_chain_destroy(ctx);
4035285f
PNA		 1722
1723 return err;
1724}
1725
445509eb 1726static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy)
2c4a488a
PNA		 1727{
1728 const struct nlattr * const *nla = ctx->nla;
1729 struct nft_table *table = ctx->table;
1730 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 1731 struct nft_base_chain *basechain;
1732 struct nft_stats *stats = NULL;
1733 struct nft_chain_hook hook;
2c4a488a
PNA		 1734 struct nf_hook_ops *ops;
1735 struct nft_trans *trans;
c974a3a3 1736 int err;
2c4a488a
PNA		 1737
1738 if (nla[NFTA_CHAIN_HOOK]) {
1739 if (!nft_is_base_chain(chain))
1740 return -EBUSY;
1741
36596dad 1742 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
445509eb 1743 false);
2c4a488a
PNA		 1744 if (err < 0)
1745 return err;
1746
1747 basechain = nft_base_chain(chain);
1748 if (basechain->type != hook.type) {
1749 nft_chain_release_hook(&hook);
1750 return -EBUSY;
1751 }
1752
c974a3a3
PNA		 1753 ops = &basechain->ops;
1754 if (ops->hooknum != hook.num ||
1755 ops->priority != hook.priority ||
1756 ops->dev != hook.dev) {
1757 nft_chain_release_hook(&hook);
1758 return -EBUSY;
2c4a488a
PNA		 1759 }
1760 nft_chain_release_hook(&hook);
1761 }
1762
1763 if (nla[NFTA_CHAIN_HANDLE] &&
1764 nla[NFTA_CHAIN_NAME]) {
1765 struct nft_chain *chain2;
1766
f102d66b
FW		 1767 chain2 = nft_chain_lookup(ctx->net, table,
1768 nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 1769 if (!IS_ERR(chain2))
1770 return -EEXIST;
2c4a488a
PNA		 1771 }
1772
1773 if (nla[NFTA_CHAIN_COUNTERS]) {
1774 if (!nft_is_base_chain(chain))
1775 return -EOPNOTSUPP;
1776
1777 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1778 if (IS_ERR(stats))
1779 return PTR_ERR(stats);
1780 }
1781
c6cc94df 1782 err = -ENOMEM;
2c4a488a
PNA		 1783 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1784 sizeof(struct nft_trans_chain));
c6cc94df
FW		 1785 if (trans == NULL)
1786 goto err;
2c4a488a
PNA		 1787
1788 nft_trans_chain_stats(trans) = stats;
1789 nft_trans_chain_update(trans) = true;
1790
1791 if (nla[NFTA_CHAIN_POLICY])
1792 nft_trans_chain_policy(trans) = policy;
1793 else
1794 nft_trans_chain_policy(trans) = -1;
1795
c6cc94df
FW		 1796 if (nla[NFTA_CHAIN_HANDLE] &&
1797 nla[NFTA_CHAIN_NAME]) {
1798 struct nft_trans *tmp;
1799 char *name;
1800
1801 err = -ENOMEM;
1802 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1803 if (!name)
1804 goto err;
1805
1806 err = -EEXIST;
1807 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
1808 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
1809 tmp->ctx.table == table &&
1810 nft_trans_chain_update(tmp) &&
1811 nft_trans_chain_name(tmp) &&
1812 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
1813 kfree(name);
1814 goto err;
1815 }
2c4a488a 1816 }
c6cc94df
FW		 1817
1818 nft_trans_chain_name(trans) = name;
2c4a488a
PNA		 1819 }
1820 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1821
1822 return 0;
c6cc94df
FW		 1823err:
1824 free_percpu(stats);
1825 kfree(trans);
1826 return err;
2c4a488a
PNA		 1827}
1828
633c9a84
PNA		 1829static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1830 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1831 const struct nlattr * const nla[],
1832 struct netlink_ext_ack *extack)
96518518
PM		 1833{
1834 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 1835 u8 genmask = nft_genmask_next(net);
1836 int family = nfmsg->nfgen_family;
36dd1bcc 1837 const struct nlattr *attr;
96518518
PM		 1838 struct nft_table *table;
1839 struct nft_chain *chain;
57de2a0c 1840 u8 policy = NF_ACCEPT;
4035285f 1841 struct nft_ctx ctx;
96518518 1842 u64 handle = 0;
96518518 1843
f102d66b
FW		 1844 lockdep_assert_held(&net->nft.commit_mutex);
1845
cac20fcd 1846 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1847 if (IS_ERR(table)) {
1848 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1849 return PTR_ERR(table);
36dd1bcc 1850 }
96518518 1851
96518518 1852 chain = NULL;
36dd1bcc 1853 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 1854
1855 if (nla[NFTA_CHAIN_HANDLE]) {
1856 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 1857 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 1858 if (IS_ERR(chain)) {
1859 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 1860 return PTR_ERR(chain);
36dd1bcc
PNA		 1861 }
1862 attr = nla[NFTA_CHAIN_HANDLE];
96518518 1863 } else {
f102d66b 1864 chain = nft_chain_lookup(net, table, attr, genmask);
96518518 1865 if (IS_ERR(chain)) {
36dd1bcc
PNA		 1866 if (PTR_ERR(chain) != -ENOENT) {
1867 NL_SET_BAD_ATTR(extack, attr);
96518518 1868 return PTR_ERR(chain);
36dd1bcc 1869 }
96518518
PM		 1870 chain = NULL;
1871 }
1872 }
1873
57de2a0c 1874 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 1875 if (chain != NULL &&
36dd1bcc
PNA		 1876 !nft_is_base_chain(chain)) {
1877 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 1878 return -EOPNOTSUPP;
36dd1bcc 1879 }
d6b6cb1d
PNA		 1880
1881 if (chain == NULL &&
36dd1bcc
PNA		 1882 nla[NFTA_CHAIN_HOOK] == NULL) {
1883 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 1884 return -EOPNOTSUPP;
36dd1bcc 1885 }
57de2a0c 1886
8f46df18 1887 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1888 switch (policy) {
1889 case NF_DROP:
1890 case NF_ACCEPT:
1891 break;
1892 default:
1893 return -EINVAL;
1894 }
1895 }
1896
98319cb9 1897 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 1898
96518518 1899 if (chain != NULL) {
36dd1bcc
PNA		 1900 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1901 NL_SET_BAD_ATTR(extack, attr);
96518518 1902 return -EEXIST;
36dd1bcc 1903 }
96518518
PM		 1904 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1905 return -EOPNOTSUPP;
1906
445509eb 1907 return nf_tables_updchain(&ctx, genmask, policy);
96518518
PM		 1908 }
1909
445509eb 1910 return nf_tables_addchain(&ctx, family, genmask, policy);
96518518
PM		 1911}
1912
633c9a84
PNA		 1913static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1914 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1915 const struct nlattr * const nla[],
1916 struct netlink_ext_ack *extack)
96518518
PM		 1917{
1918 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1919 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 1920 int family = nfmsg->nfgen_family;
1921 const struct nlattr *attr;
96518518
PM		 1922 struct nft_table *table;
1923 struct nft_chain *chain;
9dee1474 1924 struct nft_rule *rule;
91c7b38d 1925 struct nft_ctx ctx;
3ecbfd65 1926 u64 handle;
9dee1474
PNA		 1927 u32 use;
1928 int err;
96518518 1929
cac20fcd 1930 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1931 if (IS_ERR(table)) {
1932 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1933 return PTR_ERR(table);
36dd1bcc 1934 }
96518518 1935
3ecbfd65 1936 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 1937 attr = nla[NFTA_CHAIN_HANDLE];
1938 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 1939 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 1940 } else {
36dd1bcc 1941 attr = nla[NFTA_CHAIN_NAME];
f102d66b 1942 chain = nft_chain_lookup(net, table, attr, genmask);
3ecbfd65 1943 }
36dd1bcc
PNA		 1944 if (IS_ERR(chain)) {
1945 NL_SET_BAD_ATTR(extack, attr);
96518518 1946 return PTR_ERR(chain);
36dd1bcc 1947 }
9dee1474
PNA		 1948
1949 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1950 chain->use > 0)
96518518
PM		 1951 return -EBUSY;
1952
98319cb9 1953 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 1954
9dee1474
PNA		 1955 use = chain->use;
1956 list_for_each_entry(rule, &chain->rules, list) {
1957 if (!nft_is_active_next(net, rule))
1958 continue;
1959 use--;
1960
1961 err = nft_delrule(&ctx, rule);
1962 if (err < 0)
1963 return err;
1964 }
1965
1966 /* There are rules and elements that are still holding references to us,
1967 * we cannot do a recursive removal in this case.
1968 */
36dd1bcc
PNA		 1969 if (use > 0) {
1970 NL_SET_BAD_ATTR(extack, attr);
9dee1474 1971 return -EBUSY;
36dd1bcc 1972 }
9dee1474 1973
ee01d542 1974 return nft_delchain(&ctx);
96518518
PM		 1975}
1976
96518518
PM		 1977/*
1978 * Expressions
1979 */
1980
1981/**
ef1f7df9
PM		 1982 * nft_register_expr - register nf_tables expr type
1983 * @ops: expr type
96518518 1984 *
ef1f7df9 1985 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1986 * success or a negative errno code otherwise.
1987 */
ef1f7df9 1988int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1989{
1990 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1991 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1992 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1993 else
e688a7f8 1994 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1995 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1996 return 0;
1997}
1998EXPORT_SYMBOL_GPL(nft_register_expr);
1999
2000/**
ef1f7df9
PM		 2001 * nft_unregister_expr - unregister nf_tables expr type
2002 * @ops: expr type
96518518 2003 *
ef1f7df9 2004 * Unregisters the expr typefor use with nf_tables.
96518518 2005 */
ef1f7df9 2006void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 2007{
2008 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 2009 list_del_rcu(&type->list);
96518518
PM		 2010 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2011}
2012EXPORT_SYMBOL_GPL(nft_unregister_expr);
2013
64d46806
PM		 2014static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2015 struct nlattr *nla)
96518518 2016{
ef1f7df9 2017 const struct nft_expr_type *type;
96518518 2018
ef1f7df9 2019 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 2020 if (!nla_strcmp(nla, type->name) &&
2021 (!type->family || type->family == family))
ef1f7df9 2022 return type;
96518518
PM		 2023 }
2024 return NULL;
2025}
2026
452238e8
FW		 2027static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2028 u8 family,
64d46806 2029 struct nlattr *nla)
96518518 2030{
ef1f7df9 2031 const struct nft_expr_type *type;
96518518
PM		 2032
2033 if (nla == NULL)
2034 return ERR_PTR(-EINVAL);
2035
64d46806 2036 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 2037 if (type != NULL && try_module_get(type->owner))
2038 return type;
96518518 2039
f102d66b 2040 lockdep_nfnl_nft_mutex_not_held();
96518518 2041#ifdef CONFIG_MODULES
ef1f7df9 2042 if (type == NULL) {
452238e8
FW		 2043 nft_request_module(net, "nft-expr-%u-%.*s", family,
2044 nla_len(nla), (char *)nla_data(nla));
64d46806
PM		 2045 if (__nft_expr_type_get(family, nla))
2046 return ERR_PTR(-EAGAIN);
2047
452238e8
FW		 2048 nft_request_module(net, "nft-expr-%.*s",
2049 nla_len(nla), (char *)nla_data(nla));
64d46806 2050 if (__nft_expr_type_get(family, nla))
96518518
PM		 2051 return ERR_PTR(-EAGAIN);
2052 }
2053#endif
2054 return ERR_PTR(-ENOENT);
2055}
2056
2057static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2058 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
2059 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2060};
2061
2062static int nf_tables_fill_expr_info(struct sk_buff *skb,
2063 const struct nft_expr *expr)
2064{
ef1f7df9 2065 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 2066 goto nla_put_failure;
2067
2068 if (expr->ops->dump) {
2069 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
2070 if (data == NULL)
2071 goto nla_put_failure;
2072 if (expr->ops->dump(skb, expr) < 0)
2073 goto nla_put_failure;
2074 nla_nest_end(skb, data);
2075 }
2076
2077 return skb->len;
2078
2079nla_put_failure:
2080 return -1;
2081};
2082
0b2d8a7b
PM		 2083int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2084 const struct nft_expr *expr)
2085{
2086 struct nlattr *nest;
2087
2088 nest = nla_nest_start(skb, attr);
2089 if (!nest)
2090 goto nla_put_failure;
2091 if (nf_tables_fill_expr_info(skb, expr) < 0)
2092 goto nla_put_failure;
2093 nla_nest_end(skb, nest);
2094 return 0;
2095
2096nla_put_failure:
2097 return -1;
2098}
2099
96518518
PM		 2100struct nft_expr_info {
2101 const struct nft_expr_ops *ops;
ef1f7df9 2102 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 2103};
2104
0ca743a5
PNA		 2105static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2106 const struct nlattr *nla,
96518518
PM		 2107 struct nft_expr_info *info)
2108{
ef1f7df9 2109 const struct nft_expr_type *type;
96518518 2110 const struct nft_expr_ops *ops;
ef1f7df9 2111 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 2112 int err;
2113
fceb6435 2114 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 2115 if (err < 0)
2116 return err;
2117
452238e8 2118 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 2119 if (IS_ERR(type))
2120 return PTR_ERR(type);
2121
2122 if (tb[NFTA_EXPR_DATA]) {
2123 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 2124 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 2125 if (err < 0)
2126 goto err1;
2127 } else
2128 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2129
2130 if (type->select_ops != NULL) {
0ca743a5
PNA		 2131 ops = type->select_ops(ctx,
2132 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 2133 if (IS_ERR(ops)) {
2134 err = PTR_ERR(ops);
2135 goto err1;
2136 }
2137 } else
2138 ops = type->ops;
2139
96518518
PM		 2140 info->ops = ops;
2141 return 0;
ef1f7df9
PM		 2142
2143err1:
2144 module_put(type->owner);
2145 return err;
96518518
PM		 2146}
2147
2148static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 2149 const struct nft_expr_info *info,
96518518
PM		 2150 struct nft_expr *expr)
2151{
2152 const struct nft_expr_ops *ops = info->ops;
2153 int err;
2154
2155 expr->ops = ops;
2156 if (ops->init) {
ef1f7df9 2157 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 2158 if (err < 0)
2159 goto err1;
2160 }
2161
96518518 2162 return 0;
96518518
PM		 2163err1:
2164 expr->ops = NULL;
2165 return err;
2166}
2167
62472bce
PM		 2168static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2169 struct nft_expr *expr)
96518518 2170{
3f3a390d
PNA		 2171 const struct nft_expr_type *type = expr->ops->type;
2172
96518518 2173 if (expr->ops->destroy)
62472bce 2174 expr->ops->destroy(ctx, expr);
3f3a390d 2175 module_put(type->owner);
96518518
PM		 2176}
2177
0b2d8a7b
PM		 2178struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2179 const struct nlattr *nla)
2180{
2181 struct nft_expr_info info;
2182 struct nft_expr *expr;
b8e20400 2183 struct module *owner;
0b2d8a7b
PM		 2184 int err;
2185
2186 err = nf_tables_expr_parse(ctx, nla, &info);
2187 if (err < 0)
2188 goto err1;
2189
2190 err = -ENOMEM;
2191 expr = kzalloc(info.ops->size, GFP_KERNEL);
2192 if (expr == NULL)
2193 goto err2;
2194
2195 err = nf_tables_newexpr(ctx, &info, expr);
2196 if (err < 0)
6cafaf47 2197 goto err3;
0b2d8a7b
PM		 2198
2199 return expr;
6cafaf47
LZ		 2200err3:
2201 kfree(expr);
0b2d8a7b 2202err2:
b8e20400
PNA		 2203 owner = info.ops->type->owner;
2204 if (info.ops->type->release_ops)
2205 info.ops->type->release_ops(info.ops);
2206
2207 module_put(owner);
0b2d8a7b
PM		 2208err1:
2209 return ERR_PTR(err);
2210}
2211
2212void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2213{
2214 nf_tables_expr_destroy(ctx, expr);
2215 kfree(expr);
2216}
2217
96518518
PM		 2218/*
2219 * Rules
2220 */
2221
cac20fcd
PNA		 2222static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2223 u64 handle)
96518518
PM		 2224{
2225 struct nft_rule *rule;
2226
2227 // FIXME: this sucks
d9adf22a 2228 list_for_each_entry_rcu(rule, &chain->rules, list) {
96518518
PM		 2229 if (handle == rule->handle)
2230 return rule;
2231 }
2232
2233 return ERR_PTR(-ENOENT);
2234}
2235
cac20fcd
PNA		 2236static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2237 const struct nlattr *nla)
96518518
PM		 2238{
2239 if (nla == NULL)
2240 return ERR_PTR(-EINVAL);
2241
cac20fcd 2242 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 2243}
2244
2245static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 2246 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2247 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 2248 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2249 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2250 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2251 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 2252 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 2253 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 2254 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2255 .len = NFT_USERDATA_MAXLEN },
467697d2 2256 [NFTA_RULE_ID] = { .type = NLA_U32 },
0604628b 2257 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
96518518
PM		 2258};
2259
84d7fce6
PNA		 2260static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2261 u32 portid, u32 seq, int event,
2262 u32 flags, int family,
96518518
PM		 2263 const struct nft_table *table,
2264 const struct nft_chain *chain,
2265 const struct nft_rule *rule)
2266{
2267 struct nlmsghdr *nlh;
2268 struct nfgenmsg *nfmsg;
2269 const struct nft_expr *expr, *next;
2270 struct nlattr *list;
5e948466 2271 const struct nft_rule *prule;
dedb67c4 2272 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 2273
dedb67c4 2274 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 2275 if (nlh == NULL)
2276 goto nla_put_failure;
2277
2278 nfmsg = nlmsg_data(nlh);
2279 nfmsg->nfgen_family = family;
2280 nfmsg->version = NFNETLINK_V0;
84d7fce6 2281 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2282
2283 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2284 goto nla_put_failure;
2285 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2286 goto nla_put_failure;
b46f6ded
ND		 2287 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2288 NFTA_RULE_PAD))
96518518
PM		 2289 goto nla_put_failure;
2290
5e948466 2291 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 2292 prule = list_prev_entry(rule, list);
5e948466 2293 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2294 cpu_to_be64(prule->handle),
2295 NFTA_RULE_PAD))
5e948466
EL		 2296 goto nla_put_failure;
2297 }
2298
96518518
PM		 2299 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2300 if (list == NULL)
2301 goto nla_put_failure;
2302 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2303 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2304 goto nla_put_failure;
96518518
PM		 2305 }
2306 nla_nest_end(skb, list);
2307
86f1ec32
PM		 2308 if (rule->udata) {
2309 struct nft_userdata *udata = nft_userdata(rule);
2310 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2311 udata->data) < 0)
2312 goto nla_put_failure;
2313 }
0768b3b3 2314
053c095a
JB		 2315 nlmsg_end(skb, nlh);
2316 return 0;
96518518
PM		 2317
2318nla_put_failure:
2319 nlmsg_trim(skb, nlh);
2320 return -1;
2321}
2322
25e94a99
PNA		 2323static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2324 const struct nft_rule *rule, int event)
96518518
PM		 2325{
2326 struct sk_buff *skb;
96518518
PM		 2327 int err;
2328
128ad332
PNA		 2329 if (!ctx->report &&
2330 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2331 return;
96518518 2332
96518518
PM		 2333 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2334 if (skb == NULL)
2335 goto err;
2336
84d7fce6 2337 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2338 event, 0, ctx->family, ctx->table,
35151d84 2339 ctx->chain, rule);
96518518
PM		 2340 if (err < 0) {
2341 kfree_skb(skb);
2342 goto err;
2343 }
2344
25e94a99
PNA		 2345 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2346 ctx->report, GFP_KERNEL);
2347 return;
96518518 2348err:
25e94a99 2349 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2350}
2351
6e1f760e 2352struct nft_rule_dump_ctx {
e46abbcc 2353 char *table;
b7263e07 2354 char *chain;
6e1f760e
PNA		 2355};
2356
241faece
PS		 2357static int __nf_tables_dump_rules(struct sk_buff *skb,
2358 unsigned int *idx,
2359 struct netlink_callback *cb,
2360 const struct nft_table *table,
2361 const struct nft_chain *chain)
2362{
2363 struct net *net = sock_net(skb->sk);
2364 unsigned int s_idx = cb->args[0];
2365 const struct nft_rule *rule;
241faece
PS		 2366
2367 list_for_each_entry_rcu(rule, &chain->rules, list) {
2368 if (!nft_is_active(net, rule))
2369 goto cont;
2370 if (*idx < s_idx)
2371 goto cont;
2372 if (*idx > s_idx) {
2373 memset(&cb->args[1], 0,
2374 sizeof(cb->args) - sizeof(cb->args[0]));
2375 }
2376 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2377 cb->nlh->nlmsg_seq,
2378 NFT_MSG_NEWRULE,
2379 NLM_F_MULTI | NLM_F_APPEND,
2380 table->family,
2381 table, chain, rule) < 0)
310529e6 2382 return 1;
241faece
PS		 2383
2384 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2385cont:
2386 (*idx)++;
2387 }
310529e6 2388 return 0;
241faece
PS		 2389}
2390
96518518
PM		 2391static int nf_tables_dump_rules(struct sk_buff *skb,
2392 struct netlink_callback *cb)
2393{
2394 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2395 const struct nft_rule_dump_ctx *ctx = cb->data;
241faece 2396 struct nft_table *table;
96518518 2397 const struct nft_chain *chain;
241faece 2398 unsigned int idx = 0;
99633ab2 2399 struct net *net = sock_net(skb->sk);
96518518
PM		 2400 int family = nfmsg->nfgen_family;
2401
e688a7f8 2402 rcu_read_lock();
38e029f1
PNA		 2403 cb->seq = net->nft.base_seq;
2404
36596dad 2405 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2406 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2407 continue;
2408
2409 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2410 continue;
2411
715849ab 2412 if (ctx && ctx->table && ctx->chain) {
241faece 2413 struct rhlist_head *list, *tmp;
6e1f760e 2414
241faece
PS		 2415 list = rhltable_lookup(&table->chains_ht, ctx->chain,
2416 nft_chain_ht_params);
2417 if (!list)
2418 goto done;
2419
2420 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2421 if (!nft_is_active(net, chain))
2422 continue;
2423 __nf_tables_dump_rules(skb, &idx,
2424 cb, table, chain);
2425 break;
96518518 2426 }
241faece 2427 goto done;
96518518 2428 }
241faece
PS		 2429
2430 list_for_each_entry_rcu(chain, &table->chains, list) {
2431 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2432 goto done;
2433 }
2434
2435 if (ctx && ctx->table)
2436 break;
96518518
PM		 2437 }
2438done:
e688a7f8 2439 rcu_read_unlock();
310529e6
PS		 2440
2441 cb->args[0] = idx;
96518518
PM		 2442 return skb->len;
2443}
2444
90fd131a
FW		 2445static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2446{
2447 const struct nlattr * const *nla = cb->data;
2448 struct nft_rule_dump_ctx *ctx = NULL;
2449
2450 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2451 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2452 if (!ctx)
2453 return -ENOMEM;
2454
2455 if (nla[NFTA_RULE_TABLE]) {
2456 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2457 GFP_ATOMIC);
2458 if (!ctx->table) {
2459 kfree(ctx);
2460 return -ENOMEM;
2461 }
2462 }
2463 if (nla[NFTA_RULE_CHAIN]) {
2464 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2465 GFP_ATOMIC);
2466 if (!ctx->chain) {
2467 kfree(ctx->table);
2468 kfree(ctx);
2469 return -ENOMEM;
2470 }
2471 }
2472 }
2473
2474 cb->data = ctx;
2475 return 0;
2476}
2477
6e1f760e
PNA		 2478static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2479{
e46abbcc
PS		 2480 struct nft_rule_dump_ctx *ctx = cb->data;
2481
2482 if (ctx) {
2483 kfree(ctx->table);
b7263e07 2484 kfree(ctx->chain);
e46abbcc
PS		 2485 kfree(ctx);
2486 }
6e1f760e
PNA		 2487 return 0;
2488}
2489
d9adf22a 2490/* called with rcu_read_lock held */
7b8002a1
PNA		 2491static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2492 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2493 const struct nlattr * const nla[],
2494 struct netlink_ext_ack *extack)
96518518
PM		 2495{
2496 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2497 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2498 const struct nft_chain *chain;
2499 const struct nft_rule *rule;
1b2470e5 2500 struct nft_table *table;
96518518
PM		 2501 struct sk_buff *skb2;
2502 int family = nfmsg->nfgen_family;
2503 int err;
2504
2505 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2506 struct netlink_dump_control c = {
90fd131a 2507 .start= nf_tables_dump_rules_start,
96518518 2508 .dump = nf_tables_dump_rules,
6e1f760e 2509 .done = nf_tables_dump_rules_done,
d9adf22a 2510 .module = THIS_MODULE,
90fd131a 2511 .data = (void *)nla,
96518518 2512 };
6e1f760e 2513
d9adf22a 2514 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 2515 }
2516
cac20fcd 2517 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2518 if (IS_ERR(table)) {
2519 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2520 return PTR_ERR(table);
36dd1bcc 2521 }
96518518 2522
f102d66b 2523 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2524 if (IS_ERR(chain)) {
2525 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2526 return PTR_ERR(chain);
36dd1bcc 2527 }
96518518 2528
cac20fcd 2529 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2530 if (IS_ERR(rule)) {
2531 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2532 return PTR_ERR(rule);
36dd1bcc 2533 }
96518518 2534
d9adf22a 2535 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 2536 if (!skb2)
2537 return -ENOMEM;
2538
84d7fce6 2539 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2540 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2541 family, table, chain, rule);
2542 if (err < 0)
2543 goto err;
2544
2545 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2546
2547err:
2548 kfree_skb(skb2);
2549 return err;
2550}
2551
62472bce
PM		 2552static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2553 struct nft_rule *rule)
96518518 2554{
29e38801 2555 struct nft_expr *expr, *next;
96518518
PM		 2556
2557 /*
2558 * Careful: some expressions might not be initialized in case this
2559 * is called on error from nf_tables_newrule().
2560 */
2561 expr = nft_expr_first(rule);
3e38df13 2562 while (expr != nft_expr_last(rule) && expr->ops) {
29e38801 2563 next = nft_expr_next(expr);
62472bce 2564 nf_tables_expr_destroy(ctx, expr);
29e38801 2565 expr = next;
96518518
PM		 2566 }
2567 kfree(rule);
2568}
2569
bb7b40ae
PNA		 2570static void nf_tables_rule_release(const struct nft_ctx *ctx,
2571 struct nft_rule *rule)
2572{
f6ac8585 2573 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
bb7b40ae
PNA		 2574 nf_tables_rule_destroy(ctx, rule);
2575}
2576
a654de8f
PNA		 2577int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2578{
2579 struct nft_expr *expr, *last;
2580 const struct nft_data *data;
2581 struct nft_rule *rule;
2582 int err;
2583
26b2f552
TY		 2584 if (ctx->level == NFT_JUMP_STACK_SIZE)
2585 return -EMLINK;
2586
a654de8f
PNA		 2587 list_for_each_entry(rule, &chain->rules, list) {
2588 if (!nft_is_active_next(ctx->net, rule))
2589 continue;
2590
2591 nft_rule_for_each_expr(expr, last, rule) {
2592 if (!expr->ops->validate)
2593 continue;
2594
2595 err = expr->ops->validate(ctx, expr, &data);
2596 if (err < 0)
2597 return err;
2598 }
2599 }
2600
2601 return 0;
2602}
2603EXPORT_SYMBOL_GPL(nft_chain_validate);
2604
2605static int nft_table_validate(struct net *net, const struct nft_table *table)
2606{
2607 struct nft_chain *chain;
2608 struct nft_ctx ctx = {
2609 .net = net,
2610 .family = table->family,
2611 };
2612 int err;
2613
2614 list_for_each_entry(chain, &table->chains, list) {
2615 if (!nft_is_base_chain(chain))
2616 continue;
2617
2618 ctx.chain = chain;
2619 err = nft_chain_validate(&ctx, chain);
2620 if (err < 0)
2621 return err;
2622 }
2623
2624 return 0;
2625}
2626
75dd48e2
PS		 2627static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2628 const struct nlattr *nla);
2629
1081d11b
PNA		 2630#define NFT_RULE_MAXEXPRS 128
2631
633c9a84
PNA		 2632static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2633 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2634 const struct nlattr * const nla[],
2635 struct netlink_ext_ack *extack)
96518518
PM		 2636{
2637 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2638 u8 genmask = nft_genmask_next(net);
2a43ecf9 2639 struct nft_expr_info *info = NULL;
98319cb9 2640 int family = nfmsg->nfgen_family;
96518518
PM		 2641 struct nft_table *table;
2642 struct nft_chain *chain;
2643 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2644 struct nft_userdata *udata;
1081d11b 2645 struct nft_trans *trans = NULL;
96518518
PM		 2646 struct nft_expr *expr;
2647 struct nft_ctx ctx;
2648 struct nlattr *tmp;
86f1ec32 2649 unsigned int size, i, n, ulen = 0, usize = 0;
96518518 2650 int err, rem;
5e948466 2651 u64 handle, pos_handle;
96518518 2652
f102d66b
FW		 2653 lockdep_assert_held(&net->nft.commit_mutex);
2654
cac20fcd 2655 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2656 if (IS_ERR(table)) {
2657 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2658 return PTR_ERR(table);
36dd1bcc 2659 }
96518518 2660
f102d66b 2661 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2662 if (IS_ERR(chain)) {
2663 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2664 return PTR_ERR(chain);
36dd1bcc 2665 }
96518518
PM		 2666
2667 if (nla[NFTA_RULE_HANDLE]) {
2668 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 2669 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 2670 if (IS_ERR(rule)) {
2671 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2672 return PTR_ERR(rule);
36dd1bcc 2673 }
96518518 2674
36dd1bcc
PNA		 2675 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2676 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2677 return -EEXIST;
36dd1bcc 2678 }
96518518
PM		 2679 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2680 old_rule = rule;
2681 else
2682 return -EOPNOTSUPP;
2683 } else {
445509eb
PNA		 2684 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
2685 nlh->nlmsg_flags & NLM_F_REPLACE)
96518518
PM		 2686 return -EINVAL;
2687 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2688
2689 if (chain->use == UINT_MAX)
2690 return -EOVERFLOW;
5e948466 2691
447750f2
FW		 2692 if (nla[NFTA_RULE_POSITION]) {
2693 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2694 old_rule = __nft_rule_lookup(chain, pos_handle);
2695 if (IS_ERR(old_rule)) {
2696 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
2697 return PTR_ERR(old_rule);
2698 }
75dd48e2
PS		 2699 } else if (nla[NFTA_RULE_POSITION_ID]) {
2700 old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
2701 if (IS_ERR(old_rule)) {
2702 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
2703 return PTR_ERR(old_rule);
2704 }
36dd1bcc 2705 }
5e948466
EL		 2706 }
2707
98319cb9 2708 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 2709
96518518
PM		 2710 n = 0;
2711 size = 0;
2712 if (nla[NFTA_RULE_EXPRESSIONS]) {
2a43ecf9
FW		 2713 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
2714 sizeof(struct nft_expr_info),
2715 GFP_KERNEL);
2716 if (!info)
2717 return -ENOMEM;
2718
96518518
PM		 2719 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2720 err = -EINVAL;
2721 if (nla_type(tmp) != NFTA_LIST_ELEM)
2722 goto err1;
2723 if (n == NFT_RULE_MAXEXPRS)
2724 goto err1;
0ca743a5 2725 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2726 if (err < 0)
2727 goto err1;
2728 size += info[n].ops->size;
2729 n++;
2730 }
2731 }
9889840f
PM		 2732 /* Check for overflow of dlen field */
2733 err = -EFBIG;
2734 if (size >= 1 << 12)
2735 goto err1;
96518518 2736
86f1ec32 2737 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2738 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2739 if (ulen > 0)
2740 usize = sizeof(struct nft_userdata) + ulen;
2741 }
0768b3b3 2742
96518518 2743 err = -ENOMEM;
86f1ec32 2744 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2745 if (rule == NULL)
2746 goto err1;
2747
889f7ee7 2748 nft_activate_next(net, rule);
0628b123 2749
96518518
PM		 2750 rule->handle = handle;
2751 rule->dlen = size;
86f1ec32 2752 rule->udata = ulen ? 1 : 0;
0768b3b3 2753
86f1ec32
PM		 2754 if (ulen) {
2755 udata = nft_userdata(rule);
2756 udata->len = ulen - 1;
2757 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2758 }
96518518 2759
96518518
PM		 2760 expr = nft_expr_first(rule);
2761 for (i = 0; i < n; i++) {
2762 err = nf_tables_newexpr(&ctx, &info[i], expr);
2763 if (err < 0)
2764 goto err2;
a654de8f
PNA		 2765
2766 if (info[i].ops->validate)
2767 nft_validate_state_update(net, NFT_VALIDATE_NEED);
2768
ef1f7df9 2769 info[i].ops = NULL;
96518518
PM		 2770 expr = nft_expr_next(expr);
2771 }
2772
96518518 2773 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
ca089878 2774 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
569ccae6
FW		 2775 if (trans == NULL) {
2776 err = -ENOMEM;
2777 goto err2;
2778 }
ca089878
TY		 2779 err = nft_delrule(&ctx, old_rule);
2780 if (err < 0) {
2781 nft_trans_destroy(trans);
569ccae6
FW		 2782 goto err2;
2783 }
2784
2785 list_add_tail_rcu(&rule->list, &old_rule->list);
2786 } else {
2787 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2788 err = -ENOMEM;
2789 goto err2;
2790 }
2791
2792 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2793 if (old_rule)
2794 list_add_rcu(&rule->list, &old_rule->list);
2795 else
2796 list_add_tail_rcu(&rule->list, &chain->rules);
2797 } else {
2798 if (old_rule)
2799 list_add_tail_rcu(&rule->list, &old_rule->list);
2800 else
2801 list_add_rcu(&rule->list, &chain->rules);
2802 }
0628b123 2803 }
2a43ecf9 2804 kvfree(info);
4fefee57 2805 chain->use++;
96518518 2806
a654de8f
PNA		 2807 if (net->nft.validate_state == NFT_VALIDATE_DO)
2808 return nft_table_validate(net, table);
2809
2810 return 0;
96518518 2811err2:
bb7b40ae 2812 nf_tables_rule_release(&ctx, rule);
96518518
PM		 2813err1:
2814 for (i = 0; i < n; i++) {
b25a31bf 2815 if (info[i].ops) {
ef1f7df9 2816 module_put(info[i].ops->type->owner);
b25a31bf
TY		 2817 if (info[i].ops->type->release_ops)
2818 info[i].ops->type->release_ops(info[i].ops);
2819 }
96518518 2820 }
2a43ecf9 2821 kvfree(info);
96518518
PM		 2822 return err;
2823}
2824
1a94e38d
PNA		 2825static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2826 const struct nlattr *nla)
2827{
2828 u32 id = ntohl(nla_get_be32(nla));
2829 struct nft_trans *trans;
2830
2831 list_for_each_entry(trans, &net->nft.commit_list, list) {
2832 struct nft_rule *rule = nft_trans_rule(trans);
2833
2834 if (trans->msg_type == NFT_MSG_NEWRULE &&
2835 id == nft_trans_rule_id(trans))
2836 return rule;
2837 }
2838 return ERR_PTR(-ENOENT);
2839}
2840
633c9a84
PNA		 2841static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2842 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2843 const struct nlattr * const nla[],
2844 struct netlink_ext_ack *extack)
96518518
PM		 2845{
2846 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2847 u8 genmask = nft_genmask_next(net);
7c95f6d8 2848 struct nft_table *table;
cf9dc09d
PNA		 2849 struct nft_chain *chain = NULL;
2850 struct nft_rule *rule;
0628b123
PNA		 2851 int family = nfmsg->nfgen_family, err = 0;
2852 struct nft_ctx ctx;
96518518 2853
cac20fcd 2854 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2855 if (IS_ERR(table)) {
2856 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2857 return PTR_ERR(table);
36dd1bcc 2858 }
96518518 2859
cf9dc09d 2860 if (nla[NFTA_RULE_CHAIN]) {
f102d66b
FW		 2861 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
2862 genmask);
36dd1bcc
PNA		 2863 if (IS_ERR(chain)) {
2864 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 2865 return PTR_ERR(chain);
36dd1bcc 2866 }
cf9dc09d 2867 }
96518518 2868
98319cb9 2869 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 2870
cf9dc09d
PNA		 2871 if (chain) {
2872 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 2873 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2874 if (IS_ERR(rule)) {
2875 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 2876 return PTR_ERR(rule);
36dd1bcc 2877 }
96518518 2878
1a94e38d
PNA		 2879 err = nft_delrule(&ctx, rule);
2880 } else if (nla[NFTA_RULE_ID]) {
2881 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 2882 if (IS_ERR(rule)) {
2883 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 2884 return PTR_ERR(rule);
36dd1bcc 2885 }
1a94e38d 2886
5e266fe7 2887 err = nft_delrule(&ctx, rule);
cf9dc09d 2888 } else {
ce24b721 2889 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2890 }
2891 } else {
2892 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2893 if (!nft_is_active_next(net, chain))
2894 continue;
2895
cf9dc09d 2896 ctx.chain = chain;
ce24b721 2897 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2898 if (err < 0)
2899 break;
2900 }
2901 }
2902
2903 return err;
2904}
2905
20a69341
PM		 2906/*
2907 * Sets
2908 */
2909
2b664957 2910static LIST_HEAD(nf_tables_set_types);
20a69341 2911
2b664957 2912int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2913{
2914 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2915 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2916 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2917 return 0;
2918}
2919EXPORT_SYMBOL_GPL(nft_register_set);
2920
2b664957 2921void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2922{
2923 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2924 list_del_rcu(&type->list);
20a69341
PM		 2925 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2926}
2927EXPORT_SYMBOL_GPL(nft_unregister_set);
2928
2b664957 2929#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 2930 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
2931 NFT_SET_EVAL)
2b664957 2932
71cc0873 2933static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 2934{
71cc0873 2935 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 2936}
2937
c50b960c
PM		 2938/*
2939 * Select a set implementation based on the data characteristics and the
2940 * given policy. The total memory use might not be known if no size is
2941 * given, in that case the amount of memory per element is used.
2942 */
2943static const struct nft_set_ops *
2b664957
PNA		 2944nft_select_set_ops(const struct nft_ctx *ctx,
2945 const struct nlattr * const nla[],
c50b960c
PM		 2946 const struct nft_set_desc *desc,
2947 enum nft_set_policies policy)
20a69341 2948{
c50b960c
PM		 2949 const struct nft_set_ops *ops, *bops;
2950 struct nft_set_estimate est, best;
2b664957
PNA		 2951 const struct nft_set_type *type;
2952 u32 flags = 0;
20a69341 2953
f102d66b
FW		 2954 lockdep_assert_held(&ctx->net->nft.commit_mutex);
2955 lockdep_nfnl_nft_mutex_not_held();
20a69341 2956#ifdef CONFIG_MODULES
2b664957 2957 if (list_empty(&nf_tables_set_types)) {
452238e8 2958 nft_request_module(ctx->net, "nft-set");
2b664957 2959 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2960 return ERR_PTR(-EAGAIN);
2961 }
2962#endif
2b664957
PNA		 2963 if (nla[NFTA_SET_FLAGS] != NULL)
2964 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2965
55af753c
PNA		 2966 bops = NULL;
2967 best.size = ~0;
2968 best.lookup = ~0;
0b5a7874 2969 best.space = ~0;
c50b960c 2970
2b664957 2971 list_for_each_entry(type, &nf_tables_set_types, list) {
71cc0873 2972 ops = &type->ops;
2b664957 2973
71cc0873 2974 if (!nft_set_ops_candidate(type, flags))
20a69341 2975 continue;
2b664957 2976 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2977 continue;
2978
2979 switch (policy) {
2980 case NFT_SET_POL_PERFORMANCE:
55af753c 2981 if (est.lookup < best.lookup)
c50b960c 2982 break;
644e334e
PNA		 2983 if (est.lookup == best.lookup &&
2984 est.space < best.space)
2985 break;
c50b960c
PM		 2986 continue;
2987 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2988 if (!desc->size) {
2989 if (est.space < best.space)
2990 break;
2991 if (est.space == best.space &&
2992 est.lookup < best.lookup)
2993 break;
4f2921ca 2994 } else if (est.size < best.size || !bops) {
c50b960c 2995 break;
0b5a7874 2996 }
c50b960c
PM		 2997 continue;
2998 default:
2999 break;
3000 }
3001
2b664957 3002 if (!try_module_get(type->owner))
20a69341 3003 continue;
c50b960c 3004 if (bops != NULL)
71cc0873 3005 module_put(to_set_type(bops)->owner);
c50b960c
PM		 3006
3007 bops = ops;
3008 best = est;
20a69341
PM		 3009 }
3010
c50b960c
PM		 3011 if (bops != NULL)
3012 return bops;
3013
20a69341
PM		 3014 return ERR_PTR(-EOPNOTSUPP);
3015}
3016
3017static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 3018 [NFTA_SET_TABLE] = { .type = NLA_STRING,
3019 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 3020 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 3021 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 3022 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
3023 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
3024 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
3025 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
3026 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 3027 [NFTA_SET_POLICY] = { .type = NLA_U32 },
3028 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 3029 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 3030 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
3031 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 3032 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
3033 .len = NFT_USERDATA_MAXLEN },
8aeff920 3034 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 3035 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 3036};
3037
3038static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3039 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 3040};
3041
633c9a84 3042static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3043 const struct sk_buff *skb,
3044 const struct nlmsghdr *nlh,
f2a6d766 3045 const struct nlattr * const nla[],
36dd1bcc 3046 struct netlink_ext_ack *extack,
f2a6d766 3047 u8 genmask)
20a69341
PM		 3048{
3049 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3050 int family = nfmsg->nfgen_family;
7c95f6d8 3051 struct nft_table *table = NULL;
20a69341 3052
20a69341 3053 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 3054 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3055 genmask);
36dd1bcc
PNA		 3056 if (IS_ERR(table)) {
3057 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3058 return PTR_ERR(table);
36dd1bcc 3059 }
20a69341
PM		 3060 }
3061
98319cb9 3062 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3063 return 0;
3064}
3065
cac20fcd
PNA		 3066static struct nft_set *nft_set_lookup(const struct nft_table *table,
3067 const struct nlattr *nla, u8 genmask)
20a69341
PM		 3068{
3069 struct nft_set *set;
3070
3071 if (nla == NULL)
3072 return ERR_PTR(-EINVAL);
3073
d9adf22a 3074 list_for_each_entry_rcu(set, &table->sets, list) {
37a9cc52
PNA		 3075 if (!nla_strcmp(nla, set->name) &&
3076 nft_active_genmask(set, genmask))
20a69341
PM		 3077 return set;
3078 }
3079 return ERR_PTR(-ENOENT);
3080}
3081
cac20fcd
PNA		 3082static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3083 const struct nlattr *nla,
3084 u8 genmask)
3ecbfd65
HS		 3085{
3086 struct nft_set *set;
3087
3ecbfd65
HS		 3088 list_for_each_entry(set, &table->sets, list) {
3089 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3090 nft_active_genmask(set, genmask))
3091 return set;
3092 }
3093 return ERR_PTR(-ENOENT);
3094}
3095
cac20fcd
PNA		 3096static struct nft_set *nft_set_lookup_byid(const struct net *net,
3097 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 3098{
3099 struct nft_trans *trans;
3100 u32 id = ntohl(nla_get_be32(nla));
3101
3102 list_for_each_entry(trans, &net->nft.commit_list, list) {
9c7f96fd
AK		 3103 if (trans->msg_type == NFT_MSG_NEWSET) {
3104 struct nft_set *set = nft_trans_set(trans);
37a9cc52 3105
9c7f96fd
AK		 3106 if (id == nft_trans_set_id(trans) &&
3107 nft_active_genmask(set, genmask))
3108 return set;
3109 }
958bee14
PNA		 3110 }
3111 return ERR_PTR(-ENOENT);
3112}
c7a72e3f 3113
10659cba
PNA		 3114struct nft_set *nft_set_lookup_global(const struct net *net,
3115 const struct nft_table *table,
3116 const struct nlattr *nla_set_name,
3117 const struct nlattr *nla_set_id,
3118 u8 genmask)
c7a72e3f
PNA		 3119{
3120 struct nft_set *set;
3121
cac20fcd 3122 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 3123 if (IS_ERR(set)) {
3124 if (!nla_set_id)
3125 return set;
3126
cac20fcd 3127 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 3128 }
3129 return set;
3130}
10659cba 3131EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 3132
20a69341
PM		 3133static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3134 const char *name)
3135{
3136 const struct nft_set *i;
3137 const char *p;
3138 unsigned long *inuse;
60eb1894 3139 unsigned int n = 0, min = 0;
20a69341 3140
38745490 3141 p = strchr(name, '%');
20a69341
PM		 3142 if (p != NULL) {
3143 if (p[1] != 'd' || strchr(p + 2, '%'))
3144 return -EINVAL;
3145
3146 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3147 if (inuse == NULL)
3148 return -ENOMEM;
60eb1894 3149cont:
20a69341 3150 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 3151 int tmp;
3152
37a9cc52
PNA		 3153 if (!nft_is_active_next(ctx->net, set))
3154 continue;
14662917 3155 if (!sscanf(i->name, name, &tmp))
20a69341 3156 continue;
60eb1894 3157 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 3158 continue;
14662917 3159
60eb1894 3160 set_bit(tmp - min, inuse);
20a69341
PM		 3161 }
3162
53b70287 3163 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 3164 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3165 min += BITS_PER_BYTE * PAGE_SIZE;
3166 memset(inuse, 0, PAGE_SIZE);
3167 goto cont;
3168 }
20a69341
PM		 3169 free_page((unsigned long)inuse);
3170 }
3171
38745490
PS		 3172 set->name = kasprintf(GFP_KERNEL, name, min + n);
3173 if (!set->name)
3174 return -ENOMEM;
3175
20a69341 3176 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 3177 if (!nft_is_active_next(ctx->net, i))
3178 continue;
e63aaaa6
AY		 3179 if (!strcmp(set->name, i->name)) {
3180 kfree(set->name);
20a69341 3181 return -ENFILE;
e63aaaa6 3182 }
20a69341
PM		 3183 }
3184 return 0;
3185}
3186
8e1102d5
FW		 3187static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3188{
3189 u64 ms = be64_to_cpu(nla_get_be64(nla));
3190 u64 max = (u64)(~((u64)0));
3191
3192 max = div_u64(max, NSEC_PER_MSEC);
3193 if (ms >= max)
3194 return -ERANGE;
3195
3196 ms *= NSEC_PER_MSEC;
3197 *result = nsecs_to_jiffies64(ms);
3198 return 0;
3199}
3200
d6501de8 3201static __be64 nf_jiffies64_to_msecs(u64 input)
8e1102d5
FW		 3202{
3203 u64 ms = jiffies64_to_nsecs(input);
3204
3205 return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
3206}
3207
20a69341
PM		 3208static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3209 const struct nft_set *set, u16 event, u16 flags)
3210{
3211 struct nfgenmsg *nfmsg;
3212 struct nlmsghdr *nlh;
c50b960c 3213 struct nlattr *desc;
128ad332
PNA		 3214 u32 portid = ctx->portid;
3215 u32 seq = ctx->seq;
20a69341 3216
dedb67c4 3217 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 3218 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3219 flags);
3220 if (nlh == NULL)
3221 goto nla_put_failure;
3222
3223 nfmsg = nlmsg_data(nlh);
36596dad 3224 nfmsg->nfgen_family = ctx->family;
20a69341 3225 nfmsg->version = NFNETLINK_V0;
84d7fce6 3226 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 3227
3228 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3229 goto nla_put_failure;
3230 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3231 goto nla_put_failure;
3ecbfd65
HS		 3232 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3233 NFTA_SET_PAD))
3234 goto nla_put_failure;
20a69341
PM		 3235 if (set->flags != 0)
3236 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3237 goto nla_put_failure;
3238
3239 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3240 goto nla_put_failure;
3241 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3242 goto nla_put_failure;
3243 if (set->flags & NFT_SET_MAP) {
3244 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3245 goto nla_put_failure;
3246 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3247 goto nla_put_failure;
3248 }
8aeff920
PNA		 3249 if (set->flags & NFT_SET_OBJECT &&
3250 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3251 goto nla_put_failure;
20a69341 3252
761da293 3253 if (set->timeout &&
d3e2a111 3254 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 3255 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 3256 NFTA_SET_PAD))
761da293
PM		 3257 goto nla_put_failure;
3258 if (set->gc_int &&
3259 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3260 goto nla_put_failure;
3261
9363dc4b
AB		 3262 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3263 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3264 goto nla_put_failure;
3265 }
3266
e6d8ecac
CFG		 3267 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3268 goto nla_put_failure;
3269
c50b960c
PM		 3270 desc = nla_nest_start(skb, NFTA_SET_DESC);
3271 if (desc == NULL)
3272 goto nla_put_failure;
3273 if (set->size &&
3274 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3275 goto nla_put_failure;
3276 nla_nest_end(skb, desc);
3277
053c095a
JB		 3278 nlmsg_end(skb, nlh);
3279 return 0;
20a69341
PM		 3280
3281nla_put_failure:
3282 nlmsg_trim(skb, nlh);
3283 return -1;
3284}
3285
25e94a99
PNA		 3286static void nf_tables_set_notify(const struct nft_ctx *ctx,
3287 const struct nft_set *set, int event,
3288 gfp_t gfp_flags)
20a69341
PM		 3289{
3290 struct sk_buff *skb;
128ad332 3291 u32 portid = ctx->portid;
20a69341
PM		 3292 int err;
3293
128ad332
PNA		 3294 if (!ctx->report &&
3295 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 3296 return;
20a69341 3297
31f8441c 3298 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 3299 if (skb == NULL)
3300 goto err;
3301
3302 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3303 if (err < 0) {
3304 kfree_skb(skb);
3305 goto err;
3306 }
3307
25e94a99
PNA		 3308 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3309 gfp_flags);
3310 return;
20a69341 3311err:
25e94a99 3312 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 3313}
3314
5b96af77 3315static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 3316{
3317 const struct nft_set *set;
3318 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 3319 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3320 struct net *net = sock_net(skb->sk);
5b96af77 3321 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 3322
3323 if (cb->args[1])
3324 return skb->len;
3325
e688a7f8 3326 rcu_read_lock();
38e029f1
PNA		 3327 cb->seq = net->nft.base_seq;
3328
36596dad
PNA		 3329 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3330 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 3331 ctx->family != table->family)
36596dad
PNA		 3332 continue;
3333
3334 if (ctx->table && ctx->table != table)
5b96af77
PNA		 3335 continue;
3336
36596dad
PNA		 3337 if (cur_table) {
3338 if (cur_table != table)
c9c8e485
PNA		 3339 continue;
3340
36596dad 3341 cur_table = NULL;
c9c8e485 3342 }
36596dad
PNA		 3343 idx = 0;
3344 list_for_each_entry_rcu(set, &table->sets, list) {
3345 if (idx < s_idx)
3346 goto cont;
3347 if (!nft_is_active(net, set))
3348 goto cont;
5b96af77 3349
36596dad
PNA		 3350 ctx_set = *ctx;
3351 ctx_set.table = table;
98319cb9 3352 ctx_set.family = table->family;
c9c8e485 3353
36596dad
PNA		 3354 if (nf_tables_fill_set(skb, &ctx_set, set,
3355 NFT_MSG_NEWSET,
3356 NLM_F_MULTI) < 0) {
3357 cb->args[0] = idx;
3358 cb->args[2] = (unsigned long) table;
3359 goto done;
c9c8e485 3360 }
36596dad 3361 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 3362cont:
36596dad 3363 idx++;
c9c8e485 3364 }
36596dad
PNA		 3365 if (s_idx)
3366 s_idx = 0;
c9c8e485
PNA		 3367 }
3368 cb->args[1] = 1;
3369done:
e688a7f8 3370 rcu_read_unlock();
c9c8e485
PNA		 3371 return skb->len;
3372}
3373
90fd131a
FW		 3374static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3375{
3376 struct nft_ctx *ctx_dump = NULL;
3377
3378 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3379 if (ctx_dump == NULL)
3380 return -ENOMEM;
3381
3382 cb->data = ctx_dump;
3383 return 0;
3384}
3385
5b96af77 3386static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 3387{
5b96af77
PNA		 3388 kfree(cb->data);
3389 return 0;
20a69341
PM		 3390}
3391
d9adf22a 3392/* called with rcu_read_lock held */
7b8002a1
PNA		 3393static int nf_tables_getset(struct net *net, struct sock *nlsk,
3394 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3395 const struct nlattr * const nla[],
3396 struct netlink_ext_ack *extack)
20a69341 3397{
f2a6d766 3398 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3399 const struct nft_set *set;
3400 struct nft_ctx ctx;
3401 struct sk_buff *skb2;
c9c8e485 3402 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 3403 int err;
3404
01cfa0a4 3405 /* Verify existence before starting dump */
36dd1bcc
PNA		 3406 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3407 genmask);
20a69341
PM		 3408 if (err < 0)
3409 return err;
3410
3411 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3412 struct netlink_dump_control c = {
90fd131a 3413 .start = nf_tables_dump_sets_start,
20a69341 3414 .dump = nf_tables_dump_sets,
5b96af77 3415 .done = nf_tables_dump_sets_done,
90fd131a 3416 .data = &ctx,
d9adf22a 3417 .module = THIS_MODULE,
20a69341 3418 };
5b96af77 3419
d9adf22a 3420 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
20a69341
PM		 3421 }
3422
c9c8e485
PNA		 3423 /* Only accept unspec with dump */
3424 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3425 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3426 if (!nla[NFTA_SET_TABLE])
3427 return -EINVAL;
c9c8e485 3428
cac20fcd 3429 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3430 if (IS_ERR(set))
3431 return PTR_ERR(set);
3432
d9adf22a 3433 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
20a69341
PM		 3434 if (skb2 == NULL)
3435 return -ENOMEM;
3436
3437 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3438 if (err < 0)
3439 goto err;
3440
3441 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3442
3443err:
3444 kfree_skb(skb2);
3445 return err;
3446}
3447
c50b960c
PM		 3448static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3449 struct nft_set_desc *desc,
3450 const struct nlattr *nla)
3451{
3452 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3453 int err;
3454
fceb6435
JB		 3455 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3456 nft_set_desc_policy, NULL);
c50b960c
PM		 3457 if (err < 0)
3458 return err;
3459
3460 if (da[NFTA_SET_DESC_SIZE] != NULL)
3461 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3462
3463 return 0;
3464}
3465
633c9a84
PNA		 3466static int nf_tables_newset(struct net *net, struct sock *nlsk,
3467 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3468 const struct nlattr * const nla[],
3469 struct netlink_ext_ack *extack)
20a69341
PM		 3470{
3471 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3472 u8 genmask = nft_genmask_next(net);
98319cb9 3473 int family = nfmsg->nfgen_family;
20a69341 3474 const struct nft_set_ops *ops;
20a69341
PM		 3475 struct nft_table *table;
3476 struct nft_set *set;
3477 struct nft_ctx ctx;
38745490 3478 char *name;
4ef360dd 3479 u64 size;
761da293 3480 u64 timeout;
8aeff920 3481 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3482 struct nft_set_desc desc;
e6d8ecac
CFG		 3483 unsigned char *udata;
3484 u16 udlen;
20a69341
PM		 3485 int err;
3486
3487 if (nla[NFTA_SET_TABLE] == NULL ||
3488 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3489 nla[NFTA_SET_KEY_LEN] == NULL ||
3490 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3491 return -EINVAL;
3492
c50b960c
PM		 3493 memset(&desc, 0, sizeof(desc));
3494
20a69341
PM		 3495 ktype = NFT_DATA_VALUE;
3496 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3497 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3498 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3499 return -EINVAL;
3500 }
3501
c50b960c 3502 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3503 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3504 return -EINVAL;
3505
3506 flags = 0;
3507 if (nla[NFTA_SET_FLAGS] != NULL) {
3508 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3509 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3510 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3511 NFT_SET_MAP | NFT_SET_EVAL |
3512 NFT_SET_OBJECT))
20a69341 3513 return -EINVAL;
8aeff920
PNA		 3514 /* Only one of these operations is supported */
3515 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3516 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3517 return -EOPNOTSUPP;
20a69341
PM		 3518 }
3519
3520 dtype = 0;
20a69341
PM		 3521 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3522 if (!(flags & NFT_SET_MAP))
3523 return -EINVAL;
3524
3525 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3526 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3527 dtype != NFT_DATA_VERDICT)
3528 return -EINVAL;
3529
3530 if (dtype != NFT_DATA_VERDICT) {
3531 if (nla[NFTA_SET_DATA_LEN] == NULL)
3532 return -EINVAL;
c50b960c 3533 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3534 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3535 return -EINVAL;
3536 } else
7d740264 3537 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3538 } else if (flags & NFT_SET_MAP)
3539 return -EINVAL;
3540
8aeff920
PNA		 3541 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3542 if (!(flags & NFT_SET_OBJECT))
3543 return -EINVAL;
3544
3545 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3546 if (objtype == NFT_OBJECT_UNSPEC ||
3547 objtype > NFT_OBJECT_MAX)
3548 return -EINVAL;
3549 } else if (flags & NFT_SET_OBJECT)
3550 return -EINVAL;
3551 else
3552 objtype = NFT_OBJECT_UNSPEC;
3553
761da293
PM		 3554 timeout = 0;
3555 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3556 if (!(flags & NFT_SET_TIMEOUT))
3557 return -EINVAL;
8e1102d5
FW		 3558
3559 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3560 if (err)
3561 return err;
761da293
PM		 3562 }
3563 gc_int = 0;
3564 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3565 if (!(flags & NFT_SET_TIMEOUT))
3566 return -EINVAL;
3567 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3568 }
3569
c50b960c
PM		 3570 policy = NFT_SET_POL_PERFORMANCE;
3571 if (nla[NFTA_SET_POLICY] != NULL)
3572 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3573
3574 if (nla[NFTA_SET_DESC] != NULL) {
3575 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3576 if (err < 0)
3577 return err;
3578 }
3579
cac20fcd 3580 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 3581 if (IS_ERR(table)) {
3582 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3583 return PTR_ERR(table);
36dd1bcc 3584 }
20a69341 3585
98319cb9 3586 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3587
cac20fcd 3588 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 3589 if (IS_ERR(set)) {
36dd1bcc
PNA		 3590 if (PTR_ERR(set) != -ENOENT) {
3591 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3592 return PTR_ERR(set);
36dd1bcc 3593 }
1a28ad74 3594 } else {
36dd1bcc
PNA		 3595 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3596 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3597 return -EEXIST;
36dd1bcc 3598 }
20a69341
PM		 3599 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3600 return -EOPNOTSUPP;
36dd1bcc 3601
20a69341
PM		 3602 return 0;
3603 }
3604
3605 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3606 return -ENOENT;
3607
2b664957 3608 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3609 if (IS_ERR(ops))
3610 return PTR_ERR(ops);
3611
e6d8ecac
CFG		 3612 udlen = 0;
3613 if (nla[NFTA_SET_USERDATA])
3614 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3615
20a69341
PM		 3616 size = 0;
3617 if (ops->privsize != NULL)
347b408d 3618 size = ops->privsize(nla, &desc);
20a69341 3619
1ff75a3e
PNA		 3620 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3621 if (!set) {
3622 err = -ENOMEM;
20a69341 3623 goto err1;
1ff75a3e 3624 }
20a69341 3625
38745490
PS		 3626 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3627 if (!name) {
3628 err = -ENOMEM;
3629 goto err2;
3630 }
3631
20a69341 3632 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3633 kfree(name);
20a69341
PM		 3634 if (err < 0)
3635 goto err2;
3636
e6d8ecac
CFG		 3637 udata = NULL;
3638 if (udlen) {
3639 udata = set->data + size;
3640 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3641 }
3642
20a69341 3643 INIT_LIST_HEAD(&set->bindings);
3453c927
PNA		 3644 set->table = table;
3645 write_pnet(&set->net, net);
20a69341
PM		 3646 set->ops = ops;
3647 set->ktype = ktype;
c50b960c 3648 set->klen = desc.klen;
20a69341 3649 set->dtype = dtype;
8aeff920 3650 set->objtype = objtype;
c50b960c 3651 set->dlen = desc.dlen;
20a69341 3652 set->flags = flags;
c50b960c 3653 set->size = desc.size;
9363dc4b 3654 set->policy = policy;
e6d8ecac
CFG		 3655 set->udlen = udlen;
3656 set->udata = udata;
761da293
PM		 3657 set->timeout = timeout;
3658 set->gc_int = gc_int;
3ecbfd65 3659 set->handle = nf_tables_alloc_handle(table);
20a69341 3660
c50b960c 3661 err = ops->init(set, &desc, nla);
20a69341 3662 if (err < 0)
2f6adf48 3663 goto err3;
20a69341 3664
958bee14 3665 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3666 if (err < 0)
2f6adf48 3667 goto err4;
20a69341 3668
e688a7f8 3669 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3670 table->use++;
20a69341
PM		 3671 return 0;
3672
2f6adf48 3673err4:
c17c3cdf 3674 ops->destroy(set);
2f6adf48
FW		 3675err3:
3676 kfree(set->name);
20a69341 3677err2:
1ff75a3e 3678 kvfree(set);
20a69341 3679err1:
71cc0873 3680 module_put(to_set_type(ops)->owner);
20a69341
PM		 3681 return err;
3682}
3683
958bee14 3684static void nft_set_destroy(struct nft_set *set)
20a69341 3685{
273fe3f1
PNA		 3686 if (WARN_ON(set->use > 0))
3687 return;
3688
20a69341 3689 set->ops->destroy(set);
71cc0873 3690 module_put(to_set_type(set->ops)->owner);
38745490 3691 kfree(set->name);
1ff75a3e 3692 kvfree(set);
20a69341
PM		 3693}
3694
633c9a84
PNA		 3695static int nf_tables_delset(struct net *net, struct sock *nlsk,
3696 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3697 const struct nlattr * const nla[],
3698 struct netlink_ext_ack *extack)
20a69341 3699{
c9c8e485 3700 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3701 u8 genmask = nft_genmask_next(net);
36dd1bcc 3702 const struct nlattr *attr;
20a69341
PM		 3703 struct nft_set *set;
3704 struct nft_ctx ctx;
3705 int err;
3706
ec2c9935
PM		 3707 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3708 return -EAFNOSUPPORT;
20a69341
PM		 3709 if (nla[NFTA_SET_TABLE] == NULL)
3710 return -EINVAL;
3711
36dd1bcc
PNA		 3712 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3713 genmask);
20a69341
PM		 3714 if (err < 0)
3715 return err;
3716
36dd1bcc
PNA		 3717 if (nla[NFTA_SET_HANDLE]) {
3718 attr = nla[NFTA_SET_HANDLE];
3719 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3720 } else {
3721 attr = nla[NFTA_SET_NAME];
3722 set = nft_set_lookup(ctx.table, attr, genmask);
3723 }
a8278400 3724
36dd1bcc
PNA		 3725 if (IS_ERR(set)) {
3726 NL_SET_BAD_ATTR(extack, attr);
3727 return PTR_ERR(set);
3728 }
273fe3f1 3729 if (set->use ||
36dd1bcc
PNA		 3730 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3731 NL_SET_BAD_ATTR(extack, attr);
20a69341 3732 return -EBUSY;
36dd1bcc 3733 }
20a69341 3734
ee01d542 3735 return nft_delset(&ctx, set);
20a69341
PM		 3736}
3737
3738static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3739 struct nft_set *set,
20a69341 3740 const struct nft_set_iter *iter,
de70185d 3741 struct nft_set_elem *elem)
20a69341 3742{
fe2811eb 3743 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3744 enum nft_registers dreg;
3745
3746 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3747 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3748 set->dtype == NFT_DATA_VERDICT ?
3749 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3750 set->dlen);
20a69341
PM		 3751}
3752
3753int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3754 struct nft_set_binding *binding)
3755{
3756 struct nft_set_binding *i;
3757 struct nft_set_iter iter;
3758
273fe3f1
PNA		 3759 if (set->use == UINT_MAX)
3760 return -EOVERFLOW;
3761
408070d6 3762 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 3763 return -EBUSY;
3764
11113e19 3765 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3766 /* If the set is already bound to the same chain all
3767 * jumps are already validated for that chain.
3768 */
3769 list_for_each_entry(i, &set->bindings, list) {
a4684402 3770 if (i->flags & NFT_SET_MAP &&
11113e19 3771 i->chain == binding->chain)
20a69341
PM		 3772 goto bind;
3773 }
3774
8588ac09 3775 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3776 iter.skip = 0;
3777 iter.count = 0;
3778 iter.err = 0;
3779 iter.fn = nf_tables_bind_check_setelem;
3780
3781 set->ops->walk(ctx, set, &iter);
a02f4248 3782 if (iter.err < 0)
20a69341 3783 return iter.err;
20a69341
PM		 3784 }
3785bind:
3786 binding->chain = ctx->chain;
e688a7f8 3787 list_add_tail_rcu(&binding->list, &set->bindings);
f6ac8585 3788 nft_set_trans_bind(ctx, set);
273fe3f1 3789 set->use++;
f6ac8585 3790
20a69341
PM		 3791 return 0;
3792}
63aea290 3793EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341 3794
cd5125d8 3795void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
f6ac8585 3796 struct nft_set_binding *binding, bool event)
20a69341 3797{
e688a7f8 3798 list_del_rcu(&binding->list);
20a69341 3799
f6ac8585 3800 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
cd5125d8 3801 list_del_rcu(&set->list);
f6ac8585
PNA		 3802 if (event)
3803 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
3804 GFP_KERNEL);
3805 }
20a69341 3806}
63aea290 3807EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3808
273fe3f1
PNA		 3809void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
3810 struct nft_set_binding *binding,
3811 enum nft_trans_phase phase)
3812{
3813 switch (phase) {
3814 case NFT_TRANS_PREPARE:
3815 set->use--;
3816 return;
3817 case NFT_TRANS_ABORT:
3818 case NFT_TRANS_RELEASE:
3819 set->use--;
3820 /* fall through */
3821 default:
3822 nf_tables_unbind_set(ctx, set, binding,
3823 phase == NFT_TRANS_COMMIT);
3824 }
3825}
3826EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
3827
cd5125d8
FW		 3828void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
3829{
f6ac8585 3830 if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
cd5125d8 3831 nft_set_destroy(set);
cd5125d8
FW		 3832}
3833EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
3834
3ac4c07a
PM		 3835const struct nft_set_ext_type nft_set_ext_types[] = {
3836 [NFT_SET_EXT_KEY] = {
7d740264 3837 .align = __alignof__(u32),
3ac4c07a
PM		 3838 },
3839 [NFT_SET_EXT_DATA] = {
7d740264 3840 .align = __alignof__(u32),
3ac4c07a 3841 },
f25ad2e9
PM		 3842 [NFT_SET_EXT_EXPR] = {
3843 .align = __alignof__(struct nft_expr),
3844 },
8aeff920
PNA		 3845 [NFT_SET_EXT_OBJREF] = {
3846 .len = sizeof(struct nft_object *),
3847 .align = __alignof__(struct nft_object *),
3848 },
3ac4c07a
PM		 3849 [NFT_SET_EXT_FLAGS] = {
3850 .len = sizeof(u8),
3851 .align = __alignof__(u8),
3852 },
c3e1b005
PM		 3853 [NFT_SET_EXT_TIMEOUT] = {
3854 .len = sizeof(u64),
3855 .align = __alignof__(u64),
3856 },
3857 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 3858 .len = sizeof(u64),
3859 .align = __alignof__(u64),
c3e1b005 3860 },
68e942e8
PM		 3861 [NFT_SET_EXT_USERDATA] = {
3862 .len = sizeof(struct nft_userdata),
3863 .align = __alignof__(struct nft_userdata),
3864 },
3ac4c07a
PM		 3865};
3866EXPORT_SYMBOL_GPL(nft_set_ext_types);
3867
20a69341
PM		 3868/*
3869 * Set elements
3870 */
3871
3872static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3873 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3874 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3875 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3876 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3877 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3878 .len = NFT_USERDATA_MAXLEN },
467697d2
FW		 3879 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3880 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
20a69341
PM		 3881};
3882
3883static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3884 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3885 .len = NFT_TABLE_MAXNAMELEN - 1 },
3886 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3887 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3888 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3889 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3890};
3891
633c9a84 3892static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3893 const struct sk_buff *skb,
3894 const struct nlmsghdr *nlh,
f2a6d766 3895 const struct nlattr * const nla[],
36dd1bcc 3896 struct netlink_ext_ack *extack,
f2a6d766 3897 u8 genmask)
20a69341
PM		 3898{
3899 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3900 int family = nfmsg->nfgen_family;
7c95f6d8 3901 struct nft_table *table;
20a69341 3902
cac20fcd
PNA		 3903 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3904 genmask);
36dd1bcc
PNA		 3905 if (IS_ERR(table)) {
3906 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 3907 return PTR_ERR(table);
36dd1bcc 3908 }
20a69341 3909
98319cb9 3910 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3911 return 0;
3912}
3913
3914static int nf_tables_fill_setelem(struct sk_buff *skb,
3915 const struct nft_set *set,
3916 const struct nft_set_elem *elem)
3917{
fe2811eb 3918 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3919 unsigned char *b = skb_tail_pointer(skb);
3920 struct nlattr *nest;
3921
3922 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3923 if (nest == NULL)
3924 goto nla_put_failure;
3925
fe2811eb
PM		 3926 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3927 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3928 goto nla_put_failure;
3929
fe2811eb
PM		 3930 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3931 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3932 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3933 set->dlen) < 0)
3934 goto nla_put_failure;
3935
f25ad2e9
PM		 3936 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3937 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3938 goto nla_put_failure;
3939
8aeff920
PNA		 3940 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3941 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
d152159b 3942 (*nft_set_ext_obj(ext))->key.name) < 0)
8aeff920
PNA		 3943 goto nla_put_failure;
3944
fe2811eb
PM		 3945 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3946 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3947 htonl(*nft_set_ext_flags(ext))))
3948 goto nla_put_failure;
20a69341 3949
c3e1b005
PM		 3950 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3951 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 3952 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 3953 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3954 goto nla_put_failure;
3955
3956 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 3957 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 3958
3959 expires = *nft_set_ext_expiration(ext);
8e1102d5 3960 if (time_before64(now, expires))
c3e1b005
PM		 3961 expires -= now;
3962 else
3963 expires = 0;
3964
3965 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 3966 nf_jiffies64_to_msecs(expires),
b46f6ded 3967 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3968 goto nla_put_failure;
3969 }
3970
68e942e8
PM		 3971 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3972 struct nft_userdata *udata;
3973
3974 udata = nft_set_ext_userdata(ext);
3975 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3976 udata->len + 1, udata->data))
3977 goto nla_put_failure;
3978 }
3979
20a69341
PM		 3980 nla_nest_end(skb, nest);
3981 return 0;
3982
3983nla_put_failure:
3984 nlmsg_trim(skb, b);
3985 return -EMSGSIZE;
3986}
3987
3988struct nft_set_dump_args {
3989 const struct netlink_callback *cb;
3990 struct nft_set_iter iter;
3991 struct sk_buff *skb;
3992};
3993
3994static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3995 struct nft_set *set,
20a69341 3996 const struct nft_set_iter *iter,
de70185d 3997 struct nft_set_elem *elem)
20a69341
PM		 3998{
3999 struct nft_set_dump_args *args;
4000
4001 args = container_of(iter, struct nft_set_dump_args, iter);
4002 return nf_tables_fill_setelem(args->skb, set, elem);
4003}
4004
fa803605
LZ		 4005struct nft_set_dump_ctx {
4006 const struct nft_set *set;
4007 struct nft_ctx ctx;
4008};
4009
20a69341
PM		 4010static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4011{
fa803605 4012 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 4013 struct net *net = sock_net(skb->sk);
fa803605 4014 struct nft_table *table;
de70185d 4015 struct nft_set *set;
20a69341 4016 struct nft_set_dump_args args;
fa803605 4017 bool set_found = false;
20a69341
PM		 4018 struct nfgenmsg *nfmsg;
4019 struct nlmsghdr *nlh;
4020 struct nlattr *nest;
4021 u32 portid, seq;
fa803605 4022 int event;
20a69341 4023
fa803605 4024 rcu_read_lock();
36596dad
PNA		 4025 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4026 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 4027 dump_ctx->ctx.family != table->family)
fa803605 4028 continue;
20a69341 4029
36596dad
PNA		 4030 if (table != dump_ctx->ctx.table)
4031 continue;
20a69341 4032
36596dad
PNA		 4033 list_for_each_entry_rcu(set, &table->sets, list) {
4034 if (set == dump_ctx->set) {
4035 set_found = true;
4036 break;
fa803605 4037 }
fa803605
LZ		 4038 }
4039 break;
4040 }
4041
4042 if (!set_found) {
4043 rcu_read_unlock();
4044 return -ENOENT;
4045 }
20a69341 4046
dedb67c4 4047 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 4048 portid = NETLINK_CB(cb->skb).portid;
4049 seq = cb->nlh->nlmsg_seq;
4050
4051 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4052 NLM_F_MULTI);
4053 if (nlh == NULL)
4054 goto nla_put_failure;
4055
4056 nfmsg = nlmsg_data(nlh);
98319cb9 4057 nfmsg->nfgen_family = table->family;
20a69341 4058 nfmsg->version = NFNETLINK_V0;
fa803605 4059 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 4060
fa803605 4061 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 4062 goto nla_put_failure;
4063 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4064 goto nla_put_failure;
4065
4066 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4067 if (nest == NULL)
4068 goto nla_put_failure;
4069
8588ac09
PNA		 4070 args.cb = cb;
4071 args.skb = skb;
fa803605 4072 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 4073 args.iter.skip = cb->args[0];
4074 args.iter.count = 0;
4075 args.iter.err = 0;
4076 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 4077 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4078 rcu_read_unlock();
20a69341
PM		 4079
4080 nla_nest_end(skb, nest);
4081 nlmsg_end(skb, nlh);
4082
4083 if (args.iter.err && args.iter.err != -EMSGSIZE)
4084 return args.iter.err;
4085 if (args.iter.count == cb->args[0])
4086 return 0;
4087
4088 cb->args[0] = args.iter.count;
4089 return skb->len;
4090
4091nla_put_failure:
fa803605 4092 rcu_read_unlock();
20a69341
PM		 4093 return -ENOSPC;
4094}
4095
90fd131a
FW		 4096static int nf_tables_dump_set_start(struct netlink_callback *cb)
4097{
4098 struct nft_set_dump_ctx *dump_ctx = cb->data;
4099
4100 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4101
4102 return cb->data ? 0 : -ENOMEM;
4103}
4104
fa803605
LZ		 4105static int nf_tables_dump_set_done(struct netlink_callback *cb)
4106{
4107 kfree(cb->data);
4108 return 0;
4109}
4110
d60ce62f
AB		 4111static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4112 const struct nft_ctx *ctx, u32 seq,
4113 u32 portid, int event, u16 flags,
4114 const struct nft_set *set,
4115 const struct nft_set_elem *elem)
4116{
4117 struct nfgenmsg *nfmsg;
4118 struct nlmsghdr *nlh;
4119 struct nlattr *nest;
4120 int err;
4121
dedb67c4 4122 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 4123 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4124 flags);
4125 if (nlh == NULL)
4126 goto nla_put_failure;
4127
4128 nfmsg = nlmsg_data(nlh);
36596dad 4129 nfmsg->nfgen_family = ctx->family;
d60ce62f 4130 nfmsg->version = NFNETLINK_V0;
84d7fce6 4131 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 4132
4133 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4134 goto nla_put_failure;
4135 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4136 goto nla_put_failure;
4137
4138 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4139 if (nest == NULL)
4140 goto nla_put_failure;
4141
4142 err = nf_tables_fill_setelem(skb, set, elem);
4143 if (err < 0)
4144 goto nla_put_failure;
4145
4146 nla_nest_end(skb, nest);
4147
053c095a
JB		 4148 nlmsg_end(skb, nlh);
4149 return 0;
d60ce62f
AB		 4150
4151nla_put_failure:
4152 nlmsg_trim(skb, nlh);
4153 return -1;
4154}
4155
ba0e4d99
PNA		 4156static int nft_setelem_parse_flags(const struct nft_set *set,
4157 const struct nlattr *attr, u32 *flags)
4158{
4159 if (attr == NULL)
4160 return 0;
4161
4162 *flags = ntohl(nla_get_be32(attr));
4163 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4164 return -EINVAL;
4165 if (!(set->flags & NFT_SET_INTERVAL) &&
4166 *flags & NFT_SET_ELEM_INTERVAL_END)
4167 return -EINVAL;
4168
4169 return 0;
4170}
4171
4172static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4173 const struct nlattr *attr)
4174{
4175 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
ba0e4d99
PNA		 4176 struct nft_data_desc desc;
4177 struct nft_set_elem elem;
4178 struct sk_buff *skb;
4179 uint32_t flags = 0;
4180 void *priv;
4181 int err;
4182
4183 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4184 nft_set_elem_policy, NULL);
4185 if (err < 0)
4186 return err;
4187
4188 if (!nla[NFTA_SET_ELEM_KEY])
4189 return -EINVAL;
4190
4191 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4192 if (err < 0)
4193 return err;
4194
4195 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4196 nla[NFTA_SET_ELEM_KEY]);
4197 if (err < 0)
4198 return err;
4199
4200 err = -EINVAL;
4201 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4202 return err;
4203
4204 priv = set->ops->get(ctx->net, set, &elem, flags);
4205 if (IS_ERR(priv))
4206 return PTR_ERR(priv);
4207
4208 elem.priv = priv;
ba0e4d99
PNA		 4209
4210 err = -ENOMEM;
d9adf22a 4211 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
ba0e4d99
PNA		 4212 if (skb == NULL)
4213 goto err1;
4214
4215 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4216 NFT_MSG_NEWSETELEM, 0, set, &elem);
4217 if (err < 0)
4218 goto err2;
4219
4220 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4221 /* This avoids a loop in nfnetlink. */
4222 if (err < 0)
4223 goto err1;
4224
4225 return 0;
4226err2:
4227 kfree_skb(skb);
4228err1:
4229 /* this avoids a loop in nfnetlink. */
4230 return err == -EAGAIN ? -ENOBUFS : err;
4231}
4232
d9adf22a 4233/* called with rcu_read_lock held */
ba0e4d99
PNA		 4234static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4235 struct sk_buff *skb, const struct nlmsghdr *nlh,
4236 const struct nlattr * const nla[],
4237 struct netlink_ext_ack *extack)
4238{
4239 u8 genmask = nft_genmask_cur(net);
4240 struct nft_set *set;
4241 struct nlattr *attr;
4242 struct nft_ctx ctx;
4243 int rem, err = 0;
4244
36dd1bcc
PNA		 4245 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4246 genmask);
ba0e4d99
PNA		 4247 if (err < 0)
4248 return err;
4249
cac20fcd 4250 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 4251 if (IS_ERR(set))
4252 return PTR_ERR(set);
4253
4254 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4255 struct netlink_dump_control c = {
90fd131a 4256 .start = nf_tables_dump_set_start,
ba0e4d99
PNA		 4257 .dump = nf_tables_dump_set,
4258 .done = nf_tables_dump_set_done,
d9adf22a 4259 .module = THIS_MODULE,
ba0e4d99 4260 };
90fd131a
FW		 4261 struct nft_set_dump_ctx dump_ctx = {
4262 .set = set,
4263 .ctx = ctx,
4264 };
ba0e4d99 4265
90fd131a 4266 c.data = &dump_ctx;
d9adf22a 4267 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
ba0e4d99
PNA		 4268 }
4269
4270 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4271 return -EINVAL;
4272
4273 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4274 err = nft_get_set_elem(&ctx, set, attr);
4275 if (err < 0)
4276 break;
4277 }
4278
4279 return err;
4280}
4281
25e94a99
PNA		 4282static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4283 const struct nft_set *set,
4284 const struct nft_set_elem *elem,
4285 int event, u16 flags)
d60ce62f 4286{
128ad332
PNA		 4287 struct net *net = ctx->net;
4288 u32 portid = ctx->portid;
d60ce62f
AB		 4289 struct sk_buff *skb;
4290 int err;
4291
128ad332 4292 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4293 return;
d60ce62f 4294
d60ce62f
AB		 4295 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4296 if (skb == NULL)
4297 goto err;
4298
4299 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4300 set, elem);
4301 if (err < 0) {
4302 kfree_skb(skb);
4303 goto err;
4304 }
4305
25e94a99
PNA		 4306 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4307 GFP_KERNEL);
4308 return;
d60ce62f 4309err:
25e94a99 4310 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 4311}
4312
60319eb1
PNA		 4313static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4314 int msg_type,
4315 struct nft_set *set)
4316{
4317 struct nft_trans *trans;
4318
4319 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4320 if (trans == NULL)
4321 return NULL;
4322
4323 nft_trans_elem_set(trans) = set;
4324 return trans;
4325}
4326
22fe54d5
PM		 4327void *nft_set_elem_init(const struct nft_set *set,
4328 const struct nft_set_ext_tmpl *tmpl,
49499c3e 4329 const u32 *key, const u32 *data,
22fe54d5 4330 u64 timeout, gfp_t gfp)
fe2811eb
PM		 4331{
4332 struct nft_set_ext *ext;
4333 void *elem;
4334
4335 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4336 if (elem == NULL)
4337 return NULL;
4338
4339 ext = nft_set_elem_ext(set, elem);
4340 nft_set_ext_init(ext, tmpl);
4341
4342 memcpy(nft_set_ext_key(ext), key, set->klen);
4343 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4344 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 4345 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
4346 *nft_set_ext_expiration(ext) =
8e1102d5 4347 get_jiffies_64() + timeout;
c3e1b005
PM		 4348 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4349 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 4350
4351 return elem;
4352}
4353
61f9e292
LZ		 4354void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4355 bool destroy_expr)
61edafbb
PM		 4356{
4357 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3453c927
PNA		 4358 struct nft_ctx ctx = {
4359 .net = read_pnet(&set->net),
4360 .family = set->table->family,
4361 };
61edafbb 4362
59105446 4363 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 4364 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 4365 nft_data_release(nft_set_ext_data(ext), set->dtype);
371ebcbb
PNA		 4366 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4367 struct nft_expr *expr = nft_set_ext_expr(ext);
4368
4369 if (expr->ops->destroy_clone) {
4370 expr->ops->destroy_clone(&ctx, expr);
4371 module_put(expr->ops->type->owner);
4372 } else {
4373 nf_tables_expr_destroy(&ctx, expr);
4374 }
4375 }
8aeff920
PNA		 4376 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4377 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 4378 kfree(elem);
4379}
4380EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4381
59105446
PNA		 4382/* Only called from commit path, nft_set_elem_deactivate() already deals with
4383 * the refcounting from the preparation phase.
4384 */
3453c927
PNA		 4385static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4386 const struct nft_set *set, void *elem)
59105446
PNA		 4387{
4388 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4389
4390 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3453c927 4391 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
59105446
PNA		 4392 kfree(elem);
4393}
4394
60319eb1 4395static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 4396 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 4397{
4398 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 4399 u8 genmask = nft_genmask_next(ctx->net);
20a69341 4400 struct nft_data_desc d1, d2;
fe2811eb 4401 struct nft_set_ext_tmpl tmpl;
c016c7e4 4402 struct nft_set_ext *ext, *ext2;
20a69341
PM		 4403 struct nft_set_elem elem;
4404 struct nft_set_binding *binding;
8aeff920 4405 struct nft_object *obj = NULL;
68e942e8 4406 struct nft_userdata *udata;
fe2811eb 4407 struct nft_data data;
20a69341 4408 enum nft_registers dreg;
60319eb1 4409 struct nft_trans *trans;
0e9091d6 4410 u32 flags = 0;
c3e1b005 4411 u64 timeout;
68e942e8 4412 u8 ulen;
20a69341
PM		 4413 int err;
4414
4415 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4416 nft_set_elem_policy, NULL);
20a69341
PM		 4417 if (err < 0)
4418 return err;
4419
4420 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4421 return -EINVAL;
4422
fe2811eb
PM		 4423 nft_set_ext_prepare(&tmpl);
4424
0e9091d6
PNA		 4425 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4426 if (err < 0)
4427 return err;
4428 if (flags != 0)
4429 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 4430
4431 if (set->flags & NFT_SET_MAP) {
4432 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 4433 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 4434 return -EINVAL;
bd7fc645 4435 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 4436 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 4437 return -EINVAL;
20a69341
PM		 4438 } else {
4439 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4440 return -EINVAL;
4441 }
4442
c3e1b005
PM		 4443 timeout = 0;
4444 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4445 if (!(set->flags & NFT_SET_TIMEOUT))
4446 return -EINVAL;
8e1102d5
FW		 4447 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4448 &timeout);
4449 if (err)
4450 return err;
c3e1b005
PM		 4451 } else if (set->flags & NFT_SET_TIMEOUT) {
4452 timeout = set->timeout;
4453 }
4454
7d740264 4455 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 4456 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4457 if (err < 0)
4458 goto err1;
4459 err = -EINVAL;
4460 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4461 goto err2;
4462
7d740264 4463 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 4464 if (timeout > 0) {
4465 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4466 if (timeout != set->timeout)
4467 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4468 }
fe2811eb 4469
8aeff920
PNA		 4470 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4471 if (!(set->flags & NFT_SET_OBJECT)) {
4472 err = -EINVAL;
4473 goto err2;
4474 }
4d44175a
FW		 4475 obj = nft_obj_lookup(ctx->net, ctx->table,
4476 nla[NFTA_SET_ELEM_OBJREF],
cac20fcd 4477 set->objtype, genmask);
8aeff920
PNA		 4478 if (IS_ERR(obj)) {
4479 err = PTR_ERR(obj);
4480 goto err2;
4481 }
4482 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4483 }
4484
20a69341 4485 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 4486 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4487 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 4488 if (err < 0)
4489 goto err2;
4490
4491 err = -EINVAL;
4492 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4493 goto err3;
4494
4495 dreg = nft_type_to_reg(set->dtype);
4496 list_for_each_entry(binding, &set->bindings, list) {
4497 struct nft_ctx bind_ctx = {
58c78e10 4498 .net = ctx->net,
36596dad 4499 .family = ctx->family,
20a69341 4500 .table = ctx->table,
7c95f6d8 4501 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4502 };
4503
11113e19
PM		 4504 if (!(binding->flags & NFT_SET_MAP))
4505 continue;
4506
1ec10212
PM		 4507 err = nft_validate_register_store(&bind_ctx, dreg,
4508 &data,
4509 d2.type, d2.len);
20a69341
PM		 4510 if (err < 0)
4511 goto err3;
a654de8f
PNA		 4512
4513 if (d2.type == NFT_DATA_VERDICT &&
4514 (data.verdict.code == NFT_GOTO ||
4515 data.verdict.code == NFT_JUMP))
4516 nft_validate_state_update(ctx->net,
4517 NFT_VALIDATE_NEED);
20a69341 4518 }
fe2811eb 4519
7d740264 4520 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4521 }
4522
68e942e8
PM		 4523 /* The full maximum length of userdata can exceed the maximum
4524 * offset value (U8_MAX) for following extensions, therefor it
4525 * must be the last extension added.
4526 */
4527 ulen = 0;
4528 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4529 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4530 if (ulen > 0)
4531 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4532 ulen);
4533 }
4534
fe2811eb 4535 err = -ENOMEM;
7d740264 4536 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 4537 timeout, GFP_KERNEL);
fe2811eb
PM		 4538 if (elem.priv == NULL)
4539 goto err3;
4540
4541 ext = nft_set_elem_ext(set, elem.priv);
4542 if (flags)
4543 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4544 if (ulen > 0) {
4545 udata = nft_set_ext_userdata(ext);
4546 udata->len = ulen - 1;
4547 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4548 }
8aeff920
PNA		 4549 if (obj) {
4550 *nft_set_ext_obj(ext) = obj;
4551 obj->use++;
4552 }
fe2811eb 4553
60319eb1
PNA		 4554 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4555 if (trans == NULL)
fe2811eb 4556 goto err4;
60319eb1 4557
69086658 4558 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4559 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4560 if (err) {
4561 if (err == -EEXIST) {
9744a6fc
PNA		 4562 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4563 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4564 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
f0dfd7a2
CIK		 4565 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4566 err = -EBUSY;
4567 goto err5;
4568 }
8aeff920
PNA		 4569 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4570 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4571 memcmp(nft_set_ext_data(ext),
4572 nft_set_ext_data(ext2), set->dlen) != 0) ||
4573 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4574 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4575 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4576 err = -EBUSY;
4577 else if (!(nlmsg_flags & NLM_F_EXCL))
4578 err = 0;
4579 }
fe2811eb 4580 goto err5;
c016c7e4 4581 }
20a69341 4582
35d0ac90
PNA		 4583 if (set->size &&
4584 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4585 err = -ENFILE;
4586 goto err6;
4587 }
4588
60319eb1 4589 nft_trans_elem(trans) = elem;
46bbafce 4590 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4591 return 0;
4592
35d0ac90 4593err6:
5cb82a38 4594 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4595err5:
60319eb1 4596 kfree(trans);
fe2811eb 4597err4:
b91d9036
TY		 4598 if (obj)
4599 obj->use--;
fe2811eb 4600 kfree(elem.priv);
20a69341
PM		 4601err3:
4602 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4603 nft_data_release(&data, d2.type);
20a69341 4604err2:
59105446 4605 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4606err1:
4607 return err;
4608}
4609
633c9a84
PNA		 4610static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4611 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4612 const struct nlattr * const nla[],
4613 struct netlink_ext_ack *extack)
20a69341 4614{
f2a6d766 4615 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4616 const struct nlattr *attr;
4617 struct nft_set *set;
4618 struct nft_ctx ctx;
a654de8f 4619 int rem, err;
20a69341 4620
7d5570ca
PNA		 4621 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4622 return -EINVAL;
4623
36dd1bcc
PNA		 4624 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4625 genmask);
20a69341
PM		 4626 if (err < 0)
4627 return err;
4628
a3073c17
PNA		 4629 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4630 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4631 if (IS_ERR(set))
4632 return PTR_ERR(set);
958bee14 4633
20a69341
PM		 4634 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4635 return -EBUSY;
4636
4637 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4638 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4639 if (err < 0)
a654de8f 4640 return err;
20a69341 4641 }
a654de8f
PNA		 4642
4643 if (net->nft.validate_state == NFT_VALIDATE_DO)
4644 return nft_table_validate(net, ctx.table);
4645
4646 return 0;
20a69341
PM		 4647}
4648
59105446
PNA		 4649/**
4650 * nft_data_hold - hold a nft_data item
4651 *
4652 * @data: struct nft_data to release
4653 * @type: type of data
4654 *
4655 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4656 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4657 * NFT_GOTO verdicts. This function must be called on active data objects
4658 * from the second phase of the commit protocol.
4659 */
bb7b40ae 4660void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
59105446
PNA		 4661{
4662 if (type == NFT_DATA_VERDICT) {
4663 switch (data->verdict.code) {
4664 case NFT_JUMP:
4665 case NFT_GOTO:
4666 data->verdict.chain->use++;
4667 break;
4668 }
4669 }
4670}
4671
4672static void nft_set_elem_activate(const struct net *net,
4673 const struct nft_set *set,
4674 struct nft_set_elem *elem)
4675{
4676 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4677
4678 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4679 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4680 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4681 (*nft_set_ext_obj(ext))->use++;
4682}
4683
4684static void nft_set_elem_deactivate(const struct net *net,
4685 const struct nft_set *set,
4686 struct nft_set_elem *elem)
4687{
4688 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4689
4690 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4691 nft_data_release(nft_set_ext_data(ext), set->dtype);
4692 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4693 (*nft_set_ext_obj(ext))->use--;
4694}
4695
60319eb1 4696static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4697 const struct nlattr *attr)
4698{
4699 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4700 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4701 struct nft_data_desc desc;
4702 struct nft_set_elem elem;
3971ca14 4703 struct nft_set_ext *ext;
60319eb1 4704 struct nft_trans *trans;
3971ca14
PNA		 4705 u32 flags = 0;
4706 void *priv;
20a69341
PM		 4707 int err;
4708
4709 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4710 nft_set_elem_policy, NULL);
20a69341
PM		 4711 if (err < 0)
4712 goto err1;
4713
4714 err = -EINVAL;
4715 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4716 goto err1;
4717
3971ca14
PNA		 4718 nft_set_ext_prepare(&tmpl);
4719
4720 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4721 if (err < 0)
4722 return err;
4723 if (flags != 0)
4724 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4725
7d740264 4726 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4727 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4728 if (err < 0)
4729 goto err1;
4730
4731 err = -EINVAL;
4732 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4733 goto err2;
4734
3971ca14
PNA		 4735 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4736
4737 err = -ENOMEM;
4738 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4739 GFP_KERNEL);
4740 if (elem.priv == NULL)
4741 goto err2;
4742
4743 ext = nft_set_elem_ext(set, elem.priv);
4744 if (flags)
4745 *nft_set_ext_flags(ext) = flags;
4746
60319eb1 4747 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4748 if (trans == NULL) {
4749 err = -ENOMEM;
3971ca14 4750 goto err3;
609ccf08 4751 }
20a69341 4752
42a55769 4753 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4754 if (priv == NULL) {
cc02e457 4755 err = -ENOENT;
3971ca14 4756 goto err4;
cc02e457 4757 }
3971ca14
PNA		 4758 kfree(elem.priv);
4759 elem.priv = priv;
cc02e457 4760
59105446
PNA		 4761 nft_set_elem_deactivate(ctx->net, set, &elem);
4762
60319eb1 4763 nft_trans_elem(trans) = elem;
46bbafce 4764 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4765 return 0;
cc02e457 4766
3971ca14 4767err4:
cc02e457 4768 kfree(trans);
3971ca14
PNA		 4769err3:
4770 kfree(elem.priv);
20a69341 4771err2:
59105446 4772 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4773err1:
4774 return err;
4775}
4776
8411b644 4777static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4778 struct nft_set *set,
8411b644 4779 const struct nft_set_iter *iter,
de70185d 4780 struct nft_set_elem *elem)
8411b644
PNA		 4781{
4782 struct nft_trans *trans;
4783 int err;
4784
4785 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4786 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4787 if (!trans)
4788 return -ENOMEM;
4789
1ba1c414 4790 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4791 err = -ENOENT;
4792 goto err1;
4793 }
b2c11e4b 4794 set->ndeact++;
8411b644 4795
7acfda53 4796 nft_set_elem_deactivate(ctx->net, set, elem);
de70185d
PNA		 4797 nft_trans_elem_set(trans) = set;
4798 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4799 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4800
4801 return 0;
4802err1:
4803 kfree(trans);
4804 return err;
4805}
4806
633c9a84
PNA		 4807static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4808 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4809 const struct nlattr * const nla[],
4810 struct netlink_ext_ack *extack)
20a69341 4811{
f2a6d766 4812 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4813 const struct nlattr *attr;
4814 struct nft_set *set;
4815 struct nft_ctx ctx;
60319eb1 4816 int rem, err = 0;
20a69341 4817
36dd1bcc
PNA		 4818 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4819 genmask);
20a69341
PM		 4820 if (err < 0)
4821 return err;
4822
cac20fcd 4823 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 4824 if (IS_ERR(set))
4825 return PTR_ERR(set);
4826 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4827 return -EBUSY;
4828
8411b644 4829 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4830 struct nft_set_iter iter = {
4831 .genmask = genmask,
4832 .fn = nft_flush_set,
8411b644 4833 };
baa2d42c 4834 set->ops->walk(&ctx, set, &iter);
8411b644 4835
baa2d42c 4836 return iter.err;
8411b644
PNA		 4837 }
4838
20a69341
PM		 4839 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4840 err = nft_del_setelem(&ctx, set, attr);
4841 if (err < 0)
60319eb1 4842 break;
4fefee57 4843
3dd0673a 4844 set->ndeact++;
20a69341 4845 }
60319eb1 4846 return err;
20a69341
PM		 4847}
4848
cfed7e1b
PM		 4849void nft_set_gc_batch_release(struct rcu_head *rcu)
4850{
4851 struct nft_set_gc_batch *gcb;
4852 unsigned int i;
4853
4854 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4855 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4856 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4857 kfree(gcb);
4858}
4859EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4860
4861struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4862 gfp_t gfp)
4863{
4864 struct nft_set_gc_batch *gcb;
4865
4866 gcb = kzalloc(sizeof(*gcb), gfp);
4867 if (gcb == NULL)
4868 return gcb;
4869 gcb->head.set = set;
4870 return gcb;
4871}
4872EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4873
e5009240
PNA		 4874/*
4875 * Stateful objects
4876 */
4877
4878/**
4879 * nft_register_obj- register nf_tables stateful object type
4880 * @obj: object type
4881 *
4882 * Registers the object type for use with nf_tables. Returns zero on
4883 * success or a negative errno code otherwise.
4884 */
4885int nft_register_obj(struct nft_object_type *obj_type)
4886{
4887 if (obj_type->type == NFT_OBJECT_UNSPEC)
4888 return -EINVAL;
4889
4890 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4891 list_add_rcu(&obj_type->list, &nf_tables_objects);
4892 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4893 return 0;
4894}
4895EXPORT_SYMBOL_GPL(nft_register_obj);
4896
4897/**
4898 * nft_unregister_obj - unregister nf_tables object type
4899 * @obj: object type
4900 *
4901 * Unregisters the object type for use with nf_tables.
4902 */
4903void nft_unregister_obj(struct nft_object_type *obj_type)
4904{
4905 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4906 list_del_rcu(&obj_type->list);
4907 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4908}
4909EXPORT_SYMBOL_GPL(nft_unregister_obj);
4910
4d44175a
FW		 4911struct nft_object *nft_obj_lookup(const struct net *net,
4912 const struct nft_table *table,
cac20fcd
PNA		 4913 const struct nlattr *nla, u32 objtype,
4914 u8 genmask)
e5009240 4915{
4d44175a
FW		 4916 struct nft_object_hash_key k = { .table = table };
4917 char search[NFT_OBJ_MAXNAMELEN];
4918 struct rhlist_head *tmp, *list;
e5009240
PNA		 4919 struct nft_object *obj;
4920
4d44175a
FW		 4921 nla_strlcpy(search, nla, sizeof(search));
4922 k.name = search;
4923
4924 WARN_ON_ONCE(!rcu_read_lock_held() &&
4925 !lockdep_commit_lock_is_held(net));
4926
4927 rcu_read_lock();
4928 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
4929 if (!list)
4930 goto out;
4931
4932 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
4933 if (objtype == obj->ops->type->type &&
4934 nft_active_genmask(obj, genmask)) {
4935 rcu_read_unlock();
e5009240 4936 return obj;
4d44175a 4937 }
e5009240 4938 }
4d44175a
FW		 4939out:
4940 rcu_read_unlock();
e5009240
PNA		 4941 return ERR_PTR(-ENOENT);
4942}
cac20fcd 4943EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 4944
cac20fcd
PNA		 4945static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4946 const struct nlattr *nla,
4947 u32 objtype, u8 genmask)
3ecbfd65
HS		 4948{
4949 struct nft_object *obj;
4950
4951 list_for_each_entry(obj, &table->objects, list) {
4952 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4953 objtype == obj->ops->type->type &&
4954 nft_active_genmask(obj, genmask))
4955 return obj;
4956 }
4957 return ERR_PTR(-ENOENT);
4958}
4959
e5009240 4960static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4961 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4962 .len = NFT_TABLE_MAXNAMELEN - 1 },
4963 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4964 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4965 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4966 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 4967 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 4968};
4969
84fba055
FW		 4970static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4971 const struct nft_object_type *type,
e5009240
PNA		 4972 const struct nlattr *attr)
4973{
5b4c6e38 4974 struct nlattr **tb;
dfc46034 4975 const struct nft_object_ops *ops;
e5009240 4976 struct nft_object *obj;
5b4c6e38
GS		 4977 int err = -ENOMEM;
4978
4979 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4980 if (!tb)
4981 goto err1;
e5009240
PNA		 4982
4983 if (attr) {
fceb6435
JB		 4984 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4985 NULL);
e5009240 4986 if (err < 0)
5b4c6e38 4987 goto err2;
e5009240
PNA		 4988 } else {
4989 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4990 }
4991
dfc46034
PBG		 4992 if (type->select_ops) {
4993 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4994 if (IS_ERR(ops)) {
4995 err = PTR_ERR(ops);
5b4c6e38 4996 goto err2;
dfc46034
PBG		 4997 }
4998 } else {
4999 ops = type->ops;
5000 }
5001
e5009240 5002 err = -ENOMEM;
dfc46034 5003 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 5004 if (!obj)
5005 goto err2;
e5009240 5006
dfc46034 5007 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 5008 if (err < 0)
5b4c6e38 5009 goto err3;
e5009240 5010
dfc46034
PBG		 5011 obj->ops = ops;
5012
5b4c6e38 5013 kfree(tb);
e5009240 5014 return obj;
5b4c6e38 5015err3:
e5009240 5016 kfree(obj);
5b4c6e38
GS		 5017err2:
5018 kfree(tb);
e5009240
PNA		 5019err1:
5020 return ERR_PTR(err);
5021}
5022
5023static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 5024 struct nft_object *obj, bool reset)
e5009240
PNA		 5025{
5026 struct nlattr *nest;
5027
5028 nest = nla_nest_start(skb, attr);
5029 if (!nest)
5030 goto nla_put_failure;
dfc46034 5031 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 5032 goto nla_put_failure;
5033 nla_nest_end(skb, nest);
5034 return 0;
5035
5036nla_put_failure:
5037 return -1;
5038}
5039
5040static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5041{
5042 const struct nft_object_type *type;
5043
5044 list_for_each_entry(type, &nf_tables_objects, list) {
5045 if (objtype == type->type)
5046 return type;
5047 }
5048 return NULL;
5049}
5050
452238e8
FW		 5051static const struct nft_object_type *
5052nft_obj_type_get(struct net *net, u32 objtype)
e5009240
PNA		 5053{
5054 const struct nft_object_type *type;
5055
5056 type = __nft_obj_type_get(objtype);
5057 if (type != NULL && try_module_get(type->owner))
5058 return type;
5059
f102d66b 5060 lockdep_nfnl_nft_mutex_not_held();
e5009240
PNA		 5061#ifdef CONFIG_MODULES
5062 if (type == NULL) {
452238e8 5063 nft_request_module(net, "nft-obj-%u", objtype);
e5009240
PNA		 5064 if (__nft_obj_type_get(objtype))
5065 return ERR_PTR(-EAGAIN);
5066 }
5067#endif
5068 return ERR_PTR(-ENOENT);
5069}
5070
5071static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5072 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5073 const struct nlattr * const nla[],
5074 struct netlink_ext_ack *extack)
e5009240
PNA		 5075{
5076 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5077 const struct nft_object_type *type;
5078 u8 genmask = nft_genmask_next(net);
5079 int family = nfmsg->nfgen_family;
e5009240
PNA		 5080 struct nft_table *table;
5081 struct nft_object *obj;
5082 struct nft_ctx ctx;
5083 u32 objtype;
5084 int err;
5085
5086 if (!nla[NFTA_OBJ_TYPE] ||
5087 !nla[NFTA_OBJ_NAME] ||
5088 !nla[NFTA_OBJ_DATA])
5089 return -EINVAL;
5090
cac20fcd 5091 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5092 if (IS_ERR(table)) {
5093 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5094 return PTR_ERR(table);
36dd1bcc 5095 }
e5009240
PNA		 5096
5097 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5098 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 5099 if (IS_ERR(obj)) {
5100 err = PTR_ERR(obj);
36dd1bcc
PNA		 5101 if (err != -ENOENT) {
5102 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5103 return err;
36dd1bcc 5104 }
1a28ad74 5105 } else {
36dd1bcc
PNA		 5106 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5107 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5108 return -EEXIST;
36dd1bcc 5109 }
e5009240
PNA		 5110 return 0;
5111 }
5112
98319cb9 5113 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240 5114
452238e8 5115 type = nft_obj_type_get(net, objtype);
e5009240
PNA		 5116 if (IS_ERR(type))
5117 return PTR_ERR(type);
5118
84fba055 5119 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 5120 if (IS_ERR(obj)) {
5121 err = PTR_ERR(obj);
5122 goto err1;
5123 }
d152159b 5124 obj->key.table = table;
3ecbfd65
HS		 5125 obj->handle = nf_tables_alloc_handle(table);
5126
d152159b
FW		 5127 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5128 if (!obj->key.name) {
61509575
PS		 5129 err = -ENOMEM;
5130 goto err2;
5131 }
e5009240
PNA		 5132
5133 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5134 if (err < 0)
61509575 5135 goto err3;
e5009240 5136
4d44175a
FW		 5137 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
5138 nft_objname_ht_params);
5139 if (err < 0)
5140 goto err4;
5141
e5009240
PNA		 5142 list_add_tail_rcu(&obj->list, &table->objects);
5143 table->use++;
5144 return 0;
4d44175a
FW		 5145err4:
5146 /* queued in transaction log */
5147 INIT_LIST_HEAD(&obj->list);
5148 return err;
61509575 5149err3:
d152159b 5150 kfree(obj->key.name);
e5009240 5151err2:
dfc46034 5152 if (obj->ops->destroy)
00bfb320 5153 obj->ops->destroy(&ctx, obj);
e5009240
PNA		 5154 kfree(obj);
5155err1:
5156 module_put(type->owner);
5157 return err;
5158}
5159
5160static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5161 u32 portid, u32 seq, int event, u32 flags,
5162 int family, const struct nft_table *table,
43da04a5 5163 struct nft_object *obj, bool reset)
e5009240
PNA		 5164{
5165 struct nfgenmsg *nfmsg;
5166 struct nlmsghdr *nlh;
5167
dedb67c4 5168 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 5169 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5170 if (nlh == NULL)
5171 goto nla_put_failure;
5172
5173 nfmsg = nlmsg_data(nlh);
5174 nfmsg->nfgen_family = family;
5175 nfmsg->version = NFNETLINK_V0;
5176 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5177
5178 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
d152159b 5179 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
dfc46034 5180 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 5181 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 5182 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5183 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5184 NFTA_OBJ_PAD))
e5009240
PNA		 5185 goto nla_put_failure;
5186
5187 nlmsg_end(skb, nlh);
5188 return 0;
5189
5190nla_put_failure:
5191 nlmsg_trim(skb, nlh);
5192 return -1;
5193}
5194
a9fea2a3 5195struct nft_obj_filter {
e46abbcc 5196 char *table;
a9fea2a3
PNA		 5197 u32 type;
5198};
5199
e5009240
PNA		 5200static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
5201{
5202 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 5203 const struct nft_table *table;
e5009240 5204 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 5205 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 5206 struct net *net = sock_net(skb->sk);
5207 int family = nfmsg->nfgen_family;
43da04a5
PNA		 5208 struct nft_object *obj;
5209 bool reset = false;
5210
5211 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5212 reset = true;
e5009240
PNA		 5213
5214 rcu_read_lock();
5215 cb->seq = net->nft.base_seq;
5216
36596dad 5217 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5218 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 5219 continue;
5220
36596dad
PNA		 5221 list_for_each_entry_rcu(obj, &table->objects, list) {
5222 if (!nft_is_active(net, obj))
5223 goto cont;
5224 if (idx < s_idx)
5225 goto cont;
5226 if (idx > s_idx)
5227 memset(&cb->args[1], 0,
5228 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5229 if (filter && filter->table &&
36596dad
PNA		 5230 strcmp(filter->table, table->name))
5231 goto cont;
5232 if (filter &&
5233 filter->type != NFT_OBJECT_UNSPEC &&
5234 obj->ops->type->type != filter->type)
5235 goto cont;
a9fea2a3 5236
36596dad
PNA		 5237 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
5238 cb->nlh->nlmsg_seq,
5239 NFT_MSG_NEWOBJ,
5240 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5241 table->family, table,
36596dad
PNA		 5242 obj, reset) < 0)
5243 goto done;
e5009240 5244
36596dad 5245 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 5246cont:
36596dad 5247 idx++;
e5009240
PNA		 5248 }
5249 }
5250done:
5251 rcu_read_unlock();
5252
5253 cb->args[0] = idx;
5254 return skb->len;
5255}
5256
90fd131a 5257static int nf_tables_dump_obj_start(struct netlink_callback *cb)
a9fea2a3 5258{
90fd131a
FW		 5259 const struct nlattr * const *nla = cb->data;
5260 struct nft_obj_filter *filter = NULL;
e46abbcc 5261
90fd131a
FW		 5262 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
5263 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5264 if (!filter)
5265 return -ENOMEM;
5266
5267 if (nla[NFTA_OBJ_TABLE]) {
5268 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
5269 if (!filter->table) {
5270 kfree(filter);
5271 return -ENOMEM;
5272 }
5273 }
5274
5275 if (nla[NFTA_OBJ_TYPE])
5276 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
8bea728d 5277 }
a9fea2a3 5278
90fd131a 5279 cb->data = filter;
a9fea2a3
PNA		 5280 return 0;
5281}
5282
90fd131a 5283static int nf_tables_dump_obj_done(struct netlink_callback *cb)
a9fea2a3 5284{
90fd131a 5285 struct nft_obj_filter *filter = cb->data;
a9fea2a3 5286
90fd131a
FW		 5287 if (filter) {
5288 kfree(filter->table);
5289 kfree(filter);
e46abbcc 5290 }
a9fea2a3 5291
90fd131a 5292 return 0;
a9fea2a3
PNA		 5293}
5294
d9adf22a 5295/* called with rcu_read_lock held */
e5009240
PNA		 5296static int nf_tables_getobj(struct net *net, struct sock *nlsk,
5297 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5298 const struct nlattr * const nla[],
5299 struct netlink_ext_ack *extack)
e5009240
PNA		 5300{
5301 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5302 u8 genmask = nft_genmask_cur(net);
5303 int family = nfmsg->nfgen_family;
e5009240
PNA		 5304 const struct nft_table *table;
5305 struct nft_object *obj;
5306 struct sk_buff *skb2;
43da04a5 5307 bool reset = false;
e5009240
PNA		 5308 u32 objtype;
5309 int err;
5310
5311 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5312 struct netlink_dump_control c = {
90fd131a 5313 .start = nf_tables_dump_obj_start,
e5009240 5314 .dump = nf_tables_dump_obj,
a9fea2a3 5315 .done = nf_tables_dump_obj_done,
d9adf22a 5316 .module = THIS_MODULE,
90fd131a 5317 .data = (void *)nla,
e5009240 5318 };
a9fea2a3 5319
d9adf22a 5320 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
e5009240
PNA		 5321 }
5322
5323 if (!nla[NFTA_OBJ_NAME] ||
5324 !nla[NFTA_OBJ_TYPE])
5325 return -EINVAL;
5326
cac20fcd 5327 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5328 if (IS_ERR(table)) {
5329 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5330 return PTR_ERR(table);
36dd1bcc 5331 }
e5009240
PNA		 5332
5333 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5334 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 5335 if (IS_ERR(obj)) {
5336 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5337 return PTR_ERR(obj);
36dd1bcc 5338 }
e5009240 5339
d9adf22a 5340 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
e5009240
PNA		 5341 if (!skb2)
5342 return -ENOMEM;
5343
43da04a5
PNA		 5344 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5345 reset = true;
5346
e5009240
PNA		 5347 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5348 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 5349 family, table, obj, reset);
e5009240
PNA		 5350 if (err < 0)
5351 goto err;
5352
5353 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5354err:
5355 kfree_skb(skb2);
5356 return err;
e5009240
PNA		 5357}
5358
00bfb320 5359static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
e5009240 5360{
dfc46034 5361 if (obj->ops->destroy)
00bfb320 5362 obj->ops->destroy(ctx, obj);
e5009240 5363
dfc46034 5364 module_put(obj->ops->type->owner);
d152159b 5365 kfree(obj->key.name);
e5009240
PNA		 5366 kfree(obj);
5367}
5368
5369static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 5370 struct sk_buff *skb, const struct nlmsghdr *nlh,
5371 const struct nlattr * const nla[],
5372 struct netlink_ext_ack *extack)
e5009240
PNA		 5373{
5374 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5375 u8 genmask = nft_genmask_next(net);
5376 int family = nfmsg->nfgen_family;
36dd1bcc 5377 const struct nlattr *attr;
e5009240
PNA		 5378 struct nft_table *table;
5379 struct nft_object *obj;
5380 struct nft_ctx ctx;
5381 u32 objtype;
5382
5383 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 5384 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 5385 return -EINVAL;
5386
cac20fcd 5387 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5388 if (IS_ERR(table)) {
5389 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5390 return PTR_ERR(table);
36dd1bcc 5391 }
e5009240
PNA		 5392
5393 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 5394 if (nla[NFTA_OBJ_HANDLE]) {
5395 attr = nla[NFTA_OBJ_HANDLE];
5396 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5397 } else {
5398 attr = nla[NFTA_OBJ_NAME];
4d44175a 5399 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
36dd1bcc
PNA		 5400 }
5401
5402 if (IS_ERR(obj)) {
5403 NL_SET_BAD_ATTR(extack, attr);
e5009240 5404 return PTR_ERR(obj);
36dd1bcc
PNA		 5405 }
5406 if (obj->use > 0) {
5407 NL_SET_BAD_ATTR(extack, attr);
e5009240 5408 return -EBUSY;
36dd1bcc 5409 }
e5009240 5410
98319cb9 5411 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 5412
5413 return nft_delobj(&ctx, obj);
5414}
5415
d152159b 5416void nft_obj_notify(struct net *net, const struct nft_table *table,
25e94a99
PNA		 5417 struct nft_object *obj, u32 portid, u32 seq, int event,
5418 int family, int report, gfp_t gfp)
e5009240
PNA		 5419{
5420 struct sk_buff *skb;
5421 int err;
5422
2599e989
PNA		 5423 if (!report &&
5424 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5425 return;
e5009240 5426
2599e989 5427 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 5428 if (skb == NULL)
5429 goto err;
5430
2599e989
PNA		 5431 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5432 table, obj, false);
e5009240
PNA		 5433 if (err < 0) {
5434 kfree_skb(skb);
5435 goto err;
5436 }
5437
25e94a99
PNA		 5438 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5439 return;
e5009240 5440err:
25e94a99 5441 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 5442}
2599e989
PNA		 5443EXPORT_SYMBOL_GPL(nft_obj_notify);
5444
25e94a99
PNA		 5445static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5446 struct nft_object *obj, int event)
2599e989 5447{
25e94a99 5448 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 5449 ctx->family, ctx->report, GFP_KERNEL);
2599e989 5450}
e5009240 5451
3b49e2e9
PNA		 5452/*
5453 * Flow tables
5454 */
5455void nft_register_flowtable_type(struct nf_flowtable_type *type)
5456{
5457 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5458 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5459 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5460}
5461EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5462
5463void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5464{
5465 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5466 list_del_rcu(&type->list);
5467 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5468}
5469EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5470
5471static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5472 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
5473 .len = NFT_NAME_MAXLEN - 1 },
5474 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
5475 .len = NFT_NAME_MAXLEN - 1 },
5476 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 5477 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
3b49e2e9
PNA		 5478};
5479
cac20fcd
PNA		 5480struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5481 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 5482{
5483 struct nft_flowtable *flowtable;
5484
d9adf22a 5485 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
3b49e2e9
PNA		 5486 if (!nla_strcmp(nla, flowtable->name) &&
5487 nft_active_genmask(flowtable, genmask))
5488 return flowtable;
5489 }
5490 return ERR_PTR(-ENOENT);
5491}
cac20fcd 5492EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 5493
ae0662f8 5494static struct nft_flowtable *
cac20fcd
PNA		 5495nft_flowtable_lookup_byhandle(const struct nft_table *table,
5496 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 5497{
5498 struct nft_flowtable *flowtable;
5499
5500 list_for_each_entry(flowtable, &table->flowtables, list) {
5501 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5502 nft_active_genmask(flowtable, genmask))
5503 return flowtable;
5504 }
5505 return ERR_PTR(-ENOENT);
5506}
5507
3b49e2e9
PNA		 5508static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5509 const struct nlattr *attr,
5510 struct net_device *dev_array[], int *len)
5511{
5512 const struct nlattr *tmp;
5513 struct net_device *dev;
5514 char ifname[IFNAMSIZ];
5515 int rem, n = 0, err;
5516
5517 nla_for_each_nested(tmp, attr, rem) {
5518 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5519 err = -EINVAL;
5520 goto err1;
5521 }
5522
5523 nla_strlcpy(ifname, tmp, IFNAMSIZ);
90d2723c 5524 dev = __dev_get_by_name(ctx->net, ifname);
3b49e2e9
PNA		 5525 if (!dev) {
5526 err = -ENOENT;
5527 goto err1;
5528 }
5529
5530 dev_array[n++] = dev;
5531 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5532 err = -EFBIG;
5533 goto err1;
5534 }
5535 }
5536 if (!len)
5537 return -EINVAL;
5538
5539 err = 0;
5540err1:
5541 *len = n;
5542 return err;
5543}
5544
5545static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5546 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5547 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5548 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5549};
5550
5551static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5552 const struct nlattr *attr,
5553 struct nft_flowtable *flowtable)
5554{
5555 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5556 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5557 struct nf_hook_ops *ops;
5558 int hooknum, priority;
5559 int err, n = 0, i;
5560
5561 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5562 nft_flowtable_hook_policy, NULL);
5563 if (err < 0)
5564 return err;
5565
5566 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5567 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5568 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5569 return -EINVAL;
5570
5571 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 5572 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 5573 return -EINVAL;
5574
5575 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5576
5577 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5578 dev_array, &n);
5579 if (err < 0)
d92191aa 5580 return err;
3b49e2e9 5581
6396bb22 5582 ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
90d2723c
PNA		 5583 if (!ops)
5584 return -ENOMEM;
3b49e2e9 5585
0e839dfa
PNA		 5586 flowtable->hooknum = hooknum;
5587 flowtable->priority = priority;
3b49e2e9
PNA		 5588 flowtable->ops = ops;
5589 flowtable->ops_len = n;
5590
5591 for (i = 0; i < n; i++) {
5592 flowtable->ops[i].pf = NFPROTO_NETDEV;
5593 flowtable->ops[i].hooknum = hooknum;
5594 flowtable->ops[i].priority = priority;
17857d92 5595 flowtable->ops[i].priv = &flowtable->data;
3b49e2e9
PNA		 5596 flowtable->ops[i].hook = flowtable->data.type->hook;
5597 flowtable->ops[i].dev = dev_array[i];
5598 }
5599
3b49e2e9
PNA		 5600 return err;
5601}
5602
98319cb9 5603static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5604{
5605 const struct nf_flowtable_type *type;
5606
5607 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 5608 if (family == type->family)
3b49e2e9
PNA		 5609 return type;
5610 }
5611 return NULL;
5612}
5613
452238e8
FW		 5614static const struct nf_flowtable_type *
5615nft_flowtable_type_get(struct net *net, u8 family)
3b49e2e9
PNA		 5616{
5617 const struct nf_flowtable_type *type;
5618
98319cb9 5619 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 5620 if (type != NULL && try_module_get(type->owner))
5621 return type;
5622
f102d66b 5623 lockdep_nfnl_nft_mutex_not_held();
3b49e2e9
PNA		 5624#ifdef CONFIG_MODULES
5625 if (type == NULL) {
452238e8 5626 nft_request_module(net, "nf-flowtable-%u", family);
98319cb9 5627 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 5628 return ERR_PTR(-EAGAIN);
5629 }
5630#endif
5631 return ERR_PTR(-ENOENT);
5632}
5633
3b49e2e9
PNA		 5634static void nft_unregister_flowtable_net_hooks(struct net *net,
5635 struct nft_flowtable *flowtable)
5636{
5637 int i;
5638
5639 for (i = 0; i < flowtable->ops_len; i++) {
5640 if (!flowtable->ops[i].dev)
5641 continue;
5642
5643 nf_unregister_net_hook(net, &flowtable->ops[i]);
5644 }
5645}
5646
5647static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5648 struct sk_buff *skb,
5649 const struct nlmsghdr *nlh,
5650 const struct nlattr * const nla[],
5651 struct netlink_ext_ack *extack)
5652{
5653 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5654 const struct nf_flowtable_type *type;
32fc7187 5655 struct nft_flowtable *flowtable, *ft;
3b49e2e9
PNA		 5656 u8 genmask = nft_genmask_next(net);
5657 int family = nfmsg->nfgen_family;
3b49e2e9
PNA		 5658 struct nft_table *table;
5659 struct nft_ctx ctx;
5660 int err, i, k;
5661
5662 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5663 !nla[NFTA_FLOWTABLE_NAME] ||
5664 !nla[NFTA_FLOWTABLE_HOOK])
5665 return -EINVAL;
5666
cac20fcd
PNA		 5667 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5668 genmask);
36dd1bcc
PNA		 5669 if (IS_ERR(table)) {
5670 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5671 return PTR_ERR(table);
36dd1bcc 5672 }
3b49e2e9 5673
cac20fcd
PNA		 5674 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5675 genmask);
3b49e2e9
PNA		 5676 if (IS_ERR(flowtable)) {
5677 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 5678 if (err != -ENOENT) {
5679 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5680 return err;
36dd1bcc 5681 }
3b49e2e9 5682 } else {
36dd1bcc
PNA		 5683 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5684 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 5685 return -EEXIST;
36dd1bcc 5686 }
3b49e2e9
PNA		 5687
5688 return 0;
5689 }
5690
98319cb9 5691 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5692
5693 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5694 if (!flowtable)
5695 return -ENOMEM;
5696
5697 flowtable->table = table;
3ecbfd65
HS		 5698 flowtable->handle = nf_tables_alloc_handle(table);
5699
3b49e2e9
PNA		 5700 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5701 if (!flowtable->name) {
5702 err = -ENOMEM;
5703 goto err1;
5704 }
5705
452238e8 5706 type = nft_flowtable_type_get(net, family);
3b49e2e9
PNA		 5707 if (IS_ERR(type)) {
5708 err = PTR_ERR(type);
5709 goto err2;
5710 }
5711
5712 flowtable->data.type = type;
a268de77 5713 err = type->init(&flowtable->data);
3b49e2e9
PNA		 5714 if (err < 0)
5715 goto err3;
5716
5717 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5718 flowtable);
5719 if (err < 0)
a268de77 5720 goto err4;
3b49e2e9
PNA		 5721
5722 for (i = 0; i < flowtable->ops_len; i++) {
32fc7187
PNA		 5723 if (!flowtable->ops[i].dev)
5724 continue;
5725
5726 list_for_each_entry(ft, &table->flowtables, list) {
5727 for (k = 0; k < ft->ops_len; k++) {
5728 if (!ft->ops[k].dev)
5729 continue;
5730
5731 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5732 flowtable->ops[i].pf == ft->ops[k].pf) {
5733 err = -EBUSY;
a268de77 5734 goto err5;
32fc7187
PNA		 5735 }
5736 }
5737 }
5738
3b49e2e9
PNA		 5739 err = nf_register_net_hook(net, &flowtable->ops[i]);
5740 if (err < 0)
a268de77 5741 goto err5;
3b49e2e9
PNA		 5742 }
5743
5744 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5745 if (err < 0)
a268de77 5746 goto err6;
3b49e2e9
PNA		 5747
5748 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5749 table->use++;
5750
5751 return 0;
a268de77 5752err6:
3b49e2e9 5753 i = flowtable->ops_len;
a268de77 5754err5:
b8088dda 5755 for (k = i - 1; k >= 0; k--)
0e0d5002 5756 nf_unregister_net_hook(net, &flowtable->ops[k]);
3b49e2e9
PNA		 5757
5758 kfree(flowtable->ops);
a268de77
FF		 5759err4:
5760 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 5761err3:
5762 module_put(type->owner);
5763err2:
5764 kfree(flowtable->name);
5765err1:
5766 kfree(flowtable);
5767 return err;
5768}
5769
5770static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5771 struct sk_buff *skb,
5772 const struct nlmsghdr *nlh,
5773 const struct nlattr * const nla[],
5774 struct netlink_ext_ack *extack)
5775{
5776 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5777 u8 genmask = nft_genmask_next(net);
5778 int family = nfmsg->nfgen_family;
5779 struct nft_flowtable *flowtable;
36dd1bcc 5780 const struct nlattr *attr;
3b49e2e9
PNA		 5781 struct nft_table *table;
5782 struct nft_ctx ctx;
5783
e603ea4b
PNA		 5784 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5785 (!nla[NFTA_FLOWTABLE_NAME] &&
5786 !nla[NFTA_FLOWTABLE_HANDLE]))
5787 return -EINVAL;
5788
cac20fcd
PNA		 5789 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5790 genmask);
36dd1bcc
PNA		 5791 if (IS_ERR(table)) {
5792 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 5793 return PTR_ERR(table);
36dd1bcc 5794 }
3b49e2e9 5795
36dd1bcc
PNA		 5796 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5797 attr = nla[NFTA_FLOWTABLE_HANDLE];
5798 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5799 } else {
5800 attr = nla[NFTA_FLOWTABLE_NAME];
5801 flowtable = nft_flowtable_lookup(table, attr, genmask);
5802 }
5803
5804 if (IS_ERR(flowtable)) {
5805 NL_SET_BAD_ATTR(extack, attr);
5806 return PTR_ERR(flowtable);
5807 }
5808 if (flowtable->use > 0) {
5809 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 5810 return -EBUSY;
36dd1bcc 5811 }
3b49e2e9 5812
98319cb9 5813 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 5814
5815 return nft_delflowtable(&ctx, flowtable);
5816}
5817
5818static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5819 u32 portid, u32 seq, int event,
5820 u32 flags, int family,
5821 struct nft_flowtable *flowtable)
5822{
5823 struct nlattr *nest, *nest_devs;
5824 struct nfgenmsg *nfmsg;
5825 struct nlmsghdr *nlh;
5826 int i;
5827
5828 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5829 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5830 if (nlh == NULL)
5831 goto nla_put_failure;
5832
5833 nfmsg = nlmsg_data(nlh);
5834 nfmsg->nfgen_family = family;
5835 nfmsg->version = NFNETLINK_V0;
5836 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5837
5838 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5839 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 5840 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5841 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5842 NFTA_FLOWTABLE_PAD))
3b49e2e9
PNA		 5843 goto nla_put_failure;
5844
5845 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
eb895086
KL		 5846 if (!nest)
5847 goto nla_put_failure;
3b49e2e9
PNA		 5848 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5849 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5850 goto nla_put_failure;
5851
5852 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5853 if (!nest_devs)
5854 goto nla_put_failure;
5855
5856 for (i = 0; i < flowtable->ops_len; i++) {
b8088dda
FW		 5857 const struct net_device *dev = READ_ONCE(flowtable->ops[i].dev);
5858
5859 if (dev &&
5860 nla_put_string(skb, NFTA_DEVICE_NAME, dev->name))
3b49e2e9
PNA		 5861 goto nla_put_failure;
5862 }
5863 nla_nest_end(skb, nest_devs);
5864 nla_nest_end(skb, nest);
5865
5866 nlmsg_end(skb, nlh);
5867 return 0;
5868
5869nla_put_failure:
5870 nlmsg_trim(skb, nlh);
5871 return -1;
5872}
5873
5874struct nft_flowtable_filter {
5875 char *table;
5876};
5877
5878static int nf_tables_dump_flowtable(struct sk_buff *skb,
5879 struct netlink_callback *cb)
5880{
5881 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5882 struct nft_flowtable_filter *filter = cb->data;
5883 unsigned int idx = 0, s_idx = cb->args[0];
5884 struct net *net = sock_net(skb->sk);
5885 int family = nfmsg->nfgen_family;
5886 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5887 const struct nft_table *table;
5888
5889 rcu_read_lock();
5890 cb->seq = net->nft.base_seq;
5891
36596dad 5892 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5893 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 5894 continue;
5895
36596dad
PNA		 5896 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5897 if (!nft_is_active(net, flowtable))
5898 goto cont;
5899 if (idx < s_idx)
5900 goto cont;
5901 if (idx > s_idx)
5902 memset(&cb->args[1], 0,
5903 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5904 if (filter && filter->table &&
36596dad
PNA		 5905 strcmp(filter->table, table->name))
5906 goto cont;
3b49e2e9 5907
36596dad
PNA		 5908 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5909 cb->nlh->nlmsg_seq,
5910 NFT_MSG_NEWFLOWTABLE,
5911 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5912 table->family, flowtable) < 0)
36596dad 5913 goto done;
3b49e2e9 5914
36596dad 5915 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 5916cont:
36596dad 5917 idx++;
3b49e2e9
PNA		 5918 }
5919 }
5920done:
5921 rcu_read_unlock();
5922
5923 cb->args[0] = idx;
5924 return skb->len;
5925}
5926
90fd131a 5927static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
3b49e2e9 5928{
90fd131a
FW		 5929 const struct nlattr * const *nla = cb->data;
5930 struct nft_flowtable_filter *filter = NULL;
3b49e2e9 5931
90fd131a
FW		 5932 if (nla[NFTA_FLOWTABLE_TABLE]) {
5933 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5934 if (!filter)
5935 return -ENOMEM;
3b49e2e9 5936
90fd131a
FW		 5937 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5938 GFP_ATOMIC);
5939 if (!filter->table) {
5940 kfree(filter);
5941 return -ENOMEM;
5942 }
5943 }
3b49e2e9 5944
90fd131a 5945 cb->data = filter;
3b49e2e9
PNA		 5946 return 0;
5947}
5948
90fd131a 5949static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
3b49e2e9 5950{
90fd131a 5951 struct nft_flowtable_filter *filter = cb->data;
3b49e2e9 5952
3b49e2e9 5953 if (!filter)
90fd131a 5954 return 0;
3b49e2e9 5955
90fd131a
FW		 5956 kfree(filter->table);
5957 kfree(filter);
5958
5959 return 0;
3b49e2e9
PNA		 5960}
5961
d9adf22a 5962/* called with rcu_read_lock held */
3b49e2e9
PNA		 5963static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5964 struct sk_buff *skb,
5965 const struct nlmsghdr *nlh,
5966 const struct nlattr * const nla[],
5967 struct netlink_ext_ack *extack)
5968{
5969 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5970 u8 genmask = nft_genmask_cur(net);
5971 int family = nfmsg->nfgen_family;
5972 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 5973 const struct nft_table *table;
5974 struct sk_buff *skb2;
5975 int err;
5976
5977 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5978 struct netlink_dump_control c = {
90fd131a 5979 .start = nf_tables_dump_flowtable_start,
3b49e2e9
PNA		 5980 .dump = nf_tables_dump_flowtable,
5981 .done = nf_tables_dump_flowtable_done,
d9adf22a 5982 .module = THIS_MODULE,
90fd131a 5983 .data = (void *)nla,
3b49e2e9
PNA		 5984 };
5985
d9adf22a 5986 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3b49e2e9
PNA		 5987 }
5988
5989 if (!nla[NFTA_FLOWTABLE_NAME])
5990 return -EINVAL;
5991
cac20fcd
PNA		 5992 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5993 genmask);
3b49e2e9
PNA		 5994 if (IS_ERR(table))
5995 return PTR_ERR(table);
5996
cac20fcd
PNA		 5997 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5998 genmask);
03a0120f 5999 if (IS_ERR(flowtable))
3b49e2e9
PNA		 6000 return PTR_ERR(flowtable);
6001
d9adf22a 6002 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3b49e2e9
PNA		 6003 if (!skb2)
6004 return -ENOMEM;
6005
6006 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
6007 nlh->nlmsg_seq,
6008 NFT_MSG_NEWFLOWTABLE, 0, family,
6009 flowtable);
6010 if (err < 0)
6011 goto err;
6012
6013 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6014err:
6015 kfree_skb(skb2);
6016 return err;
6017}
6018
6019static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
6020 struct nft_flowtable *flowtable,
6021 int event)
6022{
6023 struct sk_buff *skb;
6024 int err;
6025
6026 if (ctx->report &&
6027 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
6028 return;
6029
6030 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6031 if (skb == NULL)
6032 goto err;
6033
6034 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
6035 ctx->seq, event, 0,
36596dad 6036 ctx->family, flowtable);
3b49e2e9
PNA		 6037 if (err < 0) {
6038 kfree_skb(skb);
6039 goto err;
6040 }
6041
6042 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
6043 ctx->report, GFP_KERNEL);
6044 return;
6045err:
6046 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
6047}
6048
3b49e2e9
PNA		 6049static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
6050{
c04a3f73 6051 kfree(flowtable->ops);
3b49e2e9 6052 kfree(flowtable->name);
b408c5b0 6053 flowtable->data.type->free(&flowtable->data);
3b49e2e9 6054 module_put(flowtable->data.type->owner);
a12486eb 6055 kfree(flowtable);
3b49e2e9
PNA		 6056}
6057
84d7fce6
PNA		 6058static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
6059 u32 portid, u32 seq)
6060{
6061 struct nlmsghdr *nlh;
6062 struct nfgenmsg *nfmsg;
784b4e61 6063 char buf[TASK_COMM_LEN];
dedb67c4 6064 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 6065
6066 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
6067 if (nlh == NULL)
6068 goto nla_put_failure;
6069
6070 nfmsg = nlmsg_data(nlh);
6071 nfmsg->nfgen_family = AF_UNSPEC;
6072 nfmsg->version = NFNETLINK_V0;
6073 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
6074
784b4e61
PS		 6075 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
6076 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
6077 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 6078 goto nla_put_failure;
6079
053c095a
JB		 6080 nlmsg_end(skb, nlh);
6081 return 0;
84d7fce6
PNA		 6082
6083nla_put_failure:
6084 nlmsg_trim(skb, nlh);
6085 return -EMSGSIZE;
6086}
6087
3b49e2e9
PNA		 6088static void nft_flowtable_event(unsigned long event, struct net_device *dev,
6089 struct nft_flowtable *flowtable)
6090{
6091 int i;
6092
6093 for (i = 0; i < flowtable->ops_len; i++) {
6094 if (flowtable->ops[i].dev != dev)
6095 continue;
6096
6097 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
6098 flowtable->ops[i].dev = NULL;
6099 break;
6100 }
6101}
6102
6103static int nf_tables_flowtable_event(struct notifier_block *this,
6104 unsigned long event, void *ptr)
6105{
6106 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
6107 struct nft_flowtable *flowtable;
6108 struct nft_table *table;
0a2cf5ee 6109 struct net *net;
3b49e2e9
PNA		 6110
6111 if (event != NETDEV_UNREGISTER)
6112 return 0;
6113
6a48de01 6114 net = dev_net(dev);
9e619d87 6115 mutex_lock(&net->nft.commit_mutex);
0a2cf5ee 6116 list_for_each_entry(table, &net->nft.tables, list) {
36596dad
PNA		 6117 list_for_each_entry(flowtable, &table->flowtables, list) {
6118 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 6119 }
6120 }
9e619d87 6121 mutex_unlock(&net->nft.commit_mutex);
6a48de01 6122
3b49e2e9
PNA		 6123 return NOTIFY_DONE;
6124}
6125
6126static struct notifier_block nf_tables_flowtable_notifier = {
6127 .notifier_call = nf_tables_flowtable_event,
6128};
6129
25e94a99
PNA		 6130static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
6131 int event)
84d7fce6
PNA		 6132{
6133 struct nlmsghdr *nlh = nlmsg_hdr(skb);
6134 struct sk_buff *skb2;
6135 int err;
6136
6137 if (nlmsg_report(nlh) &&
6138 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 6139 return;
84d7fce6 6140
84d7fce6
PNA		 6141 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6142 if (skb2 == NULL)
6143 goto err;
6144
6145 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6146 nlh->nlmsg_seq);
6147 if (err < 0) {
6148 kfree_skb(skb2);
6149 goto err;
6150 }
6151
25e94a99
PNA		 6152 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6153 nlmsg_report(nlh), GFP_KERNEL);
6154 return;
84d7fce6 6155err:
25e94a99
PNA		 6156 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6157 -ENOBUFS);
84d7fce6
PNA		 6158}
6159
7b8002a1
PNA		 6160static int nf_tables_getgen(struct net *net, struct sock *nlsk,
6161 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 6162 const struct nlattr * const nla[],
6163 struct netlink_ext_ack *extack)
84d7fce6 6164{
84d7fce6
PNA		 6165 struct sk_buff *skb2;
6166 int err;
6167
d9adf22a 6168 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
84d7fce6
PNA		 6169 if (skb2 == NULL)
6170 return -ENOMEM;
6171
6172 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6173 nlh->nlmsg_seq);
6174 if (err < 0)
6175 goto err;
6176
6177 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6178err:
6179 kfree_skb(skb2);
6180 return err;
6181}
6182
96518518
PM		 6183static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
6184 [NFT_MSG_NEWTABLE] = {
55dd6f93 6185 .call_batch = nf_tables_newtable,
96518518
PM		 6186 .attr_count = NFTA_TABLE_MAX,
6187 .policy = nft_table_policy,
6188 },
6189 [NFT_MSG_GETTABLE] = {
d9adf22a 6190 .call_rcu = nf_tables_gettable,
96518518
PM		 6191 .attr_count = NFTA_TABLE_MAX,
6192 .policy = nft_table_policy,
6193 },
6194 [NFT_MSG_DELTABLE] = {
55dd6f93 6195 .call_batch = nf_tables_deltable,
96518518
PM		 6196 .attr_count = NFTA_TABLE_MAX,
6197 .policy = nft_table_policy,
6198 },
6199 [NFT_MSG_NEWCHAIN] = {
91c7b38d 6200 .call_batch = nf_tables_newchain,
96518518
PM		 6201 .attr_count = NFTA_CHAIN_MAX,
6202 .policy = nft_chain_policy,
6203 },
6204 [NFT_MSG_GETCHAIN] = {
d9adf22a 6205 .call_rcu = nf_tables_getchain,
96518518
PM		 6206 .attr_count = NFTA_CHAIN_MAX,
6207 .policy = nft_chain_policy,
6208 },
6209 [NFT_MSG_DELCHAIN] = {
91c7b38d 6210 .call_batch = nf_tables_delchain,
96518518
PM		 6211 .attr_count = NFTA_CHAIN_MAX,
6212 .policy = nft_chain_policy,
6213 },
6214 [NFT_MSG_NEWRULE] = {
0628b123 6215 .call_batch = nf_tables_newrule,
96518518
PM		 6216 .attr_count = NFTA_RULE_MAX,
6217 .policy = nft_rule_policy,
6218 },
6219 [NFT_MSG_GETRULE] = {
d9adf22a 6220 .call_rcu = nf_tables_getrule,
96518518
PM		 6221 .attr_count = NFTA_RULE_MAX,
6222 .policy = nft_rule_policy,
6223 },
6224 [NFT_MSG_DELRULE] = {
0628b123 6225 .call_batch = nf_tables_delrule,
96518518
PM		 6226 .attr_count = NFTA_RULE_MAX,
6227 .policy = nft_rule_policy,
6228 },
20a69341 6229 [NFT_MSG_NEWSET] = {
958bee14 6230 .call_batch = nf_tables_newset,
20a69341
PM		 6231 .attr_count = NFTA_SET_MAX,
6232 .policy = nft_set_policy,
6233 },
6234 [NFT_MSG_GETSET] = {
d9adf22a 6235 .call_rcu = nf_tables_getset,
20a69341
PM		 6236 .attr_count = NFTA_SET_MAX,
6237 .policy = nft_set_policy,
6238 },
6239 [NFT_MSG_DELSET] = {
958bee14 6240 .call_batch = nf_tables_delset,
20a69341
PM		 6241 .attr_count = NFTA_SET_MAX,
6242 .policy = nft_set_policy,
6243 },
6244 [NFT_MSG_NEWSETELEM] = {
958bee14 6245 .call_batch = nf_tables_newsetelem,
20a69341
PM		 6246 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6247 .policy = nft_set_elem_list_policy,
6248 },
6249 [NFT_MSG_GETSETELEM] = {
d9adf22a 6250 .call_rcu = nf_tables_getsetelem,
20a69341
PM		 6251 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6252 .policy = nft_set_elem_list_policy,
6253 },
6254 [NFT_MSG_DELSETELEM] = {
958bee14 6255 .call_batch = nf_tables_delsetelem,
20a69341
PM		 6256 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6257 .policy = nft_set_elem_list_policy,
6258 },
84d7fce6 6259 [NFT_MSG_GETGEN] = {
d9adf22a 6260 .call_rcu = nf_tables_getgen,
84d7fce6 6261 },
e5009240
PNA		 6262 [NFT_MSG_NEWOBJ] = {
6263 .call_batch = nf_tables_newobj,
6264 .attr_count = NFTA_OBJ_MAX,
6265 .policy = nft_obj_policy,
6266 },
6267 [NFT_MSG_GETOBJ] = {
d9adf22a 6268 .call_rcu = nf_tables_getobj,
e5009240
PNA		 6269 .attr_count = NFTA_OBJ_MAX,
6270 .policy = nft_obj_policy,
6271 },
6272 [NFT_MSG_DELOBJ] = {
6273 .call_batch = nf_tables_delobj,
6274 .attr_count = NFTA_OBJ_MAX,
6275 .policy = nft_obj_policy,
6276 },
43da04a5 6277 [NFT_MSG_GETOBJ_RESET] = {
d9adf22a 6278 .call_rcu = nf_tables_getobj,
43da04a5
PNA		 6279 .attr_count = NFTA_OBJ_MAX,
6280 .policy = nft_obj_policy,
6281 },
3b49e2e9
PNA		 6282 [NFT_MSG_NEWFLOWTABLE] = {
6283 .call_batch = nf_tables_newflowtable,
6284 .attr_count = NFTA_FLOWTABLE_MAX,
6285 .policy = nft_flowtable_policy,
6286 },
6287 [NFT_MSG_GETFLOWTABLE] = {
d9adf22a 6288 .call_rcu = nf_tables_getflowtable,
3b49e2e9
PNA		 6289 .attr_count = NFTA_FLOWTABLE_MAX,
6290 .policy = nft_flowtable_policy,
6291 },
6292 [NFT_MSG_DELFLOWTABLE] = {
6293 .call_batch = nf_tables_delflowtable,
6294 .attr_count = NFTA_FLOWTABLE_MAX,
6295 .policy = nft_flowtable_policy,
6296 },
96518518
PM		 6297};
6298
a654de8f
PNA		 6299static int nf_tables_validate(struct net *net)
6300{
6301 struct nft_table *table;
6302
6303 switch (net->nft.validate_state) {
6304 case NFT_VALIDATE_SKIP:
6305 break;
6306 case NFT_VALIDATE_NEED:
6307 nft_validate_state_update(net, NFT_VALIDATE_DO);
6308 /* fall through */
6309 case NFT_VALIDATE_DO:
6310 list_for_each_entry(table, &net->nft.tables, list) {
6311 if (nft_table_validate(net, table) < 0)
6312 return -EAGAIN;
6313 }
6314 break;
6315 }
6316
6317 return 0;
6318}
6319
66293c46
FW		 6320/* a drop policy has to be deferred until all rules have been activated,
6321 * otherwise a large ruleset that contains a drop-policy base chain will
6322 * cause all packets to get dropped until the full transaction has been
6323 * processed.
6324 *
6325 * We defer the drop policy until the transaction has been finalized.
6326 */
6327static void nft_chain_commit_drop_policy(struct nft_trans *trans)
6328{
6329 struct nft_base_chain *basechain;
6330
6331 if (nft_trans_chain_policy(trans) != NF_DROP)
6332 return;
6333
6334 if (!nft_is_base_chain(trans->ctx.chain))
6335 return;
6336
6337 basechain = nft_base_chain(trans->ctx.chain);
6338 basechain->policy = NF_DROP;
6339}
6340
91c7b38d
PNA		 6341static void nft_chain_commit_update(struct nft_trans *trans)
6342{
6343 struct nft_base_chain *basechain;
6344
1b2470e5
FW		 6345 if (nft_trans_chain_name(trans)) {
6346 rhltable_remove(&trans->ctx.table->chains_ht,
6347 &trans->ctx.chain->rhlhead,
6348 nft_chain_ht_params);
d71efb59 6349 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
1b2470e5
FW		 6350 rhltable_insert_key(&trans->ctx.table->chains_ht,
6351 trans->ctx.chain->name,
6352 &trans->ctx.chain->rhlhead,
6353 nft_chain_ht_params);
6354 }
91c7b38d 6355
f323d954 6356 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 6357 return;
6358
6359 basechain = nft_base_chain(trans->ctx.chain);
4c05ec47
TY		 6360 nft_chain_stats_replace(trans->ctx.net, basechain,
6361 nft_trans_chain_stats(trans));
91c7b38d
PNA		 6362
6363 switch (nft_trans_chain_policy(trans)) {
6364 case NF_DROP:
6365 case NF_ACCEPT:
6366 basechain->policy = nft_trans_chain_policy(trans);
6367 break;
6368 }
6369}
6370
2f99aa31 6371static void nft_commit_release(struct nft_trans *trans)
c7c32e72 6372{
c7c32e72
PNA		 6373 switch (trans->msg_type) {
6374 case NFT_MSG_DELTABLE:
6375 nf_tables_table_destroy(&trans->ctx);
6376 break;
9f8aac0b
FW		 6377 case NFT_MSG_NEWCHAIN:
6378 kfree(nft_trans_chain_name(trans));
6379 break;
c7c32e72 6380 case NFT_MSG_DELCHAIN:
43a605f2 6381 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6382 break;
6383 case NFT_MSG_DELRULE:
6384 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6385 break;
6386 case NFT_MSG_DELSET:
6387 nft_set_destroy(nft_trans_set(trans));
6388 break;
61edafbb 6389 case NFT_MSG_DELSETELEM:
3453c927
PNA		 6390 nf_tables_set_elem_destroy(&trans->ctx,
6391 nft_trans_elem_set(trans),
59105446 6392 nft_trans_elem(trans).priv);
61edafbb 6393 break;
e5009240 6394 case NFT_MSG_DELOBJ:
00bfb320 6395 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6396 break;
3b49e2e9
PNA		 6397 case NFT_MSG_DELFLOWTABLE:
6398 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6399 break;
c7c32e72 6400 }
0935d558
FW		 6401
6402 if (trans->put_net)
6403 put_net(trans->ctx.net);
6404
c7c32e72
PNA		 6405 kfree(trans);
6406}
6407
0935d558 6408static void nf_tables_trans_destroy_work(struct work_struct *w)
2f99aa31
FW		 6409{
6410 struct nft_trans *trans, *next;
0935d558
FW		 6411 LIST_HEAD(head);
6412
6413 spin_lock(&nf_tables_destroy_list_lock);
6414 list_splice_init(&nf_tables_destroy_list, &head);
6415 spin_unlock(&nf_tables_destroy_list_lock);
2f99aa31 6416
0935d558 6417 if (list_empty(&head))
2f99aa31
FW		 6418 return;
6419
6420 synchronize_rcu();
6421
0935d558 6422 list_for_each_entry_safe(trans, next, &head, list) {
2f99aa31
FW		 6423 list_del(&trans->list);
6424 nft_commit_release(trans);
6425 }
6426}
6427
0cbc06b3
FW		 6428static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6429{
6430 struct nft_rule *rule;
6431 unsigned int alloc = 0;
6432 int i;
6433
6434 /* already handled or inactive chain? */
6435 if (chain->rules_next || !nft_is_active_next(net, chain))
6436 return 0;
6437
6438 rule = list_entry(&chain->rules, struct nft_rule, list);
6439 i = 0;
6440
6441 list_for_each_entry_continue(rule, &chain->rules, list) {
6442 if (nft_is_active_next(net, rule))
6443 alloc++;
6444 }
6445
6446 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6447 if (!chain->rules_next)
6448 return -ENOMEM;
6449
6450 list_for_each_entry_continue(rule, &chain->rules, list) {
6451 if (nft_is_active_next(net, rule))
6452 chain->rules_next[i++] = rule;
6453 }
6454
6455 chain->rules_next[i] = NULL;
6456 return 0;
6457}
6458
6459static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6460{
6461 struct nft_trans *trans, *next;
6462
6463 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6464 struct nft_chain *chain = trans->ctx.chain;
6465
6466 if (trans->msg_type == NFT_MSG_NEWRULE ||
6467 trans->msg_type == NFT_MSG_DELRULE) {
6468 kvfree(chain->rules_next);
6469 chain->rules_next = NULL;
6470 }
6471 }
6472}
6473
6474static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6475{
6476 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6477
6478 kvfree(o->start);
6479}
6480
6481static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6482{
6483 struct nft_rule **r = rules;
6484 struct nft_rules_old *old;
6485
6486 while (*r)
6487 r++;
6488
6489 r++; /* rcu_head is after end marker */
6490 old = (void *) r;
6491 old->start = rules;
6492
6493 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6494}
6495
0fb39bbe 6496static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
0cbc06b3
FW		 6497{
6498 struct nft_rule **g0, **g1;
6499 bool next_genbit;
6500
6501 next_genbit = nft_gencursor_next(net);
6502
6503 g0 = rcu_dereference_protected(chain->rules_gen_0,
f102d66b 6504 lockdep_commit_lock_is_held(net));
0cbc06b3 6505 g1 = rcu_dereference_protected(chain->rules_gen_1,
f102d66b 6506 lockdep_commit_lock_is_held(net));
0cbc06b3
FW		 6507
6508 /* No changes to this chain? */
6509 if (chain->rules_next == NULL) {
6510 /* chain had no change in last or next generation */
6511 if (g0 == g1)
6512 return;
6513 /*
6514 * chain had no change in this generation; make sure next
6515 * one uses same rules as current generation.
6516 */
6517 if (next_genbit) {
6518 rcu_assign_pointer(chain->rules_gen_1, g0);
6519 nf_tables_commit_chain_free_rules_old(g1);
6520 } else {
6521 rcu_assign_pointer(chain->rules_gen_0, g1);
6522 nf_tables_commit_chain_free_rules_old(g0);
6523 }
6524
6525 return;
6526 }
6527
6528 if (next_genbit)
6529 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6530 else
6531 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6532
6533 chain->rules_next = NULL;
6534
6535 if (g0 == g1)
6536 return;
6537
6538 if (next_genbit)
6539 nf_tables_commit_chain_free_rules_old(g1);
6540 else
6541 nf_tables_commit_chain_free_rules_old(g0);
6542}
6543
d152159b
FW		 6544static void nft_obj_del(struct nft_object *obj)
6545{
4d44175a 6546 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
d152159b
FW		 6547 list_del_rcu(&obj->list);
6548}
6549
1b2470e5
FW		 6550static void nft_chain_del(struct nft_chain *chain)
6551{
6552 struct nft_table *table = chain->table;
6553
6554 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
6555 nft_chain_ht_params));
6556 list_del_rcu(&chain->list);
6557}
6558
0935d558
FW		 6559static void nf_tables_commit_release(struct net *net)
6560{
6561 struct nft_trans *trans;
6562
6563 /* all side effects have to be made visible.
6564 * For example, if a chain named 'foo' has been deleted, a
6565 * new transaction must not find it anymore.
6566 *
6567 * Memory reclaim happens asynchronously from work queue
6568 * to prevent expensive synchronize_rcu() in commit phase.
6569 */
6570 if (list_empty(&net->nft.commit_list)) {
6571 mutex_unlock(&net->nft.commit_mutex);
6572 return;
6573 }
6574
6575 trans = list_last_entry(&net->nft.commit_list,
6576 struct nft_trans, list);
6577 get_net(trans->ctx.net);
6578 WARN_ON_ONCE(trans->put_net);
6579
6580 trans->put_net = true;
6581 spin_lock(&nf_tables_destroy_list_lock);
6582 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
6583 spin_unlock(&nf_tables_destroy_list_lock);
6584
6585 mutex_unlock(&net->nft.commit_mutex);
6586
6587 schedule_work(&trans_destroy_work);
6588}
6589
5913beaf 6590static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 6591{
37082f93 6592 struct nft_trans *trans, *next;
a3716e70 6593 struct nft_trans_elem *te;
0cbc06b3
FW		 6594 struct nft_chain *chain;
6595 struct nft_table *table;
37082f93 6596
b8b27498
FW		 6597 if (list_empty(&net->nft.commit_list)) {
6598 mutex_unlock(&net->nft.commit_mutex);
6599 return 0;
6600 }
6601
a654de8f
PNA		 6602 /* 0. Validate ruleset, otherwise roll back for error reporting. */
6603 if (nf_tables_validate(net) < 0)
6604 return -EAGAIN;
6605
0cbc06b3
FW		 6606 /* 1. Allocate space for next generation rules_gen_X[] */
6607 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6608 int ret;
37082f93 6609
0cbc06b3
FW		 6610 if (trans->msg_type == NFT_MSG_NEWRULE ||
6611 trans->msg_type == NFT_MSG_DELRULE) {
6612 chain = trans->ctx.chain;
6613
6614 ret = nf_tables_commit_chain_prepare(net, chain);
6615 if (ret < 0) {
6616 nf_tables_commit_chain_prepare_cancel(net);
6617 return ret;
6618 }
6619 }
6620 }
37082f93 6621
0cbc06b3
FW		 6622 /* step 2. Make rules_gen_X visible to packet path */
6623 list_for_each_entry(table, &net->nft.tables, list) {
0fb39bbe
FW		 6624 list_for_each_entry(chain, &table->chains, list)
6625 nf_tables_commit_chain(net, chain);
0cbc06b3
FW		 6626 }
6627
6628 /*
6629 * Bump generation counter, invalidate any dump in progress.
6630 * Cannot fail after this point.
37082f93 6631 */
0cbc06b3
FW		 6632 while (++net->nft.base_seq == 0);
6633
6634 /* step 3. Start new generation, rules_gen_X now in use. */
6635 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 6636
6637 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 6638 switch (trans->msg_type) {
55dd6f93
PNA		 6639 case NFT_MSG_NEWTABLE:
6640 if (nft_trans_table_update(trans)) {
6641 if (!nft_trans_table_enable(trans)) {
664b0f8c 6642 nf_tables_table_disable(net,
55dd6f93
PNA		 6643 trans->ctx.table);
6644 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6645 }
6646 } else {
f2a6d766 6647 nft_clear(net, trans->ctx.table);
55dd6f93 6648 }
35151d84 6649 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 6650 nft_trans_destroy(trans);
6651 break;
6652 case NFT_MSG_DELTABLE:
f2a6d766 6653 list_del_rcu(&trans->ctx.table->list);
35151d84 6654 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 6655 break;
91c7b38d 6656 case NFT_MSG_NEWCHAIN:
9f8aac0b 6657 if (nft_trans_chain_update(trans)) {
91c7b38d 6658 nft_chain_commit_update(trans);
9f8aac0b
FW		 6659 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6660 /* trans destroyed after rcu grace period */
6661 } else {
66293c46 6662 nft_chain_commit_drop_policy(trans);
664b0f8c 6663 nft_clear(net, trans->ctx.chain);
9f8aac0b
FW		 6664 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6665 nft_trans_destroy(trans);
6666 }
91c7b38d
PNA		 6667 break;
6668 case NFT_MSG_DELCHAIN:
1b2470e5 6669 nft_chain_del(trans->ctx.chain);
35151d84 6670 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 6671 nf_tables_unregister_hook(trans->ctx.net,
6672 trans->ctx.table,
6673 trans->ctx.chain);
91c7b38d 6674 break;
b380e5c7 6675 case NFT_MSG_NEWRULE:
889f7ee7 6676 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 6677 nf_tables_rule_notify(&trans->ctx,
37082f93 6678 nft_trans_rule(trans),
35151d84 6679 NFT_MSG_NEWRULE);
37082f93 6680 nft_trans_destroy(trans);
b380e5c7
PNA		 6681 break;
6682 case NFT_MSG_DELRULE:
6683 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 6684 nf_tables_rule_notify(&trans->ctx,
6685 nft_trans_rule(trans),
6686 NFT_MSG_DELRULE);
f6ac8585
PNA		 6687 nft_rule_expr_deactivate(&trans->ctx,
6688 nft_trans_rule(trans),
6689 NFT_TRANS_COMMIT);
b380e5c7 6690 break;
958bee14 6691 case NFT_MSG_NEWSET:
37a9cc52 6692 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 6693 /* This avoids hitting -EBUSY when deleting the table
6694 * from the transaction.
6695 */
408070d6 6696 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 6697 !list_empty(&nft_trans_set(trans)->bindings))
6698 trans->ctx.table->use--;
6699
958bee14 6700 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6701 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 6702 nft_trans_destroy(trans);
6703 break;
6704 case NFT_MSG_DELSET:
37a9cc52 6705 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 6706 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 6707 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 6708 break;
60319eb1 6709 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 6710 te = (struct nft_trans_elem *)trans->data;
6711
42a55769 6712 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 6713 nf_tables_setelem_notify(&trans->ctx, te->set,
6714 &te->elem,
60319eb1
PNA		 6715 NFT_MSG_NEWSETELEM, 0);
6716 nft_trans_destroy(trans);
6717 break;
6718 case NFT_MSG_DELSETELEM:
a3716e70 6719 te = (struct nft_trans_elem *)trans->data;
fe2811eb 6720
a3716e70
PNA		 6721 nf_tables_setelem_notify(&trans->ctx, te->set,
6722 &te->elem,
60319eb1 6723 NFT_MSG_DELSETELEM, 0);
5cb82a38 6724 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 6725 atomic_dec(&te->set->nelems);
6726 te->set->ndeact--;
60319eb1 6727 break;
e5009240
PNA		 6728 case NFT_MSG_NEWOBJ:
6729 nft_clear(net, nft_trans_obj(trans));
6730 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6731 NFT_MSG_NEWOBJ);
6732 nft_trans_destroy(trans);
6733 break;
6734 case NFT_MSG_DELOBJ:
d152159b 6735 nft_obj_del(nft_trans_obj(trans));
e5009240
PNA		 6736 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6737 NFT_MSG_DELOBJ);
6738 break;
3b49e2e9
PNA		 6739 case NFT_MSG_NEWFLOWTABLE:
6740 nft_clear(net, nft_trans_flowtable(trans));
6741 nf_tables_flowtable_notify(&trans->ctx,
6742 nft_trans_flowtable(trans),
6743 NFT_MSG_NEWFLOWTABLE);
6744 nft_trans_destroy(trans);
6745 break;
6746 case NFT_MSG_DELFLOWTABLE:
6747 list_del_rcu(&nft_trans_flowtable(trans)->list);
6748 nf_tables_flowtable_notify(&trans->ctx,
6749 nft_trans_flowtable(trans),
6750 NFT_MSG_DELFLOWTABLE);
6751 nft_unregister_flowtable_net_hooks(net,
6752 nft_trans_flowtable(trans));
6753 break;
37082f93 6754 }
37082f93
PNA		 6755 }
6756
84d7fce6 6757 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
0935d558 6758 nf_tables_commit_release(net);
37082f93
PNA		 6759
6760 return 0;
6761}
6762
b326dd37 6763static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 6764{
c7c32e72
PNA		 6765 switch (trans->msg_type) {
6766 case NFT_MSG_NEWTABLE:
6767 nf_tables_table_destroy(&trans->ctx);
6768 break;
6769 case NFT_MSG_NEWCHAIN:
43a605f2 6770 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6771 break;
6772 case NFT_MSG_NEWRULE:
6773 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6774 break;
6775 case NFT_MSG_NEWSET:
40ba1d9b 6776 nft_set_destroy(nft_trans_set(trans));
c7c32e72 6777 break;
61edafbb
PM		 6778 case NFT_MSG_NEWSETELEM:
6779 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 6780 nft_trans_elem(trans).priv, true);
61edafbb 6781 break;
e5009240 6782 case NFT_MSG_NEWOBJ:
00bfb320 6783 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6784 break;
3b49e2e9
PNA		 6785 case NFT_MSG_NEWFLOWTABLE:
6786 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6787 break;
c7c32e72
PNA		 6788 }
6789 kfree(trans);
6790}
6791
71ad00c5 6792static int __nf_tables_abort(struct net *net)
37082f93 6793{
37082f93 6794 struct nft_trans *trans, *next;
02263db0 6795 struct nft_trans_elem *te;
37082f93 6796
a907e36d
XL		 6797 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6798 list) {
b380e5c7 6799 switch (trans->msg_type) {
55dd6f93
PNA		 6800 case NFT_MSG_NEWTABLE:
6801 if (nft_trans_table_update(trans)) {
6802 if (nft_trans_table_enable(trans)) {
664b0f8c 6803 nf_tables_table_disable(net,
55dd6f93
PNA		 6804 trans->ctx.table);
6805 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6806 }
6807 nft_trans_destroy(trans);
6808 } else {
e688a7f8 6809 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 6810 }
6811 break;
6812 case NFT_MSG_DELTABLE:
f2a6d766 6813 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 6814 nft_trans_destroy(trans);
6815 break;
91c7b38d
PNA		 6816 case NFT_MSG_NEWCHAIN:
6817 if (nft_trans_chain_update(trans)) {
982f4051 6818 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b 6819 kfree(nft_trans_chain_name(trans));
91c7b38d
PNA		 6820 nft_trans_destroy(trans);
6821 } else {
4fefee57 6822 trans->ctx.table->use--;
1b2470e5 6823 nft_chain_del(trans->ctx.chain);
c974a3a3
PNA		 6824 nf_tables_unregister_hook(trans->ctx.net,
6825 trans->ctx.table,
6826 trans->ctx.chain);
91c7b38d
PNA		 6827 }
6828 break;
6829 case NFT_MSG_DELCHAIN:
4fefee57 6830 trans->ctx.table->use++;
664b0f8c 6831 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 6832 nft_trans_destroy(trans);
6833 break;
b380e5c7 6834 case NFT_MSG_NEWRULE:
4fefee57 6835 trans->ctx.chain->use--;
b380e5c7 6836 list_del_rcu(&nft_trans_rule(trans)->list);
f6ac8585
PNA		 6837 nft_rule_expr_deactivate(&trans->ctx,
6838 nft_trans_rule(trans),
6839 NFT_TRANS_ABORT);
b380e5c7
PNA		 6840 break;
6841 case NFT_MSG_DELRULE:
4fefee57 6842 trans->ctx.chain->use++;
889f7ee7 6843 nft_clear(trans->ctx.net, nft_trans_rule(trans));
bb7b40ae 6844 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
37082f93 6845 nft_trans_destroy(trans);
b380e5c7 6846 break;
958bee14 6847 case NFT_MSG_NEWSET:
4fefee57 6848 trans->ctx.table->use--;
40ba1d9b
PNA		 6849 if (nft_trans_set(trans)->bound) {
6850 nft_trans_destroy(trans);
6851 break;
6852 }
6853 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 6854 break;
6855 case NFT_MSG_DELSET:
4fefee57 6856 trans->ctx.table->use++;
37a9cc52 6857 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 6858 nft_trans_destroy(trans);
6859 break;
60319eb1 6860 case NFT_MSG_NEWSETELEM:
40ba1d9b
PNA		 6861 if (nft_trans_elem_set(trans)->bound) {
6862 nft_trans_destroy(trans);
6863 break;
6864 }
02263db0 6865 te = (struct nft_trans_elem *)trans->data;
5cb82a38 6866 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 6867 atomic_dec(&te->set->nelems);
60319eb1
PNA		 6868 break;
6869 case NFT_MSG_DELSETELEM:
cc02e457
PM		 6870 te = (struct nft_trans_elem *)trans->data;
6871
59105446 6872 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 6873 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 6874 te->set->ndeact--;
cc02e457 6875
e5009240
PNA		 6876 nft_trans_destroy(trans);
6877 break;
6878 case NFT_MSG_NEWOBJ:
6879 trans->ctx.table->use--;
4d44175a 6880 nft_obj_del(nft_trans_obj(trans));
e5009240
PNA		 6881 break;
6882 case NFT_MSG_DELOBJ:
6883 trans->ctx.table->use++;
6884 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 6885 nft_trans_destroy(trans);
6886 break;
3b49e2e9
PNA		 6887 case NFT_MSG_NEWFLOWTABLE:
6888 trans->ctx.table->use--;
6889 list_del_rcu(&nft_trans_flowtable(trans)->list);
6890 nft_unregister_flowtable_net_hooks(net,
6891 nft_trans_flowtable(trans));
6892 break;
6893 case NFT_MSG_DELFLOWTABLE:
6894 trans->ctx.table->use++;
6895 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6896 nft_trans_destroy(trans);
6897 break;
37082f93 6898 }
37082f93
PNA		 6899 }
6900
b326dd37
PNA		 6901 synchronize_rcu();
6902
a1cee076
PNA		 6903 list_for_each_entry_safe_reverse(trans, next,
6904 &net->nft.commit_list, list) {
c7c32e72 6905 list_del(&trans->list);
b326dd37 6906 nf_tables_abort_release(trans);
37082f93
PNA		 6907 }
6908
6909 return 0;
6910}
6911
a654de8f
PNA		 6912static void nf_tables_cleanup(struct net *net)
6913{
6914 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
6915}
6916
71ad00c5
FW		 6917static int nf_tables_abort(struct net *net, struct sk_buff *skb)
6918{
f102d66b
FW		 6919 int ret = __nf_tables_abort(net);
6920
6921 mutex_unlock(&net->nft.commit_mutex);
6922
6923 return ret;
71ad00c5
FW		 6924}
6925
74e8bcd2
PNA		 6926static bool nf_tables_valid_genid(struct net *net, u32 genid)
6927{
f102d66b
FW		 6928 bool genid_ok;
6929
6930 mutex_lock(&net->nft.commit_mutex);
6931
6932 genid_ok = genid == 0 || net->nft.base_seq == genid;
6933 if (!genid_ok)
6934 mutex_unlock(&net->nft.commit_mutex);
6935
6936 /* else, commit mutex has to be released by commit or abort function */
6937 return genid_ok;
74e8bcd2
PNA		 6938}
6939
96518518
PM		 6940static const struct nfnetlink_subsystem nf_tables_subsys = {
6941 .name = "nf_tables",
6942 .subsys_id = NFNL_SUBSYS_NFTABLES,
6943 .cb_count = NFT_MSG_MAX,
6944 .cb = nf_tables_cb,
0628b123
PNA		 6945 .commit = nf_tables_commit,
6946 .abort = nf_tables_abort,
a654de8f 6947 .cleanup = nf_tables_cleanup,
74e8bcd2 6948 .valid_genid = nf_tables_valid_genid,
be2ab5b4 6949 .owner = THIS_MODULE,
96518518
PM		 6950};
6951
7210e4e3 6952int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 6953 enum nft_chain_types type)
7210e4e3
PNA		 6954{
6955 const struct nft_base_chain *basechain;
6956
f323d954 6957 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 6958 basechain = nft_base_chain(chain);
6959 if (basechain->type->type != type)
6960 return -EOPNOTSUPP;
6961 }
6962 return 0;
6963}
6964EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6965
75e8d06d
PNA		 6966int nft_chain_validate_hooks(const struct nft_chain *chain,
6967 unsigned int hook_flags)
6968{
6969 struct nft_base_chain *basechain;
6970
f323d954 6971 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 6972 basechain = nft_base_chain(chain);
6973
c974a3a3 6974 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 6975 return 0;
6976
6977 return -EOPNOTSUPP;
6978 }
6979
6980 return 0;
6981}
6982EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6983
20a69341
PM		 6984/*
6985 * Loop detection - walk through the ruleset beginning at the destination chain
6986 * of a new jump until either the source chain is reached (loop) or all
6987 * reachable chains have been traversed.
6988 *
6989 * The loop check is performed whenever a new jump verdict is added to an
6990 * expression or verdict map or a verdict map is bound to a new chain.
6991 */
6992
6993static int nf_tables_check_loops(const struct nft_ctx *ctx,
6994 const struct nft_chain *chain);
6995
6996static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 6997 struct nft_set *set,
20a69341 6998 const struct nft_set_iter *iter,
de70185d 6999 struct nft_set_elem *elem)
20a69341 7000{
fe2811eb
PM		 7001 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
7002 const struct nft_data *data;
7003
7004 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
7005 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 7006 return 0;
7007
fe2811eb 7008 data = nft_set_ext_data(ext);
1ca2e170 7009 switch (data->verdict.code) {
20a69341
PM		 7010 case NFT_JUMP:
7011 case NFT_GOTO:
1ca2e170 7012 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7013 default:
7014 return 0;
7015 }
7016}
7017
7018static int nf_tables_check_loops(const struct nft_ctx *ctx,
7019 const struct nft_chain *chain)
7020{
7021 const struct nft_rule *rule;
7022 const struct nft_expr *expr, *last;
de70185d 7023 struct nft_set *set;
20a69341
PM		 7024 struct nft_set_binding *binding;
7025 struct nft_set_iter iter;
20a69341
PM		 7026
7027 if (ctx->chain == chain)
7028 return -ELOOP;
7029
7030 list_for_each_entry(rule, &chain->rules, list) {
7031 nft_rule_for_each_expr(expr, last, rule) {
a654de8f
PNA		 7032 struct nft_immediate_expr *priv;
7033 const struct nft_data *data;
0ca743a5
PNA		 7034 int err;
7035
a654de8f 7036 if (strcmp(expr->ops->type->name, "immediate"))
20a69341
PM		 7037 continue;
7038
a654de8f
PNA		 7039 priv = nft_expr_priv(expr);
7040 if (priv->dreg != NFT_REG_VERDICT)
0ca743a5 7041 continue;
20a69341 7042
a654de8f 7043 data = &priv->data;
1ca2e170 7044 switch (data->verdict.code) {
20a69341
PM		 7045 case NFT_JUMP:
7046 case NFT_GOTO:
1ca2e170
PM		 7047 err = nf_tables_check_loops(ctx,
7048 data->verdict.chain);
20a69341
PM		 7049 if (err < 0)
7050 return err;
7051 default:
7052 break;
7053 }
7054 }
7055 }
7056
7057 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 7058 if (!nft_is_active_next(ctx->net, set))
7059 continue;
20a69341
PM		 7060 if (!(set->flags & NFT_SET_MAP) ||
7061 set->dtype != NFT_DATA_VERDICT)
7062 continue;
7063
7064 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 7065 if (!(binding->flags & NFT_SET_MAP) ||
7066 binding->chain != chain)
20a69341
PM		 7067 continue;
7068
8588ac09 7069 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 7070 iter.skip = 0;
7071 iter.count = 0;
7072 iter.err = 0;
7073 iter.fn = nf_tables_loop_check_setelem;
7074
7075 set->ops->walk(ctx, set, &iter);
7076 if (iter.err < 0)
7077 return iter.err;
7078 }
7079 }
7080
7081 return 0;
7082}
7083
36b701fa
LGL		 7084/**
7085 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
7086 *
7087 * @attr: netlink attribute to fetch value from
7088 * @max: maximum value to be stored in dest
7089 * @dest: pointer to the variable
7090 *
7091 * Parse, check and store a given u32 netlink attribute into variable.
7092 * This function returns -ERANGE if the value goes over maximum value.
7093 * Otherwise a 0 is returned and the attribute value is stored in the
7094 * destination variable.
7095 */
f1d505bb 7096int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 7097{
09525a09 7098 u32 val;
36b701fa
LGL		 7099
7100 val = ntohl(nla_get_be32(attr));
7101 if (val > max)
7102 return -ERANGE;
7103
7104 *dest = val;
7105 return 0;
7106}
7107EXPORT_SYMBOL_GPL(nft_parse_u32_check);
7108
49499c3e
PM		 7109/**
7110 * nft_parse_register - parse a register value from a netlink attribute
7111 *
7112 * @attr: netlink attribute
7113 *
7114 * Parse and translate a register value from a netlink attribute.
7115 * Registers used to be 128 bit wide, these register numbers will be
7116 * mapped to the corresponding 32 bit register numbers.
7117 */
b1c96ed3
PM		 7118unsigned int nft_parse_register(const struct nlattr *attr)
7119{
49499c3e
PM		 7120 unsigned int reg;
7121
7122 reg = ntohl(nla_get_be32(attr));
7123 switch (reg) {
7124 case NFT_REG_VERDICT...NFT_REG_4:
7125 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
7126 default:
7127 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
7128 }
b1c96ed3
PM		 7129}
7130EXPORT_SYMBOL_GPL(nft_parse_register);
7131
49499c3e
PM		 7132/**
7133 * nft_dump_register - dump a register value to a netlink attribute
7134 *
7135 * @skb: socket buffer
7136 * @attr: attribute number
7137 * @reg: register number
7138 *
7139 * Construct a netlink attribute containing the register number. For
7140 * compatibility reasons, register numbers being a multiple of 4 are
7141 * translated to the corresponding 128 bit register numbers.
7142 */
b1c96ed3
PM		 7143int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
7144{
49499c3e
PM		 7145 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
7146 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
7147 else
7148 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
7149
b1c96ed3
PM		 7150 return nla_put_be32(skb, attr, htonl(reg));
7151}
7152EXPORT_SYMBOL_GPL(nft_dump_register);
7153
96518518 7154/**
d07db988 7155 * nft_validate_register_load - validate a load from a register
96518518
PM		 7156 *
7157 * @reg: the register number
d07db988 7158 * @len: the length of the data
96518518
PM		 7159 *
7160 * Validate that the input register is one of the general purpose
d07db988 7161 * registers and that the length of the load is within the bounds.
96518518 7162 */
d07db988 7163int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 7164{
49499c3e 7165 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 7166 return -EINVAL;
d07db988
PM		 7167 if (len == 0)
7168 return -EINVAL;
49499c3e 7169 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 7170 return -ERANGE;
49499c3e 7171
96518518
PM		 7172 return 0;
7173}
d07db988 7174EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 7175
96518518 7176/**
1ec10212 7177 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 7178 *
7179 * @ctx: context of the expression performing the load
7180 * @reg: the destination register number
7181 * @data: the data to load
7182 * @type: the data type
45d9bcda 7183 * @len: the length of the data
96518518
PM		 7184 *
7185 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 7186 * the destination register and the length is within the bounds.
7187 * A value of NULL for the data means that its runtime gathered
58f40ab6 7188 * data.
96518518 7189 */
1ec10212
PM		 7190int nft_validate_register_store(const struct nft_ctx *ctx,
7191 enum nft_registers reg,
7192 const struct nft_data *data,
7193 enum nft_data_types type, unsigned int len)
96518518 7194{
20a69341
PM		 7195 int err;
7196
96518518
PM		 7197 switch (reg) {
7198 case NFT_REG_VERDICT:
58f40ab6 7199 if (type != NFT_DATA_VERDICT)
96518518 7200 return -EINVAL;
20a69341 7201
58f40ab6 7202 if (data != NULL &&
1ca2e170
PM		 7203 (data->verdict.code == NFT_GOTO ||
7204 data->verdict.code == NFT_JUMP)) {
7205 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7206 if (err < 0)
7207 return err;
20a69341
PM		 7208 }
7209
96518518
PM		 7210 return 0;
7211 default:
49499c3e 7212 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 7213 return -EINVAL;
45d9bcda
PM		 7214 if (len == 0)
7215 return -EINVAL;
49499c3e
PM		 7216 if (reg * NFT_REG32_SIZE + len >
7217 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 7218 return -ERANGE;
27e6d201 7219
96518518
PM		 7220 if (data != NULL && type != NFT_DATA_VALUE)
7221 return -EINVAL;
7222 return 0;
7223 }
7224}
1ec10212 7225EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 7226
7227static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
7228 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
7229 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
7230 .len = NFT_CHAIN_MAXNAMELEN - 1 },
7231};
7232
7233static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
7234 struct nft_data_desc *desc, const struct nlattr *nla)
7235{
664b0f8c 7236 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 7237 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
7238 struct nft_chain *chain;
7239 int err;
7240
fceb6435
JB		 7241 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
7242 NULL);
96518518
PM		 7243 if (err < 0)
7244 return err;
7245
7246 if (!tb[NFTA_VERDICT_CODE])
7247 return -EINVAL;
1ca2e170 7248 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 7249
1ca2e170 7250 switch (data->verdict.code) {
e0abdadc 7251 default:
1ca2e170 7252 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 7253 case NF_ACCEPT:
7254 case NF_DROP:
7255 case NF_QUEUE:
7256 break;
7257 default:
7258 return -EINVAL;
7259 }
7260 /* fall through */
96518518
PM		 7261 case NFT_CONTINUE:
7262 case NFT_BREAK:
7263 case NFT_RETURN:
96518518
PM		 7264 break;
7265 case NFT_JUMP:
7266 case NFT_GOTO:
7267 if (!tb[NFTA_VERDICT_CHAIN])
7268 return -EINVAL;
f102d66b
FW		 7269 chain = nft_chain_lookup(ctx->net, ctx->table,
7270 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 7271 if (IS_ERR(chain))
7272 return PTR_ERR(chain);
f323d954 7273 if (nft_is_base_chain(chain))
96518518
PM		 7274 return -EOPNOTSUPP;
7275
96518518 7276 chain->use++;
1ca2e170 7277 data->verdict.chain = chain;
96518518 7278 break;
96518518
PM		 7279 }
7280
4c4ed074 7281 desc->len = sizeof(data->verdict);
96518518
PM		 7282 desc->type = NFT_DATA_VERDICT;
7283 return 0;
7284}
7285
7286static void nft_verdict_uninit(const struct nft_data *data)
7287{
1ca2e170 7288 switch (data->verdict.code) {
96518518
PM		 7289 case NFT_JUMP:
7290 case NFT_GOTO:
1ca2e170 7291 data->verdict.chain->use--;
96518518
PM		 7292 break;
7293 }
7294}
7295
33d5a7b1 7296int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 7297{
7298 struct nlattr *nest;
7299
33d5a7b1 7300 nest = nla_nest_start(skb, type);
96518518
PM		 7301 if (!nest)
7302 goto nla_put_failure;
7303
33d5a7b1 7304 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 7305 goto nla_put_failure;
7306
33d5a7b1 7307 switch (v->code) {
96518518
PM		 7308 case NFT_JUMP:
7309 case NFT_GOTO:
1ca2e170 7310 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 7311 v->chain->name))
96518518
PM		 7312 goto nla_put_failure;
7313 }
7314 nla_nest_end(skb, nest);
7315 return 0;
7316
7317nla_put_failure:
7318 return -1;
7319}
7320
d0a11fc3
PM		 7321static int nft_value_init(const struct nft_ctx *ctx,
7322 struct nft_data *data, unsigned int size,
96518518
PM		 7323 struct nft_data_desc *desc, const struct nlattr *nla)
7324{
7325 unsigned int len;
7326
7327 len = nla_len(nla);
7328 if (len == 0)
7329 return -EINVAL;
d0a11fc3 7330 if (len > size)
96518518
PM		 7331 return -EOVERFLOW;
7332
d0a11fc3 7333 nla_memcpy(data->data, nla, len);
96518518
PM		 7334 desc->type = NFT_DATA_VALUE;
7335 desc->len = len;
7336 return 0;
7337}
7338
7339static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
7340 unsigned int len)
7341{
7342 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
7343}
7344
7345static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 7346 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 7347 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
7348};
7349
7350/**
7351 * nft_data_init - parse nf_tables data netlink attributes
7352 *
7353 * @ctx: context of the expression using the data
7354 * @data: destination struct nft_data
d0a11fc3 7355 * @size: maximum data length
96518518
PM		 7356 * @desc: data description
7357 * @nla: netlink attribute containing data
7358 *
7359 * Parse the netlink data attributes and initialize a struct nft_data.
7360 * The type and length of data are returned in the data description.
7361 *
7362 * The caller can indicate that it only wants to accept data of type
7363 * NFT_DATA_VALUE by passing NULL for the ctx argument.
7364 */
d0a11fc3
PM		 7365int nft_data_init(const struct nft_ctx *ctx,
7366 struct nft_data *data, unsigned int size,
96518518
PM		 7367 struct nft_data_desc *desc, const struct nlattr *nla)
7368{
7369 struct nlattr *tb[NFTA_DATA_MAX + 1];
7370 int err;
7371
fceb6435 7372 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 7373 if (err < 0)
7374 return err;
7375
7376 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 7377 return nft_value_init(ctx, data, size, desc,
7378 tb[NFTA_DATA_VALUE]);
96518518
PM		 7379 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
7380 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
7381 return -EINVAL;
7382}
7383EXPORT_SYMBOL_GPL(nft_data_init);
7384
7385/**
59105446 7386 * nft_data_release - release a nft_data item
96518518
PM		 7387 *
7388 * @data: struct nft_data to release
7389 * @type: type of data
7390 *
7391 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
7392 * all others need to be released by calling this function.
7393 */
59105446 7394void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 7395{
960bd2c2 7396 if (type < NFT_DATA_VERDICT)
96518518 7397 return;
960bd2c2 7398 switch (type) {
96518518
PM		 7399 case NFT_DATA_VERDICT:
7400 return nft_verdict_uninit(data);
7401 default:
7402 WARN_ON(1);
7403 }
7404}
59105446 7405EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 7406
7407int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
7408 enum nft_data_types type, unsigned int len)
7409{
7410 struct nlattr *nest;
7411 int err;
7412
7413 nest = nla_nest_start(skb, attr);
7414 if (nest == NULL)
7415 return -1;
7416
7417 switch (type) {
7418 case NFT_DATA_VALUE:
7419 err = nft_value_dump(skb, data, len);
7420 break;
7421 case NFT_DATA_VERDICT:
33d5a7b1 7422 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 7423 break;
7424 default:
7425 err = -EINVAL;
7426 WARN_ON(1);
7427 }
7428
7429 nla_nest_end(skb, nest);
7430 return err;
7431}
7432EXPORT_SYMBOL_GPL(nft_data_dump);
7433
5ebe0b0e
PNA		 7434int __nft_release_basechain(struct nft_ctx *ctx)
7435{
7436 struct nft_rule *rule, *nr;
7437
fa5950e4
FW		 7438 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
7439 return 0;
5ebe0b0e 7440
c974a3a3 7441 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 7442 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
7443 list_del(&rule->list);
7444 ctx->chain->use--;
bb7b40ae 7445 nf_tables_rule_release(ctx, rule);
5ebe0b0e 7446 }
1b2470e5 7447 nft_chain_del(ctx->chain);
5ebe0b0e 7448 ctx->table->use--;
43a605f2 7449 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 7450
7451 return 0;
7452}
7453EXPORT_SYMBOL_GPL(__nft_release_basechain);
7454
98319cb9 7455static void __nft_release_tables(struct net *net)
df05ef87 7456{
3b49e2e9 7457 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 7458 struct nft_table *table, *nt;
7459 struct nft_chain *chain, *nc;
e5009240 7460 struct nft_object *obj, *ne;
df05ef87
PNA		 7461 struct nft_rule *rule, *nr;
7462 struct nft_set *set, *ns;
7463 struct nft_ctx ctx = {
7464 .net = net,
43a605f2 7465 .family = NFPROTO_NETDEV,
df05ef87
PNA		 7466 };
7467
36596dad 7468 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 7469 ctx.family = table->family;
dd4cbef7 7470
df05ef87 7471 list_for_each_entry(chain, &table->chains, list)
c974a3a3 7472 nf_tables_unregister_hook(net, table, chain);
df05ef87
PNA		 7473 /* No packets are walking on these chains anymore. */
7474 ctx.table = table;
7475 list_for_each_entry(chain, &table->chains, list) {
7476 ctx.chain = chain;
7477 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7478 list_del(&rule->list);
7479 chain->use--;
bb7b40ae 7480 nf_tables_rule_release(&ctx, rule);
df05ef87
PNA		 7481 }
7482 }
3b49e2e9
PNA		 7483 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7484 list_del(&flowtable->list);
7485 table->use--;
7486 nf_tables_flowtable_destroy(flowtable);
7487 }
df05ef87
PNA		 7488 list_for_each_entry_safe(set, ns, &table->sets, list) {
7489 list_del(&set->list);
7490 table->use--;
7491 nft_set_destroy(set);
7492 }
e5009240 7493 list_for_each_entry_safe(obj, ne, &table->objects, list) {
d152159b 7494 nft_obj_del(obj);
e5009240 7495 table->use--;
00bfb320 7496 nft_obj_destroy(&ctx, obj);
e5009240 7497 }
df05ef87 7498 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 7499 ctx.chain = chain;
1b2470e5 7500 nft_chain_del(chain);
df05ef87 7501 table->use--;
43a605f2 7502 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 7503 }
7504 list_del(&table->list);
7505 nf_tables_table_destroy(&ctx);
7506 }
7507}
7508
dd4cbef7
PNA		 7509static int __net_init nf_tables_init_net(struct net *net)
7510{
7511 INIT_LIST_HEAD(&net->nft.tables);
7512 INIT_LIST_HEAD(&net->nft.commit_list);
f102d66b 7513 mutex_init(&net->nft.commit_mutex);
dd4cbef7 7514 net->nft.base_seq = 1;
a654de8f
PNA		 7515 net->nft.validate_state = NFT_VALIDATE_SKIP;
7516
dd4cbef7
PNA		 7517 return 0;
7518}
7519
7520static void __net_exit nf_tables_exit_net(struct net *net)
7521{
f102d66b 7522 mutex_lock(&net->nft.commit_mutex);
71ad00c5
FW		 7523 if (!list_empty(&net->nft.commit_list))
7524 __nf_tables_abort(net);
98319cb9 7525 __nft_release_tables(net);
f102d66b 7526 mutex_unlock(&net->nft.commit_mutex);
dd4cbef7 7527 WARN_ON_ONCE(!list_empty(&net->nft.tables));
dd4cbef7
PNA		 7528}
7529
99633ab2
PNA		 7530static struct pernet_operations nf_tables_net_ops = {
7531 .init = nf_tables_init_net,
613d0776 7532 .exit = nf_tables_exit_net,
99633ab2
PNA		 7533};
7534
96518518
PM		 7535static int __init nf_tables_module_init(void)
7536{
7537 int err;
7538
0935d558 7539 spin_lock_init(&nf_tables_destroy_list_lock);
d209df3e
FW		 7540 err = register_pernet_subsys(&nf_tables_net_ops);
7541 if (err < 0)
7542 return err;
7543
7544 err = nft_chain_filter_init();
7545 if (err < 0)
7546 goto err1;
02c7b25e 7547
96518518
PM		 7548 err = nf_tables_core_module_init();
7549 if (err < 0)
d209df3e 7550 goto err2;
96518518 7551
d209df3e 7552 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
96518518 7553 if (err < 0)
d209df3e 7554 goto err3;
96518518 7555
4d44175a
FW		 7556 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
7557 if (err < 0)
7558 goto err4;
7559
d209df3e
FW		 7560 /* must be last */
7561 err = nfnetlink_subsys_register(&nf_tables_subsys);
7562 if (err < 0)
4d44175a 7563 goto err5;
3b49e2e9 7564
d209df3e 7565 return err;
4d44175a
FW		 7566err5:
7567 rhltable_destroy(&nft_objname_ht);
d209df3e
FW		 7568err4:
7569 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7570err3:
96518518 7571 nf_tables_core_module_exit();
d209df3e
FW		 7572err2:
7573 nft_chain_filter_fini();
7574err1:
7575 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 7576 return err;
7577}
7578
7579static void __exit nf_tables_module_exit(void)
7580{
7581 nfnetlink_subsys_unregister(&nf_tables_subsys);
3b49e2e9 7582 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
0a2cf5ee 7583 nft_chain_filter_fini();
71ad00c5 7584 unregister_pernet_subsys(&nf_tables_net_ops);
0935d558 7585 cancel_work_sync(&trans_destroy_work);
1b1bc49c 7586 rcu_barrier();
4d44175a 7587 rhltable_destroy(&nft_objname_ht);
96518518 7588 nf_tables_core_module_exit();
96518518
PM		 7589}
7590
7591module_init(nf_tables_module_init);
7592module_exit(nf_tables_module_exit);
7593
7594MODULE_LICENSE("GPL");
7595MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
7596MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Jammy Linux kernel mirror