]>
Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
0ca743a5 PNA |
2 | /* |
3 | * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org> | |
4 | * | |
0ca743a5 PNA |
5 | * This software has been sponsored by Sophos Astaro <http://www.sophos.com> |
6 | */ | |
7 | ||
8 | #include <linux/kernel.h> | |
9 | #include <linux/init.h> | |
10 | #include <linux/module.h> | |
11 | #include <linux/netlink.h> | |
12 | #include <linux/netfilter.h> | |
13 | #include <linux/netfilter/nfnetlink.h> | |
14 | #include <linux/netfilter/nf_tables.h> | |
15 | #include <linux/netfilter/nf_tables_compat.h> | |
16 | #include <linux/netfilter/x_tables.h> | |
17 | #include <linux/netfilter_ipv4/ip_tables.h> | |
18 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
5191f4d8 | 19 | #include <linux/netfilter_bridge/ebtables.h> |
5f158939 | 20 | #include <linux/netfilter_arp/arp_tables.h> |
0ca743a5 | 21 | #include <net/netfilter/nf_tables.h> |
4b512e1c | 22 | |
732a8049 FW |
23 | /* Used for matches where *info is larger than X byte */ |
24 | #define NFT_MATCH_LARGE_THRESH 192 | |
25 | ||
26 | struct nft_xt_match_priv { | |
27 | void *info; | |
28 | }; | |
29 | ||
e4844c9c FW |
30 | static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, |
31 | const char *tablename) | |
f3f5dded | 32 | { |
e4844c9c FW |
33 | enum nft_chain_types type = NFT_CHAIN_T_DEFAULT; |
34 | const struct nft_chain *chain = ctx->chain; | |
f3f5dded PNA |
35 | const struct nft_base_chain *basechain; |
36 | ||
f323d954 PNA |
37 | if (!tablename || |
38 | !nft_is_base_chain(chain)) | |
f3f5dded PNA |
39 | return 0; |
40 | ||
f3f5dded | 41 | basechain = nft_base_chain(chain); |
e4844c9c FW |
42 | if (strcmp(tablename, "nat") == 0) { |
43 | if (ctx->family != NFPROTO_BRIDGE) | |
44 | type = NFT_CHAIN_T_NAT; | |
45 | if (basechain->type->type != type) | |
46 | return -EINVAL; | |
47 | } | |
f3f5dded PNA |
48 | |
49 | return 0; | |
50 | } | |
51 | ||
0ca743a5 PNA |
52 | union nft_entry { |
53 | struct ipt_entry e4; | |
54 | struct ip6t_entry e6; | |
5191f4d8 | 55 | struct ebt_entry ebt; |
5f158939 | 56 | struct arpt_entry arp; |
0ca743a5 PNA |
57 | }; |
58 | ||
59 | static inline void | |
60 | nft_compat_set_par(struct xt_action_param *par, void *xt, const void *xt_info) | |
61 | { | |
62 | par->target = xt; | |
63 | par->targinfo = xt_info; | |
64 | par->hotdrop = false; | |
65 | } | |
66 | ||
5191f4d8 | 67 | static void nft_target_eval_xt(const struct nft_expr *expr, |
a55e22e9 | 68 | struct nft_regs *regs, |
5191f4d8 | 69 | const struct nft_pktinfo *pkt) |
0ca743a5 PNA |
70 | { |
71 | void *info = nft_expr_priv(expr); | |
72 | struct xt_target *target = expr->ops->data; | |
73 | struct sk_buff *skb = pkt->skb; | |
74 | int ret; | |
75 | ||
76 | nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info); | |
77 | ||
78 | ret = target->target(skb, &pkt->xt); | |
79 | ||
80 | if (pkt->xt.hotdrop) | |
81 | ret = NF_DROP; | |
82 | ||
5191f4d8 | 83 | switch (ret) { |
0ca743a5 | 84 | case XT_CONTINUE: |
a55e22e9 | 85 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 PNA |
86 | break; |
87 | default: | |
a55e22e9 | 88 | regs->verdict.code = ret; |
0ca743a5 PNA |
89 | break; |
90 | } | |
5191f4d8 AB |
91 | } |
92 | ||
93 | static void nft_target_eval_bridge(const struct nft_expr *expr, | |
a55e22e9 | 94 | struct nft_regs *regs, |
5191f4d8 AB |
95 | const struct nft_pktinfo *pkt) |
96 | { | |
97 | void *info = nft_expr_priv(expr); | |
98 | struct xt_target *target = expr->ops->data; | |
99 | struct sk_buff *skb = pkt->skb; | |
100 | int ret; | |
101 | ||
102 | nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info); | |
103 | ||
104 | ret = target->target(skb, &pkt->xt); | |
105 | ||
106 | if (pkt->xt.hotdrop) | |
107 | ret = NF_DROP; | |
108 | ||
109 | switch (ret) { | |
110 | case EBT_ACCEPT: | |
a55e22e9 | 111 | regs->verdict.code = NF_ACCEPT; |
5191f4d8 AB |
112 | break; |
113 | case EBT_DROP: | |
a55e22e9 | 114 | regs->verdict.code = NF_DROP; |
5191f4d8 AB |
115 | break; |
116 | case EBT_CONTINUE: | |
a55e22e9 | 117 | regs->verdict.code = NFT_CONTINUE; |
5191f4d8 AB |
118 | break; |
119 | case EBT_RETURN: | |
a55e22e9 | 120 | regs->verdict.code = NFT_RETURN; |
5191f4d8 AB |
121 | break; |
122 | default: | |
a55e22e9 | 123 | regs->verdict.code = ret; |
5191f4d8 AB |
124 | break; |
125 | } | |
0ca743a5 PNA |
126 | } |
127 | ||
128 | static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { | |
129 | [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, | |
130 | [NFTA_TARGET_REV] = { .type = NLA_U32 }, | |
131 | [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, | |
132 | }; | |
133 | ||
134 | static void | |
135 | nft_target_set_tgchk_param(struct xt_tgchk_param *par, | |
136 | const struct nft_ctx *ctx, | |
137 | struct xt_target *target, void *info, | |
2156d321 | 138 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 139 | { |
2daf1b4d | 140 | par->net = ctx->net; |
0ca743a5 | 141 | par->table = ctx->table->name; |
36596dad | 142 | switch (ctx->family) { |
0ca743a5 PNA |
143 | case AF_INET: |
144 | entry->e4.ip.proto = proto; | |
145 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
146 | break; | |
147 | case AF_INET6: | |
749177cc PNA |
148 | if (proto) |
149 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
150 | ||
0ca743a5 PNA |
151 | entry->e6.ipv6.proto = proto; |
152 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
153 | break; | |
5191f4d8 | 154 | case NFPROTO_BRIDGE: |
2156d321 | 155 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
156 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
157 | break; | |
5f158939 AB |
158 | case NFPROTO_ARP: |
159 | break; | |
0ca743a5 PNA |
160 | } |
161 | par->entryinfo = entry; | |
162 | par->target = target; | |
163 | par->targinfo = info; | |
f323d954 | 164 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
165 | const struct nft_base_chain *basechain = |
166 | nft_base_chain(ctx->chain); | |
c974a3a3 | 167 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
168 | |
169 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
170 | } else { |
171 | par->hook_mask = 0; | |
0ca743a5 | 172 | } |
36596dad | 173 | par->family = ctx->family; |
55917a21 | 174 | par->nft_compat = true; |
0ca743a5 PNA |
175 | } |
176 | ||
177 | static void target_compat_from_user(struct xt_target *t, void *in, void *out) | |
178 | { | |
756c1b1a | 179 | int pad; |
0ca743a5 | 180 | |
756c1b1a PNA |
181 | memcpy(out, in, t->targetsize); |
182 | pad = XT_ALIGN(t->targetsize) - t->targetsize; | |
183 | if (pad > 0) | |
184 | memset(out + t->targetsize, 0, pad); | |
0ca743a5 PNA |
185 | } |
186 | ||
187 | static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = { | |
188 | [NFTA_RULE_COMPAT_PROTO] = { .type = NLA_U32 }, | |
189 | [NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 }, | |
190 | }; | |
191 | ||
2156d321 | 192 | static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) |
0ca743a5 PNA |
193 | { |
194 | struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; | |
195 | u32 flags; | |
196 | int err; | |
197 | ||
8cb08174 JB |
198 | err = nla_parse_nested_deprecated(tb, NFTA_RULE_COMPAT_MAX, attr, |
199 | nft_rule_compat_policy, NULL); | |
0ca743a5 PNA |
200 | if (err < 0) |
201 | return err; | |
202 | ||
203 | if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS]) | |
204 | return -EINVAL; | |
205 | ||
206 | flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS])); | |
207 | if (flags & ~NFT_RULE_COMPAT_F_MASK) | |
208 | return -EINVAL; | |
209 | if (flags & NFT_RULE_COMPAT_F_INV) | |
210 | *inv = true; | |
211 | ||
8691a9a3 PNA |
212 | *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); |
213 | return 0; | |
0ca743a5 PNA |
214 | } |
215 | ||
2f941622 FW |
216 | static void nft_compat_wait_for_destructors(void) |
217 | { | |
218 | /* xtables matches or targets can have side effects, e.g. | |
219 | * creation/destruction of /proc files. | |
220 | * The xt ->destroy functions are run asynchronously from | |
221 | * work queue. If we have pending invocations we thus | |
222 | * need to wait for those to finish. | |
223 | */ | |
224 | nf_tables_trans_destroy_flush_work(); | |
225 | } | |
226 | ||
0ca743a5 PNA |
227 | static int |
228 | nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
229 | const struct nlattr * const tb[]) | |
230 | { | |
231 | void *info = nft_expr_priv(expr); | |
232 | struct xt_target *target = expr->ops->data; | |
233 | struct xt_tgchk_param par; | |
234 | size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); | |
2156d321 | 235 | u16 proto = 0; |
0ca743a5 PNA |
236 | bool inv = false; |
237 | union nft_entry e = {}; | |
238 | int ret; | |
239 | ||
240 | target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info); | |
241 | ||
8691a9a3 PNA |
242 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
243 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
244 | if (ret < 0) | |
b8e9dc1c | 245 | return ret; |
8691a9a3 | 246 | } |
0ca743a5 PNA |
247 | |
248 | nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); | |
249 | ||
2f941622 | 250 | nft_compat_wait_for_destructors(); |
ffe8923f | 251 | |
0ca743a5 PNA |
252 | ret = xt_check_target(&par, size, proto, inv); |
253 | if (ret < 0) | |
b8e9dc1c | 254 | return ret; |
0ca743a5 PNA |
255 | |
256 | /* The standard target cannot be used */ | |
b8e9dc1c FW |
257 | if (!target->target) |
258 | return -EINVAL; | |
0ca743a5 PNA |
259 | |
260 | return 0; | |
0ca743a5 PNA |
261 | } |
262 | ||
ffe8923f FW |
263 | static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr) |
264 | { | |
ffe8923f FW |
265 | module_put(me); |
266 | kfree(expr->ops); | |
267 | } | |
268 | ||
0ca743a5 | 269 | static void |
62472bce | 270 | nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
0ca743a5 PNA |
271 | { |
272 | struct xt_target *target = expr->ops->data; | |
3d9b1421 | 273 | void *info = nft_expr_priv(expr); |
753c111f | 274 | struct module *me = target->me; |
3d9b1421 PNA |
275 | struct xt_tgdtor_param par; |
276 | ||
277 | par.net = ctx->net; | |
278 | par.target = target; | |
279 | par.targinfo = info; | |
36596dad | 280 | par.family = ctx->family; |
3d9b1421 PNA |
281 | if (par.target->destroy != NULL) |
282 | par.target->destroy(&par); | |
0ca743a5 | 283 | |
ffe8923f | 284 | __nft_mt_tg_destroy(me, expr); |
0ca743a5 PNA |
285 | } |
286 | ||
d701d811 PNA |
287 | static int nft_extension_dump_info(struct sk_buff *skb, int attr, |
288 | const void *info, | |
289 | unsigned int size, unsigned int user_size) | |
290 | { | |
291 | unsigned int info_size, aligned_size = XT_ALIGN(size); | |
292 | struct nlattr *nla; | |
293 | ||
294 | nla = nla_reserve(skb, attr, aligned_size); | |
295 | if (!nla) | |
296 | return -1; | |
297 | ||
298 | info_size = user_size ? : size; | |
299 | memcpy(nla_data(nla), info, info_size); | |
300 | memset(nla_data(nla) + info_size, 0, aligned_size - info_size); | |
301 | ||
302 | return 0; | |
303 | } | |
304 | ||
0ca743a5 PNA |
305 | static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr) |
306 | { | |
307 | const struct xt_target *target = expr->ops->data; | |
308 | void *info = nft_expr_priv(expr); | |
309 | ||
310 | if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) || | |
311 | nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) || | |
d701d811 PNA |
312 | nft_extension_dump_info(skb, NFTA_TARGET_INFO, info, |
313 | target->targetsize, target->usersize)) | |
0ca743a5 PNA |
314 | goto nla_put_failure; |
315 | ||
316 | return 0; | |
317 | ||
318 | nla_put_failure: | |
319 | return -1; | |
320 | } | |
321 | ||
322 | static int nft_target_validate(const struct nft_ctx *ctx, | |
323 | const struct nft_expr *expr, | |
324 | const struct nft_data **data) | |
325 | { | |
326 | struct xt_target *target = expr->ops->data; | |
327 | unsigned int hook_mask = 0; | |
f3f5dded | 328 | int ret; |
0ca743a5 | 329 | |
f323d954 | 330 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
331 | const struct nft_base_chain *basechain = |
332 | nft_base_chain(ctx->chain); | |
c974a3a3 | 333 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
334 | |
335 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 336 | if (target->hooks && !(hook_mask & target->hooks)) |
f3f5dded | 337 | return -EINVAL; |
0ca743a5 | 338 | |
e4844c9c | 339 | ret = nft_compat_chain_validate_dependency(ctx, target->table); |
f3f5dded PNA |
340 | if (ret < 0) |
341 | return ret; | |
0ca743a5 PNA |
342 | } |
343 | return 0; | |
344 | } | |
345 | ||
8bdf1647 FW |
346 | static void __nft_match_eval(const struct nft_expr *expr, |
347 | struct nft_regs *regs, | |
348 | const struct nft_pktinfo *pkt, | |
349 | void *info) | |
0ca743a5 | 350 | { |
0ca743a5 PNA |
351 | struct xt_match *match = expr->ops->data; |
352 | struct sk_buff *skb = pkt->skb; | |
353 | bool ret; | |
354 | ||
355 | nft_compat_set_par((struct xt_action_param *)&pkt->xt, match, info); | |
356 | ||
357 | ret = match->match(skb, (struct xt_action_param *)&pkt->xt); | |
358 | ||
359 | if (pkt->xt.hotdrop) { | |
a55e22e9 | 360 | regs->verdict.code = NF_DROP; |
0ca743a5 PNA |
361 | return; |
362 | } | |
363 | ||
c1f86676 DM |
364 | switch (ret ? 1 : 0) { |
365 | case 1: | |
a55e22e9 | 366 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 | 367 | break; |
c1f86676 | 368 | case 0: |
a55e22e9 | 369 | regs->verdict.code = NFT_BREAK; |
0ca743a5 PNA |
370 | break; |
371 | } | |
372 | } | |
373 | ||
732a8049 FW |
374 | static void nft_match_large_eval(const struct nft_expr *expr, |
375 | struct nft_regs *regs, | |
376 | const struct nft_pktinfo *pkt) | |
377 | { | |
378 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
379 | ||
380 | __nft_match_eval(expr, regs, pkt, priv->info); | |
381 | } | |
382 | ||
8bdf1647 FW |
383 | static void nft_match_eval(const struct nft_expr *expr, |
384 | struct nft_regs *regs, | |
385 | const struct nft_pktinfo *pkt) | |
386 | { | |
387 | __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr)); | |
388 | } | |
389 | ||
0ca743a5 PNA |
390 | static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { |
391 | [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, | |
392 | [NFTA_MATCH_REV] = { .type = NLA_U32 }, | |
393 | [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, | |
394 | }; | |
395 | ||
396 | /* struct xt_mtchk_param and xt_tgchk_param look very similar */ | |
397 | static void | |
398 | nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, | |
399 | struct xt_match *match, void *info, | |
2156d321 | 400 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 401 | { |
2daf1b4d | 402 | par->net = ctx->net; |
0ca743a5 | 403 | par->table = ctx->table->name; |
36596dad | 404 | switch (ctx->family) { |
0ca743a5 PNA |
405 | case AF_INET: |
406 | entry->e4.ip.proto = proto; | |
407 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
408 | break; | |
409 | case AF_INET6: | |
749177cc PNA |
410 | if (proto) |
411 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
412 | ||
0ca743a5 PNA |
413 | entry->e6.ipv6.proto = proto; |
414 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
415 | break; | |
5191f4d8 | 416 | case NFPROTO_BRIDGE: |
2156d321 | 417 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
418 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
419 | break; | |
5f158939 AB |
420 | case NFPROTO_ARP: |
421 | break; | |
0ca743a5 PNA |
422 | } |
423 | par->entryinfo = entry; | |
424 | par->match = match; | |
425 | par->matchinfo = info; | |
f323d954 | 426 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
427 | const struct nft_base_chain *basechain = |
428 | nft_base_chain(ctx->chain); | |
c974a3a3 | 429 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
430 | |
431 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
432 | } else { |
433 | par->hook_mask = 0; | |
0ca743a5 | 434 | } |
36596dad | 435 | par->family = ctx->family; |
55917a21 | 436 | par->nft_compat = true; |
0ca743a5 PNA |
437 | } |
438 | ||
439 | static void match_compat_from_user(struct xt_match *m, void *in, void *out) | |
440 | { | |
756c1b1a PNA |
441 | int pad; |
442 | ||
443 | memcpy(out, in, m->matchsize); | |
444 | pad = XT_ALIGN(m->matchsize) - m->matchsize; | |
445 | if (pad > 0) | |
446 | memset(out + m->matchsize, 0, pad); | |
0ca743a5 PNA |
447 | } |
448 | ||
449 | static int | |
8bdf1647 FW |
450 | __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
451 | const struct nlattr * const tb[], | |
452 | void *info) | |
0ca743a5 | 453 | { |
0ca743a5 PNA |
454 | struct xt_match *match = expr->ops->data; |
455 | struct xt_mtchk_param par; | |
456 | size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); | |
2156d321 | 457 | u16 proto = 0; |
0ca743a5 PNA |
458 | bool inv = false; |
459 | union nft_entry e = {}; | |
460 | int ret; | |
461 | ||
462 | match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info); | |
463 | ||
8691a9a3 PNA |
464 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
465 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
466 | if (ret < 0) | |
b8e9dc1c | 467 | return ret; |
8691a9a3 | 468 | } |
0ca743a5 PNA |
469 | |
470 | nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); | |
471 | ||
2f941622 FW |
472 | nft_compat_wait_for_destructors(); |
473 | ||
b8e20400 | 474 | return xt_check_match(&par, size, proto, inv); |
0ca743a5 PNA |
475 | } |
476 | ||
8bdf1647 FW |
477 | static int |
478 | nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
479 | const struct nlattr * const tb[]) | |
480 | { | |
481 | return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr)); | |
482 | } | |
483 | ||
732a8049 FW |
484 | static int |
485 | nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
486 | const struct nlattr * const tb[]) | |
487 | { | |
488 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
489 | struct xt_match *m = expr->ops->data; | |
490 | int ret; | |
491 | ||
492 | priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); | |
493 | if (!priv->info) | |
494 | return -ENOMEM; | |
495 | ||
496 | ret = __nft_match_init(ctx, expr, tb, priv->info); | |
497 | if (ret) | |
498 | kfree(priv->info); | |
499 | return ret; | |
500 | } | |
501 | ||
0ca743a5 | 502 | static void |
8bdf1647 FW |
503 | __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, |
504 | void *info) | |
0ca743a5 PNA |
505 | { |
506 | struct xt_match *match = expr->ops->data; | |
29e38801 | 507 | struct module *me = match->me; |
3d9b1421 PNA |
508 | struct xt_mtdtor_param par; |
509 | ||
510 | par.net = ctx->net; | |
511 | par.match = match; | |
512 | par.matchinfo = info; | |
36596dad | 513 | par.family = ctx->family; |
3d9b1421 PNA |
514 | if (par.match->destroy != NULL) |
515 | par.match->destroy(&par); | |
0ca743a5 | 516 | |
ffe8923f | 517 | __nft_mt_tg_destroy(me, expr); |
0ca743a5 PNA |
518 | } |
519 | ||
8bdf1647 FW |
520 | static void |
521 | nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
522 | { | |
523 | __nft_match_destroy(ctx, expr, nft_expr_priv(expr)); | |
524 | } | |
525 | ||
732a8049 FW |
526 | static void |
527 | nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
528 | { | |
529 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
530 | ||
531 | __nft_match_destroy(ctx, expr, priv->info); | |
532 | kfree(priv->info); | |
533 | } | |
534 | ||
8bdf1647 FW |
535 | static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, |
536 | void *info) | |
0ca743a5 | 537 | { |
0ca743a5 PNA |
538 | struct xt_match *match = expr->ops->data; |
539 | ||
540 | if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) || | |
541 | nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) || | |
d701d811 PNA |
542 | nft_extension_dump_info(skb, NFTA_MATCH_INFO, info, |
543 | match->matchsize, match->usersize)) | |
0ca743a5 PNA |
544 | goto nla_put_failure; |
545 | ||
546 | return 0; | |
547 | ||
548 | nla_put_failure: | |
549 | return -1; | |
550 | } | |
551 | ||
8bdf1647 FW |
552 | static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr) |
553 | { | |
554 | return __nft_match_dump(skb, expr, nft_expr_priv(expr)); | |
555 | } | |
556 | ||
732a8049 FW |
557 | static int nft_match_large_dump(struct sk_buff *skb, const struct nft_expr *e) |
558 | { | |
559 | struct nft_xt_match_priv *priv = nft_expr_priv(e); | |
560 | ||
561 | return __nft_match_dump(skb, e, priv->info); | |
562 | } | |
563 | ||
0ca743a5 PNA |
564 | static int nft_match_validate(const struct nft_ctx *ctx, |
565 | const struct nft_expr *expr, | |
566 | const struct nft_data **data) | |
567 | { | |
568 | struct xt_match *match = expr->ops->data; | |
569 | unsigned int hook_mask = 0; | |
f3f5dded | 570 | int ret; |
0ca743a5 | 571 | |
f323d954 | 572 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
573 | const struct nft_base_chain *basechain = |
574 | nft_base_chain(ctx->chain); | |
c974a3a3 | 575 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
576 | |
577 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 578 | if (match->hooks && !(hook_mask & match->hooks)) |
f3f5dded | 579 | return -EINVAL; |
0ca743a5 | 580 | |
e4844c9c | 581 | ret = nft_compat_chain_validate_dependency(ctx, match->table); |
f3f5dded PNA |
582 | if (ret < 0) |
583 | return ret; | |
0ca743a5 PNA |
584 | } |
585 | return 0; | |
586 | } | |
587 | ||
588 | static int | |
589 | nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, | |
590 | int event, u16 family, const char *name, | |
591 | int rev, int target) | |
592 | { | |
593 | struct nlmsghdr *nlh; | |
0ca743a5 PNA |
594 | unsigned int flags = portid ? NLM_F_MULTI : 0; |
595 | ||
dedb67c4 | 596 | event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event); |
19c28b13 PNA |
597 | nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, |
598 | NFNETLINK_V0, 0); | |
599 | if (!nlh) | |
0ca743a5 PNA |
600 | goto nlmsg_failure; |
601 | ||
0ca743a5 PNA |
602 | if (nla_put_string(skb, NFTA_COMPAT_NAME, name) || |
603 | nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) || | |
604 | nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target))) | |
605 | goto nla_put_failure; | |
606 | ||
607 | nlmsg_end(skb, nlh); | |
608 | return skb->len; | |
609 | ||
610 | nlmsg_failure: | |
611 | nla_put_failure: | |
612 | nlmsg_cancel(skb, nlh); | |
613 | return -1; | |
614 | } | |
615 | ||
eb1fb147 FW |
616 | static int nfnl_compat_get_rcu(struct net *net, struct sock *nfnl, |
617 | struct sk_buff *skb, const struct nlmsghdr *nlh, | |
618 | const struct nlattr * const tb[], | |
619 | struct netlink_ext_ack *extack) | |
0ca743a5 PNA |
620 | { |
621 | int ret = 0, target; | |
622 | struct nfgenmsg *nfmsg; | |
623 | const char *fmt; | |
624 | const char *name; | |
625 | u32 rev; | |
626 | struct sk_buff *skb2; | |
627 | ||
628 | if (tb[NFTA_COMPAT_NAME] == NULL || | |
629 | tb[NFTA_COMPAT_REV] == NULL || | |
630 | tb[NFTA_COMPAT_TYPE] == NULL) | |
631 | return -EINVAL; | |
632 | ||
633 | name = nla_data(tb[NFTA_COMPAT_NAME]); | |
634 | rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV])); | |
635 | target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE])); | |
636 | ||
637 | nfmsg = nlmsg_data(nlh); | |
638 | ||
639 | switch(nfmsg->nfgen_family) { | |
640 | case AF_INET: | |
641 | fmt = "ipt_%s"; | |
642 | break; | |
643 | case AF_INET6: | |
644 | fmt = "ip6t_%s"; | |
645 | break; | |
5191f4d8 AB |
646 | case NFPROTO_BRIDGE: |
647 | fmt = "ebt_%s"; | |
648 | break; | |
5f158939 AB |
649 | case NFPROTO_ARP: |
650 | fmt = "arpt_%s"; | |
651 | break; | |
0ca743a5 PNA |
652 | default: |
653 | pr_err("nft_compat: unsupported protocol %d\n", | |
654 | nfmsg->nfgen_family); | |
655 | return -EINVAL; | |
656 | } | |
657 | ||
eb1fb147 FW |
658 | if (!try_module_get(THIS_MODULE)) |
659 | return -EINVAL; | |
660 | ||
661 | rcu_read_unlock(); | |
0ca743a5 PNA |
662 | try_then_request_module(xt_find_revision(nfmsg->nfgen_family, name, |
663 | rev, target, &ret), | |
664 | fmt, name); | |
0ca743a5 | 665 | if (ret < 0) |
eb1fb147 | 666 | goto out_put; |
0ca743a5 PNA |
667 | |
668 | skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); | |
eb1fb147 FW |
669 | if (skb2 == NULL) { |
670 | ret = -ENOMEM; | |
671 | goto out_put; | |
672 | } | |
0ca743a5 PNA |
673 | |
674 | /* include the best revision for this extension in the message */ | |
675 | if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid, | |
676 | nlh->nlmsg_seq, | |
677 | NFNL_MSG_TYPE(nlh->nlmsg_type), | |
678 | NFNL_MSG_COMPAT_GET, | |
679 | nfmsg->nfgen_family, | |
680 | name, ret, target) <= 0) { | |
681 | kfree_skb(skb2); | |
eb1fb147 | 682 | goto out_put; |
0ca743a5 PNA |
683 | } |
684 | ||
685 | ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid, | |
686 | MSG_DONTWAIT); | |
687 | if (ret > 0) | |
688 | ret = 0; | |
eb1fb147 FW |
689 | out_put: |
690 | rcu_read_lock(); | |
691 | module_put(THIS_MODULE); | |
0ca743a5 PNA |
692 | return ret == -EAGAIN ? -ENOBUFS : ret; |
693 | } | |
694 | ||
695 | static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = { | |
696 | [NFTA_COMPAT_NAME] = { .type = NLA_NUL_STRING, | |
697 | .len = NFT_COMPAT_NAME_MAX-1 }, | |
698 | [NFTA_COMPAT_REV] = { .type = NLA_U32 }, | |
699 | [NFTA_COMPAT_TYPE] = { .type = NLA_U32 }, | |
700 | }; | |
701 | ||
702 | static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = { | |
eb1fb147 | 703 | [NFNL_MSG_COMPAT_GET] = { .call_rcu = nfnl_compat_get_rcu, |
0ca743a5 PNA |
704 | .attr_count = NFTA_COMPAT_MAX, |
705 | .policy = nfnl_compat_policy_get }, | |
706 | }; | |
707 | ||
708 | static const struct nfnetlink_subsystem nfnl_compat_subsys = { | |
709 | .name = "nft-compat", | |
710 | .subsys_id = NFNL_SUBSYS_NFT_COMPAT, | |
711 | .cb_count = NFNL_MSG_COMPAT_MAX, | |
712 | .cb = nfnl_nft_compat_cb, | |
713 | }; | |
714 | ||
b8e20400 | 715 | static struct nft_expr_type nft_match_type; |
ba378ca9 | 716 | |
0ca743a5 PNA |
717 | static const struct nft_expr_ops * |
718 | nft_match_select_ops(const struct nft_ctx *ctx, | |
719 | const struct nlattr * const tb[]) | |
720 | { | |
b8e20400 | 721 | struct nft_expr_ops *ops; |
0ca743a5 | 722 | struct xt_match *match; |
732a8049 | 723 | unsigned int matchsize; |
0ca743a5 | 724 | char *mt_name; |
ba378ca9 | 725 | u32 rev, family; |
2bf4fade | 726 | int err; |
0ca743a5 PNA |
727 | |
728 | if (tb[NFTA_MATCH_NAME] == NULL || | |
729 | tb[NFTA_MATCH_REV] == NULL || | |
730 | tb[NFTA_MATCH_INFO] == NULL) | |
731 | return ERR_PTR(-EINVAL); | |
732 | ||
733 | mt_name = nla_data(tb[NFTA_MATCH_NAME]); | |
734 | rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); | |
36596dad | 735 | family = ctx->family; |
0ca743a5 | 736 | |
0ca743a5 PNA |
737 | match = xt_request_find_match(family, mt_name, rev); |
738 | if (IS_ERR(match)) | |
739 | return ERR_PTR(-ENOENT); | |
740 | ||
2bf4fade LZ |
741 | if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) { |
742 | err = -EINVAL; | |
743 | goto err; | |
744 | } | |
f0716cd6 | 745 | |
b8e20400 PNA |
746 | ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); |
747 | if (!ops) { | |
2bf4fade LZ |
748 | err = -ENOMEM; |
749 | goto err; | |
750 | } | |
0ca743a5 | 751 | |
b8e20400 PNA |
752 | ops->type = &nft_match_type; |
753 | ops->eval = nft_match_eval; | |
754 | ops->init = nft_match_init; | |
755 | ops->destroy = nft_match_destroy; | |
756 | ops->dump = nft_match_dump; | |
757 | ops->validate = nft_match_validate; | |
758 | ops->data = match; | |
0ca743a5 | 759 | |
732a8049 FW |
760 | matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); |
761 | if (matchsize > NFT_MATCH_LARGE_THRESH) { | |
762 | matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); | |
763 | ||
b8e20400 PNA |
764 | ops->eval = nft_match_large_eval; |
765 | ops->init = nft_match_large_init; | |
766 | ops->destroy = nft_match_large_destroy; | |
767 | ops->dump = nft_match_large_dump; | |
732a8049 FW |
768 | } |
769 | ||
b8e20400 | 770 | ops->size = matchsize; |
732a8049 | 771 | |
b8e20400 | 772 | return ops; |
2bf4fade LZ |
773 | err: |
774 | module_put(match->me); | |
775 | return ERR_PTR(err); | |
0ca743a5 PNA |
776 | } |
777 | ||
b8e20400 PNA |
778 | static void nft_match_release_ops(const struct nft_expr_ops *ops) |
779 | { | |
780 | struct xt_match *match = ops->data; | |
781 | ||
782 | module_put(match->me); | |
783 | kfree(ops); | |
784 | } | |
785 | ||
0ca743a5 PNA |
786 | static struct nft_expr_type nft_match_type __read_mostly = { |
787 | .name = "match", | |
788 | .select_ops = nft_match_select_ops, | |
b8e20400 | 789 | .release_ops = nft_match_release_ops, |
0ca743a5 PNA |
790 | .policy = nft_match_policy, |
791 | .maxattr = NFTA_MATCH_MAX, | |
792 | .owner = THIS_MODULE, | |
793 | }; | |
794 | ||
b8e20400 | 795 | static struct nft_expr_type nft_target_type; |
ba378ca9 | 796 | |
0ca743a5 PNA |
797 | static const struct nft_expr_ops * |
798 | nft_target_select_ops(const struct nft_ctx *ctx, | |
799 | const struct nlattr * const tb[]) | |
800 | { | |
b8e20400 | 801 | struct nft_expr_ops *ops; |
0ca743a5 PNA |
802 | struct xt_target *target; |
803 | char *tg_name; | |
ba378ca9 | 804 | u32 rev, family; |
2bf4fade | 805 | int err; |
0ca743a5 PNA |
806 | |
807 | if (tb[NFTA_TARGET_NAME] == NULL || | |
808 | tb[NFTA_TARGET_REV] == NULL || | |
809 | tb[NFTA_TARGET_INFO] == NULL) | |
810 | return ERR_PTR(-EINVAL); | |
811 | ||
812 | tg_name = nla_data(tb[NFTA_TARGET_NAME]); | |
813 | rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); | |
36596dad | 814 | family = ctx->family; |
0ca743a5 | 815 | |
21d5e078 FW |
816 | if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || |
817 | strcmp(tg_name, XT_STANDARD_TARGET) == 0 || | |
818 | strcmp(tg_name, "standard") == 0) | |
819 | return ERR_PTR(-EINVAL); | |
820 | ||
0ca743a5 PNA |
821 | target = xt_request_find_target(family, tg_name, rev); |
822 | if (IS_ERR(target)) | |
823 | return ERR_PTR(-ENOENT); | |
824 | ||
21d5e078 FW |
825 | if (!target->target) { |
826 | err = -EINVAL; | |
827 | goto err; | |
828 | } | |
829 | ||
2bf4fade LZ |
830 | if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) { |
831 | err = -EINVAL; | |
832 | goto err; | |
833 | } | |
f0716cd6 | 834 | |
b8e20400 PNA |
835 | ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); |
836 | if (!ops) { | |
2bf4fade LZ |
837 | err = -ENOMEM; |
838 | goto err; | |
839 | } | |
0ca743a5 | 840 | |
b8e20400 PNA |
841 | ops->type = &nft_target_type; |
842 | ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); | |
843 | ops->init = nft_target_init; | |
844 | ops->destroy = nft_target_destroy; | |
845 | ops->dump = nft_target_dump; | |
846 | ops->validate = nft_target_validate; | |
847 | ops->data = target; | |
0ca743a5 | 848 | |
5191f4d8 | 849 | if (family == NFPROTO_BRIDGE) |
b8e20400 | 850 | ops->eval = nft_target_eval_bridge; |
5191f4d8 | 851 | else |
b8e20400 | 852 | ops->eval = nft_target_eval_xt; |
0ca743a5 | 853 | |
b8e20400 | 854 | return ops; |
2bf4fade LZ |
855 | err: |
856 | module_put(target->me); | |
857 | return ERR_PTR(err); | |
0ca743a5 PNA |
858 | } |
859 | ||
b8e20400 PNA |
860 | static void nft_target_release_ops(const struct nft_expr_ops *ops) |
861 | { | |
862 | struct xt_target *target = ops->data; | |
863 | ||
864 | module_put(target->me); | |
865 | kfree(ops); | |
866 | } | |
867 | ||
0ca743a5 PNA |
868 | static struct nft_expr_type nft_target_type __read_mostly = { |
869 | .name = "target", | |
870 | .select_ops = nft_target_select_ops, | |
b8e20400 | 871 | .release_ops = nft_target_release_ops, |
0ca743a5 PNA |
872 | .policy = nft_target_policy, |
873 | .maxattr = NFTA_TARGET_MAX, | |
874 | .owner = THIS_MODULE, | |
875 | }; | |
876 | ||
877 | static int __init nft_compat_module_init(void) | |
878 | { | |
879 | int ret; | |
880 | ||
881 | ret = nft_register_expr(&nft_match_type); | |
882 | if (ret < 0) | |
b8e20400 | 883 | return ret; |
0ca743a5 PNA |
884 | |
885 | ret = nft_register_expr(&nft_target_type); | |
886 | if (ret < 0) | |
887 | goto err_match; | |
888 | ||
889 | ret = nfnetlink_subsys_register(&nfnl_compat_subsys); | |
890 | if (ret < 0) { | |
891 | pr_err("nft_compat: cannot register with nfnetlink.\n"); | |
892 | goto err_target; | |
893 | } | |
894 | ||
0ca743a5 | 895 | return ret; |
0ca743a5 PNA |
896 | err_target: |
897 | nft_unregister_expr(&nft_target_type); | |
898 | err_match: | |
899 | nft_unregister_expr(&nft_match_type); | |
900 | return ret; | |
901 | } | |
902 | ||
903 | static void __exit nft_compat_module_exit(void) | |
904 | { | |
905 | nfnetlink_subsys_unregister(&nfnl_compat_subsys); | |
906 | nft_unregister_expr(&nft_target_type); | |
907 | nft_unregister_expr(&nft_match_type); | |
0ca743a5 PNA |
908 | } |
909 | ||
910 | MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); | |
911 | ||
912 | module_init(nft_compat_module_init); | |
913 | module_exit(nft_compat_module_exit); | |
914 | ||
915 | MODULE_LICENSE("GPL"); | |
916 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); | |
917 | MODULE_ALIAS_NFT_EXPR("match"); | |
918 | MODULE_ALIAS_NFT_EXPR("target"); | |
4cacc395 | 919 | MODULE_DESCRIPTION("x_tables over nftables support"); |