]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame_incremental - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-hirsute-kernel.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
netfilter: nf_tables: missing attribute validation in nf_tables_delflowtable()
[mirror_ubuntu-hirsute-kernel.git] / net / netfilter / nf_tables_api.c
... / ...
CommitLineData
1/*
2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
16#include <linux/vmalloc.h>
17#include <linux/netfilter.h>
18#include <linux/netfilter/nfnetlink.h>
19#include <linux/netfilter/nf_tables.h>
20#include <net/netfilter/nf_flow_table.h>
21#include <net/netfilter/nf_tables_core.h>
22#include <net/netfilter/nf_tables.h>
23#include <net/net_namespace.h>
24#include <net/sock.h>
25
26static LIST_HEAD(nf_tables_expressions);
27static LIST_HEAD(nf_tables_objects);
28static LIST_HEAD(nf_tables_flowtables);
29static u64 table_handle;
30
31static void nft_ctx_init(struct nft_ctx *ctx,
32 struct net *net,
33 const struct sk_buff *skb,
34 const struct nlmsghdr *nlh,
35 u8 family,
36 struct nft_table *table,
37 struct nft_chain *chain,
38 const struct nlattr * const *nla)
39{
40 ctx->net = net;
41 ctx->family = family;
42 ctx->table = table;
43 ctx->chain = chain;
44 ctx->nla = nla;
45 ctx->portid = NETLINK_CB(skb).portid;
46 ctx->report = nlmsg_report(nlh);
47 ctx->seq = nlh->nlmsg_seq;
48}
49
50static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
51 int msg_type, u32 size, gfp_t gfp)
52{
53 struct nft_trans *trans;
54
55 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
56 if (trans == NULL)
57 return NULL;
58
59 trans->msg_type = msg_type;
60 trans->ctx = *ctx;
61
62 return trans;
63}
64
65static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
66 int msg_type, u32 size)
67{
68 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
69}
70
71static void nft_trans_destroy(struct nft_trans *trans)
72{
73 list_del(&trans->list);
74 kfree(trans);
75}
76
77static int nf_tables_register_hook(struct net *net,
78 const struct nft_table *table,
79 struct nft_chain *chain)
80{
81 if (table->flags & NFT_TABLE_F_DORMANT ||
82 !nft_is_base_chain(chain))
83 return 0;
84
85 return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
86}
87
88static void nf_tables_unregister_hook(struct net *net,
89 const struct nft_table *table,
90 struct nft_chain *chain)
91{
92 if (table->flags & NFT_TABLE_F_DORMANT ||
93 !nft_is_base_chain(chain))
94 return;
95
96 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
97}
98
99static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
100{
101 struct nft_trans *trans;
102
103 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
104 if (trans == NULL)
105 return -ENOMEM;
106
107 if (msg_type == NFT_MSG_NEWTABLE)
108 nft_activate_next(ctx->net, ctx->table);
109
110 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
111 return 0;
112}
113
114static int nft_deltable(struct nft_ctx *ctx)
115{
116 int err;
117
118 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
119 if (err < 0)
120 return err;
121
122 nft_deactivate_next(ctx->net, ctx->table);
123 return err;
124}
125
126static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
127{
128 struct nft_trans *trans;
129
130 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
131 if (trans == NULL)
132 return -ENOMEM;
133
134 if (msg_type == NFT_MSG_NEWCHAIN)
135 nft_activate_next(ctx->net, ctx->chain);
136
137 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
138 return 0;
139}
140
141static int nft_delchain(struct nft_ctx *ctx)
142{
143 int err;
144
145 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
146 if (err < 0)
147 return err;
148
149 ctx->table->use--;
150 nft_deactivate_next(ctx->net, ctx->chain);
151
152 return err;
153}
154
155static int
156nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
157{
158 /* You cannot delete the same rule twice */
159 if (nft_is_active_next(ctx->net, rule)) {
160 nft_deactivate_next(ctx->net, rule);
161 ctx->chain->use--;
162 return 0;
163 }
164 return -ENOENT;
165}
166
167static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
168 struct nft_rule *rule)
169{
170 struct nft_trans *trans;
171
172 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
173 if (trans == NULL)
174 return NULL;
175
176 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
177 nft_trans_rule_id(trans) =
178 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
179 }
180 nft_trans_rule(trans) = rule;
181 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
182
183 return trans;
184}
185
186static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
187{
188 struct nft_trans *trans;
189 int err;
190
191 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
192 if (trans == NULL)
193 return -ENOMEM;
194
195 err = nf_tables_delrule_deactivate(ctx, rule);
196 if (err < 0) {
197 nft_trans_destroy(trans);
198 return err;
199 }
200
201 return 0;
202}
203
204static int nft_delrule_by_chain(struct nft_ctx *ctx)
205{
206 struct nft_rule *rule;
207 int err;
208
209 list_for_each_entry(rule, &ctx->chain->rules, list) {
210 err = nft_delrule(ctx, rule);
211 if (err < 0)
212 return err;
213 }
214 return 0;
215}
216
217static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
218 struct nft_set *set)
219{
220 struct nft_trans *trans;
221
222 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
223 if (trans == NULL)
224 return -ENOMEM;
225
226 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
227 nft_trans_set_id(trans) =
228 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
229 nft_activate_next(ctx->net, set);
230 }
231 nft_trans_set(trans) = set;
232 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
233
234 return 0;
235}
236
237static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
238{
239 int err;
240
241 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
242 if (err < 0)
243 return err;
244
245 nft_deactivate_next(ctx->net, set);
246 ctx->table->use--;
247
248 return err;
249}
250
251static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
252 struct nft_object *obj)
253{
254 struct nft_trans *trans;
255
256 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
257 if (trans == NULL)
258 return -ENOMEM;
259
260 if (msg_type == NFT_MSG_NEWOBJ)
261 nft_activate_next(ctx->net, obj);
262
263 nft_trans_obj(trans) = obj;
264 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
265
266 return 0;
267}
268
269static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
270{
271 int err;
272
273 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
274 if (err < 0)
275 return err;
276
277 nft_deactivate_next(ctx->net, obj);
278 ctx->table->use--;
279
280 return err;
281}
282
283static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
284 struct nft_flowtable *flowtable)
285{
286 struct nft_trans *trans;
287
288 trans = nft_trans_alloc(ctx, msg_type,
289 sizeof(struct nft_trans_flowtable));
290 if (trans == NULL)
291 return -ENOMEM;
292
293 if (msg_type == NFT_MSG_NEWFLOWTABLE)
294 nft_activate_next(ctx->net, flowtable);
295
296 nft_trans_flowtable(trans) = flowtable;
297 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
298
299 return 0;
300}
301
302static int nft_delflowtable(struct nft_ctx *ctx,
303 struct nft_flowtable *flowtable)
304{
305 int err;
306
307 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
308 if (err < 0)
309 return err;
310
311 nft_deactivate_next(ctx->net, flowtable);
312 ctx->table->use--;
313
314 return err;
315}
316
317/*
318 * Tables
319 */
320
321static struct nft_table *nft_table_lookup(const struct net *net,
322 const struct nlattr *nla,
323 u8 family, u8 genmask)
324{
325 struct nft_table *table;
326
327 list_for_each_entry(table, &net->nft.tables, list) {
328 if (!nla_strcmp(nla, table->name) &&
329 table->family == family &&
330 nft_active_genmask(table, genmask))
331 return table;
332 }
333 return NULL;
334}
335
336static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
337 const struct nlattr *nla,
338 u8 genmask)
339{
340 struct nft_table *table;
341
342 list_for_each_entry(table, &net->nft.tables, list) {
343 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
344 nft_active_genmask(table, genmask))
345 return table;
346 }
347 return NULL;
348}
349
350static struct nft_table *nf_tables_table_lookup(const struct net *net,
351 const struct nlattr *nla,
352 u8 family, u8 genmask)
353{
354 struct nft_table *table;
355
356 if (nla == NULL)
357 return ERR_PTR(-EINVAL);
358
359 table = nft_table_lookup(net, nla, family, genmask);
360 if (table != NULL)
361 return table;
362
363 return ERR_PTR(-ENOENT);
364}
365
366static struct nft_table *nf_tables_table_lookup_byhandle(const struct net *net,
367 const struct nlattr *nla,
368 u8 genmask)
369{
370 struct nft_table *table;
371
372 if (nla == NULL)
373 return ERR_PTR(-EINVAL);
374
375 table = nft_table_lookup_byhandle(net, nla, genmask);
376 if (table != NULL)
377 return table;
378
379 return ERR_PTR(-ENOENT);
380}
381
382static inline u64 nf_tables_alloc_handle(struct nft_table *table)
383{
384 return ++table->hgenerator;
385}
386
387static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
388
389static const struct nf_chain_type *
390__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
391{
392 int i;
393
394 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
395 if (chain_type[family][i] != NULL &&
396 !nla_strcmp(nla, chain_type[family][i]->name))
397 return chain_type[family][i];
398 }
399 return NULL;
400}
401
402static const struct nf_chain_type *
403nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload)
404{
405 const struct nf_chain_type *type;
406
407 type = __nf_tables_chain_type_lookup(nla, family);
408 if (type != NULL)
409 return type;
410#ifdef CONFIG_MODULES
411 if (autoload) {
412 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
413 request_module("nft-chain-%u-%.*s", family,
414 nla_len(nla), (const char *)nla_data(nla));
415 nfnl_lock(NFNL_SUBSYS_NFTABLES);
416 type = __nf_tables_chain_type_lookup(nla, family);
417 if (type != NULL)
418 return ERR_PTR(-EAGAIN);
419 }
420#endif
421 return ERR_PTR(-ENOENT);
422}
423
424static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
425 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
426 .len = NFT_TABLE_MAXNAMELEN - 1 },
427 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
428 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
429};
430
431static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
432 u32 portid, u32 seq, int event, u32 flags,
433 int family, const struct nft_table *table)
434{
435 struct nlmsghdr *nlh;
436 struct nfgenmsg *nfmsg;
437
438 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
439 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
440 if (nlh == NULL)
441 goto nla_put_failure;
442
443 nfmsg = nlmsg_data(nlh);
444 nfmsg->nfgen_family = family;
445 nfmsg->version = NFNETLINK_V0;
446 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
447
448 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
449 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
450 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
451 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
452 NFTA_TABLE_PAD))
453 goto nla_put_failure;
454
455 nlmsg_end(skb, nlh);
456 return 0;
457
458nla_put_failure:
459 nlmsg_trim(skb, nlh);
460 return -1;
461}
462
463static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
464{
465 struct sk_buff *skb;
466 int err;
467
468 if (!ctx->report &&
469 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
470 return;
471
472 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
473 if (skb == NULL)
474 goto err;
475
476 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
477 event, 0, ctx->family, ctx->table);
478 if (err < 0) {
479 kfree_skb(skb);
480 goto err;
481 }
482
483 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
484 ctx->report, GFP_KERNEL);
485 return;
486err:
487 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
488}
489
490static int nf_tables_dump_tables(struct sk_buff *skb,
491 struct netlink_callback *cb)
492{
493 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
494 const struct nft_table *table;
495 unsigned int idx = 0, s_idx = cb->args[0];
496 struct net *net = sock_net(skb->sk);
497 int family = nfmsg->nfgen_family;
498
499 rcu_read_lock();
500 cb->seq = net->nft.base_seq;
501
502 list_for_each_entry_rcu(table, &net->nft.tables, list) {
503 if (family != NFPROTO_UNSPEC && family != table->family)
504 continue;
505
506 if (idx < s_idx)
507 goto cont;
508 if (idx > s_idx)
509 memset(&cb->args[1], 0,
510 sizeof(cb->args) - sizeof(cb->args[0]));
511 if (!nft_is_active(net, table))
512 continue;
513 if (nf_tables_fill_table_info(skb, net,
514 NETLINK_CB(cb->skb).portid,
515 cb->nlh->nlmsg_seq,
516 NFT_MSG_NEWTABLE, NLM_F_MULTI,
517 table->family, table) < 0)
518 goto done;
519
520 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
521cont:
522 idx++;
523 }
524done:
525 rcu_read_unlock();
526 cb->args[0] = idx;
527 return skb->len;
528}
529
530static int nf_tables_gettable(struct net *net, struct sock *nlsk,
531 struct sk_buff *skb, const struct nlmsghdr *nlh,
532 const struct nlattr * const nla[],
533 struct netlink_ext_ack *extack)
534{
535 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
536 u8 genmask = nft_genmask_cur(net);
537 const struct nft_table *table;
538 struct sk_buff *skb2;
539 int family = nfmsg->nfgen_family;
540 int err;
541
542 if (nlh->nlmsg_flags & NLM_F_DUMP) {
543 struct netlink_dump_control c = {
544 .dump = nf_tables_dump_tables,
545 };
546 return netlink_dump_start(nlsk, skb, nlh, &c);
547 }
548
549 table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family,
550 genmask);
551 if (IS_ERR(table))
552 return PTR_ERR(table);
553
554 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
555 if (!skb2)
556 return -ENOMEM;
557
558 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
559 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
560 family, table);
561 if (err < 0)
562 goto err;
563
564 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
565
566err:
567 kfree_skb(skb2);
568 return err;
569}
570
571static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
572{
573 struct nft_chain *chain;
574 u32 i = 0;
575
576 list_for_each_entry(chain, &table->chains, list) {
577 if (!nft_is_active_next(net, chain))
578 continue;
579 if (!nft_is_base_chain(chain))
580 continue;
581
582 if (cnt && i++ == cnt)
583 break;
584
585 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
586 }
587}
588
589static int nf_tables_table_enable(struct net *net, struct nft_table *table)
590{
591 struct nft_chain *chain;
592 int err, i = 0;
593
594 list_for_each_entry(chain, &table->chains, list) {
595 if (!nft_is_active_next(net, chain))
596 continue;
597 if (!nft_is_base_chain(chain))
598 continue;
599
600 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
601 if (err < 0)
602 goto err;
603
604 i++;
605 }
606 return 0;
607err:
608 if (i)
609 nft_table_disable(net, table, i);
610 return err;
611}
612
613static void nf_tables_table_disable(struct net *net, struct nft_table *table)
614{
615 nft_table_disable(net, table, 0);
616}
617
618static int nf_tables_updtable(struct nft_ctx *ctx)
619{
620 struct nft_trans *trans;
621 u32 flags;
622 int ret = 0;
623
624 if (!ctx->nla[NFTA_TABLE_FLAGS])
625 return 0;
626
627 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
628 if (flags & ~NFT_TABLE_F_DORMANT)
629 return -EINVAL;
630
631 if (flags == ctx->table->flags)
632 return 0;
633
634 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
635 sizeof(struct nft_trans_table));
636 if (trans == NULL)
637 return -ENOMEM;
638
639 if ((flags & NFT_TABLE_F_DORMANT) &&
640 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
641 nft_trans_table_enable(trans) = false;
642 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
643 ctx->table->flags & NFT_TABLE_F_DORMANT) {
644 ret = nf_tables_table_enable(ctx->net, ctx->table);
645 if (ret >= 0) {
646 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
647 nft_trans_table_enable(trans) = true;
648 }
649 }
650 if (ret < 0)
651 goto err;
652
653 nft_trans_table_update(trans) = true;
654 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
655 return 0;
656err:
657 nft_trans_destroy(trans);
658 return ret;
659}
660
661static int nf_tables_newtable(struct net *net, struct sock *nlsk,
662 struct sk_buff *skb, const struct nlmsghdr *nlh,
663 const struct nlattr * const nla[],
664 struct netlink_ext_ack *extack)
665{
666 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
667 u8 genmask = nft_genmask_next(net);
668 const struct nlattr *name;
669 struct nft_table *table;
670 int family = nfmsg->nfgen_family;
671 u32 flags = 0;
672 struct nft_ctx ctx;
673 int err;
674
675 name = nla[NFTA_TABLE_NAME];
676 table = nf_tables_table_lookup(net, name, family, genmask);
677 if (IS_ERR(table)) {
678 if (PTR_ERR(table) != -ENOENT)
679 return PTR_ERR(table);
680 } else {
681 if (nlh->nlmsg_flags & NLM_F_EXCL)
682 return -EEXIST;
683 if (nlh->nlmsg_flags & NLM_F_REPLACE)
684 return -EOPNOTSUPP;
685
686 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
687 return nf_tables_updtable(&ctx);
688 }
689
690 if (nla[NFTA_TABLE_FLAGS]) {
691 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
692 if (flags & ~NFT_TABLE_F_DORMANT)
693 return -EINVAL;
694 }
695
696 err = -ENOMEM;
697 table = kzalloc(sizeof(*table), GFP_KERNEL);
698 if (table == NULL)
699 goto err_kzalloc;
700
701 table->name = nla_strdup(name, GFP_KERNEL);
702 if (table->name == NULL)
703 goto err_strdup;
704
705 INIT_LIST_HEAD(&table->chains);
706 INIT_LIST_HEAD(&table->sets);
707 INIT_LIST_HEAD(&table->objects);
708 INIT_LIST_HEAD(&table->flowtables);
709 table->family = family;
710 table->flags = flags;
711 table->handle = ++table_handle;
712
713 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
714 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
715 if (err < 0)
716 goto err_trans;
717
718 list_add_tail_rcu(&table->list, &net->nft.tables);
719 return 0;
720err_trans:
721 kfree(table->name);
722err_strdup:
723 kfree(table);
724err_kzalloc:
725 return err;
726}
727
728static int nft_flush_table(struct nft_ctx *ctx)
729{
730 struct nft_flowtable *flowtable, *nft;
731 struct nft_chain *chain, *nc;
732 struct nft_object *obj, *ne;
733 struct nft_set *set, *ns;
734 int err;
735
736 list_for_each_entry(chain, &ctx->table->chains, list) {
737 if (!nft_is_active_next(ctx->net, chain))
738 continue;
739
740 ctx->chain = chain;
741
742 err = nft_delrule_by_chain(ctx);
743 if (err < 0)
744 goto out;
745 }
746
747 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
748 if (!nft_is_active_next(ctx->net, set))
749 continue;
750
751 if (nft_set_is_anonymous(set) &&
752 !list_empty(&set->bindings))
753 continue;
754
755 err = nft_delset(ctx, set);
756 if (err < 0)
757 goto out;
758 }
759
760 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
761 err = nft_delflowtable(ctx, flowtable);
762 if (err < 0)
763 goto out;
764 }
765
766 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
767 err = nft_delobj(ctx, obj);
768 if (err < 0)
769 goto out;
770 }
771
772 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
773 if (!nft_is_active_next(ctx->net, chain))
774 continue;
775
776 ctx->chain = chain;
777
778 err = nft_delchain(ctx);
779 if (err < 0)
780 goto out;
781 }
782
783 err = nft_deltable(ctx);
784out:
785 return err;
786}
787
788static int nft_flush(struct nft_ctx *ctx, int family)
789{
790 struct nft_table *table, *nt;
791 const struct nlattr * const *nla = ctx->nla;
792 int err = 0;
793
794 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
795 if (family != AF_UNSPEC && table->family != family)
796 continue;
797
798 ctx->family = table->family;
799
800 if (!nft_is_active_next(ctx->net, table))
801 continue;
802
803 if (nla[NFTA_TABLE_NAME] &&
804 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
805 continue;
806
807 ctx->table = table;
808
809 err = nft_flush_table(ctx);
810 if (err < 0)
811 goto out;
812 }
813out:
814 return err;
815}
816
817static int nf_tables_deltable(struct net *net, struct sock *nlsk,
818 struct sk_buff *skb, const struct nlmsghdr *nlh,
819 const struct nlattr * const nla[],
820 struct netlink_ext_ack *extack)
821{
822 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
823 u8 genmask = nft_genmask_next(net);
824 struct nft_table *table;
825 int family = nfmsg->nfgen_family;
826 struct nft_ctx ctx;
827
828 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
829 if (family == AF_UNSPEC ||
830 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
831 return nft_flush(&ctx, family);
832
833 if (nla[NFTA_TABLE_HANDLE])
834 table = nf_tables_table_lookup_byhandle(net,
835 nla[NFTA_TABLE_HANDLE],
836 genmask);
837 else
838 table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME],
839 family, genmask);
840
841 if (IS_ERR(table))
842 return PTR_ERR(table);
843
844 if (nlh->nlmsg_flags & NLM_F_NONREC &&
845 table->use > 0)
846 return -EBUSY;
847
848 ctx.family = family;
849 ctx.table = table;
850
851 return nft_flush_table(&ctx);
852}
853
854static void nf_tables_table_destroy(struct nft_ctx *ctx)
855{
856 BUG_ON(ctx->table->use > 0);
857
858 kfree(ctx->table->name);
859 kfree(ctx->table);
860}
861
862int nft_register_chain_type(const struct nf_chain_type *ctype)
863{
864 int err = 0;
865
866 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
867 return -EINVAL;
868
869 nfnl_lock(NFNL_SUBSYS_NFTABLES);
870 if (chain_type[ctype->family][ctype->type] != NULL) {
871 err = -EBUSY;
872 goto out;
873 }
874 chain_type[ctype->family][ctype->type] = ctype;
875out:
876 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
877 return err;
878}
879EXPORT_SYMBOL_GPL(nft_register_chain_type);
880
881void nft_unregister_chain_type(const struct nf_chain_type *ctype)
882{
883 nfnl_lock(NFNL_SUBSYS_NFTABLES);
884 chain_type[ctype->family][ctype->type] = NULL;
885 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
886}
887EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
888
889/*
890 * Chains
891 */
892
893static struct nft_chain *
894nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
895 u8 genmask)
896{
897 struct nft_chain *chain;
898
899 list_for_each_entry(chain, &table->chains, list) {
900 if (chain->handle == handle &&
901 nft_active_genmask(chain, genmask))
902 return chain;
903 }
904
905 return ERR_PTR(-ENOENT);
906}
907
908static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
909 const struct nlattr *nla,
910 u8 genmask)
911{
912 struct nft_chain *chain;
913
914 if (nla == NULL)
915 return ERR_PTR(-EINVAL);
916
917 list_for_each_entry(chain, &table->chains, list) {
918 if (!nla_strcmp(nla, chain->name) &&
919 nft_active_genmask(chain, genmask))
920 return chain;
921 }
922
923 return ERR_PTR(-ENOENT);
924}
925
926static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
927 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
928 .len = NFT_TABLE_MAXNAMELEN - 1 },
929 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
930 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
931 .len = NFT_CHAIN_MAXNAMELEN - 1 },
932 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
933 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
934 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
935 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
936};
937
938static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
939 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
940 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
941 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
942 .len = IFNAMSIZ - 1 },
943};
944
945static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
946{
947 struct nft_stats *cpu_stats, total;
948 struct nlattr *nest;
949 unsigned int seq;
950 u64 pkts, bytes;
951 int cpu;
952
953 memset(&total, 0, sizeof(total));
954 for_each_possible_cpu(cpu) {
955 cpu_stats = per_cpu_ptr(stats, cpu);
956 do {
957 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
958 pkts = cpu_stats->pkts;
959 bytes = cpu_stats->bytes;
960 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
961 total.pkts += pkts;
962 total.bytes += bytes;
963 }
964 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
965 if (nest == NULL)
966 goto nla_put_failure;
967
968 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
969 NFTA_COUNTER_PAD) ||
970 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
971 NFTA_COUNTER_PAD))
972 goto nla_put_failure;
973
974 nla_nest_end(skb, nest);
975 return 0;
976
977nla_put_failure:
978 return -ENOSPC;
979}
980
981static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
982 u32 portid, u32 seq, int event, u32 flags,
983 int family, const struct nft_table *table,
984 const struct nft_chain *chain)
985{
986 struct nlmsghdr *nlh;
987 struct nfgenmsg *nfmsg;
988
989 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
990 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
991 if (nlh == NULL)
992 goto nla_put_failure;
993
994 nfmsg = nlmsg_data(nlh);
995 nfmsg->nfgen_family = family;
996 nfmsg->version = NFNETLINK_V0;
997 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
998
999 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1000 goto nla_put_failure;
1001 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1002 NFTA_CHAIN_PAD))
1003 goto nla_put_failure;
1004 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1005 goto nla_put_failure;
1006
1007 if (nft_is_base_chain(chain)) {
1008 const struct nft_base_chain *basechain = nft_base_chain(chain);
1009 const struct nf_hook_ops *ops = &basechain->ops;
1010 struct nlattr *nest;
1011
1012 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
1013 if (nest == NULL)
1014 goto nla_put_failure;
1015 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1016 goto nla_put_failure;
1017 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1018 goto nla_put_failure;
1019 if (basechain->dev_name[0] &&
1020 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1021 goto nla_put_failure;
1022 nla_nest_end(skb, nest);
1023
1024 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1025 htonl(basechain->policy)))
1026 goto nla_put_failure;
1027
1028 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1029 goto nla_put_failure;
1030
1031 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
1032 goto nla_put_failure;
1033 }
1034
1035 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1036 goto nla_put_failure;
1037
1038 nlmsg_end(skb, nlh);
1039 return 0;
1040
1041nla_put_failure:
1042 nlmsg_trim(skb, nlh);
1043 return -1;
1044}
1045
1046static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1047{
1048 struct sk_buff *skb;
1049 int err;
1050
1051 if (!ctx->report &&
1052 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1053 return;
1054
1055 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1056 if (skb == NULL)
1057 goto err;
1058
1059 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1060 event, 0, ctx->family, ctx->table,
1061 ctx->chain);
1062 if (err < 0) {
1063 kfree_skb(skb);
1064 goto err;
1065 }
1066
1067 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1068 ctx->report, GFP_KERNEL);
1069 return;
1070err:
1071 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1072}
1073
1074static int nf_tables_dump_chains(struct sk_buff *skb,
1075 struct netlink_callback *cb)
1076{
1077 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1078 const struct nft_table *table;
1079 const struct nft_chain *chain;
1080 unsigned int idx = 0, s_idx = cb->args[0];
1081 struct net *net = sock_net(skb->sk);
1082 int family = nfmsg->nfgen_family;
1083
1084 rcu_read_lock();
1085 cb->seq = net->nft.base_seq;
1086
1087 list_for_each_entry_rcu(table, &net->nft.tables, list) {
1088 if (family != NFPROTO_UNSPEC && family != table->family)
1089 continue;
1090
1091 list_for_each_entry_rcu(chain, &table->chains, list) {
1092 if (idx < s_idx)
1093 goto cont;
1094 if (idx > s_idx)
1095 memset(&cb->args[1], 0,
1096 sizeof(cb->args) - sizeof(cb->args[0]));
1097 if (!nft_is_active(net, chain))
1098 continue;
1099 if (nf_tables_fill_chain_info(skb, net,
1100 NETLINK_CB(cb->skb).portid,
1101 cb->nlh->nlmsg_seq,
1102 NFT_MSG_NEWCHAIN,
1103 NLM_F_MULTI,
1104 table->family, table,
1105 chain) < 0)
1106 goto done;
1107
1108 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1109cont:
1110 idx++;
1111 }
1112 }
1113done:
1114 rcu_read_unlock();
1115 cb->args[0] = idx;
1116 return skb->len;
1117}
1118
1119static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1120 struct sk_buff *skb, const struct nlmsghdr *nlh,
1121 const struct nlattr * const nla[],
1122 struct netlink_ext_ack *extack)
1123{
1124 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1125 u8 genmask = nft_genmask_cur(net);
1126 const struct nft_table *table;
1127 const struct nft_chain *chain;
1128 struct sk_buff *skb2;
1129 int family = nfmsg->nfgen_family;
1130 int err;
1131
1132 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1133 struct netlink_dump_control c = {
1134 .dump = nf_tables_dump_chains,
1135 };
1136 return netlink_dump_start(nlsk, skb, nlh, &c);
1137 }
1138
1139 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
1140 genmask);
1141 if (IS_ERR(table))
1142 return PTR_ERR(table);
1143
1144 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1145 if (IS_ERR(chain))
1146 return PTR_ERR(chain);
1147
1148 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1149 if (!skb2)
1150 return -ENOMEM;
1151
1152 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1153 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1154 family, table, chain);
1155 if (err < 0)
1156 goto err;
1157
1158 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1159
1160err:
1161 kfree_skb(skb2);
1162 return err;
1163}
1164
1165static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1166 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1167 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1168};
1169
1170static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1171{
1172 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1173 struct nft_stats __percpu *newstats;
1174 struct nft_stats *stats;
1175 int err;
1176
1177 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1178 NULL);
1179 if (err < 0)
1180 return ERR_PTR(err);
1181
1182 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1183 return ERR_PTR(-EINVAL);
1184
1185 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1186 if (newstats == NULL)
1187 return ERR_PTR(-ENOMEM);
1188
1189 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1190 * are not exposed to userspace.
1191 */
1192 preempt_disable();
1193 stats = this_cpu_ptr(newstats);
1194 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1195 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1196 preempt_enable();
1197
1198 return newstats;
1199}
1200
1201static void nft_chain_stats_replace(struct nft_base_chain *chain,
1202 struct nft_stats __percpu *newstats)
1203{
1204 struct nft_stats __percpu *oldstats;
1205
1206 if (newstats == NULL)
1207 return;
1208
1209 if (chain->stats) {
1210 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
1211 rcu_assign_pointer(chain->stats, newstats);
1212 synchronize_rcu();
1213 free_percpu(oldstats);
1214 } else
1215 rcu_assign_pointer(chain->stats, newstats);
1216}
1217
1218static void nf_tables_chain_destroy(struct nft_chain *chain)
1219{
1220 BUG_ON(chain->use > 0);
1221
1222 if (nft_is_base_chain(chain)) {
1223 struct nft_base_chain *basechain = nft_base_chain(chain);
1224
1225 module_put(basechain->type->owner);
1226 free_percpu(basechain->stats);
1227 if (basechain->stats)
1228 static_branch_dec(&nft_counters_enabled);
1229 if (basechain->ops.dev != NULL)
1230 dev_put(basechain->ops.dev);
1231 kfree(chain->name);
1232 kfree(basechain);
1233 } else {
1234 kfree(chain->name);
1235 kfree(chain);
1236 }
1237}
1238
1239struct nft_chain_hook {
1240 u32 num;
1241 s32 priority;
1242 const struct nf_chain_type *type;
1243 struct net_device *dev;
1244};
1245
1246static int nft_chain_parse_hook(struct net *net,
1247 const struct nlattr * const nla[],
1248 struct nft_chain_hook *hook, u8 family,
1249 bool create)
1250{
1251 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1252 const struct nf_chain_type *type;
1253 struct net_device *dev;
1254 int err;
1255
1256 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
1257 nft_hook_policy, NULL);
1258 if (err < 0)
1259 return err;
1260
1261 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1262 ha[NFTA_HOOK_PRIORITY] == NULL)
1263 return -EINVAL;
1264
1265 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1266 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1267
1268 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
1269 if (nla[NFTA_CHAIN_TYPE]) {
1270 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
1271 family, create);
1272 if (IS_ERR(type))
1273 return PTR_ERR(type);
1274 }
1275 if (!(type->hook_mask & (1 << hook->num)))
1276 return -EOPNOTSUPP;
1277
1278 if (type->type == NFT_CHAIN_T_NAT &&
1279 hook->priority <= NF_IP_PRI_CONNTRACK)
1280 return -EOPNOTSUPP;
1281
1282 if (!try_module_get(type->owner))
1283 return -ENOENT;
1284
1285 hook->type = type;
1286
1287 hook->dev = NULL;
1288 if (family == NFPROTO_NETDEV) {
1289 char ifname[IFNAMSIZ];
1290
1291 if (!ha[NFTA_HOOK_DEV]) {
1292 module_put(type->owner);
1293 return -EOPNOTSUPP;
1294 }
1295
1296 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1297 dev = dev_get_by_name(net, ifname);
1298 if (!dev) {
1299 module_put(type->owner);
1300 return -ENOENT;
1301 }
1302 hook->dev = dev;
1303 } else if (ha[NFTA_HOOK_DEV]) {
1304 module_put(type->owner);
1305 return -EOPNOTSUPP;
1306 }
1307
1308 return 0;
1309}
1310
1311static void nft_chain_release_hook(struct nft_chain_hook *hook)
1312{
1313 module_put(hook->type->owner);
1314 if (hook->dev != NULL)
1315 dev_put(hook->dev);
1316}
1317
1318static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1319 u8 policy, bool create)
1320{
1321 const struct nlattr * const *nla = ctx->nla;
1322 struct nft_table *table = ctx->table;
1323 struct nft_base_chain *basechain;
1324 struct nft_stats __percpu *stats;
1325 struct net *net = ctx->net;
1326 struct nft_chain *chain;
1327 int err;
1328
1329 if (table->use == UINT_MAX)
1330 return -EOVERFLOW;
1331
1332 if (nla[NFTA_CHAIN_HOOK]) {
1333 struct nft_chain_hook hook;
1334 struct nf_hook_ops *ops;
1335
1336 err = nft_chain_parse_hook(net, nla, &hook, family, create);
1337 if (err < 0)
1338 return err;
1339
1340 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1341 if (basechain == NULL) {
1342 nft_chain_release_hook(&hook);
1343 return -ENOMEM;
1344 }
1345
1346 if (hook.dev != NULL)
1347 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1348
1349 if (nla[NFTA_CHAIN_COUNTERS]) {
1350 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1351 if (IS_ERR(stats)) {
1352 nft_chain_release_hook(&hook);
1353 kfree(basechain);
1354 return PTR_ERR(stats);
1355 }
1356 basechain->stats = stats;
1357 static_branch_inc(&nft_counters_enabled);
1358 }
1359
1360 basechain->type = hook.type;
1361 chain = &basechain->chain;
1362
1363 ops = &basechain->ops;
1364 ops->pf = family;
1365 ops->hooknum = hook.num;
1366 ops->priority = hook.priority;
1367 ops->priv = chain;
1368 ops->hook = hook.type->hooks[ops->hooknum];
1369 ops->dev = hook.dev;
1370
1371 if (basechain->type->type == NFT_CHAIN_T_NAT)
1372 ops->nat_hook = true;
1373
1374 chain->flags |= NFT_BASE_CHAIN;
1375 basechain->policy = policy;
1376 } else {
1377 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1378 if (chain == NULL)
1379 return -ENOMEM;
1380 }
1381 INIT_LIST_HEAD(&chain->rules);
1382 chain->handle = nf_tables_alloc_handle(table);
1383 chain->table = table;
1384 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1385 if (!chain->name) {
1386 err = -ENOMEM;
1387 goto err1;
1388 }
1389
1390 err = nf_tables_register_hook(net, table, chain);
1391 if (err < 0)
1392 goto err1;
1393
1394 ctx->chain = chain;
1395 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1396 if (err < 0)
1397 goto err2;
1398
1399 table->use++;
1400 list_add_tail_rcu(&chain->list, &table->chains);
1401
1402 return 0;
1403err2:
1404 nf_tables_unregister_hook(net, table, chain);
1405err1:
1406 nf_tables_chain_destroy(chain);
1407
1408 return err;
1409}
1410
1411static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1412 bool create)
1413{
1414 const struct nlattr * const *nla = ctx->nla;
1415 struct nft_table *table = ctx->table;
1416 struct nft_chain *chain = ctx->chain;
1417 struct nft_base_chain *basechain;
1418 struct nft_stats *stats = NULL;
1419 struct nft_chain_hook hook;
1420 const struct nlattr *name;
1421 struct nf_hook_ops *ops;
1422 struct nft_trans *trans;
1423 int err;
1424
1425 if (nla[NFTA_CHAIN_HOOK]) {
1426 if (!nft_is_base_chain(chain))
1427 return -EBUSY;
1428
1429 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
1430 create);
1431 if (err < 0)
1432 return err;
1433
1434 basechain = nft_base_chain(chain);
1435 if (basechain->type != hook.type) {
1436 nft_chain_release_hook(&hook);
1437 return -EBUSY;
1438 }
1439
1440 ops = &basechain->ops;
1441 if (ops->hooknum != hook.num ||
1442 ops->priority != hook.priority ||
1443 ops->dev != hook.dev) {
1444 nft_chain_release_hook(&hook);
1445 return -EBUSY;
1446 }
1447 nft_chain_release_hook(&hook);
1448 }
1449
1450 if (nla[NFTA_CHAIN_HANDLE] &&
1451 nla[NFTA_CHAIN_NAME]) {
1452 struct nft_chain *chain2;
1453
1454 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
1455 genmask);
1456 if (!IS_ERR(chain2))
1457 return -EEXIST;
1458 }
1459
1460 if (nla[NFTA_CHAIN_COUNTERS]) {
1461 if (!nft_is_base_chain(chain))
1462 return -EOPNOTSUPP;
1463
1464 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1465 if (IS_ERR(stats))
1466 return PTR_ERR(stats);
1467 }
1468
1469 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1470 sizeof(struct nft_trans_chain));
1471 if (trans == NULL) {
1472 free_percpu(stats);
1473 return -ENOMEM;
1474 }
1475
1476 nft_trans_chain_stats(trans) = stats;
1477 nft_trans_chain_update(trans) = true;
1478
1479 if (nla[NFTA_CHAIN_POLICY])
1480 nft_trans_chain_policy(trans) = policy;
1481 else
1482 nft_trans_chain_policy(trans) = -1;
1483
1484 name = nla[NFTA_CHAIN_NAME];
1485 if (nla[NFTA_CHAIN_HANDLE] && name) {
1486 nft_trans_chain_name(trans) =
1487 nla_strdup(name, GFP_KERNEL);
1488 if (!nft_trans_chain_name(trans)) {
1489 kfree(trans);
1490 free_percpu(stats);
1491 return -ENOMEM;
1492 }
1493 }
1494 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1495
1496 return 0;
1497}
1498
1499static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1500 struct sk_buff *skb, const struct nlmsghdr *nlh,
1501 const struct nlattr * const nla[],
1502 struct netlink_ext_ack *extack)
1503{
1504 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1505 const struct nlattr * uninitialized_var(name);
1506 u8 genmask = nft_genmask_next(net);
1507 int family = nfmsg->nfgen_family;
1508 struct nft_table *table;
1509 struct nft_chain *chain;
1510 u8 policy = NF_ACCEPT;
1511 struct nft_ctx ctx;
1512 u64 handle = 0;
1513 bool create;
1514
1515 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1516
1517 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
1518 genmask);
1519 if (IS_ERR(table))
1520 return PTR_ERR(table);
1521
1522 chain = NULL;
1523 name = nla[NFTA_CHAIN_NAME];
1524
1525 if (nla[NFTA_CHAIN_HANDLE]) {
1526 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1527 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
1528 if (IS_ERR(chain))
1529 return PTR_ERR(chain);
1530 } else {
1531 chain = nf_tables_chain_lookup(table, name, genmask);
1532 if (IS_ERR(chain)) {
1533 if (PTR_ERR(chain) != -ENOENT)
1534 return PTR_ERR(chain);
1535 chain = NULL;
1536 }
1537 }
1538
1539 if (nla[NFTA_CHAIN_POLICY]) {
1540 if (chain != NULL &&
1541 !nft_is_base_chain(chain))
1542 return -EOPNOTSUPP;
1543
1544 if (chain == NULL &&
1545 nla[NFTA_CHAIN_HOOK] == NULL)
1546 return -EOPNOTSUPP;
1547
1548 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
1549 switch (policy) {
1550 case NF_DROP:
1551 case NF_ACCEPT:
1552 break;
1553 default:
1554 return -EINVAL;
1555 }
1556 }
1557
1558 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1559
1560 if (chain != NULL) {
1561 if (nlh->nlmsg_flags & NLM_F_EXCL)
1562 return -EEXIST;
1563 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1564 return -EOPNOTSUPP;
1565
1566 return nf_tables_updchain(&ctx, genmask, policy, create);
1567 }
1568
1569 return nf_tables_addchain(&ctx, family, genmask, policy, create);
1570}
1571
1572static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1573 struct sk_buff *skb, const struct nlmsghdr *nlh,
1574 const struct nlattr * const nla[],
1575 struct netlink_ext_ack *extack)
1576{
1577 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1578 u8 genmask = nft_genmask_next(net);
1579 struct nft_table *table;
1580 struct nft_chain *chain;
1581 struct nft_rule *rule;
1582 int family = nfmsg->nfgen_family;
1583 struct nft_ctx ctx;
1584 u64 handle;
1585 u32 use;
1586 int err;
1587
1588 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
1589 genmask);
1590 if (IS_ERR(table))
1591 return PTR_ERR(table);
1592
1593 if (nla[NFTA_CHAIN_HANDLE]) {
1594 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1595 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
1596 } else {
1597 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1598 }
1599 if (IS_ERR(chain))
1600 return PTR_ERR(chain);
1601
1602 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1603 chain->use > 0)
1604 return -EBUSY;
1605
1606 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1607
1608 use = chain->use;
1609 list_for_each_entry(rule, &chain->rules, list) {
1610 if (!nft_is_active_next(net, rule))
1611 continue;
1612 use--;
1613
1614 err = nft_delrule(&ctx, rule);
1615 if (err < 0)
1616 return err;
1617 }
1618
1619 /* There are rules and elements that are still holding references to us,
1620 * we cannot do a recursive removal in this case.
1621 */
1622 if (use > 0)
1623 return -EBUSY;
1624
1625 return nft_delchain(&ctx);
1626}
1627
1628/*
1629 * Expressions
1630 */
1631
1632/**
1633 * nft_register_expr - register nf_tables expr type
1634 * @ops: expr type
1635 *
1636 * Registers the expr type for use with nf_tables. Returns zero on
1637 * success or a negative errno code otherwise.
1638 */
1639int nft_register_expr(struct nft_expr_type *type)
1640{
1641 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1642 if (type->family == NFPROTO_UNSPEC)
1643 list_add_tail_rcu(&type->list, &nf_tables_expressions);
1644 else
1645 list_add_rcu(&type->list, &nf_tables_expressions);
1646 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1647 return 0;
1648}
1649EXPORT_SYMBOL_GPL(nft_register_expr);
1650
1651/**
1652 * nft_unregister_expr - unregister nf_tables expr type
1653 * @ops: expr type
1654 *
1655 * Unregisters the expr typefor use with nf_tables.
1656 */
1657void nft_unregister_expr(struct nft_expr_type *type)
1658{
1659 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1660 list_del_rcu(&type->list);
1661 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1662}
1663EXPORT_SYMBOL_GPL(nft_unregister_expr);
1664
1665static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1666 struct nlattr *nla)
1667{
1668 const struct nft_expr_type *type;
1669
1670 list_for_each_entry(type, &nf_tables_expressions, list) {
1671 if (!nla_strcmp(nla, type->name) &&
1672 (!type->family || type->family == family))
1673 return type;
1674 }
1675 return NULL;
1676}
1677
1678static const struct nft_expr_type *nft_expr_type_get(u8 family,
1679 struct nlattr *nla)
1680{
1681 const struct nft_expr_type *type;
1682
1683 if (nla == NULL)
1684 return ERR_PTR(-EINVAL);
1685
1686 type = __nft_expr_type_get(family, nla);
1687 if (type != NULL && try_module_get(type->owner))
1688 return type;
1689
1690#ifdef CONFIG_MODULES
1691 if (type == NULL) {
1692 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1693 request_module("nft-expr-%u-%.*s", family,
1694 nla_len(nla), (char *)nla_data(nla));
1695 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1696 if (__nft_expr_type_get(family, nla))
1697 return ERR_PTR(-EAGAIN);
1698
1699 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1700 request_module("nft-expr-%.*s",
1701 nla_len(nla), (char *)nla_data(nla));
1702 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1703 if (__nft_expr_type_get(family, nla))
1704 return ERR_PTR(-EAGAIN);
1705 }
1706#endif
1707 return ERR_PTR(-ENOENT);
1708}
1709
1710static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1711 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1712 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1713};
1714
1715static int nf_tables_fill_expr_info(struct sk_buff *skb,
1716 const struct nft_expr *expr)
1717{
1718 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
1719 goto nla_put_failure;
1720
1721 if (expr->ops->dump) {
1722 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1723 if (data == NULL)
1724 goto nla_put_failure;
1725 if (expr->ops->dump(skb, expr) < 0)
1726 goto nla_put_failure;
1727 nla_nest_end(skb, data);
1728 }
1729
1730 return skb->len;
1731
1732nla_put_failure:
1733 return -1;
1734};
1735
1736int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1737 const struct nft_expr *expr)
1738{
1739 struct nlattr *nest;
1740
1741 nest = nla_nest_start(skb, attr);
1742 if (!nest)
1743 goto nla_put_failure;
1744 if (nf_tables_fill_expr_info(skb, expr) < 0)
1745 goto nla_put_failure;
1746 nla_nest_end(skb, nest);
1747 return 0;
1748
1749nla_put_failure:
1750 return -1;
1751}
1752
1753struct nft_expr_info {
1754 const struct nft_expr_ops *ops;
1755 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
1756};
1757
1758static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1759 const struct nlattr *nla,
1760 struct nft_expr_info *info)
1761{
1762 const struct nft_expr_type *type;
1763 const struct nft_expr_ops *ops;
1764 struct nlattr *tb[NFTA_EXPR_MAX + 1];
1765 int err;
1766
1767 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
1768 if (err < 0)
1769 return err;
1770
1771 type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
1772 if (IS_ERR(type))
1773 return PTR_ERR(type);
1774
1775 if (tb[NFTA_EXPR_DATA]) {
1776 err = nla_parse_nested(info->tb, type->maxattr,
1777 tb[NFTA_EXPR_DATA], type->policy, NULL);
1778 if (err < 0)
1779 goto err1;
1780 } else
1781 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1782
1783 if (type->select_ops != NULL) {
1784 ops = type->select_ops(ctx,
1785 (const struct nlattr * const *)info->tb);
1786 if (IS_ERR(ops)) {
1787 err = PTR_ERR(ops);
1788 goto err1;
1789 }
1790 } else
1791 ops = type->ops;
1792
1793 info->ops = ops;
1794 return 0;
1795
1796err1:
1797 module_put(type->owner);
1798 return err;
1799}
1800
1801static int nf_tables_newexpr(const struct nft_ctx *ctx,
1802 const struct nft_expr_info *info,
1803 struct nft_expr *expr)
1804{
1805 const struct nft_expr_ops *ops = info->ops;
1806 int err;
1807
1808 expr->ops = ops;
1809 if (ops->init) {
1810 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
1811 if (err < 0)
1812 goto err1;
1813 }
1814
1815 if (ops->validate) {
1816 const struct nft_data *data = NULL;
1817
1818 err = ops->validate(ctx, expr, &data);
1819 if (err < 0)
1820 goto err2;
1821 }
1822
1823 return 0;
1824
1825err2:
1826 if (ops->destroy)
1827 ops->destroy(ctx, expr);
1828err1:
1829 expr->ops = NULL;
1830 return err;
1831}
1832
1833static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1834 struct nft_expr *expr)
1835{
1836 if (expr->ops->destroy)
1837 expr->ops->destroy(ctx, expr);
1838 module_put(expr->ops->type->owner);
1839}
1840
1841struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1842 const struct nlattr *nla)
1843{
1844 struct nft_expr_info info;
1845 struct nft_expr *expr;
1846 int err;
1847
1848 err = nf_tables_expr_parse(ctx, nla, &info);
1849 if (err < 0)
1850 goto err1;
1851
1852 err = -ENOMEM;
1853 expr = kzalloc(info.ops->size, GFP_KERNEL);
1854 if (expr == NULL)
1855 goto err2;
1856
1857 err = nf_tables_newexpr(ctx, &info, expr);
1858 if (err < 0)
1859 goto err3;
1860
1861 return expr;
1862err3:
1863 kfree(expr);
1864err2:
1865 module_put(info.ops->type->owner);
1866err1:
1867 return ERR_PTR(err);
1868}
1869
1870void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1871{
1872 nf_tables_expr_destroy(ctx, expr);
1873 kfree(expr);
1874}
1875
1876/*
1877 * Rules
1878 */
1879
1880static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1881 u64 handle)
1882{
1883 struct nft_rule *rule;
1884
1885 // FIXME: this sucks
1886 list_for_each_entry(rule, &chain->rules, list) {
1887 if (handle == rule->handle)
1888 return rule;
1889 }
1890
1891 return ERR_PTR(-ENOENT);
1892}
1893
1894static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1895 const struct nlattr *nla)
1896{
1897 if (nla == NULL)
1898 return ERR_PTR(-EINVAL);
1899
1900 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1901}
1902
1903static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
1904 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1905 .len = NFT_TABLE_MAXNAMELEN - 1 },
1906 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1907 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1908 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1909 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
1910 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
1911 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
1912 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1913 .len = NFT_USERDATA_MAXLEN },
1914};
1915
1916static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1917 u32 portid, u32 seq, int event,
1918 u32 flags, int family,
1919 const struct nft_table *table,
1920 const struct nft_chain *chain,
1921 const struct nft_rule *rule)
1922{
1923 struct nlmsghdr *nlh;
1924 struct nfgenmsg *nfmsg;
1925 const struct nft_expr *expr, *next;
1926 struct nlattr *list;
1927 const struct nft_rule *prule;
1928 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1929
1930 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
1931 if (nlh == NULL)
1932 goto nla_put_failure;
1933
1934 nfmsg = nlmsg_data(nlh);
1935 nfmsg->nfgen_family = family;
1936 nfmsg->version = NFNETLINK_V0;
1937 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
1938
1939 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1940 goto nla_put_failure;
1941 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1942 goto nla_put_failure;
1943 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
1944 NFTA_RULE_PAD))
1945 goto nla_put_failure;
1946
1947 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
1948 prule = list_prev_entry(rule, list);
1949 if (nla_put_be64(skb, NFTA_RULE_POSITION,
1950 cpu_to_be64(prule->handle),
1951 NFTA_RULE_PAD))
1952 goto nla_put_failure;
1953 }
1954
1955 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1956 if (list == NULL)
1957 goto nla_put_failure;
1958 nft_rule_for_each_expr(expr, next, rule) {
1959 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
1960 goto nla_put_failure;
1961 }
1962 nla_nest_end(skb, list);
1963
1964 if (rule->udata) {
1965 struct nft_userdata *udata = nft_userdata(rule);
1966 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
1967 udata->data) < 0)
1968 goto nla_put_failure;
1969 }
1970
1971 nlmsg_end(skb, nlh);
1972 return 0;
1973
1974nla_put_failure:
1975 nlmsg_trim(skb, nlh);
1976 return -1;
1977}
1978
1979static void nf_tables_rule_notify(const struct nft_ctx *ctx,
1980 const struct nft_rule *rule, int event)
1981{
1982 struct sk_buff *skb;
1983 int err;
1984
1985 if (!ctx->report &&
1986 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1987 return;
1988
1989 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1990 if (skb == NULL)
1991 goto err;
1992
1993 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
1994 event, 0, ctx->family, ctx->table,
1995 ctx->chain, rule);
1996 if (err < 0) {
1997 kfree_skb(skb);
1998 goto err;
1999 }
2000
2001 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2002 ctx->report, GFP_KERNEL);
2003 return;
2004err:
2005 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2006}
2007
2008struct nft_rule_dump_ctx {
2009 char *table;
2010 char *chain;
2011};
2012
2013static int nf_tables_dump_rules(struct sk_buff *skb,
2014 struct netlink_callback *cb)
2015{
2016 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2017 const struct nft_rule_dump_ctx *ctx = cb->data;
2018 const struct nft_table *table;
2019 const struct nft_chain *chain;
2020 const struct nft_rule *rule;
2021 unsigned int idx = 0, s_idx = cb->args[0];
2022 struct net *net = sock_net(skb->sk);
2023 int family = nfmsg->nfgen_family;
2024
2025 rcu_read_lock();
2026 cb->seq = net->nft.base_seq;
2027
2028 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2029 if (family != NFPROTO_UNSPEC && family != table->family)
2030 continue;
2031
2032 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
2033 continue;
2034
2035 list_for_each_entry_rcu(chain, &table->chains, list) {
2036 if (ctx && ctx->chain &&
2037 strcmp(ctx->chain, chain->name) != 0)
2038 continue;
2039
2040 list_for_each_entry_rcu(rule, &chain->rules, list) {
2041 if (!nft_is_active(net, rule))
2042 goto cont;
2043 if (idx < s_idx)
2044 goto cont;
2045 if (idx > s_idx)
2046 memset(&cb->args[1], 0,
2047 sizeof(cb->args) - sizeof(cb->args[0]));
2048 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2049 cb->nlh->nlmsg_seq,
2050 NFT_MSG_NEWRULE,
2051 NLM_F_MULTI | NLM_F_APPEND,
2052 table->family,
2053 table, chain, rule) < 0)
2054 goto done;
2055
2056 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2057cont:
2058 idx++;
2059 }
2060 }
2061 }
2062done:
2063 rcu_read_unlock();
2064
2065 cb->args[0] = idx;
2066 return skb->len;
2067}
2068
2069static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2070{
2071 struct nft_rule_dump_ctx *ctx = cb->data;
2072
2073 if (ctx) {
2074 kfree(ctx->table);
2075 kfree(ctx->chain);
2076 kfree(ctx);
2077 }
2078 return 0;
2079}
2080
2081static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2082 struct sk_buff *skb, const struct nlmsghdr *nlh,
2083 const struct nlattr * const nla[],
2084 struct netlink_ext_ack *extack)
2085{
2086 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2087 u8 genmask = nft_genmask_cur(net);
2088 const struct nft_table *table;
2089 const struct nft_chain *chain;
2090 const struct nft_rule *rule;
2091 struct sk_buff *skb2;
2092 int family = nfmsg->nfgen_family;
2093 int err;
2094
2095 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2096 struct netlink_dump_control c = {
2097 .dump = nf_tables_dump_rules,
2098 .done = nf_tables_dump_rules_done,
2099 };
2100
2101 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2102 struct nft_rule_dump_ctx *ctx;
2103
2104 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2105 if (!ctx)
2106 return -ENOMEM;
2107
2108 if (nla[NFTA_RULE_TABLE]) {
2109 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2110 GFP_KERNEL);
2111 if (!ctx->table) {
2112 kfree(ctx);
2113 return -ENOMEM;
2114 }
2115 }
2116 if (nla[NFTA_RULE_CHAIN]) {
2117 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2118 GFP_KERNEL);
2119 if (!ctx->chain) {
2120 kfree(ctx->table);
2121 kfree(ctx);
2122 return -ENOMEM;
2123 }
2124 }
2125 c.data = ctx;
2126 }
2127
2128 return netlink_dump_start(nlsk, skb, nlh, &c);
2129 }
2130
2131 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
2132 genmask);
2133 if (IS_ERR(table))
2134 return PTR_ERR(table);
2135
2136 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2137 if (IS_ERR(chain))
2138 return PTR_ERR(chain);
2139
2140 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2141 if (IS_ERR(rule))
2142 return PTR_ERR(rule);
2143
2144 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2145 if (!skb2)
2146 return -ENOMEM;
2147
2148 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
2149 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2150 family, table, chain, rule);
2151 if (err < 0)
2152 goto err;
2153
2154 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2155
2156err:
2157 kfree_skb(skb2);
2158 return err;
2159}
2160
2161static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2162 struct nft_rule *rule)
2163{
2164 struct nft_expr *expr;
2165
2166 /*
2167 * Careful: some expressions might not be initialized in case this
2168 * is called on error from nf_tables_newrule().
2169 */
2170 expr = nft_expr_first(rule);
2171 while (expr != nft_expr_last(rule) && expr->ops) {
2172 nf_tables_expr_destroy(ctx, expr);
2173 expr = nft_expr_next(expr);
2174 }
2175 kfree(rule);
2176}
2177
2178#define NFT_RULE_MAXEXPRS 128
2179
2180static struct nft_expr_info *info;
2181
2182static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2183 struct sk_buff *skb, const struct nlmsghdr *nlh,
2184 const struct nlattr * const nla[],
2185 struct netlink_ext_ack *extack)
2186{
2187 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2188 u8 genmask = nft_genmask_next(net);
2189 int family = nfmsg->nfgen_family;
2190 struct nft_table *table;
2191 struct nft_chain *chain;
2192 struct nft_rule *rule, *old_rule = NULL;
2193 struct nft_userdata *udata;
2194 struct nft_trans *trans = NULL;
2195 struct nft_expr *expr;
2196 struct nft_ctx ctx;
2197 struct nlattr *tmp;
2198 unsigned int size, i, n, ulen = 0, usize = 0;
2199 int err, rem;
2200 bool create;
2201 u64 handle, pos_handle;
2202
2203 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2204
2205 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
2206 genmask);
2207 if (IS_ERR(table))
2208 return PTR_ERR(table);
2209
2210 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2211 if (IS_ERR(chain))
2212 return PTR_ERR(chain);
2213
2214 if (nla[NFTA_RULE_HANDLE]) {
2215 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2216 rule = __nf_tables_rule_lookup(chain, handle);
2217 if (IS_ERR(rule))
2218 return PTR_ERR(rule);
2219
2220 if (nlh->nlmsg_flags & NLM_F_EXCL)
2221 return -EEXIST;
2222 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2223 old_rule = rule;
2224 else
2225 return -EOPNOTSUPP;
2226 } else {
2227 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2228 return -EINVAL;
2229 handle = nf_tables_alloc_handle(table);
2230
2231 if (chain->use == UINT_MAX)
2232 return -EOVERFLOW;
2233 }
2234
2235 if (nla[NFTA_RULE_POSITION]) {
2236 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2237 return -EOPNOTSUPP;
2238
2239 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2240 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
2241 if (IS_ERR(old_rule))
2242 return PTR_ERR(old_rule);
2243 }
2244
2245 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2246
2247 n = 0;
2248 size = 0;
2249 if (nla[NFTA_RULE_EXPRESSIONS]) {
2250 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2251 err = -EINVAL;
2252 if (nla_type(tmp) != NFTA_LIST_ELEM)
2253 goto err1;
2254 if (n == NFT_RULE_MAXEXPRS)
2255 goto err1;
2256 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
2257 if (err < 0)
2258 goto err1;
2259 size += info[n].ops->size;
2260 n++;
2261 }
2262 }
2263 /* Check for overflow of dlen field */
2264 err = -EFBIG;
2265 if (size >= 1 << 12)
2266 goto err1;
2267
2268 if (nla[NFTA_RULE_USERDATA]) {
2269 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
2270 if (ulen > 0)
2271 usize = sizeof(struct nft_userdata) + ulen;
2272 }
2273
2274 err = -ENOMEM;
2275 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
2276 if (rule == NULL)
2277 goto err1;
2278
2279 nft_activate_next(net, rule);
2280
2281 rule->handle = handle;
2282 rule->dlen = size;
2283 rule->udata = ulen ? 1 : 0;
2284
2285 if (ulen) {
2286 udata = nft_userdata(rule);
2287 udata->len = ulen - 1;
2288 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2289 }
2290
2291 expr = nft_expr_first(rule);
2292 for (i = 0; i < n; i++) {
2293 err = nf_tables_newexpr(&ctx, &info[i], expr);
2294 if (err < 0)
2295 goto err2;
2296 info[i].ops = NULL;
2297 expr = nft_expr_next(expr);
2298 }
2299
2300 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
2301 if (nft_is_active_next(net, old_rule)) {
2302 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
2303 old_rule);
2304 if (trans == NULL) {
2305 err = -ENOMEM;
2306 goto err2;
2307 }
2308 nft_deactivate_next(net, old_rule);
2309 chain->use--;
2310 list_add_tail_rcu(&rule->list, &old_rule->list);
2311 } else {
2312 err = -ENOENT;
2313 goto err2;
2314 }
2315 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
2316 if (old_rule)
2317 list_add_rcu(&rule->list, &old_rule->list);
2318 else
2319 list_add_tail_rcu(&rule->list, &chain->rules);
2320 else {
2321 if (old_rule)
2322 list_add_tail_rcu(&rule->list, &old_rule->list);
2323 else
2324 list_add_rcu(&rule->list, &chain->rules);
2325 }
2326
2327 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2328 err = -ENOMEM;
2329 goto err3;
2330 }
2331 chain->use++;
2332 return 0;
2333
2334err3:
2335 list_del_rcu(&rule->list);
2336err2:
2337 nf_tables_rule_destroy(&ctx, rule);
2338err1:
2339 for (i = 0; i < n; i++) {
2340 if (info[i].ops != NULL)
2341 module_put(info[i].ops->type->owner);
2342 }
2343 return err;
2344}
2345
2346static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2347 const struct nlattr *nla)
2348{
2349 u32 id = ntohl(nla_get_be32(nla));
2350 struct nft_trans *trans;
2351
2352 list_for_each_entry(trans, &net->nft.commit_list, list) {
2353 struct nft_rule *rule = nft_trans_rule(trans);
2354
2355 if (trans->msg_type == NFT_MSG_NEWRULE &&
2356 id == nft_trans_rule_id(trans))
2357 return rule;
2358 }
2359 return ERR_PTR(-ENOENT);
2360}
2361
2362static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2363 struct sk_buff *skb, const struct nlmsghdr *nlh,
2364 const struct nlattr * const nla[],
2365 struct netlink_ext_ack *extack)
2366{
2367 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2368 u8 genmask = nft_genmask_next(net);
2369 struct nft_table *table;
2370 struct nft_chain *chain = NULL;
2371 struct nft_rule *rule;
2372 int family = nfmsg->nfgen_family, err = 0;
2373 struct nft_ctx ctx;
2374
2375 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
2376 genmask);
2377 if (IS_ERR(table))
2378 return PTR_ERR(table);
2379
2380 if (nla[NFTA_RULE_CHAIN]) {
2381 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN],
2382 genmask);
2383 if (IS_ERR(chain))
2384 return PTR_ERR(chain);
2385 }
2386
2387 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2388
2389 if (chain) {
2390 if (nla[NFTA_RULE_HANDLE]) {
2391 rule = nf_tables_rule_lookup(chain,
2392 nla[NFTA_RULE_HANDLE]);
2393 if (IS_ERR(rule))
2394 return PTR_ERR(rule);
2395
2396 err = nft_delrule(&ctx, rule);
2397 } else if (nla[NFTA_RULE_ID]) {
2398 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2399 if (IS_ERR(rule))
2400 return PTR_ERR(rule);
2401
2402 err = nft_delrule(&ctx, rule);
2403 } else {
2404 err = nft_delrule_by_chain(&ctx);
2405 }
2406 } else {
2407 list_for_each_entry(chain, &table->chains, list) {
2408 if (!nft_is_active_next(net, chain))
2409 continue;
2410
2411 ctx.chain = chain;
2412 err = nft_delrule_by_chain(&ctx);
2413 if (err < 0)
2414 break;
2415 }
2416 }
2417
2418 return err;
2419}
2420
2421/*
2422 * Sets
2423 */
2424
2425static LIST_HEAD(nf_tables_set_types);
2426
2427int nft_register_set(struct nft_set_type *type)
2428{
2429 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2430 list_add_tail_rcu(&type->list, &nf_tables_set_types);
2431 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2432 return 0;
2433}
2434EXPORT_SYMBOL_GPL(nft_register_set);
2435
2436void nft_unregister_set(struct nft_set_type *type)
2437{
2438 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2439 list_del_rcu(&type->list);
2440 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2441}
2442EXPORT_SYMBOL_GPL(nft_unregister_set);
2443
2444#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2445 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
2446
2447static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
2448{
2449 return (flags & ops->features) == (flags & NFT_SET_FEATURES);
2450}
2451
2452/*
2453 * Select a set implementation based on the data characteristics and the
2454 * given policy. The total memory use might not be known if no size is
2455 * given, in that case the amount of memory per element is used.
2456 */
2457static const struct nft_set_ops *
2458nft_select_set_ops(const struct nft_ctx *ctx,
2459 const struct nlattr * const nla[],
2460 const struct nft_set_desc *desc,
2461 enum nft_set_policies policy)
2462{
2463 const struct nft_set_ops *ops, *bops;
2464 struct nft_set_estimate est, best;
2465 const struct nft_set_type *type;
2466 u32 flags = 0;
2467
2468#ifdef CONFIG_MODULES
2469 if (list_empty(&nf_tables_set_types)) {
2470 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2471 request_module("nft-set");
2472 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2473 if (!list_empty(&nf_tables_set_types))
2474 return ERR_PTR(-EAGAIN);
2475 }
2476#endif
2477 if (nla[NFTA_SET_FLAGS] != NULL)
2478 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2479
2480 bops = NULL;
2481 best.size = ~0;
2482 best.lookup = ~0;
2483 best.space = ~0;
2484
2485 list_for_each_entry(type, &nf_tables_set_types, list) {
2486 if (!type->select_ops)
2487 ops = type->ops;
2488 else
2489 ops = type->select_ops(ctx, desc, flags);
2490 if (!ops)
2491 continue;
2492
2493 if (!nft_set_ops_candidate(ops, flags))
2494 continue;
2495 if (!ops->estimate(desc, flags, &est))
2496 continue;
2497
2498 switch (policy) {
2499 case NFT_SET_POL_PERFORMANCE:
2500 if (est.lookup < best.lookup)
2501 break;
2502 if (est.lookup == best.lookup &&
2503 est.space < best.space)
2504 break;
2505 continue;
2506 case NFT_SET_POL_MEMORY:
2507 if (!desc->size) {
2508 if (est.space < best.space)
2509 break;
2510 if (est.space == best.space &&
2511 est.lookup < best.lookup)
2512 break;
2513 } else if (est.size < best.size) {
2514 break;
2515 }
2516 continue;
2517 default:
2518 break;
2519 }
2520
2521 if (!try_module_get(type->owner))
2522 continue;
2523 if (bops != NULL)
2524 module_put(bops->type->owner);
2525
2526 bops = ops;
2527 best = est;
2528 }
2529
2530 if (bops != NULL)
2531 return bops;
2532
2533 return ERR_PTR(-EOPNOTSUPP);
2534}
2535
2536static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
2537 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2538 .len = NFT_TABLE_MAXNAMELEN - 1 },
2539 [NFTA_SET_NAME] = { .type = NLA_STRING,
2540 .len = NFT_SET_MAXNAMELEN - 1 },
2541 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2542 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2543 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2544 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2545 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
2546 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2547 [NFTA_SET_DESC] = { .type = NLA_NESTED },
2548 [NFTA_SET_ID] = { .type = NLA_U32 },
2549 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2550 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
2551 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2552 .len = NFT_USERDATA_MAXLEN },
2553 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
2554 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
2555};
2556
2557static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2558 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
2559};
2560
2561static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
2562 const struct sk_buff *skb,
2563 const struct nlmsghdr *nlh,
2564 const struct nlattr * const nla[],
2565 u8 genmask)
2566{
2567 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2568 int family = nfmsg->nfgen_family;
2569 struct nft_table *table = NULL;
2570
2571 if (nla[NFTA_SET_TABLE] != NULL) {
2572 table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
2573 family, genmask);
2574 if (IS_ERR(table))
2575 return PTR_ERR(table);
2576 }
2577
2578 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
2579 return 0;
2580}
2581
2582static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2583 const struct nlattr *nla, u8 genmask)
2584{
2585 struct nft_set *set;
2586
2587 if (nla == NULL)
2588 return ERR_PTR(-EINVAL);
2589
2590 list_for_each_entry(set, &table->sets, list) {
2591 if (!nla_strcmp(nla, set->name) &&
2592 nft_active_genmask(set, genmask))
2593 return set;
2594 }
2595 return ERR_PTR(-ENOENT);
2596}
2597
2598static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *table,
2599 const struct nlattr *nla, u8 genmask)
2600{
2601 struct nft_set *set;
2602
2603 if (nla == NULL)
2604 return ERR_PTR(-EINVAL);
2605
2606 list_for_each_entry(set, &table->sets, list) {
2607 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2608 nft_active_genmask(set, genmask))
2609 return set;
2610 }
2611 return ERR_PTR(-ENOENT);
2612}
2613
2614static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2615 const struct nlattr *nla,
2616 u8 genmask)
2617{
2618 struct nft_trans *trans;
2619 u32 id = ntohl(nla_get_be32(nla));
2620
2621 list_for_each_entry(trans, &net->nft.commit_list, list) {
2622 struct nft_set *set = nft_trans_set(trans);
2623
2624 if (trans->msg_type == NFT_MSG_NEWSET &&
2625 id == nft_trans_set_id(trans) &&
2626 nft_active_genmask(set, genmask))
2627 return set;
2628 }
2629 return ERR_PTR(-ENOENT);
2630}
2631
2632struct nft_set *nft_set_lookup(const struct net *net,
2633 const struct nft_table *table,
2634 const struct nlattr *nla_set_name,
2635 const struct nlattr *nla_set_id,
2636 u8 genmask)
2637{
2638 struct nft_set *set;
2639
2640 set = nf_tables_set_lookup(table, nla_set_name, genmask);
2641 if (IS_ERR(set)) {
2642 if (!nla_set_id)
2643 return set;
2644
2645 set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
2646 }
2647 return set;
2648}
2649EXPORT_SYMBOL_GPL(nft_set_lookup);
2650
2651static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2652 const char *name)
2653{
2654 const struct nft_set *i;
2655 const char *p;
2656 unsigned long *inuse;
2657 unsigned int n = 0, min = 0;
2658
2659 p = strchr(name, '%');
2660 if (p != NULL) {
2661 if (p[1] != 'd' || strchr(p + 2, '%'))
2662 return -EINVAL;
2663
2664 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2665 if (inuse == NULL)
2666 return -ENOMEM;
2667cont:
2668 list_for_each_entry(i, &ctx->table->sets, list) {
2669 int tmp;
2670
2671 if (!nft_is_active_next(ctx->net, set))
2672 continue;
2673 if (!sscanf(i->name, name, &tmp))
2674 continue;
2675 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
2676 continue;
2677
2678 set_bit(tmp - min, inuse);
2679 }
2680
2681 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
2682 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2683 min += BITS_PER_BYTE * PAGE_SIZE;
2684 memset(inuse, 0, PAGE_SIZE);
2685 goto cont;
2686 }
2687 free_page((unsigned long)inuse);
2688 }
2689
2690 set->name = kasprintf(GFP_KERNEL, name, min + n);
2691 if (!set->name)
2692 return -ENOMEM;
2693
2694 list_for_each_entry(i, &ctx->table->sets, list) {
2695 if (!nft_is_active_next(ctx->net, i))
2696 continue;
2697 if (!strcmp(set->name, i->name)) {
2698 kfree(set->name);
2699 return -ENFILE;
2700 }
2701 }
2702 return 0;
2703}
2704
2705static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2706 const struct nft_set *set, u16 event, u16 flags)
2707{
2708 struct nfgenmsg *nfmsg;
2709 struct nlmsghdr *nlh;
2710 struct nlattr *desc;
2711 u32 portid = ctx->portid;
2712 u32 seq = ctx->seq;
2713
2714 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2715 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2716 flags);
2717 if (nlh == NULL)
2718 goto nla_put_failure;
2719
2720 nfmsg = nlmsg_data(nlh);
2721 nfmsg->nfgen_family = ctx->family;
2722 nfmsg->version = NFNETLINK_V0;
2723 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
2724
2725 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2726 goto nla_put_failure;
2727 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2728 goto nla_put_failure;
2729 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
2730 NFTA_SET_PAD))
2731 goto nla_put_failure;
2732 if (set->flags != 0)
2733 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2734 goto nla_put_failure;
2735
2736 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2737 goto nla_put_failure;
2738 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2739 goto nla_put_failure;
2740 if (set->flags & NFT_SET_MAP) {
2741 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2742 goto nla_put_failure;
2743 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2744 goto nla_put_failure;
2745 }
2746 if (set->flags & NFT_SET_OBJECT &&
2747 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2748 goto nla_put_failure;
2749
2750 if (set->timeout &&
2751 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2752 cpu_to_be64(jiffies_to_msecs(set->timeout)),
2753 NFTA_SET_PAD))
2754 goto nla_put_failure;
2755 if (set->gc_int &&
2756 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2757 goto nla_put_failure;
2758
2759 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2760 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2761 goto nla_put_failure;
2762 }
2763
2764 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2765 goto nla_put_failure;
2766
2767 desc = nla_nest_start(skb, NFTA_SET_DESC);
2768 if (desc == NULL)
2769 goto nla_put_failure;
2770 if (set->size &&
2771 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2772 goto nla_put_failure;
2773 nla_nest_end(skb, desc);
2774
2775 nlmsg_end(skb, nlh);
2776 return 0;
2777
2778nla_put_failure:
2779 nlmsg_trim(skb, nlh);
2780 return -1;
2781}
2782
2783static void nf_tables_set_notify(const struct nft_ctx *ctx,
2784 const struct nft_set *set, int event,
2785 gfp_t gfp_flags)
2786{
2787 struct sk_buff *skb;
2788 u32 portid = ctx->portid;
2789 int err;
2790
2791 if (!ctx->report &&
2792 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2793 return;
2794
2795 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
2796 if (skb == NULL)
2797 goto err;
2798
2799 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2800 if (err < 0) {
2801 kfree_skb(skb);
2802 goto err;
2803 }
2804
2805 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2806 gfp_flags);
2807 return;
2808err:
2809 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
2810}
2811
2812static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
2813{
2814 const struct nft_set *set;
2815 unsigned int idx, s_idx = cb->args[0];
2816 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2817 struct net *net = sock_net(skb->sk);
2818 struct nft_ctx *ctx = cb->data, ctx_set;
2819
2820 if (cb->args[1])
2821 return skb->len;
2822
2823 rcu_read_lock();
2824 cb->seq = net->nft.base_seq;
2825
2826 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2827 if (ctx->family != NFPROTO_UNSPEC &&
2828 ctx->family != table->family)
2829 continue;
2830
2831 if (ctx->table && ctx->table != table)
2832 continue;
2833
2834 if (cur_table) {
2835 if (cur_table != table)
2836 continue;
2837
2838 cur_table = NULL;
2839 }
2840 idx = 0;
2841 list_for_each_entry_rcu(set, &table->sets, list) {
2842 if (idx < s_idx)
2843 goto cont;
2844 if (!nft_is_active(net, set))
2845 goto cont;
2846
2847 ctx_set = *ctx;
2848 ctx_set.table = table;
2849 ctx_set.family = table->family;
2850
2851 if (nf_tables_fill_set(skb, &ctx_set, set,
2852 NFT_MSG_NEWSET,
2853 NLM_F_MULTI) < 0) {
2854 cb->args[0] = idx;
2855 cb->args[2] = (unsigned long) table;
2856 goto done;
2857 }
2858 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2859cont:
2860 idx++;
2861 }
2862 if (s_idx)
2863 s_idx = 0;
2864 }
2865 cb->args[1] = 1;
2866done:
2867 rcu_read_unlock();
2868 return skb->len;
2869}
2870
2871static int nf_tables_dump_sets_done(struct netlink_callback *cb)
2872{
2873 kfree(cb->data);
2874 return 0;
2875}
2876
2877static int nf_tables_getset(struct net *net, struct sock *nlsk,
2878 struct sk_buff *skb, const struct nlmsghdr *nlh,
2879 const struct nlattr * const nla[],
2880 struct netlink_ext_ack *extack)
2881{
2882 u8 genmask = nft_genmask_cur(net);
2883 const struct nft_set *set;
2884 struct nft_ctx ctx;
2885 struct sk_buff *skb2;
2886 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2887 int err;
2888
2889 /* Verify existence before starting dump */
2890 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
2891 if (err < 0)
2892 return err;
2893
2894 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2895 struct netlink_dump_control c = {
2896 .dump = nf_tables_dump_sets,
2897 .done = nf_tables_dump_sets_done,
2898 };
2899 struct nft_ctx *ctx_dump;
2900
2901 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2902 if (ctx_dump == NULL)
2903 return -ENOMEM;
2904
2905 *ctx_dump = ctx;
2906 c.data = ctx_dump;
2907
2908 return netlink_dump_start(nlsk, skb, nlh, &c);
2909 }
2910
2911 /* Only accept unspec with dump */
2912 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2913 return -EAFNOSUPPORT;
2914 if (!nla[NFTA_SET_TABLE])
2915 return -EINVAL;
2916
2917 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
2918 if (IS_ERR(set))
2919 return PTR_ERR(set);
2920
2921 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2922 if (skb2 == NULL)
2923 return -ENOMEM;
2924
2925 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2926 if (err < 0)
2927 goto err;
2928
2929 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2930
2931err:
2932 kfree_skb(skb2);
2933 return err;
2934}
2935
2936static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2937 struct nft_set_desc *desc,
2938 const struct nlattr *nla)
2939{
2940 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2941 int err;
2942
2943 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
2944 nft_set_desc_policy, NULL);
2945 if (err < 0)
2946 return err;
2947
2948 if (da[NFTA_SET_DESC_SIZE] != NULL)
2949 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
2950
2951 return 0;
2952}
2953
2954static int nf_tables_newset(struct net *net, struct sock *nlsk,
2955 struct sk_buff *skb, const struct nlmsghdr *nlh,
2956 const struct nlattr * const nla[],
2957 struct netlink_ext_ack *extack)
2958{
2959 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2960 u8 genmask = nft_genmask_next(net);
2961 int family = nfmsg->nfgen_family;
2962 const struct nft_set_ops *ops;
2963 struct nft_table *table;
2964 struct nft_set *set;
2965 struct nft_ctx ctx;
2966 char *name;
2967 unsigned int size;
2968 bool create;
2969 u64 timeout;
2970 u32 ktype, dtype, flags, policy, gc_int, objtype;
2971 struct nft_set_desc desc;
2972 unsigned char *udata;
2973 u16 udlen;
2974 int err;
2975
2976 if (nla[NFTA_SET_TABLE] == NULL ||
2977 nla[NFTA_SET_NAME] == NULL ||
2978 nla[NFTA_SET_KEY_LEN] == NULL ||
2979 nla[NFTA_SET_ID] == NULL)
2980 return -EINVAL;
2981
2982 memset(&desc, 0, sizeof(desc));
2983
2984 ktype = NFT_DATA_VALUE;
2985 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
2986 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
2987 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
2988 return -EINVAL;
2989 }
2990
2991 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
2992 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
2993 return -EINVAL;
2994
2995 flags = 0;
2996 if (nla[NFTA_SET_FLAGS] != NULL) {
2997 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2998 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
2999 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
3000 NFT_SET_MAP | NFT_SET_EVAL |
3001 NFT_SET_OBJECT))
3002 return -EINVAL;
3003 /* Only one of these operations is supported */
3004 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3005 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
3006 return -EOPNOTSUPP;
3007 }
3008
3009 dtype = 0;
3010 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3011 if (!(flags & NFT_SET_MAP))
3012 return -EINVAL;
3013
3014 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3015 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3016 dtype != NFT_DATA_VERDICT)
3017 return -EINVAL;
3018
3019 if (dtype != NFT_DATA_VERDICT) {
3020 if (nla[NFTA_SET_DATA_LEN] == NULL)
3021 return -EINVAL;
3022 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
3023 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
3024 return -EINVAL;
3025 } else
3026 desc.dlen = sizeof(struct nft_verdict);
3027 } else if (flags & NFT_SET_MAP)
3028 return -EINVAL;
3029
3030 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3031 if (!(flags & NFT_SET_OBJECT))
3032 return -EINVAL;
3033
3034 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3035 if (objtype == NFT_OBJECT_UNSPEC ||
3036 objtype > NFT_OBJECT_MAX)
3037 return -EINVAL;
3038 } else if (flags & NFT_SET_OBJECT)
3039 return -EINVAL;
3040 else
3041 objtype = NFT_OBJECT_UNSPEC;
3042
3043 timeout = 0;
3044 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3045 if (!(flags & NFT_SET_TIMEOUT))
3046 return -EINVAL;
3047 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3048 nla[NFTA_SET_TIMEOUT])));
3049 }
3050 gc_int = 0;
3051 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3052 if (!(flags & NFT_SET_TIMEOUT))
3053 return -EINVAL;
3054 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3055 }
3056
3057 policy = NFT_SET_POL_PERFORMANCE;
3058 if (nla[NFTA_SET_POLICY] != NULL)
3059 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3060
3061 if (nla[NFTA_SET_DESC] != NULL) {
3062 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3063 if (err < 0)
3064 return err;
3065 }
3066
3067 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3068
3069 table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], family,
3070 genmask);
3071 if (IS_ERR(table))
3072 return PTR_ERR(table);
3073
3074 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3075
3076 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
3077 if (IS_ERR(set)) {
3078 if (PTR_ERR(set) != -ENOENT)
3079 return PTR_ERR(set);
3080 } else {
3081 if (nlh->nlmsg_flags & NLM_F_EXCL)
3082 return -EEXIST;
3083 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3084 return -EOPNOTSUPP;
3085 return 0;
3086 }
3087
3088 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3089 return -ENOENT;
3090
3091 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
3092 if (IS_ERR(ops))
3093 return PTR_ERR(ops);
3094
3095 udlen = 0;
3096 if (nla[NFTA_SET_USERDATA])
3097 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3098
3099 size = 0;
3100 if (ops->privsize != NULL)
3101 size = ops->privsize(nla, &desc);
3102
3103 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3104 if (!set) {
3105 err = -ENOMEM;
3106 goto err1;
3107 }
3108
3109 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3110 if (!name) {
3111 err = -ENOMEM;
3112 goto err2;
3113 }
3114
3115 err = nf_tables_set_alloc_name(&ctx, set, name);
3116 kfree(name);
3117 if (err < 0)
3118 goto err2;
3119
3120 udata = NULL;
3121 if (udlen) {
3122 udata = set->data + size;
3123 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3124 }
3125
3126 INIT_LIST_HEAD(&set->bindings);
3127 set->ops = ops;
3128 set->ktype = ktype;
3129 set->klen = desc.klen;
3130 set->dtype = dtype;
3131 set->objtype = objtype;
3132 set->dlen = desc.dlen;
3133 set->flags = flags;
3134 set->size = desc.size;
3135 set->policy = policy;
3136 set->udlen = udlen;
3137 set->udata = udata;
3138 set->timeout = timeout;
3139 set->gc_int = gc_int;
3140 set->handle = nf_tables_alloc_handle(table);
3141
3142 err = ops->init(set, &desc, nla);
3143 if (err < 0)
3144 goto err2;
3145
3146 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
3147 if (err < 0)
3148 goto err3;
3149
3150 list_add_tail_rcu(&set->list, &table->sets);
3151 table->use++;
3152 return 0;
3153
3154err3:
3155 ops->destroy(set);
3156err2:
3157 kvfree(set);
3158err1:
3159 module_put(ops->type->owner);
3160 return err;
3161}
3162
3163static void nft_set_destroy(struct nft_set *set)
3164{
3165 set->ops->destroy(set);
3166 module_put(set->ops->type->owner);
3167 kfree(set->name);
3168 kvfree(set);
3169}
3170
3171static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3172{
3173 list_del_rcu(&set->list);
3174 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
3175 nft_set_destroy(set);
3176}
3177
3178static int nf_tables_delset(struct net *net, struct sock *nlsk,
3179 struct sk_buff *skb, const struct nlmsghdr *nlh,
3180 const struct nlattr * const nla[],
3181 struct netlink_ext_ack *extack)
3182{
3183 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3184 u8 genmask = nft_genmask_next(net);
3185 struct nft_set *set;
3186 struct nft_ctx ctx;
3187 int err;
3188
3189 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3190 return -EAFNOSUPPORT;
3191 if (nla[NFTA_SET_TABLE] == NULL)
3192 return -EINVAL;
3193
3194 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
3195 if (err < 0)
3196 return err;
3197
3198 if (nla[NFTA_SET_HANDLE])
3199 set = nf_tables_set_lookup_byhandle(ctx.table, nla[NFTA_SET_HANDLE], genmask);
3200 else
3201 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
3202 if (IS_ERR(set))
3203 return PTR_ERR(set);
3204
3205 if (!list_empty(&set->bindings) ||
3206 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0))
3207 return -EBUSY;
3208
3209 return nft_delset(&ctx, set);
3210}
3211
3212static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
3213 struct nft_set *set,
3214 const struct nft_set_iter *iter,
3215 struct nft_set_elem *elem)
3216{
3217 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3218 enum nft_registers dreg;
3219
3220 dreg = nft_type_to_reg(set->dtype);
3221 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3222 set->dtype == NFT_DATA_VERDICT ?
3223 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3224 set->dlen);
3225}
3226
3227int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3228 struct nft_set_binding *binding)
3229{
3230 struct nft_set_binding *i;
3231 struct nft_set_iter iter;
3232
3233 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
3234 return -EBUSY;
3235
3236 if (binding->flags & NFT_SET_MAP) {
3237 /* If the set is already bound to the same chain all
3238 * jumps are already validated for that chain.
3239 */
3240 list_for_each_entry(i, &set->bindings, list) {
3241 if (i->flags & NFT_SET_MAP &&
3242 i->chain == binding->chain)
3243 goto bind;
3244 }
3245
3246 iter.genmask = nft_genmask_next(ctx->net);
3247 iter.skip = 0;
3248 iter.count = 0;
3249 iter.err = 0;
3250 iter.fn = nf_tables_bind_check_setelem;
3251
3252 set->ops->walk(ctx, set, &iter);
3253 if (iter.err < 0)
3254 return iter.err;
3255 }
3256bind:
3257 binding->chain = ctx->chain;
3258 list_add_tail_rcu(&binding->list, &set->bindings);
3259 return 0;
3260}
3261EXPORT_SYMBOL_GPL(nf_tables_bind_set);
3262
3263void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3264 struct nft_set_binding *binding)
3265{
3266 list_del_rcu(&binding->list);
3267
3268 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
3269 nft_is_active(ctx->net, set))
3270 nf_tables_set_destroy(ctx, set);
3271}
3272EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
3273
3274const struct nft_set_ext_type nft_set_ext_types[] = {
3275 [NFT_SET_EXT_KEY] = {
3276 .align = __alignof__(u32),
3277 },
3278 [NFT_SET_EXT_DATA] = {
3279 .align = __alignof__(u32),
3280 },
3281 [NFT_SET_EXT_EXPR] = {
3282 .align = __alignof__(struct nft_expr),
3283 },
3284 [NFT_SET_EXT_OBJREF] = {
3285 .len = sizeof(struct nft_object *),
3286 .align = __alignof__(struct nft_object *),
3287 },
3288 [NFT_SET_EXT_FLAGS] = {
3289 .len = sizeof(u8),
3290 .align = __alignof__(u8),
3291 },
3292 [NFT_SET_EXT_TIMEOUT] = {
3293 .len = sizeof(u64),
3294 .align = __alignof__(u64),
3295 },
3296 [NFT_SET_EXT_EXPIRATION] = {
3297 .len = sizeof(unsigned long),
3298 .align = __alignof__(unsigned long),
3299 },
3300 [NFT_SET_EXT_USERDATA] = {
3301 .len = sizeof(struct nft_userdata),
3302 .align = __alignof__(struct nft_userdata),
3303 },
3304};
3305EXPORT_SYMBOL_GPL(nft_set_ext_types);
3306
3307/*
3308 * Set elements
3309 */
3310
3311static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3312 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3313 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3314 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
3315 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
3316 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3317 .len = NFT_USERDATA_MAXLEN },
3318};
3319
3320static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
3321 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3322 .len = NFT_TABLE_MAXNAMELEN - 1 },
3323 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3324 .len = NFT_SET_MAXNAMELEN - 1 },
3325 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
3326 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
3327};
3328
3329static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
3330 const struct sk_buff *skb,
3331 const struct nlmsghdr *nlh,
3332 const struct nlattr * const nla[],
3333 u8 genmask)
3334{
3335 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3336 int family = nfmsg->nfgen_family;
3337 struct nft_table *table;
3338
3339 table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
3340 family, genmask);
3341 if (IS_ERR(table))
3342 return PTR_ERR(table);
3343
3344 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
3345 return 0;
3346}
3347
3348static int nf_tables_fill_setelem(struct sk_buff *skb,
3349 const struct nft_set *set,
3350 const struct nft_set_elem *elem)
3351{
3352 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3353 unsigned char *b = skb_tail_pointer(skb);
3354 struct nlattr *nest;
3355
3356 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3357 if (nest == NULL)
3358 goto nla_put_failure;
3359
3360 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3361 NFT_DATA_VALUE, set->klen) < 0)
3362 goto nla_put_failure;
3363
3364 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3365 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
3366 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3367 set->dlen) < 0)
3368 goto nla_put_failure;
3369
3370 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3371 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3372 goto nla_put_failure;
3373
3374 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3375 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3376 (*nft_set_ext_obj(ext))->name) < 0)
3377 goto nla_put_failure;
3378
3379 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3380 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3381 htonl(*nft_set_ext_flags(ext))))
3382 goto nla_put_failure;
3383
3384 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3385 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
3386 cpu_to_be64(jiffies_to_msecs(
3387 *nft_set_ext_timeout(ext))),
3388 NFTA_SET_ELEM_PAD))
3389 goto nla_put_failure;
3390
3391 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3392 unsigned long expires, now = jiffies;
3393
3394 expires = *nft_set_ext_expiration(ext);
3395 if (time_before(now, expires))
3396 expires -= now;
3397 else
3398 expires = 0;
3399
3400 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
3401 cpu_to_be64(jiffies_to_msecs(expires)),
3402 NFTA_SET_ELEM_PAD))
3403 goto nla_put_failure;
3404 }
3405
3406 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3407 struct nft_userdata *udata;
3408
3409 udata = nft_set_ext_userdata(ext);
3410 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3411 udata->len + 1, udata->data))
3412 goto nla_put_failure;
3413 }
3414
3415 nla_nest_end(skb, nest);
3416 return 0;
3417
3418nla_put_failure:
3419 nlmsg_trim(skb, b);
3420 return -EMSGSIZE;
3421}
3422
3423struct nft_set_dump_args {
3424 const struct netlink_callback *cb;
3425 struct nft_set_iter iter;
3426 struct sk_buff *skb;
3427};
3428
3429static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
3430 struct nft_set *set,
3431 const struct nft_set_iter *iter,
3432 struct nft_set_elem *elem)
3433{
3434 struct nft_set_dump_args *args;
3435
3436 args = container_of(iter, struct nft_set_dump_args, iter);
3437 return nf_tables_fill_setelem(args->skb, set, elem);
3438}
3439
3440struct nft_set_dump_ctx {
3441 const struct nft_set *set;
3442 struct nft_ctx ctx;
3443};
3444
3445static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3446{
3447 struct nft_set_dump_ctx *dump_ctx = cb->data;
3448 struct net *net = sock_net(skb->sk);
3449 struct nft_table *table;
3450 struct nft_set *set;
3451 struct nft_set_dump_args args;
3452 bool set_found = false;
3453 struct nfgenmsg *nfmsg;
3454 struct nlmsghdr *nlh;
3455 struct nlattr *nest;
3456 u32 portid, seq;
3457 int event;
3458
3459 rcu_read_lock();
3460 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3461 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
3462 dump_ctx->ctx.family != table->family)
3463 continue;
3464
3465 if (table != dump_ctx->ctx.table)
3466 continue;
3467
3468 list_for_each_entry_rcu(set, &table->sets, list) {
3469 if (set == dump_ctx->set) {
3470 set_found = true;
3471 break;
3472 }
3473 }
3474 break;
3475 }
3476
3477 if (!set_found) {
3478 rcu_read_unlock();
3479 return -ENOENT;
3480 }
3481
3482 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
3483 portid = NETLINK_CB(cb->skb).portid;
3484 seq = cb->nlh->nlmsg_seq;
3485
3486 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3487 NLM_F_MULTI);
3488 if (nlh == NULL)
3489 goto nla_put_failure;
3490
3491 nfmsg = nlmsg_data(nlh);
3492 nfmsg->nfgen_family = table->family;
3493 nfmsg->version = NFNETLINK_V0;
3494 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
3495
3496 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
3497 goto nla_put_failure;
3498 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3499 goto nla_put_failure;
3500
3501 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3502 if (nest == NULL)
3503 goto nla_put_failure;
3504
3505 args.cb = cb;
3506 args.skb = skb;
3507 args.iter.genmask = nft_genmask_cur(net);
3508 args.iter.skip = cb->args[0];
3509 args.iter.count = 0;
3510 args.iter.err = 0;
3511 args.iter.fn = nf_tables_dump_setelem;
3512 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3513 rcu_read_unlock();
3514
3515 nla_nest_end(skb, nest);
3516 nlmsg_end(skb, nlh);
3517
3518 if (args.iter.err && args.iter.err != -EMSGSIZE)
3519 return args.iter.err;
3520 if (args.iter.count == cb->args[0])
3521 return 0;
3522
3523 cb->args[0] = args.iter.count;
3524 return skb->len;
3525
3526nla_put_failure:
3527 rcu_read_unlock();
3528 return -ENOSPC;
3529}
3530
3531static int nf_tables_dump_set_done(struct netlink_callback *cb)
3532{
3533 kfree(cb->data);
3534 return 0;
3535}
3536
3537static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3538 const struct nft_ctx *ctx, u32 seq,
3539 u32 portid, int event, u16 flags,
3540 const struct nft_set *set,
3541 const struct nft_set_elem *elem)
3542{
3543 struct nfgenmsg *nfmsg;
3544 struct nlmsghdr *nlh;
3545 struct nlattr *nest;
3546 int err;
3547
3548 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3549 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3550 flags);
3551 if (nlh == NULL)
3552 goto nla_put_failure;
3553
3554 nfmsg = nlmsg_data(nlh);
3555 nfmsg->nfgen_family = ctx->family;
3556 nfmsg->version = NFNETLINK_V0;
3557 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
3558
3559 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3560 goto nla_put_failure;
3561 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3562 goto nla_put_failure;
3563
3564 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3565 if (nest == NULL)
3566 goto nla_put_failure;
3567
3568 err = nf_tables_fill_setelem(skb, set, elem);
3569 if (err < 0)
3570 goto nla_put_failure;
3571
3572 nla_nest_end(skb, nest);
3573
3574 nlmsg_end(skb, nlh);
3575 return 0;
3576
3577nla_put_failure:
3578 nlmsg_trim(skb, nlh);
3579 return -1;
3580}
3581
3582static int nft_setelem_parse_flags(const struct nft_set *set,
3583 const struct nlattr *attr, u32 *flags)
3584{
3585 if (attr == NULL)
3586 return 0;
3587
3588 *flags = ntohl(nla_get_be32(attr));
3589 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3590 return -EINVAL;
3591 if (!(set->flags & NFT_SET_INTERVAL) &&
3592 *flags & NFT_SET_ELEM_INTERVAL_END)
3593 return -EINVAL;
3594
3595 return 0;
3596}
3597
3598static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3599 const struct nlattr *attr)
3600{
3601 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3602 const struct nft_set_ext *ext;
3603 struct nft_data_desc desc;
3604 struct nft_set_elem elem;
3605 struct sk_buff *skb;
3606 uint32_t flags = 0;
3607 void *priv;
3608 int err;
3609
3610 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3611 nft_set_elem_policy, NULL);
3612 if (err < 0)
3613 return err;
3614
3615 if (!nla[NFTA_SET_ELEM_KEY])
3616 return -EINVAL;
3617
3618 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3619 if (err < 0)
3620 return err;
3621
3622 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3623 nla[NFTA_SET_ELEM_KEY]);
3624 if (err < 0)
3625 return err;
3626
3627 err = -EINVAL;
3628 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3629 return err;
3630
3631 priv = set->ops->get(ctx->net, set, &elem, flags);
3632 if (IS_ERR(priv))
3633 return PTR_ERR(priv);
3634
3635 elem.priv = priv;
3636 ext = nft_set_elem_ext(set, &elem);
3637
3638 err = -ENOMEM;
3639 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3640 if (skb == NULL)
3641 goto err1;
3642
3643 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3644 NFT_MSG_NEWSETELEM, 0, set, &elem);
3645 if (err < 0)
3646 goto err2;
3647
3648 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3649 /* This avoids a loop in nfnetlink. */
3650 if (err < 0)
3651 goto err1;
3652
3653 return 0;
3654err2:
3655 kfree_skb(skb);
3656err1:
3657 /* this avoids a loop in nfnetlink. */
3658 return err == -EAGAIN ? -ENOBUFS : err;
3659}
3660
3661static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3662 struct sk_buff *skb, const struct nlmsghdr *nlh,
3663 const struct nlattr * const nla[],
3664 struct netlink_ext_ack *extack)
3665{
3666 u8 genmask = nft_genmask_cur(net);
3667 struct nft_set *set;
3668 struct nlattr *attr;
3669 struct nft_ctx ctx;
3670 int rem, err = 0;
3671
3672 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
3673 if (err < 0)
3674 return err;
3675
3676 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
3677 genmask);
3678 if (IS_ERR(set))
3679 return PTR_ERR(set);
3680
3681 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3682 struct netlink_dump_control c = {
3683 .dump = nf_tables_dump_set,
3684 .done = nf_tables_dump_set_done,
3685 };
3686 struct nft_set_dump_ctx *dump_ctx;
3687
3688 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3689 if (!dump_ctx)
3690 return -ENOMEM;
3691
3692 dump_ctx->set = set;
3693 dump_ctx->ctx = ctx;
3694
3695 c.data = dump_ctx;
3696 return netlink_dump_start(nlsk, skb, nlh, &c);
3697 }
3698
3699 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3700 return -EINVAL;
3701
3702 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3703 err = nft_get_set_elem(&ctx, set, attr);
3704 if (err < 0)
3705 break;
3706 }
3707
3708 return err;
3709}
3710
3711static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3712 const struct nft_set *set,
3713 const struct nft_set_elem *elem,
3714 int event, u16 flags)
3715{
3716 struct net *net = ctx->net;
3717 u32 portid = ctx->portid;
3718 struct sk_buff *skb;
3719 int err;
3720
3721 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
3722 return;
3723
3724 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3725 if (skb == NULL)
3726 goto err;
3727
3728 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3729 set, elem);
3730 if (err < 0) {
3731 kfree_skb(skb);
3732 goto err;
3733 }
3734
3735 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3736 GFP_KERNEL);
3737 return;
3738err:
3739 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3740}
3741
3742static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3743 int msg_type,
3744 struct nft_set *set)
3745{
3746 struct nft_trans *trans;
3747
3748 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3749 if (trans == NULL)
3750 return NULL;
3751
3752 nft_trans_elem_set(trans) = set;
3753 return trans;
3754}
3755
3756void *nft_set_elem_init(const struct nft_set *set,
3757 const struct nft_set_ext_tmpl *tmpl,
3758 const u32 *key, const u32 *data,
3759 u64 timeout, gfp_t gfp)
3760{
3761 struct nft_set_ext *ext;
3762 void *elem;
3763
3764 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3765 if (elem == NULL)
3766 return NULL;
3767
3768 ext = nft_set_elem_ext(set, elem);
3769 nft_set_ext_init(ext, tmpl);
3770
3771 memcpy(nft_set_ext_key(ext), key, set->klen);
3772 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3773 memcpy(nft_set_ext_data(ext), data, set->dlen);
3774 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3775 *nft_set_ext_expiration(ext) =
3776 jiffies + timeout;
3777 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3778 *nft_set_ext_timeout(ext) = timeout;
3779
3780 return elem;
3781}
3782
3783void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3784 bool destroy_expr)
3785{
3786 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3787
3788 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
3789 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3790 nft_data_release(nft_set_ext_data(ext), set->dtype);
3791 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3792 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3793 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3794 (*nft_set_ext_obj(ext))->use--;
3795 kfree(elem);
3796}
3797EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3798
3799/* Only called from commit path, nft_set_elem_deactivate() already deals with
3800 * the refcounting from the preparation phase.
3801 */
3802static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3803{
3804 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3805
3806 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3807 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3808 kfree(elem);
3809}
3810
3811static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3812 const struct nlattr *attr, u32 nlmsg_flags)
3813{
3814 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3815 u8 genmask = nft_genmask_next(ctx->net);
3816 struct nft_data_desc d1, d2;
3817 struct nft_set_ext_tmpl tmpl;
3818 struct nft_set_ext *ext, *ext2;
3819 struct nft_set_elem elem;
3820 struct nft_set_binding *binding;
3821 struct nft_object *obj = NULL;
3822 struct nft_userdata *udata;
3823 struct nft_data data;
3824 enum nft_registers dreg;
3825 struct nft_trans *trans;
3826 u32 flags = 0;
3827 u64 timeout;
3828 u8 ulen;
3829 int err;
3830
3831 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3832 nft_set_elem_policy, NULL);
3833 if (err < 0)
3834 return err;
3835
3836 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3837 return -EINVAL;
3838
3839 nft_set_ext_prepare(&tmpl);
3840
3841 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3842 if (err < 0)
3843 return err;
3844 if (flags != 0)
3845 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
3846
3847 if (set->flags & NFT_SET_MAP) {
3848 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
3849 !(flags & NFT_SET_ELEM_INTERVAL_END))
3850 return -EINVAL;
3851 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
3852 flags & NFT_SET_ELEM_INTERVAL_END)
3853 return -EINVAL;
3854 } else {
3855 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3856 return -EINVAL;
3857 }
3858
3859 timeout = 0;
3860 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3861 if (!(set->flags & NFT_SET_TIMEOUT))
3862 return -EINVAL;
3863 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3864 nla[NFTA_SET_ELEM_TIMEOUT])));
3865 } else if (set->flags & NFT_SET_TIMEOUT) {
3866 timeout = set->timeout;
3867 }
3868
3869 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
3870 nla[NFTA_SET_ELEM_KEY]);
3871 if (err < 0)
3872 goto err1;
3873 err = -EINVAL;
3874 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3875 goto err2;
3876
3877 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
3878 if (timeout > 0) {
3879 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
3880 if (timeout != set->timeout)
3881 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
3882 }
3883
3884 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
3885 if (!(set->flags & NFT_SET_OBJECT)) {
3886 err = -EINVAL;
3887 goto err2;
3888 }
3889 obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
3890 set->objtype, genmask);
3891 if (IS_ERR(obj)) {
3892 err = PTR_ERR(obj);
3893 goto err2;
3894 }
3895 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
3896 }
3897
3898 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
3899 err = nft_data_init(ctx, &data, sizeof(data), &d2,
3900 nla[NFTA_SET_ELEM_DATA]);
3901 if (err < 0)
3902 goto err2;
3903
3904 err = -EINVAL;
3905 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3906 goto err3;
3907
3908 dreg = nft_type_to_reg(set->dtype);
3909 list_for_each_entry(binding, &set->bindings, list) {
3910 struct nft_ctx bind_ctx = {
3911 .net = ctx->net,
3912 .family = ctx->family,
3913 .table = ctx->table,
3914 .chain = (struct nft_chain *)binding->chain,
3915 };
3916
3917 if (!(binding->flags & NFT_SET_MAP))
3918 continue;
3919
3920 err = nft_validate_register_store(&bind_ctx, dreg,
3921 &data,
3922 d2.type, d2.len);
3923 if (err < 0)
3924 goto err3;
3925 }
3926
3927 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
3928 }
3929
3930 /* The full maximum length of userdata can exceed the maximum
3931 * offset value (U8_MAX) for following extensions, therefor it
3932 * must be the last extension added.
3933 */
3934 ulen = 0;
3935 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
3936 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
3937 if (ulen > 0)
3938 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
3939 ulen);
3940 }
3941
3942 err = -ENOMEM;
3943 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
3944 timeout, GFP_KERNEL);
3945 if (elem.priv == NULL)
3946 goto err3;
3947
3948 ext = nft_set_elem_ext(set, elem.priv);
3949 if (flags)
3950 *nft_set_ext_flags(ext) = flags;
3951 if (ulen > 0) {
3952 udata = nft_set_ext_userdata(ext);
3953 udata->len = ulen - 1;
3954 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
3955 }
3956 if (obj) {
3957 *nft_set_ext_obj(ext) = obj;
3958 obj->use++;
3959 }
3960
3961 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
3962 if (trans == NULL)
3963 goto err4;
3964
3965 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
3966 err = set->ops->insert(ctx->net, set, &elem, &ext2);
3967 if (err) {
3968 if (err == -EEXIST) {
3969 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
3970 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
3971 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
3972 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
3973 return -EBUSY;
3974 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3975 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
3976 memcmp(nft_set_ext_data(ext),
3977 nft_set_ext_data(ext2), set->dlen) != 0) ||
3978 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3979 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
3980 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
3981 err = -EBUSY;
3982 else if (!(nlmsg_flags & NLM_F_EXCL))
3983 err = 0;
3984 }
3985 goto err5;
3986 }
3987
3988 if (set->size &&
3989 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
3990 err = -ENFILE;
3991 goto err6;
3992 }
3993
3994 nft_trans_elem(trans) = elem;
3995 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
3996 return 0;
3997
3998err6:
3999 set->ops->remove(ctx->net, set, &elem);
4000err5:
4001 kfree(trans);
4002err4:
4003 kfree(elem.priv);
4004err3:
4005 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4006 nft_data_release(&data, d2.type);
4007err2:
4008 nft_data_release(&elem.key.val, d1.type);
4009err1:
4010 return err;
4011}
4012
4013static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4014 struct sk_buff *skb, const struct nlmsghdr *nlh,
4015 const struct nlattr * const nla[],
4016 struct netlink_ext_ack *extack)
4017{
4018 u8 genmask = nft_genmask_next(net);
4019 const struct nlattr *attr;
4020 struct nft_set *set;
4021 struct nft_ctx ctx;
4022 int rem, err = 0;
4023
4024 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4025 return -EINVAL;
4026
4027 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
4028 if (err < 0)
4029 return err;
4030
4031 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4032 genmask);
4033 if (IS_ERR(set)) {
4034 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
4035 set = nf_tables_set_lookup_byid(net,
4036 nla[NFTA_SET_ELEM_LIST_SET_ID],
4037 genmask);
4038 }
4039 if (IS_ERR(set))
4040 return PTR_ERR(set);
4041 }
4042
4043 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4044 return -EBUSY;
4045
4046 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4047 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
4048 if (err < 0)
4049 break;
4050 }
4051 return err;
4052}
4053
4054/**
4055 * nft_data_hold - hold a nft_data item
4056 *
4057 * @data: struct nft_data to release
4058 * @type: type of data
4059 *
4060 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4061 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4062 * NFT_GOTO verdicts. This function must be called on active data objects
4063 * from the second phase of the commit protocol.
4064 */
4065static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4066{
4067 if (type == NFT_DATA_VERDICT) {
4068 switch (data->verdict.code) {
4069 case NFT_JUMP:
4070 case NFT_GOTO:
4071 data->verdict.chain->use++;
4072 break;
4073 }
4074 }
4075}
4076
4077static void nft_set_elem_activate(const struct net *net,
4078 const struct nft_set *set,
4079 struct nft_set_elem *elem)
4080{
4081 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4082
4083 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4084 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4085 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4086 (*nft_set_ext_obj(ext))->use++;
4087}
4088
4089static void nft_set_elem_deactivate(const struct net *net,
4090 const struct nft_set *set,
4091 struct nft_set_elem *elem)
4092{
4093 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4094
4095 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4096 nft_data_release(nft_set_ext_data(ext), set->dtype);
4097 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4098 (*nft_set_ext_obj(ext))->use--;
4099}
4100
4101static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
4102 const struct nlattr *attr)
4103{
4104 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4105 struct nft_set_ext_tmpl tmpl;
4106 struct nft_data_desc desc;
4107 struct nft_set_elem elem;
4108 struct nft_set_ext *ext;
4109 struct nft_trans *trans;
4110 u32 flags = 0;
4111 void *priv;
4112 int err;
4113
4114 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4115 nft_set_elem_policy, NULL);
4116 if (err < 0)
4117 goto err1;
4118
4119 err = -EINVAL;
4120 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4121 goto err1;
4122
4123 nft_set_ext_prepare(&tmpl);
4124
4125 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4126 if (err < 0)
4127 return err;
4128 if (flags != 0)
4129 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4130
4131 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4132 nla[NFTA_SET_ELEM_KEY]);
4133 if (err < 0)
4134 goto err1;
4135
4136 err = -EINVAL;
4137 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4138 goto err2;
4139
4140 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4141
4142 err = -ENOMEM;
4143 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4144 GFP_KERNEL);
4145 if (elem.priv == NULL)
4146 goto err2;
4147
4148 ext = nft_set_elem_ext(set, elem.priv);
4149 if (flags)
4150 *nft_set_ext_flags(ext) = flags;
4151
4152 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
4153 if (trans == NULL) {
4154 err = -ENOMEM;
4155 goto err3;
4156 }
4157
4158 priv = set->ops->deactivate(ctx->net, set, &elem);
4159 if (priv == NULL) {
4160 err = -ENOENT;
4161 goto err4;
4162 }
4163 kfree(elem.priv);
4164 elem.priv = priv;
4165
4166 nft_set_elem_deactivate(ctx->net, set, &elem);
4167
4168 nft_trans_elem(trans) = elem;
4169 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4170 return 0;
4171
4172err4:
4173 kfree(trans);
4174err3:
4175 kfree(elem.priv);
4176err2:
4177 nft_data_release(&elem.key.val, desc.type);
4178err1:
4179 return err;
4180}
4181
4182static int nft_flush_set(const struct nft_ctx *ctx,
4183 struct nft_set *set,
4184 const struct nft_set_iter *iter,
4185 struct nft_set_elem *elem)
4186{
4187 struct nft_trans *trans;
4188 int err;
4189
4190 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4191 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4192 if (!trans)
4193 return -ENOMEM;
4194
4195 if (!set->ops->flush(ctx->net, set, elem->priv)) {
4196 err = -ENOENT;
4197 goto err1;
4198 }
4199 set->ndeact++;
4200
4201 nft_trans_elem_set(trans) = set;
4202 nft_trans_elem(trans) = *elem;
4203 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4204
4205 return 0;
4206err1:
4207 kfree(trans);
4208 return err;
4209}
4210
4211static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4212 struct sk_buff *skb, const struct nlmsghdr *nlh,
4213 const struct nlattr * const nla[],
4214 struct netlink_ext_ack *extack)
4215{
4216 u8 genmask = nft_genmask_next(net);
4217 const struct nlattr *attr;
4218 struct nft_set *set;
4219 struct nft_ctx ctx;
4220 int rem, err = 0;
4221
4222 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
4223 if (err < 0)
4224 return err;
4225
4226 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4227 genmask);
4228 if (IS_ERR(set))
4229 return PTR_ERR(set);
4230 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4231 return -EBUSY;
4232
4233 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
4234 struct nft_set_iter iter = {
4235 .genmask = genmask,
4236 .fn = nft_flush_set,
4237 };
4238 set->ops->walk(&ctx, set, &iter);
4239
4240 return iter.err;
4241 }
4242
4243 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4244 err = nft_del_setelem(&ctx, set, attr);
4245 if (err < 0)
4246 break;
4247
4248 set->ndeact++;
4249 }
4250 return err;
4251}
4252
4253void nft_set_gc_batch_release(struct rcu_head *rcu)
4254{
4255 struct nft_set_gc_batch *gcb;
4256 unsigned int i;
4257
4258 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4259 for (i = 0; i < gcb->head.cnt; i++)
4260 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
4261 kfree(gcb);
4262}
4263EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4264
4265struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4266 gfp_t gfp)
4267{
4268 struct nft_set_gc_batch *gcb;
4269
4270 gcb = kzalloc(sizeof(*gcb), gfp);
4271 if (gcb == NULL)
4272 return gcb;
4273 gcb->head.set = set;
4274 return gcb;
4275}
4276EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4277
4278/*
4279 * Stateful objects
4280 */
4281
4282/**
4283 * nft_register_obj- register nf_tables stateful object type
4284 * @obj: object type
4285 *
4286 * Registers the object type for use with nf_tables. Returns zero on
4287 * success or a negative errno code otherwise.
4288 */
4289int nft_register_obj(struct nft_object_type *obj_type)
4290{
4291 if (obj_type->type == NFT_OBJECT_UNSPEC)
4292 return -EINVAL;
4293
4294 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4295 list_add_rcu(&obj_type->list, &nf_tables_objects);
4296 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4297 return 0;
4298}
4299EXPORT_SYMBOL_GPL(nft_register_obj);
4300
4301/**
4302 * nft_unregister_obj - unregister nf_tables object type
4303 * @obj: object type
4304 *
4305 * Unregisters the object type for use with nf_tables.
4306 */
4307void nft_unregister_obj(struct nft_object_type *obj_type)
4308{
4309 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4310 list_del_rcu(&obj_type->list);
4311 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4312}
4313EXPORT_SYMBOL_GPL(nft_unregister_obj);
4314
4315struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
4316 const struct nlattr *nla,
4317 u32 objtype, u8 genmask)
4318{
4319 struct nft_object *obj;
4320
4321 list_for_each_entry(obj, &table->objects, list) {
4322 if (!nla_strcmp(nla, obj->name) &&
4323 objtype == obj->ops->type->type &&
4324 nft_active_genmask(obj, genmask))
4325 return obj;
4326 }
4327 return ERR_PTR(-ENOENT);
4328}
4329EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
4330
4331struct nft_object *nf_tables_obj_lookup_byhandle(const struct nft_table *table,
4332 const struct nlattr *nla,
4333 u32 objtype, u8 genmask)
4334{
4335 struct nft_object *obj;
4336
4337 list_for_each_entry(obj, &table->objects, list) {
4338 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4339 objtype == obj->ops->type->type &&
4340 nft_active_genmask(obj, genmask))
4341 return obj;
4342 }
4343 return ERR_PTR(-ENOENT);
4344}
4345
4346static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
4347 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4348 .len = NFT_TABLE_MAXNAMELEN - 1 },
4349 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4350 .len = NFT_OBJ_MAXNAMELEN - 1 },
4351 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4352 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4353 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
4354};
4355
4356static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4357 const struct nft_object_type *type,
4358 const struct nlattr *attr)
4359{
4360 struct nlattr *tb[type->maxattr + 1];
4361 const struct nft_object_ops *ops;
4362 struct nft_object *obj;
4363 int err;
4364
4365 if (attr) {
4366 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4367 NULL);
4368 if (err < 0)
4369 goto err1;
4370 } else {
4371 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4372 }
4373
4374 if (type->select_ops) {
4375 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4376 if (IS_ERR(ops)) {
4377 err = PTR_ERR(ops);
4378 goto err1;
4379 }
4380 } else {
4381 ops = type->ops;
4382 }
4383
4384 err = -ENOMEM;
4385 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
4386 if (obj == NULL)
4387 goto err1;
4388
4389 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
4390 if (err < 0)
4391 goto err2;
4392
4393 obj->ops = ops;
4394
4395 return obj;
4396err2:
4397 kfree(obj);
4398err1:
4399 return ERR_PTR(err);
4400}
4401
4402static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
4403 struct nft_object *obj, bool reset)
4404{
4405 struct nlattr *nest;
4406
4407 nest = nla_nest_start(skb, attr);
4408 if (!nest)
4409 goto nla_put_failure;
4410 if (obj->ops->dump(skb, obj, reset) < 0)
4411 goto nla_put_failure;
4412 nla_nest_end(skb, nest);
4413 return 0;
4414
4415nla_put_failure:
4416 return -1;
4417}
4418
4419static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4420{
4421 const struct nft_object_type *type;
4422
4423 list_for_each_entry(type, &nf_tables_objects, list) {
4424 if (objtype == type->type)
4425 return type;
4426 }
4427 return NULL;
4428}
4429
4430static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4431{
4432 const struct nft_object_type *type;
4433
4434 type = __nft_obj_type_get(objtype);
4435 if (type != NULL && try_module_get(type->owner))
4436 return type;
4437
4438#ifdef CONFIG_MODULES
4439 if (type == NULL) {
4440 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4441 request_module("nft-obj-%u", objtype);
4442 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4443 if (__nft_obj_type_get(objtype))
4444 return ERR_PTR(-EAGAIN);
4445 }
4446#endif
4447 return ERR_PTR(-ENOENT);
4448}
4449
4450static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4451 struct sk_buff *skb, const struct nlmsghdr *nlh,
4452 const struct nlattr * const nla[],
4453 struct netlink_ext_ack *extack)
4454{
4455 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4456 const struct nft_object_type *type;
4457 u8 genmask = nft_genmask_next(net);
4458 int family = nfmsg->nfgen_family;
4459 struct nft_table *table;
4460 struct nft_object *obj;
4461 struct nft_ctx ctx;
4462 u32 objtype;
4463 int err;
4464
4465 if (!nla[NFTA_OBJ_TYPE] ||
4466 !nla[NFTA_OBJ_NAME] ||
4467 !nla[NFTA_OBJ_DATA])
4468 return -EINVAL;
4469
4470 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
4471 genmask);
4472 if (IS_ERR(table))
4473 return PTR_ERR(table);
4474
4475 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4476 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4477 if (IS_ERR(obj)) {
4478 err = PTR_ERR(obj);
4479 if (err != -ENOENT)
4480 return err;
4481
4482 } else {
4483 if (nlh->nlmsg_flags & NLM_F_EXCL)
4484 return -EEXIST;
4485
4486 return 0;
4487 }
4488
4489 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
4490
4491 type = nft_obj_type_get(objtype);
4492 if (IS_ERR(type))
4493 return PTR_ERR(type);
4494
4495 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
4496 if (IS_ERR(obj)) {
4497 err = PTR_ERR(obj);
4498 goto err1;
4499 }
4500 obj->table = table;
4501 obj->handle = nf_tables_alloc_handle(table);
4502
4503 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4504 if (!obj->name) {
4505 err = -ENOMEM;
4506 goto err2;
4507 }
4508
4509 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4510 if (err < 0)
4511 goto err3;
4512
4513 list_add_tail_rcu(&obj->list, &table->objects);
4514 table->use++;
4515 return 0;
4516err3:
4517 kfree(obj->name);
4518err2:
4519 if (obj->ops->destroy)
4520 obj->ops->destroy(obj);
4521 kfree(obj);
4522err1:
4523 module_put(type->owner);
4524 return err;
4525}
4526
4527static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4528 u32 portid, u32 seq, int event, u32 flags,
4529 int family, const struct nft_table *table,
4530 struct nft_object *obj, bool reset)
4531{
4532 struct nfgenmsg *nfmsg;
4533 struct nlmsghdr *nlh;
4534
4535 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4536 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4537 if (nlh == NULL)
4538 goto nla_put_failure;
4539
4540 nfmsg = nlmsg_data(nlh);
4541 nfmsg->nfgen_family = family;
4542 nfmsg->version = NFNETLINK_V0;
4543 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4544
4545 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4546 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
4547 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
4548 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
4549 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
4550 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
4551 NFTA_OBJ_PAD))
4552 goto nla_put_failure;
4553
4554 nlmsg_end(skb, nlh);
4555 return 0;
4556
4557nla_put_failure:
4558 nlmsg_trim(skb, nlh);
4559 return -1;
4560}
4561
4562struct nft_obj_filter {
4563 char *table;
4564 u32 type;
4565};
4566
4567static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4568{
4569 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
4570 const struct nft_table *table;
4571 unsigned int idx = 0, s_idx = cb->args[0];
4572 struct nft_obj_filter *filter = cb->data;
4573 struct net *net = sock_net(skb->sk);
4574 int family = nfmsg->nfgen_family;
4575 struct nft_object *obj;
4576 bool reset = false;
4577
4578 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4579 reset = true;
4580
4581 rcu_read_lock();
4582 cb->seq = net->nft.base_seq;
4583
4584 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4585 if (family != NFPROTO_UNSPEC && family != table->family)
4586 continue;
4587
4588 list_for_each_entry_rcu(obj, &table->objects, list) {
4589 if (!nft_is_active(net, obj))
4590 goto cont;
4591 if (idx < s_idx)
4592 goto cont;
4593 if (idx > s_idx)
4594 memset(&cb->args[1], 0,
4595 sizeof(cb->args) - sizeof(cb->args[0]));
4596 if (filter && filter->table[0] &&
4597 strcmp(filter->table, table->name))
4598 goto cont;
4599 if (filter &&
4600 filter->type != NFT_OBJECT_UNSPEC &&
4601 obj->ops->type->type != filter->type)
4602 goto cont;
4603
4604 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4605 cb->nlh->nlmsg_seq,
4606 NFT_MSG_NEWOBJ,
4607 NLM_F_MULTI | NLM_F_APPEND,
4608 table->family, table,
4609 obj, reset) < 0)
4610 goto done;
4611
4612 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4613cont:
4614 idx++;
4615 }
4616 }
4617done:
4618 rcu_read_unlock();
4619
4620 cb->args[0] = idx;
4621 return skb->len;
4622}
4623
4624static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4625{
4626 struct nft_obj_filter *filter = cb->data;
4627
4628 if (filter) {
4629 kfree(filter->table);
4630 kfree(filter);
4631 }
4632
4633 return 0;
4634}
4635
4636static struct nft_obj_filter *
4637nft_obj_filter_alloc(const struct nlattr * const nla[])
4638{
4639 struct nft_obj_filter *filter;
4640
4641 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4642 if (!filter)
4643 return ERR_PTR(-ENOMEM);
4644
4645 if (nla[NFTA_OBJ_TABLE]) {
4646 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL);
4647 if (!filter->table) {
4648 kfree(filter);
4649 return ERR_PTR(-ENOMEM);
4650 }
4651 }
4652 if (nla[NFTA_OBJ_TYPE])
4653 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4654
4655 return filter;
4656}
4657
4658static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4659 struct sk_buff *skb, const struct nlmsghdr *nlh,
4660 const struct nlattr * const nla[],
4661 struct netlink_ext_ack *extack)
4662{
4663 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4664 u8 genmask = nft_genmask_cur(net);
4665 int family = nfmsg->nfgen_family;
4666 const struct nft_table *table;
4667 struct nft_object *obj;
4668 struct sk_buff *skb2;
4669 bool reset = false;
4670 u32 objtype;
4671 int err;
4672
4673 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4674 struct netlink_dump_control c = {
4675 .dump = nf_tables_dump_obj,
4676 .done = nf_tables_dump_obj_done,
4677 };
4678
4679 if (nla[NFTA_OBJ_TABLE] ||
4680 nla[NFTA_OBJ_TYPE]) {
4681 struct nft_obj_filter *filter;
4682
4683 filter = nft_obj_filter_alloc(nla);
4684 if (IS_ERR(filter))
4685 return -ENOMEM;
4686
4687 c.data = filter;
4688 }
4689 return netlink_dump_start(nlsk, skb, nlh, &c);
4690 }
4691
4692 if (!nla[NFTA_OBJ_NAME] ||
4693 !nla[NFTA_OBJ_TYPE])
4694 return -EINVAL;
4695
4696 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
4697 genmask);
4698 if (IS_ERR(table))
4699 return PTR_ERR(table);
4700
4701 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4702 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4703 if (IS_ERR(obj))
4704 return PTR_ERR(obj);
4705
4706 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4707 if (!skb2)
4708 return -ENOMEM;
4709
4710 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4711 reset = true;
4712
4713 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4714 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
4715 family, table, obj, reset);
4716 if (err < 0)
4717 goto err;
4718
4719 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4720err:
4721 kfree_skb(skb2);
4722 return err;
4723}
4724
4725static void nft_obj_destroy(struct nft_object *obj)
4726{
4727 if (obj->ops->destroy)
4728 obj->ops->destroy(obj);
4729
4730 module_put(obj->ops->type->owner);
4731 kfree(obj->name);
4732 kfree(obj);
4733}
4734
4735static int nf_tables_delobj(struct net *net, struct sock *nlsk,
4736 struct sk_buff *skb, const struct nlmsghdr *nlh,
4737 const struct nlattr * const nla[],
4738 struct netlink_ext_ack *extack)
4739{
4740 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4741 u8 genmask = nft_genmask_next(net);
4742 int family = nfmsg->nfgen_family;
4743 struct nft_table *table;
4744 struct nft_object *obj;
4745 struct nft_ctx ctx;
4746 u32 objtype;
4747
4748 if (!nla[NFTA_OBJ_TYPE] ||
4749 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
4750 return -EINVAL;
4751
4752 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
4753 genmask);
4754 if (IS_ERR(table))
4755 return PTR_ERR(table);
4756
4757 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4758 if (nla[NFTA_OBJ_HANDLE])
4759 obj = nf_tables_obj_lookup_byhandle(table, nla[NFTA_OBJ_HANDLE],
4760 objtype, genmask);
4761 else
4762 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME],
4763 objtype, genmask);
4764 if (IS_ERR(obj))
4765 return PTR_ERR(obj);
4766 if (obj->use > 0)
4767 return -EBUSY;
4768
4769 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
4770
4771 return nft_delobj(&ctx, obj);
4772}
4773
4774void nft_obj_notify(struct net *net, struct nft_table *table,
4775 struct nft_object *obj, u32 portid, u32 seq, int event,
4776 int family, int report, gfp_t gfp)
4777{
4778 struct sk_buff *skb;
4779 int err;
4780
4781 if (!report &&
4782 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
4783 return;
4784
4785 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
4786 if (skb == NULL)
4787 goto err;
4788
4789 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4790 table, obj, false);
4791 if (err < 0) {
4792 kfree_skb(skb);
4793 goto err;
4794 }
4795
4796 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4797 return;
4798err:
4799 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
4800}
4801EXPORT_SYMBOL_GPL(nft_obj_notify);
4802
4803static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4804 struct nft_object *obj, int event)
4805{
4806 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
4807 ctx->family, ctx->report, GFP_KERNEL);
4808}
4809
4810/*
4811 * Flow tables
4812 */
4813void nft_register_flowtable_type(struct nf_flowtable_type *type)
4814{
4815 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4816 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
4817 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4818}
4819EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
4820
4821void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
4822{
4823 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4824 list_del_rcu(&type->list);
4825 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4826}
4827EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
4828
4829static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
4830 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
4831 .len = NFT_NAME_MAXLEN - 1 },
4832 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
4833 .len = NFT_NAME_MAXLEN - 1 },
4834 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
4835 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
4836};
4837
4838struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
4839 const struct nlattr *nla,
4840 u8 genmask)
4841{
4842 struct nft_flowtable *flowtable;
4843
4844 list_for_each_entry(flowtable, &table->flowtables, list) {
4845 if (!nla_strcmp(nla, flowtable->name) &&
4846 nft_active_genmask(flowtable, genmask))
4847 return flowtable;
4848 }
4849 return ERR_PTR(-ENOENT);
4850}
4851EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
4852
4853struct nft_flowtable *
4854nf_tables_flowtable_lookup_byhandle(const struct nft_table *table,
4855 const struct nlattr *nla, u8 genmask)
4856{
4857 struct nft_flowtable *flowtable;
4858
4859 list_for_each_entry(flowtable, &table->flowtables, list) {
4860 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
4861 nft_active_genmask(flowtable, genmask))
4862 return flowtable;
4863 }
4864 return ERR_PTR(-ENOENT);
4865}
4866
4867#define NFT_FLOWTABLE_DEVICE_MAX 8
4868
4869static int nf_tables_parse_devices(const struct nft_ctx *ctx,
4870 const struct nlattr *attr,
4871 struct net_device *dev_array[], int *len)
4872{
4873 const struct nlattr *tmp;
4874 struct net_device *dev;
4875 char ifname[IFNAMSIZ];
4876 int rem, n = 0, err;
4877
4878 nla_for_each_nested(tmp, attr, rem) {
4879 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
4880 err = -EINVAL;
4881 goto err1;
4882 }
4883
4884 nla_strlcpy(ifname, tmp, IFNAMSIZ);
4885 dev = dev_get_by_name(ctx->net, ifname);
4886 if (!dev) {
4887 err = -ENOENT;
4888 goto err1;
4889 }
4890
4891 dev_array[n++] = dev;
4892 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
4893 err = -EFBIG;
4894 goto err1;
4895 }
4896 }
4897 if (!len)
4898 return -EINVAL;
4899
4900 err = 0;
4901err1:
4902 *len = n;
4903 return err;
4904}
4905
4906static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
4907 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
4908 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
4909 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
4910};
4911
4912static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
4913 const struct nlattr *attr,
4914 struct nft_flowtable *flowtable)
4915{
4916 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
4917 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
4918 struct nf_hook_ops *ops;
4919 int hooknum, priority;
4920 int err, n = 0, i;
4921
4922 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
4923 nft_flowtable_hook_policy, NULL);
4924 if (err < 0)
4925 return err;
4926
4927 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
4928 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
4929 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
4930 return -EINVAL;
4931
4932 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
4933 if (hooknum != NF_NETDEV_INGRESS)
4934 return -EINVAL;
4935
4936 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
4937
4938 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
4939 dev_array, &n);
4940 if (err < 0)
4941 goto err1;
4942
4943 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
4944 if (!ops) {
4945 err = -ENOMEM;
4946 goto err1;
4947 }
4948
4949 flowtable->hooknum = hooknum;
4950 flowtable->priority = priority;
4951 flowtable->ops = ops;
4952 flowtable->ops_len = n;
4953
4954 for (i = 0; i < n; i++) {
4955 flowtable->ops[i].pf = NFPROTO_NETDEV;
4956 flowtable->ops[i].hooknum = hooknum;
4957 flowtable->ops[i].priority = priority;
4958 flowtable->ops[i].priv = &flowtable->data.rhashtable;
4959 flowtable->ops[i].hook = flowtable->data.type->hook;
4960 flowtable->ops[i].dev = dev_array[i];
4961 }
4962
4963 err = 0;
4964err1:
4965 for (i = 0; i < n; i++)
4966 dev_put(dev_array[i]);
4967
4968 return err;
4969}
4970
4971static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
4972{
4973 const struct nf_flowtable_type *type;
4974
4975 list_for_each_entry(type, &nf_tables_flowtables, list) {
4976 if (family == type->family)
4977 return type;
4978 }
4979 return NULL;
4980}
4981
4982static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
4983{
4984 const struct nf_flowtable_type *type;
4985
4986 type = __nft_flowtable_type_get(family);
4987 if (type != NULL && try_module_get(type->owner))
4988 return type;
4989
4990#ifdef CONFIG_MODULES
4991 if (type == NULL) {
4992 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4993 request_module("nf-flowtable-%u", family);
4994 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4995 if (__nft_flowtable_type_get(family))
4996 return ERR_PTR(-EAGAIN);
4997 }
4998#endif
4999 return ERR_PTR(-ENOENT);
5000}
5001
5002void nft_flow_table_iterate(struct net *net,
5003 void (*iter)(struct nf_flowtable *flowtable, void *data),
5004 void *data)
5005{
5006 struct nft_flowtable *flowtable;
5007 const struct nft_table *table;
5008
5009 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5010 list_for_each_entry(table, &net->nft.tables, list) {
5011 list_for_each_entry(flowtable, &table->flowtables, list) {
5012 iter(&flowtable->data, data);
5013 }
5014 }
5015 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5016}
5017EXPORT_SYMBOL_GPL(nft_flow_table_iterate);
5018
5019static void nft_unregister_flowtable_net_hooks(struct net *net,
5020 struct nft_flowtable *flowtable)
5021{
5022 int i;
5023
5024 for (i = 0; i < flowtable->ops_len; i++) {
5025 if (!flowtable->ops[i].dev)
5026 continue;
5027
5028 nf_unregister_net_hook(net, &flowtable->ops[i]);
5029 }
5030}
5031
5032static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5033 struct sk_buff *skb,
5034 const struct nlmsghdr *nlh,
5035 const struct nlattr * const nla[],
5036 struct netlink_ext_ack *extack)
5037{
5038 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5039 const struct nf_flowtable_type *type;
5040 struct nft_flowtable *flowtable, *ft;
5041 u8 genmask = nft_genmask_next(net);
5042 int family = nfmsg->nfgen_family;
5043 struct nft_table *table;
5044 struct nft_ctx ctx;
5045 int err, i, k;
5046
5047 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5048 !nla[NFTA_FLOWTABLE_NAME] ||
5049 !nla[NFTA_FLOWTABLE_HOOK])
5050 return -EINVAL;
5051
5052 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
5053 family, genmask);
5054 if (IS_ERR(table))
5055 return PTR_ERR(table);
5056
5057 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5058 genmask);
5059 if (IS_ERR(flowtable)) {
5060 err = PTR_ERR(flowtable);
5061 if (err != -ENOENT)
5062 return err;
5063 } else {
5064 if (nlh->nlmsg_flags & NLM_F_EXCL)
5065 return -EEXIST;
5066
5067 return 0;
5068 }
5069
5070 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5071
5072 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5073 if (!flowtable)
5074 return -ENOMEM;
5075
5076 flowtable->table = table;
5077 flowtable->handle = nf_tables_alloc_handle(table);
5078
5079 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5080 if (!flowtable->name) {
5081 err = -ENOMEM;
5082 goto err1;
5083 }
5084
5085 type = nft_flowtable_type_get(family);
5086 if (IS_ERR(type)) {
5087 err = PTR_ERR(type);
5088 goto err2;
5089 }
5090
5091 flowtable->data.type = type;
5092 err = rhashtable_init(&flowtable->data.rhashtable, type->params);
5093 if (err < 0)
5094 goto err3;
5095
5096 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5097 flowtable);
5098 if (err < 0)
5099 goto err3;
5100
5101 for (i = 0; i < flowtable->ops_len; i++) {
5102 if (!flowtable->ops[i].dev)
5103 continue;
5104
5105 list_for_each_entry(ft, &table->flowtables, list) {
5106 for (k = 0; k < ft->ops_len; k++) {
5107 if (!ft->ops[k].dev)
5108 continue;
5109
5110 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5111 flowtable->ops[i].pf == ft->ops[k].pf) {
5112 err = -EBUSY;
5113 goto err4;
5114 }
5115 }
5116 }
5117
5118 err = nf_register_net_hook(net, &flowtable->ops[i]);
5119 if (err < 0)
5120 goto err4;
5121 }
5122
5123 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5124 if (err < 0)
5125 goto err5;
5126
5127 INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc);
5128 queue_delayed_work(system_power_efficient_wq,
5129 &flowtable->data.gc_work, HZ);
5130
5131 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5132 table->use++;
5133
5134 return 0;
5135err5:
5136 i = flowtable->ops_len;
5137err4:
5138 for (k = i - 1; k >= 0; k--)
5139 nf_unregister_net_hook(net, &flowtable->ops[i]);
5140
5141 kfree(flowtable->ops);
5142err3:
5143 module_put(type->owner);
5144err2:
5145 kfree(flowtable->name);
5146err1:
5147 kfree(flowtable);
5148 return err;
5149}
5150
5151static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5152 struct sk_buff *skb,
5153 const struct nlmsghdr *nlh,
5154 const struct nlattr * const nla[],
5155 struct netlink_ext_ack *extack)
5156{
5157 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5158 u8 genmask = nft_genmask_next(net);
5159 int family = nfmsg->nfgen_family;
5160 struct nft_flowtable *flowtable;
5161 struct nft_table *table;
5162 struct nft_ctx ctx;
5163
5164 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5165 (!nla[NFTA_FLOWTABLE_NAME] &&
5166 !nla[NFTA_FLOWTABLE_HANDLE]))
5167 return -EINVAL;
5168
5169 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
5170 family, genmask);
5171 if (IS_ERR(table))
5172 return PTR_ERR(table);
5173
5174 if (nla[NFTA_FLOWTABLE_HANDLE])
5175 flowtable = nf_tables_flowtable_lookup_byhandle(table,
5176 nla[NFTA_FLOWTABLE_HANDLE],
5177 genmask);
5178 else
5179 flowtable = nf_tables_flowtable_lookup(table,
5180 nla[NFTA_FLOWTABLE_NAME],
5181 genmask);
5182 if (IS_ERR(flowtable))
5183 return PTR_ERR(flowtable);
5184 if (flowtable->use > 0)
5185 return -EBUSY;
5186
5187 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5188
5189 return nft_delflowtable(&ctx, flowtable);
5190}
5191
5192static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5193 u32 portid, u32 seq, int event,
5194 u32 flags, int family,
5195 struct nft_flowtable *flowtable)
5196{
5197 struct nlattr *nest, *nest_devs;
5198 struct nfgenmsg *nfmsg;
5199 struct nlmsghdr *nlh;
5200 int i;
5201
5202 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5203 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5204 if (nlh == NULL)
5205 goto nla_put_failure;
5206
5207 nfmsg = nlmsg_data(nlh);
5208 nfmsg->nfgen_family = family;
5209 nfmsg->version = NFNETLINK_V0;
5210 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5211
5212 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5213 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
5214 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5215 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5216 NFTA_FLOWTABLE_PAD))
5217 goto nla_put_failure;
5218
5219 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5220 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5221 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5222 goto nla_put_failure;
5223
5224 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5225 if (!nest_devs)
5226 goto nla_put_failure;
5227
5228 for (i = 0; i < flowtable->ops_len; i++) {
5229 if (flowtable->ops[i].dev &&
5230 nla_put_string(skb, NFTA_DEVICE_NAME,
5231 flowtable->ops[i].dev->name))
5232 goto nla_put_failure;
5233 }
5234 nla_nest_end(skb, nest_devs);
5235 nla_nest_end(skb, nest);
5236
5237 nlmsg_end(skb, nlh);
5238 return 0;
5239
5240nla_put_failure:
5241 nlmsg_trim(skb, nlh);
5242 return -1;
5243}
5244
5245struct nft_flowtable_filter {
5246 char *table;
5247};
5248
5249static int nf_tables_dump_flowtable(struct sk_buff *skb,
5250 struct netlink_callback *cb)
5251{
5252 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5253 struct nft_flowtable_filter *filter = cb->data;
5254 unsigned int idx = 0, s_idx = cb->args[0];
5255 struct net *net = sock_net(skb->sk);
5256 int family = nfmsg->nfgen_family;
5257 struct nft_flowtable *flowtable;
5258 const struct nft_table *table;
5259
5260 rcu_read_lock();
5261 cb->seq = net->nft.base_seq;
5262
5263 list_for_each_entry_rcu(table, &net->nft.tables, list) {
5264 if (family != NFPROTO_UNSPEC && family != table->family)
5265 continue;
5266
5267 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5268 if (!nft_is_active(net, flowtable))
5269 goto cont;
5270 if (idx < s_idx)
5271 goto cont;
5272 if (idx > s_idx)
5273 memset(&cb->args[1], 0,
5274 sizeof(cb->args) - sizeof(cb->args[0]));
5275 if (filter && filter->table[0] &&
5276 strcmp(filter->table, table->name))
5277 goto cont;
5278
5279 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5280 cb->nlh->nlmsg_seq,
5281 NFT_MSG_NEWFLOWTABLE,
5282 NLM_F_MULTI | NLM_F_APPEND,
5283 table->family, flowtable) < 0)
5284 goto done;
5285
5286 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
5287cont:
5288 idx++;
5289 }
5290 }
5291done:
5292 rcu_read_unlock();
5293
5294 cb->args[0] = idx;
5295 return skb->len;
5296}
5297
5298static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
5299{
5300 struct nft_flowtable_filter *filter = cb->data;
5301
5302 if (!filter)
5303 return 0;
5304
5305 kfree(filter->table);
5306 kfree(filter);
5307
5308 return 0;
5309}
5310
5311static struct nft_flowtable_filter *
5312nft_flowtable_filter_alloc(const struct nlattr * const nla[])
5313{
5314 struct nft_flowtable_filter *filter;
5315
5316 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
5317 if (!filter)
5318 return ERR_PTR(-ENOMEM);
5319
5320 if (nla[NFTA_FLOWTABLE_TABLE]) {
5321 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5322 GFP_KERNEL);
5323 if (!filter->table) {
5324 kfree(filter);
5325 return ERR_PTR(-ENOMEM);
5326 }
5327 }
5328 return filter;
5329}
5330
5331static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5332 struct sk_buff *skb,
5333 const struct nlmsghdr *nlh,
5334 const struct nlattr * const nla[],
5335 struct netlink_ext_ack *extack)
5336{
5337 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5338 u8 genmask = nft_genmask_cur(net);
5339 int family = nfmsg->nfgen_family;
5340 struct nft_flowtable *flowtable;
5341 const struct nft_table *table;
5342 struct sk_buff *skb2;
5343 int err;
5344
5345 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5346 struct netlink_dump_control c = {
5347 .dump = nf_tables_dump_flowtable,
5348 .done = nf_tables_dump_flowtable_done,
5349 };
5350
5351 if (nla[NFTA_FLOWTABLE_TABLE]) {
5352 struct nft_flowtable_filter *filter;
5353
5354 filter = nft_flowtable_filter_alloc(nla);
5355 if (IS_ERR(filter))
5356 return -ENOMEM;
5357
5358 c.data = filter;
5359 }
5360 return netlink_dump_start(nlsk, skb, nlh, &c);
5361 }
5362
5363 if (!nla[NFTA_FLOWTABLE_NAME])
5364 return -EINVAL;
5365
5366 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
5367 family, genmask);
5368 if (IS_ERR(table))
5369 return PTR_ERR(table);
5370
5371 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5372 genmask);
5373 if (IS_ERR(flowtable))
5374 return PTR_ERR(flowtable);
5375
5376 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5377 if (!skb2)
5378 return -ENOMEM;
5379
5380 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5381 nlh->nlmsg_seq,
5382 NFT_MSG_NEWFLOWTABLE, 0, family,
5383 flowtable);
5384 if (err < 0)
5385 goto err;
5386
5387 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5388err:
5389 kfree_skb(skb2);
5390 return err;
5391}
5392
5393static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5394 struct nft_flowtable *flowtable,
5395 int event)
5396{
5397 struct sk_buff *skb;
5398 int err;
5399
5400 if (ctx->report &&
5401 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5402 return;
5403
5404 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5405 if (skb == NULL)
5406 goto err;
5407
5408 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5409 ctx->seq, event, 0,
5410 ctx->family, flowtable);
5411 if (err < 0) {
5412 kfree_skb(skb);
5413 goto err;
5414 }
5415
5416 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5417 ctx->report, GFP_KERNEL);
5418 return;
5419err:
5420 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5421}
5422
5423static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5424{
5425 cancel_delayed_work_sync(&flowtable->data.gc_work);
5426 kfree(flowtable->name);
5427 flowtable->data.type->free(&flowtable->data);
5428 rhashtable_destroy(&flowtable->data.rhashtable);
5429 module_put(flowtable->data.type->owner);
5430}
5431
5432static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5433 u32 portid, u32 seq)
5434{
5435 struct nlmsghdr *nlh;
5436 struct nfgenmsg *nfmsg;
5437 char buf[TASK_COMM_LEN];
5438 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
5439
5440 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5441 if (nlh == NULL)
5442 goto nla_put_failure;
5443
5444 nfmsg = nlmsg_data(nlh);
5445 nfmsg->nfgen_family = AF_UNSPEC;
5446 nfmsg->version = NFNETLINK_V0;
5447 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5448
5449 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5450 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5451 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
5452 goto nla_put_failure;
5453
5454 nlmsg_end(skb, nlh);
5455 return 0;
5456
5457nla_put_failure:
5458 nlmsg_trim(skb, nlh);
5459 return -EMSGSIZE;
5460}
5461
5462static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5463 struct nft_flowtable *flowtable)
5464{
5465 int i;
5466
5467 for (i = 0; i < flowtable->ops_len; i++) {
5468 if (flowtable->ops[i].dev != dev)
5469 continue;
5470
5471 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
5472 flowtable->ops[i].dev = NULL;
5473 break;
5474 }
5475}
5476
5477static int nf_tables_flowtable_event(struct notifier_block *this,
5478 unsigned long event, void *ptr)
5479{
5480 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5481 struct nft_flowtable *flowtable;
5482 struct nft_table *table;
5483
5484 if (event != NETDEV_UNREGISTER)
5485 return 0;
5486
5487 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5488 list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
5489 list_for_each_entry(flowtable, &table->flowtables, list) {
5490 nft_flowtable_event(event, dev, flowtable);
5491 }
5492 }
5493 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5494
5495 return NOTIFY_DONE;
5496}
5497
5498static struct notifier_block nf_tables_flowtable_notifier = {
5499 .notifier_call = nf_tables_flowtable_event,
5500};
5501
5502static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5503 int event)
5504{
5505 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5506 struct sk_buff *skb2;
5507 int err;
5508
5509 if (nlmsg_report(nlh) &&
5510 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5511 return;
5512
5513 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5514 if (skb2 == NULL)
5515 goto err;
5516
5517 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5518 nlh->nlmsg_seq);
5519 if (err < 0) {
5520 kfree_skb(skb2);
5521 goto err;
5522 }
5523
5524 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5525 nlmsg_report(nlh), GFP_KERNEL);
5526 return;
5527err:
5528 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5529 -ENOBUFS);
5530}
5531
5532static int nf_tables_getgen(struct net *net, struct sock *nlsk,
5533 struct sk_buff *skb, const struct nlmsghdr *nlh,
5534 const struct nlattr * const nla[],
5535 struct netlink_ext_ack *extack)
5536{
5537 struct sk_buff *skb2;
5538 int err;
5539
5540 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
5541 if (skb2 == NULL)
5542 return -ENOMEM;
5543
5544 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5545 nlh->nlmsg_seq);
5546 if (err < 0)
5547 goto err;
5548
5549 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5550err:
5551 kfree_skb(skb2);
5552 return err;
5553}
5554
5555static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
5556 [NFT_MSG_NEWTABLE] = {
5557 .call_batch = nf_tables_newtable,
5558 .attr_count = NFTA_TABLE_MAX,
5559 .policy = nft_table_policy,
5560 },
5561 [NFT_MSG_GETTABLE] = {
5562 .call = nf_tables_gettable,
5563 .attr_count = NFTA_TABLE_MAX,
5564 .policy = nft_table_policy,
5565 },
5566 [NFT_MSG_DELTABLE] = {
5567 .call_batch = nf_tables_deltable,
5568 .attr_count = NFTA_TABLE_MAX,
5569 .policy = nft_table_policy,
5570 },
5571 [NFT_MSG_NEWCHAIN] = {
5572 .call_batch = nf_tables_newchain,
5573 .attr_count = NFTA_CHAIN_MAX,
5574 .policy = nft_chain_policy,
5575 },
5576 [NFT_MSG_GETCHAIN] = {
5577 .call = nf_tables_getchain,
5578 .attr_count = NFTA_CHAIN_MAX,
5579 .policy = nft_chain_policy,
5580 },
5581 [NFT_MSG_DELCHAIN] = {
5582 .call_batch = nf_tables_delchain,
5583 .attr_count = NFTA_CHAIN_MAX,
5584 .policy = nft_chain_policy,
5585 },
5586 [NFT_MSG_NEWRULE] = {
5587 .call_batch = nf_tables_newrule,
5588 .attr_count = NFTA_RULE_MAX,
5589 .policy = nft_rule_policy,
5590 },
5591 [NFT_MSG_GETRULE] = {
5592 .call = nf_tables_getrule,
5593 .attr_count = NFTA_RULE_MAX,
5594 .policy = nft_rule_policy,
5595 },
5596 [NFT_MSG_DELRULE] = {
5597 .call_batch = nf_tables_delrule,
5598 .attr_count = NFTA_RULE_MAX,
5599 .policy = nft_rule_policy,
5600 },
5601 [NFT_MSG_NEWSET] = {
5602 .call_batch = nf_tables_newset,
5603 .attr_count = NFTA_SET_MAX,
5604 .policy = nft_set_policy,
5605 },
5606 [NFT_MSG_GETSET] = {
5607 .call = nf_tables_getset,
5608 .attr_count = NFTA_SET_MAX,
5609 .policy = nft_set_policy,
5610 },
5611 [NFT_MSG_DELSET] = {
5612 .call_batch = nf_tables_delset,
5613 .attr_count = NFTA_SET_MAX,
5614 .policy = nft_set_policy,
5615 },
5616 [NFT_MSG_NEWSETELEM] = {
5617 .call_batch = nf_tables_newsetelem,
5618 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5619 .policy = nft_set_elem_list_policy,
5620 },
5621 [NFT_MSG_GETSETELEM] = {
5622 .call = nf_tables_getsetelem,
5623 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5624 .policy = nft_set_elem_list_policy,
5625 },
5626 [NFT_MSG_DELSETELEM] = {
5627 .call_batch = nf_tables_delsetelem,
5628 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5629 .policy = nft_set_elem_list_policy,
5630 },
5631 [NFT_MSG_GETGEN] = {
5632 .call = nf_tables_getgen,
5633 },
5634 [NFT_MSG_NEWOBJ] = {
5635 .call_batch = nf_tables_newobj,
5636 .attr_count = NFTA_OBJ_MAX,
5637 .policy = nft_obj_policy,
5638 },
5639 [NFT_MSG_GETOBJ] = {
5640 .call = nf_tables_getobj,
5641 .attr_count = NFTA_OBJ_MAX,
5642 .policy = nft_obj_policy,
5643 },
5644 [NFT_MSG_DELOBJ] = {
5645 .call_batch = nf_tables_delobj,
5646 .attr_count = NFTA_OBJ_MAX,
5647 .policy = nft_obj_policy,
5648 },
5649 [NFT_MSG_GETOBJ_RESET] = {
5650 .call = nf_tables_getobj,
5651 .attr_count = NFTA_OBJ_MAX,
5652 .policy = nft_obj_policy,
5653 },
5654 [NFT_MSG_NEWFLOWTABLE] = {
5655 .call_batch = nf_tables_newflowtable,
5656 .attr_count = NFTA_FLOWTABLE_MAX,
5657 .policy = nft_flowtable_policy,
5658 },
5659 [NFT_MSG_GETFLOWTABLE] = {
5660 .call = nf_tables_getflowtable,
5661 .attr_count = NFTA_FLOWTABLE_MAX,
5662 .policy = nft_flowtable_policy,
5663 },
5664 [NFT_MSG_DELFLOWTABLE] = {
5665 .call_batch = nf_tables_delflowtable,
5666 .attr_count = NFTA_FLOWTABLE_MAX,
5667 .policy = nft_flowtable_policy,
5668 },
5669};
5670
5671static void nft_chain_commit_update(struct nft_trans *trans)
5672{
5673 struct nft_base_chain *basechain;
5674
5675 if (nft_trans_chain_name(trans))
5676 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
5677
5678 if (!nft_is_base_chain(trans->ctx.chain))
5679 return;
5680
5681 basechain = nft_base_chain(trans->ctx.chain);
5682 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5683
5684 switch (nft_trans_chain_policy(trans)) {
5685 case NF_DROP:
5686 case NF_ACCEPT:
5687 basechain->policy = nft_trans_chain_policy(trans);
5688 break;
5689 }
5690}
5691
5692static void nf_tables_commit_release(struct nft_trans *trans)
5693{
5694 switch (trans->msg_type) {
5695 case NFT_MSG_DELTABLE:
5696 nf_tables_table_destroy(&trans->ctx);
5697 break;
5698 case NFT_MSG_DELCHAIN:
5699 nf_tables_chain_destroy(trans->ctx.chain);
5700 break;
5701 case NFT_MSG_DELRULE:
5702 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5703 break;
5704 case NFT_MSG_DELSET:
5705 nft_set_destroy(nft_trans_set(trans));
5706 break;
5707 case NFT_MSG_DELSETELEM:
5708 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
5709 nft_trans_elem(trans).priv);
5710 break;
5711 case NFT_MSG_DELOBJ:
5712 nft_obj_destroy(nft_trans_obj(trans));
5713 break;
5714 case NFT_MSG_DELFLOWTABLE:
5715 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5716 break;
5717 }
5718 kfree(trans);
5719}
5720
5721static int nf_tables_commit(struct net *net, struct sk_buff *skb)
5722{
5723 struct nft_trans *trans, *next;
5724 struct nft_trans_elem *te;
5725
5726 /* Bump generation counter, invalidate any dump in progress */
5727 while (++net->nft.base_seq == 0);
5728
5729 /* A new generation has just started */
5730 net->nft.gencursor = nft_gencursor_next(net);
5731
5732 /* Make sure all packets have left the previous generation before
5733 * purging old rules.
5734 */
5735 synchronize_rcu();
5736
5737 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
5738 switch (trans->msg_type) {
5739 case NFT_MSG_NEWTABLE:
5740 if (nft_trans_table_update(trans)) {
5741 if (!nft_trans_table_enable(trans)) {
5742 nf_tables_table_disable(net,
5743 trans->ctx.table);
5744 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5745 }
5746 } else {
5747 nft_clear(net, trans->ctx.table);
5748 }
5749 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
5750 nft_trans_destroy(trans);
5751 break;
5752 case NFT_MSG_DELTABLE:
5753 list_del_rcu(&trans->ctx.table->list);
5754 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
5755 break;
5756 case NFT_MSG_NEWCHAIN:
5757 if (nft_trans_chain_update(trans))
5758 nft_chain_commit_update(trans);
5759 else
5760 nft_clear(net, trans->ctx.chain);
5761
5762 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
5763 nft_trans_destroy(trans);
5764 break;
5765 case NFT_MSG_DELCHAIN:
5766 list_del_rcu(&trans->ctx.chain->list);
5767 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
5768 nf_tables_unregister_hook(trans->ctx.net,
5769 trans->ctx.table,
5770 trans->ctx.chain);
5771 break;
5772 case NFT_MSG_NEWRULE:
5773 nft_clear(trans->ctx.net, nft_trans_rule(trans));
5774 nf_tables_rule_notify(&trans->ctx,
5775 nft_trans_rule(trans),
5776 NFT_MSG_NEWRULE);
5777 nft_trans_destroy(trans);
5778 break;
5779 case NFT_MSG_DELRULE:
5780 list_del_rcu(&nft_trans_rule(trans)->list);
5781 nf_tables_rule_notify(&trans->ctx,
5782 nft_trans_rule(trans),
5783 NFT_MSG_DELRULE);
5784 break;
5785 case NFT_MSG_NEWSET:
5786 nft_clear(net, nft_trans_set(trans));
5787 /* This avoids hitting -EBUSY when deleting the table
5788 * from the transaction.
5789 */
5790 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
5791 !list_empty(&nft_trans_set(trans)->bindings))
5792 trans->ctx.table->use--;
5793
5794 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
5795 NFT_MSG_NEWSET, GFP_KERNEL);
5796 nft_trans_destroy(trans);
5797 break;
5798 case NFT_MSG_DELSET:
5799 list_del_rcu(&nft_trans_set(trans)->list);
5800 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
5801 NFT_MSG_DELSET, GFP_KERNEL);
5802 break;
5803 case NFT_MSG_NEWSETELEM:
5804 te = (struct nft_trans_elem *)trans->data;
5805
5806 te->set->ops->activate(net, te->set, &te->elem);
5807 nf_tables_setelem_notify(&trans->ctx, te->set,
5808 &te->elem,
5809 NFT_MSG_NEWSETELEM, 0);
5810 nft_trans_destroy(trans);
5811 break;
5812 case NFT_MSG_DELSETELEM:
5813 te = (struct nft_trans_elem *)trans->data;
5814
5815 nf_tables_setelem_notify(&trans->ctx, te->set,
5816 &te->elem,
5817 NFT_MSG_DELSETELEM, 0);
5818 te->set->ops->remove(net, te->set, &te->elem);
5819 atomic_dec(&te->set->nelems);
5820 te->set->ndeact--;
5821 break;
5822 case NFT_MSG_NEWOBJ:
5823 nft_clear(net, nft_trans_obj(trans));
5824 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5825 NFT_MSG_NEWOBJ);
5826 nft_trans_destroy(trans);
5827 break;
5828 case NFT_MSG_DELOBJ:
5829 list_del_rcu(&nft_trans_obj(trans)->list);
5830 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5831 NFT_MSG_DELOBJ);
5832 break;
5833 case NFT_MSG_NEWFLOWTABLE:
5834 nft_clear(net, nft_trans_flowtable(trans));
5835 nf_tables_flowtable_notify(&trans->ctx,
5836 nft_trans_flowtable(trans),
5837 NFT_MSG_NEWFLOWTABLE);
5838 nft_trans_destroy(trans);
5839 break;
5840 case NFT_MSG_DELFLOWTABLE:
5841 list_del_rcu(&nft_trans_flowtable(trans)->list);
5842 nf_tables_flowtable_notify(&trans->ctx,
5843 nft_trans_flowtable(trans),
5844 NFT_MSG_DELFLOWTABLE);
5845 nft_unregister_flowtable_net_hooks(net,
5846 nft_trans_flowtable(trans));
5847 break;
5848 }
5849 }
5850
5851 synchronize_rcu();
5852
5853 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
5854 list_del(&trans->list);
5855 nf_tables_commit_release(trans);
5856 }
5857
5858 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
5859
5860 return 0;
5861}
5862
5863static void nf_tables_abort_release(struct nft_trans *trans)
5864{
5865 switch (trans->msg_type) {
5866 case NFT_MSG_NEWTABLE:
5867 nf_tables_table_destroy(&trans->ctx);
5868 break;
5869 case NFT_MSG_NEWCHAIN:
5870 nf_tables_chain_destroy(trans->ctx.chain);
5871 break;
5872 case NFT_MSG_NEWRULE:
5873 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5874 break;
5875 case NFT_MSG_NEWSET:
5876 nft_set_destroy(nft_trans_set(trans));
5877 break;
5878 case NFT_MSG_NEWSETELEM:
5879 nft_set_elem_destroy(nft_trans_elem_set(trans),
5880 nft_trans_elem(trans).priv, true);
5881 break;
5882 case NFT_MSG_NEWOBJ:
5883 nft_obj_destroy(nft_trans_obj(trans));
5884 break;
5885 case NFT_MSG_NEWFLOWTABLE:
5886 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
5887 break;
5888 }
5889 kfree(trans);
5890}
5891
5892static int nf_tables_abort(struct net *net, struct sk_buff *skb)
5893{
5894 struct nft_trans *trans, *next;
5895 struct nft_trans_elem *te;
5896
5897 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
5898 list) {
5899 switch (trans->msg_type) {
5900 case NFT_MSG_NEWTABLE:
5901 if (nft_trans_table_update(trans)) {
5902 if (nft_trans_table_enable(trans)) {
5903 nf_tables_table_disable(net,
5904 trans->ctx.table);
5905 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5906 }
5907 nft_trans_destroy(trans);
5908 } else {
5909 list_del_rcu(&trans->ctx.table->list);
5910 }
5911 break;
5912 case NFT_MSG_DELTABLE:
5913 nft_clear(trans->ctx.net, trans->ctx.table);
5914 nft_trans_destroy(trans);
5915 break;
5916 case NFT_MSG_NEWCHAIN:
5917 if (nft_trans_chain_update(trans)) {
5918 free_percpu(nft_trans_chain_stats(trans));
5919
5920 nft_trans_destroy(trans);
5921 } else {
5922 trans->ctx.table->use--;
5923 list_del_rcu(&trans->ctx.chain->list);
5924 nf_tables_unregister_hook(trans->ctx.net,
5925 trans->ctx.table,
5926 trans->ctx.chain);
5927 }
5928 break;
5929 case NFT_MSG_DELCHAIN:
5930 trans->ctx.table->use++;
5931 nft_clear(trans->ctx.net, trans->ctx.chain);
5932 nft_trans_destroy(trans);
5933 break;
5934 case NFT_MSG_NEWRULE:
5935 trans->ctx.chain->use--;
5936 list_del_rcu(&nft_trans_rule(trans)->list);
5937 break;
5938 case NFT_MSG_DELRULE:
5939 trans->ctx.chain->use++;
5940 nft_clear(trans->ctx.net, nft_trans_rule(trans));
5941 nft_trans_destroy(trans);
5942 break;
5943 case NFT_MSG_NEWSET:
5944 trans->ctx.table->use--;
5945 list_del_rcu(&nft_trans_set(trans)->list);
5946 break;
5947 case NFT_MSG_DELSET:
5948 trans->ctx.table->use++;
5949 nft_clear(trans->ctx.net, nft_trans_set(trans));
5950 nft_trans_destroy(trans);
5951 break;
5952 case NFT_MSG_NEWSETELEM:
5953 te = (struct nft_trans_elem *)trans->data;
5954
5955 te->set->ops->remove(net, te->set, &te->elem);
5956 atomic_dec(&te->set->nelems);
5957 break;
5958 case NFT_MSG_DELSETELEM:
5959 te = (struct nft_trans_elem *)trans->data;
5960
5961 nft_set_elem_activate(net, te->set, &te->elem);
5962 te->set->ops->activate(net, te->set, &te->elem);
5963 te->set->ndeact--;
5964
5965 nft_trans_destroy(trans);
5966 break;
5967 case NFT_MSG_NEWOBJ:
5968 trans->ctx.table->use--;
5969 list_del_rcu(&nft_trans_obj(trans)->list);
5970 break;
5971 case NFT_MSG_DELOBJ:
5972 trans->ctx.table->use++;
5973 nft_clear(trans->ctx.net, nft_trans_obj(trans));
5974 nft_trans_destroy(trans);
5975 break;
5976 case NFT_MSG_NEWFLOWTABLE:
5977 trans->ctx.table->use--;
5978 list_del_rcu(&nft_trans_flowtable(trans)->list);
5979 nft_unregister_flowtable_net_hooks(net,
5980 nft_trans_flowtable(trans));
5981 break;
5982 case NFT_MSG_DELFLOWTABLE:
5983 trans->ctx.table->use++;
5984 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
5985 nft_trans_destroy(trans);
5986 break;
5987 }
5988 }
5989
5990 synchronize_rcu();
5991
5992 list_for_each_entry_safe_reverse(trans, next,
5993 &net->nft.commit_list, list) {
5994 list_del(&trans->list);
5995 nf_tables_abort_release(trans);
5996 }
5997
5998 return 0;
5999}
6000
6001static bool nf_tables_valid_genid(struct net *net, u32 genid)
6002{
6003 return net->nft.base_seq == genid;
6004}
6005
6006static const struct nfnetlink_subsystem nf_tables_subsys = {
6007 .name = "nf_tables",
6008 .subsys_id = NFNL_SUBSYS_NFTABLES,
6009 .cb_count = NFT_MSG_MAX,
6010 .cb = nf_tables_cb,
6011 .commit = nf_tables_commit,
6012 .abort = nf_tables_abort,
6013 .valid_genid = nf_tables_valid_genid,
6014};
6015
6016int nft_chain_validate_dependency(const struct nft_chain *chain,
6017 enum nft_chain_type type)
6018{
6019 const struct nft_base_chain *basechain;
6020
6021 if (nft_is_base_chain(chain)) {
6022 basechain = nft_base_chain(chain);
6023 if (basechain->type->type != type)
6024 return -EOPNOTSUPP;
6025 }
6026 return 0;
6027}
6028EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6029
6030int nft_chain_validate_hooks(const struct nft_chain *chain,
6031 unsigned int hook_flags)
6032{
6033 struct nft_base_chain *basechain;
6034
6035 if (nft_is_base_chain(chain)) {
6036 basechain = nft_base_chain(chain);
6037
6038 if ((1 << basechain->ops.hooknum) & hook_flags)
6039 return 0;
6040
6041 return -EOPNOTSUPP;
6042 }
6043
6044 return 0;
6045}
6046EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6047
6048/*
6049 * Loop detection - walk through the ruleset beginning at the destination chain
6050 * of a new jump until either the source chain is reached (loop) or all
6051 * reachable chains have been traversed.
6052 *
6053 * The loop check is performed whenever a new jump verdict is added to an
6054 * expression or verdict map or a verdict map is bound to a new chain.
6055 */
6056
6057static int nf_tables_check_loops(const struct nft_ctx *ctx,
6058 const struct nft_chain *chain);
6059
6060static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
6061 struct nft_set *set,
6062 const struct nft_set_iter *iter,
6063 struct nft_set_elem *elem)
6064{
6065 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6066 const struct nft_data *data;
6067
6068 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6069 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
6070 return 0;
6071
6072 data = nft_set_ext_data(ext);
6073 switch (data->verdict.code) {
6074 case NFT_JUMP:
6075 case NFT_GOTO:
6076 return nf_tables_check_loops(ctx, data->verdict.chain);
6077 default:
6078 return 0;
6079 }
6080}
6081
6082static int nf_tables_check_loops(const struct nft_ctx *ctx,
6083 const struct nft_chain *chain)
6084{
6085 const struct nft_rule *rule;
6086 const struct nft_expr *expr, *last;
6087 struct nft_set *set;
6088 struct nft_set_binding *binding;
6089 struct nft_set_iter iter;
6090
6091 if (ctx->chain == chain)
6092 return -ELOOP;
6093
6094 list_for_each_entry(rule, &chain->rules, list) {
6095 nft_rule_for_each_expr(expr, last, rule) {
6096 const struct nft_data *data = NULL;
6097 int err;
6098
6099 if (!expr->ops->validate)
6100 continue;
6101
6102 err = expr->ops->validate(ctx, expr, &data);
6103 if (err < 0)
6104 return err;
6105
6106 if (data == NULL)
6107 continue;
6108
6109 switch (data->verdict.code) {
6110 case NFT_JUMP:
6111 case NFT_GOTO:
6112 err = nf_tables_check_loops(ctx,
6113 data->verdict.chain);
6114 if (err < 0)
6115 return err;
6116 default:
6117 break;
6118 }
6119 }
6120 }
6121
6122 list_for_each_entry(set, &ctx->table->sets, list) {
6123 if (!nft_is_active_next(ctx->net, set))
6124 continue;
6125 if (!(set->flags & NFT_SET_MAP) ||
6126 set->dtype != NFT_DATA_VERDICT)
6127 continue;
6128
6129 list_for_each_entry(binding, &set->bindings, list) {
6130 if (!(binding->flags & NFT_SET_MAP) ||
6131 binding->chain != chain)
6132 continue;
6133
6134 iter.genmask = nft_genmask_next(ctx->net);
6135 iter.skip = 0;
6136 iter.count = 0;
6137 iter.err = 0;
6138 iter.fn = nf_tables_loop_check_setelem;
6139
6140 set->ops->walk(ctx, set, &iter);
6141 if (iter.err < 0)
6142 return iter.err;
6143 }
6144 }
6145
6146 return 0;
6147}
6148
6149/**
6150 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6151 *
6152 * @attr: netlink attribute to fetch value from
6153 * @max: maximum value to be stored in dest
6154 * @dest: pointer to the variable
6155 *
6156 * Parse, check and store a given u32 netlink attribute into variable.
6157 * This function returns -ERANGE if the value goes over maximum value.
6158 * Otherwise a 0 is returned and the attribute value is stored in the
6159 * destination variable.
6160 */
6161int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
6162{
6163 u32 val;
6164
6165 val = ntohl(nla_get_be32(attr));
6166 if (val > max)
6167 return -ERANGE;
6168
6169 *dest = val;
6170 return 0;
6171}
6172EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6173
6174/**
6175 * nft_parse_register - parse a register value from a netlink attribute
6176 *
6177 * @attr: netlink attribute
6178 *
6179 * Parse and translate a register value from a netlink attribute.
6180 * Registers used to be 128 bit wide, these register numbers will be
6181 * mapped to the corresponding 32 bit register numbers.
6182 */
6183unsigned int nft_parse_register(const struct nlattr *attr)
6184{
6185 unsigned int reg;
6186
6187 reg = ntohl(nla_get_be32(attr));
6188 switch (reg) {
6189 case NFT_REG_VERDICT...NFT_REG_4:
6190 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6191 default:
6192 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6193 }
6194}
6195EXPORT_SYMBOL_GPL(nft_parse_register);
6196
6197/**
6198 * nft_dump_register - dump a register value to a netlink attribute
6199 *
6200 * @skb: socket buffer
6201 * @attr: attribute number
6202 * @reg: register number
6203 *
6204 * Construct a netlink attribute containing the register number. For
6205 * compatibility reasons, register numbers being a multiple of 4 are
6206 * translated to the corresponding 128 bit register numbers.
6207 */
6208int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6209{
6210 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6211 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6212 else
6213 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6214
6215 return nla_put_be32(skb, attr, htonl(reg));
6216}
6217EXPORT_SYMBOL_GPL(nft_dump_register);
6218
6219/**
6220 * nft_validate_register_load - validate a load from a register
6221 *
6222 * @reg: the register number
6223 * @len: the length of the data
6224 *
6225 * Validate that the input register is one of the general purpose
6226 * registers and that the length of the load is within the bounds.
6227 */
6228int nft_validate_register_load(enum nft_registers reg, unsigned int len)
6229{
6230 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
6231 return -EINVAL;
6232 if (len == 0)
6233 return -EINVAL;
6234 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
6235 return -ERANGE;
6236
6237 return 0;
6238}
6239EXPORT_SYMBOL_GPL(nft_validate_register_load);
6240
6241/**
6242 * nft_validate_register_store - validate an expressions' register store
6243 *
6244 * @ctx: context of the expression performing the load
6245 * @reg: the destination register number
6246 * @data: the data to load
6247 * @type: the data type
6248 * @len: the length of the data
6249 *
6250 * Validate that a data load uses the appropriate data type for
6251 * the destination register and the length is within the bounds.
6252 * A value of NULL for the data means that its runtime gathered
6253 * data.
6254 */
6255int nft_validate_register_store(const struct nft_ctx *ctx,
6256 enum nft_registers reg,
6257 const struct nft_data *data,
6258 enum nft_data_types type, unsigned int len)
6259{
6260 int err;
6261
6262 switch (reg) {
6263 case NFT_REG_VERDICT:
6264 if (type != NFT_DATA_VERDICT)
6265 return -EINVAL;
6266
6267 if (data != NULL &&
6268 (data->verdict.code == NFT_GOTO ||
6269 data->verdict.code == NFT_JUMP)) {
6270 err = nf_tables_check_loops(ctx, data->verdict.chain);
6271 if (err < 0)
6272 return err;
6273
6274 if (ctx->chain->level + 1 >
6275 data->verdict.chain->level) {
6276 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
6277 return -EMLINK;
6278 data->verdict.chain->level = ctx->chain->level + 1;
6279 }
6280 }
6281
6282 return 0;
6283 default:
6284 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
6285 return -EINVAL;
6286 if (len == 0)
6287 return -EINVAL;
6288 if (reg * NFT_REG32_SIZE + len >
6289 FIELD_SIZEOF(struct nft_regs, data))
6290 return -ERANGE;
6291
6292 if (data != NULL && type != NFT_DATA_VALUE)
6293 return -EINVAL;
6294 return 0;
6295 }
6296}
6297EXPORT_SYMBOL_GPL(nft_validate_register_store);
6298
6299static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
6300 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
6301 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
6302 .len = NFT_CHAIN_MAXNAMELEN - 1 },
6303};
6304
6305static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
6306 struct nft_data_desc *desc, const struct nlattr *nla)
6307{
6308 u8 genmask = nft_genmask_next(ctx->net);
6309 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
6310 struct nft_chain *chain;
6311 int err;
6312
6313 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
6314 NULL);
6315 if (err < 0)
6316 return err;
6317
6318 if (!tb[NFTA_VERDICT_CODE])
6319 return -EINVAL;
6320 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
6321
6322 switch (data->verdict.code) {
6323 default:
6324 switch (data->verdict.code & NF_VERDICT_MASK) {
6325 case NF_ACCEPT:
6326 case NF_DROP:
6327 case NF_QUEUE:
6328 break;
6329 default:
6330 return -EINVAL;
6331 }
6332 /* fall through */
6333 case NFT_CONTINUE:
6334 case NFT_BREAK:
6335 case NFT_RETURN:
6336 break;
6337 case NFT_JUMP:
6338 case NFT_GOTO:
6339 if (!tb[NFTA_VERDICT_CHAIN])
6340 return -EINVAL;
6341 chain = nf_tables_chain_lookup(ctx->table,
6342 tb[NFTA_VERDICT_CHAIN], genmask);
6343 if (IS_ERR(chain))
6344 return PTR_ERR(chain);
6345 if (nft_is_base_chain(chain))
6346 return -EOPNOTSUPP;
6347
6348 chain->use++;
6349 data->verdict.chain = chain;
6350 break;
6351 }
6352
6353 desc->len = sizeof(data->verdict);
6354 desc->type = NFT_DATA_VERDICT;
6355 return 0;
6356}
6357
6358static void nft_verdict_uninit(const struct nft_data *data)
6359{
6360 switch (data->verdict.code) {
6361 case NFT_JUMP:
6362 case NFT_GOTO:
6363 data->verdict.chain->use--;
6364 break;
6365 }
6366}
6367
6368int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
6369{
6370 struct nlattr *nest;
6371
6372 nest = nla_nest_start(skb, type);
6373 if (!nest)
6374 goto nla_put_failure;
6375
6376 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
6377 goto nla_put_failure;
6378
6379 switch (v->code) {
6380 case NFT_JUMP:
6381 case NFT_GOTO:
6382 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
6383 v->chain->name))
6384 goto nla_put_failure;
6385 }
6386 nla_nest_end(skb, nest);
6387 return 0;
6388
6389nla_put_failure:
6390 return -1;
6391}
6392
6393static int nft_value_init(const struct nft_ctx *ctx,
6394 struct nft_data *data, unsigned int size,
6395 struct nft_data_desc *desc, const struct nlattr *nla)
6396{
6397 unsigned int len;
6398
6399 len = nla_len(nla);
6400 if (len == 0)
6401 return -EINVAL;
6402 if (len > size)
6403 return -EOVERFLOW;
6404
6405 nla_memcpy(data->data, nla, len);
6406 desc->type = NFT_DATA_VALUE;
6407 desc->len = len;
6408 return 0;
6409}
6410
6411static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
6412 unsigned int len)
6413{
6414 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
6415}
6416
6417static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
6418 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
6419 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
6420};
6421
6422/**
6423 * nft_data_init - parse nf_tables data netlink attributes
6424 *
6425 * @ctx: context of the expression using the data
6426 * @data: destination struct nft_data
6427 * @size: maximum data length
6428 * @desc: data description
6429 * @nla: netlink attribute containing data
6430 *
6431 * Parse the netlink data attributes and initialize a struct nft_data.
6432 * The type and length of data are returned in the data description.
6433 *
6434 * The caller can indicate that it only wants to accept data of type
6435 * NFT_DATA_VALUE by passing NULL for the ctx argument.
6436 */
6437int nft_data_init(const struct nft_ctx *ctx,
6438 struct nft_data *data, unsigned int size,
6439 struct nft_data_desc *desc, const struct nlattr *nla)
6440{
6441 struct nlattr *tb[NFTA_DATA_MAX + 1];
6442 int err;
6443
6444 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
6445 if (err < 0)
6446 return err;
6447
6448 if (tb[NFTA_DATA_VALUE])
6449 return nft_value_init(ctx, data, size, desc,
6450 tb[NFTA_DATA_VALUE]);
6451 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
6452 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
6453 return -EINVAL;
6454}
6455EXPORT_SYMBOL_GPL(nft_data_init);
6456
6457/**
6458 * nft_data_release - release a nft_data item
6459 *
6460 * @data: struct nft_data to release
6461 * @type: type of data
6462 *
6463 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6464 * all others need to be released by calling this function.
6465 */
6466void nft_data_release(const struct nft_data *data, enum nft_data_types type)
6467{
6468 if (type < NFT_DATA_VERDICT)
6469 return;
6470 switch (type) {
6471 case NFT_DATA_VERDICT:
6472 return nft_verdict_uninit(data);
6473 default:
6474 WARN_ON(1);
6475 }
6476}
6477EXPORT_SYMBOL_GPL(nft_data_release);
6478
6479int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
6480 enum nft_data_types type, unsigned int len)
6481{
6482 struct nlattr *nest;
6483 int err;
6484
6485 nest = nla_nest_start(skb, attr);
6486 if (nest == NULL)
6487 return -1;
6488
6489 switch (type) {
6490 case NFT_DATA_VALUE:
6491 err = nft_value_dump(skb, data, len);
6492 break;
6493 case NFT_DATA_VERDICT:
6494 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
6495 break;
6496 default:
6497 err = -EINVAL;
6498 WARN_ON(1);
6499 }
6500
6501 nla_nest_end(skb, nest);
6502 return err;
6503}
6504EXPORT_SYMBOL_GPL(nft_data_dump);
6505
6506int __nft_release_basechain(struct nft_ctx *ctx)
6507{
6508 struct nft_rule *rule, *nr;
6509
6510 BUG_ON(!nft_is_base_chain(ctx->chain));
6511
6512 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
6513 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6514 list_del(&rule->list);
6515 ctx->chain->use--;
6516 nf_tables_rule_destroy(ctx, rule);
6517 }
6518 list_del(&ctx->chain->list);
6519 ctx->table->use--;
6520 nf_tables_chain_destroy(ctx->chain);
6521
6522 return 0;
6523}
6524EXPORT_SYMBOL_GPL(__nft_release_basechain);
6525
6526static void __nft_release_tables(struct net *net)
6527{
6528 struct nft_flowtable *flowtable, *nf;
6529 struct nft_table *table, *nt;
6530 struct nft_chain *chain, *nc;
6531 struct nft_object *obj, *ne;
6532 struct nft_rule *rule, *nr;
6533 struct nft_set *set, *ns;
6534 struct nft_ctx ctx = {
6535 .net = net,
6536 };
6537
6538 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
6539 ctx.family = table->family;
6540
6541 list_for_each_entry(chain, &table->chains, list)
6542 nf_tables_unregister_hook(net, table, chain);
6543 list_for_each_entry(flowtable, &table->flowtables, list)
6544 nf_unregister_net_hooks(net, flowtable->ops,
6545 flowtable->ops_len);
6546 /* No packets are walking on these chains anymore. */
6547 ctx.table = table;
6548 list_for_each_entry(chain, &table->chains, list) {
6549 ctx.chain = chain;
6550 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
6551 list_del(&rule->list);
6552 chain->use--;
6553 nf_tables_rule_destroy(&ctx, rule);
6554 }
6555 }
6556 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
6557 list_del(&flowtable->list);
6558 table->use--;
6559 nf_tables_flowtable_destroy(flowtable);
6560 }
6561 list_for_each_entry_safe(set, ns, &table->sets, list) {
6562 list_del(&set->list);
6563 table->use--;
6564 nft_set_destroy(set);
6565 }
6566 list_for_each_entry_safe(obj, ne, &table->objects, list) {
6567 list_del(&obj->list);
6568 table->use--;
6569 nft_obj_destroy(obj);
6570 }
6571 list_for_each_entry_safe(chain, nc, &table->chains, list) {
6572 list_del(&chain->list);
6573 table->use--;
6574 nf_tables_chain_destroy(chain);
6575 }
6576 list_del(&table->list);
6577 nf_tables_table_destroy(&ctx);
6578 }
6579}
6580
6581static int __net_init nf_tables_init_net(struct net *net)
6582{
6583 INIT_LIST_HEAD(&net->nft.tables);
6584 INIT_LIST_HEAD(&net->nft.commit_list);
6585 net->nft.base_seq = 1;
6586 return 0;
6587}
6588
6589static void __net_exit nf_tables_exit_net(struct net *net)
6590{
6591 __nft_release_tables(net);
6592 WARN_ON_ONCE(!list_empty(&net->nft.tables));
6593 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
6594}
6595
6596static struct pernet_operations nf_tables_net_ops = {
6597 .init = nf_tables_init_net,
6598 .exit = nf_tables_exit_net,
6599};
6600
6601static int __init nf_tables_module_init(void)
6602{
6603 int err;
6604
6605 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
6606 GFP_KERNEL);
6607 if (info == NULL) {
6608 err = -ENOMEM;
6609 goto err1;
6610 }
6611
6612 err = nf_tables_core_module_init();
6613 if (err < 0)
6614 goto err2;
6615
6616 err = nfnetlink_subsys_register(&nf_tables_subsys);
6617 if (err < 0)
6618 goto err3;
6619
6620 register_netdevice_notifier(&nf_tables_flowtable_notifier);
6621
6622 return register_pernet_subsys(&nf_tables_net_ops);
6623err3:
6624 nf_tables_core_module_exit();
6625err2:
6626 kfree(info);
6627err1:
6628 return err;
6629}
6630
6631static void __exit nf_tables_module_exit(void)
6632{
6633 unregister_pernet_subsys(&nf_tables_net_ops);
6634 nfnetlink_subsys_unregister(&nf_tables_subsys);
6635 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
6636 rcu_barrier();
6637 nf_tables_core_module_exit();
6638 kfree(info);
6639}
6640
6641module_init(nf_tables_module_init);
6642module_exit(nf_tables_module_exit);
6643
6644MODULE_LICENSE("GPL");
6645MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
6646MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Ubuntu Hirsute Linux kernel mirror