]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/netfilter/nf_tables_api.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:


6e72ae341fda1952e895e31ac54345e78459fd35
[mirror_ubuntu-bionic-kernel.git] / net / netfilter / nf_tables_api.c
1 /*
2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/list.h>
14 #include <linux/skbuff.h>
15 #include <linux/netlink.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter/nfnetlink.h>
19 #include <linux/netfilter/nf_tables.h>
20 #include <net/netfilter/nf_tables_core.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/net_namespace.h>
23 #include <net/sock.h>
24
25 static LIST_HEAD(nf_tables_expressions);
26 static LIST_HEAD(nf_tables_objects);
27
28 /**
29 * nft_register_afinfo - register nf_tables address family info
30 *
31 * @afi: address family info to register
32 *
33 * Register the address family for use with nf_tables. Returns zero on
34 * success or a negative errno code otherwise.
35 */
36 int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
37 {
38 INIT_LIST_HEAD(&afi->tables);
39 nfnl_lock(NFNL_SUBSYS_NFTABLES);
40 list_add_tail_rcu(&afi->list, &net->nft.af_info);
41 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
42 return 0;
43 }
44 EXPORT_SYMBOL_GPL(nft_register_afinfo);
45
46 static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi);
47
48 /**
49 * nft_unregister_afinfo - unregister nf_tables address family info
50 *
51 * @afi: address family info to unregister
52 *
53 * Unregister the address family for use with nf_tables.
54 */
55 void nft_unregister_afinfo(struct net *net, struct nft_af_info *afi)
56 {
57 nfnl_lock(NFNL_SUBSYS_NFTABLES);
58 __nft_release_afinfo(net, afi);
59 list_del_rcu(&afi->list);
60 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
61 }
62 EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
63
64 static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
65 {
66 struct nft_af_info *afi;
67
68 list_for_each_entry(afi, &net->nft.af_info, list) {
69 if (afi->family == family)
70 return afi;
71 }
72 return NULL;
73 }
74
75 static struct nft_af_info *
76 nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
77 {
78 struct nft_af_info *afi;
79
80 afi = nft_afinfo_lookup(net, family);
81 if (afi != NULL)
82 return afi;
83 #ifdef CONFIG_MODULES
84 if (autoload) {
85 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
86 request_module("nft-afinfo-%u", family);
87 nfnl_lock(NFNL_SUBSYS_NFTABLES);
88 afi = nft_afinfo_lookup(net, family);
89 if (afi != NULL)
90 return ERR_PTR(-EAGAIN);
91 }
92 #endif
93 return ERR_PTR(-EAFNOSUPPORT);
94 }
95
96 static void nft_ctx_init(struct nft_ctx *ctx,
97 struct net *net,
98 const struct sk_buff *skb,
99 const struct nlmsghdr *nlh,
100 struct nft_af_info *afi,
101 struct nft_table *table,
102 struct nft_chain *chain,
103 const struct nlattr * const *nla)
104 {
105 ctx->net = net;
106 ctx->afi = afi;
107 ctx->table = table;
108 ctx->chain = chain;
109 ctx->nla = nla;
110 ctx->portid = NETLINK_CB(skb).portid;
111 ctx->report = nlmsg_report(nlh);
112 ctx->seq = nlh->nlmsg_seq;
113 }
114
115 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
116 int msg_type, u32 size, gfp_t gfp)
117 {
118 struct nft_trans *trans;
119
120 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
121 if (trans == NULL)
122 return NULL;
123
124 trans->msg_type = msg_type;
125 trans->ctx = *ctx;
126
127 return trans;
128 }
129
130 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
131 int msg_type, u32 size)
132 {
133 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
134 }
135
136 static void nft_trans_destroy(struct nft_trans *trans)
137 {
138 list_del(&trans->list);
139 kfree(trans);
140 }
141
142 static int nf_tables_register_hooks(struct net *net,
143 const struct nft_table *table,
144 struct nft_chain *chain,
145 unsigned int hook_nops)
146 {
147 if (table->flags & NFT_TABLE_F_DORMANT ||
148 !nft_is_base_chain(chain))
149 return 0;
150
151 return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
152 hook_nops);
153 }
154
155 static void nf_tables_unregister_hooks(struct net *net,
156 const struct nft_table *table,
157 struct nft_chain *chain,
158 unsigned int hook_nops)
159 {
160 if (table->flags & NFT_TABLE_F_DORMANT ||
161 !nft_is_base_chain(chain))
162 return;
163
164 nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
165 }
166
167 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
168 {
169 struct nft_trans *trans;
170
171 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
172 if (trans == NULL)
173 return -ENOMEM;
174
175 if (msg_type == NFT_MSG_NEWTABLE)
176 nft_activate_next(ctx->net, ctx->table);
177
178 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
179 return 0;
180 }
181
182 static int nft_deltable(struct nft_ctx *ctx)
183 {
184 int err;
185
186 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
187 if (err < 0)
188 return err;
189
190 nft_deactivate_next(ctx->net, ctx->table);
191 return err;
192 }
193
194 static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
195 {
196 struct nft_trans *trans;
197
198 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
199 if (trans == NULL)
200 return -ENOMEM;
201
202 if (msg_type == NFT_MSG_NEWCHAIN)
203 nft_activate_next(ctx->net, ctx->chain);
204
205 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
206 return 0;
207 }
208
209 static int nft_delchain(struct nft_ctx *ctx)
210 {
211 int err;
212
213 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
214 if (err < 0)
215 return err;
216
217 ctx->table->use--;
218 nft_deactivate_next(ctx->net, ctx->chain);
219
220 return err;
221 }
222
223 static int
224 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
225 {
226 /* You cannot delete the same rule twice */
227 if (nft_is_active_next(ctx->net, rule)) {
228 nft_deactivate_next(ctx->net, rule);
229 ctx->chain->use--;
230 return 0;
231 }
232 return -ENOENT;
233 }
234
235 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
236 struct nft_rule *rule)
237 {
238 struct nft_trans *trans;
239
240 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
241 if (trans == NULL)
242 return NULL;
243
244 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
245 nft_trans_rule_id(trans) =
246 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
247 }
248 nft_trans_rule(trans) = rule;
249 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
250
251 return trans;
252 }
253
254 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
255 {
256 struct nft_trans *trans;
257 int err;
258
259 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
260 if (trans == NULL)
261 return -ENOMEM;
262
263 err = nf_tables_delrule_deactivate(ctx, rule);
264 if (err < 0) {
265 nft_trans_destroy(trans);
266 return err;
267 }
268
269 return 0;
270 }
271
272 static int nft_delrule_by_chain(struct nft_ctx *ctx)
273 {
274 struct nft_rule *rule;
275 int err;
276
277 list_for_each_entry(rule, &ctx->chain->rules, list) {
278 err = nft_delrule(ctx, rule);
279 if (err < 0)
280 return err;
281 }
282 return 0;
283 }
284
285 static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
286 struct nft_set *set)
287 {
288 struct nft_trans *trans;
289
290 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
291 if (trans == NULL)
292 return -ENOMEM;
293
294 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
295 nft_trans_set_id(trans) =
296 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
297 nft_activate_next(ctx->net, set);
298 }
299 nft_trans_set(trans) = set;
300 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
301
302 return 0;
303 }
304
305 static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
306 {
307 int err;
308
309 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
310 if (err < 0)
311 return err;
312
313 nft_deactivate_next(ctx->net, set);
314 ctx->table->use--;
315
316 return err;
317 }
318
319 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
320 struct nft_object *obj)
321 {
322 struct nft_trans *trans;
323
324 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
325 if (trans == NULL)
326 return -ENOMEM;
327
328 if (msg_type == NFT_MSG_NEWOBJ)
329 nft_activate_next(ctx->net, obj);
330
331 nft_trans_obj(trans) = obj;
332 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
333
334 return 0;
335 }
336
337 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
338 {
339 int err;
340
341 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
342 if (err < 0)
343 return err;
344
345 nft_deactivate_next(ctx->net, obj);
346 ctx->table->use--;
347
348 return err;
349 }
350
351 /*
352 * Tables
353 */
354
355 static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
356 const struct nlattr *nla,
357 u8 genmask)
358 {
359 struct nft_table *table;
360
361 list_for_each_entry(table, &afi->tables, list) {
362 if (!nla_strcmp(nla, table->name) &&
363 nft_active_genmask(table, genmask))
364 return table;
365 }
366 return NULL;
367 }
368
369 static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
370 const struct nlattr *nla,
371 u8 genmask)
372 {
373 struct nft_table *table;
374
375 if (nla == NULL)
376 return ERR_PTR(-EINVAL);
377
378 table = nft_table_lookup(afi, nla, genmask);
379 if (table != NULL)
380 return table;
381
382 return ERR_PTR(-ENOENT);
383 }
384
385 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
386 {
387 return ++table->hgenerator;
388 }
389
390 static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
391
392 static const struct nf_chain_type *
393 __nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
394 {
395 int i;
396
397 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
398 if (chain_type[family][i] != NULL &&
399 !nla_strcmp(nla, chain_type[family][i]->name))
400 return chain_type[family][i];
401 }
402 return NULL;
403 }
404
405 static const struct nf_chain_type *
406 nf_tables_chain_type_lookup(const struct nft_af_info *afi,
407 const struct nlattr *nla,
408 bool autoload)
409 {
410 const struct nf_chain_type *type;
411
412 type = __nf_tables_chain_type_lookup(afi->family, nla);
413 if (type != NULL)
414 return type;
415 #ifdef CONFIG_MODULES
416 if (autoload) {
417 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
418 request_module("nft-chain-%u-%.*s", afi->family,
419 nla_len(nla), (const char *)nla_data(nla));
420 nfnl_lock(NFNL_SUBSYS_NFTABLES);
421 type = __nf_tables_chain_type_lookup(afi->family, nla);
422 if (type != NULL)
423 return ERR_PTR(-EAGAIN);
424 }
425 #endif
426 return ERR_PTR(-ENOENT);
427 }
428
429 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
430 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
431 .len = NFT_TABLE_MAXNAMELEN - 1 },
432 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
433 };
434
435 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
436 u32 portid, u32 seq, int event, u32 flags,
437 int family, const struct nft_table *table)
438 {
439 struct nlmsghdr *nlh;
440 struct nfgenmsg *nfmsg;
441
442 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
443 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
444 if (nlh == NULL)
445 goto nla_put_failure;
446
447 nfmsg = nlmsg_data(nlh);
448 nfmsg->nfgen_family = family;
449 nfmsg->version = NFNETLINK_V0;
450 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
451
452 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
453 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
454 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
455 goto nla_put_failure;
456
457 nlmsg_end(skb, nlh);
458 return 0;
459
460 nla_put_failure:
461 nlmsg_trim(skb, nlh);
462 return -1;
463 }
464
465 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
466 {
467 struct sk_buff *skb;
468 int err;
469
470 if (!ctx->report &&
471 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
472 return;
473
474 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
475 if (skb == NULL)
476 goto err;
477
478 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
479 event, 0, ctx->afi->family, ctx->table);
480 if (err < 0) {
481 kfree_skb(skb);
482 goto err;
483 }
484
485 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
486 ctx->report, GFP_KERNEL);
487 return;
488 err:
489 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
490 }
491
492 static int nf_tables_dump_tables(struct sk_buff *skb,
493 struct netlink_callback *cb)
494 {
495 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
496 const struct nft_af_info *afi;
497 const struct nft_table *table;
498 unsigned int idx = 0, s_idx = cb->args[0];
499 struct net *net = sock_net(skb->sk);
500 int family = nfmsg->nfgen_family;
501
502 rcu_read_lock();
503 cb->seq = net->nft.base_seq;
504
505 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
506 if (family != NFPROTO_UNSPEC && family != afi->family)
507 continue;
508
509 list_for_each_entry_rcu(table, &afi->tables, list) {
510 if (idx < s_idx)
511 goto cont;
512 if (idx > s_idx)
513 memset(&cb->args[1], 0,
514 sizeof(cb->args) - sizeof(cb->args[0]));
515 if (!nft_is_active(net, table))
516 continue;
517 if (nf_tables_fill_table_info(skb, net,
518 NETLINK_CB(cb->skb).portid,
519 cb->nlh->nlmsg_seq,
520 NFT_MSG_NEWTABLE,
521 NLM_F_MULTI,
522 afi->family, table) < 0)
523 goto done;
524
525 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
526 cont:
527 idx++;
528 }
529 }
530 done:
531 rcu_read_unlock();
532 cb->args[0] = idx;
533 return skb->len;
534 }
535
536 static int nf_tables_gettable(struct net *net, struct sock *nlsk,
537 struct sk_buff *skb, const struct nlmsghdr *nlh,
538 const struct nlattr * const nla[],
539 struct netlink_ext_ack *extack)
540 {
541 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
542 u8 genmask = nft_genmask_cur(net);
543 const struct nft_af_info *afi;
544 const struct nft_table *table;
545 struct sk_buff *skb2;
546 int family = nfmsg->nfgen_family;
547 int err;
548
549 if (nlh->nlmsg_flags & NLM_F_DUMP) {
550 struct netlink_dump_control c = {
551 .dump = nf_tables_dump_tables,
552 };
553 return netlink_dump_start(nlsk, skb, nlh, &c);
554 }
555
556 afi = nf_tables_afinfo_lookup(net, family, false);
557 if (IS_ERR(afi))
558 return PTR_ERR(afi);
559
560 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
561 if (IS_ERR(table))
562 return PTR_ERR(table);
563
564 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
565 if (!skb2)
566 return -ENOMEM;
567
568 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
569 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
570 family, table);
571 if (err < 0)
572 goto err;
573
574 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
575
576 err:
577 kfree_skb(skb2);
578 return err;
579 }
580
581 static void _nf_tables_table_disable(struct net *net,
582 const struct nft_af_info *afi,
583 struct nft_table *table,
584 u32 cnt)
585 {
586 struct nft_chain *chain;
587 u32 i = 0;
588
589 list_for_each_entry(chain, &table->chains, list) {
590 if (!nft_is_active_next(net, chain))
591 continue;
592 if (!nft_is_base_chain(chain))
593 continue;
594
595 if (cnt && i++ == cnt)
596 break;
597
598 nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
599 afi->nops);
600 }
601 }
602
603 static int nf_tables_table_enable(struct net *net,
604 const struct nft_af_info *afi,
605 struct nft_table *table)
606 {
607 struct nft_chain *chain;
608 int err, i = 0;
609
610 list_for_each_entry(chain, &table->chains, list) {
611 if (!nft_is_active_next(net, chain))
612 continue;
613 if (!nft_is_base_chain(chain))
614 continue;
615
616 err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
617 afi->nops);
618 if (err < 0)
619 goto err;
620
621 i++;
622 }
623 return 0;
624 err:
625 if (i)
626 _nf_tables_table_disable(net, afi, table, i);
627 return err;
628 }
629
630 static void nf_tables_table_disable(struct net *net,
631 const struct nft_af_info *afi,
632 struct nft_table *table)
633 {
634 _nf_tables_table_disable(net, afi, table, 0);
635 }
636
637 static int nf_tables_updtable(struct nft_ctx *ctx)
638 {
639 struct nft_trans *trans;
640 u32 flags;
641 int ret = 0;
642
643 if (!ctx->nla[NFTA_TABLE_FLAGS])
644 return 0;
645
646 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
647 if (flags & ~NFT_TABLE_F_DORMANT)
648 return -EINVAL;
649
650 if (flags == ctx->table->flags)
651 return 0;
652
653 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
654 sizeof(struct nft_trans_table));
655 if (trans == NULL)
656 return -ENOMEM;
657
658 if ((flags & NFT_TABLE_F_DORMANT) &&
659 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
660 nft_trans_table_enable(trans) = false;
661 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
662 ctx->table->flags & NFT_TABLE_F_DORMANT) {
663 ret = nf_tables_table_enable(ctx->net, ctx->afi, ctx->table);
664 if (ret >= 0) {
665 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
666 nft_trans_table_enable(trans) = true;
667 }
668 }
669 if (ret < 0)
670 goto err;
671
672 nft_trans_table_update(trans) = true;
673 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
674 return 0;
675 err:
676 nft_trans_destroy(trans);
677 return ret;
678 }
679
680 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
681 struct sk_buff *skb, const struct nlmsghdr *nlh,
682 const struct nlattr * const nla[],
683 struct netlink_ext_ack *extack)
684 {
685 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
686 u8 genmask = nft_genmask_next(net);
687 const struct nlattr *name;
688 struct nft_af_info *afi;
689 struct nft_table *table;
690 int family = nfmsg->nfgen_family;
691 u32 flags = 0;
692 struct nft_ctx ctx;
693 int err;
694
695 afi = nf_tables_afinfo_lookup(net, family, true);
696 if (IS_ERR(afi))
697 return PTR_ERR(afi);
698
699 name = nla[NFTA_TABLE_NAME];
700 table = nf_tables_table_lookup(afi, name, genmask);
701 if (IS_ERR(table)) {
702 if (PTR_ERR(table) != -ENOENT)
703 return PTR_ERR(table);
704 } else {
705 if (nlh->nlmsg_flags & NLM_F_EXCL)
706 return -EEXIST;
707 if (nlh->nlmsg_flags & NLM_F_REPLACE)
708 return -EOPNOTSUPP;
709
710 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
711 return nf_tables_updtable(&ctx);
712 }
713
714 if (nla[NFTA_TABLE_FLAGS]) {
715 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
716 if (flags & ~NFT_TABLE_F_DORMANT)
717 return -EINVAL;
718 }
719
720 err = -EAFNOSUPPORT;
721 if (!try_module_get(afi->owner))
722 goto err1;
723
724 err = -ENOMEM;
725 table = kzalloc(sizeof(*table), GFP_KERNEL);
726 if (table == NULL)
727 goto err2;
728
729 table->name = nla_strdup(name, GFP_KERNEL);
730 if (table->name == NULL)
731 goto err3;
732
733 INIT_LIST_HEAD(&table->chains);
734 INIT_LIST_HEAD(&table->sets);
735 INIT_LIST_HEAD(&table->objects);
736 table->flags = flags;
737
738 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
739 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
740 if (err < 0)
741 goto err4;
742
743 list_add_tail_rcu(&table->list, &afi->tables);
744 return 0;
745 err4:
746 kfree(table->name);
747 err3:
748 kfree(table);
749 err2:
750 module_put(afi->owner);
751 err1:
752 return err;
753 }
754
755 static int nft_flush_table(struct nft_ctx *ctx)
756 {
757 int err;
758 struct nft_chain *chain, *nc;
759 struct nft_object *obj, *ne;
760 struct nft_set *set, *ns;
761
762 list_for_each_entry(chain, &ctx->table->chains, list) {
763 if (!nft_is_active_next(ctx->net, chain))
764 continue;
765
766 ctx->chain = chain;
767
768 err = nft_delrule_by_chain(ctx);
769 if (err < 0)
770 goto out;
771 }
772
773 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
774 if (!nft_is_active_next(ctx->net, set))
775 continue;
776
777 if (set->flags & NFT_SET_ANONYMOUS &&
778 !list_empty(&set->bindings))
779 continue;
780
781 err = nft_delset(ctx, set);
782 if (err < 0)
783 goto out;
784 }
785
786 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
787 err = nft_delobj(ctx, obj);
788 if (err < 0)
789 goto out;
790 }
791
792 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
793 if (!nft_is_active_next(ctx->net, chain))
794 continue;
795
796 ctx->chain = chain;
797
798 err = nft_delchain(ctx);
799 if (err < 0)
800 goto out;
801 }
802
803 err = nft_deltable(ctx);
804 out:
805 return err;
806 }
807
808 static int nft_flush(struct nft_ctx *ctx, int family)
809 {
810 struct nft_af_info *afi;
811 struct nft_table *table, *nt;
812 const struct nlattr * const *nla = ctx->nla;
813 int err = 0;
814
815 list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
816 if (family != AF_UNSPEC && afi->family != family)
817 continue;
818
819 ctx->afi = afi;
820 list_for_each_entry_safe(table, nt, &afi->tables, list) {
821 if (!nft_is_active_next(ctx->net, table))
822 continue;
823
824 if (nla[NFTA_TABLE_NAME] &&
825 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
826 continue;
827
828 ctx->table = table;
829
830 err = nft_flush_table(ctx);
831 if (err < 0)
832 goto out;
833 }
834 }
835 out:
836 return err;
837 }
838
839 static int nf_tables_deltable(struct net *net, struct sock *nlsk,
840 struct sk_buff *skb, const struct nlmsghdr *nlh,
841 const struct nlattr * const nla[],
842 struct netlink_ext_ack *extack)
843 {
844 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
845 u8 genmask = nft_genmask_next(net);
846 struct nft_af_info *afi;
847 struct nft_table *table;
848 int family = nfmsg->nfgen_family;
849 struct nft_ctx ctx;
850
851 nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
852 if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
853 return nft_flush(&ctx, family);
854
855 afi = nf_tables_afinfo_lookup(net, family, false);
856 if (IS_ERR(afi))
857 return PTR_ERR(afi);
858
859 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
860 if (IS_ERR(table))
861 return PTR_ERR(table);
862
863 if (nlh->nlmsg_flags & NLM_F_NONREC &&
864 table->use > 0)
865 return -EBUSY;
866
867 ctx.afi = afi;
868 ctx.table = table;
869
870 return nft_flush_table(&ctx);
871 }
872
873 static void nf_tables_table_destroy(struct nft_ctx *ctx)
874 {
875 BUG_ON(ctx->table->use > 0);
876
877 kfree(ctx->table->name);
878 kfree(ctx->table);
879 module_put(ctx->afi->owner);
880 }
881
882 int nft_register_chain_type(const struct nf_chain_type *ctype)
883 {
884 int err = 0;
885
886 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
887 return -EINVAL;
888
889 nfnl_lock(NFNL_SUBSYS_NFTABLES);
890 if (chain_type[ctype->family][ctype->type] != NULL) {
891 err = -EBUSY;
892 goto out;
893 }
894 chain_type[ctype->family][ctype->type] = ctype;
895 out:
896 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
897 return err;
898 }
899 EXPORT_SYMBOL_GPL(nft_register_chain_type);
900
901 void nft_unregister_chain_type(const struct nf_chain_type *ctype)
902 {
903 nfnl_lock(NFNL_SUBSYS_NFTABLES);
904 chain_type[ctype->family][ctype->type] = NULL;
905 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
906 }
907 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
908
909 /*
910 * Chains
911 */
912
913 static struct nft_chain *
914 nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
915 u8 genmask)
916 {
917 struct nft_chain *chain;
918
919 list_for_each_entry(chain, &table->chains, list) {
920 if (chain->handle == handle &&
921 nft_active_genmask(chain, genmask))
922 return chain;
923 }
924
925 return ERR_PTR(-ENOENT);
926 }
927
928 static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
929 const struct nlattr *nla,
930 u8 genmask)
931 {
932 struct nft_chain *chain;
933
934 if (nla == NULL)
935 return ERR_PTR(-EINVAL);
936
937 list_for_each_entry(chain, &table->chains, list) {
938 if (!nla_strcmp(nla, chain->name) &&
939 nft_active_genmask(chain, genmask))
940 return chain;
941 }
942
943 return ERR_PTR(-ENOENT);
944 }
945
946 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
947 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
948 .len = NFT_TABLE_MAXNAMELEN - 1 },
949 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
950 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
951 .len = NFT_CHAIN_MAXNAMELEN - 1 },
952 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
953 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
954 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
955 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
956 };
957
958 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
959 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
960 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
961 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
962 .len = IFNAMSIZ - 1 },
963 };
964
965 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
966 {
967 struct nft_stats *cpu_stats, total;
968 struct nlattr *nest;
969 unsigned int seq;
970 u64 pkts, bytes;
971 int cpu;
972
973 memset(&total, 0, sizeof(total));
974 for_each_possible_cpu(cpu) {
975 cpu_stats = per_cpu_ptr(stats, cpu);
976 do {
977 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
978 pkts = cpu_stats->pkts;
979 bytes = cpu_stats->bytes;
980 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
981 total.pkts += pkts;
982 total.bytes += bytes;
983 }
984 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
985 if (nest == NULL)
986 goto nla_put_failure;
987
988 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
989 NFTA_COUNTER_PAD) ||
990 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
991 NFTA_COUNTER_PAD))
992 goto nla_put_failure;
993
994 nla_nest_end(skb, nest);
995 return 0;
996
997 nla_put_failure:
998 return -ENOSPC;
999 }
1000
1001 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1002 u32 portid, u32 seq, int event, u32 flags,
1003 int family, const struct nft_table *table,
1004 const struct nft_chain *chain)
1005 {
1006 struct nlmsghdr *nlh;
1007 struct nfgenmsg *nfmsg;
1008
1009 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1010 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1011 if (nlh == NULL)
1012 goto nla_put_failure;
1013
1014 nfmsg = nlmsg_data(nlh);
1015 nfmsg->nfgen_family = family;
1016 nfmsg->version = NFNETLINK_V0;
1017 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
1018
1019 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1020 goto nla_put_failure;
1021 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1022 NFTA_CHAIN_PAD))
1023 goto nla_put_failure;
1024 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1025 goto nla_put_failure;
1026
1027 if (nft_is_base_chain(chain)) {
1028 const struct nft_base_chain *basechain = nft_base_chain(chain);
1029 const struct nf_hook_ops *ops = &basechain->ops[0];
1030 struct nlattr *nest;
1031
1032 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
1033 if (nest == NULL)
1034 goto nla_put_failure;
1035 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1036 goto nla_put_failure;
1037 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1038 goto nla_put_failure;
1039 if (basechain->dev_name[0] &&
1040 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1041 goto nla_put_failure;
1042 nla_nest_end(skb, nest);
1043
1044 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1045 htonl(basechain->policy)))
1046 goto nla_put_failure;
1047
1048 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1049 goto nla_put_failure;
1050
1051 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
1052 goto nla_put_failure;
1053 }
1054
1055 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1056 goto nla_put_failure;
1057
1058 nlmsg_end(skb, nlh);
1059 return 0;
1060
1061 nla_put_failure:
1062 nlmsg_trim(skb, nlh);
1063 return -1;
1064 }
1065
1066 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1067 {
1068 struct sk_buff *skb;
1069 int err;
1070
1071 if (!ctx->report &&
1072 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1073 return;
1074
1075 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1076 if (skb == NULL)
1077 goto err;
1078
1079 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1080 event, 0, ctx->afi->family, ctx->table,
1081 ctx->chain);
1082 if (err < 0) {
1083 kfree_skb(skb);
1084 goto err;
1085 }
1086
1087 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1088 ctx->report, GFP_KERNEL);
1089 return;
1090 err:
1091 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1092 }
1093
1094 static int nf_tables_dump_chains(struct sk_buff *skb,
1095 struct netlink_callback *cb)
1096 {
1097 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1098 const struct nft_af_info *afi;
1099 const struct nft_table *table;
1100 const struct nft_chain *chain;
1101 unsigned int idx = 0, s_idx = cb->args[0];
1102 struct net *net = sock_net(skb->sk);
1103 int family = nfmsg->nfgen_family;
1104
1105 rcu_read_lock();
1106 cb->seq = net->nft.base_seq;
1107
1108 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
1109 if (family != NFPROTO_UNSPEC && family != afi->family)
1110 continue;
1111
1112 list_for_each_entry_rcu(table, &afi->tables, list) {
1113 list_for_each_entry_rcu(chain, &table->chains, list) {
1114 if (idx < s_idx)
1115 goto cont;
1116 if (idx > s_idx)
1117 memset(&cb->args[1], 0,
1118 sizeof(cb->args) - sizeof(cb->args[0]));
1119 if (!nft_is_active(net, chain))
1120 continue;
1121 if (nf_tables_fill_chain_info(skb, net,
1122 NETLINK_CB(cb->skb).portid,
1123 cb->nlh->nlmsg_seq,
1124 NFT_MSG_NEWCHAIN,
1125 NLM_F_MULTI,
1126 afi->family, table, chain) < 0)
1127 goto done;
1128
1129 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1130 cont:
1131 idx++;
1132 }
1133 }
1134 }
1135 done:
1136 rcu_read_unlock();
1137 cb->args[0] = idx;
1138 return skb->len;
1139 }
1140
1141 static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1142 struct sk_buff *skb, const struct nlmsghdr *nlh,
1143 const struct nlattr * const nla[],
1144 struct netlink_ext_ack *extack)
1145 {
1146 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1147 u8 genmask = nft_genmask_cur(net);
1148 const struct nft_af_info *afi;
1149 const struct nft_table *table;
1150 const struct nft_chain *chain;
1151 struct sk_buff *skb2;
1152 int family = nfmsg->nfgen_family;
1153 int err;
1154
1155 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1156 struct netlink_dump_control c = {
1157 .dump = nf_tables_dump_chains,
1158 };
1159 return netlink_dump_start(nlsk, skb, nlh, &c);
1160 }
1161
1162 afi = nf_tables_afinfo_lookup(net, family, false);
1163 if (IS_ERR(afi))
1164 return PTR_ERR(afi);
1165
1166 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
1167 if (IS_ERR(table))
1168 return PTR_ERR(table);
1169
1170 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1171 if (IS_ERR(chain))
1172 return PTR_ERR(chain);
1173
1174 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1175 if (!skb2)
1176 return -ENOMEM;
1177
1178 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1179 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1180 family, table, chain);
1181 if (err < 0)
1182 goto err;
1183
1184 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1185
1186 err:
1187 kfree_skb(skb2);
1188 return err;
1189 }
1190
1191 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1192 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1193 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1194 };
1195
1196 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1197 {
1198 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1199 struct nft_stats __percpu *newstats;
1200 struct nft_stats *stats;
1201 int err;
1202
1203 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1204 NULL);
1205 if (err < 0)
1206 return ERR_PTR(err);
1207
1208 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1209 return ERR_PTR(-EINVAL);
1210
1211 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1212 if (newstats == NULL)
1213 return ERR_PTR(-ENOMEM);
1214
1215 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1216 * are not exposed to userspace.
1217 */
1218 preempt_disable();
1219 stats = this_cpu_ptr(newstats);
1220 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1221 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1222 preempt_enable();
1223
1224 return newstats;
1225 }
1226
1227 static void nft_chain_stats_replace(struct nft_base_chain *chain,
1228 struct nft_stats __percpu *newstats)
1229 {
1230 if (newstats == NULL)
1231 return;
1232
1233 if (chain->stats) {
1234 struct nft_stats __percpu *oldstats =
1235 nft_dereference(chain->stats);
1236
1237 rcu_assign_pointer(chain->stats, newstats);
1238 synchronize_rcu();
1239 free_percpu(oldstats);
1240 } else
1241 rcu_assign_pointer(chain->stats, newstats);
1242 }
1243
1244 static void nf_tables_chain_destroy(struct nft_chain *chain)
1245 {
1246 BUG_ON(chain->use > 0);
1247
1248 if (nft_is_base_chain(chain)) {
1249 struct nft_base_chain *basechain = nft_base_chain(chain);
1250
1251 module_put(basechain->type->owner);
1252 free_percpu(basechain->stats);
1253 if (basechain->stats)
1254 static_branch_dec(&nft_counters_enabled);
1255 if (basechain->ops[0].dev != NULL)
1256 dev_put(basechain->ops[0].dev);
1257 kfree(chain->name);
1258 kfree(basechain);
1259 } else {
1260 kfree(chain->name);
1261 kfree(chain);
1262 }
1263 }
1264
1265 struct nft_chain_hook {
1266 u32 num;
1267 u32 priority;
1268 const struct nf_chain_type *type;
1269 struct net_device *dev;
1270 };
1271
1272 static int nft_chain_parse_hook(struct net *net,
1273 const struct nlattr * const nla[],
1274 struct nft_af_info *afi,
1275 struct nft_chain_hook *hook, bool create)
1276 {
1277 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1278 const struct nf_chain_type *type;
1279 struct net_device *dev;
1280 int err;
1281
1282 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
1283 nft_hook_policy, NULL);
1284 if (err < 0)
1285 return err;
1286
1287 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1288 ha[NFTA_HOOK_PRIORITY] == NULL)
1289 return -EINVAL;
1290
1291 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1292 if (hook->num >= afi->nhooks)
1293 return -EINVAL;
1294
1295 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1296
1297 type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
1298 if (nla[NFTA_CHAIN_TYPE]) {
1299 type = nf_tables_chain_type_lookup(afi, nla[NFTA_CHAIN_TYPE],
1300 create);
1301 if (IS_ERR(type))
1302 return PTR_ERR(type);
1303 }
1304 if (!(type->hook_mask & (1 << hook->num)))
1305 return -EOPNOTSUPP;
1306 if (!try_module_get(type->owner))
1307 return -ENOENT;
1308
1309 hook->type = type;
1310
1311 hook->dev = NULL;
1312 if (afi->flags & NFT_AF_NEEDS_DEV) {
1313 char ifname[IFNAMSIZ];
1314
1315 if (!ha[NFTA_HOOK_DEV]) {
1316 module_put(type->owner);
1317 return -EOPNOTSUPP;
1318 }
1319
1320 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1321 dev = dev_get_by_name(net, ifname);
1322 if (!dev) {
1323 module_put(type->owner);
1324 return -ENOENT;
1325 }
1326 hook->dev = dev;
1327 } else if (ha[NFTA_HOOK_DEV]) {
1328 module_put(type->owner);
1329 return -EOPNOTSUPP;
1330 }
1331
1332 return 0;
1333 }
1334
1335 static void nft_chain_release_hook(struct nft_chain_hook *hook)
1336 {
1337 module_put(hook->type->owner);
1338 if (hook->dev != NULL)
1339 dev_put(hook->dev);
1340 }
1341
1342 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1343 u8 policy, bool create)
1344 {
1345 const struct nlattr * const *nla = ctx->nla;
1346 struct nft_table *table = ctx->table;
1347 struct nft_af_info *afi = ctx->afi;
1348 struct nft_base_chain *basechain;
1349 struct nft_stats __percpu *stats;
1350 struct net *net = ctx->net;
1351 struct nft_chain *chain;
1352 unsigned int i;
1353 int err;
1354
1355 if (table->use == UINT_MAX)
1356 return -EOVERFLOW;
1357
1358 if (nla[NFTA_CHAIN_HOOK]) {
1359 struct nft_chain_hook hook;
1360 struct nf_hook_ops *ops;
1361 nf_hookfn *hookfn;
1362
1363 err = nft_chain_parse_hook(net, nla, afi, &hook, create);
1364 if (err < 0)
1365 return err;
1366
1367 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1368 if (basechain == NULL) {
1369 nft_chain_release_hook(&hook);
1370 return -ENOMEM;
1371 }
1372
1373 if (hook.dev != NULL)
1374 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1375
1376 if (nla[NFTA_CHAIN_COUNTERS]) {
1377 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1378 if (IS_ERR(stats)) {
1379 nft_chain_release_hook(&hook);
1380 kfree(basechain);
1381 return PTR_ERR(stats);
1382 }
1383 basechain->stats = stats;
1384 static_branch_inc(&nft_counters_enabled);
1385 }
1386
1387 hookfn = hook.type->hooks[hook.num];
1388 basechain->type = hook.type;
1389 chain = &basechain->chain;
1390
1391 for (i = 0; i < afi->nops; i++) {
1392 ops = &basechain->ops[i];
1393 ops->pf = family;
1394 ops->hooknum = hook.num;
1395 ops->priority = hook.priority;
1396 ops->priv = chain;
1397 ops->hook = afi->hooks[ops->hooknum];
1398 ops->dev = hook.dev;
1399 if (hookfn)
1400 ops->hook = hookfn;
1401 if (afi->hook_ops_init)
1402 afi->hook_ops_init(ops, i);
1403 }
1404
1405 chain->flags |= NFT_BASE_CHAIN;
1406 basechain->policy = policy;
1407 } else {
1408 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1409 if (chain == NULL)
1410 return -ENOMEM;
1411 }
1412 INIT_LIST_HEAD(&chain->rules);
1413 chain->handle = nf_tables_alloc_handle(table);
1414 chain->table = table;
1415 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1416 if (!chain->name) {
1417 err = -ENOMEM;
1418 goto err1;
1419 }
1420
1421 err = nf_tables_register_hooks(net, table, chain, afi->nops);
1422 if (err < 0)
1423 goto err1;
1424
1425 ctx->chain = chain;
1426 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1427 if (err < 0)
1428 goto err2;
1429
1430 table->use++;
1431 list_add_tail_rcu(&chain->list, &table->chains);
1432
1433 return 0;
1434 err2:
1435 nf_tables_unregister_hooks(net, table, chain, afi->nops);
1436 err1:
1437 nf_tables_chain_destroy(chain);
1438
1439 return err;
1440 }
1441
1442 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1443 bool create)
1444 {
1445 const struct nlattr * const *nla = ctx->nla;
1446 struct nft_table *table = ctx->table;
1447 struct nft_chain *chain = ctx->chain;
1448 struct nft_af_info *afi = ctx->afi;
1449 struct nft_base_chain *basechain;
1450 struct nft_stats *stats = NULL;
1451 struct nft_chain_hook hook;
1452 const struct nlattr *name;
1453 struct nf_hook_ops *ops;
1454 struct nft_trans *trans;
1455 int err, i;
1456
1457 if (nla[NFTA_CHAIN_HOOK]) {
1458 if (!nft_is_base_chain(chain))
1459 return -EBUSY;
1460
1461 err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook,
1462 create);
1463 if (err < 0)
1464 return err;
1465
1466 basechain = nft_base_chain(chain);
1467 if (basechain->type != hook.type) {
1468 nft_chain_release_hook(&hook);
1469 return -EBUSY;
1470 }
1471
1472 for (i = 0; i < afi->nops; i++) {
1473 ops = &basechain->ops[i];
1474 if (ops->hooknum != hook.num ||
1475 ops->priority != hook.priority ||
1476 ops->dev != hook.dev) {
1477 nft_chain_release_hook(&hook);
1478 return -EBUSY;
1479 }
1480 }
1481 nft_chain_release_hook(&hook);
1482 }
1483
1484 if (nla[NFTA_CHAIN_HANDLE] &&
1485 nla[NFTA_CHAIN_NAME]) {
1486 struct nft_chain *chain2;
1487
1488 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
1489 genmask);
1490 if (!IS_ERR(chain2))
1491 return -EEXIST;
1492 }
1493
1494 if (nla[NFTA_CHAIN_COUNTERS]) {
1495 if (!nft_is_base_chain(chain))
1496 return -EOPNOTSUPP;
1497
1498 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1499 if (IS_ERR(stats))
1500 return PTR_ERR(stats);
1501 }
1502
1503 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1504 sizeof(struct nft_trans_chain));
1505 if (trans == NULL) {
1506 free_percpu(stats);
1507 return -ENOMEM;
1508 }
1509
1510 nft_trans_chain_stats(trans) = stats;
1511 nft_trans_chain_update(trans) = true;
1512
1513 if (nla[NFTA_CHAIN_POLICY])
1514 nft_trans_chain_policy(trans) = policy;
1515 else
1516 nft_trans_chain_policy(trans) = -1;
1517
1518 name = nla[NFTA_CHAIN_NAME];
1519 if (nla[NFTA_CHAIN_HANDLE] && name) {
1520 nft_trans_chain_name(trans) =
1521 nla_strdup(name, GFP_KERNEL);
1522 if (!nft_trans_chain_name(trans)) {
1523 kfree(trans);
1524 free_percpu(stats);
1525 return -ENOMEM;
1526 }
1527 }
1528 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1529
1530 return 0;
1531 }
1532
1533 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1534 struct sk_buff *skb, const struct nlmsghdr *nlh,
1535 const struct nlattr * const nla[],
1536 struct netlink_ext_ack *extack)
1537 {
1538 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1539 const struct nlattr * uninitialized_var(name);
1540 u8 genmask = nft_genmask_next(net);
1541 int family = nfmsg->nfgen_family;
1542 struct nft_af_info *afi;
1543 struct nft_table *table;
1544 struct nft_chain *chain;
1545 u8 policy = NF_ACCEPT;
1546 struct nft_ctx ctx;
1547 u64 handle = 0;
1548 bool create;
1549
1550 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1551
1552 afi = nf_tables_afinfo_lookup(net, family, true);
1553 if (IS_ERR(afi))
1554 return PTR_ERR(afi);
1555
1556 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
1557 if (IS_ERR(table))
1558 return PTR_ERR(table);
1559
1560 chain = NULL;
1561 name = nla[NFTA_CHAIN_NAME];
1562
1563 if (nla[NFTA_CHAIN_HANDLE]) {
1564 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1565 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
1566 if (IS_ERR(chain))
1567 return PTR_ERR(chain);
1568 } else {
1569 chain = nf_tables_chain_lookup(table, name, genmask);
1570 if (IS_ERR(chain)) {
1571 if (PTR_ERR(chain) != -ENOENT)
1572 return PTR_ERR(chain);
1573 chain = NULL;
1574 }
1575 }
1576
1577 if (nla[NFTA_CHAIN_POLICY]) {
1578 if (chain != NULL &&
1579 !nft_is_base_chain(chain))
1580 return -EOPNOTSUPP;
1581
1582 if (chain == NULL &&
1583 nla[NFTA_CHAIN_HOOK] == NULL)
1584 return -EOPNOTSUPP;
1585
1586 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
1587 switch (policy) {
1588 case NF_DROP:
1589 case NF_ACCEPT:
1590 break;
1591 default:
1592 return -EINVAL;
1593 }
1594 }
1595
1596 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
1597
1598 if (chain != NULL) {
1599 if (nlh->nlmsg_flags & NLM_F_EXCL)
1600 return -EEXIST;
1601 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1602 return -EOPNOTSUPP;
1603
1604 return nf_tables_updchain(&ctx, genmask, policy, create);
1605 }
1606
1607 return nf_tables_addchain(&ctx, family, genmask, policy, create);
1608 }
1609
1610 static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1611 struct sk_buff *skb, const struct nlmsghdr *nlh,
1612 const struct nlattr * const nla[],
1613 struct netlink_ext_ack *extack)
1614 {
1615 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1616 u8 genmask = nft_genmask_next(net);
1617 struct nft_af_info *afi;
1618 struct nft_table *table;
1619 struct nft_chain *chain;
1620 struct nft_rule *rule;
1621 int family = nfmsg->nfgen_family;
1622 struct nft_ctx ctx;
1623 u32 use;
1624 int err;
1625
1626 afi = nf_tables_afinfo_lookup(net, family, false);
1627 if (IS_ERR(afi))
1628 return PTR_ERR(afi);
1629
1630 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
1631 if (IS_ERR(table))
1632 return PTR_ERR(table);
1633
1634 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1635 if (IS_ERR(chain))
1636 return PTR_ERR(chain);
1637
1638 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1639 chain->use > 0)
1640 return -EBUSY;
1641
1642 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
1643
1644 use = chain->use;
1645 list_for_each_entry(rule, &chain->rules, list) {
1646 if (!nft_is_active_next(net, rule))
1647 continue;
1648 use--;
1649
1650 err = nft_delrule(&ctx, rule);
1651 if (err < 0)
1652 return err;
1653 }
1654
1655 /* There are rules and elements that are still holding references to us,
1656 * we cannot do a recursive removal in this case.
1657 */
1658 if (use > 0)
1659 return -EBUSY;
1660
1661 return nft_delchain(&ctx);
1662 }
1663
1664 /*
1665 * Expressions
1666 */
1667
1668 /**
1669 * nft_register_expr - register nf_tables expr type
1670 * @ops: expr type
1671 *
1672 * Registers the expr type for use with nf_tables. Returns zero on
1673 * success or a negative errno code otherwise.
1674 */
1675 int nft_register_expr(struct nft_expr_type *type)
1676 {
1677 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1678 if (type->family == NFPROTO_UNSPEC)
1679 list_add_tail_rcu(&type->list, &nf_tables_expressions);
1680 else
1681 list_add_rcu(&type->list, &nf_tables_expressions);
1682 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1683 return 0;
1684 }
1685 EXPORT_SYMBOL_GPL(nft_register_expr);
1686
1687 /**
1688 * nft_unregister_expr - unregister nf_tables expr type
1689 * @ops: expr type
1690 *
1691 * Unregisters the expr typefor use with nf_tables.
1692 */
1693 void nft_unregister_expr(struct nft_expr_type *type)
1694 {
1695 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1696 list_del_rcu(&type->list);
1697 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1698 }
1699 EXPORT_SYMBOL_GPL(nft_unregister_expr);
1700
1701 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1702 struct nlattr *nla)
1703 {
1704 const struct nft_expr_type *type;
1705
1706 list_for_each_entry(type, &nf_tables_expressions, list) {
1707 if (!nla_strcmp(nla, type->name) &&
1708 (!type->family || type->family == family))
1709 return type;
1710 }
1711 return NULL;
1712 }
1713
1714 static const struct nft_expr_type *nft_expr_type_get(u8 family,
1715 struct nlattr *nla)
1716 {
1717 const struct nft_expr_type *type;
1718
1719 if (nla == NULL)
1720 return ERR_PTR(-EINVAL);
1721
1722 type = __nft_expr_type_get(family, nla);
1723 if (type != NULL && try_module_get(type->owner))
1724 return type;
1725
1726 #ifdef CONFIG_MODULES
1727 if (type == NULL) {
1728 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1729 request_module("nft-expr-%u-%.*s", family,
1730 nla_len(nla), (char *)nla_data(nla));
1731 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1732 if (__nft_expr_type_get(family, nla))
1733 return ERR_PTR(-EAGAIN);
1734
1735 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1736 request_module("nft-expr-%.*s",
1737 nla_len(nla), (char *)nla_data(nla));
1738 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1739 if (__nft_expr_type_get(family, nla))
1740 return ERR_PTR(-EAGAIN);
1741 }
1742 #endif
1743 return ERR_PTR(-ENOENT);
1744 }
1745
1746 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1747 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1748 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1749 };
1750
1751 static int nf_tables_fill_expr_info(struct sk_buff *skb,
1752 const struct nft_expr *expr)
1753 {
1754 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
1755 goto nla_put_failure;
1756
1757 if (expr->ops->dump) {
1758 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1759 if (data == NULL)
1760 goto nla_put_failure;
1761 if (expr->ops->dump(skb, expr) < 0)
1762 goto nla_put_failure;
1763 nla_nest_end(skb, data);
1764 }
1765
1766 return skb->len;
1767
1768 nla_put_failure:
1769 return -1;
1770 };
1771
1772 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1773 const struct nft_expr *expr)
1774 {
1775 struct nlattr *nest;
1776
1777 nest = nla_nest_start(skb, attr);
1778 if (!nest)
1779 goto nla_put_failure;
1780 if (nf_tables_fill_expr_info(skb, expr) < 0)
1781 goto nla_put_failure;
1782 nla_nest_end(skb, nest);
1783 return 0;
1784
1785 nla_put_failure:
1786 return -1;
1787 }
1788
1789 struct nft_expr_info {
1790 const struct nft_expr_ops *ops;
1791 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
1792 };
1793
1794 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1795 const struct nlattr *nla,
1796 struct nft_expr_info *info)
1797 {
1798 const struct nft_expr_type *type;
1799 const struct nft_expr_ops *ops;
1800 struct nlattr *tb[NFTA_EXPR_MAX + 1];
1801 int err;
1802
1803 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
1804 if (err < 0)
1805 return err;
1806
1807 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
1808 if (IS_ERR(type))
1809 return PTR_ERR(type);
1810
1811 if (tb[NFTA_EXPR_DATA]) {
1812 err = nla_parse_nested(info->tb, type->maxattr,
1813 tb[NFTA_EXPR_DATA], type->policy, NULL);
1814 if (err < 0)
1815 goto err1;
1816 } else
1817 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1818
1819 if (type->select_ops != NULL) {
1820 ops = type->select_ops(ctx,
1821 (const struct nlattr * const *)info->tb);
1822 if (IS_ERR(ops)) {
1823 err = PTR_ERR(ops);
1824 goto err1;
1825 }
1826 } else
1827 ops = type->ops;
1828
1829 info->ops = ops;
1830 return 0;
1831
1832 err1:
1833 module_put(type->owner);
1834 return err;
1835 }
1836
1837 static int nf_tables_newexpr(const struct nft_ctx *ctx,
1838 const struct nft_expr_info *info,
1839 struct nft_expr *expr)
1840 {
1841 const struct nft_expr_ops *ops = info->ops;
1842 int err;
1843
1844 expr->ops = ops;
1845 if (ops->init) {
1846 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
1847 if (err < 0)
1848 goto err1;
1849 }
1850
1851 if (ops->validate) {
1852 const struct nft_data *data = NULL;
1853
1854 err = ops->validate(ctx, expr, &data);
1855 if (err < 0)
1856 goto err2;
1857 }
1858
1859 return 0;
1860
1861 err2:
1862 if (ops->destroy)
1863 ops->destroy(ctx, expr);
1864 err1:
1865 expr->ops = NULL;
1866 return err;
1867 }
1868
1869 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1870 struct nft_expr *expr)
1871 {
1872 if (expr->ops->destroy)
1873 expr->ops->destroy(ctx, expr);
1874 module_put(expr->ops->type->owner);
1875 }
1876
1877 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1878 const struct nlattr *nla)
1879 {
1880 struct nft_expr_info info;
1881 struct nft_expr *expr;
1882 int err;
1883
1884 err = nf_tables_expr_parse(ctx, nla, &info);
1885 if (err < 0)
1886 goto err1;
1887
1888 err = -ENOMEM;
1889 expr = kzalloc(info.ops->size, GFP_KERNEL);
1890 if (expr == NULL)
1891 goto err2;
1892
1893 err = nf_tables_newexpr(ctx, &info, expr);
1894 if (err < 0)
1895 goto err3;
1896
1897 return expr;
1898 err3:
1899 kfree(expr);
1900 err2:
1901 module_put(info.ops->type->owner);
1902 err1:
1903 return ERR_PTR(err);
1904 }
1905
1906 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1907 {
1908 nf_tables_expr_destroy(ctx, expr);
1909 kfree(expr);
1910 }
1911
1912 /*
1913 * Rules
1914 */
1915
1916 static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1917 u64 handle)
1918 {
1919 struct nft_rule *rule;
1920
1921 // FIXME: this sucks
1922 list_for_each_entry(rule, &chain->rules, list) {
1923 if (handle == rule->handle)
1924 return rule;
1925 }
1926
1927 return ERR_PTR(-ENOENT);
1928 }
1929
1930 static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1931 const struct nlattr *nla)
1932 {
1933 if (nla == NULL)
1934 return ERR_PTR(-EINVAL);
1935
1936 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1937 }
1938
1939 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
1940 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1941 .len = NFT_TABLE_MAXNAMELEN - 1 },
1942 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1943 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1944 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1945 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
1946 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
1947 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
1948 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1949 .len = NFT_USERDATA_MAXLEN },
1950 };
1951
1952 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1953 u32 portid, u32 seq, int event,
1954 u32 flags, int family,
1955 const struct nft_table *table,
1956 const struct nft_chain *chain,
1957 const struct nft_rule *rule)
1958 {
1959 struct nlmsghdr *nlh;
1960 struct nfgenmsg *nfmsg;
1961 const struct nft_expr *expr, *next;
1962 struct nlattr *list;
1963 const struct nft_rule *prule;
1964 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1965
1966 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
1967 if (nlh == NULL)
1968 goto nla_put_failure;
1969
1970 nfmsg = nlmsg_data(nlh);
1971 nfmsg->nfgen_family = family;
1972 nfmsg->version = NFNETLINK_V0;
1973 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
1974
1975 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1976 goto nla_put_failure;
1977 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1978 goto nla_put_failure;
1979 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
1980 NFTA_RULE_PAD))
1981 goto nla_put_failure;
1982
1983 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
1984 prule = list_prev_entry(rule, list);
1985 if (nla_put_be64(skb, NFTA_RULE_POSITION,
1986 cpu_to_be64(prule->handle),
1987 NFTA_RULE_PAD))
1988 goto nla_put_failure;
1989 }
1990
1991 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1992 if (list == NULL)
1993 goto nla_put_failure;
1994 nft_rule_for_each_expr(expr, next, rule) {
1995 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
1996 goto nla_put_failure;
1997 }
1998 nla_nest_end(skb, list);
1999
2000 if (rule->udata) {
2001 struct nft_userdata *udata = nft_userdata(rule);
2002 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2003 udata->data) < 0)
2004 goto nla_put_failure;
2005 }
2006
2007 nlmsg_end(skb, nlh);
2008 return 0;
2009
2010 nla_put_failure:
2011 nlmsg_trim(skb, nlh);
2012 return -1;
2013 }
2014
2015 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2016 const struct nft_rule *rule, int event)
2017 {
2018 struct sk_buff *skb;
2019 int err;
2020
2021 if (!ctx->report &&
2022 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2023 return;
2024
2025 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2026 if (skb == NULL)
2027 goto err;
2028
2029 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2030 event, 0, ctx->afi->family, ctx->table,
2031 ctx->chain, rule);
2032 if (err < 0) {
2033 kfree_skb(skb);
2034 goto err;
2035 }
2036
2037 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2038 ctx->report, GFP_KERNEL);
2039 return;
2040 err:
2041 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2042 }
2043
2044 struct nft_rule_dump_ctx {
2045 char *table;
2046 char *chain;
2047 };
2048
2049 static int nf_tables_dump_rules(struct sk_buff *skb,
2050 struct netlink_callback *cb)
2051 {
2052 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2053 const struct nft_rule_dump_ctx *ctx = cb->data;
2054 const struct nft_af_info *afi;
2055 const struct nft_table *table;
2056 const struct nft_chain *chain;
2057 const struct nft_rule *rule;
2058 unsigned int idx = 0, s_idx = cb->args[0];
2059 struct net *net = sock_net(skb->sk);
2060 int family = nfmsg->nfgen_family;
2061
2062 rcu_read_lock();
2063 cb->seq = net->nft.base_seq;
2064
2065 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
2066 if (family != NFPROTO_UNSPEC && family != afi->family)
2067 continue;
2068
2069 list_for_each_entry_rcu(table, &afi->tables, list) {
2070 if (ctx && ctx->table &&
2071 strcmp(ctx->table, table->name) != 0)
2072 continue;
2073
2074 list_for_each_entry_rcu(chain, &table->chains, list) {
2075 if (ctx && ctx->chain &&
2076 strcmp(ctx->chain, chain->name) != 0)
2077 continue;
2078
2079 list_for_each_entry_rcu(rule, &chain->rules, list) {
2080 if (!nft_is_active(net, rule))
2081 goto cont;
2082 if (idx < s_idx)
2083 goto cont;
2084 if (idx > s_idx)
2085 memset(&cb->args[1], 0,
2086 sizeof(cb->args) - sizeof(cb->args[0]));
2087 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2088 cb->nlh->nlmsg_seq,
2089 NFT_MSG_NEWRULE,
2090 NLM_F_MULTI | NLM_F_APPEND,
2091 afi->family, table, chain, rule) < 0)
2092 goto done;
2093
2094 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2095 cont:
2096 idx++;
2097 }
2098 }
2099 }
2100 }
2101 done:
2102 rcu_read_unlock();
2103
2104 cb->args[0] = idx;
2105 return skb->len;
2106 }
2107
2108 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2109 {
2110 struct nft_rule_dump_ctx *ctx = cb->data;
2111
2112 if (ctx) {
2113 kfree(ctx->table);
2114 kfree(ctx->chain);
2115 kfree(ctx);
2116 }
2117 return 0;
2118 }
2119
2120 static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2121 struct sk_buff *skb, const struct nlmsghdr *nlh,
2122 const struct nlattr * const nla[],
2123 struct netlink_ext_ack *extack)
2124 {
2125 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2126 u8 genmask = nft_genmask_cur(net);
2127 const struct nft_af_info *afi;
2128 const struct nft_table *table;
2129 const struct nft_chain *chain;
2130 const struct nft_rule *rule;
2131 struct sk_buff *skb2;
2132 int family = nfmsg->nfgen_family;
2133 int err;
2134
2135 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2136 struct netlink_dump_control c = {
2137 .dump = nf_tables_dump_rules,
2138 .done = nf_tables_dump_rules_done,
2139 };
2140
2141 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2142 struct nft_rule_dump_ctx *ctx;
2143
2144 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2145 if (!ctx)
2146 return -ENOMEM;
2147
2148 if (nla[NFTA_RULE_TABLE]) {
2149 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2150 GFP_KERNEL);
2151 if (!ctx->table) {
2152 kfree(ctx);
2153 return -ENOMEM;
2154 }
2155 }
2156 if (nla[NFTA_RULE_CHAIN]) {
2157 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2158 GFP_KERNEL);
2159 if (!ctx->chain) {
2160 kfree(ctx->table);
2161 kfree(ctx);
2162 return -ENOMEM;
2163 }
2164 }
2165 c.data = ctx;
2166 }
2167
2168 return netlink_dump_start(nlsk, skb, nlh, &c);
2169 }
2170
2171 afi = nf_tables_afinfo_lookup(net, family, false);
2172 if (IS_ERR(afi))
2173 return PTR_ERR(afi);
2174
2175 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
2176 if (IS_ERR(table))
2177 return PTR_ERR(table);
2178
2179 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2180 if (IS_ERR(chain))
2181 return PTR_ERR(chain);
2182
2183 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2184 if (IS_ERR(rule))
2185 return PTR_ERR(rule);
2186
2187 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2188 if (!skb2)
2189 return -ENOMEM;
2190
2191 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
2192 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2193 family, table, chain, rule);
2194 if (err < 0)
2195 goto err;
2196
2197 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2198
2199 err:
2200 kfree_skb(skb2);
2201 return err;
2202 }
2203
2204 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2205 struct nft_rule *rule)
2206 {
2207 struct nft_expr *expr;
2208
2209 /*
2210 * Careful: some expressions might not be initialized in case this
2211 * is called on error from nf_tables_newrule().
2212 */
2213 expr = nft_expr_first(rule);
2214 while (expr != nft_expr_last(rule) && expr->ops) {
2215 nf_tables_expr_destroy(ctx, expr);
2216 expr = nft_expr_next(expr);
2217 }
2218 kfree(rule);
2219 }
2220
2221 #define NFT_RULE_MAXEXPRS 128
2222
2223 static struct nft_expr_info *info;
2224
2225 static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2226 struct sk_buff *skb, const struct nlmsghdr *nlh,
2227 const struct nlattr * const nla[],
2228 struct netlink_ext_ack *extack)
2229 {
2230 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2231 u8 genmask = nft_genmask_next(net);
2232 struct nft_af_info *afi;
2233 struct nft_table *table;
2234 struct nft_chain *chain;
2235 struct nft_rule *rule, *old_rule = NULL;
2236 struct nft_userdata *udata;
2237 struct nft_trans *trans = NULL;
2238 struct nft_expr *expr;
2239 struct nft_ctx ctx;
2240 struct nlattr *tmp;
2241 unsigned int size, i, n, ulen = 0, usize = 0;
2242 int err, rem;
2243 bool create;
2244 u64 handle, pos_handle;
2245
2246 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2247
2248 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
2249 if (IS_ERR(afi))
2250 return PTR_ERR(afi);
2251
2252 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
2253 if (IS_ERR(table))
2254 return PTR_ERR(table);
2255
2256 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2257 if (IS_ERR(chain))
2258 return PTR_ERR(chain);
2259
2260 if (nla[NFTA_RULE_HANDLE]) {
2261 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2262 rule = __nf_tables_rule_lookup(chain, handle);
2263 if (IS_ERR(rule))
2264 return PTR_ERR(rule);
2265
2266 if (nlh->nlmsg_flags & NLM_F_EXCL)
2267 return -EEXIST;
2268 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2269 old_rule = rule;
2270 else
2271 return -EOPNOTSUPP;
2272 } else {
2273 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2274 return -EINVAL;
2275 handle = nf_tables_alloc_handle(table);
2276
2277 if (chain->use == UINT_MAX)
2278 return -EOVERFLOW;
2279 }
2280
2281 if (nla[NFTA_RULE_POSITION]) {
2282 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2283 return -EOPNOTSUPP;
2284
2285 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2286 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
2287 if (IS_ERR(old_rule))
2288 return PTR_ERR(old_rule);
2289 }
2290
2291 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
2292
2293 n = 0;
2294 size = 0;
2295 if (nla[NFTA_RULE_EXPRESSIONS]) {
2296 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2297 err = -EINVAL;
2298 if (nla_type(tmp) != NFTA_LIST_ELEM)
2299 goto err1;
2300 if (n == NFT_RULE_MAXEXPRS)
2301 goto err1;
2302 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
2303 if (err < 0)
2304 goto err1;
2305 size += info[n].ops->size;
2306 n++;
2307 }
2308 }
2309 /* Check for overflow of dlen field */
2310 err = -EFBIG;
2311 if (size >= 1 << 12)
2312 goto err1;
2313
2314 if (nla[NFTA_RULE_USERDATA]) {
2315 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
2316 if (ulen > 0)
2317 usize = sizeof(struct nft_userdata) + ulen;
2318 }
2319
2320 err = -ENOMEM;
2321 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
2322 if (rule == NULL)
2323 goto err1;
2324
2325 nft_activate_next(net, rule);
2326
2327 rule->handle = handle;
2328 rule->dlen = size;
2329 rule->udata = ulen ? 1 : 0;
2330
2331 if (ulen) {
2332 udata = nft_userdata(rule);
2333 udata->len = ulen - 1;
2334 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2335 }
2336
2337 expr = nft_expr_first(rule);
2338 for (i = 0; i < n; i++) {
2339 err = nf_tables_newexpr(&ctx, &info[i], expr);
2340 if (err < 0)
2341 goto err2;
2342 info[i].ops = NULL;
2343 expr = nft_expr_next(expr);
2344 }
2345
2346 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
2347 if (!nft_is_active_next(net, old_rule)) {
2348 err = -ENOENT;
2349 goto err2;
2350 }
2351 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
2352 old_rule);
2353 if (trans == NULL) {
2354 err = -ENOMEM;
2355 goto err2;
2356 }
2357 nft_deactivate_next(net, old_rule);
2358 chain->use--;
2359
2360 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2361 err = -ENOMEM;
2362 goto err2;
2363 }
2364
2365 list_add_tail_rcu(&rule->list, &old_rule->list);
2366 } else {
2367 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2368 err = -ENOMEM;
2369 goto err2;
2370 }
2371
2372 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2373 if (old_rule)
2374 list_add_rcu(&rule->list, &old_rule->list);
2375 else
2376 list_add_tail_rcu(&rule->list, &chain->rules);
2377 } else {
2378 if (old_rule)
2379 list_add_tail_rcu(&rule->list, &old_rule->list);
2380 else
2381 list_add_rcu(&rule->list, &chain->rules);
2382 }
2383 }
2384 chain->use++;
2385 return 0;
2386
2387 err2:
2388 nf_tables_rule_destroy(&ctx, rule);
2389 err1:
2390 for (i = 0; i < n; i++) {
2391 if (info[i].ops != NULL)
2392 module_put(info[i].ops->type->owner);
2393 }
2394 return err;
2395 }
2396
2397 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2398 const struct nlattr *nla)
2399 {
2400 u32 id = ntohl(nla_get_be32(nla));
2401 struct nft_trans *trans;
2402
2403 list_for_each_entry(trans, &net->nft.commit_list, list) {
2404 struct nft_rule *rule = nft_trans_rule(trans);
2405
2406 if (trans->msg_type == NFT_MSG_NEWRULE &&
2407 id == nft_trans_rule_id(trans))
2408 return rule;
2409 }
2410 return ERR_PTR(-ENOENT);
2411 }
2412
2413 static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2414 struct sk_buff *skb, const struct nlmsghdr *nlh,
2415 const struct nlattr * const nla[],
2416 struct netlink_ext_ack *extack)
2417 {
2418 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2419 u8 genmask = nft_genmask_next(net);
2420 struct nft_af_info *afi;
2421 struct nft_table *table;
2422 struct nft_chain *chain = NULL;
2423 struct nft_rule *rule;
2424 int family = nfmsg->nfgen_family, err = 0;
2425 struct nft_ctx ctx;
2426
2427 afi = nf_tables_afinfo_lookup(net, family, false);
2428 if (IS_ERR(afi))
2429 return PTR_ERR(afi);
2430
2431 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
2432 if (IS_ERR(table))
2433 return PTR_ERR(table);
2434
2435 if (nla[NFTA_RULE_CHAIN]) {
2436 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN],
2437 genmask);
2438 if (IS_ERR(chain))
2439 return PTR_ERR(chain);
2440 }
2441
2442 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
2443
2444 if (chain) {
2445 if (nla[NFTA_RULE_HANDLE]) {
2446 rule = nf_tables_rule_lookup(chain,
2447 nla[NFTA_RULE_HANDLE]);
2448 if (IS_ERR(rule))
2449 return PTR_ERR(rule);
2450
2451 err = nft_delrule(&ctx, rule);
2452 } else if (nla[NFTA_RULE_ID]) {
2453 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2454 if (IS_ERR(rule))
2455 return PTR_ERR(rule);
2456
2457 err = nft_delrule(&ctx, rule);
2458 } else {
2459 err = nft_delrule_by_chain(&ctx);
2460 }
2461 } else {
2462 list_for_each_entry(chain, &table->chains, list) {
2463 if (!nft_is_active_next(net, chain))
2464 continue;
2465
2466 ctx.chain = chain;
2467 err = nft_delrule_by_chain(&ctx);
2468 if (err < 0)
2469 break;
2470 }
2471 }
2472
2473 return err;
2474 }
2475
2476 /*
2477 * Sets
2478 */
2479
2480 static LIST_HEAD(nf_tables_set_types);
2481
2482 int nft_register_set(struct nft_set_type *type)
2483 {
2484 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2485 list_add_tail_rcu(&type->list, &nf_tables_set_types);
2486 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2487 return 0;
2488 }
2489 EXPORT_SYMBOL_GPL(nft_register_set);
2490
2491 void nft_unregister_set(struct nft_set_type *type)
2492 {
2493 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2494 list_del_rcu(&type->list);
2495 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2496 }
2497 EXPORT_SYMBOL_GPL(nft_unregister_set);
2498
2499 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2500 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
2501
2502 static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
2503 {
2504 return (flags & ops->features) == (flags & NFT_SET_FEATURES);
2505 }
2506
2507 /*
2508 * Select a set implementation based on the data characteristics and the
2509 * given policy. The total memory use might not be known if no size is
2510 * given, in that case the amount of memory per element is used.
2511 */
2512 static const struct nft_set_ops *
2513 nft_select_set_ops(const struct nft_ctx *ctx,
2514 const struct nlattr * const nla[],
2515 const struct nft_set_desc *desc,
2516 enum nft_set_policies policy)
2517 {
2518 const struct nft_set_ops *ops, *bops;
2519 struct nft_set_estimate est, best;
2520 const struct nft_set_type *type;
2521 u32 flags = 0;
2522
2523 #ifdef CONFIG_MODULES
2524 if (list_empty(&nf_tables_set_types)) {
2525 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2526 request_module("nft-set");
2527 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2528 if (!list_empty(&nf_tables_set_types))
2529 return ERR_PTR(-EAGAIN);
2530 }
2531 #endif
2532 if (nla[NFTA_SET_FLAGS] != NULL)
2533 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2534
2535 bops = NULL;
2536 best.size = ~0;
2537 best.lookup = ~0;
2538 best.space = ~0;
2539
2540 list_for_each_entry(type, &nf_tables_set_types, list) {
2541 if (!type->select_ops)
2542 ops = type->ops;
2543 else
2544 ops = type->select_ops(ctx, desc, flags);
2545 if (!ops)
2546 continue;
2547
2548 if (!nft_set_ops_candidate(ops, flags))
2549 continue;
2550 if (!ops->estimate(desc, flags, &est))
2551 continue;
2552
2553 switch (policy) {
2554 case NFT_SET_POL_PERFORMANCE:
2555 if (est.lookup < best.lookup)
2556 break;
2557 if (est.lookup == best.lookup &&
2558 est.space < best.space)
2559 break;
2560 continue;
2561 case NFT_SET_POL_MEMORY:
2562 if (!desc->size) {
2563 if (est.space < best.space)
2564 break;
2565 if (est.space == best.space &&
2566 est.lookup < best.lookup)
2567 break;
2568 } else if (est.size < best.size) {
2569 break;
2570 }
2571 continue;
2572 default:
2573 break;
2574 }
2575
2576 if (!try_module_get(type->owner))
2577 continue;
2578 if (bops != NULL)
2579 module_put(bops->type->owner);
2580
2581 bops = ops;
2582 best = est;
2583 }
2584
2585 if (bops != NULL)
2586 return bops;
2587
2588 return ERR_PTR(-EOPNOTSUPP);
2589 }
2590
2591 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
2592 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2593 .len = NFT_TABLE_MAXNAMELEN - 1 },
2594 [NFTA_SET_NAME] = { .type = NLA_STRING,
2595 .len = NFT_SET_MAXNAMELEN - 1 },
2596 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2597 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2598 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2599 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2600 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
2601 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2602 [NFTA_SET_DESC] = { .type = NLA_NESTED },
2603 [NFTA_SET_ID] = { .type = NLA_U32 },
2604 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2605 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
2606 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2607 .len = NFT_USERDATA_MAXLEN },
2608 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
2609 };
2610
2611 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2612 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
2613 };
2614
2615 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
2616 const struct sk_buff *skb,
2617 const struct nlmsghdr *nlh,
2618 const struct nlattr * const nla[],
2619 u8 genmask)
2620 {
2621 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2622 struct nft_af_info *afi = NULL;
2623 struct nft_table *table = NULL;
2624
2625 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
2626 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
2627 if (IS_ERR(afi))
2628 return PTR_ERR(afi);
2629 }
2630
2631 if (nla[NFTA_SET_TABLE] != NULL) {
2632 if (afi == NULL)
2633 return -EAFNOSUPPORT;
2634
2635 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE],
2636 genmask);
2637 if (IS_ERR(table))
2638 return PTR_ERR(table);
2639 }
2640
2641 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
2642 return 0;
2643 }
2644
2645 static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2646 const struct nlattr *nla, u8 genmask)
2647 {
2648 struct nft_set *set;
2649
2650 if (nla == NULL)
2651 return ERR_PTR(-EINVAL);
2652
2653 list_for_each_entry(set, &table->sets, list) {
2654 if (!nla_strcmp(nla, set->name) &&
2655 nft_active_genmask(set, genmask))
2656 return set;
2657 }
2658 return ERR_PTR(-ENOENT);
2659 }
2660
2661 static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2662 const struct nlattr *nla,
2663 u8 genmask)
2664 {
2665 struct nft_trans *trans;
2666 u32 id = ntohl(nla_get_be32(nla));
2667
2668 list_for_each_entry(trans, &net->nft.commit_list, list) {
2669 struct nft_set *set = nft_trans_set(trans);
2670
2671 if (trans->msg_type == NFT_MSG_NEWSET &&
2672 id == nft_trans_set_id(trans) &&
2673 nft_active_genmask(set, genmask))
2674 return set;
2675 }
2676 return ERR_PTR(-ENOENT);
2677 }
2678
2679 struct nft_set *nft_set_lookup(const struct net *net,
2680 const struct nft_table *table,
2681 const struct nlattr *nla_set_name,
2682 const struct nlattr *nla_set_id,
2683 u8 genmask)
2684 {
2685 struct nft_set *set;
2686
2687 set = nf_tables_set_lookup(table, nla_set_name, genmask);
2688 if (IS_ERR(set)) {
2689 if (!nla_set_id)
2690 return set;
2691
2692 set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
2693 }
2694 return set;
2695 }
2696 EXPORT_SYMBOL_GPL(nft_set_lookup);
2697
2698 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2699 const char *name)
2700 {
2701 const struct nft_set *i;
2702 const char *p;
2703 unsigned long *inuse;
2704 unsigned int n = 0, min = 0;
2705
2706 p = strchr(name, '%');
2707 if (p != NULL) {
2708 if (p[1] != 'd' || strchr(p + 2, '%'))
2709 return -EINVAL;
2710
2711 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2712 if (inuse == NULL)
2713 return -ENOMEM;
2714 cont:
2715 list_for_each_entry(i, &ctx->table->sets, list) {
2716 int tmp;
2717
2718 if (!nft_is_active_next(ctx->net, set))
2719 continue;
2720 if (!sscanf(i->name, name, &tmp))
2721 continue;
2722 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
2723 continue;
2724
2725 set_bit(tmp - min, inuse);
2726 }
2727
2728 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
2729 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2730 min += BITS_PER_BYTE * PAGE_SIZE;
2731 memset(inuse, 0, PAGE_SIZE);
2732 goto cont;
2733 }
2734 free_page((unsigned long)inuse);
2735 }
2736
2737 set->name = kasprintf(GFP_KERNEL, name, min + n);
2738 if (!set->name)
2739 return -ENOMEM;
2740
2741 list_for_each_entry(i, &ctx->table->sets, list) {
2742 if (!nft_is_active_next(ctx->net, i))
2743 continue;
2744 if (!strcmp(set->name, i->name)) {
2745 kfree(set->name);
2746 return -ENFILE;
2747 }
2748 }
2749 return 0;
2750 }
2751
2752 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2753 const struct nft_set *set, u16 event, u16 flags)
2754 {
2755 struct nfgenmsg *nfmsg;
2756 struct nlmsghdr *nlh;
2757 struct nlattr *desc;
2758 u32 portid = ctx->portid;
2759 u32 seq = ctx->seq;
2760
2761 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2762 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2763 flags);
2764 if (nlh == NULL)
2765 goto nla_put_failure;
2766
2767 nfmsg = nlmsg_data(nlh);
2768 nfmsg->nfgen_family = ctx->afi->family;
2769 nfmsg->version = NFNETLINK_V0;
2770 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
2771
2772 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2773 goto nla_put_failure;
2774 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2775 goto nla_put_failure;
2776 if (set->flags != 0)
2777 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2778 goto nla_put_failure;
2779
2780 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2781 goto nla_put_failure;
2782 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2783 goto nla_put_failure;
2784 if (set->flags & NFT_SET_MAP) {
2785 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2786 goto nla_put_failure;
2787 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2788 goto nla_put_failure;
2789 }
2790 if (set->flags & NFT_SET_OBJECT &&
2791 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2792 goto nla_put_failure;
2793
2794 if (set->timeout &&
2795 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2796 cpu_to_be64(jiffies_to_msecs(set->timeout)),
2797 NFTA_SET_PAD))
2798 goto nla_put_failure;
2799 if (set->gc_int &&
2800 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2801 goto nla_put_failure;
2802
2803 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2804 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2805 goto nla_put_failure;
2806 }
2807
2808 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2809 goto nla_put_failure;
2810
2811 desc = nla_nest_start(skb, NFTA_SET_DESC);
2812 if (desc == NULL)
2813 goto nla_put_failure;
2814 if (set->size &&
2815 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2816 goto nla_put_failure;
2817 nla_nest_end(skb, desc);
2818
2819 nlmsg_end(skb, nlh);
2820 return 0;
2821
2822 nla_put_failure:
2823 nlmsg_trim(skb, nlh);
2824 return -1;
2825 }
2826
2827 static void nf_tables_set_notify(const struct nft_ctx *ctx,
2828 const struct nft_set *set, int event,
2829 gfp_t gfp_flags)
2830 {
2831 struct sk_buff *skb;
2832 u32 portid = ctx->portid;
2833 int err;
2834
2835 if (!ctx->report &&
2836 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2837 return;
2838
2839 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
2840 if (skb == NULL)
2841 goto err;
2842
2843 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2844 if (err < 0) {
2845 kfree_skb(skb);
2846 goto err;
2847 }
2848
2849 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2850 gfp_flags);
2851 return;
2852 err:
2853 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
2854 }
2855
2856 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
2857 {
2858 const struct nft_set *set;
2859 unsigned int idx, s_idx = cb->args[0];
2860 struct nft_af_info *afi;
2861 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2862 struct net *net = sock_net(skb->sk);
2863 int cur_family = cb->args[3];
2864 struct nft_ctx *ctx = cb->data, ctx_set;
2865
2866 if (cb->args[1])
2867 return skb->len;
2868
2869 rcu_read_lock();
2870 cb->seq = net->nft.base_seq;
2871
2872 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
2873 if (ctx->afi && ctx->afi != afi)
2874 continue;
2875
2876 if (cur_family) {
2877 if (afi->family != cur_family)
2878 continue;
2879
2880 cur_family = 0;
2881 }
2882 list_for_each_entry_rcu(table, &afi->tables, list) {
2883 if (ctx->table && ctx->table != table)
2884 continue;
2885
2886 if (cur_table) {
2887 if (cur_table != table)
2888 continue;
2889
2890 cur_table = NULL;
2891 }
2892 idx = 0;
2893 list_for_each_entry_rcu(set, &table->sets, list) {
2894 if (idx < s_idx)
2895 goto cont;
2896 if (!nft_is_active(net, set))
2897 goto cont;
2898
2899 ctx_set = *ctx;
2900 ctx_set.table = table;
2901 ctx_set.afi = afi;
2902 if (nf_tables_fill_set(skb, &ctx_set, set,
2903 NFT_MSG_NEWSET,
2904 NLM_F_MULTI) < 0) {
2905 cb->args[0] = idx;
2906 cb->args[2] = (unsigned long) table;
2907 cb->args[3] = afi->family;
2908 goto done;
2909 }
2910 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2911 cont:
2912 idx++;
2913 }
2914 if (s_idx)
2915 s_idx = 0;
2916 }
2917 }
2918 cb->args[1] = 1;
2919 done:
2920 rcu_read_unlock();
2921 return skb->len;
2922 }
2923
2924 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
2925 {
2926 kfree(cb->data);
2927 return 0;
2928 }
2929
2930 static int nf_tables_getset(struct net *net, struct sock *nlsk,
2931 struct sk_buff *skb, const struct nlmsghdr *nlh,
2932 const struct nlattr * const nla[],
2933 struct netlink_ext_ack *extack)
2934 {
2935 u8 genmask = nft_genmask_cur(net);
2936 const struct nft_set *set;
2937 struct nft_ctx ctx;
2938 struct sk_buff *skb2;
2939 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2940 int err;
2941
2942 /* Verify existence before starting dump */
2943 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
2944 if (err < 0)
2945 return err;
2946
2947 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2948 struct netlink_dump_control c = {
2949 .dump = nf_tables_dump_sets,
2950 .done = nf_tables_dump_sets_done,
2951 };
2952 struct nft_ctx *ctx_dump;
2953
2954 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2955 if (ctx_dump == NULL)
2956 return -ENOMEM;
2957
2958 *ctx_dump = ctx;
2959 c.data = ctx_dump;
2960
2961 return netlink_dump_start(nlsk, skb, nlh, &c);
2962 }
2963
2964 /* Only accept unspec with dump */
2965 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2966 return -EAFNOSUPPORT;
2967 if (!nla[NFTA_SET_TABLE])
2968 return -EINVAL;
2969
2970 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
2971 if (IS_ERR(set))
2972 return PTR_ERR(set);
2973
2974 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2975 if (skb2 == NULL)
2976 return -ENOMEM;
2977
2978 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2979 if (err < 0)
2980 goto err;
2981
2982 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2983
2984 err:
2985 kfree_skb(skb2);
2986 return err;
2987 }
2988
2989 static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2990 struct nft_set_desc *desc,
2991 const struct nlattr *nla)
2992 {
2993 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2994 int err;
2995
2996 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
2997 nft_set_desc_policy, NULL);
2998 if (err < 0)
2999 return err;
3000
3001 if (da[NFTA_SET_DESC_SIZE] != NULL)
3002 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3003
3004 return 0;
3005 }
3006
3007 static int nf_tables_newset(struct net *net, struct sock *nlsk,
3008 struct sk_buff *skb, const struct nlmsghdr *nlh,
3009 const struct nlattr * const nla[],
3010 struct netlink_ext_ack *extack)
3011 {
3012 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3013 u8 genmask = nft_genmask_next(net);
3014 const struct nft_set_ops *ops;
3015 struct nft_af_info *afi;
3016 struct nft_table *table;
3017 struct nft_set *set;
3018 struct nft_ctx ctx;
3019 char *name;
3020 unsigned int size;
3021 bool create;
3022 u64 timeout;
3023 u32 ktype, dtype, flags, policy, gc_int, objtype;
3024 struct nft_set_desc desc;
3025 unsigned char *udata;
3026 u16 udlen;
3027 int err;
3028
3029 if (nla[NFTA_SET_TABLE] == NULL ||
3030 nla[NFTA_SET_NAME] == NULL ||
3031 nla[NFTA_SET_KEY_LEN] == NULL ||
3032 nla[NFTA_SET_ID] == NULL)
3033 return -EINVAL;
3034
3035 memset(&desc, 0, sizeof(desc));
3036
3037 ktype = NFT_DATA_VALUE;
3038 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3039 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3040 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3041 return -EINVAL;
3042 }
3043
3044 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
3045 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
3046 return -EINVAL;
3047
3048 flags = 0;
3049 if (nla[NFTA_SET_FLAGS] != NULL) {
3050 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3051 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
3052 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
3053 NFT_SET_MAP | NFT_SET_EVAL |
3054 NFT_SET_OBJECT))
3055 return -EINVAL;
3056 /* Only one of these operations is supported */
3057 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3058 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
3059 return -EOPNOTSUPP;
3060 }
3061
3062 dtype = 0;
3063 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3064 if (!(flags & NFT_SET_MAP))
3065 return -EINVAL;
3066
3067 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3068 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3069 dtype != NFT_DATA_VERDICT)
3070 return -EINVAL;
3071
3072 if (dtype != NFT_DATA_VERDICT) {
3073 if (nla[NFTA_SET_DATA_LEN] == NULL)
3074 return -EINVAL;
3075 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
3076 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
3077 return -EINVAL;
3078 } else
3079 desc.dlen = sizeof(struct nft_verdict);
3080 } else if (flags & NFT_SET_MAP)
3081 return -EINVAL;
3082
3083 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3084 if (!(flags & NFT_SET_OBJECT))
3085 return -EINVAL;
3086
3087 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3088 if (objtype == NFT_OBJECT_UNSPEC ||
3089 objtype > NFT_OBJECT_MAX)
3090 return -EINVAL;
3091 } else if (flags & NFT_SET_OBJECT)
3092 return -EINVAL;
3093 else
3094 objtype = NFT_OBJECT_UNSPEC;
3095
3096 timeout = 0;
3097 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3098 if (!(flags & NFT_SET_TIMEOUT))
3099 return -EINVAL;
3100 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3101 nla[NFTA_SET_TIMEOUT])));
3102 }
3103 gc_int = 0;
3104 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3105 if (!(flags & NFT_SET_TIMEOUT))
3106 return -EINVAL;
3107 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3108 }
3109
3110 policy = NFT_SET_POL_PERFORMANCE;
3111 if (nla[NFTA_SET_POLICY] != NULL)
3112 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3113
3114 if (nla[NFTA_SET_DESC] != NULL) {
3115 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3116 if (err < 0)
3117 return err;
3118 }
3119
3120 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3121
3122 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
3123 if (IS_ERR(afi))
3124 return PTR_ERR(afi);
3125
3126 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask);
3127 if (IS_ERR(table))
3128 return PTR_ERR(table);
3129
3130 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
3131
3132 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
3133 if (IS_ERR(set)) {
3134 if (PTR_ERR(set) != -ENOENT)
3135 return PTR_ERR(set);
3136 } else {
3137 if (nlh->nlmsg_flags & NLM_F_EXCL)
3138 return -EEXIST;
3139 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3140 return -EOPNOTSUPP;
3141 return 0;
3142 }
3143
3144 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3145 return -ENOENT;
3146
3147 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
3148 if (IS_ERR(ops))
3149 return PTR_ERR(ops);
3150
3151 udlen = 0;
3152 if (nla[NFTA_SET_USERDATA])
3153 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3154
3155 size = 0;
3156 if (ops->privsize != NULL)
3157 size = ops->privsize(nla, &desc);
3158
3159 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3160 if (!set) {
3161 err = -ENOMEM;
3162 goto err1;
3163 }
3164
3165 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3166 if (!name) {
3167 err = -ENOMEM;
3168 goto err2;
3169 }
3170
3171 err = nf_tables_set_alloc_name(&ctx, set, name);
3172 kfree(name);
3173 if (err < 0)
3174 goto err2;
3175
3176 udata = NULL;
3177 if (udlen) {
3178 udata = set->data + size;
3179 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3180 }
3181
3182 INIT_LIST_HEAD(&set->bindings);
3183 set->ops = ops;
3184 set->ktype = ktype;
3185 set->klen = desc.klen;
3186 set->dtype = dtype;
3187 set->objtype = objtype;
3188 set->dlen = desc.dlen;
3189 set->flags = flags;
3190 set->size = desc.size;
3191 set->policy = policy;
3192 set->udlen = udlen;
3193 set->udata = udata;
3194 set->timeout = timeout;
3195 set->gc_int = gc_int;
3196
3197 err = ops->init(set, &desc, nla);
3198 if (err < 0)
3199 goto err3;
3200
3201 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
3202 if (err < 0)
3203 goto err4;
3204
3205 list_add_tail_rcu(&set->list, &table->sets);
3206 table->use++;
3207 return 0;
3208
3209 err4:
3210 ops->destroy(set);
3211 err3:
3212 kfree(set->name);
3213 err2:
3214 kvfree(set);
3215 err1:
3216 module_put(ops->type->owner);
3217 return err;
3218 }
3219
3220 static void nft_set_destroy(struct nft_set *set)
3221 {
3222 set->ops->destroy(set);
3223 module_put(set->ops->type->owner);
3224 kfree(set->name);
3225 kvfree(set);
3226 }
3227
3228 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3229 {
3230 list_del_rcu(&set->list);
3231 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
3232 nft_set_destroy(set);
3233 }
3234
3235 static int nf_tables_delset(struct net *net, struct sock *nlsk,
3236 struct sk_buff *skb, const struct nlmsghdr *nlh,
3237 const struct nlattr * const nla[],
3238 struct netlink_ext_ack *extack)
3239 {
3240 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3241 u8 genmask = nft_genmask_next(net);
3242 struct nft_set *set;
3243 struct nft_ctx ctx;
3244 int err;
3245
3246 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3247 return -EAFNOSUPPORT;
3248 if (nla[NFTA_SET_TABLE] == NULL)
3249 return -EINVAL;
3250
3251 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
3252 if (err < 0)
3253 return err;
3254
3255 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
3256 if (IS_ERR(set))
3257 return PTR_ERR(set);
3258
3259 if (!list_empty(&set->bindings) ||
3260 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0))
3261 return -EBUSY;
3262
3263 return nft_delset(&ctx, set);
3264 }
3265
3266 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
3267 struct nft_set *set,
3268 const struct nft_set_iter *iter,
3269 struct nft_set_elem *elem)
3270 {
3271 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3272 enum nft_registers dreg;
3273
3274 dreg = nft_type_to_reg(set->dtype);
3275 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3276 set->dtype == NFT_DATA_VERDICT ?
3277 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3278 set->dlen);
3279 }
3280
3281 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3282 struct nft_set_binding *binding)
3283 {
3284 struct nft_set_binding *i;
3285 struct nft_set_iter iter;
3286
3287 if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
3288 return -EBUSY;
3289
3290 if (binding->flags & NFT_SET_MAP) {
3291 /* If the set is already bound to the same chain all
3292 * jumps are already validated for that chain.
3293 */
3294 list_for_each_entry(i, &set->bindings, list) {
3295 if (i->flags & NFT_SET_MAP &&
3296 i->chain == binding->chain)
3297 goto bind;
3298 }
3299
3300 iter.genmask = nft_genmask_next(ctx->net);
3301 iter.skip = 0;
3302 iter.count = 0;
3303 iter.err = 0;
3304 iter.fn = nf_tables_bind_check_setelem;
3305
3306 set->ops->walk(ctx, set, &iter);
3307 if (iter.err < 0)
3308 return iter.err;
3309 }
3310 bind:
3311 binding->chain = ctx->chain;
3312 list_add_tail_rcu(&binding->list, &set->bindings);
3313 return 0;
3314 }
3315 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
3316
3317 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3318 struct nft_set_binding *binding)
3319 {
3320 list_del_rcu(&binding->list);
3321
3322 if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS &&
3323 nft_is_active(ctx->net, set))
3324 nf_tables_set_destroy(ctx, set);
3325 }
3326 EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
3327
3328 const struct nft_set_ext_type nft_set_ext_types[] = {
3329 [NFT_SET_EXT_KEY] = {
3330 .align = __alignof__(u32),
3331 },
3332 [NFT_SET_EXT_DATA] = {
3333 .align = __alignof__(u32),
3334 },
3335 [NFT_SET_EXT_EXPR] = {
3336 .align = __alignof__(struct nft_expr),
3337 },
3338 [NFT_SET_EXT_OBJREF] = {
3339 .len = sizeof(struct nft_object *),
3340 .align = __alignof__(struct nft_object *),
3341 },
3342 [NFT_SET_EXT_FLAGS] = {
3343 .len = sizeof(u8),
3344 .align = __alignof__(u8),
3345 },
3346 [NFT_SET_EXT_TIMEOUT] = {
3347 .len = sizeof(u64),
3348 .align = __alignof__(u64),
3349 },
3350 [NFT_SET_EXT_EXPIRATION] = {
3351 .len = sizeof(unsigned long),
3352 .align = __alignof__(unsigned long),
3353 },
3354 [NFT_SET_EXT_USERDATA] = {
3355 .len = sizeof(struct nft_userdata),
3356 .align = __alignof__(struct nft_userdata),
3357 },
3358 };
3359 EXPORT_SYMBOL_GPL(nft_set_ext_types);
3360
3361 /*
3362 * Set elements
3363 */
3364
3365 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3366 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3367 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3368 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
3369 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
3370 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3371 .len = NFT_USERDATA_MAXLEN },
3372 };
3373
3374 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
3375 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3376 .len = NFT_TABLE_MAXNAMELEN - 1 },
3377 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3378 .len = NFT_SET_MAXNAMELEN - 1 },
3379 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
3380 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
3381 };
3382
3383 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
3384 const struct sk_buff *skb,
3385 const struct nlmsghdr *nlh,
3386 const struct nlattr * const nla[],
3387 u8 genmask)
3388 {
3389 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3390 struct nft_af_info *afi;
3391 struct nft_table *table;
3392
3393 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
3394 if (IS_ERR(afi))
3395 return PTR_ERR(afi);
3396
3397 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE],
3398 genmask);
3399 if (IS_ERR(table))
3400 return PTR_ERR(table);
3401
3402 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
3403 return 0;
3404 }
3405
3406 static int nf_tables_fill_setelem(struct sk_buff *skb,
3407 const struct nft_set *set,
3408 const struct nft_set_elem *elem)
3409 {
3410 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3411 unsigned char *b = skb_tail_pointer(skb);
3412 struct nlattr *nest;
3413
3414 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3415 if (nest == NULL)
3416 goto nla_put_failure;
3417
3418 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3419 NFT_DATA_VALUE, set->klen) < 0)
3420 goto nla_put_failure;
3421
3422 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3423 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
3424 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3425 set->dlen) < 0)
3426 goto nla_put_failure;
3427
3428 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3429 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3430 goto nla_put_failure;
3431
3432 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3433 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3434 (*nft_set_ext_obj(ext))->name) < 0)
3435 goto nla_put_failure;
3436
3437 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3438 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3439 htonl(*nft_set_ext_flags(ext))))
3440 goto nla_put_failure;
3441
3442 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3443 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
3444 cpu_to_be64(jiffies_to_msecs(
3445 *nft_set_ext_timeout(ext))),
3446 NFTA_SET_ELEM_PAD))
3447 goto nla_put_failure;
3448
3449 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3450 unsigned long expires, now = jiffies;
3451
3452 expires = *nft_set_ext_expiration(ext);
3453 if (time_before(now, expires))
3454 expires -= now;
3455 else
3456 expires = 0;
3457
3458 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
3459 cpu_to_be64(jiffies_to_msecs(expires)),
3460 NFTA_SET_ELEM_PAD))
3461 goto nla_put_failure;
3462 }
3463
3464 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3465 struct nft_userdata *udata;
3466
3467 udata = nft_set_ext_userdata(ext);
3468 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3469 udata->len + 1, udata->data))
3470 goto nla_put_failure;
3471 }
3472
3473 nla_nest_end(skb, nest);
3474 return 0;
3475
3476 nla_put_failure:
3477 nlmsg_trim(skb, b);
3478 return -EMSGSIZE;
3479 }
3480
3481 struct nft_set_dump_args {
3482 const struct netlink_callback *cb;
3483 struct nft_set_iter iter;
3484 struct sk_buff *skb;
3485 };
3486
3487 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
3488 struct nft_set *set,
3489 const struct nft_set_iter *iter,
3490 struct nft_set_elem *elem)
3491 {
3492 struct nft_set_dump_args *args;
3493
3494 args = container_of(iter, struct nft_set_dump_args, iter);
3495 return nf_tables_fill_setelem(args->skb, set, elem);
3496 }
3497
3498 struct nft_set_dump_ctx {
3499 const struct nft_set *set;
3500 struct nft_ctx ctx;
3501 };
3502
3503 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3504 {
3505 struct nft_set_dump_ctx *dump_ctx = cb->data;
3506 struct net *net = sock_net(skb->sk);
3507 struct nft_af_info *afi;
3508 struct nft_table *table;
3509 struct nft_set *set;
3510 struct nft_set_dump_args args;
3511 bool set_found = false;
3512 struct nfgenmsg *nfmsg;
3513 struct nlmsghdr *nlh;
3514 struct nlattr *nest;
3515 u32 portid, seq;
3516 int event;
3517
3518 rcu_read_lock();
3519 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
3520 if (afi != dump_ctx->ctx.afi)
3521 continue;
3522
3523 list_for_each_entry_rcu(table, &afi->tables, list) {
3524 if (table != dump_ctx->ctx.table)
3525 continue;
3526
3527 list_for_each_entry_rcu(set, &table->sets, list) {
3528 if (set == dump_ctx->set) {
3529 set_found = true;
3530 break;
3531 }
3532 }
3533 break;
3534 }
3535 break;
3536 }
3537
3538 if (!set_found) {
3539 rcu_read_unlock();
3540 return -ENOENT;
3541 }
3542
3543 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
3544 portid = NETLINK_CB(cb->skb).portid;
3545 seq = cb->nlh->nlmsg_seq;
3546
3547 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3548 NLM_F_MULTI);
3549 if (nlh == NULL)
3550 goto nla_put_failure;
3551
3552 nfmsg = nlmsg_data(nlh);
3553 nfmsg->nfgen_family = afi->family;
3554 nfmsg->version = NFNETLINK_V0;
3555 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
3556
3557 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
3558 goto nla_put_failure;
3559 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3560 goto nla_put_failure;
3561
3562 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3563 if (nest == NULL)
3564 goto nla_put_failure;
3565
3566 args.cb = cb;
3567 args.skb = skb;
3568 args.iter.genmask = nft_genmask_cur(net);
3569 args.iter.skip = cb->args[0];
3570 args.iter.count = 0;
3571 args.iter.err = 0;
3572 args.iter.fn = nf_tables_dump_setelem;
3573 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3574 rcu_read_unlock();
3575
3576 nla_nest_end(skb, nest);
3577 nlmsg_end(skb, nlh);
3578
3579 if (args.iter.err && args.iter.err != -EMSGSIZE)
3580 return args.iter.err;
3581 if (args.iter.count == cb->args[0])
3582 return 0;
3583
3584 cb->args[0] = args.iter.count;
3585 return skb->len;
3586
3587 nla_put_failure:
3588 rcu_read_unlock();
3589 return -ENOSPC;
3590 }
3591
3592 static int nf_tables_dump_set_done(struct netlink_callback *cb)
3593 {
3594 kfree(cb->data);
3595 return 0;
3596 }
3597
3598 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3599 const struct nft_ctx *ctx, u32 seq,
3600 u32 portid, int event, u16 flags,
3601 const struct nft_set *set,
3602 const struct nft_set_elem *elem)
3603 {
3604 struct nfgenmsg *nfmsg;
3605 struct nlmsghdr *nlh;
3606 struct nlattr *nest;
3607 int err;
3608
3609 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3610 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3611 flags);
3612 if (nlh == NULL)
3613 goto nla_put_failure;
3614
3615 nfmsg = nlmsg_data(nlh);
3616 nfmsg->nfgen_family = ctx->afi->family;
3617 nfmsg->version = NFNETLINK_V0;
3618 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
3619
3620 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3621 goto nla_put_failure;
3622 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3623 goto nla_put_failure;
3624
3625 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3626 if (nest == NULL)
3627 goto nla_put_failure;
3628
3629 err = nf_tables_fill_setelem(skb, set, elem);
3630 if (err < 0)
3631 goto nla_put_failure;
3632
3633 nla_nest_end(skb, nest);
3634
3635 nlmsg_end(skb, nlh);
3636 return 0;
3637
3638 nla_put_failure:
3639 nlmsg_trim(skb, nlh);
3640 return -1;
3641 }
3642
3643 static int nft_setelem_parse_flags(const struct nft_set *set,
3644 const struct nlattr *attr, u32 *flags)
3645 {
3646 if (attr == NULL)
3647 return 0;
3648
3649 *flags = ntohl(nla_get_be32(attr));
3650 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3651 return -EINVAL;
3652 if (!(set->flags & NFT_SET_INTERVAL) &&
3653 *flags & NFT_SET_ELEM_INTERVAL_END)
3654 return -EINVAL;
3655
3656 return 0;
3657 }
3658
3659 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3660 const struct nlattr *attr)
3661 {
3662 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3663 const struct nft_set_ext *ext;
3664 struct nft_data_desc desc;
3665 struct nft_set_elem elem;
3666 struct sk_buff *skb;
3667 uint32_t flags = 0;
3668 void *priv;
3669 int err;
3670
3671 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3672 nft_set_elem_policy, NULL);
3673 if (err < 0)
3674 return err;
3675
3676 if (!nla[NFTA_SET_ELEM_KEY])
3677 return -EINVAL;
3678
3679 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3680 if (err < 0)
3681 return err;
3682
3683 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3684 nla[NFTA_SET_ELEM_KEY]);
3685 if (err < 0)
3686 return err;
3687
3688 err = -EINVAL;
3689 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3690 return err;
3691
3692 priv = set->ops->get(ctx->net, set, &elem, flags);
3693 if (IS_ERR(priv))
3694 return PTR_ERR(priv);
3695
3696 elem.priv = priv;
3697 ext = nft_set_elem_ext(set, &elem);
3698
3699 err = -ENOMEM;
3700 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3701 if (skb == NULL)
3702 goto err1;
3703
3704 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3705 NFT_MSG_NEWSETELEM, 0, set, &elem);
3706 if (err < 0)
3707 goto err2;
3708
3709 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3710 /* This avoids a loop in nfnetlink. */
3711 if (err < 0)
3712 goto err1;
3713
3714 return 0;
3715 err2:
3716 kfree_skb(skb);
3717 err1:
3718 /* this avoids a loop in nfnetlink. */
3719 return err == -EAGAIN ? -ENOBUFS : err;
3720 }
3721
3722 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3723 struct sk_buff *skb, const struct nlmsghdr *nlh,
3724 const struct nlattr * const nla[],
3725 struct netlink_ext_ack *extack)
3726 {
3727 u8 genmask = nft_genmask_cur(net);
3728 struct nft_set *set;
3729 struct nlattr *attr;
3730 struct nft_ctx ctx;
3731 int rem, err = 0;
3732
3733 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
3734 if (err < 0)
3735 return err;
3736
3737 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
3738 genmask);
3739 if (IS_ERR(set))
3740 return PTR_ERR(set);
3741
3742 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3743 struct netlink_dump_control c = {
3744 .dump = nf_tables_dump_set,
3745 .done = nf_tables_dump_set_done,
3746 };
3747 struct nft_set_dump_ctx *dump_ctx;
3748
3749 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3750 if (!dump_ctx)
3751 return -ENOMEM;
3752
3753 dump_ctx->set = set;
3754 dump_ctx->ctx = ctx;
3755
3756 c.data = dump_ctx;
3757 return netlink_dump_start(nlsk, skb, nlh, &c);
3758 }
3759
3760 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3761 return -EINVAL;
3762
3763 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3764 err = nft_get_set_elem(&ctx, set, attr);
3765 if (err < 0)
3766 break;
3767 }
3768
3769 return err;
3770 }
3771
3772 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3773 const struct nft_set *set,
3774 const struct nft_set_elem *elem,
3775 int event, u16 flags)
3776 {
3777 struct net *net = ctx->net;
3778 u32 portid = ctx->portid;
3779 struct sk_buff *skb;
3780 int err;
3781
3782 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
3783 return;
3784
3785 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3786 if (skb == NULL)
3787 goto err;
3788
3789 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3790 set, elem);
3791 if (err < 0) {
3792 kfree_skb(skb);
3793 goto err;
3794 }
3795
3796 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3797 GFP_KERNEL);
3798 return;
3799 err:
3800 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3801 }
3802
3803 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3804 int msg_type,
3805 struct nft_set *set)
3806 {
3807 struct nft_trans *trans;
3808
3809 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3810 if (trans == NULL)
3811 return NULL;
3812
3813 nft_trans_elem_set(trans) = set;
3814 return trans;
3815 }
3816
3817 void *nft_set_elem_init(const struct nft_set *set,
3818 const struct nft_set_ext_tmpl *tmpl,
3819 const u32 *key, const u32 *data,
3820 u64 timeout, gfp_t gfp)
3821 {
3822 struct nft_set_ext *ext;
3823 void *elem;
3824
3825 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3826 if (elem == NULL)
3827 return NULL;
3828
3829 ext = nft_set_elem_ext(set, elem);
3830 nft_set_ext_init(ext, tmpl);
3831
3832 memcpy(nft_set_ext_key(ext), key, set->klen);
3833 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3834 memcpy(nft_set_ext_data(ext), data, set->dlen);
3835 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3836 *nft_set_ext_expiration(ext) =
3837 jiffies + timeout;
3838 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3839 *nft_set_ext_timeout(ext) = timeout;
3840
3841 return elem;
3842 }
3843
3844 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3845 bool destroy_expr)
3846 {
3847 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3848
3849 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
3850 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3851 nft_data_release(nft_set_ext_data(ext), set->dtype);
3852 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3853 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3854 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3855 (*nft_set_ext_obj(ext))->use--;
3856 kfree(elem);
3857 }
3858 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3859
3860 /* Only called from commit path, nft_set_elem_deactivate() already deals with
3861 * the refcounting from the preparation phase.
3862 */
3863 static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3864 {
3865 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3866
3867 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3868 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3869 kfree(elem);
3870 }
3871
3872 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3873 const struct nlattr *attr, u32 nlmsg_flags)
3874 {
3875 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3876 u8 genmask = nft_genmask_next(ctx->net);
3877 struct nft_data_desc d1, d2;
3878 struct nft_set_ext_tmpl tmpl;
3879 struct nft_set_ext *ext, *ext2;
3880 struct nft_set_elem elem;
3881 struct nft_set_binding *binding;
3882 struct nft_object *obj = NULL;
3883 struct nft_userdata *udata;
3884 struct nft_data data;
3885 enum nft_registers dreg;
3886 struct nft_trans *trans;
3887 u32 flags = 0;
3888 u64 timeout;
3889 u8 ulen;
3890 int err;
3891
3892 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3893 nft_set_elem_policy, NULL);
3894 if (err < 0)
3895 return err;
3896
3897 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3898 return -EINVAL;
3899
3900 nft_set_ext_prepare(&tmpl);
3901
3902 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3903 if (err < 0)
3904 return err;
3905 if (flags != 0)
3906 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
3907
3908 if (set->flags & NFT_SET_MAP) {
3909 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
3910 !(flags & NFT_SET_ELEM_INTERVAL_END))
3911 return -EINVAL;
3912 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
3913 flags & NFT_SET_ELEM_INTERVAL_END)
3914 return -EINVAL;
3915 } else {
3916 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3917 return -EINVAL;
3918 }
3919
3920 timeout = 0;
3921 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3922 if (!(set->flags & NFT_SET_TIMEOUT))
3923 return -EINVAL;
3924 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3925 nla[NFTA_SET_ELEM_TIMEOUT])));
3926 } else if (set->flags & NFT_SET_TIMEOUT) {
3927 timeout = set->timeout;
3928 }
3929
3930 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
3931 nla[NFTA_SET_ELEM_KEY]);
3932 if (err < 0)
3933 goto err1;
3934 err = -EINVAL;
3935 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3936 goto err2;
3937
3938 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
3939 if (timeout > 0) {
3940 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
3941 if (timeout != set->timeout)
3942 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
3943 }
3944
3945 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
3946 if (!(set->flags & NFT_SET_OBJECT)) {
3947 err = -EINVAL;
3948 goto err2;
3949 }
3950 obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
3951 set->objtype, genmask);
3952 if (IS_ERR(obj)) {
3953 err = PTR_ERR(obj);
3954 goto err2;
3955 }
3956 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
3957 }
3958
3959 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
3960 err = nft_data_init(ctx, &data, sizeof(data), &d2,
3961 nla[NFTA_SET_ELEM_DATA]);
3962 if (err < 0)
3963 goto err2;
3964
3965 err = -EINVAL;
3966 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3967 goto err3;
3968
3969 dreg = nft_type_to_reg(set->dtype);
3970 list_for_each_entry(binding, &set->bindings, list) {
3971 struct nft_ctx bind_ctx = {
3972 .net = ctx->net,
3973 .afi = ctx->afi,
3974 .table = ctx->table,
3975 .chain = (struct nft_chain *)binding->chain,
3976 };
3977
3978 if (!(binding->flags & NFT_SET_MAP))
3979 continue;
3980
3981 err = nft_validate_register_store(&bind_ctx, dreg,
3982 &data,
3983 d2.type, d2.len);
3984 if (err < 0)
3985 goto err3;
3986 }
3987
3988 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
3989 }
3990
3991 /* The full maximum length of userdata can exceed the maximum
3992 * offset value (U8_MAX) for following extensions, therefor it
3993 * must be the last extension added.
3994 */
3995 ulen = 0;
3996 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
3997 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
3998 if (ulen > 0)
3999 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4000 ulen);
4001 }
4002
4003 err = -ENOMEM;
4004 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
4005 timeout, GFP_KERNEL);
4006 if (elem.priv == NULL)
4007 goto err3;
4008
4009 ext = nft_set_elem_ext(set, elem.priv);
4010 if (flags)
4011 *nft_set_ext_flags(ext) = flags;
4012 if (ulen > 0) {
4013 udata = nft_set_ext_userdata(ext);
4014 udata->len = ulen - 1;
4015 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4016 }
4017 if (obj) {
4018 *nft_set_ext_obj(ext) = obj;
4019 obj->use++;
4020 }
4021
4022 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4023 if (trans == NULL)
4024 goto err4;
4025
4026 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
4027 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4028 if (err) {
4029 if (err == -EEXIST) {
4030 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4031 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4032 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4033 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
4034 return -EBUSY;
4035 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4036 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4037 memcmp(nft_set_ext_data(ext),
4038 nft_set_ext_data(ext2), set->dlen) != 0) ||
4039 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4040 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4041 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
4042 err = -EBUSY;
4043 else if (!(nlmsg_flags & NLM_F_EXCL))
4044 err = 0;
4045 }
4046 goto err5;
4047 }
4048
4049 if (set->size &&
4050 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4051 err = -ENFILE;
4052 goto err6;
4053 }
4054
4055 nft_trans_elem(trans) = elem;
4056 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4057 return 0;
4058
4059 err6:
4060 set->ops->remove(ctx->net, set, &elem);
4061 err5:
4062 kfree(trans);
4063 err4:
4064 kfree(elem.priv);
4065 err3:
4066 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4067 nft_data_release(&data, d2.type);
4068 err2:
4069 nft_data_release(&elem.key.val, d1.type);
4070 err1:
4071 return err;
4072 }
4073
4074 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4075 struct sk_buff *skb, const struct nlmsghdr *nlh,
4076 const struct nlattr * const nla[],
4077 struct netlink_ext_ack *extack)
4078 {
4079 u8 genmask = nft_genmask_next(net);
4080 const struct nlattr *attr;
4081 struct nft_set *set;
4082 struct nft_ctx ctx;
4083 int rem, err = 0;
4084
4085 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4086 return -EINVAL;
4087
4088 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
4089 if (err < 0)
4090 return err;
4091
4092 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4093 genmask);
4094 if (IS_ERR(set)) {
4095 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
4096 set = nf_tables_set_lookup_byid(net,
4097 nla[NFTA_SET_ELEM_LIST_SET_ID],
4098 genmask);
4099 }
4100 if (IS_ERR(set))
4101 return PTR_ERR(set);
4102 }
4103
4104 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4105 return -EBUSY;
4106
4107 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4108 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
4109 if (err < 0)
4110 break;
4111 }
4112 return err;
4113 }
4114
4115 /**
4116 * nft_data_hold - hold a nft_data item
4117 *
4118 * @data: struct nft_data to release
4119 * @type: type of data
4120 *
4121 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4122 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4123 * NFT_GOTO verdicts. This function must be called on active data objects
4124 * from the second phase of the commit protocol.
4125 */
4126 static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4127 {
4128 if (type == NFT_DATA_VERDICT) {
4129 switch (data->verdict.code) {
4130 case NFT_JUMP:
4131 case NFT_GOTO:
4132 data->verdict.chain->use++;
4133 break;
4134 }
4135 }
4136 }
4137
4138 static void nft_set_elem_activate(const struct net *net,
4139 const struct nft_set *set,
4140 struct nft_set_elem *elem)
4141 {
4142 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4143
4144 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4145 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4146 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4147 (*nft_set_ext_obj(ext))->use++;
4148 }
4149
4150 static void nft_set_elem_deactivate(const struct net *net,
4151 const struct nft_set *set,
4152 struct nft_set_elem *elem)
4153 {
4154 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4155
4156 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4157 nft_data_release(nft_set_ext_data(ext), set->dtype);
4158 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4159 (*nft_set_ext_obj(ext))->use--;
4160 }
4161
4162 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
4163 const struct nlattr *attr)
4164 {
4165 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4166 struct nft_set_ext_tmpl tmpl;
4167 struct nft_data_desc desc;
4168 struct nft_set_elem elem;
4169 struct nft_set_ext *ext;
4170 struct nft_trans *trans;
4171 u32 flags = 0;
4172 void *priv;
4173 int err;
4174
4175 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4176 nft_set_elem_policy, NULL);
4177 if (err < 0)
4178 goto err1;
4179
4180 err = -EINVAL;
4181 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4182 goto err1;
4183
4184 nft_set_ext_prepare(&tmpl);
4185
4186 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4187 if (err < 0)
4188 return err;
4189 if (flags != 0)
4190 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4191
4192 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4193 nla[NFTA_SET_ELEM_KEY]);
4194 if (err < 0)
4195 goto err1;
4196
4197 err = -EINVAL;
4198 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4199 goto err2;
4200
4201 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4202
4203 err = -ENOMEM;
4204 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4205 GFP_KERNEL);
4206 if (elem.priv == NULL)
4207 goto err2;
4208
4209 ext = nft_set_elem_ext(set, elem.priv);
4210 if (flags)
4211 *nft_set_ext_flags(ext) = flags;
4212
4213 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
4214 if (trans == NULL) {
4215 err = -ENOMEM;
4216 goto err3;
4217 }
4218
4219 priv = set->ops->deactivate(ctx->net, set, &elem);
4220 if (priv == NULL) {
4221 err = -ENOENT;
4222 goto err4;
4223 }
4224 kfree(elem.priv);
4225 elem.priv = priv;
4226
4227 nft_set_elem_deactivate(ctx->net, set, &elem);
4228
4229 nft_trans_elem(trans) = elem;
4230 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4231 return 0;
4232
4233 err4:
4234 kfree(trans);
4235 err3:
4236 kfree(elem.priv);
4237 err2:
4238 nft_data_release(&elem.key.val, desc.type);
4239 err1:
4240 return err;
4241 }
4242
4243 static int nft_flush_set(const struct nft_ctx *ctx,
4244 struct nft_set *set,
4245 const struct nft_set_iter *iter,
4246 struct nft_set_elem *elem)
4247 {
4248 struct nft_trans *trans;
4249 int err;
4250
4251 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4252 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4253 if (!trans)
4254 return -ENOMEM;
4255
4256 if (!set->ops->flush(ctx->net, set, elem->priv)) {
4257 err = -ENOENT;
4258 goto err1;
4259 }
4260 set->ndeact++;
4261
4262 nft_trans_elem_set(trans) = set;
4263 nft_trans_elem(trans) = *elem;
4264 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4265
4266 return 0;
4267 err1:
4268 kfree(trans);
4269 return err;
4270 }
4271
4272 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4273 struct sk_buff *skb, const struct nlmsghdr *nlh,
4274 const struct nlattr * const nla[],
4275 struct netlink_ext_ack *extack)
4276 {
4277 u8 genmask = nft_genmask_next(net);
4278 const struct nlattr *attr;
4279 struct nft_set *set;
4280 struct nft_ctx ctx;
4281 int rem, err = 0;
4282
4283 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
4284 if (err < 0)
4285 return err;
4286
4287 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4288 genmask);
4289 if (IS_ERR(set))
4290 return PTR_ERR(set);
4291 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4292 return -EBUSY;
4293
4294 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
4295 struct nft_set_iter iter = {
4296 .genmask = genmask,
4297 .fn = nft_flush_set,
4298 };
4299 set->ops->walk(&ctx, set, &iter);
4300
4301 return iter.err;
4302 }
4303
4304 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4305 err = nft_del_setelem(&ctx, set, attr);
4306 if (err < 0)
4307 break;
4308
4309 set->ndeact++;
4310 }
4311 return err;
4312 }
4313
4314 void nft_set_gc_batch_release(struct rcu_head *rcu)
4315 {
4316 struct nft_set_gc_batch *gcb;
4317 unsigned int i;
4318
4319 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4320 for (i = 0; i < gcb->head.cnt; i++)
4321 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
4322 kfree(gcb);
4323 }
4324 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4325
4326 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4327 gfp_t gfp)
4328 {
4329 struct nft_set_gc_batch *gcb;
4330
4331 gcb = kzalloc(sizeof(*gcb), gfp);
4332 if (gcb == NULL)
4333 return gcb;
4334 gcb->head.set = set;
4335 return gcb;
4336 }
4337 EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4338
4339 /*
4340 * Stateful objects
4341 */
4342
4343 /**
4344 * nft_register_obj- register nf_tables stateful object type
4345 * @obj: object type
4346 *
4347 * Registers the object type for use with nf_tables. Returns zero on
4348 * success or a negative errno code otherwise.
4349 */
4350 int nft_register_obj(struct nft_object_type *obj_type)
4351 {
4352 if (obj_type->type == NFT_OBJECT_UNSPEC)
4353 return -EINVAL;
4354
4355 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4356 list_add_rcu(&obj_type->list, &nf_tables_objects);
4357 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4358 return 0;
4359 }
4360 EXPORT_SYMBOL_GPL(nft_register_obj);
4361
4362 /**
4363 * nft_unregister_obj - unregister nf_tables object type
4364 * @obj: object type
4365 *
4366 * Unregisters the object type for use with nf_tables.
4367 */
4368 void nft_unregister_obj(struct nft_object_type *obj_type)
4369 {
4370 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4371 list_del_rcu(&obj_type->list);
4372 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4373 }
4374 EXPORT_SYMBOL_GPL(nft_unregister_obj);
4375
4376 struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
4377 const struct nlattr *nla,
4378 u32 objtype, u8 genmask)
4379 {
4380 struct nft_object *obj;
4381
4382 list_for_each_entry(obj, &table->objects, list) {
4383 if (!nla_strcmp(nla, obj->name) &&
4384 objtype == obj->ops->type->type &&
4385 nft_active_genmask(obj, genmask))
4386 return obj;
4387 }
4388 return ERR_PTR(-ENOENT);
4389 }
4390 EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
4391
4392 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
4393 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4394 .len = NFT_TABLE_MAXNAMELEN - 1 },
4395 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4396 .len = NFT_OBJ_MAXNAMELEN - 1 },
4397 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4398 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4399 };
4400
4401 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4402 const struct nft_object_type *type,
4403 const struct nlattr *attr)
4404 {
4405 struct nlattr *tb[type->maxattr + 1];
4406 const struct nft_object_ops *ops;
4407 struct nft_object *obj;
4408 int err;
4409
4410 if (attr) {
4411 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4412 NULL);
4413 if (err < 0)
4414 goto err1;
4415 } else {
4416 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4417 }
4418
4419 if (type->select_ops) {
4420 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4421 if (IS_ERR(ops)) {
4422 err = PTR_ERR(ops);
4423 goto err1;
4424 }
4425 } else {
4426 ops = type->ops;
4427 }
4428
4429 err = -ENOMEM;
4430 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
4431 if (obj == NULL)
4432 goto err1;
4433
4434 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
4435 if (err < 0)
4436 goto err2;
4437
4438 obj->ops = ops;
4439
4440 return obj;
4441 err2:
4442 kfree(obj);
4443 err1:
4444 return ERR_PTR(err);
4445 }
4446
4447 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
4448 struct nft_object *obj, bool reset)
4449 {
4450 struct nlattr *nest;
4451
4452 nest = nla_nest_start(skb, attr);
4453 if (!nest)
4454 goto nla_put_failure;
4455 if (obj->ops->dump(skb, obj, reset) < 0)
4456 goto nla_put_failure;
4457 nla_nest_end(skb, nest);
4458 return 0;
4459
4460 nla_put_failure:
4461 return -1;
4462 }
4463
4464 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4465 {
4466 const struct nft_object_type *type;
4467
4468 list_for_each_entry(type, &nf_tables_objects, list) {
4469 if (objtype == type->type)
4470 return type;
4471 }
4472 return NULL;
4473 }
4474
4475 static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4476 {
4477 const struct nft_object_type *type;
4478
4479 type = __nft_obj_type_get(objtype);
4480 if (type != NULL && try_module_get(type->owner))
4481 return type;
4482
4483 #ifdef CONFIG_MODULES
4484 if (type == NULL) {
4485 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4486 request_module("nft-obj-%u", objtype);
4487 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4488 if (__nft_obj_type_get(objtype))
4489 return ERR_PTR(-EAGAIN);
4490 }
4491 #endif
4492 return ERR_PTR(-ENOENT);
4493 }
4494
4495 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4496 struct sk_buff *skb, const struct nlmsghdr *nlh,
4497 const struct nlattr * const nla[],
4498 struct netlink_ext_ack *extack)
4499 {
4500 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4501 const struct nft_object_type *type;
4502 u8 genmask = nft_genmask_next(net);
4503 int family = nfmsg->nfgen_family;
4504 struct nft_af_info *afi;
4505 struct nft_table *table;
4506 struct nft_object *obj;
4507 struct nft_ctx ctx;
4508 u32 objtype;
4509 int err;
4510
4511 if (!nla[NFTA_OBJ_TYPE] ||
4512 !nla[NFTA_OBJ_NAME] ||
4513 !nla[NFTA_OBJ_DATA])
4514 return -EINVAL;
4515
4516 afi = nf_tables_afinfo_lookup(net, family, true);
4517 if (IS_ERR(afi))
4518 return PTR_ERR(afi);
4519
4520 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4521 if (IS_ERR(table))
4522 return PTR_ERR(table);
4523
4524 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4525 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4526 if (IS_ERR(obj)) {
4527 err = PTR_ERR(obj);
4528 if (err != -ENOENT)
4529 return err;
4530
4531 } else {
4532 if (nlh->nlmsg_flags & NLM_F_EXCL)
4533 return -EEXIST;
4534
4535 return 0;
4536 }
4537
4538 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4539
4540 type = nft_obj_type_get(objtype);
4541 if (IS_ERR(type))
4542 return PTR_ERR(type);
4543
4544 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
4545 if (IS_ERR(obj)) {
4546 err = PTR_ERR(obj);
4547 goto err1;
4548 }
4549 obj->table = table;
4550 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4551 if (!obj->name) {
4552 err = -ENOMEM;
4553 goto err2;
4554 }
4555
4556 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4557 if (err < 0)
4558 goto err3;
4559
4560 list_add_tail_rcu(&obj->list, &table->objects);
4561 table->use++;
4562 return 0;
4563 err3:
4564 kfree(obj->name);
4565 err2:
4566 if (obj->ops->destroy)
4567 obj->ops->destroy(obj);
4568 kfree(obj);
4569 err1:
4570 module_put(type->owner);
4571 return err;
4572 }
4573
4574 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4575 u32 portid, u32 seq, int event, u32 flags,
4576 int family, const struct nft_table *table,
4577 struct nft_object *obj, bool reset)
4578 {
4579 struct nfgenmsg *nfmsg;
4580 struct nlmsghdr *nlh;
4581
4582 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4583 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4584 if (nlh == NULL)
4585 goto nla_put_failure;
4586
4587 nfmsg = nlmsg_data(nlh);
4588 nfmsg->nfgen_family = family;
4589 nfmsg->version = NFNETLINK_V0;
4590 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4591
4592 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4593 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
4594 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
4595 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
4596 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset))
4597 goto nla_put_failure;
4598
4599 nlmsg_end(skb, nlh);
4600 return 0;
4601
4602 nla_put_failure:
4603 nlmsg_trim(skb, nlh);
4604 return -1;
4605 }
4606
4607 struct nft_obj_filter {
4608 char *table;
4609 u32 type;
4610 };
4611
4612 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4613 {
4614 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
4615 const struct nft_af_info *afi;
4616 const struct nft_table *table;
4617 unsigned int idx = 0, s_idx = cb->args[0];
4618 struct nft_obj_filter *filter = cb->data;
4619 struct net *net = sock_net(skb->sk);
4620 int family = nfmsg->nfgen_family;
4621 struct nft_object *obj;
4622 bool reset = false;
4623
4624 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4625 reset = true;
4626
4627 rcu_read_lock();
4628 cb->seq = net->nft.base_seq;
4629
4630 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
4631 if (family != NFPROTO_UNSPEC && family != afi->family)
4632 continue;
4633
4634 list_for_each_entry_rcu(table, &afi->tables, list) {
4635 list_for_each_entry_rcu(obj, &table->objects, list) {
4636 if (!nft_is_active(net, obj))
4637 goto cont;
4638 if (idx < s_idx)
4639 goto cont;
4640 if (idx > s_idx)
4641 memset(&cb->args[1], 0,
4642 sizeof(cb->args) - sizeof(cb->args[0]));
4643 if (filter && filter->table[0] &&
4644 strcmp(filter->table, table->name))
4645 goto cont;
4646 if (filter &&
4647 filter->type != NFT_OBJECT_UNSPEC &&
4648 obj->ops->type->type != filter->type)
4649 goto cont;
4650
4651 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4652 cb->nlh->nlmsg_seq,
4653 NFT_MSG_NEWOBJ,
4654 NLM_F_MULTI | NLM_F_APPEND,
4655 afi->family, table, obj, reset) < 0)
4656 goto done;
4657
4658 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4659 cont:
4660 idx++;
4661 }
4662 }
4663 }
4664 done:
4665 rcu_read_unlock();
4666
4667 cb->args[0] = idx;
4668 return skb->len;
4669 }
4670
4671 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4672 {
4673 struct nft_obj_filter *filter = cb->data;
4674
4675 if (filter) {
4676 kfree(filter->table);
4677 kfree(filter);
4678 }
4679
4680 return 0;
4681 }
4682
4683 static struct nft_obj_filter *
4684 nft_obj_filter_alloc(const struct nlattr * const nla[])
4685 {
4686 struct nft_obj_filter *filter;
4687
4688 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4689 if (!filter)
4690 return ERR_PTR(-ENOMEM);
4691
4692 if (nla[NFTA_OBJ_TABLE]) {
4693 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL);
4694 if (!filter->table) {
4695 kfree(filter);
4696 return ERR_PTR(-ENOMEM);
4697 }
4698 }
4699 if (nla[NFTA_OBJ_TYPE])
4700 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4701
4702 return filter;
4703 }
4704
4705 static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4706 struct sk_buff *skb, const struct nlmsghdr *nlh,
4707 const struct nlattr * const nla[],
4708 struct netlink_ext_ack *extack)
4709 {
4710 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4711 u8 genmask = nft_genmask_cur(net);
4712 int family = nfmsg->nfgen_family;
4713 const struct nft_af_info *afi;
4714 const struct nft_table *table;
4715 struct nft_object *obj;
4716 struct sk_buff *skb2;
4717 bool reset = false;
4718 u32 objtype;
4719 int err;
4720
4721 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4722 struct netlink_dump_control c = {
4723 .dump = nf_tables_dump_obj,
4724 .done = nf_tables_dump_obj_done,
4725 };
4726
4727 if (nla[NFTA_OBJ_TABLE] ||
4728 nla[NFTA_OBJ_TYPE]) {
4729 struct nft_obj_filter *filter;
4730
4731 filter = nft_obj_filter_alloc(nla);
4732 if (IS_ERR(filter))
4733 return -ENOMEM;
4734
4735 c.data = filter;
4736 }
4737 return netlink_dump_start(nlsk, skb, nlh, &c);
4738 }
4739
4740 if (!nla[NFTA_OBJ_NAME] ||
4741 !nla[NFTA_OBJ_TYPE])
4742 return -EINVAL;
4743
4744 afi = nf_tables_afinfo_lookup(net, family, false);
4745 if (IS_ERR(afi))
4746 return PTR_ERR(afi);
4747
4748 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4749 if (IS_ERR(table))
4750 return PTR_ERR(table);
4751
4752 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4753 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4754 if (IS_ERR(obj))
4755 return PTR_ERR(obj);
4756
4757 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4758 if (!skb2)
4759 return -ENOMEM;
4760
4761 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4762 reset = true;
4763
4764 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4765 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
4766 family, table, obj, reset);
4767 if (err < 0)
4768 goto err;
4769
4770 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4771 err:
4772 kfree_skb(skb2);
4773 return err;
4774 }
4775
4776 static void nft_obj_destroy(struct nft_object *obj)
4777 {
4778 if (obj->ops->destroy)
4779 obj->ops->destroy(obj);
4780
4781 module_put(obj->ops->type->owner);
4782 kfree(obj->name);
4783 kfree(obj);
4784 }
4785
4786 static int nf_tables_delobj(struct net *net, struct sock *nlsk,
4787 struct sk_buff *skb, const struct nlmsghdr *nlh,
4788 const struct nlattr * const nla[],
4789 struct netlink_ext_ack *extack)
4790 {
4791 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4792 u8 genmask = nft_genmask_next(net);
4793 int family = nfmsg->nfgen_family;
4794 struct nft_af_info *afi;
4795 struct nft_table *table;
4796 struct nft_object *obj;
4797 struct nft_ctx ctx;
4798 u32 objtype;
4799
4800 if (!nla[NFTA_OBJ_TYPE] ||
4801 !nla[NFTA_OBJ_NAME])
4802 return -EINVAL;
4803
4804 afi = nf_tables_afinfo_lookup(net, family, true);
4805 if (IS_ERR(afi))
4806 return PTR_ERR(afi);
4807
4808 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4809 if (IS_ERR(table))
4810 return PTR_ERR(table);
4811
4812 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4813 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4814 if (IS_ERR(obj))
4815 return PTR_ERR(obj);
4816 if (obj->use > 0)
4817 return -EBUSY;
4818
4819 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4820
4821 return nft_delobj(&ctx, obj);
4822 }
4823
4824 void nft_obj_notify(struct net *net, struct nft_table *table,
4825 struct nft_object *obj, u32 portid, u32 seq, int event,
4826 int family, int report, gfp_t gfp)
4827 {
4828 struct sk_buff *skb;
4829 int err;
4830
4831 if (!report &&
4832 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
4833 return;
4834
4835 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
4836 if (skb == NULL)
4837 goto err;
4838
4839 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4840 table, obj, false);
4841 if (err < 0) {
4842 kfree_skb(skb);
4843 goto err;
4844 }
4845
4846 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4847 return;
4848 err:
4849 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
4850 }
4851 EXPORT_SYMBOL_GPL(nft_obj_notify);
4852
4853 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4854 struct nft_object *obj, int event)
4855 {
4856 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
4857 ctx->afi->family, ctx->report, GFP_KERNEL);
4858 }
4859
4860 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
4861 u32 portid, u32 seq)
4862 {
4863 struct nlmsghdr *nlh;
4864 struct nfgenmsg *nfmsg;
4865 char buf[TASK_COMM_LEN];
4866 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
4867
4868 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
4869 if (nlh == NULL)
4870 goto nla_put_failure;
4871
4872 nfmsg = nlmsg_data(nlh);
4873 nfmsg->nfgen_family = AF_UNSPEC;
4874 nfmsg->version = NFNETLINK_V0;
4875 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4876
4877 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
4878 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
4879 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
4880 goto nla_put_failure;
4881
4882 nlmsg_end(skb, nlh);
4883 return 0;
4884
4885 nla_put_failure:
4886 nlmsg_trim(skb, nlh);
4887 return -EMSGSIZE;
4888 }
4889
4890 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
4891 int event)
4892 {
4893 struct nlmsghdr *nlh = nlmsg_hdr(skb);
4894 struct sk_buff *skb2;
4895 int err;
4896
4897 if (nlmsg_report(nlh) &&
4898 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
4899 return;
4900
4901 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4902 if (skb2 == NULL)
4903 goto err;
4904
4905 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
4906 nlh->nlmsg_seq);
4907 if (err < 0) {
4908 kfree_skb(skb2);
4909 goto err;
4910 }
4911
4912 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
4913 nlmsg_report(nlh), GFP_KERNEL);
4914 return;
4915 err:
4916 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
4917 -ENOBUFS);
4918 }
4919
4920 static int nf_tables_getgen(struct net *net, struct sock *nlsk,
4921 struct sk_buff *skb, const struct nlmsghdr *nlh,
4922 const struct nlattr * const nla[],
4923 struct netlink_ext_ack *extack)
4924 {
4925 struct sk_buff *skb2;
4926 int err;
4927
4928 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4929 if (skb2 == NULL)
4930 return -ENOMEM;
4931
4932 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
4933 nlh->nlmsg_seq);
4934 if (err < 0)
4935 goto err;
4936
4937 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4938 err:
4939 kfree_skb(skb2);
4940 return err;
4941 }
4942
4943 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
4944 [NFT_MSG_NEWTABLE] = {
4945 .call_batch = nf_tables_newtable,
4946 .attr_count = NFTA_TABLE_MAX,
4947 .policy = nft_table_policy,
4948 },
4949 [NFT_MSG_GETTABLE] = {
4950 .call = nf_tables_gettable,
4951 .attr_count = NFTA_TABLE_MAX,
4952 .policy = nft_table_policy,
4953 },
4954 [NFT_MSG_DELTABLE] = {
4955 .call_batch = nf_tables_deltable,
4956 .attr_count = NFTA_TABLE_MAX,
4957 .policy = nft_table_policy,
4958 },
4959 [NFT_MSG_NEWCHAIN] = {
4960 .call_batch = nf_tables_newchain,
4961 .attr_count = NFTA_CHAIN_MAX,
4962 .policy = nft_chain_policy,
4963 },
4964 [NFT_MSG_GETCHAIN] = {
4965 .call = nf_tables_getchain,
4966 .attr_count = NFTA_CHAIN_MAX,
4967 .policy = nft_chain_policy,
4968 },
4969 [NFT_MSG_DELCHAIN] = {
4970 .call_batch = nf_tables_delchain,
4971 .attr_count = NFTA_CHAIN_MAX,
4972 .policy = nft_chain_policy,
4973 },
4974 [NFT_MSG_NEWRULE] = {
4975 .call_batch = nf_tables_newrule,
4976 .attr_count = NFTA_RULE_MAX,
4977 .policy = nft_rule_policy,
4978 },
4979 [NFT_MSG_GETRULE] = {
4980 .call = nf_tables_getrule,
4981 .attr_count = NFTA_RULE_MAX,
4982 .policy = nft_rule_policy,
4983 },
4984 [NFT_MSG_DELRULE] = {
4985 .call_batch = nf_tables_delrule,
4986 .attr_count = NFTA_RULE_MAX,
4987 .policy = nft_rule_policy,
4988 },
4989 [NFT_MSG_NEWSET] = {
4990 .call_batch = nf_tables_newset,
4991 .attr_count = NFTA_SET_MAX,
4992 .policy = nft_set_policy,
4993 },
4994 [NFT_MSG_GETSET] = {
4995 .call = nf_tables_getset,
4996 .attr_count = NFTA_SET_MAX,
4997 .policy = nft_set_policy,
4998 },
4999 [NFT_MSG_DELSET] = {
5000 .call_batch = nf_tables_delset,
5001 .attr_count = NFTA_SET_MAX,
5002 .policy = nft_set_policy,
5003 },
5004 [NFT_MSG_NEWSETELEM] = {
5005 .call_batch = nf_tables_newsetelem,
5006 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5007 .policy = nft_set_elem_list_policy,
5008 },
5009 [NFT_MSG_GETSETELEM] = {
5010 .call = nf_tables_getsetelem,
5011 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5012 .policy = nft_set_elem_list_policy,
5013 },
5014 [NFT_MSG_DELSETELEM] = {
5015 .call_batch = nf_tables_delsetelem,
5016 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5017 .policy = nft_set_elem_list_policy,
5018 },
5019 [NFT_MSG_GETGEN] = {
5020 .call = nf_tables_getgen,
5021 },
5022 [NFT_MSG_NEWOBJ] = {
5023 .call_batch = nf_tables_newobj,
5024 .attr_count = NFTA_OBJ_MAX,
5025 .policy = nft_obj_policy,
5026 },
5027 [NFT_MSG_GETOBJ] = {
5028 .call = nf_tables_getobj,
5029 .attr_count = NFTA_OBJ_MAX,
5030 .policy = nft_obj_policy,
5031 },
5032 [NFT_MSG_DELOBJ] = {
5033 .call_batch = nf_tables_delobj,
5034 .attr_count = NFTA_OBJ_MAX,
5035 .policy = nft_obj_policy,
5036 },
5037 [NFT_MSG_GETOBJ_RESET] = {
5038 .call = nf_tables_getobj,
5039 .attr_count = NFTA_OBJ_MAX,
5040 .policy = nft_obj_policy,
5041 },
5042 };
5043
5044 static void nft_chain_commit_update(struct nft_trans *trans)
5045 {
5046 struct nft_base_chain *basechain;
5047
5048 if (nft_trans_chain_name(trans))
5049 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
5050
5051 if (!nft_is_base_chain(trans->ctx.chain))
5052 return;
5053
5054 basechain = nft_base_chain(trans->ctx.chain);
5055 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5056
5057 switch (nft_trans_chain_policy(trans)) {
5058 case NF_DROP:
5059 case NF_ACCEPT:
5060 basechain->policy = nft_trans_chain_policy(trans);
5061 break;
5062 }
5063 }
5064
5065 static void nf_tables_commit_release(struct nft_trans *trans)
5066 {
5067 switch (trans->msg_type) {
5068 case NFT_MSG_DELTABLE:
5069 nf_tables_table_destroy(&trans->ctx);
5070 break;
5071 case NFT_MSG_DELCHAIN:
5072 nf_tables_chain_destroy(trans->ctx.chain);
5073 break;
5074 case NFT_MSG_DELRULE:
5075 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5076 break;
5077 case NFT_MSG_DELSET:
5078 nft_set_destroy(nft_trans_set(trans));
5079 break;
5080 case NFT_MSG_DELSETELEM:
5081 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
5082 nft_trans_elem(trans).priv);
5083 break;
5084 case NFT_MSG_DELOBJ:
5085 nft_obj_destroy(nft_trans_obj(trans));
5086 break;
5087 }
5088 kfree(trans);
5089 }
5090
5091 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
5092 {
5093 struct nft_trans *trans, *next;
5094 struct nft_trans_elem *te;
5095
5096 /* Bump generation counter, invalidate any dump in progress */
5097 while (++net->nft.base_seq == 0);
5098
5099 /* A new generation has just started */
5100 net->nft.gencursor = nft_gencursor_next(net);
5101
5102 /* Make sure all packets have left the previous generation before
5103 * purging old rules.
5104 */
5105 synchronize_rcu();
5106
5107 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
5108 switch (trans->msg_type) {
5109 case NFT_MSG_NEWTABLE:
5110 if (nft_trans_table_update(trans)) {
5111 if (!nft_trans_table_enable(trans)) {
5112 nf_tables_table_disable(net,
5113 trans->ctx.afi,
5114 trans->ctx.table);
5115 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5116 }
5117 } else {
5118 nft_clear(net, trans->ctx.table);
5119 }
5120 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
5121 nft_trans_destroy(trans);
5122 break;
5123 case NFT_MSG_DELTABLE:
5124 list_del_rcu(&trans->ctx.table->list);
5125 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
5126 break;
5127 case NFT_MSG_NEWCHAIN:
5128 if (nft_trans_chain_update(trans))
5129 nft_chain_commit_update(trans);
5130 else
5131 nft_clear(net, trans->ctx.chain);
5132
5133 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
5134 nft_trans_destroy(trans);
5135 break;
5136 case NFT_MSG_DELCHAIN:
5137 list_del_rcu(&trans->ctx.chain->list);
5138 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
5139 nf_tables_unregister_hooks(trans->ctx.net,
5140 trans->ctx.table,
5141 trans->ctx.chain,
5142 trans->ctx.afi->nops);
5143 break;
5144 case NFT_MSG_NEWRULE:
5145 nft_clear(trans->ctx.net, nft_trans_rule(trans));
5146 nf_tables_rule_notify(&trans->ctx,
5147 nft_trans_rule(trans),
5148 NFT_MSG_NEWRULE);
5149 nft_trans_destroy(trans);
5150 break;
5151 case NFT_MSG_DELRULE:
5152 list_del_rcu(&nft_trans_rule(trans)->list);
5153 nf_tables_rule_notify(&trans->ctx,
5154 nft_trans_rule(trans),
5155 NFT_MSG_DELRULE);
5156 break;
5157 case NFT_MSG_NEWSET:
5158 nft_clear(net, nft_trans_set(trans));
5159 /* This avoids hitting -EBUSY when deleting the table
5160 * from the transaction.
5161 */
5162 if (nft_trans_set(trans)->flags & NFT_SET_ANONYMOUS &&
5163 !list_empty(&nft_trans_set(trans)->bindings))
5164 trans->ctx.table->use--;
5165
5166 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
5167 NFT_MSG_NEWSET, GFP_KERNEL);
5168 nft_trans_destroy(trans);
5169 break;
5170 case NFT_MSG_DELSET:
5171 list_del_rcu(&nft_trans_set(trans)->list);
5172 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
5173 NFT_MSG_DELSET, GFP_KERNEL);
5174 break;
5175 case NFT_MSG_NEWSETELEM:
5176 te = (struct nft_trans_elem *)trans->data;
5177
5178 te->set->ops->activate(net, te->set, &te->elem);
5179 nf_tables_setelem_notify(&trans->ctx, te->set,
5180 &te->elem,
5181 NFT_MSG_NEWSETELEM, 0);
5182 nft_trans_destroy(trans);
5183 break;
5184 case NFT_MSG_DELSETELEM:
5185 te = (struct nft_trans_elem *)trans->data;
5186
5187 nf_tables_setelem_notify(&trans->ctx, te->set,
5188 &te->elem,
5189 NFT_MSG_DELSETELEM, 0);
5190 te->set->ops->remove(net, te->set, &te->elem);
5191 atomic_dec(&te->set->nelems);
5192 te->set->ndeact--;
5193 break;
5194 case NFT_MSG_NEWOBJ:
5195 nft_clear(net, nft_trans_obj(trans));
5196 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5197 NFT_MSG_NEWOBJ);
5198 nft_trans_destroy(trans);
5199 break;
5200 case NFT_MSG_DELOBJ:
5201 list_del_rcu(&nft_trans_obj(trans)->list);
5202 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5203 NFT_MSG_DELOBJ);
5204 break;
5205 }
5206 }
5207
5208 synchronize_rcu();
5209
5210 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
5211 list_del(&trans->list);
5212 nf_tables_commit_release(trans);
5213 }
5214
5215 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
5216
5217 return 0;
5218 }
5219
5220 static void nf_tables_abort_release(struct nft_trans *trans)
5221 {
5222 switch (trans->msg_type) {
5223 case NFT_MSG_NEWTABLE:
5224 nf_tables_table_destroy(&trans->ctx);
5225 break;
5226 case NFT_MSG_NEWCHAIN:
5227 nf_tables_chain_destroy(trans->ctx.chain);
5228 break;
5229 case NFT_MSG_NEWRULE:
5230 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5231 break;
5232 case NFT_MSG_NEWSET:
5233 nft_set_destroy(nft_trans_set(trans));
5234 break;
5235 case NFT_MSG_NEWSETELEM:
5236 nft_set_elem_destroy(nft_trans_elem_set(trans),
5237 nft_trans_elem(trans).priv, true);
5238 break;
5239 case NFT_MSG_NEWOBJ:
5240 nft_obj_destroy(nft_trans_obj(trans));
5241 break;
5242 }
5243 kfree(trans);
5244 }
5245
5246 static int nf_tables_abort(struct net *net, struct sk_buff *skb)
5247 {
5248 struct nft_trans *trans, *next;
5249 struct nft_trans_elem *te;
5250
5251 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
5252 list) {
5253 switch (trans->msg_type) {
5254 case NFT_MSG_NEWTABLE:
5255 if (nft_trans_table_update(trans)) {
5256 if (nft_trans_table_enable(trans)) {
5257 nf_tables_table_disable(net,
5258 trans->ctx.afi,
5259 trans->ctx.table);
5260 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5261 }
5262 nft_trans_destroy(trans);
5263 } else {
5264 list_del_rcu(&trans->ctx.table->list);
5265 }
5266 break;
5267 case NFT_MSG_DELTABLE:
5268 nft_clear(trans->ctx.net, trans->ctx.table);
5269 nft_trans_destroy(trans);
5270 break;
5271 case NFT_MSG_NEWCHAIN:
5272 if (nft_trans_chain_update(trans)) {
5273 free_percpu(nft_trans_chain_stats(trans));
5274
5275 nft_trans_destroy(trans);
5276 } else {
5277 trans->ctx.table->use--;
5278 list_del_rcu(&trans->ctx.chain->list);
5279 nf_tables_unregister_hooks(trans->ctx.net,
5280 trans->ctx.table,
5281 trans->ctx.chain,
5282 trans->ctx.afi->nops);
5283 }
5284 break;
5285 case NFT_MSG_DELCHAIN:
5286 trans->ctx.table->use++;
5287 nft_clear(trans->ctx.net, trans->ctx.chain);
5288 nft_trans_destroy(trans);
5289 break;
5290 case NFT_MSG_NEWRULE:
5291 trans->ctx.chain->use--;
5292 list_del_rcu(&nft_trans_rule(trans)->list);
5293 break;
5294 case NFT_MSG_DELRULE:
5295 trans->ctx.chain->use++;
5296 nft_clear(trans->ctx.net, nft_trans_rule(trans));
5297 nft_trans_destroy(trans);
5298 break;
5299 case NFT_MSG_NEWSET:
5300 trans->ctx.table->use--;
5301 list_del_rcu(&nft_trans_set(trans)->list);
5302 break;
5303 case NFT_MSG_DELSET:
5304 trans->ctx.table->use++;
5305 nft_clear(trans->ctx.net, nft_trans_set(trans));
5306 nft_trans_destroy(trans);
5307 break;
5308 case NFT_MSG_NEWSETELEM:
5309 te = (struct nft_trans_elem *)trans->data;
5310
5311 te->set->ops->remove(net, te->set, &te->elem);
5312 atomic_dec(&te->set->nelems);
5313 break;
5314 case NFT_MSG_DELSETELEM:
5315 te = (struct nft_trans_elem *)trans->data;
5316
5317 nft_set_elem_activate(net, te->set, &te->elem);
5318 te->set->ops->activate(net, te->set, &te->elem);
5319 te->set->ndeact--;
5320
5321 nft_trans_destroy(trans);
5322 break;
5323 case NFT_MSG_NEWOBJ:
5324 trans->ctx.table->use--;
5325 list_del_rcu(&nft_trans_obj(trans)->list);
5326 break;
5327 case NFT_MSG_DELOBJ:
5328 trans->ctx.table->use++;
5329 nft_clear(trans->ctx.net, nft_trans_obj(trans));
5330 nft_trans_destroy(trans);
5331 break;
5332 }
5333 }
5334
5335 synchronize_rcu();
5336
5337 list_for_each_entry_safe_reverse(trans, next,
5338 &net->nft.commit_list, list) {
5339 list_del(&trans->list);
5340 nf_tables_abort_release(trans);
5341 }
5342
5343 return 0;
5344 }
5345
5346 static bool nf_tables_valid_genid(struct net *net, u32 genid)
5347 {
5348 return net->nft.base_seq == genid;
5349 }
5350
5351 static const struct nfnetlink_subsystem nf_tables_subsys = {
5352 .name = "nf_tables",
5353 .subsys_id = NFNL_SUBSYS_NFTABLES,
5354 .cb_count = NFT_MSG_MAX,
5355 .cb = nf_tables_cb,
5356 .commit = nf_tables_commit,
5357 .abort = nf_tables_abort,
5358 .valid_genid = nf_tables_valid_genid,
5359 };
5360
5361 int nft_chain_validate_dependency(const struct nft_chain *chain,
5362 enum nft_chain_type type)
5363 {
5364 const struct nft_base_chain *basechain;
5365
5366 if (nft_is_base_chain(chain)) {
5367 basechain = nft_base_chain(chain);
5368 if (basechain->type->type != type)
5369 return -EOPNOTSUPP;
5370 }
5371 return 0;
5372 }
5373 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
5374
5375 int nft_chain_validate_hooks(const struct nft_chain *chain,
5376 unsigned int hook_flags)
5377 {
5378 struct nft_base_chain *basechain;
5379
5380 if (nft_is_base_chain(chain)) {
5381 basechain = nft_base_chain(chain);
5382
5383 if ((1 << basechain->ops[0].hooknum) & hook_flags)
5384 return 0;
5385
5386 return -EOPNOTSUPP;
5387 }
5388
5389 return 0;
5390 }
5391 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
5392
5393 /*
5394 * Loop detection - walk through the ruleset beginning at the destination chain
5395 * of a new jump until either the source chain is reached (loop) or all
5396 * reachable chains have been traversed.
5397 *
5398 * The loop check is performed whenever a new jump verdict is added to an
5399 * expression or verdict map or a verdict map is bound to a new chain.
5400 */
5401
5402 static int nf_tables_check_loops(const struct nft_ctx *ctx,
5403 const struct nft_chain *chain);
5404
5405 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
5406 struct nft_set *set,
5407 const struct nft_set_iter *iter,
5408 struct nft_set_elem *elem)
5409 {
5410 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5411 const struct nft_data *data;
5412
5413 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
5414 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
5415 return 0;
5416
5417 data = nft_set_ext_data(ext);
5418 switch (data->verdict.code) {
5419 case NFT_JUMP:
5420 case NFT_GOTO:
5421 return nf_tables_check_loops(ctx, data->verdict.chain);
5422 default:
5423 return 0;
5424 }
5425 }
5426
5427 static int nf_tables_check_loops(const struct nft_ctx *ctx,
5428 const struct nft_chain *chain)
5429 {
5430 const struct nft_rule *rule;
5431 const struct nft_expr *expr, *last;
5432 struct nft_set *set;
5433 struct nft_set_binding *binding;
5434 struct nft_set_iter iter;
5435
5436 if (ctx->chain == chain)
5437 return -ELOOP;
5438
5439 list_for_each_entry(rule, &chain->rules, list) {
5440 nft_rule_for_each_expr(expr, last, rule) {
5441 const struct nft_data *data = NULL;
5442 int err;
5443
5444 if (!expr->ops->validate)
5445 continue;
5446
5447 err = expr->ops->validate(ctx, expr, &data);
5448 if (err < 0)
5449 return err;
5450
5451 if (data == NULL)
5452 continue;
5453
5454 switch (data->verdict.code) {
5455 case NFT_JUMP:
5456 case NFT_GOTO:
5457 err = nf_tables_check_loops(ctx,
5458 data->verdict.chain);
5459 if (err < 0)
5460 return err;
5461 default:
5462 break;
5463 }
5464 }
5465 }
5466
5467 list_for_each_entry(set, &ctx->table->sets, list) {
5468 if (!nft_is_active_next(ctx->net, set))
5469 continue;
5470 if (!(set->flags & NFT_SET_MAP) ||
5471 set->dtype != NFT_DATA_VERDICT)
5472 continue;
5473
5474 list_for_each_entry(binding, &set->bindings, list) {
5475 if (!(binding->flags & NFT_SET_MAP) ||
5476 binding->chain != chain)
5477 continue;
5478
5479 iter.genmask = nft_genmask_next(ctx->net);
5480 iter.skip = 0;
5481 iter.count = 0;
5482 iter.err = 0;
5483 iter.fn = nf_tables_loop_check_setelem;
5484
5485 set->ops->walk(ctx, set, &iter);
5486 if (iter.err < 0)
5487 return iter.err;
5488 }
5489 }
5490
5491 return 0;
5492 }
5493
5494 /**
5495 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
5496 *
5497 * @attr: netlink attribute to fetch value from
5498 * @max: maximum value to be stored in dest
5499 * @dest: pointer to the variable
5500 *
5501 * Parse, check and store a given u32 netlink attribute into variable.
5502 * This function returns -ERANGE if the value goes over maximum value.
5503 * Otherwise a 0 is returned and the attribute value is stored in the
5504 * destination variable.
5505 */
5506 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
5507 {
5508 u32 val;
5509
5510 val = ntohl(nla_get_be32(attr));
5511 if (val > max)
5512 return -ERANGE;
5513
5514 *dest = val;
5515 return 0;
5516 }
5517 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
5518
5519 /**
5520 * nft_parse_register - parse a register value from a netlink attribute
5521 *
5522 * @attr: netlink attribute
5523 *
5524 * Parse and translate a register value from a netlink attribute.
5525 * Registers used to be 128 bit wide, these register numbers will be
5526 * mapped to the corresponding 32 bit register numbers.
5527 */
5528 unsigned int nft_parse_register(const struct nlattr *attr)
5529 {
5530 unsigned int reg;
5531
5532 reg = ntohl(nla_get_be32(attr));
5533 switch (reg) {
5534 case NFT_REG_VERDICT...NFT_REG_4:
5535 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
5536 default:
5537 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
5538 }
5539 }
5540 EXPORT_SYMBOL_GPL(nft_parse_register);
5541
5542 /**
5543 * nft_dump_register - dump a register value to a netlink attribute
5544 *
5545 * @skb: socket buffer
5546 * @attr: attribute number
5547 * @reg: register number
5548 *
5549 * Construct a netlink attribute containing the register number. For
5550 * compatibility reasons, register numbers being a multiple of 4 are
5551 * translated to the corresponding 128 bit register numbers.
5552 */
5553 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
5554 {
5555 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
5556 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
5557 else
5558 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
5559
5560 return nla_put_be32(skb, attr, htonl(reg));
5561 }
5562 EXPORT_SYMBOL_GPL(nft_dump_register);
5563
5564 /**
5565 * nft_validate_register_load - validate a load from a register
5566 *
5567 * @reg: the register number
5568 * @len: the length of the data
5569 *
5570 * Validate that the input register is one of the general purpose
5571 * registers and that the length of the load is within the bounds.
5572 */
5573 int nft_validate_register_load(enum nft_registers reg, unsigned int len)
5574 {
5575 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
5576 return -EINVAL;
5577 if (len == 0)
5578 return -EINVAL;
5579 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
5580 return -ERANGE;
5581
5582 return 0;
5583 }
5584 EXPORT_SYMBOL_GPL(nft_validate_register_load);
5585
5586 /**
5587 * nft_validate_register_store - validate an expressions' register store
5588 *
5589 * @ctx: context of the expression performing the load
5590 * @reg: the destination register number
5591 * @data: the data to load
5592 * @type: the data type
5593 * @len: the length of the data
5594 *
5595 * Validate that a data load uses the appropriate data type for
5596 * the destination register and the length is within the bounds.
5597 * A value of NULL for the data means that its runtime gathered
5598 * data.
5599 */
5600 int nft_validate_register_store(const struct nft_ctx *ctx,
5601 enum nft_registers reg,
5602 const struct nft_data *data,
5603 enum nft_data_types type, unsigned int len)
5604 {
5605 int err;
5606
5607 switch (reg) {
5608 case NFT_REG_VERDICT:
5609 if (type != NFT_DATA_VERDICT)
5610 return -EINVAL;
5611
5612 if (data != NULL &&
5613 (data->verdict.code == NFT_GOTO ||
5614 data->verdict.code == NFT_JUMP)) {
5615 err = nf_tables_check_loops(ctx, data->verdict.chain);
5616 if (err < 0)
5617 return err;
5618
5619 if (ctx->chain->level + 1 >
5620 data->verdict.chain->level) {
5621 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
5622 return -EMLINK;
5623 data->verdict.chain->level = ctx->chain->level + 1;
5624 }
5625 }
5626
5627 return 0;
5628 default:
5629 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
5630 return -EINVAL;
5631 if (len == 0)
5632 return -EINVAL;
5633 if (reg * NFT_REG32_SIZE + len >
5634 FIELD_SIZEOF(struct nft_regs, data))
5635 return -ERANGE;
5636
5637 if (data != NULL && type != NFT_DATA_VALUE)
5638 return -EINVAL;
5639 return 0;
5640 }
5641 }
5642 EXPORT_SYMBOL_GPL(nft_validate_register_store);
5643
5644 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
5645 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
5646 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
5647 .len = NFT_CHAIN_MAXNAMELEN - 1 },
5648 };
5649
5650 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
5651 struct nft_data_desc *desc, const struct nlattr *nla)
5652 {
5653 u8 genmask = nft_genmask_next(ctx->net);
5654 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
5655 struct nft_chain *chain;
5656 int err;
5657
5658 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
5659 NULL);
5660 if (err < 0)
5661 return err;
5662
5663 if (!tb[NFTA_VERDICT_CODE])
5664 return -EINVAL;
5665 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
5666
5667 switch (data->verdict.code) {
5668 default:
5669 switch (data->verdict.code & NF_VERDICT_MASK) {
5670 case NF_ACCEPT:
5671 case NF_DROP:
5672 case NF_QUEUE:
5673 break;
5674 default:
5675 return -EINVAL;
5676 }
5677 /* fall through */
5678 case NFT_CONTINUE:
5679 case NFT_BREAK:
5680 case NFT_RETURN:
5681 break;
5682 case NFT_JUMP:
5683 case NFT_GOTO:
5684 if (!tb[NFTA_VERDICT_CHAIN])
5685 return -EINVAL;
5686 chain = nf_tables_chain_lookup(ctx->table,
5687 tb[NFTA_VERDICT_CHAIN], genmask);
5688 if (IS_ERR(chain))
5689 return PTR_ERR(chain);
5690 if (nft_is_base_chain(chain))
5691 return -EOPNOTSUPP;
5692
5693 chain->use++;
5694 data->verdict.chain = chain;
5695 break;
5696 }
5697
5698 desc->len = sizeof(data->verdict);
5699 desc->type = NFT_DATA_VERDICT;
5700 return 0;
5701 }
5702
5703 static void nft_verdict_uninit(const struct nft_data *data)
5704 {
5705 switch (data->verdict.code) {
5706 case NFT_JUMP:
5707 case NFT_GOTO:
5708 data->verdict.chain->use--;
5709 break;
5710 }
5711 }
5712
5713 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
5714 {
5715 struct nlattr *nest;
5716
5717 nest = nla_nest_start(skb, type);
5718 if (!nest)
5719 goto nla_put_failure;
5720
5721 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
5722 goto nla_put_failure;
5723
5724 switch (v->code) {
5725 case NFT_JUMP:
5726 case NFT_GOTO:
5727 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
5728 v->chain->name))
5729 goto nla_put_failure;
5730 }
5731 nla_nest_end(skb, nest);
5732 return 0;
5733
5734 nla_put_failure:
5735 return -1;
5736 }
5737
5738 static int nft_value_init(const struct nft_ctx *ctx,
5739 struct nft_data *data, unsigned int size,
5740 struct nft_data_desc *desc, const struct nlattr *nla)
5741 {
5742 unsigned int len;
5743
5744 len = nla_len(nla);
5745 if (len == 0)
5746 return -EINVAL;
5747 if (len > size)
5748 return -EOVERFLOW;
5749
5750 nla_memcpy(data->data, nla, len);
5751 desc->type = NFT_DATA_VALUE;
5752 desc->len = len;
5753 return 0;
5754 }
5755
5756 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
5757 unsigned int len)
5758 {
5759 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
5760 }
5761
5762 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
5763 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
5764 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
5765 };
5766
5767 /**
5768 * nft_data_init - parse nf_tables data netlink attributes
5769 *
5770 * @ctx: context of the expression using the data
5771 * @data: destination struct nft_data
5772 * @size: maximum data length
5773 * @desc: data description
5774 * @nla: netlink attribute containing data
5775 *
5776 * Parse the netlink data attributes and initialize a struct nft_data.
5777 * The type and length of data are returned in the data description.
5778 *
5779 * The caller can indicate that it only wants to accept data of type
5780 * NFT_DATA_VALUE by passing NULL for the ctx argument.
5781 */
5782 int nft_data_init(const struct nft_ctx *ctx,
5783 struct nft_data *data, unsigned int size,
5784 struct nft_data_desc *desc, const struct nlattr *nla)
5785 {
5786 struct nlattr *tb[NFTA_DATA_MAX + 1];
5787 int err;
5788
5789 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
5790 if (err < 0)
5791 return err;
5792
5793 if (tb[NFTA_DATA_VALUE])
5794 return nft_value_init(ctx, data, size, desc,
5795 tb[NFTA_DATA_VALUE]);
5796 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
5797 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
5798 return -EINVAL;
5799 }
5800 EXPORT_SYMBOL_GPL(nft_data_init);
5801
5802 /**
5803 * nft_data_release - release a nft_data item
5804 *
5805 * @data: struct nft_data to release
5806 * @type: type of data
5807 *
5808 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5809 * all others need to be released by calling this function.
5810 */
5811 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
5812 {
5813 if (type < NFT_DATA_VERDICT)
5814 return;
5815 switch (type) {
5816 case NFT_DATA_VERDICT:
5817 return nft_verdict_uninit(data);
5818 default:
5819 WARN_ON(1);
5820 }
5821 }
5822 EXPORT_SYMBOL_GPL(nft_data_release);
5823
5824 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
5825 enum nft_data_types type, unsigned int len)
5826 {
5827 struct nlattr *nest;
5828 int err;
5829
5830 nest = nla_nest_start(skb, attr);
5831 if (nest == NULL)
5832 return -1;
5833
5834 switch (type) {
5835 case NFT_DATA_VALUE:
5836 err = nft_value_dump(skb, data, len);
5837 break;
5838 case NFT_DATA_VERDICT:
5839 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
5840 break;
5841 default:
5842 err = -EINVAL;
5843 WARN_ON(1);
5844 }
5845
5846 nla_nest_end(skb, nest);
5847 return err;
5848 }
5849 EXPORT_SYMBOL_GPL(nft_data_dump);
5850
5851 static int __net_init nf_tables_init_net(struct net *net)
5852 {
5853 INIT_LIST_HEAD(&net->nft.af_info);
5854 INIT_LIST_HEAD(&net->nft.commit_list);
5855 net->nft.base_seq = 1;
5856 return 0;
5857 }
5858
5859 static void __net_exit nf_tables_exit_net(struct net *net)
5860 {
5861 WARN_ON_ONCE(!list_empty(&net->nft.af_info));
5862 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
5863 }
5864
5865 int __nft_release_basechain(struct nft_ctx *ctx)
5866 {
5867 struct nft_rule *rule, *nr;
5868
5869 BUG_ON(!nft_is_base_chain(ctx->chain));
5870
5871 nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
5872 ctx->afi->nops);
5873 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
5874 list_del(&rule->list);
5875 ctx->chain->use--;
5876 nf_tables_rule_destroy(ctx, rule);
5877 }
5878 list_del(&ctx->chain->list);
5879 ctx->table->use--;
5880 nf_tables_chain_destroy(ctx->chain);
5881
5882 return 0;
5883 }
5884 EXPORT_SYMBOL_GPL(__nft_release_basechain);
5885
5886 /* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */
5887 static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
5888 {
5889 struct nft_table *table, *nt;
5890 struct nft_chain *chain, *nc;
5891 struct nft_object *obj, *ne;
5892 struct nft_rule *rule, *nr;
5893 struct nft_set *set, *ns;
5894 struct nft_ctx ctx = {
5895 .net = net,
5896 .afi = afi,
5897 };
5898
5899 list_for_each_entry_safe(table, nt, &afi->tables, list) {
5900 list_for_each_entry(chain, &table->chains, list)
5901 nf_tables_unregister_hooks(net, table, chain,
5902 afi->nops);
5903 /* No packets are walking on these chains anymore. */
5904 ctx.table = table;
5905 list_for_each_entry(chain, &table->chains, list) {
5906 ctx.chain = chain;
5907 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
5908 list_del(&rule->list);
5909 chain->use--;
5910 nf_tables_rule_destroy(&ctx, rule);
5911 }
5912 }
5913 list_for_each_entry_safe(set, ns, &table->sets, list) {
5914 list_del(&set->list);
5915 table->use--;
5916 nft_set_destroy(set);
5917 }
5918 list_for_each_entry_safe(obj, ne, &table->objects, list) {
5919 list_del(&obj->list);
5920 table->use--;
5921 nft_obj_destroy(obj);
5922 }
5923 list_for_each_entry_safe(chain, nc, &table->chains, list) {
5924 list_del(&chain->list);
5925 table->use--;
5926 nf_tables_chain_destroy(chain);
5927 }
5928 list_del(&table->list);
5929 nf_tables_table_destroy(&ctx);
5930 }
5931 }
5932
5933 static struct pernet_operations nf_tables_net_ops = {
5934 .init = nf_tables_init_net,
5935 .exit = nf_tables_exit_net,
5936 };
5937
5938 static int __init nf_tables_module_init(void)
5939 {
5940 int err;
5941
5942 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
5943 GFP_KERNEL);
5944 if (info == NULL) {
5945 err = -ENOMEM;
5946 goto err1;
5947 }
5948
5949 err = nf_tables_core_module_init();
5950 if (err < 0)
5951 goto err2;
5952
5953 err = nfnetlink_subsys_register(&nf_tables_subsys);
5954 if (err < 0)
5955 goto err3;
5956
5957 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
5958 return register_pernet_subsys(&nf_tables_net_ops);
5959 err3:
5960 nf_tables_core_module_exit();
5961 err2:
5962 kfree(info);
5963 err1:
5964 return err;
5965 }
5966
5967 static void __exit nf_tables_module_exit(void)
5968 {
5969 unregister_pernet_subsys(&nf_tables_net_ops);
5970 nfnetlink_subsys_unregister(&nf_tables_subsys);
5971 rcu_barrier();
5972 nf_tables_core_module_exit();
5973 kfree(info);
5974 }
5975
5976 module_init(nf_tables_module_init);
5977 module_exit(nf_tables_module_exit);
5978
5979 MODULE_LICENSE("GPL");
5980 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
5981 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
ubuntu-bionic-kernel mirror