1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 #include <linux/module.h>
9 #include <linux/init.h>
10 #include <linux/list.h>
11 #include <linux/skbuff.h>
12 #include <linux/netlink.h>
13 #include <linux/vmalloc.h>
14 #include <linux/rhashtable.h>
15 #include <linux/audit.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nfnetlink.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_flow_table.h>
20 #include <net/netfilter/nf_tables_core.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_offload.h>
23 #include <net/net_namespace.h>
26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
28 unsigned int nf_tables_net_id __read_mostly
;
30 static LIST_HEAD(nf_tables_expressions
);
31 static LIST_HEAD(nf_tables_objects
);
32 static LIST_HEAD(nf_tables_flowtables
);
33 static LIST_HEAD(nf_tables_destroy_list
);
34 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock
);
35 static u64 table_handle
;
38 NFT_VALIDATE_SKIP
= 0,
43 static struct rhltable nft_objname_ht
;
45 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
);
46 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
);
47 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*, const void *);
49 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
);
50 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
);
51 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*, const void *);
53 static const struct rhashtable_params nft_chain_ht_params
= {
54 .head_offset
= offsetof(struct nft_chain
, rhlhead
),
55 .key_offset
= offsetof(struct nft_chain
, name
),
56 .hashfn
= nft_chain_hash
,
57 .obj_hashfn
= nft_chain_hash_obj
,
58 .obj_cmpfn
= nft_chain_hash_cmp
,
59 .automatic_shrinking
= true,
62 static const struct rhashtable_params nft_objname_ht_params
= {
63 .head_offset
= offsetof(struct nft_object
, rhlhead
),
64 .key_offset
= offsetof(struct nft_object
, key
),
65 .hashfn
= nft_objname_hash
,
66 .obj_hashfn
= nft_objname_hash_obj
,
67 .obj_cmpfn
= nft_objname_hash_cmp
,
68 .automatic_shrinking
= true,
71 struct nft_audit_data
{
72 struct nft_table
*table
;
75 struct list_head list
;
78 static const u8 nft2audit_op
[NFT_MSG_MAX
] = { // enum nf_tables_msg_types
79 [NFT_MSG_NEWTABLE
] = AUDIT_NFT_OP_TABLE_REGISTER
,
80 [NFT_MSG_GETTABLE
] = AUDIT_NFT_OP_INVALID
,
81 [NFT_MSG_DELTABLE
] = AUDIT_NFT_OP_TABLE_UNREGISTER
,
82 [NFT_MSG_NEWCHAIN
] = AUDIT_NFT_OP_CHAIN_REGISTER
,
83 [NFT_MSG_GETCHAIN
] = AUDIT_NFT_OP_INVALID
,
84 [NFT_MSG_DELCHAIN
] = AUDIT_NFT_OP_CHAIN_UNREGISTER
,
85 [NFT_MSG_NEWRULE
] = AUDIT_NFT_OP_RULE_REGISTER
,
86 [NFT_MSG_GETRULE
] = AUDIT_NFT_OP_INVALID
,
87 [NFT_MSG_DELRULE
] = AUDIT_NFT_OP_RULE_UNREGISTER
,
88 [NFT_MSG_NEWSET
] = AUDIT_NFT_OP_SET_REGISTER
,
89 [NFT_MSG_GETSET
] = AUDIT_NFT_OP_INVALID
,
90 [NFT_MSG_DELSET
] = AUDIT_NFT_OP_SET_UNREGISTER
,
91 [NFT_MSG_NEWSETELEM
] = AUDIT_NFT_OP_SETELEM_REGISTER
,
92 [NFT_MSG_GETSETELEM
] = AUDIT_NFT_OP_INVALID
,
93 [NFT_MSG_DELSETELEM
] = AUDIT_NFT_OP_SETELEM_UNREGISTER
,
94 [NFT_MSG_NEWGEN
] = AUDIT_NFT_OP_GEN_REGISTER
,
95 [NFT_MSG_GETGEN
] = AUDIT_NFT_OP_INVALID
,
96 [NFT_MSG_TRACE
] = AUDIT_NFT_OP_INVALID
,
97 [NFT_MSG_NEWOBJ
] = AUDIT_NFT_OP_OBJ_REGISTER
,
98 [NFT_MSG_GETOBJ
] = AUDIT_NFT_OP_INVALID
,
99 [NFT_MSG_DELOBJ
] = AUDIT_NFT_OP_OBJ_UNREGISTER
,
100 [NFT_MSG_GETOBJ_RESET
] = AUDIT_NFT_OP_OBJ_RESET
,
101 [NFT_MSG_NEWFLOWTABLE
] = AUDIT_NFT_OP_FLOWTABLE_REGISTER
,
102 [NFT_MSG_GETFLOWTABLE
] = AUDIT_NFT_OP_INVALID
,
103 [NFT_MSG_DELFLOWTABLE
] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER
,
106 static void nft_validate_state_update(struct net
*net
, u8 new_validate_state
)
108 struct nftables_pernet
*nft_net
= nft_pernet(net
);
110 switch (nft_net
->validate_state
) {
111 case NFT_VALIDATE_SKIP
:
112 WARN_ON_ONCE(new_validate_state
== NFT_VALIDATE_DO
);
114 case NFT_VALIDATE_NEED
:
116 case NFT_VALIDATE_DO
:
117 if (new_validate_state
== NFT_VALIDATE_NEED
)
121 nft_net
->validate_state
= new_validate_state
;
123 static void nf_tables_trans_destroy_work(struct work_struct
*w
);
124 static DECLARE_WORK(trans_destroy_work
, nf_tables_trans_destroy_work
);
126 static void nft_ctx_init(struct nft_ctx
*ctx
,
128 const struct sk_buff
*skb
,
129 const struct nlmsghdr
*nlh
,
131 struct nft_table
*table
,
132 struct nft_chain
*chain
,
133 const struct nlattr
* const *nla
)
136 ctx
->family
= family
;
141 ctx
->portid
= NETLINK_CB(skb
).portid
;
142 ctx
->report
= nlmsg_report(nlh
);
143 ctx
->flags
= nlh
->nlmsg_flags
;
144 ctx
->seq
= nlh
->nlmsg_seq
;
147 static struct nft_trans
*nft_trans_alloc_gfp(const struct nft_ctx
*ctx
,
148 int msg_type
, u32 size
, gfp_t gfp
)
150 struct nft_trans
*trans
;
152 trans
= kzalloc(sizeof(struct nft_trans
) + size
, gfp
);
156 trans
->msg_type
= msg_type
;
162 static struct nft_trans
*nft_trans_alloc(const struct nft_ctx
*ctx
,
163 int msg_type
, u32 size
)
165 return nft_trans_alloc_gfp(ctx
, msg_type
, size
, GFP_KERNEL
);
168 static void nft_trans_destroy(struct nft_trans
*trans
)
170 list_del(&trans
->list
);
174 static void nft_set_trans_bind(const struct nft_ctx
*ctx
, struct nft_set
*set
)
176 struct nftables_pernet
*nft_net
;
177 struct net
*net
= ctx
->net
;
178 struct nft_trans
*trans
;
180 if (!nft_set_is_anonymous(set
))
183 nft_net
= nft_pernet(net
);
184 list_for_each_entry_reverse(trans
, &nft_net
->commit_list
, list
) {
185 switch (trans
->msg_type
) {
187 if (nft_trans_set(trans
) == set
)
188 nft_trans_set_bound(trans
) = true;
190 case NFT_MSG_NEWSETELEM
:
191 if (nft_trans_elem_set(trans
) == set
)
192 nft_trans_elem_set_bound(trans
) = true;
198 static int nft_netdev_register_hooks(struct net
*net
,
199 struct list_head
*hook_list
)
201 struct nft_hook
*hook
;
205 list_for_each_entry(hook
, hook_list
, list
) {
206 err
= nf_register_net_hook(net
, &hook
->ops
);
215 list_for_each_entry(hook
, hook_list
, list
) {
219 nf_unregister_net_hook(net
, &hook
->ops
);
224 static void nft_netdev_unregister_hooks(struct net
*net
,
225 struct list_head
*hook_list
)
227 struct nft_hook
*hook
;
229 list_for_each_entry(hook
, hook_list
, list
)
230 nf_unregister_net_hook(net
, &hook
->ops
);
233 static int nf_tables_register_hook(struct net
*net
,
234 const struct nft_table
*table
,
235 struct nft_chain
*chain
)
237 struct nft_base_chain
*basechain
;
238 const struct nf_hook_ops
*ops
;
240 if (table
->flags
& NFT_TABLE_F_DORMANT
||
241 !nft_is_base_chain(chain
))
244 basechain
= nft_base_chain(chain
);
245 ops
= &basechain
->ops
;
247 if (basechain
->type
->ops_register
)
248 return basechain
->type
->ops_register(net
, ops
);
250 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
251 return nft_netdev_register_hooks(net
, &basechain
->hook_list
);
253 return nf_register_net_hook(net
, &basechain
->ops
);
256 static void nf_tables_unregister_hook(struct net
*net
,
257 const struct nft_table
*table
,
258 struct nft_chain
*chain
)
260 struct nft_base_chain
*basechain
;
261 const struct nf_hook_ops
*ops
;
263 if (table
->flags
& NFT_TABLE_F_DORMANT
||
264 !nft_is_base_chain(chain
))
266 basechain
= nft_base_chain(chain
);
267 ops
= &basechain
->ops
;
269 if (basechain
->type
->ops_unregister
)
270 return basechain
->type
->ops_unregister(net
, ops
);
272 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
273 nft_netdev_unregister_hooks(net
, &basechain
->hook_list
);
275 nf_unregister_net_hook(net
, &basechain
->ops
);
278 static void nft_trans_commit_list_add_tail(struct net
*net
, struct nft_trans
*trans
)
280 struct nftables_pernet
*nft_net
= nft_pernet(net
);
282 list_add_tail(&trans
->list
, &nft_net
->commit_list
);
285 static int nft_trans_table_add(struct nft_ctx
*ctx
, int msg_type
)
287 struct nft_trans
*trans
;
289 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_table
));
293 if (msg_type
== NFT_MSG_NEWTABLE
)
294 nft_activate_next(ctx
->net
, ctx
->table
);
296 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
300 static int nft_deltable(struct nft_ctx
*ctx
)
304 err
= nft_trans_table_add(ctx
, NFT_MSG_DELTABLE
);
308 nft_deactivate_next(ctx
->net
, ctx
->table
);
312 static struct nft_trans
*nft_trans_chain_add(struct nft_ctx
*ctx
, int msg_type
)
314 struct nft_trans
*trans
;
316 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_chain
));
318 return ERR_PTR(-ENOMEM
);
320 if (msg_type
== NFT_MSG_NEWCHAIN
) {
321 nft_activate_next(ctx
->net
, ctx
->chain
);
323 if (ctx
->nla
[NFTA_CHAIN_ID
]) {
324 nft_trans_chain_id(trans
) =
325 ntohl(nla_get_be32(ctx
->nla
[NFTA_CHAIN_ID
]));
329 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
333 static int nft_delchain(struct nft_ctx
*ctx
)
335 struct nft_trans
*trans
;
337 trans
= nft_trans_chain_add(ctx
, NFT_MSG_DELCHAIN
);
339 return PTR_ERR(trans
);
342 nft_deactivate_next(ctx
->net
, ctx
->chain
);
347 static void nft_rule_expr_activate(const struct nft_ctx
*ctx
,
348 struct nft_rule
*rule
)
350 struct nft_expr
*expr
;
352 expr
= nft_expr_first(rule
);
353 while (nft_expr_more(rule
, expr
)) {
354 if (expr
->ops
->activate
)
355 expr
->ops
->activate(ctx
, expr
);
357 expr
= nft_expr_next(expr
);
361 static void nft_rule_expr_deactivate(const struct nft_ctx
*ctx
,
362 struct nft_rule
*rule
,
363 enum nft_trans_phase phase
)
365 struct nft_expr
*expr
;
367 expr
= nft_expr_first(rule
);
368 while (nft_expr_more(rule
, expr
)) {
369 if (expr
->ops
->deactivate
)
370 expr
->ops
->deactivate(ctx
, expr
, phase
);
372 expr
= nft_expr_next(expr
);
377 nf_tables_delrule_deactivate(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
379 /* You cannot delete the same rule twice */
380 if (nft_is_active_next(ctx
->net
, rule
)) {
381 nft_deactivate_next(ctx
->net
, rule
);
388 static struct nft_trans
*nft_trans_rule_add(struct nft_ctx
*ctx
, int msg_type
,
389 struct nft_rule
*rule
)
391 struct nft_trans
*trans
;
393 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_rule
));
397 if (msg_type
== NFT_MSG_NEWRULE
&& ctx
->nla
[NFTA_RULE_ID
] != NULL
) {
398 nft_trans_rule_id(trans
) =
399 ntohl(nla_get_be32(ctx
->nla
[NFTA_RULE_ID
]));
401 nft_trans_rule(trans
) = rule
;
402 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
407 static int nft_delrule(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
409 struct nft_flow_rule
*flow
;
410 struct nft_trans
*trans
;
413 trans
= nft_trans_rule_add(ctx
, NFT_MSG_DELRULE
, rule
);
417 if (ctx
->chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
418 flow
= nft_flow_rule_create(ctx
->net
, rule
);
420 nft_trans_destroy(trans
);
421 return PTR_ERR(flow
);
424 nft_trans_flow_rule(trans
) = flow
;
427 err
= nf_tables_delrule_deactivate(ctx
, rule
);
429 nft_trans_destroy(trans
);
432 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_PREPARE
);
437 static int nft_delrule_by_chain(struct nft_ctx
*ctx
)
439 struct nft_rule
*rule
;
442 list_for_each_entry(rule
, &ctx
->chain
->rules
, list
) {
443 if (!nft_is_active_next(ctx
->net
, rule
))
446 err
= nft_delrule(ctx
, rule
);
453 static int nft_trans_set_add(const struct nft_ctx
*ctx
, int msg_type
,
456 struct nft_trans
*trans
;
458 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_set
));
462 if (msg_type
== NFT_MSG_NEWSET
&& ctx
->nla
[NFTA_SET_ID
] != NULL
) {
463 nft_trans_set_id(trans
) =
464 ntohl(nla_get_be32(ctx
->nla
[NFTA_SET_ID
]));
465 nft_activate_next(ctx
->net
, set
);
467 nft_trans_set(trans
) = set
;
468 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
473 static int nft_delset(const struct nft_ctx
*ctx
, struct nft_set
*set
)
477 err
= nft_trans_set_add(ctx
, NFT_MSG_DELSET
, set
);
481 nft_deactivate_next(ctx
->net
, set
);
487 static int nft_trans_obj_add(struct nft_ctx
*ctx
, int msg_type
,
488 struct nft_object
*obj
)
490 struct nft_trans
*trans
;
492 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_obj
));
496 if (msg_type
== NFT_MSG_NEWOBJ
)
497 nft_activate_next(ctx
->net
, obj
);
499 nft_trans_obj(trans
) = obj
;
500 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
505 static int nft_delobj(struct nft_ctx
*ctx
, struct nft_object
*obj
)
509 err
= nft_trans_obj_add(ctx
, NFT_MSG_DELOBJ
, obj
);
513 nft_deactivate_next(ctx
->net
, obj
);
519 static int nft_trans_flowtable_add(struct nft_ctx
*ctx
, int msg_type
,
520 struct nft_flowtable
*flowtable
)
522 struct nft_trans
*trans
;
524 trans
= nft_trans_alloc(ctx
, msg_type
,
525 sizeof(struct nft_trans_flowtable
));
529 if (msg_type
== NFT_MSG_NEWFLOWTABLE
)
530 nft_activate_next(ctx
->net
, flowtable
);
532 nft_trans_flowtable(trans
) = flowtable
;
533 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
538 static int nft_delflowtable(struct nft_ctx
*ctx
,
539 struct nft_flowtable
*flowtable
)
543 err
= nft_trans_flowtable_add(ctx
, NFT_MSG_DELFLOWTABLE
, flowtable
);
547 nft_deactivate_next(ctx
->net
, flowtable
);
557 static struct nft_table
*nft_table_lookup(const struct net
*net
,
558 const struct nlattr
*nla
,
559 u8 family
, u8 genmask
, u32 nlpid
)
561 struct nftables_pernet
*nft_net
;
562 struct nft_table
*table
;
565 return ERR_PTR(-EINVAL
);
567 nft_net
= nft_pernet(net
);
568 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
,
569 lockdep_is_held(&nft_net
->commit_mutex
)) {
570 if (!nla_strcmp(nla
, table
->name
) &&
571 table
->family
== family
&&
572 nft_active_genmask(table
, genmask
)) {
573 if (nft_table_has_owner(table
) &&
574 nlpid
&& table
->nlpid
!= nlpid
)
575 return ERR_PTR(-EPERM
);
581 return ERR_PTR(-ENOENT
);
584 static struct nft_table
*nft_table_lookup_byhandle(const struct net
*net
,
585 const struct nlattr
*nla
,
586 u8 genmask
, u32 nlpid
)
588 struct nftables_pernet
*nft_net
;
589 struct nft_table
*table
;
591 nft_net
= nft_pernet(net
);
592 list_for_each_entry(table
, &nft_net
->tables
, list
) {
593 if (be64_to_cpu(nla_get_be64(nla
)) == table
->handle
&&
594 nft_active_genmask(table
, genmask
)) {
595 if (nft_table_has_owner(table
) &&
596 nlpid
&& table
->nlpid
!= nlpid
)
597 return ERR_PTR(-EPERM
);
603 return ERR_PTR(-ENOENT
);
606 static inline u64
nf_tables_alloc_handle(struct nft_table
*table
)
608 return ++table
->hgenerator
;
611 static const struct nft_chain_type
*chain_type
[NFPROTO_NUMPROTO
][NFT_CHAIN_T_MAX
];
613 static const struct nft_chain_type
*
614 __nft_chain_type_get(u8 family
, enum nft_chain_types type
)
616 if (family
>= NFPROTO_NUMPROTO
||
617 type
>= NFT_CHAIN_T_MAX
)
620 return chain_type
[family
][type
];
623 static const struct nft_chain_type
*
624 __nf_tables_chain_type_lookup(const struct nlattr
*nla
, u8 family
)
626 const struct nft_chain_type
*type
;
629 for (i
= 0; i
< NFT_CHAIN_T_MAX
; i
++) {
630 type
= __nft_chain_type_get(family
, i
);
633 if (!nla_strcmp(nla
, type
->name
))
639 struct nft_module_request
{
640 struct list_head list
;
641 char module
[MODULE_NAME_LEN
];
645 #ifdef CONFIG_MODULES
646 __printf(2, 3) int nft_request_module(struct net
*net
, const char *fmt
,
649 char module_name
[MODULE_NAME_LEN
];
650 struct nftables_pernet
*nft_net
;
651 struct nft_module_request
*req
;
656 ret
= vsnprintf(module_name
, MODULE_NAME_LEN
, fmt
, args
);
658 if (ret
>= MODULE_NAME_LEN
)
661 nft_net
= nft_pernet(net
);
662 list_for_each_entry(req
, &nft_net
->module_list
, list
) {
663 if (!strcmp(req
->module
, module_name
)) {
667 /* A request to load this module already exists. */
672 req
= kmalloc(sizeof(*req
), GFP_KERNEL
);
677 strlcpy(req
->module
, module_name
, MODULE_NAME_LEN
);
678 list_add_tail(&req
->list
, &nft_net
->module_list
);
682 EXPORT_SYMBOL_GPL(nft_request_module
);
685 static void lockdep_nfnl_nft_mutex_not_held(void)
687 #ifdef CONFIG_PROVE_LOCKING
689 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES
));
693 static const struct nft_chain_type
*
694 nf_tables_chain_type_lookup(struct net
*net
, const struct nlattr
*nla
,
695 u8 family
, bool autoload
)
697 const struct nft_chain_type
*type
;
699 type
= __nf_tables_chain_type_lookup(nla
, family
);
703 lockdep_nfnl_nft_mutex_not_held();
704 #ifdef CONFIG_MODULES
706 if (nft_request_module(net
, "nft-chain-%u-%.*s", family
,
708 (const char *)nla_data(nla
)) == -EAGAIN
)
709 return ERR_PTR(-EAGAIN
);
712 return ERR_PTR(-ENOENT
);
715 static __be16
nft_base_seq(const struct net
*net
)
717 struct nftables_pernet
*nft_net
= nft_pernet(net
);
719 return htons(nft_net
->base_seq
& 0xffff);
722 static const struct nla_policy nft_table_policy
[NFTA_TABLE_MAX
+ 1] = {
723 [NFTA_TABLE_NAME
] = { .type
= NLA_STRING
,
724 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
725 [NFTA_TABLE_FLAGS
] = { .type
= NLA_U32
},
726 [NFTA_TABLE_HANDLE
] = { .type
= NLA_U64
},
727 [NFTA_TABLE_USERDATA
] = { .type
= NLA_BINARY
,
728 .len
= NFT_USERDATA_MAXLEN
}
731 static int nf_tables_fill_table_info(struct sk_buff
*skb
, struct net
*net
,
732 u32 portid
, u32 seq
, int event
, u32 flags
,
733 int family
, const struct nft_table
*table
)
735 struct nlmsghdr
*nlh
;
737 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
738 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
739 NFNETLINK_V0
, nft_base_seq(net
));
741 goto nla_put_failure
;
743 if (nla_put_string(skb
, NFTA_TABLE_NAME
, table
->name
) ||
744 nla_put_be32(skb
, NFTA_TABLE_FLAGS
,
745 htonl(table
->flags
& NFT_TABLE_F_MASK
)) ||
746 nla_put_be32(skb
, NFTA_TABLE_USE
, htonl(table
->use
)) ||
747 nla_put_be64(skb
, NFTA_TABLE_HANDLE
, cpu_to_be64(table
->handle
),
749 goto nla_put_failure
;
750 if (nft_table_has_owner(table
) &&
751 nla_put_be32(skb
, NFTA_TABLE_OWNER
, htonl(table
->nlpid
)))
752 goto nla_put_failure
;
755 if (nla_put(skb
, NFTA_TABLE_USERDATA
, table
->udlen
, table
->udata
))
756 goto nla_put_failure
;
763 nlmsg_trim(skb
, nlh
);
767 struct nftnl_skb_parms
{
770 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb))
772 static void nft_notify_enqueue(struct sk_buff
*skb
, bool report
,
773 struct list_head
*notify_list
)
775 NFT_CB(skb
).report
= report
;
776 list_add_tail(&skb
->list
, notify_list
);
779 static void nf_tables_table_notify(const struct nft_ctx
*ctx
, int event
)
781 struct nftables_pernet
*nft_net
;
787 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
790 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
794 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
795 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
797 err
= nf_tables_fill_table_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
798 event
, flags
, ctx
->family
, ctx
->table
);
804 nft_net
= nft_pernet(ctx
->net
);
805 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
808 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
811 static int nf_tables_dump_tables(struct sk_buff
*skb
,
812 struct netlink_callback
*cb
)
814 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
815 struct nftables_pernet
*nft_net
;
816 const struct nft_table
*table
;
817 unsigned int idx
= 0, s_idx
= cb
->args
[0];
818 struct net
*net
= sock_net(skb
->sk
);
819 int family
= nfmsg
->nfgen_family
;
822 nft_net
= nft_pernet(net
);
823 cb
->seq
= nft_net
->base_seq
;
825 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
826 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
832 memset(&cb
->args
[1], 0,
833 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
834 if (!nft_is_active(net
, table
))
836 if (nf_tables_fill_table_info(skb
, net
,
837 NETLINK_CB(cb
->skb
).portid
,
839 NFT_MSG_NEWTABLE
, NLM_F_MULTI
,
840 table
->family
, table
) < 0)
843 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
853 static int nft_netlink_dump_start_rcu(struct sock
*nlsk
, struct sk_buff
*skb
,
854 const struct nlmsghdr
*nlh
,
855 struct netlink_dump_control
*c
)
859 if (!try_module_get(THIS_MODULE
))
863 err
= netlink_dump_start(nlsk
, skb
, nlh
, c
);
865 module_put(THIS_MODULE
);
870 /* called with rcu_read_lock held */
871 static int nf_tables_gettable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
872 const struct nlattr
* const nla
[])
874 struct netlink_ext_ack
*extack
= info
->extack
;
875 u8 genmask
= nft_genmask_cur(info
->net
);
876 u8 family
= info
->nfmsg
->nfgen_family
;
877 const struct nft_table
*table
;
878 struct net
*net
= info
->net
;
879 struct sk_buff
*skb2
;
882 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
883 struct netlink_dump_control c
= {
884 .dump
= nf_tables_dump_tables
,
885 .module
= THIS_MODULE
,
888 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
891 table
= nft_table_lookup(net
, nla
[NFTA_TABLE_NAME
], family
, genmask
, 0);
893 NL_SET_BAD_ATTR(extack
, nla
[NFTA_TABLE_NAME
]);
894 return PTR_ERR(table
);
897 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
901 err
= nf_tables_fill_table_info(skb2
, net
, NETLINK_CB(skb
).portid
,
902 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWTABLE
,
905 goto err_fill_table_info
;
907 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
914 static void nft_table_disable(struct net
*net
, struct nft_table
*table
, u32 cnt
)
916 struct nft_chain
*chain
;
919 list_for_each_entry(chain
, &table
->chains
, list
) {
920 if (!nft_is_active_next(net
, chain
))
922 if (!nft_is_base_chain(chain
))
925 if (cnt
&& i
++ == cnt
)
928 nf_tables_unregister_hook(net
, table
, chain
);
932 static int nf_tables_table_enable(struct net
*net
, struct nft_table
*table
)
934 struct nft_chain
*chain
;
937 list_for_each_entry(chain
, &table
->chains
, list
) {
938 if (!nft_is_active_next(net
, chain
))
940 if (!nft_is_base_chain(chain
))
943 err
= nf_tables_register_hook(net
, table
, chain
);
945 goto err_register_hooks
;
953 nft_table_disable(net
, table
, i
);
957 static void nf_tables_table_disable(struct net
*net
, struct nft_table
*table
)
959 table
->flags
&= ~NFT_TABLE_F_DORMANT
;
960 nft_table_disable(net
, table
, 0);
961 table
->flags
|= NFT_TABLE_F_DORMANT
;
964 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1)
965 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0)
966 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1)
967 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \
968 __NFT_TABLE_F_WAS_AWAKEN)
970 static int nf_tables_updtable(struct nft_ctx
*ctx
)
972 struct nft_trans
*trans
;
976 if (!ctx
->nla
[NFTA_TABLE_FLAGS
])
979 flags
= ntohl(nla_get_be32(ctx
->nla
[NFTA_TABLE_FLAGS
]));
980 if (flags
& ~NFT_TABLE_F_MASK
)
983 if (flags
== ctx
->table
->flags
)
986 if ((nft_table_has_owner(ctx
->table
) &&
987 !(flags
& NFT_TABLE_F_OWNER
)) ||
988 (!nft_table_has_owner(ctx
->table
) &&
989 flags
& NFT_TABLE_F_OWNER
))
992 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWTABLE
,
993 sizeof(struct nft_trans_table
));
997 if ((flags
& NFT_TABLE_F_DORMANT
) &&
998 !(ctx
->table
->flags
& NFT_TABLE_F_DORMANT
)) {
999 ctx
->table
->flags
|= NFT_TABLE_F_DORMANT
;
1000 if (!(ctx
->table
->flags
& __NFT_TABLE_F_UPDATE
))
1001 ctx
->table
->flags
|= __NFT_TABLE_F_WAS_AWAKEN
;
1002 } else if (!(flags
& NFT_TABLE_F_DORMANT
) &&
1003 ctx
->table
->flags
& NFT_TABLE_F_DORMANT
) {
1004 ctx
->table
->flags
&= ~NFT_TABLE_F_DORMANT
;
1005 if (!(ctx
->table
->flags
& __NFT_TABLE_F_UPDATE
)) {
1006 ret
= nf_tables_table_enable(ctx
->net
, ctx
->table
);
1008 goto err_register_hooks
;
1010 ctx
->table
->flags
|= __NFT_TABLE_F_WAS_DORMANT
;
1014 nft_trans_table_update(trans
) = true;
1015 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
1020 nft_trans_destroy(trans
);
1024 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
)
1026 const char *name
= data
;
1028 return jhash(name
, strlen(name
), seed
);
1031 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
)
1033 const struct nft_chain
*chain
= data
;
1035 return nft_chain_hash(chain
->name
, 0, seed
);
1038 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*arg
,
1041 const struct nft_chain
*chain
= ptr
;
1042 const char *name
= arg
->key
;
1044 return strcmp(chain
->name
, name
);
1047 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
)
1049 const struct nft_object_hash_key
*k
= data
;
1051 seed
^= hash_ptr(k
->table
, 32);
1053 return jhash(k
->name
, strlen(k
->name
), seed
);
1056 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
)
1058 const struct nft_object
*obj
= data
;
1060 return nft_objname_hash(&obj
->key
, 0, seed
);
1063 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*arg
,
1066 const struct nft_object_hash_key
*k
= arg
->key
;
1067 const struct nft_object
*obj
= ptr
;
1069 if (obj
->key
.table
!= k
->table
)
1072 return strcmp(obj
->key
.name
, k
->name
);
1075 static int nf_tables_newtable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1076 const struct nlattr
* const nla
[])
1078 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
1079 struct netlink_ext_ack
*extack
= info
->extack
;
1080 u8 genmask
= nft_genmask_next(info
->net
);
1081 u8 family
= info
->nfmsg
->nfgen_family
;
1082 struct net
*net
= info
->net
;
1083 const struct nlattr
*attr
;
1084 struct nft_table
*table
;
1089 lockdep_assert_held(&nft_net
->commit_mutex
);
1090 attr
= nla
[NFTA_TABLE_NAME
];
1091 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1092 NETLINK_CB(skb
).portid
);
1093 if (IS_ERR(table
)) {
1094 if (PTR_ERR(table
) != -ENOENT
)
1095 return PTR_ERR(table
);
1097 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
1098 NL_SET_BAD_ATTR(extack
, attr
);
1101 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
1104 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
1106 return nf_tables_updtable(&ctx
);
1109 if (nla
[NFTA_TABLE_FLAGS
]) {
1110 flags
= ntohl(nla_get_be32(nla
[NFTA_TABLE_FLAGS
]));
1111 if (flags
& ~NFT_TABLE_F_MASK
)
1116 table
= kzalloc(sizeof(*table
), GFP_KERNEL
);
1120 table
->name
= nla_strdup(attr
, GFP_KERNEL
);
1121 if (table
->name
== NULL
)
1124 if (nla
[NFTA_TABLE_USERDATA
]) {
1125 table
->udata
= nla_memdup(nla
[NFTA_TABLE_USERDATA
], GFP_KERNEL
);
1126 if (table
->udata
== NULL
)
1127 goto err_table_udata
;
1129 table
->udlen
= nla_len(nla
[NFTA_TABLE_USERDATA
]);
1132 err
= rhltable_init(&table
->chains_ht
, &nft_chain_ht_params
);
1136 INIT_LIST_HEAD(&table
->chains
);
1137 INIT_LIST_HEAD(&table
->sets
);
1138 INIT_LIST_HEAD(&table
->objects
);
1139 INIT_LIST_HEAD(&table
->flowtables
);
1140 table
->family
= family
;
1141 table
->flags
= flags
;
1142 table
->handle
= ++table_handle
;
1143 if (table
->flags
& NFT_TABLE_F_OWNER
)
1144 table
->nlpid
= NETLINK_CB(skb
).portid
;
1146 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
1147 err
= nft_trans_table_add(&ctx
, NFT_MSG_NEWTABLE
);
1151 list_add_tail_rcu(&table
->list
, &nft_net
->tables
);
1154 rhltable_destroy(&table
->chains_ht
);
1156 kfree(table
->udata
);
1165 static int nft_flush_table(struct nft_ctx
*ctx
)
1167 struct nft_flowtable
*flowtable
, *nft
;
1168 struct nft_chain
*chain
, *nc
;
1169 struct nft_object
*obj
, *ne
;
1170 struct nft_set
*set
, *ns
;
1173 list_for_each_entry(chain
, &ctx
->table
->chains
, list
) {
1174 if (!nft_is_active_next(ctx
->net
, chain
))
1177 if (nft_chain_is_bound(chain
))
1182 err
= nft_delrule_by_chain(ctx
);
1187 list_for_each_entry_safe(set
, ns
, &ctx
->table
->sets
, list
) {
1188 if (!nft_is_active_next(ctx
->net
, set
))
1191 if (nft_set_is_anonymous(set
) &&
1192 !list_empty(&set
->bindings
))
1195 err
= nft_delset(ctx
, set
);
1200 list_for_each_entry_safe(flowtable
, nft
, &ctx
->table
->flowtables
, list
) {
1201 if (!nft_is_active_next(ctx
->net
, flowtable
))
1204 err
= nft_delflowtable(ctx
, flowtable
);
1209 list_for_each_entry_safe(obj
, ne
, &ctx
->table
->objects
, list
) {
1210 if (!nft_is_active_next(ctx
->net
, obj
))
1213 err
= nft_delobj(ctx
, obj
);
1218 list_for_each_entry_safe(chain
, nc
, &ctx
->table
->chains
, list
) {
1219 if (!nft_is_active_next(ctx
->net
, chain
))
1222 if (nft_chain_is_bound(chain
))
1227 err
= nft_delchain(ctx
);
1232 err
= nft_deltable(ctx
);
1237 static int nft_flush(struct nft_ctx
*ctx
, int family
)
1239 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
1240 const struct nlattr
* const *nla
= ctx
->nla
;
1241 struct nft_table
*table
, *nt
;
1244 list_for_each_entry_safe(table
, nt
, &nft_net
->tables
, list
) {
1245 if (family
!= AF_UNSPEC
&& table
->family
!= family
)
1248 ctx
->family
= table
->family
;
1250 if (!nft_is_active_next(ctx
->net
, table
))
1253 if (nft_table_has_owner(table
) && table
->nlpid
!= ctx
->portid
)
1256 if (nla
[NFTA_TABLE_NAME
] &&
1257 nla_strcmp(nla
[NFTA_TABLE_NAME
], table
->name
) != 0)
1262 err
= nft_flush_table(ctx
);
1270 static int nf_tables_deltable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1271 const struct nlattr
* const nla
[])
1273 struct netlink_ext_ack
*extack
= info
->extack
;
1274 u8 genmask
= nft_genmask_next(info
->net
);
1275 u8 family
= info
->nfmsg
->nfgen_family
;
1276 struct net
*net
= info
->net
;
1277 const struct nlattr
*attr
;
1278 struct nft_table
*table
;
1281 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, 0, NULL
, NULL
, nla
);
1282 if (family
== AF_UNSPEC
||
1283 (!nla
[NFTA_TABLE_NAME
] && !nla
[NFTA_TABLE_HANDLE
]))
1284 return nft_flush(&ctx
, family
);
1286 if (nla
[NFTA_TABLE_HANDLE
]) {
1287 attr
= nla
[NFTA_TABLE_HANDLE
];
1288 table
= nft_table_lookup_byhandle(net
, attr
, genmask
,
1289 NETLINK_CB(skb
).portid
);
1291 attr
= nla
[NFTA_TABLE_NAME
];
1292 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1293 NETLINK_CB(skb
).portid
);
1296 if (IS_ERR(table
)) {
1297 NL_SET_BAD_ATTR(extack
, attr
);
1298 return PTR_ERR(table
);
1301 if (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
1305 ctx
.family
= family
;
1308 return nft_flush_table(&ctx
);
1311 static void nf_tables_table_destroy(struct nft_ctx
*ctx
)
1313 if (WARN_ON(ctx
->table
->use
> 0))
1316 rhltable_destroy(&ctx
->table
->chains_ht
);
1317 kfree(ctx
->table
->name
);
1318 kfree(ctx
->table
->udata
);
1322 void nft_register_chain_type(const struct nft_chain_type
*ctype
)
1324 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1325 if (WARN_ON(__nft_chain_type_get(ctype
->family
, ctype
->type
))) {
1326 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1329 chain_type
[ctype
->family
][ctype
->type
] = ctype
;
1330 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1332 EXPORT_SYMBOL_GPL(nft_register_chain_type
);
1334 void nft_unregister_chain_type(const struct nft_chain_type
*ctype
)
1336 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1337 chain_type
[ctype
->family
][ctype
->type
] = NULL
;
1338 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1340 EXPORT_SYMBOL_GPL(nft_unregister_chain_type
);
1346 static struct nft_chain
*
1347 nft_chain_lookup_byhandle(const struct nft_table
*table
, u64 handle
, u8 genmask
)
1349 struct nft_chain
*chain
;
1351 list_for_each_entry(chain
, &table
->chains
, list
) {
1352 if (chain
->handle
== handle
&&
1353 nft_active_genmask(chain
, genmask
))
1357 return ERR_PTR(-ENOENT
);
1360 static bool lockdep_commit_lock_is_held(const struct net
*net
)
1362 #ifdef CONFIG_PROVE_LOCKING
1363 struct nftables_pernet
*nft_net
= nft_pernet(net
);
1365 return lockdep_is_held(&nft_net
->commit_mutex
);
1371 static struct nft_chain
*nft_chain_lookup(struct net
*net
,
1372 struct nft_table
*table
,
1373 const struct nlattr
*nla
, u8 genmask
)
1375 char search
[NFT_CHAIN_MAXNAMELEN
+ 1];
1376 struct rhlist_head
*tmp
, *list
;
1377 struct nft_chain
*chain
;
1380 return ERR_PTR(-EINVAL
);
1382 nla_strscpy(search
, nla
, sizeof(search
));
1384 WARN_ON(!rcu_read_lock_held() &&
1385 !lockdep_commit_lock_is_held(net
));
1387 chain
= ERR_PTR(-ENOENT
);
1389 list
= rhltable_lookup(&table
->chains_ht
, search
, nft_chain_ht_params
);
1393 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
1394 if (nft_active_genmask(chain
, genmask
))
1397 chain
= ERR_PTR(-ENOENT
);
1403 static const struct nla_policy nft_chain_policy
[NFTA_CHAIN_MAX
+ 1] = {
1404 [NFTA_CHAIN_TABLE
] = { .type
= NLA_STRING
,
1405 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
1406 [NFTA_CHAIN_HANDLE
] = { .type
= NLA_U64
},
1407 [NFTA_CHAIN_NAME
] = { .type
= NLA_STRING
,
1408 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
1409 [NFTA_CHAIN_HOOK
] = { .type
= NLA_NESTED
},
1410 [NFTA_CHAIN_POLICY
] = { .type
= NLA_U32
},
1411 [NFTA_CHAIN_TYPE
] = { .type
= NLA_STRING
,
1412 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
1413 [NFTA_CHAIN_COUNTERS
] = { .type
= NLA_NESTED
},
1414 [NFTA_CHAIN_FLAGS
] = { .type
= NLA_U32
},
1415 [NFTA_CHAIN_ID
] = { .type
= NLA_U32
},
1416 [NFTA_CHAIN_USERDATA
] = { .type
= NLA_BINARY
,
1417 .len
= NFT_USERDATA_MAXLEN
},
1420 static const struct nla_policy nft_hook_policy
[NFTA_HOOK_MAX
+ 1] = {
1421 [NFTA_HOOK_HOOKNUM
] = { .type
= NLA_U32
},
1422 [NFTA_HOOK_PRIORITY
] = { .type
= NLA_U32
},
1423 [NFTA_HOOK_DEV
] = { .type
= NLA_STRING
,
1424 .len
= IFNAMSIZ
- 1 },
1427 static int nft_dump_stats(struct sk_buff
*skb
, struct nft_stats __percpu
*stats
)
1429 struct nft_stats
*cpu_stats
, total
;
1430 struct nlattr
*nest
;
1438 memset(&total
, 0, sizeof(total
));
1439 for_each_possible_cpu(cpu
) {
1440 cpu_stats
= per_cpu_ptr(stats
, cpu
);
1442 seq
= u64_stats_fetch_begin_irq(&cpu_stats
->syncp
);
1443 pkts
= cpu_stats
->pkts
;
1444 bytes
= cpu_stats
->bytes
;
1445 } while (u64_stats_fetch_retry_irq(&cpu_stats
->syncp
, seq
));
1447 total
.bytes
+= bytes
;
1449 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_COUNTERS
);
1451 goto nla_put_failure
;
1453 if (nla_put_be64(skb
, NFTA_COUNTER_PACKETS
, cpu_to_be64(total
.pkts
),
1454 NFTA_COUNTER_PAD
) ||
1455 nla_put_be64(skb
, NFTA_COUNTER_BYTES
, cpu_to_be64(total
.bytes
),
1457 goto nla_put_failure
;
1459 nla_nest_end(skb
, nest
);
1466 static int nft_dump_basechain_hook(struct sk_buff
*skb
, int family
,
1467 const struct nft_base_chain
*basechain
)
1469 const struct nf_hook_ops
*ops
= &basechain
->ops
;
1470 struct nft_hook
*hook
, *first
= NULL
;
1471 struct nlattr
*nest
, *nest_devs
;
1474 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_HOOK
);
1476 goto nla_put_failure
;
1477 if (nla_put_be32(skb
, NFTA_HOOK_HOOKNUM
, htonl(ops
->hooknum
)))
1478 goto nla_put_failure
;
1479 if (nla_put_be32(skb
, NFTA_HOOK_PRIORITY
, htonl(ops
->priority
)))
1480 goto nla_put_failure
;
1482 if (nft_base_chain_netdev(family
, ops
->hooknum
)) {
1483 nest_devs
= nla_nest_start_noflag(skb
, NFTA_HOOK_DEVS
);
1484 list_for_each_entry(hook
, &basechain
->hook_list
, list
) {
1488 if (nla_put_string(skb
, NFTA_DEVICE_NAME
,
1489 hook
->ops
.dev
->name
))
1490 goto nla_put_failure
;
1493 nla_nest_end(skb
, nest_devs
);
1496 nla_put_string(skb
, NFTA_HOOK_DEV
, first
->ops
.dev
->name
))
1497 goto nla_put_failure
;
1499 nla_nest_end(skb
, nest
);
1506 static int nf_tables_fill_chain_info(struct sk_buff
*skb
, struct net
*net
,
1507 u32 portid
, u32 seq
, int event
, u32 flags
,
1508 int family
, const struct nft_table
*table
,
1509 const struct nft_chain
*chain
)
1511 struct nlmsghdr
*nlh
;
1513 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
1514 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
1515 NFNETLINK_V0
, nft_base_seq(net
));
1517 goto nla_put_failure
;
1519 if (nla_put_string(skb
, NFTA_CHAIN_TABLE
, table
->name
))
1520 goto nla_put_failure
;
1521 if (nla_put_be64(skb
, NFTA_CHAIN_HANDLE
, cpu_to_be64(chain
->handle
),
1523 goto nla_put_failure
;
1524 if (nla_put_string(skb
, NFTA_CHAIN_NAME
, chain
->name
))
1525 goto nla_put_failure
;
1527 if (nft_is_base_chain(chain
)) {
1528 const struct nft_base_chain
*basechain
= nft_base_chain(chain
);
1529 struct nft_stats __percpu
*stats
;
1531 if (nft_dump_basechain_hook(skb
, family
, basechain
))
1532 goto nla_put_failure
;
1534 if (nla_put_be32(skb
, NFTA_CHAIN_POLICY
,
1535 htonl(basechain
->policy
)))
1536 goto nla_put_failure
;
1538 if (nla_put_string(skb
, NFTA_CHAIN_TYPE
, basechain
->type
->name
))
1539 goto nla_put_failure
;
1541 stats
= rcu_dereference_check(basechain
->stats
,
1542 lockdep_commit_lock_is_held(net
));
1543 if (nft_dump_stats(skb
, stats
))
1544 goto nla_put_failure
;
1548 nla_put_be32(skb
, NFTA_CHAIN_FLAGS
, htonl(chain
->flags
)))
1549 goto nla_put_failure
;
1551 if (nla_put_be32(skb
, NFTA_CHAIN_USE
, htonl(chain
->use
)))
1552 goto nla_put_failure
;
1555 nla_put(skb
, NFTA_CHAIN_USERDATA
, chain
->udlen
, chain
->udata
))
1556 goto nla_put_failure
;
1558 nlmsg_end(skb
, nlh
);
1562 nlmsg_trim(skb
, nlh
);
1566 static void nf_tables_chain_notify(const struct nft_ctx
*ctx
, int event
)
1568 struct nftables_pernet
*nft_net
;
1569 struct sk_buff
*skb
;
1574 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
1577 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
1581 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
1582 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
1584 err
= nf_tables_fill_chain_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
1585 event
, flags
, ctx
->family
, ctx
->table
,
1592 nft_net
= nft_pernet(ctx
->net
);
1593 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
1596 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
1599 static int nf_tables_dump_chains(struct sk_buff
*skb
,
1600 struct netlink_callback
*cb
)
1602 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1603 unsigned int idx
= 0, s_idx
= cb
->args
[0];
1604 struct net
*net
= sock_net(skb
->sk
);
1605 int family
= nfmsg
->nfgen_family
;
1606 struct nftables_pernet
*nft_net
;
1607 const struct nft_table
*table
;
1608 const struct nft_chain
*chain
;
1611 nft_net
= nft_pernet(net
);
1612 cb
->seq
= nft_net
->base_seq
;
1614 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
1615 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
1618 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
1622 memset(&cb
->args
[1], 0,
1623 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
1624 if (!nft_is_active(net
, chain
))
1626 if (nf_tables_fill_chain_info(skb
, net
,
1627 NETLINK_CB(cb
->skb
).portid
,
1631 table
->family
, table
,
1635 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
1646 /* called with rcu_read_lock held */
1647 static int nf_tables_getchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1648 const struct nlattr
* const nla
[])
1650 struct netlink_ext_ack
*extack
= info
->extack
;
1651 u8 genmask
= nft_genmask_cur(info
->net
);
1652 u8 family
= info
->nfmsg
->nfgen_family
;
1653 const struct nft_chain
*chain
;
1654 struct net
*net
= info
->net
;
1655 struct nft_table
*table
;
1656 struct sk_buff
*skb2
;
1659 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1660 struct netlink_dump_control c
= {
1661 .dump
= nf_tables_dump_chains
,
1662 .module
= THIS_MODULE
,
1665 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
1668 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
, 0);
1669 if (IS_ERR(table
)) {
1670 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
1671 return PTR_ERR(table
);
1674 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_CHAIN_NAME
], genmask
);
1675 if (IS_ERR(chain
)) {
1676 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
1677 return PTR_ERR(chain
);
1680 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
1684 err
= nf_tables_fill_chain_info(skb2
, net
, NETLINK_CB(skb
).portid
,
1685 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWCHAIN
,
1686 0, family
, table
, chain
);
1688 goto err_fill_chain_info
;
1690 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
1692 err_fill_chain_info
:
1697 static const struct nla_policy nft_counter_policy
[NFTA_COUNTER_MAX
+ 1] = {
1698 [NFTA_COUNTER_PACKETS
] = { .type
= NLA_U64
},
1699 [NFTA_COUNTER_BYTES
] = { .type
= NLA_U64
},
1702 static struct nft_stats __percpu
*nft_stats_alloc(const struct nlattr
*attr
)
1704 struct nlattr
*tb
[NFTA_COUNTER_MAX
+1];
1705 struct nft_stats __percpu
*newstats
;
1706 struct nft_stats
*stats
;
1709 err
= nla_parse_nested_deprecated(tb
, NFTA_COUNTER_MAX
, attr
,
1710 nft_counter_policy
, NULL
);
1712 return ERR_PTR(err
);
1714 if (!tb
[NFTA_COUNTER_BYTES
] || !tb
[NFTA_COUNTER_PACKETS
])
1715 return ERR_PTR(-EINVAL
);
1717 newstats
= netdev_alloc_pcpu_stats(struct nft_stats
);
1718 if (newstats
== NULL
)
1719 return ERR_PTR(-ENOMEM
);
1721 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1722 * are not exposed to userspace.
1725 stats
= this_cpu_ptr(newstats
);
1726 stats
->bytes
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_BYTES
]));
1727 stats
->pkts
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_PACKETS
]));
1733 static void nft_chain_stats_replace(struct nft_trans
*trans
)
1735 struct nft_base_chain
*chain
= nft_base_chain(trans
->ctx
.chain
);
1737 if (!nft_trans_chain_stats(trans
))
1740 nft_trans_chain_stats(trans
) =
1741 rcu_replace_pointer(chain
->stats
, nft_trans_chain_stats(trans
),
1742 lockdep_commit_lock_is_held(trans
->ctx
.net
));
1744 if (!nft_trans_chain_stats(trans
))
1745 static_branch_inc(&nft_counters_enabled
);
1748 static void nf_tables_chain_free_chain_rules(struct nft_chain
*chain
)
1750 struct nft_rule
**g0
= rcu_dereference_raw(chain
->rules_gen_0
);
1751 struct nft_rule
**g1
= rcu_dereference_raw(chain
->rules_gen_1
);
1757 /* should be NULL either via abort or via successful commit */
1758 WARN_ON_ONCE(chain
->rules_next
);
1759 kvfree(chain
->rules_next
);
1762 void nf_tables_chain_destroy(struct nft_ctx
*ctx
)
1764 struct nft_chain
*chain
= ctx
->chain
;
1765 struct nft_hook
*hook
, *next
;
1767 if (WARN_ON(chain
->use
> 0))
1770 /* no concurrent access possible anymore */
1771 nf_tables_chain_free_chain_rules(chain
);
1773 if (nft_is_base_chain(chain
)) {
1774 struct nft_base_chain
*basechain
= nft_base_chain(chain
);
1776 if (nft_base_chain_netdev(ctx
->family
, basechain
->ops
.hooknum
)) {
1777 list_for_each_entry_safe(hook
, next
,
1778 &basechain
->hook_list
, list
) {
1779 list_del_rcu(&hook
->list
);
1780 kfree_rcu(hook
, rcu
);
1783 module_put(basechain
->type
->owner
);
1784 if (rcu_access_pointer(basechain
->stats
)) {
1785 static_branch_dec(&nft_counters_enabled
);
1786 free_percpu(rcu_dereference_raw(basechain
->stats
));
1789 kfree(chain
->udata
);
1793 kfree(chain
->udata
);
1798 static struct nft_hook
*nft_netdev_hook_alloc(struct net
*net
,
1799 const struct nlattr
*attr
)
1801 struct net_device
*dev
;
1802 char ifname
[IFNAMSIZ
];
1803 struct nft_hook
*hook
;
1806 hook
= kmalloc(sizeof(struct nft_hook
), GFP_KERNEL
);
1809 goto err_hook_alloc
;
1812 nla_strscpy(ifname
, attr
, IFNAMSIZ
);
1813 /* nf_tables_netdev_event() is called under rtnl_mutex, this is
1814 * indirectly serializing all the other holders of the commit_mutex with
1817 dev
= __dev_get_by_name(net
, ifname
);
1822 hook
->ops
.dev
= dev
;
1823 hook
->inactive
= false;
1830 return ERR_PTR(err
);
1833 static struct nft_hook
*nft_hook_list_find(struct list_head
*hook_list
,
1834 const struct nft_hook
*this)
1836 struct nft_hook
*hook
;
1838 list_for_each_entry(hook
, hook_list
, list
) {
1839 if (this->ops
.dev
== hook
->ops
.dev
)
1846 static int nf_tables_parse_netdev_hooks(struct net
*net
,
1847 const struct nlattr
*attr
,
1848 struct list_head
*hook_list
)
1850 struct nft_hook
*hook
, *next
;
1851 const struct nlattr
*tmp
;
1852 int rem
, n
= 0, err
;
1854 nla_for_each_nested(tmp
, attr
, rem
) {
1855 if (nla_type(tmp
) != NFTA_DEVICE_NAME
) {
1860 hook
= nft_netdev_hook_alloc(net
, tmp
);
1862 err
= PTR_ERR(hook
);
1865 if (nft_hook_list_find(hook_list
, hook
)) {
1870 list_add_tail(&hook
->list
, hook_list
);
1873 if (n
== NFT_NETDEVICE_MAX
) {
1882 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
1883 list_del(&hook
->list
);
1889 struct nft_chain_hook
{
1892 const struct nft_chain_type
*type
;
1893 struct list_head list
;
1896 static int nft_chain_parse_netdev(struct net
*net
,
1897 struct nlattr
*tb
[],
1898 struct list_head
*hook_list
)
1900 struct nft_hook
*hook
;
1903 if (tb
[NFTA_HOOK_DEV
]) {
1904 hook
= nft_netdev_hook_alloc(net
, tb
[NFTA_HOOK_DEV
]);
1906 return PTR_ERR(hook
);
1908 list_add_tail(&hook
->list
, hook_list
);
1909 } else if (tb
[NFTA_HOOK_DEVS
]) {
1910 err
= nf_tables_parse_netdev_hooks(net
, tb
[NFTA_HOOK_DEVS
],
1915 if (list_empty(hook_list
))
1924 static int nft_chain_parse_hook(struct net
*net
,
1925 const struct nlattr
* const nla
[],
1926 struct nft_chain_hook
*hook
, u8 family
,
1927 struct netlink_ext_ack
*extack
, bool autoload
)
1929 struct nftables_pernet
*nft_net
= nft_pernet(net
);
1930 struct nlattr
*ha
[NFTA_HOOK_MAX
+ 1];
1931 const struct nft_chain_type
*type
;
1934 lockdep_assert_held(&nft_net
->commit_mutex
);
1935 lockdep_nfnl_nft_mutex_not_held();
1937 err
= nla_parse_nested_deprecated(ha
, NFTA_HOOK_MAX
,
1938 nla
[NFTA_CHAIN_HOOK
],
1939 nft_hook_policy
, NULL
);
1943 if (ha
[NFTA_HOOK_HOOKNUM
] == NULL
||
1944 ha
[NFTA_HOOK_PRIORITY
] == NULL
)
1947 hook
->num
= ntohl(nla_get_be32(ha
[NFTA_HOOK_HOOKNUM
]));
1948 hook
->priority
= ntohl(nla_get_be32(ha
[NFTA_HOOK_PRIORITY
]));
1950 type
= __nft_chain_type_get(family
, NFT_CHAIN_T_DEFAULT
);
1954 if (nla
[NFTA_CHAIN_TYPE
]) {
1955 type
= nf_tables_chain_type_lookup(net
, nla
[NFTA_CHAIN_TYPE
],
1958 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TYPE
]);
1959 return PTR_ERR(type
);
1962 if (hook
->num
>= NFT_MAX_HOOKS
|| !(type
->hook_mask
& (1 << hook
->num
)))
1965 if (type
->type
== NFT_CHAIN_T_NAT
&&
1966 hook
->priority
<= NF_IP_PRI_CONNTRACK
)
1969 if (!try_module_get(type
->owner
)) {
1970 if (nla
[NFTA_CHAIN_TYPE
])
1971 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TYPE
]);
1977 INIT_LIST_HEAD(&hook
->list
);
1978 if (nft_base_chain_netdev(family
, hook
->num
)) {
1979 err
= nft_chain_parse_netdev(net
, ha
, &hook
->list
);
1981 module_put(type
->owner
);
1984 } else if (ha
[NFTA_HOOK_DEV
] || ha
[NFTA_HOOK_DEVS
]) {
1985 module_put(type
->owner
);
1992 static void nft_chain_release_hook(struct nft_chain_hook
*hook
)
1994 struct nft_hook
*h
, *next
;
1996 list_for_each_entry_safe(h
, next
, &hook
->list
, list
) {
2000 module_put(hook
->type
->owner
);
2003 struct nft_rules_old
{
2005 struct nft_rule
**start
;
2008 static struct nft_rule
**nf_tables_chain_alloc_rules(const struct nft_chain
*chain
,
2011 if (alloc
> INT_MAX
)
2014 alloc
+= 1; /* NULL, ends rules */
2015 if (sizeof(struct nft_rule
*) > INT_MAX
/ alloc
)
2018 alloc
*= sizeof(struct nft_rule
*);
2019 alloc
+= sizeof(struct nft_rules_old
);
2021 return kvmalloc(alloc
, GFP_KERNEL
);
2024 static void nft_basechain_hook_init(struct nf_hook_ops
*ops
, u8 family
,
2025 const struct nft_chain_hook
*hook
,
2026 struct nft_chain
*chain
)
2029 ops
->hooknum
= hook
->num
;
2030 ops
->priority
= hook
->priority
;
2032 ops
->hook
= hook
->type
->hooks
[ops
->hooknum
];
2033 ops
->hook_ops_type
= NF_HOOK_OP_NF_TABLES
;
2036 static int nft_basechain_init(struct nft_base_chain
*basechain
, u8 family
,
2037 struct nft_chain_hook
*hook
, u32 flags
)
2039 struct nft_chain
*chain
;
2042 basechain
->type
= hook
->type
;
2043 INIT_LIST_HEAD(&basechain
->hook_list
);
2044 chain
= &basechain
->chain
;
2046 if (nft_base_chain_netdev(family
, hook
->num
)) {
2047 list_splice_init(&hook
->list
, &basechain
->hook_list
);
2048 list_for_each_entry(h
, &basechain
->hook_list
, list
)
2049 nft_basechain_hook_init(&h
->ops
, family
, hook
, chain
);
2051 basechain
->ops
.hooknum
= hook
->num
;
2052 basechain
->ops
.priority
= hook
->priority
;
2054 nft_basechain_hook_init(&basechain
->ops
, family
, hook
, chain
);
2057 chain
->flags
|= NFT_CHAIN_BASE
| flags
;
2058 basechain
->policy
= NF_ACCEPT
;
2059 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
&&
2060 nft_chain_offload_priority(basechain
) < 0)
2063 flow_block_init(&basechain
->flow_block
);
2068 static int nft_chain_add(struct nft_table
*table
, struct nft_chain
*chain
)
2072 err
= rhltable_insert_key(&table
->chains_ht
, chain
->name
,
2073 &chain
->rhlhead
, nft_chain_ht_params
);
2077 list_add_tail_rcu(&chain
->list
, &table
->chains
);
2082 static u64 chain_id
;
2084 static int nf_tables_addchain(struct nft_ctx
*ctx
, u8 family
, u8 genmask
,
2085 u8 policy
, u32 flags
,
2086 struct netlink_ext_ack
*extack
)
2088 const struct nlattr
* const *nla
= ctx
->nla
;
2089 struct nft_table
*table
= ctx
->table
;
2090 struct nft_base_chain
*basechain
;
2091 struct nft_stats __percpu
*stats
;
2092 struct net
*net
= ctx
->net
;
2093 char name
[NFT_NAME_MAXLEN
];
2094 struct nft_trans
*trans
;
2095 struct nft_chain
*chain
;
2096 struct nft_rule
**rules
;
2099 if (table
->use
== UINT_MAX
)
2102 if (nla
[NFTA_CHAIN_HOOK
]) {
2103 struct nft_chain_hook hook
;
2105 if (flags
& NFT_CHAIN_BINDING
)
2108 err
= nft_chain_parse_hook(net
, nla
, &hook
, family
, extack
,
2113 basechain
= kzalloc(sizeof(*basechain
), GFP_KERNEL
);
2114 if (basechain
== NULL
) {
2115 nft_chain_release_hook(&hook
);
2118 chain
= &basechain
->chain
;
2120 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2121 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2122 if (IS_ERR(stats
)) {
2123 nft_chain_release_hook(&hook
);
2125 return PTR_ERR(stats
);
2127 rcu_assign_pointer(basechain
->stats
, stats
);
2128 static_branch_inc(&nft_counters_enabled
);
2131 err
= nft_basechain_init(basechain
, family
, &hook
, flags
);
2133 nft_chain_release_hook(&hook
);
2138 if (flags
& NFT_CHAIN_BASE
)
2140 if (flags
& NFT_CHAIN_HW_OFFLOAD
)
2143 chain
= kzalloc(sizeof(*chain
), GFP_KERNEL
);
2147 chain
->flags
= flags
;
2151 INIT_LIST_HEAD(&chain
->rules
);
2152 chain
->handle
= nf_tables_alloc_handle(table
);
2153 chain
->table
= table
;
2155 if (nla
[NFTA_CHAIN_NAME
]) {
2156 chain
->name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL
);
2158 if (!(flags
& NFT_CHAIN_BINDING
)) {
2160 goto err_destroy_chain
;
2163 snprintf(name
, sizeof(name
), "__chain%llu", ++chain_id
);
2164 chain
->name
= kstrdup(name
, GFP_KERNEL
);
2169 goto err_destroy_chain
;
2172 if (nla
[NFTA_CHAIN_USERDATA
]) {
2173 chain
->udata
= nla_memdup(nla
[NFTA_CHAIN_USERDATA
], GFP_KERNEL
);
2174 if (chain
->udata
== NULL
) {
2176 goto err_destroy_chain
;
2178 chain
->udlen
= nla_len(nla
[NFTA_CHAIN_USERDATA
]);
2181 rules
= nf_tables_chain_alloc_rules(chain
, 0);
2184 goto err_destroy_chain
;
2188 rcu_assign_pointer(chain
->rules_gen_0
, rules
);
2189 rcu_assign_pointer(chain
->rules_gen_1
, rules
);
2191 err
= nf_tables_register_hook(net
, table
, chain
);
2193 goto err_destroy_chain
;
2195 trans
= nft_trans_chain_add(ctx
, NFT_MSG_NEWCHAIN
);
2196 if (IS_ERR(trans
)) {
2197 err
= PTR_ERR(trans
);
2198 goto err_unregister_hook
;
2201 nft_trans_chain_policy(trans
) = NFT_CHAIN_POLICY_UNSET
;
2202 if (nft_is_base_chain(chain
))
2203 nft_trans_chain_policy(trans
) = policy
;
2205 err
= nft_chain_add(table
, chain
);
2207 nft_trans_destroy(trans
);
2208 goto err_unregister_hook
;
2214 err_unregister_hook
:
2215 nf_tables_unregister_hook(net
, table
, chain
);
2217 nf_tables_chain_destroy(ctx
);
2222 static bool nft_hook_list_equal(struct list_head
*hook_list1
,
2223 struct list_head
*hook_list2
)
2225 struct nft_hook
*hook
;
2229 list_for_each_entry(hook
, hook_list2
, list
) {
2230 if (!nft_hook_list_find(hook_list1
, hook
))
2235 list_for_each_entry(hook
, hook_list1
, list
)
2241 static int nf_tables_updchain(struct nft_ctx
*ctx
, u8 genmask
, u8 policy
,
2242 u32 flags
, const struct nlattr
*attr
,
2243 struct netlink_ext_ack
*extack
)
2245 const struct nlattr
* const *nla
= ctx
->nla
;
2246 struct nft_table
*table
= ctx
->table
;
2247 struct nft_chain
*chain
= ctx
->chain
;
2248 struct nft_base_chain
*basechain
;
2249 struct nft_stats
*stats
= NULL
;
2250 struct nft_chain_hook hook
;
2251 struct nf_hook_ops
*ops
;
2252 struct nft_trans
*trans
;
2255 if (chain
->flags
^ flags
)
2258 if (nla
[NFTA_CHAIN_HOOK
]) {
2259 if (!nft_is_base_chain(chain
)) {
2260 NL_SET_BAD_ATTR(extack
, attr
);
2263 err
= nft_chain_parse_hook(ctx
->net
, nla
, &hook
, ctx
->family
,
2268 basechain
= nft_base_chain(chain
);
2269 if (basechain
->type
!= hook
.type
) {
2270 nft_chain_release_hook(&hook
);
2271 NL_SET_BAD_ATTR(extack
, attr
);
2275 if (nft_base_chain_netdev(ctx
->family
, hook
.num
)) {
2276 if (!nft_hook_list_equal(&basechain
->hook_list
,
2278 nft_chain_release_hook(&hook
);
2279 NL_SET_BAD_ATTR(extack
, attr
);
2283 ops
= &basechain
->ops
;
2284 if (ops
->hooknum
!= hook
.num
||
2285 ops
->priority
!= hook
.priority
) {
2286 nft_chain_release_hook(&hook
);
2287 NL_SET_BAD_ATTR(extack
, attr
);
2291 nft_chain_release_hook(&hook
);
2294 if (nla
[NFTA_CHAIN_HANDLE
] &&
2295 nla
[NFTA_CHAIN_NAME
]) {
2296 struct nft_chain
*chain2
;
2298 chain2
= nft_chain_lookup(ctx
->net
, table
,
2299 nla
[NFTA_CHAIN_NAME
], genmask
);
2300 if (!IS_ERR(chain2
)) {
2301 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2306 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2307 if (!nft_is_base_chain(chain
))
2310 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2312 return PTR_ERR(stats
);
2316 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWCHAIN
,
2317 sizeof(struct nft_trans_chain
));
2321 nft_trans_chain_stats(trans
) = stats
;
2322 nft_trans_chain_update(trans
) = true;
2324 if (nla
[NFTA_CHAIN_POLICY
])
2325 nft_trans_chain_policy(trans
) = policy
;
2327 nft_trans_chain_policy(trans
) = -1;
2329 if (nla
[NFTA_CHAIN_HANDLE
] &&
2330 nla
[NFTA_CHAIN_NAME
]) {
2331 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
2332 struct nft_trans
*tmp
;
2336 name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL
);
2341 list_for_each_entry(tmp
, &nft_net
->commit_list
, list
) {
2342 if (tmp
->msg_type
== NFT_MSG_NEWCHAIN
&&
2343 tmp
->ctx
.table
== table
&&
2344 nft_trans_chain_update(tmp
) &&
2345 nft_trans_chain_name(tmp
) &&
2346 strcmp(name
, nft_trans_chain_name(tmp
)) == 0) {
2347 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2353 nft_trans_chain_name(trans
) = name
;
2355 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
2364 static struct nft_chain
*nft_chain_lookup_byid(const struct net
*net
,
2365 const struct nlattr
*nla
)
2367 struct nftables_pernet
*nft_net
= nft_pernet(net
);
2368 u32 id
= ntohl(nla_get_be32(nla
));
2369 struct nft_trans
*trans
;
2371 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
2372 struct nft_chain
*chain
= trans
->ctx
.chain
;
2374 if (trans
->msg_type
== NFT_MSG_NEWCHAIN
&&
2375 id
== nft_trans_chain_id(trans
))
2378 return ERR_PTR(-ENOENT
);
2381 static int nf_tables_newchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
2382 const struct nlattr
* const nla
[])
2384 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
2385 struct netlink_ext_ack
*extack
= info
->extack
;
2386 u8 genmask
= nft_genmask_next(info
->net
);
2387 u8 family
= info
->nfmsg
->nfgen_family
;
2388 struct nft_chain
*chain
= NULL
;
2389 struct net
*net
= info
->net
;
2390 const struct nlattr
*attr
;
2391 struct nft_table
*table
;
2392 u8 policy
= NF_ACCEPT
;
2397 lockdep_assert_held(&nft_net
->commit_mutex
);
2399 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2400 NETLINK_CB(skb
).portid
);
2401 if (IS_ERR(table
)) {
2402 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2403 return PTR_ERR(table
);
2407 attr
= nla
[NFTA_CHAIN_NAME
];
2409 if (nla
[NFTA_CHAIN_HANDLE
]) {
2410 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_CHAIN_HANDLE
]));
2411 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2412 if (IS_ERR(chain
)) {
2413 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_HANDLE
]);
2414 return PTR_ERR(chain
);
2416 attr
= nla
[NFTA_CHAIN_HANDLE
];
2417 } else if (nla
[NFTA_CHAIN_NAME
]) {
2418 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2419 if (IS_ERR(chain
)) {
2420 if (PTR_ERR(chain
) != -ENOENT
) {
2421 NL_SET_BAD_ATTR(extack
, attr
);
2422 return PTR_ERR(chain
);
2426 } else if (!nla
[NFTA_CHAIN_ID
]) {
2430 if (nla
[NFTA_CHAIN_POLICY
]) {
2431 if (chain
!= NULL
&&
2432 !nft_is_base_chain(chain
)) {
2433 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2437 if (chain
== NULL
&&
2438 nla
[NFTA_CHAIN_HOOK
] == NULL
) {
2439 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2443 policy
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_POLICY
]));
2453 if (nla
[NFTA_CHAIN_FLAGS
])
2454 flags
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_FLAGS
]));
2456 flags
= chain
->flags
;
2458 if (flags
& ~NFT_CHAIN_FLAGS
)
2461 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
2463 if (chain
!= NULL
) {
2464 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
2465 NL_SET_BAD_ATTR(extack
, attr
);
2468 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
2471 flags
|= chain
->flags
& NFT_CHAIN_BASE
;
2472 return nf_tables_updchain(&ctx
, genmask
, policy
, flags
, attr
,
2476 return nf_tables_addchain(&ctx
, family
, genmask
, policy
, flags
, extack
);
2479 static int nf_tables_delchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
2480 const struct nlattr
* const nla
[])
2482 struct netlink_ext_ack
*extack
= info
->extack
;
2483 u8 genmask
= nft_genmask_next(info
->net
);
2484 u8 family
= info
->nfmsg
->nfgen_family
;
2485 struct net
*net
= info
->net
;
2486 const struct nlattr
*attr
;
2487 struct nft_table
*table
;
2488 struct nft_chain
*chain
;
2489 struct nft_rule
*rule
;
2495 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2496 NETLINK_CB(skb
).portid
);
2497 if (IS_ERR(table
)) {
2498 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2499 return PTR_ERR(table
);
2502 if (nla
[NFTA_CHAIN_HANDLE
]) {
2503 attr
= nla
[NFTA_CHAIN_HANDLE
];
2504 handle
= be64_to_cpu(nla_get_be64(attr
));
2505 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2507 attr
= nla
[NFTA_CHAIN_NAME
];
2508 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2510 if (IS_ERR(chain
)) {
2511 NL_SET_BAD_ATTR(extack
, attr
);
2512 return PTR_ERR(chain
);
2515 if (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
2519 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
2522 list_for_each_entry(rule
, &chain
->rules
, list
) {
2523 if (!nft_is_active_next(net
, rule
))
2527 err
= nft_delrule(&ctx
, rule
);
2532 /* There are rules and elements that are still holding references to us,
2533 * we cannot do a recursive removal in this case.
2536 NL_SET_BAD_ATTR(extack
, attr
);
2540 return nft_delchain(&ctx
);
2548 * nft_register_expr - register nf_tables expr type
2551 * Registers the expr type for use with nf_tables. Returns zero on
2552 * success or a negative errno code otherwise.
2554 int nft_register_expr(struct nft_expr_type
*type
)
2556 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2557 if (type
->family
== NFPROTO_UNSPEC
)
2558 list_add_tail_rcu(&type
->list
, &nf_tables_expressions
);
2560 list_add_rcu(&type
->list
, &nf_tables_expressions
);
2561 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2564 EXPORT_SYMBOL_GPL(nft_register_expr
);
2567 * nft_unregister_expr - unregister nf_tables expr type
2570 * Unregisters the expr typefor use with nf_tables.
2572 void nft_unregister_expr(struct nft_expr_type
*type
)
2574 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2575 list_del_rcu(&type
->list
);
2576 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2578 EXPORT_SYMBOL_GPL(nft_unregister_expr
);
2580 static const struct nft_expr_type
*__nft_expr_type_get(u8 family
,
2583 const struct nft_expr_type
*type
, *candidate
= NULL
;
2585 list_for_each_entry(type
, &nf_tables_expressions
, list
) {
2586 if (!nla_strcmp(nla
, type
->name
)) {
2587 if (!type
->family
&& !candidate
)
2589 else if (type
->family
== family
)
2596 #ifdef CONFIG_MODULES
2597 static int nft_expr_type_request_module(struct net
*net
, u8 family
,
2600 if (nft_request_module(net
, "nft-expr-%u-%.*s", family
,
2601 nla_len(nla
), (char *)nla_data(nla
)) == -EAGAIN
)
2608 static const struct nft_expr_type
*nft_expr_type_get(struct net
*net
,
2612 const struct nft_expr_type
*type
;
2615 return ERR_PTR(-EINVAL
);
2617 type
= __nft_expr_type_get(family
, nla
);
2618 if (type
!= NULL
&& try_module_get(type
->owner
))
2621 lockdep_nfnl_nft_mutex_not_held();
2622 #ifdef CONFIG_MODULES
2624 if (nft_expr_type_request_module(net
, family
, nla
) == -EAGAIN
)
2625 return ERR_PTR(-EAGAIN
);
2627 if (nft_request_module(net
, "nft-expr-%.*s",
2629 (char *)nla_data(nla
)) == -EAGAIN
)
2630 return ERR_PTR(-EAGAIN
);
2633 return ERR_PTR(-ENOENT
);
2636 static const struct nla_policy nft_expr_policy
[NFTA_EXPR_MAX
+ 1] = {
2637 [NFTA_EXPR_NAME
] = { .type
= NLA_STRING
,
2638 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
2639 [NFTA_EXPR_DATA
] = { .type
= NLA_NESTED
},
2642 static int nf_tables_fill_expr_info(struct sk_buff
*skb
,
2643 const struct nft_expr
*expr
)
2645 if (nla_put_string(skb
, NFTA_EXPR_NAME
, expr
->ops
->type
->name
))
2646 goto nla_put_failure
;
2648 if (expr
->ops
->dump
) {
2649 struct nlattr
*data
= nla_nest_start_noflag(skb
,
2652 goto nla_put_failure
;
2653 if (expr
->ops
->dump(skb
, expr
) < 0)
2654 goto nla_put_failure
;
2655 nla_nest_end(skb
, data
);
2664 int nft_expr_dump(struct sk_buff
*skb
, unsigned int attr
,
2665 const struct nft_expr
*expr
)
2667 struct nlattr
*nest
;
2669 nest
= nla_nest_start_noflag(skb
, attr
);
2671 goto nla_put_failure
;
2672 if (nf_tables_fill_expr_info(skb
, expr
) < 0)
2673 goto nla_put_failure
;
2674 nla_nest_end(skb
, nest
);
2681 struct nft_expr_info
{
2682 const struct nft_expr_ops
*ops
;
2683 const struct nlattr
*attr
;
2684 struct nlattr
*tb
[NFT_EXPR_MAXATTR
+ 1];
2687 static int nf_tables_expr_parse(const struct nft_ctx
*ctx
,
2688 const struct nlattr
*nla
,
2689 struct nft_expr_info
*info
)
2691 const struct nft_expr_type
*type
;
2692 const struct nft_expr_ops
*ops
;
2693 struct nlattr
*tb
[NFTA_EXPR_MAX
+ 1];
2696 err
= nla_parse_nested_deprecated(tb
, NFTA_EXPR_MAX
, nla
,
2697 nft_expr_policy
, NULL
);
2701 type
= nft_expr_type_get(ctx
->net
, ctx
->family
, tb
[NFTA_EXPR_NAME
]);
2703 return PTR_ERR(type
);
2705 if (tb
[NFTA_EXPR_DATA
]) {
2706 err
= nla_parse_nested_deprecated(info
->tb
, type
->maxattr
,
2708 type
->policy
, NULL
);
2712 memset(info
->tb
, 0, sizeof(info
->tb
[0]) * (type
->maxattr
+ 1));
2714 if (type
->select_ops
!= NULL
) {
2715 ops
= type
->select_ops(ctx
,
2716 (const struct nlattr
* const *)info
->tb
);
2719 #ifdef CONFIG_MODULES
2721 if (nft_expr_type_request_module(ctx
->net
,
2723 tb
[NFTA_EXPR_NAME
]) != -EAGAIN
)
2737 module_put(type
->owner
);
2741 static int nf_tables_newexpr(const struct nft_ctx
*ctx
,
2742 const struct nft_expr_info
*expr_info
,
2743 struct nft_expr
*expr
)
2745 const struct nft_expr_ops
*ops
= expr_info
->ops
;
2750 err
= ops
->init(ctx
, expr
, (const struct nlattr
**)expr_info
->tb
);
2761 static void nf_tables_expr_destroy(const struct nft_ctx
*ctx
,
2762 struct nft_expr
*expr
)
2764 const struct nft_expr_type
*type
= expr
->ops
->type
;
2766 if (expr
->ops
->destroy
)
2767 expr
->ops
->destroy(ctx
, expr
);
2768 module_put(type
->owner
);
2771 static struct nft_expr
*nft_expr_init(const struct nft_ctx
*ctx
,
2772 const struct nlattr
*nla
)
2774 struct nft_expr_info expr_info
;
2775 struct nft_expr
*expr
;
2776 struct module
*owner
;
2779 err
= nf_tables_expr_parse(ctx
, nla
, &expr_info
);
2781 goto err_expr_parse
;
2784 if (!(expr_info
.ops
->type
->flags
& NFT_EXPR_STATEFUL
))
2785 goto err_expr_stateful
;
2788 expr
= kzalloc(expr_info
.ops
->size
, GFP_KERNEL
);
2790 goto err_expr_stateful
;
2792 err
= nf_tables_newexpr(ctx
, &expr_info
, expr
);
2800 owner
= expr_info
.ops
->type
->owner
;
2801 if (expr_info
.ops
->type
->release_ops
)
2802 expr_info
.ops
->type
->release_ops(expr_info
.ops
);
2806 return ERR_PTR(err
);
2809 int nft_expr_clone(struct nft_expr
*dst
, struct nft_expr
*src
)
2813 if (src
->ops
->clone
) {
2814 dst
->ops
= src
->ops
;
2815 err
= src
->ops
->clone(dst
, src
);
2819 memcpy(dst
, src
, src
->ops
->size
);
2822 __module_get(src
->ops
->type
->owner
);
2827 void nft_expr_destroy(const struct nft_ctx
*ctx
, struct nft_expr
*expr
)
2829 nf_tables_expr_destroy(ctx
, expr
);
2837 static struct nft_rule
*__nft_rule_lookup(const struct nft_chain
*chain
,
2840 struct nft_rule
*rule
;
2842 // FIXME: this sucks
2843 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
2844 if (handle
== rule
->handle
)
2848 return ERR_PTR(-ENOENT
);
2851 static struct nft_rule
*nft_rule_lookup(const struct nft_chain
*chain
,
2852 const struct nlattr
*nla
)
2855 return ERR_PTR(-EINVAL
);
2857 return __nft_rule_lookup(chain
, be64_to_cpu(nla_get_be64(nla
)));
2860 static const struct nla_policy nft_rule_policy
[NFTA_RULE_MAX
+ 1] = {
2861 [NFTA_RULE_TABLE
] = { .type
= NLA_STRING
,
2862 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
2863 [NFTA_RULE_CHAIN
] = { .type
= NLA_STRING
,
2864 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
2865 [NFTA_RULE_HANDLE
] = { .type
= NLA_U64
},
2866 [NFTA_RULE_EXPRESSIONS
] = { .type
= NLA_NESTED
},
2867 [NFTA_RULE_COMPAT
] = { .type
= NLA_NESTED
},
2868 [NFTA_RULE_POSITION
] = { .type
= NLA_U64
},
2869 [NFTA_RULE_USERDATA
] = { .type
= NLA_BINARY
,
2870 .len
= NFT_USERDATA_MAXLEN
},
2871 [NFTA_RULE_ID
] = { .type
= NLA_U32
},
2872 [NFTA_RULE_POSITION_ID
] = { .type
= NLA_U32
},
2873 [NFTA_RULE_CHAIN_ID
] = { .type
= NLA_U32
},
2876 static int nf_tables_fill_rule_info(struct sk_buff
*skb
, struct net
*net
,
2877 u32 portid
, u32 seq
, int event
,
2878 u32 flags
, int family
,
2879 const struct nft_table
*table
,
2880 const struct nft_chain
*chain
,
2881 const struct nft_rule
*rule
, u64 handle
)
2883 struct nlmsghdr
*nlh
;
2884 const struct nft_expr
*expr
, *next
;
2885 struct nlattr
*list
;
2886 u16 type
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
2888 nlh
= nfnl_msg_put(skb
, portid
, seq
, type
, flags
, family
, NFNETLINK_V0
,
2891 goto nla_put_failure
;
2893 if (nla_put_string(skb
, NFTA_RULE_TABLE
, table
->name
))
2894 goto nla_put_failure
;
2895 if (nla_put_string(skb
, NFTA_RULE_CHAIN
, chain
->name
))
2896 goto nla_put_failure
;
2897 if (nla_put_be64(skb
, NFTA_RULE_HANDLE
, cpu_to_be64(rule
->handle
),
2899 goto nla_put_failure
;
2901 if (event
!= NFT_MSG_DELRULE
&& handle
) {
2902 if (nla_put_be64(skb
, NFTA_RULE_POSITION
, cpu_to_be64(handle
),
2904 goto nla_put_failure
;
2907 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
2908 nft_flow_rule_stats(chain
, rule
);
2910 list
= nla_nest_start_noflag(skb
, NFTA_RULE_EXPRESSIONS
);
2912 goto nla_put_failure
;
2913 nft_rule_for_each_expr(expr
, next
, rule
) {
2914 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
) < 0)
2915 goto nla_put_failure
;
2917 nla_nest_end(skb
, list
);
2920 struct nft_userdata
*udata
= nft_userdata(rule
);
2921 if (nla_put(skb
, NFTA_RULE_USERDATA
, udata
->len
+ 1,
2923 goto nla_put_failure
;
2926 nlmsg_end(skb
, nlh
);
2930 nlmsg_trim(skb
, nlh
);
2934 static void nf_tables_rule_notify(const struct nft_ctx
*ctx
,
2935 const struct nft_rule
*rule
, int event
)
2937 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
2938 const struct nft_rule
*prule
;
2939 struct sk_buff
*skb
;
2945 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
2948 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
2952 if (event
== NFT_MSG_NEWRULE
&&
2953 !list_is_first(&rule
->list
, &ctx
->chain
->rules
) &&
2954 !list_is_last(&rule
->list
, &ctx
->chain
->rules
)) {
2955 prule
= list_prev_entry(rule
, list
);
2956 handle
= prule
->handle
;
2958 if (ctx
->flags
& (NLM_F_APPEND
| NLM_F_REPLACE
))
2959 flags
|= NLM_F_APPEND
;
2960 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
2961 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
2963 err
= nf_tables_fill_rule_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
2964 event
, flags
, ctx
->family
, ctx
->table
,
2965 ctx
->chain
, rule
, handle
);
2971 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
2974 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
2977 struct nft_rule_dump_ctx
{
2982 static int __nf_tables_dump_rules(struct sk_buff
*skb
,
2984 struct netlink_callback
*cb
,
2985 const struct nft_table
*table
,
2986 const struct nft_chain
*chain
)
2988 struct net
*net
= sock_net(skb
->sk
);
2989 const struct nft_rule
*rule
, *prule
;
2990 unsigned int s_idx
= cb
->args
[0];
2994 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
2995 if (!nft_is_active(net
, rule
))
3000 memset(&cb
->args
[1], 0,
3001 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
3004 handle
= prule
->handle
;
3008 if (nf_tables_fill_rule_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
3011 NLM_F_MULTI
| NLM_F_APPEND
,
3013 table
, chain
, rule
, handle
) < 0)
3016 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
3025 static int nf_tables_dump_rules(struct sk_buff
*skb
,
3026 struct netlink_callback
*cb
)
3028 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
3029 const struct nft_rule_dump_ctx
*ctx
= cb
->data
;
3030 struct nft_table
*table
;
3031 const struct nft_chain
*chain
;
3032 unsigned int idx
= 0;
3033 struct net
*net
= sock_net(skb
->sk
);
3034 int family
= nfmsg
->nfgen_family
;
3035 struct nftables_pernet
*nft_net
;
3038 nft_net
= nft_pernet(net
);
3039 cb
->seq
= nft_net
->base_seq
;
3041 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
3042 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
3045 if (ctx
&& ctx
->table
&& strcmp(ctx
->table
, table
->name
) != 0)
3048 if (ctx
&& ctx
->table
&& ctx
->chain
) {
3049 struct rhlist_head
*list
, *tmp
;
3051 list
= rhltable_lookup(&table
->chains_ht
, ctx
->chain
,
3052 nft_chain_ht_params
);
3056 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
3057 if (!nft_is_active(net
, chain
))
3059 __nf_tables_dump_rules(skb
, &idx
,
3066 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
3067 if (__nf_tables_dump_rules(skb
, &idx
, cb
, table
, chain
))
3071 if (ctx
&& ctx
->table
)
3081 static int nf_tables_dump_rules_start(struct netlink_callback
*cb
)
3083 const struct nlattr
* const *nla
= cb
->data
;
3084 struct nft_rule_dump_ctx
*ctx
= NULL
;
3086 if (nla
[NFTA_RULE_TABLE
] || nla
[NFTA_RULE_CHAIN
]) {
3087 ctx
= kzalloc(sizeof(*ctx
), GFP_ATOMIC
);
3091 if (nla
[NFTA_RULE_TABLE
]) {
3092 ctx
->table
= nla_strdup(nla
[NFTA_RULE_TABLE
],
3099 if (nla
[NFTA_RULE_CHAIN
]) {
3100 ctx
->chain
= nla_strdup(nla
[NFTA_RULE_CHAIN
],
3114 static int nf_tables_dump_rules_done(struct netlink_callback
*cb
)
3116 struct nft_rule_dump_ctx
*ctx
= cb
->data
;
3126 /* called with rcu_read_lock held */
3127 static int nf_tables_getrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3128 const struct nlattr
* const nla
[])
3130 struct netlink_ext_ack
*extack
= info
->extack
;
3131 u8 genmask
= nft_genmask_cur(info
->net
);
3132 u8 family
= info
->nfmsg
->nfgen_family
;
3133 const struct nft_chain
*chain
;
3134 const struct nft_rule
*rule
;
3135 struct net
*net
= info
->net
;
3136 struct nft_table
*table
;
3137 struct sk_buff
*skb2
;
3140 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3141 struct netlink_dump_control c
= {
3142 .start
= nf_tables_dump_rules_start
,
3143 .dump
= nf_tables_dump_rules
,
3144 .done
= nf_tables_dump_rules_done
,
3145 .module
= THIS_MODULE
,
3146 .data
= (void *)nla
,
3149 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
3152 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
, 0);
3153 if (IS_ERR(table
)) {
3154 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3155 return PTR_ERR(table
);
3158 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
], genmask
);
3159 if (IS_ERR(chain
)) {
3160 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3161 return PTR_ERR(chain
);
3164 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
3166 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3167 return PTR_ERR(rule
);
3170 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
3174 err
= nf_tables_fill_rule_info(skb2
, net
, NETLINK_CB(skb
).portid
,
3175 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWRULE
, 0,
3176 family
, table
, chain
, rule
, 0);
3178 goto err_fill_rule_info
;
3180 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
3187 static void nf_tables_rule_destroy(const struct nft_ctx
*ctx
,
3188 struct nft_rule
*rule
)
3190 struct nft_expr
*expr
, *next
;
3193 * Careful: some expressions might not be initialized in case this
3194 * is called on error from nf_tables_newrule().
3196 expr
= nft_expr_first(rule
);
3197 while (nft_expr_more(rule
, expr
)) {
3198 next
= nft_expr_next(expr
);
3199 nf_tables_expr_destroy(ctx
, expr
);
3205 void nf_tables_rule_release(const struct nft_ctx
*ctx
, struct nft_rule
*rule
)
3207 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_RELEASE
);
3208 nf_tables_rule_destroy(ctx
, rule
);
3211 int nft_chain_validate(const struct nft_ctx
*ctx
, const struct nft_chain
*chain
)
3213 struct nft_expr
*expr
, *last
;
3214 const struct nft_data
*data
;
3215 struct nft_rule
*rule
;
3218 if (ctx
->level
== NFT_JUMP_STACK_SIZE
)
3221 list_for_each_entry(rule
, &chain
->rules
, list
) {
3222 if (!nft_is_active_next(ctx
->net
, rule
))
3225 nft_rule_for_each_expr(expr
, last
, rule
) {
3226 if (!expr
->ops
->validate
)
3229 err
= expr
->ops
->validate(ctx
, expr
, &data
);
3237 EXPORT_SYMBOL_GPL(nft_chain_validate
);
3239 static int nft_table_validate(struct net
*net
, const struct nft_table
*table
)
3241 struct nft_chain
*chain
;
3242 struct nft_ctx ctx
= {
3244 .family
= table
->family
,
3248 list_for_each_entry(chain
, &table
->chains
, list
) {
3249 if (!nft_is_base_chain(chain
))
3253 err
= nft_chain_validate(&ctx
, chain
);
3261 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
3262 const struct nlattr
*nla
);
3264 #define NFT_RULE_MAXEXPRS 128
3266 static int nf_tables_newrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3267 const struct nlattr
* const nla
[])
3269 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
3270 struct netlink_ext_ack
*extack
= info
->extack
;
3271 unsigned int size
, i
, n
, ulen
= 0, usize
= 0;
3272 u8 genmask
= nft_genmask_next(info
->net
);
3273 struct nft_rule
*rule
, *old_rule
= NULL
;
3274 struct nft_expr_info
*expr_info
= NULL
;
3275 u8 family
= info
->nfmsg
->nfgen_family
;
3276 struct nft_flow_rule
*flow
= NULL
;
3277 struct net
*net
= info
->net
;
3278 struct nft_userdata
*udata
;
3279 struct nft_table
*table
;
3280 struct nft_chain
*chain
;
3281 struct nft_trans
*trans
;
3282 u64 handle
, pos_handle
;
3283 struct nft_expr
*expr
;
3288 lockdep_assert_held(&nft_net
->commit_mutex
);
3290 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
3291 NETLINK_CB(skb
).portid
);
3292 if (IS_ERR(table
)) {
3293 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3294 return PTR_ERR(table
);
3297 if (nla
[NFTA_RULE_CHAIN
]) {
3298 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
3300 if (IS_ERR(chain
)) {
3301 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3302 return PTR_ERR(chain
);
3304 if (nft_chain_is_bound(chain
))
3307 } else if (nla
[NFTA_RULE_CHAIN_ID
]) {
3308 chain
= nft_chain_lookup_byid(net
, nla
[NFTA_RULE_CHAIN_ID
]);
3309 if (IS_ERR(chain
)) {
3310 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN_ID
]);
3311 return PTR_ERR(chain
);
3317 if (nla
[NFTA_RULE_HANDLE
]) {
3318 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_HANDLE
]));
3319 rule
= __nft_rule_lookup(chain
, handle
);
3321 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3322 return PTR_ERR(rule
);
3325 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
3326 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3329 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3334 if (!(info
->nlh
->nlmsg_flags
& NLM_F_CREATE
) ||
3335 info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3337 handle
= nf_tables_alloc_handle(table
);
3339 if (chain
->use
== UINT_MAX
)
3342 if (nla
[NFTA_RULE_POSITION
]) {
3343 pos_handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_POSITION
]));
3344 old_rule
= __nft_rule_lookup(chain
, pos_handle
);
3345 if (IS_ERR(old_rule
)) {
3346 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION
]);
3347 return PTR_ERR(old_rule
);
3349 } else if (nla
[NFTA_RULE_POSITION_ID
]) {
3350 old_rule
= nft_rule_lookup_byid(net
, nla
[NFTA_RULE_POSITION_ID
]);
3351 if (IS_ERR(old_rule
)) {
3352 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION_ID
]);
3353 return PTR_ERR(old_rule
);
3358 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
3362 if (nla
[NFTA_RULE_EXPRESSIONS
]) {
3363 expr_info
= kvmalloc_array(NFT_RULE_MAXEXPRS
,
3364 sizeof(struct nft_expr_info
),
3369 nla_for_each_nested(tmp
, nla
[NFTA_RULE_EXPRESSIONS
], rem
) {
3371 if (nla_type(tmp
) != NFTA_LIST_ELEM
)
3372 goto err_release_expr
;
3373 if (n
== NFT_RULE_MAXEXPRS
)
3374 goto err_release_expr
;
3375 err
= nf_tables_expr_parse(&ctx
, tmp
, &expr_info
[n
]);
3377 NL_SET_BAD_ATTR(extack
, tmp
);
3378 goto err_release_expr
;
3380 size
+= expr_info
[n
].ops
->size
;
3384 /* Check for overflow of dlen field */
3386 if (size
>= 1 << 12)
3387 goto err_release_expr
;
3389 if (nla
[NFTA_RULE_USERDATA
]) {
3390 ulen
= nla_len(nla
[NFTA_RULE_USERDATA
]);
3392 usize
= sizeof(struct nft_userdata
) + ulen
;
3396 rule
= kzalloc(sizeof(*rule
) + size
+ usize
, GFP_KERNEL
);
3398 goto err_release_expr
;
3400 nft_activate_next(net
, rule
);
3402 rule
->handle
= handle
;
3404 rule
->udata
= ulen
? 1 : 0;
3407 udata
= nft_userdata(rule
);
3408 udata
->len
= ulen
- 1;
3409 nla_memcpy(udata
->data
, nla
[NFTA_RULE_USERDATA
], ulen
);
3412 expr
= nft_expr_first(rule
);
3413 for (i
= 0; i
< n
; i
++) {
3414 err
= nf_tables_newexpr(&ctx
, &expr_info
[i
], expr
);
3416 NL_SET_BAD_ATTR(extack
, expr_info
[i
].attr
);
3417 goto err_release_rule
;
3420 if (expr_info
[i
].ops
->validate
)
3421 nft_validate_state_update(net
, NFT_VALIDATE_NEED
);
3423 expr_info
[i
].ops
= NULL
;
3424 expr
= nft_expr_next(expr
);
3427 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
3428 flow
= nft_flow_rule_create(net
, rule
);
3430 err
= PTR_ERR(flow
);
3431 goto err_release_rule
;
3435 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
3436 err
= nft_delrule(&ctx
, old_rule
);
3438 goto err_destroy_flow_rule
;
3440 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
3441 if (trans
== NULL
) {
3443 goto err_destroy_flow_rule
;
3445 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
3447 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
3450 goto err_destroy_flow_rule
;
3453 if (info
->nlh
->nlmsg_flags
& NLM_F_APPEND
) {
3455 list_add_rcu(&rule
->list
, &old_rule
->list
);
3457 list_add_tail_rcu(&rule
->list
, &chain
->rules
);
3460 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
3462 list_add_rcu(&rule
->list
, &chain
->rules
);
3469 nft_trans_flow_rule(trans
) = flow
;
3471 if (nft_net
->validate_state
== NFT_VALIDATE_DO
)
3472 return nft_table_validate(net
, table
);
3476 err_destroy_flow_rule
:
3478 nft_flow_rule_destroy(flow
);
3480 nf_tables_rule_release(&ctx
, rule
);
3482 for (i
= 0; i
< n
; i
++) {
3483 if (expr_info
[i
].ops
) {
3484 module_put(expr_info
[i
].ops
->type
->owner
);
3485 if (expr_info
[i
].ops
->type
->release_ops
)
3486 expr_info
[i
].ops
->type
->release_ops(expr_info
[i
].ops
);
3494 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
3495 const struct nlattr
*nla
)
3497 struct nftables_pernet
*nft_net
= nft_pernet(net
);
3498 u32 id
= ntohl(nla_get_be32(nla
));
3499 struct nft_trans
*trans
;
3501 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
3502 struct nft_rule
*rule
= nft_trans_rule(trans
);
3504 if (trans
->msg_type
== NFT_MSG_NEWRULE
&&
3505 id
== nft_trans_rule_id(trans
))
3508 return ERR_PTR(-ENOENT
);
3511 static int nf_tables_delrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3512 const struct nlattr
* const nla
[])
3514 struct netlink_ext_ack
*extack
= info
->extack
;
3515 u8 genmask
= nft_genmask_next(info
->net
);
3516 u8 family
= info
->nfmsg
->nfgen_family
;
3517 struct nft_chain
*chain
= NULL
;
3518 struct net
*net
= info
->net
;
3519 struct nft_table
*table
;
3520 struct nft_rule
*rule
;
3524 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
3525 NETLINK_CB(skb
).portid
);
3526 if (IS_ERR(table
)) {
3527 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3528 return PTR_ERR(table
);
3531 if (nla
[NFTA_RULE_CHAIN
]) {
3532 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
3534 if (IS_ERR(chain
)) {
3535 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3536 return PTR_ERR(chain
);
3538 if (nft_chain_is_bound(chain
))
3542 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
3545 if (nla
[NFTA_RULE_HANDLE
]) {
3546 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
3548 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3549 return PTR_ERR(rule
);
3552 err
= nft_delrule(&ctx
, rule
);
3553 } else if (nla
[NFTA_RULE_ID
]) {
3554 rule
= nft_rule_lookup_byid(net
, nla
[NFTA_RULE_ID
]);
3556 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_ID
]);
3557 return PTR_ERR(rule
);
3560 err
= nft_delrule(&ctx
, rule
);
3562 err
= nft_delrule_by_chain(&ctx
);
3565 list_for_each_entry(chain
, &table
->chains
, list
) {
3566 if (!nft_is_active_next(net
, chain
))
3570 err
= nft_delrule_by_chain(&ctx
);
3582 static const struct nft_set_type
*nft_set_types
[] = {
3583 &nft_set_hash_fast_type
,
3585 &nft_set_rhash_type
,
3586 &nft_set_bitmap_type
,
3587 &nft_set_rbtree_type
,
3588 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
3589 &nft_set_pipapo_avx2_type
,
3591 &nft_set_pipapo_type
,
3594 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
3595 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3598 static bool nft_set_ops_candidate(const struct nft_set_type
*type
, u32 flags
)
3600 return (flags
& type
->features
) == (flags
& NFT_SET_FEATURES
);
3604 * Select a set implementation based on the data characteristics and the
3605 * given policy. The total memory use might not be known if no size is
3606 * given, in that case the amount of memory per element is used.
3608 static const struct nft_set_ops
*
3609 nft_select_set_ops(const struct nft_ctx
*ctx
,
3610 const struct nlattr
* const nla
[],
3611 const struct nft_set_desc
*desc
,
3612 enum nft_set_policies policy
)
3614 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
3615 const struct nft_set_ops
*ops
, *bops
;
3616 struct nft_set_estimate est
, best
;
3617 const struct nft_set_type
*type
;
3621 lockdep_assert_held(&nft_net
->commit_mutex
);
3622 lockdep_nfnl_nft_mutex_not_held();
3624 if (nla
[NFTA_SET_FLAGS
] != NULL
)
3625 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
3632 for (i
= 0; i
< ARRAY_SIZE(nft_set_types
); i
++) {
3633 type
= nft_set_types
[i
];
3636 if (!nft_set_ops_candidate(type
, flags
))
3638 if (!ops
->estimate(desc
, flags
, &est
))
3642 case NFT_SET_POL_PERFORMANCE
:
3643 if (est
.lookup
< best
.lookup
)
3645 if (est
.lookup
== best
.lookup
&&
3646 est
.space
< best
.space
)
3649 case NFT_SET_POL_MEMORY
:
3651 if (est
.space
< best
.space
)
3653 if (est
.space
== best
.space
&&
3654 est
.lookup
< best
.lookup
)
3656 } else if (est
.size
< best
.size
|| !bops
) {
3671 return ERR_PTR(-EOPNOTSUPP
);
3674 static const struct nla_policy nft_set_policy
[NFTA_SET_MAX
+ 1] = {
3675 [NFTA_SET_TABLE
] = { .type
= NLA_STRING
,
3676 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
3677 [NFTA_SET_NAME
] = { .type
= NLA_STRING
,
3678 .len
= NFT_SET_MAXNAMELEN
- 1 },
3679 [NFTA_SET_FLAGS
] = { .type
= NLA_U32
},
3680 [NFTA_SET_KEY_TYPE
] = { .type
= NLA_U32
},
3681 [NFTA_SET_KEY_LEN
] = { .type
= NLA_U32
},
3682 [NFTA_SET_DATA_TYPE
] = { .type
= NLA_U32
},
3683 [NFTA_SET_DATA_LEN
] = { .type
= NLA_U32
},
3684 [NFTA_SET_POLICY
] = { .type
= NLA_U32
},
3685 [NFTA_SET_DESC
] = { .type
= NLA_NESTED
},
3686 [NFTA_SET_ID
] = { .type
= NLA_U32
},
3687 [NFTA_SET_TIMEOUT
] = { .type
= NLA_U64
},
3688 [NFTA_SET_GC_INTERVAL
] = { .type
= NLA_U32
},
3689 [NFTA_SET_USERDATA
] = { .type
= NLA_BINARY
,
3690 .len
= NFT_USERDATA_MAXLEN
},
3691 [NFTA_SET_OBJ_TYPE
] = { .type
= NLA_U32
},
3692 [NFTA_SET_HANDLE
] = { .type
= NLA_U64
},
3693 [NFTA_SET_EXPR
] = { .type
= NLA_NESTED
},
3694 [NFTA_SET_EXPRESSIONS
] = { .type
= NLA_NESTED
},
3697 static const struct nla_policy nft_set_desc_policy
[NFTA_SET_DESC_MAX
+ 1] = {
3698 [NFTA_SET_DESC_SIZE
] = { .type
= NLA_U32
},
3699 [NFTA_SET_DESC_CONCAT
] = { .type
= NLA_NESTED
},
3702 static struct nft_set
*nft_set_lookup(const struct nft_table
*table
,
3703 const struct nlattr
*nla
, u8 genmask
)
3705 struct nft_set
*set
;
3708 return ERR_PTR(-EINVAL
);
3710 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
3711 if (!nla_strcmp(nla
, set
->name
) &&
3712 nft_active_genmask(set
, genmask
))
3715 return ERR_PTR(-ENOENT
);
3718 static struct nft_set
*nft_set_lookup_byhandle(const struct nft_table
*table
,
3719 const struct nlattr
*nla
,
3722 struct nft_set
*set
;
3724 list_for_each_entry(set
, &table
->sets
, list
) {
3725 if (be64_to_cpu(nla_get_be64(nla
)) == set
->handle
&&
3726 nft_active_genmask(set
, genmask
))
3729 return ERR_PTR(-ENOENT
);
3732 static struct nft_set
*nft_set_lookup_byid(const struct net
*net
,
3733 const struct nlattr
*nla
, u8 genmask
)
3735 struct nftables_pernet
*nft_net
= nft_pernet(net
);
3736 u32 id
= ntohl(nla_get_be32(nla
));
3737 struct nft_trans
*trans
;
3739 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
3740 if (trans
->msg_type
== NFT_MSG_NEWSET
) {
3741 struct nft_set
*set
= nft_trans_set(trans
);
3743 if (id
== nft_trans_set_id(trans
) &&
3744 nft_active_genmask(set
, genmask
))
3748 return ERR_PTR(-ENOENT
);
3751 struct nft_set
*nft_set_lookup_global(const struct net
*net
,
3752 const struct nft_table
*table
,
3753 const struct nlattr
*nla_set_name
,
3754 const struct nlattr
*nla_set_id
,
3757 struct nft_set
*set
;
3759 set
= nft_set_lookup(table
, nla_set_name
, genmask
);
3764 set
= nft_set_lookup_byid(net
, nla_set_id
, genmask
);
3768 EXPORT_SYMBOL_GPL(nft_set_lookup_global
);
3770 static int nf_tables_set_alloc_name(struct nft_ctx
*ctx
, struct nft_set
*set
,
3773 const struct nft_set
*i
;
3775 unsigned long *inuse
;
3776 unsigned int n
= 0, min
= 0;
3778 p
= strchr(name
, '%');
3780 if (p
[1] != 'd' || strchr(p
+ 2, '%'))
3783 inuse
= (unsigned long *)get_zeroed_page(GFP_KERNEL
);
3787 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
3790 if (!nft_is_active_next(ctx
->net
, set
))
3792 if (!sscanf(i
->name
, name
, &tmp
))
3794 if (tmp
< min
|| tmp
>= min
+ BITS_PER_BYTE
* PAGE_SIZE
)
3797 set_bit(tmp
- min
, inuse
);
3800 n
= find_first_zero_bit(inuse
, BITS_PER_BYTE
* PAGE_SIZE
);
3801 if (n
>= BITS_PER_BYTE
* PAGE_SIZE
) {
3802 min
+= BITS_PER_BYTE
* PAGE_SIZE
;
3803 memset(inuse
, 0, PAGE_SIZE
);
3806 free_page((unsigned long)inuse
);
3809 set
->name
= kasprintf(GFP_KERNEL
, name
, min
+ n
);
3813 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
3814 if (!nft_is_active_next(ctx
->net
, i
))
3816 if (!strcmp(set
->name
, i
->name
)) {
3825 int nf_msecs_to_jiffies64(const struct nlattr
*nla
, u64
*result
)
3827 u64 ms
= be64_to_cpu(nla_get_be64(nla
));
3828 u64 max
= (u64
)(~((u64
)0));
3830 max
= div_u64(max
, NSEC_PER_MSEC
);
3834 ms
*= NSEC_PER_MSEC
;
3835 *result
= nsecs_to_jiffies64(ms
);
3839 __be64
nf_jiffies64_to_msecs(u64 input
)
3841 return cpu_to_be64(jiffies64_to_msecs(input
));
3844 static int nf_tables_fill_set_concat(struct sk_buff
*skb
,
3845 const struct nft_set
*set
)
3847 struct nlattr
*concat
, *field
;
3850 concat
= nla_nest_start_noflag(skb
, NFTA_SET_DESC_CONCAT
);
3854 for (i
= 0; i
< set
->field_count
; i
++) {
3855 field
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
3859 if (nla_put_be32(skb
, NFTA_SET_FIELD_LEN
,
3860 htonl(set
->field_len
[i
])))
3863 nla_nest_end(skb
, field
);
3866 nla_nest_end(skb
, concat
);
3871 static int nf_tables_fill_set(struct sk_buff
*skb
, const struct nft_ctx
*ctx
,
3872 const struct nft_set
*set
, u16 event
, u16 flags
)
3874 struct nlmsghdr
*nlh
;
3875 u32 portid
= ctx
->portid
;
3876 struct nlattr
*nest
;
3880 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
3881 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, ctx
->family
,
3882 NFNETLINK_V0
, nft_base_seq(ctx
->net
));
3884 goto nla_put_failure
;
3886 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
3887 goto nla_put_failure
;
3888 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
3889 goto nla_put_failure
;
3890 if (nla_put_be64(skb
, NFTA_SET_HANDLE
, cpu_to_be64(set
->handle
),
3892 goto nla_put_failure
;
3893 if (set
->flags
!= 0)
3894 if (nla_put_be32(skb
, NFTA_SET_FLAGS
, htonl(set
->flags
)))
3895 goto nla_put_failure
;
3897 if (nla_put_be32(skb
, NFTA_SET_KEY_TYPE
, htonl(set
->ktype
)))
3898 goto nla_put_failure
;
3899 if (nla_put_be32(skb
, NFTA_SET_KEY_LEN
, htonl(set
->klen
)))
3900 goto nla_put_failure
;
3901 if (set
->flags
& NFT_SET_MAP
) {
3902 if (nla_put_be32(skb
, NFTA_SET_DATA_TYPE
, htonl(set
->dtype
)))
3903 goto nla_put_failure
;
3904 if (nla_put_be32(skb
, NFTA_SET_DATA_LEN
, htonl(set
->dlen
)))
3905 goto nla_put_failure
;
3907 if (set
->flags
& NFT_SET_OBJECT
&&
3908 nla_put_be32(skb
, NFTA_SET_OBJ_TYPE
, htonl(set
->objtype
)))
3909 goto nla_put_failure
;
3912 nla_put_be64(skb
, NFTA_SET_TIMEOUT
,
3913 nf_jiffies64_to_msecs(set
->timeout
),
3915 goto nla_put_failure
;
3917 nla_put_be32(skb
, NFTA_SET_GC_INTERVAL
, htonl(set
->gc_int
)))
3918 goto nla_put_failure
;
3920 if (set
->policy
!= NFT_SET_POL_PERFORMANCE
) {
3921 if (nla_put_be32(skb
, NFTA_SET_POLICY
, htonl(set
->policy
)))
3922 goto nla_put_failure
;
3926 nla_put(skb
, NFTA_SET_USERDATA
, set
->udlen
, set
->udata
))
3927 goto nla_put_failure
;
3929 nest
= nla_nest_start_noflag(skb
, NFTA_SET_DESC
);
3931 goto nla_put_failure
;
3933 nla_put_be32(skb
, NFTA_SET_DESC_SIZE
, htonl(set
->size
)))
3934 goto nla_put_failure
;
3936 if (set
->field_count
> 1 &&
3937 nf_tables_fill_set_concat(skb
, set
))
3938 goto nla_put_failure
;
3940 nla_nest_end(skb
, nest
);
3942 if (set
->num_exprs
== 1) {
3943 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPR
);
3944 if (nf_tables_fill_expr_info(skb
, set
->exprs
[0]) < 0)
3945 goto nla_put_failure
;
3947 nla_nest_end(skb
, nest
);
3948 } else if (set
->num_exprs
> 1) {
3949 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPRESSIONS
);
3951 goto nla_put_failure
;
3953 for (i
= 0; i
< set
->num_exprs
; i
++) {
3954 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
,
3956 goto nla_put_failure
;
3958 nla_nest_end(skb
, nest
);
3961 nlmsg_end(skb
, nlh
);
3965 nlmsg_trim(skb
, nlh
);
3969 static void nf_tables_set_notify(const struct nft_ctx
*ctx
,
3970 const struct nft_set
*set
, int event
,
3973 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
3974 u32 portid
= ctx
->portid
;
3975 struct sk_buff
*skb
;
3980 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
3983 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp_flags
);
3987 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
3988 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
3990 err
= nf_tables_fill_set(skb
, ctx
, set
, event
, flags
);
3996 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
3999 nfnetlink_set_err(ctx
->net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
4002 static int nf_tables_dump_sets(struct sk_buff
*skb
, struct netlink_callback
*cb
)
4004 const struct nft_set
*set
;
4005 unsigned int idx
, s_idx
= cb
->args
[0];
4006 struct nft_table
*table
, *cur_table
= (struct nft_table
*)cb
->args
[2];
4007 struct net
*net
= sock_net(skb
->sk
);
4008 struct nft_ctx
*ctx
= cb
->data
, ctx_set
;
4009 struct nftables_pernet
*nft_net
;
4015 nft_net
= nft_pernet(net
);
4016 cb
->seq
= nft_net
->base_seq
;
4018 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
4019 if (ctx
->family
!= NFPROTO_UNSPEC
&&
4020 ctx
->family
!= table
->family
)
4023 if (ctx
->table
&& ctx
->table
!= table
)
4027 if (cur_table
!= table
)
4033 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
4036 if (!nft_is_active(net
, set
))
4040 ctx_set
.table
= table
;
4041 ctx_set
.family
= table
->family
;
4043 if (nf_tables_fill_set(skb
, &ctx_set
, set
,
4047 cb
->args
[2] = (unsigned long) table
;
4050 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
4063 static int nf_tables_dump_sets_start(struct netlink_callback
*cb
)
4065 struct nft_ctx
*ctx_dump
= NULL
;
4067 ctx_dump
= kmemdup(cb
->data
, sizeof(*ctx_dump
), GFP_ATOMIC
);
4068 if (ctx_dump
== NULL
)
4071 cb
->data
= ctx_dump
;
4075 static int nf_tables_dump_sets_done(struct netlink_callback
*cb
)
4081 /* called with rcu_read_lock held */
4082 static int nf_tables_getset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4083 const struct nlattr
* const nla
[])
4085 struct netlink_ext_ack
*extack
= info
->extack
;
4086 u8 genmask
= nft_genmask_cur(info
->net
);
4087 u8 family
= info
->nfmsg
->nfgen_family
;
4088 struct nft_table
*table
= NULL
;
4089 struct net
*net
= info
->net
;
4090 const struct nft_set
*set
;
4091 struct sk_buff
*skb2
;
4095 if (nla
[NFTA_SET_TABLE
]) {
4096 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
,
4098 if (IS_ERR(table
)) {
4099 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4100 return PTR_ERR(table
);
4104 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
4106 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
4107 struct netlink_dump_control c
= {
4108 .start
= nf_tables_dump_sets_start
,
4109 .dump
= nf_tables_dump_sets
,
4110 .done
= nf_tables_dump_sets_done
,
4112 .module
= THIS_MODULE
,
4115 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
4118 /* Only accept unspec with dump */
4119 if (info
->nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
4120 return -EAFNOSUPPORT
;
4121 if (!nla
[NFTA_SET_TABLE
])
4124 set
= nft_set_lookup(table
, nla
[NFTA_SET_NAME
], genmask
);
4126 return PTR_ERR(set
);
4128 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
4132 err
= nf_tables_fill_set(skb2
, &ctx
, set
, NFT_MSG_NEWSET
, 0);
4134 goto err_fill_set_info
;
4136 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
4143 static const struct nla_policy nft_concat_policy
[NFTA_SET_FIELD_MAX
+ 1] = {
4144 [NFTA_SET_FIELD_LEN
] = { .type
= NLA_U32
},
4147 static int nft_set_desc_concat_parse(const struct nlattr
*attr
,
4148 struct nft_set_desc
*desc
)
4150 struct nlattr
*tb
[NFTA_SET_FIELD_MAX
+ 1];
4154 err
= nla_parse_nested_deprecated(tb
, NFTA_SET_FIELD_MAX
, attr
,
4155 nft_concat_policy
, NULL
);
4159 if (!tb
[NFTA_SET_FIELD_LEN
])
4162 len
= ntohl(nla_get_be32(tb
[NFTA_SET_FIELD_LEN
]));
4164 if (len
* BITS_PER_BYTE
/ 32 > NFT_REG32_COUNT
)
4167 desc
->field_len
[desc
->field_count
++] = len
;
4172 static int nft_set_desc_concat(struct nft_set_desc
*desc
,
4173 const struct nlattr
*nla
)
4175 struct nlattr
*attr
;
4178 nla_for_each_nested(attr
, nla
, rem
) {
4179 if (nla_type(attr
) != NFTA_LIST_ELEM
)
4182 err
= nft_set_desc_concat_parse(attr
, desc
);
4190 static int nf_tables_set_desc_parse(struct nft_set_desc
*desc
,
4191 const struct nlattr
*nla
)
4193 struct nlattr
*da
[NFTA_SET_DESC_MAX
+ 1];
4196 err
= nla_parse_nested_deprecated(da
, NFTA_SET_DESC_MAX
, nla
,
4197 nft_set_desc_policy
, NULL
);
4201 if (da
[NFTA_SET_DESC_SIZE
] != NULL
)
4202 desc
->size
= ntohl(nla_get_be32(da
[NFTA_SET_DESC_SIZE
]));
4203 if (da
[NFTA_SET_DESC_CONCAT
])
4204 err
= nft_set_desc_concat(desc
, da
[NFTA_SET_DESC_CONCAT
]);
4209 static int nf_tables_newset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4210 const struct nlattr
* const nla
[])
4212 u32 ktype
, dtype
, flags
, policy
, gc_int
, objtype
;
4213 struct netlink_ext_ack
*extack
= info
->extack
;
4214 u8 genmask
= nft_genmask_next(info
->net
);
4215 u8 family
= info
->nfmsg
->nfgen_family
;
4216 const struct nft_set_ops
*ops
;
4217 struct nft_expr
*expr
= NULL
;
4218 struct net
*net
= info
->net
;
4219 struct nft_set_desc desc
;
4220 struct nft_table
*table
;
4221 unsigned char *udata
;
4222 struct nft_set
*set
;
4231 if (nla
[NFTA_SET_TABLE
] == NULL
||
4232 nla
[NFTA_SET_NAME
] == NULL
||
4233 nla
[NFTA_SET_KEY_LEN
] == NULL
||
4234 nla
[NFTA_SET_ID
] == NULL
)
4237 memset(&desc
, 0, sizeof(desc
));
4239 ktype
= NFT_DATA_VALUE
;
4240 if (nla
[NFTA_SET_KEY_TYPE
] != NULL
) {
4241 ktype
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_TYPE
]));
4242 if ((ktype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
)
4246 desc
.klen
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_LEN
]));
4247 if (desc
.klen
== 0 || desc
.klen
> NFT_DATA_VALUE_MAXLEN
)
4251 if (nla
[NFTA_SET_FLAGS
] != NULL
) {
4252 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
4253 if (flags
& ~(NFT_SET_ANONYMOUS
| NFT_SET_CONSTANT
|
4254 NFT_SET_INTERVAL
| NFT_SET_TIMEOUT
|
4255 NFT_SET_MAP
| NFT_SET_EVAL
|
4256 NFT_SET_OBJECT
| NFT_SET_CONCAT
| NFT_SET_EXPR
))
4258 /* Only one of these operations is supported */
4259 if ((flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
)) ==
4260 (NFT_SET_MAP
| NFT_SET_OBJECT
))
4262 if ((flags
& (NFT_SET_EVAL
| NFT_SET_OBJECT
)) ==
4263 (NFT_SET_EVAL
| NFT_SET_OBJECT
))
4268 if (nla
[NFTA_SET_DATA_TYPE
] != NULL
) {
4269 if (!(flags
& NFT_SET_MAP
))
4272 dtype
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_TYPE
]));
4273 if ((dtype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
&&
4274 dtype
!= NFT_DATA_VERDICT
)
4277 if (dtype
!= NFT_DATA_VERDICT
) {
4278 if (nla
[NFTA_SET_DATA_LEN
] == NULL
)
4280 desc
.dlen
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_LEN
]));
4281 if (desc
.dlen
== 0 || desc
.dlen
> NFT_DATA_VALUE_MAXLEN
)
4284 desc
.dlen
= sizeof(struct nft_verdict
);
4285 } else if (flags
& NFT_SET_MAP
)
4288 if (nla
[NFTA_SET_OBJ_TYPE
] != NULL
) {
4289 if (!(flags
& NFT_SET_OBJECT
))
4292 objtype
= ntohl(nla_get_be32(nla
[NFTA_SET_OBJ_TYPE
]));
4293 if (objtype
== NFT_OBJECT_UNSPEC
||
4294 objtype
> NFT_OBJECT_MAX
)
4296 } else if (flags
& NFT_SET_OBJECT
)
4299 objtype
= NFT_OBJECT_UNSPEC
;
4302 if (nla
[NFTA_SET_TIMEOUT
] != NULL
) {
4303 if (!(flags
& NFT_SET_TIMEOUT
))
4306 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_TIMEOUT
], &timeout
);
4311 if (nla
[NFTA_SET_GC_INTERVAL
] != NULL
) {
4312 if (!(flags
& NFT_SET_TIMEOUT
))
4314 gc_int
= ntohl(nla_get_be32(nla
[NFTA_SET_GC_INTERVAL
]));
4317 policy
= NFT_SET_POL_PERFORMANCE
;
4318 if (nla
[NFTA_SET_POLICY
] != NULL
)
4319 policy
= ntohl(nla_get_be32(nla
[NFTA_SET_POLICY
]));
4321 if (nla
[NFTA_SET_DESC
] != NULL
) {
4322 err
= nf_tables_set_desc_parse(&desc
, nla
[NFTA_SET_DESC
]);
4327 if (nla
[NFTA_SET_EXPR
] || nla
[NFTA_SET_EXPRESSIONS
])
4330 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
, genmask
,
4331 NETLINK_CB(skb
).portid
);
4332 if (IS_ERR(table
)) {
4333 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4334 return PTR_ERR(table
);
4337 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
4339 set
= nft_set_lookup(table
, nla
[NFTA_SET_NAME
], genmask
);
4341 if (PTR_ERR(set
) != -ENOENT
) {
4342 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
4343 return PTR_ERR(set
);
4346 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
4347 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
4350 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
4356 if (!(info
->nlh
->nlmsg_flags
& NLM_F_CREATE
))
4359 ops
= nft_select_set_ops(&ctx
, nla
, &desc
, policy
);
4361 return PTR_ERR(ops
);
4364 if (nla
[NFTA_SET_USERDATA
])
4365 udlen
= nla_len(nla
[NFTA_SET_USERDATA
]);
4368 if (ops
->privsize
!= NULL
)
4369 size
= ops
->privsize(nla
, &desc
);
4370 alloc_size
= sizeof(*set
) + size
+ udlen
;
4371 if (alloc_size
< size
|| alloc_size
> INT_MAX
)
4373 set
= kvzalloc(alloc_size
, GFP_KERNEL
);
4377 name
= nla_strdup(nla
[NFTA_SET_NAME
], GFP_KERNEL
);
4383 err
= nf_tables_set_alloc_name(&ctx
, set
, name
);
4390 udata
= set
->data
+ size
;
4391 nla_memcpy(udata
, nla
[NFTA_SET_USERDATA
], udlen
);
4394 INIT_LIST_HEAD(&set
->bindings
);
4395 INIT_LIST_HEAD(&set
->catchall_list
);
4397 write_pnet(&set
->net
, net
);
4400 set
->klen
= desc
.klen
;
4402 set
->objtype
= objtype
;
4403 set
->dlen
= desc
.dlen
;
4405 set
->size
= desc
.size
;
4406 set
->policy
= policy
;
4409 set
->timeout
= timeout
;
4410 set
->gc_int
= gc_int
;
4412 set
->field_count
= desc
.field_count
;
4413 for (i
= 0; i
< desc
.field_count
; i
++)
4414 set
->field_len
[i
] = desc
.field_len
[i
];
4416 err
= ops
->init(set
, &desc
, nla
);
4420 if (nla
[NFTA_SET_EXPR
]) {
4421 expr
= nft_set_elem_expr_alloc(&ctx
, set
, nla
[NFTA_SET_EXPR
]);
4423 err
= PTR_ERR(expr
);
4424 goto err_set_expr_alloc
;
4426 set
->exprs
[0] = expr
;
4428 } else if (nla
[NFTA_SET_EXPRESSIONS
]) {
4429 struct nft_expr
*expr
;
4433 if (!(flags
& NFT_SET_EXPR
)) {
4435 goto err_set_expr_alloc
;
4438 nla_for_each_nested(tmp
, nla
[NFTA_SET_EXPRESSIONS
], left
) {
4439 if (i
== NFT_SET_EXPR_MAX
) {
4441 goto err_set_expr_alloc
;
4443 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
4445 goto err_set_expr_alloc
;
4447 expr
= nft_set_elem_expr_alloc(&ctx
, set
, tmp
);
4449 err
= PTR_ERR(expr
);
4450 goto err_set_expr_alloc
;
4452 set
->exprs
[i
++] = expr
;
4457 set
->handle
= nf_tables_alloc_handle(table
);
4459 err
= nft_trans_set_add(&ctx
, NFT_MSG_NEWSET
, set
);
4461 goto err_set_expr_alloc
;
4463 list_add_tail_rcu(&set
->list
, &table
->sets
);
4468 for (i
= 0; i
< set
->num_exprs
; i
++)
4469 nft_expr_destroy(&ctx
, set
->exprs
[i
]);
4479 struct nft_set_elem_catchall
{
4480 struct list_head list
;
4481 struct rcu_head rcu
;
4485 static void nft_set_catchall_destroy(const struct nft_ctx
*ctx
,
4486 struct nft_set
*set
)
4488 struct nft_set_elem_catchall
*next
, *catchall
;
4490 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
4491 list_del_rcu(&catchall
->list
);
4492 nft_set_elem_destroy(set
, catchall
->elem
, true);
4493 kfree_rcu(catchall
, rcu
);
4497 static void nft_set_destroy(const struct nft_ctx
*ctx
, struct nft_set
*set
)
4501 if (WARN_ON(set
->use
> 0))
4504 for (i
= 0; i
< set
->num_exprs
; i
++)
4505 nft_expr_destroy(ctx
, set
->exprs
[i
]);
4507 set
->ops
->destroy(set
);
4508 nft_set_catchall_destroy(ctx
, set
);
4513 static int nf_tables_delset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4514 const struct nlattr
* const nla
[])
4516 struct netlink_ext_ack
*extack
= info
->extack
;
4517 u8 genmask
= nft_genmask_next(info
->net
);
4518 u8 family
= info
->nfmsg
->nfgen_family
;
4519 struct net
*net
= info
->net
;
4520 const struct nlattr
*attr
;
4521 struct nft_table
*table
;
4522 struct nft_set
*set
;
4525 if (info
->nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
4526 return -EAFNOSUPPORT
;
4528 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
,
4529 genmask
, NETLINK_CB(skb
).portid
);
4530 if (IS_ERR(table
)) {
4531 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4532 return PTR_ERR(table
);
4535 if (nla
[NFTA_SET_HANDLE
]) {
4536 attr
= nla
[NFTA_SET_HANDLE
];
4537 set
= nft_set_lookup_byhandle(table
, attr
, genmask
);
4539 attr
= nla
[NFTA_SET_NAME
];
4540 set
= nft_set_lookup(table
, attr
, genmask
);
4544 NL_SET_BAD_ATTR(extack
, attr
);
4545 return PTR_ERR(set
);
4548 (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
4549 atomic_read(&set
->nelems
) > 0)) {
4550 NL_SET_BAD_ATTR(extack
, attr
);
4554 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
4556 return nft_delset(&ctx
, set
);
4559 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
4560 enum nft_registers reg
,
4561 const struct nft_data
*data
,
4562 enum nft_data_types type
,
4565 static int nft_setelem_data_validate(const struct nft_ctx
*ctx
,
4566 struct nft_set
*set
,
4567 struct nft_set_elem
*elem
)
4569 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
4570 enum nft_registers dreg
;
4572 dreg
= nft_type_to_reg(set
->dtype
);
4573 return nft_validate_register_store(ctx
, dreg
, nft_set_ext_data(ext
),
4574 set
->dtype
== NFT_DATA_VERDICT
?
4575 NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
4579 static int nf_tables_bind_check_setelem(const struct nft_ctx
*ctx
,
4580 struct nft_set
*set
,
4581 const struct nft_set_iter
*iter
,
4582 struct nft_set_elem
*elem
)
4584 return nft_setelem_data_validate(ctx
, set
, elem
);
4587 static int nft_set_catchall_bind_check(const struct nft_ctx
*ctx
,
4588 struct nft_set
*set
)
4590 u8 genmask
= nft_genmask_next(ctx
->net
);
4591 struct nft_set_elem_catchall
*catchall
;
4592 struct nft_set_elem elem
;
4593 struct nft_set_ext
*ext
;
4596 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
4597 ext
= nft_set_elem_ext(set
, catchall
->elem
);
4598 if (!nft_set_elem_active(ext
, genmask
))
4601 elem
.priv
= catchall
->elem
;
4602 ret
= nft_setelem_data_validate(ctx
, set
, &elem
);
4610 int nf_tables_bind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4611 struct nft_set_binding
*binding
)
4613 struct nft_set_binding
*i
;
4614 struct nft_set_iter iter
;
4616 if (set
->use
== UINT_MAX
)
4619 if (!list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
4622 if (binding
->flags
& NFT_SET_MAP
) {
4623 /* If the set is already bound to the same chain all
4624 * jumps are already validated for that chain.
4626 list_for_each_entry(i
, &set
->bindings
, list
) {
4627 if (i
->flags
& NFT_SET_MAP
&&
4628 i
->chain
== binding
->chain
)
4632 iter
.genmask
= nft_genmask_next(ctx
->net
);
4636 iter
.fn
= nf_tables_bind_check_setelem
;
4638 set
->ops
->walk(ctx
, set
, &iter
);
4640 iter
.err
= nft_set_catchall_bind_check(ctx
, set
);
4646 binding
->chain
= ctx
->chain
;
4647 list_add_tail_rcu(&binding
->list
, &set
->bindings
);
4648 nft_set_trans_bind(ctx
, set
);
4653 EXPORT_SYMBOL_GPL(nf_tables_bind_set
);
4655 static void nf_tables_unbind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4656 struct nft_set_binding
*binding
, bool event
)
4658 list_del_rcu(&binding
->list
);
4660 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
)) {
4661 list_del_rcu(&set
->list
);
4663 nf_tables_set_notify(ctx
, set
, NFT_MSG_DELSET
,
4668 void nf_tables_deactivate_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4669 struct nft_set_binding
*binding
,
4670 enum nft_trans_phase phase
)
4673 case NFT_TRANS_PREPARE
:
4676 case NFT_TRANS_ABORT
:
4677 case NFT_TRANS_RELEASE
:
4681 nf_tables_unbind_set(ctx
, set
, binding
,
4682 phase
== NFT_TRANS_COMMIT
);
4685 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set
);
4687 void nf_tables_destroy_set(const struct nft_ctx
*ctx
, struct nft_set
*set
)
4689 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
4690 nft_set_destroy(ctx
, set
);
4692 EXPORT_SYMBOL_GPL(nf_tables_destroy_set
);
4694 const struct nft_set_ext_type nft_set_ext_types
[] = {
4695 [NFT_SET_EXT_KEY
] = {
4696 .align
= __alignof__(u32
),
4698 [NFT_SET_EXT_DATA
] = {
4699 .align
= __alignof__(u32
),
4701 [NFT_SET_EXT_EXPRESSIONS
] = {
4702 .align
= __alignof__(struct nft_set_elem_expr
),
4704 [NFT_SET_EXT_OBJREF
] = {
4705 .len
= sizeof(struct nft_object
*),
4706 .align
= __alignof__(struct nft_object
*),
4708 [NFT_SET_EXT_FLAGS
] = {
4710 .align
= __alignof__(u8
),
4712 [NFT_SET_EXT_TIMEOUT
] = {
4714 .align
= __alignof__(u64
),
4716 [NFT_SET_EXT_EXPIRATION
] = {
4718 .align
= __alignof__(u64
),
4720 [NFT_SET_EXT_USERDATA
] = {
4721 .len
= sizeof(struct nft_userdata
),
4722 .align
= __alignof__(struct nft_userdata
),
4724 [NFT_SET_EXT_KEY_END
] = {
4725 .align
= __alignof__(u32
),
4733 static const struct nla_policy nft_set_elem_policy
[NFTA_SET_ELEM_MAX
+ 1] = {
4734 [NFTA_SET_ELEM_KEY
] = { .type
= NLA_NESTED
},
4735 [NFTA_SET_ELEM_DATA
] = { .type
= NLA_NESTED
},
4736 [NFTA_SET_ELEM_FLAGS
] = { .type
= NLA_U32
},
4737 [NFTA_SET_ELEM_TIMEOUT
] = { .type
= NLA_U64
},
4738 [NFTA_SET_ELEM_EXPIRATION
] = { .type
= NLA_U64
},
4739 [NFTA_SET_ELEM_USERDATA
] = { .type
= NLA_BINARY
,
4740 .len
= NFT_USERDATA_MAXLEN
},
4741 [NFTA_SET_ELEM_EXPR
] = { .type
= NLA_NESTED
},
4742 [NFTA_SET_ELEM_OBJREF
] = { .type
= NLA_STRING
,
4743 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
4744 [NFTA_SET_ELEM_KEY_END
] = { .type
= NLA_NESTED
},
4745 [NFTA_SET_ELEM_EXPRESSIONS
] = { .type
= NLA_NESTED
},
4748 static const struct nla_policy nft_set_elem_list_policy
[NFTA_SET_ELEM_LIST_MAX
+ 1] = {
4749 [NFTA_SET_ELEM_LIST_TABLE
] = { .type
= NLA_STRING
,
4750 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
4751 [NFTA_SET_ELEM_LIST_SET
] = { .type
= NLA_STRING
,
4752 .len
= NFT_SET_MAXNAMELEN
- 1 },
4753 [NFTA_SET_ELEM_LIST_ELEMENTS
] = { .type
= NLA_NESTED
},
4754 [NFTA_SET_ELEM_LIST_SET_ID
] = { .type
= NLA_U32
},
4757 static int nft_set_elem_expr_dump(struct sk_buff
*skb
,
4758 const struct nft_set
*set
,
4759 const struct nft_set_ext
*ext
)
4761 struct nft_set_elem_expr
*elem_expr
;
4762 u32 size
, num_exprs
= 0;
4763 struct nft_expr
*expr
;
4764 struct nlattr
*nest
;
4766 elem_expr
= nft_set_ext_expr(ext
);
4767 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
4770 if (num_exprs
== 1) {
4771 expr
= nft_setelem_expr_at(elem_expr
, 0);
4772 if (nft_expr_dump(skb
, NFTA_SET_ELEM_EXPR
, expr
) < 0)
4776 } else if (num_exprs
> 1) {
4777 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_EXPRESSIONS
);
4779 goto nla_put_failure
;
4781 nft_setelem_expr_foreach(expr
, elem_expr
, size
) {
4782 expr
= nft_setelem_expr_at(elem_expr
, size
);
4783 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
) < 0)
4784 goto nla_put_failure
;
4786 nla_nest_end(skb
, nest
);
4794 static int nf_tables_fill_setelem(struct sk_buff
*skb
,
4795 const struct nft_set
*set
,
4796 const struct nft_set_elem
*elem
)
4798 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
4799 unsigned char *b
= skb_tail_pointer(skb
);
4800 struct nlattr
*nest
;
4802 nest
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
4804 goto nla_put_failure
;
4806 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY
) &&
4807 nft_data_dump(skb
, NFTA_SET_ELEM_KEY
, nft_set_ext_key(ext
),
4808 NFT_DATA_VALUE
, set
->klen
) < 0)
4809 goto nla_put_failure
;
4811 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
) &&
4812 nft_data_dump(skb
, NFTA_SET_ELEM_KEY_END
, nft_set_ext_key_end(ext
),
4813 NFT_DATA_VALUE
, set
->klen
) < 0)
4814 goto nla_put_failure
;
4816 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
4817 nft_data_dump(skb
, NFTA_SET_ELEM_DATA
, nft_set_ext_data(ext
),
4818 set
->dtype
== NFT_DATA_VERDICT
? NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
4820 goto nla_put_failure
;
4822 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
) &&
4823 nft_set_elem_expr_dump(skb
, set
, ext
))
4824 goto nla_put_failure
;
4826 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
4827 nla_put_string(skb
, NFTA_SET_ELEM_OBJREF
,
4828 (*nft_set_ext_obj(ext
))->key
.name
) < 0)
4829 goto nla_put_failure
;
4831 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
4832 nla_put_be32(skb
, NFTA_SET_ELEM_FLAGS
,
4833 htonl(*nft_set_ext_flags(ext
))))
4834 goto nla_put_failure
;
4836 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
) &&
4837 nla_put_be64(skb
, NFTA_SET_ELEM_TIMEOUT
,
4838 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext
)),
4840 goto nla_put_failure
;
4842 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
4843 u64 expires
, now
= get_jiffies_64();
4845 expires
= *nft_set_ext_expiration(ext
);
4846 if (time_before64(now
, expires
))
4851 if (nla_put_be64(skb
, NFTA_SET_ELEM_EXPIRATION
,
4852 nf_jiffies64_to_msecs(expires
),
4854 goto nla_put_failure
;
4857 if (nft_set_ext_exists(ext
, NFT_SET_EXT_USERDATA
)) {
4858 struct nft_userdata
*udata
;
4860 udata
= nft_set_ext_userdata(ext
);
4861 if (nla_put(skb
, NFTA_SET_ELEM_USERDATA
,
4862 udata
->len
+ 1, udata
->data
))
4863 goto nla_put_failure
;
4866 nla_nest_end(skb
, nest
);
4874 struct nft_set_dump_args
{
4875 const struct netlink_callback
*cb
;
4876 struct nft_set_iter iter
;
4877 struct sk_buff
*skb
;
4880 static int nf_tables_dump_setelem(const struct nft_ctx
*ctx
,
4881 struct nft_set
*set
,
4882 const struct nft_set_iter
*iter
,
4883 struct nft_set_elem
*elem
)
4885 struct nft_set_dump_args
*args
;
4887 args
= container_of(iter
, struct nft_set_dump_args
, iter
);
4888 return nf_tables_fill_setelem(args
->skb
, set
, elem
);
4891 struct nft_set_dump_ctx
{
4892 const struct nft_set
*set
;
4896 static int nft_set_catchall_dump(struct net
*net
, struct sk_buff
*skb
,
4897 const struct nft_set
*set
)
4899 struct nft_set_elem_catchall
*catchall
;
4900 u8 genmask
= nft_genmask_cur(net
);
4901 struct nft_set_elem elem
;
4902 struct nft_set_ext
*ext
;
4905 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
4906 ext
= nft_set_elem_ext(set
, catchall
->elem
);
4907 if (!nft_set_elem_active(ext
, genmask
) ||
4908 nft_set_elem_expired(ext
))
4911 elem
.priv
= catchall
->elem
;
4912 ret
= nf_tables_fill_setelem(skb
, set
, &elem
);
4919 static int nf_tables_dump_set(struct sk_buff
*skb
, struct netlink_callback
*cb
)
4921 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
4922 struct net
*net
= sock_net(skb
->sk
);
4923 struct nftables_pernet
*nft_net
;
4924 struct nft_table
*table
;
4925 struct nft_set
*set
;
4926 struct nft_set_dump_args args
;
4927 bool set_found
= false;
4928 struct nlmsghdr
*nlh
;
4929 struct nlattr
*nest
;
4934 nft_net
= nft_pernet(net
);
4935 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
4936 if (dump_ctx
->ctx
.family
!= NFPROTO_UNSPEC
&&
4937 dump_ctx
->ctx
.family
!= table
->family
)
4940 if (table
!= dump_ctx
->ctx
.table
)
4943 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
4944 if (set
== dump_ctx
->set
) {
4957 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWSETELEM
);
4958 portid
= NETLINK_CB(cb
->skb
).portid
;
4959 seq
= cb
->nlh
->nlmsg_seq
;
4961 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, NLM_F_MULTI
,
4962 table
->family
, NFNETLINK_V0
, nft_base_seq(net
));
4964 goto nla_put_failure
;
4966 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_TABLE
, table
->name
))
4967 goto nla_put_failure
;
4968 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_SET
, set
->name
))
4969 goto nla_put_failure
;
4971 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
4973 goto nla_put_failure
;
4977 args
.iter
.genmask
= nft_genmask_cur(net
);
4978 args
.iter
.skip
= cb
->args
[0];
4979 args
.iter
.count
= 0;
4981 args
.iter
.fn
= nf_tables_dump_setelem
;
4982 set
->ops
->walk(&dump_ctx
->ctx
, set
, &args
.iter
);
4984 if (!args
.iter
.err
&& args
.iter
.count
== cb
->args
[0])
4985 args
.iter
.err
= nft_set_catchall_dump(net
, skb
, set
);
4988 nla_nest_end(skb
, nest
);
4989 nlmsg_end(skb
, nlh
);
4991 if (args
.iter
.err
&& args
.iter
.err
!= -EMSGSIZE
)
4992 return args
.iter
.err
;
4993 if (args
.iter
.count
== cb
->args
[0])
4996 cb
->args
[0] = args
.iter
.count
;
5004 static int nf_tables_dump_set_start(struct netlink_callback
*cb
)
5006 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
5008 cb
->data
= kmemdup(dump_ctx
, sizeof(*dump_ctx
), GFP_ATOMIC
);
5010 return cb
->data
? 0 : -ENOMEM
;
5013 static int nf_tables_dump_set_done(struct netlink_callback
*cb
)
5019 static int nf_tables_fill_setelem_info(struct sk_buff
*skb
,
5020 const struct nft_ctx
*ctx
, u32 seq
,
5021 u32 portid
, int event
, u16 flags
,
5022 const struct nft_set
*set
,
5023 const struct nft_set_elem
*elem
)
5025 struct nlmsghdr
*nlh
;
5026 struct nlattr
*nest
;
5029 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
5030 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, ctx
->family
,
5031 NFNETLINK_V0
, nft_base_seq(ctx
->net
));
5033 goto nla_put_failure
;
5035 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
5036 goto nla_put_failure
;
5037 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
5038 goto nla_put_failure
;
5040 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
5042 goto nla_put_failure
;
5044 err
= nf_tables_fill_setelem(skb
, set
, elem
);
5046 goto nla_put_failure
;
5048 nla_nest_end(skb
, nest
);
5050 nlmsg_end(skb
, nlh
);
5054 nlmsg_trim(skb
, nlh
);
5058 static int nft_setelem_parse_flags(const struct nft_set
*set
,
5059 const struct nlattr
*attr
, u32
*flags
)
5064 *flags
= ntohl(nla_get_be32(attr
));
5065 if (*flags
& ~(NFT_SET_ELEM_INTERVAL_END
| NFT_SET_ELEM_CATCHALL
))
5067 if (!(set
->flags
& NFT_SET_INTERVAL
) &&
5068 *flags
& NFT_SET_ELEM_INTERVAL_END
)
5074 static int nft_setelem_parse_key(struct nft_ctx
*ctx
, struct nft_set
*set
,
5075 struct nft_data
*key
, struct nlattr
*attr
)
5077 struct nft_data_desc desc
;
5080 err
= nft_data_init(ctx
, key
, NFT_DATA_VALUE_MAXLEN
, &desc
, attr
);
5084 if (desc
.type
!= NFT_DATA_VALUE
|| desc
.len
!= set
->klen
) {
5085 nft_data_release(key
, desc
.type
);
5092 static int nft_setelem_parse_data(struct nft_ctx
*ctx
, struct nft_set
*set
,
5093 struct nft_data_desc
*desc
,
5094 struct nft_data
*data
,
5095 struct nlattr
*attr
)
5099 err
= nft_data_init(ctx
, data
, NFT_DATA_VALUE_MAXLEN
, desc
, attr
);
5103 if (desc
->type
!= NFT_DATA_VERDICT
&& desc
->len
!= set
->dlen
) {
5104 nft_data_release(data
, desc
->type
);
5111 static void *nft_setelem_catchall_get(const struct net
*net
,
5112 const struct nft_set
*set
)
5114 struct nft_set_elem_catchall
*catchall
;
5115 u8 genmask
= nft_genmask_cur(net
);
5116 struct nft_set_ext
*ext
;
5119 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
5120 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5121 if (!nft_set_elem_active(ext
, genmask
) ||
5122 nft_set_elem_expired(ext
))
5125 priv
= catchall
->elem
;
5132 static int nft_setelem_get(struct nft_ctx
*ctx
, struct nft_set
*set
,
5133 struct nft_set_elem
*elem
, u32 flags
)
5137 if (!(flags
& NFT_SET_ELEM_CATCHALL
)) {
5138 priv
= set
->ops
->get(ctx
->net
, set
, elem
, flags
);
5140 return PTR_ERR(priv
);
5142 priv
= nft_setelem_catchall_get(ctx
->net
, set
);
5151 static int nft_get_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
5152 const struct nlattr
*attr
)
5154 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
5155 struct nft_set_elem elem
;
5156 struct sk_buff
*skb
;
5160 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
5161 nft_set_elem_policy
, NULL
);
5165 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
5169 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
5172 if (nla
[NFTA_SET_ELEM_KEY
]) {
5173 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
5174 nla
[NFTA_SET_ELEM_KEY
]);
5179 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
5180 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
5181 nla
[NFTA_SET_ELEM_KEY_END
]);
5186 err
= nft_setelem_get(ctx
, set
, &elem
, flags
);
5191 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_ATOMIC
);
5195 err
= nf_tables_fill_setelem_info(skb
, ctx
, ctx
->seq
, ctx
->portid
,
5196 NFT_MSG_NEWSETELEM
, 0, set
, &elem
);
5198 goto err_fill_setelem
;
5200 return nfnetlink_unicast(skb
, ctx
->net
, ctx
->portid
);
5207 /* called with rcu_read_lock held */
5208 static int nf_tables_getsetelem(struct sk_buff
*skb
,
5209 const struct nfnl_info
*info
,
5210 const struct nlattr
* const nla
[])
5212 struct netlink_ext_ack
*extack
= info
->extack
;
5213 u8 genmask
= nft_genmask_cur(info
->net
);
5214 u8 family
= info
->nfmsg
->nfgen_family
;
5215 struct net
*net
= info
->net
;
5216 struct nft_table
*table
;
5217 struct nft_set
*set
;
5218 struct nlattr
*attr
;
5222 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
5223 genmask
, NETLINK_CB(skb
).portid
);
5224 if (IS_ERR(table
)) {
5225 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
5226 return PTR_ERR(table
);
5229 set
= nft_set_lookup(table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
5231 return PTR_ERR(set
);
5233 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
5235 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
5236 struct netlink_dump_control c
= {
5237 .start
= nf_tables_dump_set_start
,
5238 .dump
= nf_tables_dump_set
,
5239 .done
= nf_tables_dump_set_done
,
5240 .module
= THIS_MODULE
,
5242 struct nft_set_dump_ctx dump_ctx
= {
5248 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
5251 if (!nla
[NFTA_SET_ELEM_LIST_ELEMENTS
])
5254 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
5255 err
= nft_get_set_elem(&ctx
, set
, attr
);
5263 static void nf_tables_setelem_notify(const struct nft_ctx
*ctx
,
5264 const struct nft_set
*set
,
5265 const struct nft_set_elem
*elem
,
5268 struct nftables_pernet
*nft_net
;
5269 struct net
*net
= ctx
->net
;
5270 u32 portid
= ctx
->portid
;
5271 struct sk_buff
*skb
;
5275 if (!ctx
->report
&& !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
5278 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
5282 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
5283 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
5285 err
= nf_tables_fill_setelem_info(skb
, ctx
, 0, portid
, event
, flags
,
5292 nft_net
= nft_pernet(net
);
5293 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
5296 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
5299 static struct nft_trans
*nft_trans_elem_alloc(struct nft_ctx
*ctx
,
5301 struct nft_set
*set
)
5303 struct nft_trans
*trans
;
5305 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_elem
));
5309 nft_trans_elem_set(trans
) = set
;
5313 struct nft_expr
*nft_set_elem_expr_alloc(const struct nft_ctx
*ctx
,
5314 const struct nft_set
*set
,
5315 const struct nlattr
*attr
)
5317 struct nft_expr
*expr
;
5320 expr
= nft_expr_init(ctx
, attr
);
5325 if (expr
->ops
->type
->flags
& NFT_EXPR_GC
) {
5326 if (set
->flags
& NFT_SET_TIMEOUT
)
5327 goto err_set_elem_expr
;
5328 if (!set
->ops
->gc_init
)
5329 goto err_set_elem_expr
;
5330 set
->ops
->gc_init(set
);
5336 nft_expr_destroy(ctx
, expr
);
5337 return ERR_PTR(err
);
5340 void *nft_set_elem_init(const struct nft_set
*set
,
5341 const struct nft_set_ext_tmpl
*tmpl
,
5342 const u32
*key
, const u32
*key_end
,
5343 const u32
*data
, u64 timeout
, u64 expiration
, gfp_t gfp
)
5345 struct nft_set_ext
*ext
;
5348 elem
= kzalloc(set
->ops
->elemsize
+ tmpl
->len
, gfp
);
5352 ext
= nft_set_elem_ext(set
, elem
);
5353 nft_set_ext_init(ext
, tmpl
);
5355 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY
))
5356 memcpy(nft_set_ext_key(ext
), key
, set
->klen
);
5357 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
))
5358 memcpy(nft_set_ext_key_end(ext
), key_end
, set
->klen
);
5359 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5360 memcpy(nft_set_ext_data(ext
), data
, set
->dlen
);
5361 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
5362 *nft_set_ext_expiration(ext
) = get_jiffies_64() + expiration
;
5363 if (expiration
== 0)
5364 *nft_set_ext_expiration(ext
) += timeout
;
5366 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
))
5367 *nft_set_ext_timeout(ext
) = timeout
;
5372 static void __nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
5373 struct nft_expr
*expr
)
5375 if (expr
->ops
->destroy_clone
) {
5376 expr
->ops
->destroy_clone(ctx
, expr
);
5377 module_put(expr
->ops
->type
->owner
);
5379 nf_tables_expr_destroy(ctx
, expr
);
5383 static void nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
5384 struct nft_set_elem_expr
*elem_expr
)
5386 struct nft_expr
*expr
;
5389 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
5390 __nft_set_elem_expr_destroy(ctx
, expr
);
5393 void nft_set_elem_destroy(const struct nft_set
*set
, void *elem
,
5396 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
);
5397 struct nft_ctx ctx
= {
5398 .net
= read_pnet(&set
->net
),
5399 .family
= set
->table
->family
,
5402 nft_data_release(nft_set_ext_key(ext
), NFT_DATA_VALUE
);
5403 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5404 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
5405 if (destroy_expr
&& nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
5406 nft_set_elem_expr_destroy(&ctx
, nft_set_ext_expr(ext
));
5408 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
5409 (*nft_set_ext_obj(ext
))->use
--;
5412 EXPORT_SYMBOL_GPL(nft_set_elem_destroy
);
5414 /* Only called from commit path, nft_setelem_data_deactivate() already deals
5415 * with the refcounting from the preparation phase.
5417 static void nf_tables_set_elem_destroy(const struct nft_ctx
*ctx
,
5418 const struct nft_set
*set
, void *elem
)
5420 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
);
5422 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
5423 nft_set_elem_expr_destroy(ctx
, nft_set_ext_expr(ext
));
5428 int nft_set_elem_expr_clone(const struct nft_ctx
*ctx
, struct nft_set
*set
,
5429 struct nft_expr
*expr_array
[])
5431 struct nft_expr
*expr
;
5434 for (i
= 0; i
< set
->num_exprs
; i
++) {
5435 expr
= kzalloc(set
->exprs
[i
]->ops
->size
, GFP_KERNEL
);
5439 err
= nft_expr_clone(expr
, set
->exprs
[i
]);
5441 nft_expr_destroy(ctx
, expr
);
5444 expr_array
[i
] = expr
;
5450 for (k
= i
- 1; k
>= 0; k
--)
5451 nft_expr_destroy(ctx
, expr_array
[k
]);
5456 static int nft_set_elem_expr_setup(struct nft_ctx
*ctx
,
5457 const struct nft_set_ext
*ext
,
5458 struct nft_expr
*expr_array
[],
5461 struct nft_set_elem_expr
*elem_expr
= nft_set_ext_expr(ext
);
5462 struct nft_expr
*expr
;
5465 for (i
= 0; i
< num_exprs
; i
++) {
5466 expr
= nft_setelem_expr_at(elem_expr
, elem_expr
->size
);
5467 err
= nft_expr_clone(expr
, expr_array
[i
]);
5469 goto err_elem_expr_setup
;
5471 elem_expr
->size
+= expr_array
[i
]->ops
->size
;
5472 nft_expr_destroy(ctx
, expr_array
[i
]);
5473 expr_array
[i
] = NULL
;
5478 err_elem_expr_setup
:
5479 for (; i
< num_exprs
; i
++) {
5480 nft_expr_destroy(ctx
, expr_array
[i
]);
5481 expr_array
[i
] = NULL
;
5487 struct nft_set_ext
*nft_set_catchall_lookup(const struct net
*net
,
5488 const struct nft_set
*set
)
5490 struct nft_set_elem_catchall
*catchall
;
5491 u8 genmask
= nft_genmask_cur(net
);
5492 struct nft_set_ext
*ext
;
5494 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
5495 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5496 if (nft_set_elem_active(ext
, genmask
) &&
5497 !nft_set_elem_expired(ext
))
5503 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup
);
5505 void *nft_set_catchall_gc(const struct nft_set
*set
)
5507 struct nft_set_elem_catchall
*catchall
, *next
;
5508 struct nft_set_ext
*ext
;
5511 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
5512 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5514 if (!nft_set_elem_expired(ext
) ||
5515 nft_set_elem_mark_busy(ext
))
5518 elem
= catchall
->elem
;
5519 list_del_rcu(&catchall
->list
);
5520 kfree_rcu(catchall
, rcu
);
5526 EXPORT_SYMBOL_GPL(nft_set_catchall_gc
);
5528 static int nft_setelem_catchall_insert(const struct net
*net
,
5529 struct nft_set
*set
,
5530 const struct nft_set_elem
*elem
,
5531 struct nft_set_ext
**pext
)
5533 struct nft_set_elem_catchall
*catchall
;
5534 u8 genmask
= nft_genmask_next(net
);
5535 struct nft_set_ext
*ext
;
5537 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
5538 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5539 if (nft_set_elem_active(ext
, genmask
)) {
5545 catchall
= kmalloc(sizeof(*catchall
), GFP_KERNEL
);
5549 catchall
->elem
= elem
->priv
;
5550 list_add_tail_rcu(&catchall
->list
, &set
->catchall_list
);
5555 static int nft_setelem_insert(const struct net
*net
,
5556 struct nft_set
*set
,
5557 const struct nft_set_elem
*elem
,
5558 struct nft_set_ext
**ext
, unsigned int flags
)
5562 if (flags
& NFT_SET_ELEM_CATCHALL
)
5563 ret
= nft_setelem_catchall_insert(net
, set
, elem
, ext
);
5565 ret
= set
->ops
->insert(net
, set
, elem
, ext
);
5570 static bool nft_setelem_is_catchall(const struct nft_set
*set
,
5571 const struct nft_set_elem
*elem
)
5573 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
5575 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
5576 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_CATCHALL
)
5582 static void nft_setelem_activate(struct net
*net
, struct nft_set
*set
,
5583 struct nft_set_elem
*elem
)
5585 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
5587 if (nft_setelem_is_catchall(set
, elem
)) {
5588 nft_set_elem_change_active(net
, set
, ext
);
5589 nft_set_elem_clear_busy(ext
);
5591 set
->ops
->activate(net
, set
, elem
);
5595 static int nft_setelem_catchall_deactivate(const struct net
*net
,
5596 struct nft_set
*set
,
5597 struct nft_set_elem
*elem
)
5599 struct nft_set_elem_catchall
*catchall
;
5600 struct nft_set_ext
*ext
;
5602 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
5603 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5604 if (!nft_is_active(net
, ext
) ||
5605 nft_set_elem_mark_busy(ext
))
5609 elem
->priv
= catchall
->elem
;
5610 nft_set_elem_change_active(net
, set
, ext
);
5617 static int __nft_setelem_deactivate(const struct net
*net
,
5618 struct nft_set
*set
,
5619 struct nft_set_elem
*elem
)
5623 priv
= set
->ops
->deactivate(net
, set
, elem
);
5634 static int nft_setelem_deactivate(const struct net
*net
,
5635 struct nft_set
*set
,
5636 struct nft_set_elem
*elem
, u32 flags
)
5640 if (flags
& NFT_SET_ELEM_CATCHALL
)
5641 ret
= nft_setelem_catchall_deactivate(net
, set
, elem
);
5643 ret
= __nft_setelem_deactivate(net
, set
, elem
);
5648 static void nft_setelem_catchall_remove(const struct net
*net
,
5649 const struct nft_set
*set
,
5650 const struct nft_set_elem
*elem
)
5652 struct nft_set_elem_catchall
*catchall
, *next
;
5654 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
5655 if (catchall
->elem
== elem
->priv
) {
5656 list_del_rcu(&catchall
->list
);
5657 kfree_rcu(catchall
, rcu
);
5663 static void nft_setelem_remove(const struct net
*net
,
5664 const struct nft_set
*set
,
5665 const struct nft_set_elem
*elem
)
5667 if (nft_setelem_is_catchall(set
, elem
))
5668 nft_setelem_catchall_remove(net
, set
, elem
);
5670 set
->ops
->remove(net
, set
, elem
);
5673 static int nft_add_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
5674 const struct nlattr
*attr
, u32 nlmsg_flags
)
5676 struct nft_expr
*expr_array
[NFT_SET_EXPR_MAX
] = {};
5677 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
5678 u8 genmask
= nft_genmask_next(ctx
->net
);
5679 u32 flags
= 0, size
= 0, num_exprs
= 0;
5680 struct nft_set_ext_tmpl tmpl
;
5681 struct nft_set_ext
*ext
, *ext2
;
5682 struct nft_set_elem elem
;
5683 struct nft_set_binding
*binding
;
5684 struct nft_object
*obj
= NULL
;
5685 struct nft_userdata
*udata
;
5686 struct nft_data_desc desc
;
5687 enum nft_registers dreg
;
5688 struct nft_trans
*trans
;
5694 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
5695 nft_set_elem_policy
, NULL
);
5699 nft_set_ext_prepare(&tmpl
);
5701 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
5705 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
5709 nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
5711 if (set
->flags
& NFT_SET_MAP
) {
5712 if (nla
[NFTA_SET_ELEM_DATA
] == NULL
&&
5713 !(flags
& NFT_SET_ELEM_INTERVAL_END
))
5716 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
5720 if ((flags
& NFT_SET_ELEM_INTERVAL_END
) &&
5721 (nla
[NFTA_SET_ELEM_DATA
] ||
5722 nla
[NFTA_SET_ELEM_OBJREF
] ||
5723 nla
[NFTA_SET_ELEM_TIMEOUT
] ||
5724 nla
[NFTA_SET_ELEM_EXPIRATION
] ||
5725 nla
[NFTA_SET_ELEM_USERDATA
] ||
5726 nla
[NFTA_SET_ELEM_EXPR
] ||
5727 nla
[NFTA_SET_ELEM_EXPRESSIONS
]))
5731 if (nla
[NFTA_SET_ELEM_TIMEOUT
] != NULL
) {
5732 if (!(set
->flags
& NFT_SET_TIMEOUT
))
5734 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_TIMEOUT
],
5738 } else if (set
->flags
& NFT_SET_TIMEOUT
) {
5739 timeout
= set
->timeout
;
5743 if (nla
[NFTA_SET_ELEM_EXPIRATION
] != NULL
) {
5744 if (!(set
->flags
& NFT_SET_TIMEOUT
))
5746 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_EXPIRATION
],
5752 if (nla
[NFTA_SET_ELEM_EXPR
]) {
5753 struct nft_expr
*expr
;
5755 if (set
->num_exprs
&& set
->num_exprs
!= 1)
5758 expr
= nft_set_elem_expr_alloc(ctx
, set
,
5759 nla
[NFTA_SET_ELEM_EXPR
]);
5761 return PTR_ERR(expr
);
5763 expr_array
[0] = expr
;
5766 if (set
->num_exprs
&& set
->exprs
[0]->ops
!= expr
->ops
) {
5768 goto err_set_elem_expr
;
5770 } else if (nla
[NFTA_SET_ELEM_EXPRESSIONS
]) {
5771 struct nft_expr
*expr
;
5776 nla_for_each_nested(tmp
, nla
[NFTA_SET_ELEM_EXPRESSIONS
], left
) {
5777 if (i
== NFT_SET_EXPR_MAX
||
5778 (set
->num_exprs
&& set
->num_exprs
== i
)) {
5780 goto err_set_elem_expr
;
5782 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
5784 goto err_set_elem_expr
;
5786 expr
= nft_set_elem_expr_alloc(ctx
, set
, tmp
);
5788 err
= PTR_ERR(expr
);
5789 goto err_set_elem_expr
;
5791 expr_array
[i
] = expr
;
5794 if (set
->num_exprs
&& expr
->ops
!= set
->exprs
[i
]->ops
) {
5796 goto err_set_elem_expr
;
5800 if (set
->num_exprs
&& set
->num_exprs
!= i
) {
5802 goto err_set_elem_expr
;
5804 } else if (set
->num_exprs
> 0) {
5805 err
= nft_set_elem_expr_clone(ctx
, set
, expr_array
);
5807 goto err_set_elem_expr_clone
;
5809 num_exprs
= set
->num_exprs
;
5812 if (nla
[NFTA_SET_ELEM_KEY
]) {
5813 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
5814 nla
[NFTA_SET_ELEM_KEY
]);
5816 goto err_set_elem_expr
;
5818 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
5821 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
5822 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
5823 nla
[NFTA_SET_ELEM_KEY_END
]);
5827 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
5831 nft_set_ext_add(&tmpl
, NFT_SET_EXT_EXPIRATION
);
5832 if (timeout
!= set
->timeout
)
5833 nft_set_ext_add(&tmpl
, NFT_SET_EXT_TIMEOUT
);
5837 for (i
= 0; i
< num_exprs
; i
++)
5838 size
+= expr_array
[i
]->ops
->size
;
5840 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_EXPRESSIONS
,
5841 sizeof(struct nft_set_elem_expr
) +
5845 if (nla
[NFTA_SET_ELEM_OBJREF
] != NULL
) {
5846 if (!(set
->flags
& NFT_SET_OBJECT
)) {
5848 goto err_parse_key_end
;
5850 obj
= nft_obj_lookup(ctx
->net
, ctx
->table
,
5851 nla
[NFTA_SET_ELEM_OBJREF
],
5852 set
->objtype
, genmask
);
5855 goto err_parse_key_end
;
5857 nft_set_ext_add(&tmpl
, NFT_SET_EXT_OBJREF
);
5860 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
) {
5861 err
= nft_setelem_parse_data(ctx
, set
, &desc
, &elem
.data
.val
,
5862 nla
[NFTA_SET_ELEM_DATA
]);
5864 goto err_parse_key_end
;
5866 dreg
= nft_type_to_reg(set
->dtype
);
5867 list_for_each_entry(binding
, &set
->bindings
, list
) {
5868 struct nft_ctx bind_ctx
= {
5870 .family
= ctx
->family
,
5871 .table
= ctx
->table
,
5872 .chain
= (struct nft_chain
*)binding
->chain
,
5875 if (!(binding
->flags
& NFT_SET_MAP
))
5878 err
= nft_validate_register_store(&bind_ctx
, dreg
,
5880 desc
.type
, desc
.len
);
5882 goto err_parse_data
;
5884 if (desc
.type
== NFT_DATA_VERDICT
&&
5885 (elem
.data
.val
.verdict
.code
== NFT_GOTO
||
5886 elem
.data
.val
.verdict
.code
== NFT_JUMP
))
5887 nft_validate_state_update(ctx
->net
,
5891 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_DATA
, desc
.len
);
5894 /* The full maximum length of userdata can exceed the maximum
5895 * offset value (U8_MAX) for following extensions, therefor it
5896 * must be the last extension added.
5899 if (nla
[NFTA_SET_ELEM_USERDATA
] != NULL
) {
5900 ulen
= nla_len(nla
[NFTA_SET_ELEM_USERDATA
]);
5902 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_USERDATA
,
5907 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
5908 elem
.key_end
.val
.data
, elem
.data
.val
.data
,
5909 timeout
, expiration
, GFP_KERNEL
);
5910 if (elem
.priv
== NULL
)
5911 goto err_parse_data
;
5913 ext
= nft_set_elem_ext(set
, elem
.priv
);
5915 *nft_set_ext_flags(ext
) = flags
;
5917 udata
= nft_set_ext_userdata(ext
);
5918 udata
->len
= ulen
- 1;
5919 nla_memcpy(&udata
->data
, nla
[NFTA_SET_ELEM_USERDATA
], ulen
);
5922 *nft_set_ext_obj(ext
) = obj
;
5925 err
= nft_set_elem_expr_setup(ctx
, ext
, expr_array
, num_exprs
);
5929 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_NEWSETELEM
, set
);
5930 if (trans
== NULL
) {
5935 ext
->genmask
= nft_genmask_cur(ctx
->net
) | NFT_SET_ELEM_BUSY_MASK
;
5937 err
= nft_setelem_insert(ctx
->net
, set
, &elem
, &ext2
, flags
);
5939 if (err
== -EEXIST
) {
5940 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) ^
5941 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) ||
5942 nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) ^
5943 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
))
5944 goto err_element_clash
;
5945 if ((nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
5946 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) &&
5947 memcmp(nft_set_ext_data(ext
),
5948 nft_set_ext_data(ext2
), set
->dlen
) != 0) ||
5949 (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
5950 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
) &&
5951 *nft_set_ext_obj(ext
) != *nft_set_ext_obj(ext2
)))
5952 goto err_element_clash
;
5953 else if (!(nlmsg_flags
& NLM_F_EXCL
))
5955 } else if (err
== -ENOTEMPTY
) {
5956 /* ENOTEMPTY reports overlapping between this element
5957 * and an existing one.
5961 goto err_element_clash
;
5964 if (!(flags
& NFT_SET_ELEM_CATCHALL
) && set
->size
&&
5965 !atomic_add_unless(&set
->nelems
, 1, set
->size
+ set
->ndeact
)) {
5970 nft_trans_elem(trans
) = elem
;
5971 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
5975 nft_setelem_remove(ctx
->net
, set
, &elem
);
5982 nf_tables_set_elem_destroy(ctx
, set
, elem
.priv
);
5984 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
5985 nft_data_release(&elem
.data
.val
, desc
.type
);
5987 nft_data_release(&elem
.key_end
.val
, NFT_DATA_VALUE
);
5989 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
5991 for (i
= 0; i
< num_exprs
&& expr_array
[i
]; i
++)
5992 nft_expr_destroy(ctx
, expr_array
[i
]);
5993 err_set_elem_expr_clone
:
5997 static int nf_tables_newsetelem(struct sk_buff
*skb
,
5998 const struct nfnl_info
*info
,
5999 const struct nlattr
* const nla
[])
6001 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
6002 struct netlink_ext_ack
*extack
= info
->extack
;
6003 u8 genmask
= nft_genmask_next(info
->net
);
6004 u8 family
= info
->nfmsg
->nfgen_family
;
6005 struct net
*net
= info
->net
;
6006 const struct nlattr
*attr
;
6007 struct nft_table
*table
;
6008 struct nft_set
*set
;
6012 if (nla
[NFTA_SET_ELEM_LIST_ELEMENTS
] == NULL
)
6015 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
6016 genmask
, NETLINK_CB(skb
).portid
);
6017 if (IS_ERR(table
)) {
6018 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
6019 return PTR_ERR(table
);
6022 set
= nft_set_lookup_global(net
, table
, nla
[NFTA_SET_ELEM_LIST_SET
],
6023 nla
[NFTA_SET_ELEM_LIST_SET_ID
], genmask
);
6025 return PTR_ERR(set
);
6027 if (!list_empty(&set
->bindings
) && set
->flags
& NFT_SET_CONSTANT
)
6030 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6032 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
6033 err
= nft_add_set_elem(&ctx
, set
, attr
, info
->nlh
->nlmsg_flags
);
6038 if (nft_net
->validate_state
== NFT_VALIDATE_DO
)
6039 return nft_table_validate(net
, table
);
6045 * nft_data_hold - hold a nft_data item
6047 * @data: struct nft_data to release
6048 * @type: type of data
6050 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6051 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
6052 * NFT_GOTO verdicts. This function must be called on active data objects
6053 * from the second phase of the commit protocol.
6055 void nft_data_hold(const struct nft_data
*data
, enum nft_data_types type
)
6057 struct nft_chain
*chain
;
6058 struct nft_rule
*rule
;
6060 if (type
== NFT_DATA_VERDICT
) {
6061 switch (data
->verdict
.code
) {
6064 chain
= data
->verdict
.chain
;
6067 if (!nft_chain_is_bound(chain
))
6070 chain
->table
->use
++;
6071 list_for_each_entry(rule
, &chain
->rules
, list
)
6074 nft_chain_add(chain
->table
, chain
);
6080 static void nft_setelem_data_activate(const struct net
*net
,
6081 const struct nft_set
*set
,
6082 struct nft_set_elem
*elem
)
6084 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
6086 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
6087 nft_data_hold(nft_set_ext_data(ext
), set
->dtype
);
6088 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
6089 (*nft_set_ext_obj(ext
))->use
++;
6092 static void nft_setelem_data_deactivate(const struct net
*net
,
6093 const struct nft_set
*set
,
6094 struct nft_set_elem
*elem
)
6096 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
6098 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
6099 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
6100 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
6101 (*nft_set_ext_obj(ext
))->use
--;
6104 static int nft_del_setelem(struct nft_ctx
*ctx
, struct nft_set
*set
,
6105 const struct nlattr
*attr
)
6107 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
6108 struct nft_set_ext_tmpl tmpl
;
6109 struct nft_set_elem elem
;
6110 struct nft_set_ext
*ext
;
6111 struct nft_trans
*trans
;
6115 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
6116 nft_set_elem_policy
, NULL
);
6120 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
6124 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
6127 nft_set_ext_prepare(&tmpl
);
6130 nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
6132 if (nla
[NFTA_SET_ELEM_KEY
]) {
6133 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
6134 nla
[NFTA_SET_ELEM_KEY
]);
6138 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
6141 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
6142 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
6143 nla
[NFTA_SET_ELEM_KEY_END
]);
6147 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
6151 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
6152 elem
.key_end
.val
.data
, NULL
, 0, 0,
6154 if (elem
.priv
== NULL
)
6157 ext
= nft_set_elem_ext(set
, elem
.priv
);
6159 *nft_set_ext_flags(ext
) = flags
;
6161 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_DELSETELEM
, set
);
6165 err
= nft_setelem_deactivate(ctx
->net
, set
, &elem
, flags
);
6169 nft_setelem_data_deactivate(ctx
->net
, set
, &elem
);
6171 nft_trans_elem(trans
) = elem
;
6172 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6180 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
6184 static int nft_setelem_flush(const struct nft_ctx
*ctx
,
6185 struct nft_set
*set
,
6186 const struct nft_set_iter
*iter
,
6187 struct nft_set_elem
*elem
)
6189 struct nft_trans
*trans
;
6192 trans
= nft_trans_alloc_gfp(ctx
, NFT_MSG_DELSETELEM
,
6193 sizeof(struct nft_trans_elem
), GFP_ATOMIC
);
6197 if (!set
->ops
->flush(ctx
->net
, set
, elem
->priv
)) {
6203 nft_setelem_data_deactivate(ctx
->net
, set
, elem
);
6204 nft_trans_elem_set(trans
) = set
;
6205 nft_trans_elem(trans
) = *elem
;
6206 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6214 static int __nft_set_catchall_flush(const struct nft_ctx
*ctx
,
6215 struct nft_set
*set
,
6216 struct nft_set_elem
*elem
)
6218 struct nft_trans
*trans
;
6220 trans
= nft_trans_alloc_gfp(ctx
, NFT_MSG_DELSETELEM
,
6221 sizeof(struct nft_trans_elem
), GFP_KERNEL
);
6225 nft_setelem_data_deactivate(ctx
->net
, set
, elem
);
6226 nft_trans_elem_set(trans
) = set
;
6227 nft_trans_elem(trans
) = *elem
;
6228 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6233 static int nft_set_catchall_flush(const struct nft_ctx
*ctx
,
6234 struct nft_set
*set
)
6236 u8 genmask
= nft_genmask_next(ctx
->net
);
6237 struct nft_set_elem_catchall
*catchall
;
6238 struct nft_set_elem elem
;
6239 struct nft_set_ext
*ext
;
6242 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
6243 ext
= nft_set_elem_ext(set
, catchall
->elem
);
6244 if (!nft_set_elem_active(ext
, genmask
) ||
6245 nft_set_elem_mark_busy(ext
))
6248 elem
.priv
= catchall
->elem
;
6249 ret
= __nft_set_catchall_flush(ctx
, set
, &elem
);
6257 static int nft_set_flush(struct nft_ctx
*ctx
, struct nft_set
*set
, u8 genmask
)
6259 struct nft_set_iter iter
= {
6261 .fn
= nft_setelem_flush
,
6264 set
->ops
->walk(ctx
, set
, &iter
);
6266 iter
.err
= nft_set_catchall_flush(ctx
, set
);
6271 static int nf_tables_delsetelem(struct sk_buff
*skb
,
6272 const struct nfnl_info
*info
,
6273 const struct nlattr
* const nla
[])
6275 struct netlink_ext_ack
*extack
= info
->extack
;
6276 u8 genmask
= nft_genmask_next(info
->net
);
6277 u8 family
= info
->nfmsg
->nfgen_family
;
6278 struct net
*net
= info
->net
;
6279 const struct nlattr
*attr
;
6280 struct nft_table
*table
;
6281 struct nft_set
*set
;
6285 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
6286 genmask
, NETLINK_CB(skb
).portid
);
6287 if (IS_ERR(table
)) {
6288 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
6289 return PTR_ERR(table
);
6292 set
= nft_set_lookup(table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
6294 return PTR_ERR(set
);
6295 if (!list_empty(&set
->bindings
) && set
->flags
& NFT_SET_CONSTANT
)
6298 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6300 if (!nla
[NFTA_SET_ELEM_LIST_ELEMENTS
])
6301 return nft_set_flush(&ctx
, set
, genmask
);
6303 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
6304 err
= nft_del_setelem(&ctx
, set
, attr
);
6311 void nft_set_gc_batch_release(struct rcu_head
*rcu
)
6313 struct nft_set_gc_batch
*gcb
;
6316 gcb
= container_of(rcu
, struct nft_set_gc_batch
, head
.rcu
);
6317 for (i
= 0; i
< gcb
->head
.cnt
; i
++)
6318 nft_set_elem_destroy(gcb
->head
.set
, gcb
->elems
[i
], true);
6322 struct nft_set_gc_batch
*nft_set_gc_batch_alloc(const struct nft_set
*set
,
6325 struct nft_set_gc_batch
*gcb
;
6327 gcb
= kzalloc(sizeof(*gcb
), gfp
);
6330 gcb
->head
.set
= set
;
6339 * nft_register_obj- register nf_tables stateful object type
6340 * @obj_type: object type
6342 * Registers the object type for use with nf_tables. Returns zero on
6343 * success or a negative errno code otherwise.
6345 int nft_register_obj(struct nft_object_type
*obj_type
)
6347 if (obj_type
->type
== NFT_OBJECT_UNSPEC
)
6350 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
6351 list_add_rcu(&obj_type
->list
, &nf_tables_objects
);
6352 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
6355 EXPORT_SYMBOL_GPL(nft_register_obj
);
6358 * nft_unregister_obj - unregister nf_tables object type
6359 * @obj_type: object type
6361 * Unregisters the object type for use with nf_tables.
6363 void nft_unregister_obj(struct nft_object_type
*obj_type
)
6365 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
6366 list_del_rcu(&obj_type
->list
);
6367 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
6369 EXPORT_SYMBOL_GPL(nft_unregister_obj
);
6371 struct nft_object
*nft_obj_lookup(const struct net
*net
,
6372 const struct nft_table
*table
,
6373 const struct nlattr
*nla
, u32 objtype
,
6376 struct nft_object_hash_key k
= { .table
= table
};
6377 char search
[NFT_OBJ_MAXNAMELEN
];
6378 struct rhlist_head
*tmp
, *list
;
6379 struct nft_object
*obj
;
6381 nla_strscpy(search
, nla
, sizeof(search
));
6384 WARN_ON_ONCE(!rcu_read_lock_held() &&
6385 !lockdep_commit_lock_is_held(net
));
6388 list
= rhltable_lookup(&nft_objname_ht
, &k
, nft_objname_ht_params
);
6392 rhl_for_each_entry_rcu(obj
, tmp
, list
, rhlhead
) {
6393 if (objtype
== obj
->ops
->type
->type
&&
6394 nft_active_genmask(obj
, genmask
)) {
6401 return ERR_PTR(-ENOENT
);
6403 EXPORT_SYMBOL_GPL(nft_obj_lookup
);
6405 static struct nft_object
*nft_obj_lookup_byhandle(const struct nft_table
*table
,
6406 const struct nlattr
*nla
,
6407 u32 objtype
, u8 genmask
)
6409 struct nft_object
*obj
;
6411 list_for_each_entry(obj
, &table
->objects
, list
) {
6412 if (be64_to_cpu(nla_get_be64(nla
)) == obj
->handle
&&
6413 objtype
== obj
->ops
->type
->type
&&
6414 nft_active_genmask(obj
, genmask
))
6417 return ERR_PTR(-ENOENT
);
6420 static const struct nla_policy nft_obj_policy
[NFTA_OBJ_MAX
+ 1] = {
6421 [NFTA_OBJ_TABLE
] = { .type
= NLA_STRING
,
6422 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
6423 [NFTA_OBJ_NAME
] = { .type
= NLA_STRING
,
6424 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
6425 [NFTA_OBJ_TYPE
] = { .type
= NLA_U32
},
6426 [NFTA_OBJ_DATA
] = { .type
= NLA_NESTED
},
6427 [NFTA_OBJ_HANDLE
] = { .type
= NLA_U64
},
6428 [NFTA_OBJ_USERDATA
] = { .type
= NLA_BINARY
,
6429 .len
= NFT_USERDATA_MAXLEN
},
6432 static struct nft_object
*nft_obj_init(const struct nft_ctx
*ctx
,
6433 const struct nft_object_type
*type
,
6434 const struct nlattr
*attr
)
6437 const struct nft_object_ops
*ops
;
6438 struct nft_object
*obj
;
6441 tb
= kmalloc_array(type
->maxattr
+ 1, sizeof(*tb
), GFP_KERNEL
);
6446 err
= nla_parse_nested_deprecated(tb
, type
->maxattr
, attr
,
6447 type
->policy
, NULL
);
6451 memset(tb
, 0, sizeof(tb
[0]) * (type
->maxattr
+ 1));
6454 if (type
->select_ops
) {
6455 ops
= type
->select_ops(ctx
, (const struct nlattr
* const *)tb
);
6465 obj
= kzalloc(sizeof(*obj
) + ops
->size
, GFP_KERNEL
);
6469 err
= ops
->init(ctx
, (const struct nlattr
* const *)tb
, obj
);
6482 return ERR_PTR(err
);
6485 static int nft_object_dump(struct sk_buff
*skb
, unsigned int attr
,
6486 struct nft_object
*obj
, bool reset
)
6488 struct nlattr
*nest
;
6490 nest
= nla_nest_start_noflag(skb
, attr
);
6492 goto nla_put_failure
;
6493 if (obj
->ops
->dump(skb
, obj
, reset
) < 0)
6494 goto nla_put_failure
;
6495 nla_nest_end(skb
, nest
);
6502 static const struct nft_object_type
*__nft_obj_type_get(u32 objtype
)
6504 const struct nft_object_type
*type
;
6506 list_for_each_entry(type
, &nf_tables_objects
, list
) {
6507 if (objtype
== type
->type
)
6513 static const struct nft_object_type
*
6514 nft_obj_type_get(struct net
*net
, u32 objtype
)
6516 const struct nft_object_type
*type
;
6518 type
= __nft_obj_type_get(objtype
);
6519 if (type
!= NULL
&& try_module_get(type
->owner
))
6522 lockdep_nfnl_nft_mutex_not_held();
6523 #ifdef CONFIG_MODULES
6525 if (nft_request_module(net
, "nft-obj-%u", objtype
) == -EAGAIN
)
6526 return ERR_PTR(-EAGAIN
);
6529 return ERR_PTR(-ENOENT
);
6532 static int nf_tables_updobj(const struct nft_ctx
*ctx
,
6533 const struct nft_object_type
*type
,
6534 const struct nlattr
*attr
,
6535 struct nft_object
*obj
)
6537 struct nft_object
*newobj
;
6538 struct nft_trans
*trans
;
6541 if (!try_module_get(type
->owner
))
6544 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWOBJ
,
6545 sizeof(struct nft_trans_obj
));
6549 newobj
= nft_obj_init(ctx
, type
, attr
);
6550 if (IS_ERR(newobj
)) {
6551 err
= PTR_ERR(newobj
);
6552 goto err_free_trans
;
6555 nft_trans_obj(trans
) = obj
;
6556 nft_trans_obj_update(trans
) = true;
6557 nft_trans_obj_newobj(trans
) = newobj
;
6558 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6565 module_put(type
->owner
);
6569 static int nf_tables_newobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
6570 const struct nlattr
* const nla
[])
6572 struct netlink_ext_ack
*extack
= info
->extack
;
6573 u8 genmask
= nft_genmask_next(info
->net
);
6574 u8 family
= info
->nfmsg
->nfgen_family
;
6575 const struct nft_object_type
*type
;
6576 struct net
*net
= info
->net
;
6577 struct nft_table
*table
;
6578 struct nft_object
*obj
;
6583 if (!nla
[NFTA_OBJ_TYPE
] ||
6584 !nla
[NFTA_OBJ_NAME
] ||
6585 !nla
[NFTA_OBJ_DATA
])
6588 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
6589 NETLINK_CB(skb
).portid
);
6590 if (IS_ERR(table
)) {
6591 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6592 return PTR_ERR(table
);
6595 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6596 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
6599 if (err
!= -ENOENT
) {
6600 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6604 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
6605 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6608 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
6611 type
= __nft_obj_type_get(objtype
);
6612 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6614 return nf_tables_updobj(&ctx
, type
, nla
[NFTA_OBJ_DATA
], obj
);
6617 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6619 type
= nft_obj_type_get(net
, objtype
);
6621 return PTR_ERR(type
);
6623 obj
= nft_obj_init(&ctx
, type
, nla
[NFTA_OBJ_DATA
]);
6628 obj
->key
.table
= table
;
6629 obj
->handle
= nf_tables_alloc_handle(table
);
6631 obj
->key
.name
= nla_strdup(nla
[NFTA_OBJ_NAME
], GFP_KERNEL
);
6632 if (!obj
->key
.name
) {
6637 if (nla
[NFTA_OBJ_USERDATA
]) {
6638 obj
->udata
= nla_memdup(nla
[NFTA_OBJ_USERDATA
], GFP_KERNEL
);
6639 if (obj
->udata
== NULL
)
6642 obj
->udlen
= nla_len(nla
[NFTA_OBJ_USERDATA
]);
6645 err
= nft_trans_obj_add(&ctx
, NFT_MSG_NEWOBJ
, obj
);
6649 err
= rhltable_insert(&nft_objname_ht
, &obj
->rhlhead
,
6650 nft_objname_ht_params
);
6654 list_add_tail_rcu(&obj
->list
, &table
->objects
);
6658 /* queued in transaction log */
6659 INIT_LIST_HEAD(&obj
->list
);
6664 kfree(obj
->key
.name
);
6666 if (obj
->ops
->destroy
)
6667 obj
->ops
->destroy(&ctx
, obj
);
6670 module_put(type
->owner
);
6674 static int nf_tables_fill_obj_info(struct sk_buff
*skb
, struct net
*net
,
6675 u32 portid
, u32 seq
, int event
, u32 flags
,
6676 int family
, const struct nft_table
*table
,
6677 struct nft_object
*obj
, bool reset
)
6679 struct nlmsghdr
*nlh
;
6681 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
6682 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
6683 NFNETLINK_V0
, nft_base_seq(net
));
6685 goto nla_put_failure
;
6687 if (nla_put_string(skb
, NFTA_OBJ_TABLE
, table
->name
) ||
6688 nla_put_string(skb
, NFTA_OBJ_NAME
, obj
->key
.name
) ||
6689 nla_put_be32(skb
, NFTA_OBJ_TYPE
, htonl(obj
->ops
->type
->type
)) ||
6690 nla_put_be32(skb
, NFTA_OBJ_USE
, htonl(obj
->use
)) ||
6691 nft_object_dump(skb
, NFTA_OBJ_DATA
, obj
, reset
) ||
6692 nla_put_be64(skb
, NFTA_OBJ_HANDLE
, cpu_to_be64(obj
->handle
),
6694 goto nla_put_failure
;
6697 nla_put(skb
, NFTA_OBJ_USERDATA
, obj
->udlen
, obj
->udata
))
6698 goto nla_put_failure
;
6700 nlmsg_end(skb
, nlh
);
6704 nlmsg_trim(skb
, nlh
);
6708 struct nft_obj_filter
{
6713 static int nf_tables_dump_obj(struct sk_buff
*skb
, struct netlink_callback
*cb
)
6715 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
6716 const struct nft_table
*table
;
6717 unsigned int idx
= 0, s_idx
= cb
->args
[0];
6718 struct nft_obj_filter
*filter
= cb
->data
;
6719 struct net
*net
= sock_net(skb
->sk
);
6720 int family
= nfmsg
->nfgen_family
;
6721 struct nftables_pernet
*nft_net
;
6722 struct nft_object
*obj
;
6725 if (NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
6729 nft_net
= nft_pernet(net
);
6730 cb
->seq
= nft_net
->base_seq
;
6732 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
6733 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
6736 list_for_each_entry_rcu(obj
, &table
->objects
, list
) {
6737 if (!nft_is_active(net
, obj
))
6742 memset(&cb
->args
[1], 0,
6743 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
6744 if (filter
&& filter
->table
&&
6745 strcmp(filter
->table
, table
->name
))
6748 filter
->type
!= NFT_OBJECT_UNSPEC
&&
6749 obj
->ops
->type
->type
!= filter
->type
)
6752 char *buf
= kasprintf(GFP_ATOMIC
,
6757 audit_log_nfcfg(buf
,
6760 AUDIT_NFT_OP_OBJ_RESET
,
6765 if (nf_tables_fill_obj_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
6768 NLM_F_MULTI
| NLM_F_APPEND
,
6769 table
->family
, table
,
6773 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
6785 static int nf_tables_dump_obj_start(struct netlink_callback
*cb
)
6787 const struct nlattr
* const *nla
= cb
->data
;
6788 struct nft_obj_filter
*filter
= NULL
;
6790 if (nla
[NFTA_OBJ_TABLE
] || nla
[NFTA_OBJ_TYPE
]) {
6791 filter
= kzalloc(sizeof(*filter
), GFP_ATOMIC
);
6795 if (nla
[NFTA_OBJ_TABLE
]) {
6796 filter
->table
= nla_strdup(nla
[NFTA_OBJ_TABLE
], GFP_ATOMIC
);
6797 if (!filter
->table
) {
6803 if (nla
[NFTA_OBJ_TYPE
])
6804 filter
->type
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6811 static int nf_tables_dump_obj_done(struct netlink_callback
*cb
)
6813 struct nft_obj_filter
*filter
= cb
->data
;
6816 kfree(filter
->table
);
6823 /* called with rcu_read_lock held */
6824 static int nf_tables_getobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
6825 const struct nlattr
* const nla
[])
6827 struct netlink_ext_ack
*extack
= info
->extack
;
6828 u8 genmask
= nft_genmask_cur(info
->net
);
6829 u8 family
= info
->nfmsg
->nfgen_family
;
6830 const struct nft_table
*table
;
6831 struct net
*net
= info
->net
;
6832 struct nft_object
*obj
;
6833 struct sk_buff
*skb2
;
6838 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
6839 struct netlink_dump_control c
= {
6840 .start
= nf_tables_dump_obj_start
,
6841 .dump
= nf_tables_dump_obj
,
6842 .done
= nf_tables_dump_obj_done
,
6843 .module
= THIS_MODULE
,
6844 .data
= (void *)nla
,
6847 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
6850 if (!nla
[NFTA_OBJ_NAME
] ||
6851 !nla
[NFTA_OBJ_TYPE
])
6854 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
, 0);
6855 if (IS_ERR(table
)) {
6856 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6857 return PTR_ERR(table
);
6860 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6861 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
6863 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6864 return PTR_ERR(obj
);
6867 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
6871 if (NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
6875 const struct nftables_pernet
*nft_net
;
6878 nft_net
= nft_pernet(net
);
6879 buf
= kasprintf(GFP_ATOMIC
, "%s:%u", table
->name
, nft_net
->base_seq
);
6881 audit_log_nfcfg(buf
,
6884 AUDIT_NFT_OP_OBJ_RESET
,
6889 err
= nf_tables_fill_obj_info(skb2
, net
, NETLINK_CB(skb
).portid
,
6890 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWOBJ
, 0,
6891 family
, table
, obj
, reset
);
6893 goto err_fill_obj_info
;
6895 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
6902 static void nft_obj_destroy(const struct nft_ctx
*ctx
, struct nft_object
*obj
)
6904 if (obj
->ops
->destroy
)
6905 obj
->ops
->destroy(ctx
, obj
);
6907 module_put(obj
->ops
->type
->owner
);
6908 kfree(obj
->key
.name
);
6913 static int nf_tables_delobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
6914 const struct nlattr
* const nla
[])
6916 struct netlink_ext_ack
*extack
= info
->extack
;
6917 u8 genmask
= nft_genmask_next(info
->net
);
6918 u8 family
= info
->nfmsg
->nfgen_family
;
6919 struct net
*net
= info
->net
;
6920 const struct nlattr
*attr
;
6921 struct nft_table
*table
;
6922 struct nft_object
*obj
;
6926 if (!nla
[NFTA_OBJ_TYPE
] ||
6927 (!nla
[NFTA_OBJ_NAME
] && !nla
[NFTA_OBJ_HANDLE
]))
6930 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
6931 NETLINK_CB(skb
).portid
);
6932 if (IS_ERR(table
)) {
6933 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6934 return PTR_ERR(table
);
6937 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6938 if (nla
[NFTA_OBJ_HANDLE
]) {
6939 attr
= nla
[NFTA_OBJ_HANDLE
];
6940 obj
= nft_obj_lookup_byhandle(table
, attr
, objtype
, genmask
);
6942 attr
= nla
[NFTA_OBJ_NAME
];
6943 obj
= nft_obj_lookup(net
, table
, attr
, objtype
, genmask
);
6947 NL_SET_BAD_ATTR(extack
, attr
);
6948 return PTR_ERR(obj
);
6951 NL_SET_BAD_ATTR(extack
, attr
);
6955 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6957 return nft_delobj(&ctx
, obj
);
6960 void nft_obj_notify(struct net
*net
, const struct nft_table
*table
,
6961 struct nft_object
*obj
, u32 portid
, u32 seq
, int event
,
6962 u16 flags
, int family
, int report
, gfp_t gfp
)
6964 struct nftables_pernet
*nft_net
= nft_pernet(net
);
6965 struct sk_buff
*skb
;
6967 char *buf
= kasprintf(gfp
, "%s:%u",
6968 table
->name
, nft_net
->base_seq
);
6970 audit_log_nfcfg(buf
,
6973 event
== NFT_MSG_NEWOBJ
?
6974 AUDIT_NFT_OP_OBJ_REGISTER
:
6975 AUDIT_NFT_OP_OBJ_UNREGISTER
,
6980 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
6983 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp
);
6987 err
= nf_tables_fill_obj_info(skb
, net
, portid
, seq
, event
,
6988 flags
& (NLM_F_CREATE
| NLM_F_EXCL
),
6989 family
, table
, obj
, false);
6995 nft_notify_enqueue(skb
, report
, &nft_net
->notify_list
);
6998 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
7000 EXPORT_SYMBOL_GPL(nft_obj_notify
);
7002 static void nf_tables_obj_notify(const struct nft_ctx
*ctx
,
7003 struct nft_object
*obj
, int event
)
7005 nft_obj_notify(ctx
->net
, ctx
->table
, obj
, ctx
->portid
, ctx
->seq
, event
,
7006 ctx
->flags
, ctx
->family
, ctx
->report
, GFP_KERNEL
);
7012 void nft_register_flowtable_type(struct nf_flowtable_type
*type
)
7014 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7015 list_add_tail_rcu(&type
->list
, &nf_tables_flowtables
);
7016 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7018 EXPORT_SYMBOL_GPL(nft_register_flowtable_type
);
7020 void nft_unregister_flowtable_type(struct nf_flowtable_type
*type
)
7022 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7023 list_del_rcu(&type
->list
);
7024 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7026 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type
);
7028 static const struct nla_policy nft_flowtable_policy
[NFTA_FLOWTABLE_MAX
+ 1] = {
7029 [NFTA_FLOWTABLE_TABLE
] = { .type
= NLA_STRING
,
7030 .len
= NFT_NAME_MAXLEN
- 1 },
7031 [NFTA_FLOWTABLE_NAME
] = { .type
= NLA_STRING
,
7032 .len
= NFT_NAME_MAXLEN
- 1 },
7033 [NFTA_FLOWTABLE_HOOK
] = { .type
= NLA_NESTED
},
7034 [NFTA_FLOWTABLE_HANDLE
] = { .type
= NLA_U64
},
7035 [NFTA_FLOWTABLE_FLAGS
] = { .type
= NLA_U32
},
7038 struct nft_flowtable
*nft_flowtable_lookup(const struct nft_table
*table
,
7039 const struct nlattr
*nla
, u8 genmask
)
7041 struct nft_flowtable
*flowtable
;
7043 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
7044 if (!nla_strcmp(nla
, flowtable
->name
) &&
7045 nft_active_genmask(flowtable
, genmask
))
7048 return ERR_PTR(-ENOENT
);
7050 EXPORT_SYMBOL_GPL(nft_flowtable_lookup
);
7052 void nf_tables_deactivate_flowtable(const struct nft_ctx
*ctx
,
7053 struct nft_flowtable
*flowtable
,
7054 enum nft_trans_phase phase
)
7057 case NFT_TRANS_PREPARE
:
7058 case NFT_TRANS_ABORT
:
7059 case NFT_TRANS_RELEASE
:
7066 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable
);
7068 static struct nft_flowtable
*
7069 nft_flowtable_lookup_byhandle(const struct nft_table
*table
,
7070 const struct nlattr
*nla
, u8 genmask
)
7072 struct nft_flowtable
*flowtable
;
7074 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
7075 if (be64_to_cpu(nla_get_be64(nla
)) == flowtable
->handle
&&
7076 nft_active_genmask(flowtable
, genmask
))
7079 return ERR_PTR(-ENOENT
);
7082 struct nft_flowtable_hook
{
7085 struct list_head list
;
7088 static const struct nla_policy nft_flowtable_hook_policy
[NFTA_FLOWTABLE_HOOK_MAX
+ 1] = {
7089 [NFTA_FLOWTABLE_HOOK_NUM
] = { .type
= NLA_U32
},
7090 [NFTA_FLOWTABLE_HOOK_PRIORITY
] = { .type
= NLA_U32
},
7091 [NFTA_FLOWTABLE_HOOK_DEVS
] = { .type
= NLA_NESTED
},
7094 static int nft_flowtable_parse_hook(const struct nft_ctx
*ctx
,
7095 const struct nlattr
*attr
,
7096 struct nft_flowtable_hook
*flowtable_hook
,
7097 struct nft_flowtable
*flowtable
, bool add
)
7099 struct nlattr
*tb
[NFTA_FLOWTABLE_HOOK_MAX
+ 1];
7100 struct nft_hook
*hook
;
7101 int hooknum
, priority
;
7104 INIT_LIST_HEAD(&flowtable_hook
->list
);
7106 err
= nla_parse_nested_deprecated(tb
, NFTA_FLOWTABLE_HOOK_MAX
, attr
,
7107 nft_flowtable_hook_policy
, NULL
);
7112 if (!tb
[NFTA_FLOWTABLE_HOOK_NUM
] ||
7113 !tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
])
7116 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
7117 if (hooknum
!= NF_NETDEV_INGRESS
)
7120 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
7122 flowtable_hook
->priority
= priority
;
7123 flowtable_hook
->num
= hooknum
;
7125 if (tb
[NFTA_FLOWTABLE_HOOK_NUM
]) {
7126 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
7127 if (hooknum
!= flowtable
->hooknum
)
7131 if (tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]) {
7132 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
7133 if (priority
!= flowtable
->data
.priority
)
7137 flowtable_hook
->priority
= flowtable
->data
.priority
;
7138 flowtable_hook
->num
= flowtable
->hooknum
;
7141 if (tb
[NFTA_FLOWTABLE_HOOK_DEVS
]) {
7142 err
= nf_tables_parse_netdev_hooks(ctx
->net
,
7143 tb
[NFTA_FLOWTABLE_HOOK_DEVS
],
7144 &flowtable_hook
->list
);
7149 list_for_each_entry(hook
, &flowtable_hook
->list
, list
) {
7150 hook
->ops
.pf
= NFPROTO_NETDEV
;
7151 hook
->ops
.hooknum
= flowtable_hook
->num
;
7152 hook
->ops
.priority
= flowtable_hook
->priority
;
7153 hook
->ops
.priv
= &flowtable
->data
;
7154 hook
->ops
.hook
= flowtable
->data
.type
->hook
;
7160 static const struct nf_flowtable_type
*__nft_flowtable_type_get(u8 family
)
7162 const struct nf_flowtable_type
*type
;
7164 list_for_each_entry(type
, &nf_tables_flowtables
, list
) {
7165 if (family
== type
->family
)
7171 static const struct nf_flowtable_type
*
7172 nft_flowtable_type_get(struct net
*net
, u8 family
)
7174 const struct nf_flowtable_type
*type
;
7176 type
= __nft_flowtable_type_get(family
);
7177 if (type
!= NULL
&& try_module_get(type
->owner
))
7180 lockdep_nfnl_nft_mutex_not_held();
7181 #ifdef CONFIG_MODULES
7183 if (nft_request_module(net
, "nf-flowtable-%u", family
) == -EAGAIN
)
7184 return ERR_PTR(-EAGAIN
);
7187 return ERR_PTR(-ENOENT
);
7190 /* Only called from error and netdev event paths. */
7191 static void nft_unregister_flowtable_hook(struct net
*net
,
7192 struct nft_flowtable
*flowtable
,
7193 struct nft_hook
*hook
)
7195 nf_unregister_net_hook(net
, &hook
->ops
);
7196 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
7200 static void nft_unregister_flowtable_net_hooks(struct net
*net
,
7201 struct list_head
*hook_list
)
7203 struct nft_hook
*hook
;
7205 list_for_each_entry(hook
, hook_list
, list
)
7206 nf_unregister_net_hook(net
, &hook
->ops
);
7209 static int nft_register_flowtable_net_hooks(struct net
*net
,
7210 struct nft_table
*table
,
7211 struct list_head
*hook_list
,
7212 struct nft_flowtable
*flowtable
)
7214 struct nft_hook
*hook
, *hook2
, *next
;
7215 struct nft_flowtable
*ft
;
7218 list_for_each_entry(hook
, hook_list
, list
) {
7219 list_for_each_entry(ft
, &table
->flowtables
, list
) {
7220 if (!nft_is_active_next(net
, ft
))
7223 list_for_each_entry(hook2
, &ft
->hook_list
, list
) {
7224 if (hook
->ops
.dev
== hook2
->ops
.dev
&&
7225 hook
->ops
.pf
== hook2
->ops
.pf
) {
7227 goto err_unregister_net_hooks
;
7232 err
= flowtable
->data
.type
->setup(&flowtable
->data
,
7236 goto err_unregister_net_hooks
;
7238 err
= nf_register_net_hook(net
, &hook
->ops
);
7240 flowtable
->data
.type
->setup(&flowtable
->data
,
7243 goto err_unregister_net_hooks
;
7251 err_unregister_net_hooks
:
7252 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
7256 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
7257 list_del_rcu(&hook
->list
);
7258 kfree_rcu(hook
, rcu
);
7264 static void nft_flowtable_hooks_destroy(struct list_head
*hook_list
)
7266 struct nft_hook
*hook
, *next
;
7268 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
7269 list_del_rcu(&hook
->list
);
7270 kfree_rcu(hook
, rcu
);
7274 static int nft_flowtable_update(struct nft_ctx
*ctx
, const struct nlmsghdr
*nlh
,
7275 struct nft_flowtable
*flowtable
)
7277 const struct nlattr
* const *nla
= ctx
->nla
;
7278 struct nft_flowtable_hook flowtable_hook
;
7279 struct nft_hook
*hook
, *next
;
7280 struct nft_trans
*trans
;
7281 bool unregister
= false;
7285 err
= nft_flowtable_parse_hook(ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
7286 &flowtable_hook
, flowtable
, false);
7290 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
7291 if (nft_hook_list_find(&flowtable
->hook_list
, hook
)) {
7292 list_del(&hook
->list
);
7297 if (nla
[NFTA_FLOWTABLE_FLAGS
]) {
7298 flags
= ntohl(nla_get_be32(nla
[NFTA_FLOWTABLE_FLAGS
]));
7299 if (flags
& ~NFT_FLOWTABLE_MASK
)
7301 if ((flowtable
->data
.flags
& NFT_FLOWTABLE_HW_OFFLOAD
) ^
7302 (flags
& NFT_FLOWTABLE_HW_OFFLOAD
))
7305 flags
= flowtable
->data
.flags
;
7308 err
= nft_register_flowtable_net_hooks(ctx
->net
, ctx
->table
,
7309 &flowtable_hook
.list
, flowtable
);
7311 goto err_flowtable_update_hook
;
7313 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWFLOWTABLE
,
7314 sizeof(struct nft_trans_flowtable
));
7318 goto err_flowtable_update_hook
;
7321 nft_trans_flowtable_flags(trans
) = flags
;
7322 nft_trans_flowtable(trans
) = flowtable
;
7323 nft_trans_flowtable_update(trans
) = true;
7324 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
7325 list_splice(&flowtable_hook
.list
, &nft_trans_flowtable_hooks(trans
));
7327 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7331 err_flowtable_update_hook
:
7332 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
7334 nft_unregister_flowtable_hook(ctx
->net
, flowtable
, hook
);
7335 list_del_rcu(&hook
->list
);
7336 kfree_rcu(hook
, rcu
);
7343 static int nf_tables_newflowtable(struct sk_buff
*skb
,
7344 const struct nfnl_info
*info
,
7345 const struct nlattr
* const nla
[])
7347 struct netlink_ext_ack
*extack
= info
->extack
;
7348 struct nft_flowtable_hook flowtable_hook
;
7349 u8 genmask
= nft_genmask_next(info
->net
);
7350 u8 family
= info
->nfmsg
->nfgen_family
;
7351 const struct nf_flowtable_type
*type
;
7352 struct nft_flowtable
*flowtable
;
7353 struct nft_hook
*hook
, *next
;
7354 struct net
*net
= info
->net
;
7355 struct nft_table
*table
;
7359 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
7360 !nla
[NFTA_FLOWTABLE_NAME
] ||
7361 !nla
[NFTA_FLOWTABLE_HOOK
])
7364 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7365 genmask
, NETLINK_CB(skb
).portid
);
7366 if (IS_ERR(table
)) {
7367 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
7368 return PTR_ERR(table
);
7371 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
7373 if (IS_ERR(flowtable
)) {
7374 err
= PTR_ERR(flowtable
);
7375 if (err
!= -ENOENT
) {
7376 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
7380 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
7381 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
7385 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7387 return nft_flowtable_update(&ctx
, info
->nlh
, flowtable
);
7390 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7392 flowtable
= kzalloc(sizeof(*flowtable
), GFP_KERNEL
);
7396 flowtable
->table
= table
;
7397 flowtable
->handle
= nf_tables_alloc_handle(table
);
7398 INIT_LIST_HEAD(&flowtable
->hook_list
);
7400 flowtable
->name
= nla_strdup(nla
[NFTA_FLOWTABLE_NAME
], GFP_KERNEL
);
7401 if (!flowtable
->name
) {
7406 type
= nft_flowtable_type_get(net
, family
);
7408 err
= PTR_ERR(type
);
7412 if (nla
[NFTA_FLOWTABLE_FLAGS
]) {
7413 flowtable
->data
.flags
=
7414 ntohl(nla_get_be32(nla
[NFTA_FLOWTABLE_FLAGS
]));
7415 if (flowtable
->data
.flags
& ~NFT_FLOWTABLE_MASK
) {
7421 write_pnet(&flowtable
->data
.net
, net
);
7422 flowtable
->data
.type
= type
;
7423 err
= type
->init(&flowtable
->data
);
7427 err
= nft_flowtable_parse_hook(&ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
7428 &flowtable_hook
, flowtable
, true);
7432 list_splice(&flowtable_hook
.list
, &flowtable
->hook_list
);
7433 flowtable
->data
.priority
= flowtable_hook
.priority
;
7434 flowtable
->hooknum
= flowtable_hook
.num
;
7436 err
= nft_register_flowtable_net_hooks(ctx
.net
, table
,
7437 &flowtable
->hook_list
,
7440 nft_flowtable_hooks_destroy(&flowtable
->hook_list
);
7444 err
= nft_trans_flowtable_add(&ctx
, NFT_MSG_NEWFLOWTABLE
, flowtable
);
7448 list_add_tail_rcu(&flowtable
->list
, &table
->flowtables
);
7453 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
7454 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
7455 list_del_rcu(&hook
->list
);
7456 kfree_rcu(hook
, rcu
);
7459 flowtable
->data
.type
->free(&flowtable
->data
);
7461 module_put(type
->owner
);
7463 kfree(flowtable
->name
);
7469 static void nft_flowtable_hook_release(struct nft_flowtable_hook
*flowtable_hook
)
7471 struct nft_hook
*this, *next
;
7473 list_for_each_entry_safe(this, next
, &flowtable_hook
->list
, list
) {
7474 list_del(&this->list
);
7479 static int nft_delflowtable_hook(struct nft_ctx
*ctx
,
7480 struct nft_flowtable
*flowtable
)
7482 const struct nlattr
* const *nla
= ctx
->nla
;
7483 struct nft_flowtable_hook flowtable_hook
;
7484 struct nft_hook
*this, *hook
;
7485 struct nft_trans
*trans
;
7488 err
= nft_flowtable_parse_hook(ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
7489 &flowtable_hook
, flowtable
, false);
7493 list_for_each_entry(this, &flowtable_hook
.list
, list
) {
7494 hook
= nft_hook_list_find(&flowtable
->hook_list
, this);
7497 goto err_flowtable_del_hook
;
7499 hook
->inactive
= true;
7502 trans
= nft_trans_alloc(ctx
, NFT_MSG_DELFLOWTABLE
,
7503 sizeof(struct nft_trans_flowtable
));
7506 goto err_flowtable_del_hook
;
7509 nft_trans_flowtable(trans
) = flowtable
;
7510 nft_trans_flowtable_update(trans
) = true;
7511 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
7512 nft_flowtable_hook_release(&flowtable_hook
);
7514 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7518 err_flowtable_del_hook
:
7519 list_for_each_entry(this, &flowtable_hook
.list
, list
) {
7520 hook
= nft_hook_list_find(&flowtable
->hook_list
, this);
7524 hook
->inactive
= false;
7526 nft_flowtable_hook_release(&flowtable_hook
);
7531 static int nf_tables_delflowtable(struct sk_buff
*skb
,
7532 const struct nfnl_info
*info
,
7533 const struct nlattr
* const nla
[])
7535 struct netlink_ext_ack
*extack
= info
->extack
;
7536 u8 genmask
= nft_genmask_next(info
->net
);
7537 u8 family
= info
->nfmsg
->nfgen_family
;
7538 struct nft_flowtable
*flowtable
;
7539 struct net
*net
= info
->net
;
7540 const struct nlattr
*attr
;
7541 struct nft_table
*table
;
7544 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
7545 (!nla
[NFTA_FLOWTABLE_NAME
] &&
7546 !nla
[NFTA_FLOWTABLE_HANDLE
]))
7549 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7550 genmask
, NETLINK_CB(skb
).portid
);
7551 if (IS_ERR(table
)) {
7552 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
7553 return PTR_ERR(table
);
7556 if (nla
[NFTA_FLOWTABLE_HANDLE
]) {
7557 attr
= nla
[NFTA_FLOWTABLE_HANDLE
];
7558 flowtable
= nft_flowtable_lookup_byhandle(table
, attr
, genmask
);
7560 attr
= nla
[NFTA_FLOWTABLE_NAME
];
7561 flowtable
= nft_flowtable_lookup(table
, attr
, genmask
);
7564 if (IS_ERR(flowtable
)) {
7565 NL_SET_BAD_ATTR(extack
, attr
);
7566 return PTR_ERR(flowtable
);
7569 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7571 if (nla
[NFTA_FLOWTABLE_HOOK
])
7572 return nft_delflowtable_hook(&ctx
, flowtable
);
7574 if (flowtable
->use
> 0) {
7575 NL_SET_BAD_ATTR(extack
, attr
);
7579 return nft_delflowtable(&ctx
, flowtable
);
7582 static int nf_tables_fill_flowtable_info(struct sk_buff
*skb
, struct net
*net
,
7583 u32 portid
, u32 seq
, int event
,
7584 u32 flags
, int family
,
7585 struct nft_flowtable
*flowtable
,
7586 struct list_head
*hook_list
)
7588 struct nlattr
*nest
, *nest_devs
;
7589 struct nft_hook
*hook
;
7590 struct nlmsghdr
*nlh
;
7592 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
7593 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
7594 NFNETLINK_V0
, nft_base_seq(net
));
7596 goto nla_put_failure
;
7598 if (nla_put_string(skb
, NFTA_FLOWTABLE_TABLE
, flowtable
->table
->name
) ||
7599 nla_put_string(skb
, NFTA_FLOWTABLE_NAME
, flowtable
->name
) ||
7600 nla_put_be32(skb
, NFTA_FLOWTABLE_USE
, htonl(flowtable
->use
)) ||
7601 nla_put_be64(skb
, NFTA_FLOWTABLE_HANDLE
, cpu_to_be64(flowtable
->handle
),
7602 NFTA_FLOWTABLE_PAD
) ||
7603 nla_put_be32(skb
, NFTA_FLOWTABLE_FLAGS
, htonl(flowtable
->data
.flags
)))
7604 goto nla_put_failure
;
7606 nest
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK
);
7608 goto nla_put_failure
;
7609 if (nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_NUM
, htonl(flowtable
->hooknum
)) ||
7610 nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_PRIORITY
, htonl(flowtable
->data
.priority
)))
7611 goto nla_put_failure
;
7613 nest_devs
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK_DEVS
);
7615 goto nla_put_failure
;
7617 list_for_each_entry_rcu(hook
, hook_list
, list
) {
7618 if (nla_put_string(skb
, NFTA_DEVICE_NAME
, hook
->ops
.dev
->name
))
7619 goto nla_put_failure
;
7621 nla_nest_end(skb
, nest_devs
);
7622 nla_nest_end(skb
, nest
);
7624 nlmsg_end(skb
, nlh
);
7628 nlmsg_trim(skb
, nlh
);
7632 struct nft_flowtable_filter
{
7636 static int nf_tables_dump_flowtable(struct sk_buff
*skb
,
7637 struct netlink_callback
*cb
)
7639 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
7640 struct nft_flowtable_filter
*filter
= cb
->data
;
7641 unsigned int idx
= 0, s_idx
= cb
->args
[0];
7642 struct net
*net
= sock_net(skb
->sk
);
7643 int family
= nfmsg
->nfgen_family
;
7644 struct nft_flowtable
*flowtable
;
7645 struct nftables_pernet
*nft_net
;
7646 const struct nft_table
*table
;
7649 nft_net
= nft_pernet(net
);
7650 cb
->seq
= nft_net
->base_seq
;
7652 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
7653 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
7656 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
7657 if (!nft_is_active(net
, flowtable
))
7662 memset(&cb
->args
[1], 0,
7663 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
7664 if (filter
&& filter
->table
&&
7665 strcmp(filter
->table
, table
->name
))
7668 if (nf_tables_fill_flowtable_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
7670 NFT_MSG_NEWFLOWTABLE
,
7671 NLM_F_MULTI
| NLM_F_APPEND
,
7674 &flowtable
->hook_list
) < 0)
7677 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
7689 static int nf_tables_dump_flowtable_start(struct netlink_callback
*cb
)
7691 const struct nlattr
* const *nla
= cb
->data
;
7692 struct nft_flowtable_filter
*filter
= NULL
;
7694 if (nla
[NFTA_FLOWTABLE_TABLE
]) {
7695 filter
= kzalloc(sizeof(*filter
), GFP_ATOMIC
);
7699 filter
->table
= nla_strdup(nla
[NFTA_FLOWTABLE_TABLE
],
7701 if (!filter
->table
) {
7711 static int nf_tables_dump_flowtable_done(struct netlink_callback
*cb
)
7713 struct nft_flowtable_filter
*filter
= cb
->data
;
7718 kfree(filter
->table
);
7724 /* called with rcu_read_lock held */
7725 static int nf_tables_getflowtable(struct sk_buff
*skb
,
7726 const struct nfnl_info
*info
,
7727 const struct nlattr
* const nla
[])
7729 u8 genmask
= nft_genmask_cur(info
->net
);
7730 u8 family
= info
->nfmsg
->nfgen_family
;
7731 struct nft_flowtable
*flowtable
;
7732 const struct nft_table
*table
;
7733 struct net
*net
= info
->net
;
7734 struct sk_buff
*skb2
;
7737 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
7738 struct netlink_dump_control c
= {
7739 .start
= nf_tables_dump_flowtable_start
,
7740 .dump
= nf_tables_dump_flowtable
,
7741 .done
= nf_tables_dump_flowtable_done
,
7742 .module
= THIS_MODULE
,
7743 .data
= (void *)nla
,
7746 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
7749 if (!nla
[NFTA_FLOWTABLE_NAME
])
7752 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7755 return PTR_ERR(table
);
7757 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
7759 if (IS_ERR(flowtable
))
7760 return PTR_ERR(flowtable
);
7762 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
7766 err
= nf_tables_fill_flowtable_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7767 info
->nlh
->nlmsg_seq
,
7768 NFT_MSG_NEWFLOWTABLE
, 0, family
,
7769 flowtable
, &flowtable
->hook_list
);
7771 goto err_fill_flowtable_info
;
7773 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
7775 err_fill_flowtable_info
:
7780 static void nf_tables_flowtable_notify(struct nft_ctx
*ctx
,
7781 struct nft_flowtable
*flowtable
,
7782 struct list_head
*hook_list
,
7785 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
7786 struct sk_buff
*skb
;
7791 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
7794 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
7798 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
7799 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
7801 err
= nf_tables_fill_flowtable_info(skb
, ctx
->net
, ctx
->portid
,
7802 ctx
->seq
, event
, flags
,
7803 ctx
->family
, flowtable
, hook_list
);
7809 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
7812 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
7815 static void nf_tables_flowtable_destroy(struct nft_flowtable
*flowtable
)
7817 struct nft_hook
*hook
, *next
;
7819 flowtable
->data
.type
->free(&flowtable
->data
);
7820 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
7821 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
7823 list_del_rcu(&hook
->list
);
7826 kfree(flowtable
->name
);
7827 module_put(flowtable
->data
.type
->owner
);
7831 static int nf_tables_fill_gen_info(struct sk_buff
*skb
, struct net
*net
,
7832 u32 portid
, u32 seq
)
7834 struct nftables_pernet
*nft_net
= nft_pernet(net
);
7835 struct nlmsghdr
*nlh
;
7836 char buf
[TASK_COMM_LEN
];
7837 int event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWGEN
);
7839 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, 0, AF_UNSPEC
,
7840 NFNETLINK_V0
, nft_base_seq(net
));
7842 goto nla_put_failure
;
7844 if (nla_put_be32(skb
, NFTA_GEN_ID
, htonl(nft_net
->base_seq
)) ||
7845 nla_put_be32(skb
, NFTA_GEN_PROC_PID
, htonl(task_pid_nr(current
))) ||
7846 nla_put_string(skb
, NFTA_GEN_PROC_NAME
, get_task_comm(buf
, current
)))
7847 goto nla_put_failure
;
7849 nlmsg_end(skb
, nlh
);
7853 nlmsg_trim(skb
, nlh
);
7857 static void nft_flowtable_event(unsigned long event
, struct net_device
*dev
,
7858 struct nft_flowtable
*flowtable
)
7860 struct nft_hook
*hook
;
7862 list_for_each_entry(hook
, &flowtable
->hook_list
, list
) {
7863 if (hook
->ops
.dev
!= dev
)
7866 /* flow_offload_netdev_event() cleans up entries for us. */
7867 nft_unregister_flowtable_hook(dev_net(dev
), flowtable
, hook
);
7868 list_del_rcu(&hook
->list
);
7869 kfree_rcu(hook
, rcu
);
7874 static int nf_tables_flowtable_event(struct notifier_block
*this,
7875 unsigned long event
, void *ptr
)
7877 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
7878 struct nft_flowtable
*flowtable
;
7879 struct nftables_pernet
*nft_net
;
7880 struct nft_table
*table
;
7883 if (event
!= NETDEV_UNREGISTER
)
7887 nft_net
= nft_pernet(net
);
7888 mutex_lock(&nft_net
->commit_mutex
);
7889 list_for_each_entry(table
, &nft_net
->tables
, list
) {
7890 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
7891 nft_flowtable_event(event
, dev
, flowtable
);
7894 mutex_unlock(&nft_net
->commit_mutex
);
7899 static struct notifier_block nf_tables_flowtable_notifier
= {
7900 .notifier_call
= nf_tables_flowtable_event
,
7903 static void nf_tables_gen_notify(struct net
*net
, struct sk_buff
*skb
,
7906 struct nlmsghdr
*nlh
= nlmsg_hdr(skb
);
7907 struct sk_buff
*skb2
;
7910 if (!nlmsg_report(nlh
) &&
7911 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
7914 skb2
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
7918 err
= nf_tables_fill_gen_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7925 nfnetlink_send(skb2
, net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
7926 nlmsg_report(nlh
), GFP_KERNEL
);
7929 nfnetlink_set_err(net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
7933 static int nf_tables_getgen(struct sk_buff
*skb
, const struct nfnl_info
*info
,
7934 const struct nlattr
* const nla
[])
7936 struct sk_buff
*skb2
;
7939 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
7943 err
= nf_tables_fill_gen_info(skb2
, info
->net
, NETLINK_CB(skb
).portid
,
7944 info
->nlh
->nlmsg_seq
);
7946 goto err_fill_gen_info
;
7948 return nfnetlink_unicast(skb2
, info
->net
, NETLINK_CB(skb
).portid
);
7955 static const struct nfnl_callback nf_tables_cb
[NFT_MSG_MAX
] = {
7956 [NFT_MSG_NEWTABLE
] = {
7957 .call
= nf_tables_newtable
,
7958 .type
= NFNL_CB_BATCH
,
7959 .attr_count
= NFTA_TABLE_MAX
,
7960 .policy
= nft_table_policy
,
7962 [NFT_MSG_GETTABLE
] = {
7963 .call
= nf_tables_gettable
,
7964 .type
= NFNL_CB_RCU
,
7965 .attr_count
= NFTA_TABLE_MAX
,
7966 .policy
= nft_table_policy
,
7968 [NFT_MSG_DELTABLE
] = {
7969 .call
= nf_tables_deltable
,
7970 .type
= NFNL_CB_BATCH
,
7971 .attr_count
= NFTA_TABLE_MAX
,
7972 .policy
= nft_table_policy
,
7974 [NFT_MSG_NEWCHAIN
] = {
7975 .call
= nf_tables_newchain
,
7976 .type
= NFNL_CB_BATCH
,
7977 .attr_count
= NFTA_CHAIN_MAX
,
7978 .policy
= nft_chain_policy
,
7980 [NFT_MSG_GETCHAIN
] = {
7981 .call
= nf_tables_getchain
,
7982 .type
= NFNL_CB_RCU
,
7983 .attr_count
= NFTA_CHAIN_MAX
,
7984 .policy
= nft_chain_policy
,
7986 [NFT_MSG_DELCHAIN
] = {
7987 .call
= nf_tables_delchain
,
7988 .type
= NFNL_CB_BATCH
,
7989 .attr_count
= NFTA_CHAIN_MAX
,
7990 .policy
= nft_chain_policy
,
7992 [NFT_MSG_NEWRULE
] = {
7993 .call
= nf_tables_newrule
,
7994 .type
= NFNL_CB_BATCH
,
7995 .attr_count
= NFTA_RULE_MAX
,
7996 .policy
= nft_rule_policy
,
7998 [NFT_MSG_GETRULE
] = {
7999 .call
= nf_tables_getrule
,
8000 .type
= NFNL_CB_RCU
,
8001 .attr_count
= NFTA_RULE_MAX
,
8002 .policy
= nft_rule_policy
,
8004 [NFT_MSG_DELRULE
] = {
8005 .call
= nf_tables_delrule
,
8006 .type
= NFNL_CB_BATCH
,
8007 .attr_count
= NFTA_RULE_MAX
,
8008 .policy
= nft_rule_policy
,
8010 [NFT_MSG_NEWSET
] = {
8011 .call
= nf_tables_newset
,
8012 .type
= NFNL_CB_BATCH
,
8013 .attr_count
= NFTA_SET_MAX
,
8014 .policy
= nft_set_policy
,
8016 [NFT_MSG_GETSET
] = {
8017 .call
= nf_tables_getset
,
8018 .type
= NFNL_CB_RCU
,
8019 .attr_count
= NFTA_SET_MAX
,
8020 .policy
= nft_set_policy
,
8022 [NFT_MSG_DELSET
] = {
8023 .call
= nf_tables_delset
,
8024 .type
= NFNL_CB_BATCH
,
8025 .attr_count
= NFTA_SET_MAX
,
8026 .policy
= nft_set_policy
,
8028 [NFT_MSG_NEWSETELEM
] = {
8029 .call
= nf_tables_newsetelem
,
8030 .type
= NFNL_CB_BATCH
,
8031 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
8032 .policy
= nft_set_elem_list_policy
,
8034 [NFT_MSG_GETSETELEM
] = {
8035 .call
= nf_tables_getsetelem
,
8036 .type
= NFNL_CB_RCU
,
8037 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
8038 .policy
= nft_set_elem_list_policy
,
8040 [NFT_MSG_DELSETELEM
] = {
8041 .call
= nf_tables_delsetelem
,
8042 .type
= NFNL_CB_BATCH
,
8043 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
8044 .policy
= nft_set_elem_list_policy
,
8046 [NFT_MSG_GETGEN
] = {
8047 .call
= nf_tables_getgen
,
8048 .type
= NFNL_CB_RCU
,
8050 [NFT_MSG_NEWOBJ
] = {
8051 .call
= nf_tables_newobj
,
8052 .type
= NFNL_CB_BATCH
,
8053 .attr_count
= NFTA_OBJ_MAX
,
8054 .policy
= nft_obj_policy
,
8056 [NFT_MSG_GETOBJ
] = {
8057 .call
= nf_tables_getobj
,
8058 .type
= NFNL_CB_RCU
,
8059 .attr_count
= NFTA_OBJ_MAX
,
8060 .policy
= nft_obj_policy
,
8062 [NFT_MSG_DELOBJ
] = {
8063 .call
= nf_tables_delobj
,
8064 .type
= NFNL_CB_BATCH
,
8065 .attr_count
= NFTA_OBJ_MAX
,
8066 .policy
= nft_obj_policy
,
8068 [NFT_MSG_GETOBJ_RESET
] = {
8069 .call
= nf_tables_getobj
,
8070 .type
= NFNL_CB_RCU
,
8071 .attr_count
= NFTA_OBJ_MAX
,
8072 .policy
= nft_obj_policy
,
8074 [NFT_MSG_NEWFLOWTABLE
] = {
8075 .call
= nf_tables_newflowtable
,
8076 .type
= NFNL_CB_BATCH
,
8077 .attr_count
= NFTA_FLOWTABLE_MAX
,
8078 .policy
= nft_flowtable_policy
,
8080 [NFT_MSG_GETFLOWTABLE
] = {
8081 .call
= nf_tables_getflowtable
,
8082 .type
= NFNL_CB_RCU
,
8083 .attr_count
= NFTA_FLOWTABLE_MAX
,
8084 .policy
= nft_flowtable_policy
,
8086 [NFT_MSG_DELFLOWTABLE
] = {
8087 .call
= nf_tables_delflowtable
,
8088 .type
= NFNL_CB_BATCH
,
8089 .attr_count
= NFTA_FLOWTABLE_MAX
,
8090 .policy
= nft_flowtable_policy
,
8094 static int nf_tables_validate(struct net
*net
)
8096 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8097 struct nft_table
*table
;
8099 switch (nft_net
->validate_state
) {
8100 case NFT_VALIDATE_SKIP
:
8102 case NFT_VALIDATE_NEED
:
8103 nft_validate_state_update(net
, NFT_VALIDATE_DO
);
8105 case NFT_VALIDATE_DO
:
8106 list_for_each_entry(table
, &nft_net
->tables
, list
) {
8107 if (nft_table_validate(net
, table
) < 0)
8116 /* a drop policy has to be deferred until all rules have been activated,
8117 * otherwise a large ruleset that contains a drop-policy base chain will
8118 * cause all packets to get dropped until the full transaction has been
8121 * We defer the drop policy until the transaction has been finalized.
8123 static void nft_chain_commit_drop_policy(struct nft_trans
*trans
)
8125 struct nft_base_chain
*basechain
;
8127 if (nft_trans_chain_policy(trans
) != NF_DROP
)
8130 if (!nft_is_base_chain(trans
->ctx
.chain
))
8133 basechain
= nft_base_chain(trans
->ctx
.chain
);
8134 basechain
->policy
= NF_DROP
;
8137 static void nft_chain_commit_update(struct nft_trans
*trans
)
8139 struct nft_base_chain
*basechain
;
8141 if (nft_trans_chain_name(trans
)) {
8142 rhltable_remove(&trans
->ctx
.table
->chains_ht
,
8143 &trans
->ctx
.chain
->rhlhead
,
8144 nft_chain_ht_params
);
8145 swap(trans
->ctx
.chain
->name
, nft_trans_chain_name(trans
));
8146 rhltable_insert_key(&trans
->ctx
.table
->chains_ht
,
8147 trans
->ctx
.chain
->name
,
8148 &trans
->ctx
.chain
->rhlhead
,
8149 nft_chain_ht_params
);
8152 if (!nft_is_base_chain(trans
->ctx
.chain
))
8155 nft_chain_stats_replace(trans
);
8157 basechain
= nft_base_chain(trans
->ctx
.chain
);
8159 switch (nft_trans_chain_policy(trans
)) {
8162 basechain
->policy
= nft_trans_chain_policy(trans
);
8167 static void nft_obj_commit_update(struct nft_trans
*trans
)
8169 struct nft_object
*newobj
;
8170 struct nft_object
*obj
;
8172 obj
= nft_trans_obj(trans
);
8173 newobj
= nft_trans_obj_newobj(trans
);
8175 if (obj
->ops
->update
)
8176 obj
->ops
->update(obj
, newobj
);
8178 nft_obj_destroy(&trans
->ctx
, newobj
);
8181 static void nft_commit_release(struct nft_trans
*trans
)
8183 switch (trans
->msg_type
) {
8184 case NFT_MSG_DELTABLE
:
8185 nf_tables_table_destroy(&trans
->ctx
);
8187 case NFT_MSG_NEWCHAIN
:
8188 free_percpu(nft_trans_chain_stats(trans
));
8189 kfree(nft_trans_chain_name(trans
));
8191 case NFT_MSG_DELCHAIN
:
8192 nf_tables_chain_destroy(&trans
->ctx
);
8194 case NFT_MSG_DELRULE
:
8195 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
8197 case NFT_MSG_DELSET
:
8198 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
8200 case NFT_MSG_DELSETELEM
:
8201 nf_tables_set_elem_destroy(&trans
->ctx
,
8202 nft_trans_elem_set(trans
),
8203 nft_trans_elem(trans
).priv
);
8205 case NFT_MSG_DELOBJ
:
8206 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
8208 case NFT_MSG_DELFLOWTABLE
:
8209 if (nft_trans_flowtable_update(trans
))
8210 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
8212 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
8217 put_net(trans
->ctx
.net
);
8222 static void nf_tables_trans_destroy_work(struct work_struct
*w
)
8224 struct nft_trans
*trans
, *next
;
8227 spin_lock(&nf_tables_destroy_list_lock
);
8228 list_splice_init(&nf_tables_destroy_list
, &head
);
8229 spin_unlock(&nf_tables_destroy_list_lock
);
8231 if (list_empty(&head
))
8236 list_for_each_entry_safe(trans
, next
, &head
, list
) {
8237 list_del(&trans
->list
);
8238 nft_commit_release(trans
);
8242 void nf_tables_trans_destroy_flush_work(void)
8244 flush_work(&trans_destroy_work
);
8246 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work
);
8248 static int nf_tables_commit_chain_prepare(struct net
*net
, struct nft_chain
*chain
)
8250 struct nft_rule
*rule
;
8251 unsigned int alloc
= 0;
8254 /* already handled or inactive chain? */
8255 if (chain
->rules_next
|| !nft_is_active_next(net
, chain
))
8258 rule
= list_entry(&chain
->rules
, struct nft_rule
, list
);
8261 list_for_each_entry_continue(rule
, &chain
->rules
, list
) {
8262 if (nft_is_active_next(net
, rule
))
8266 chain
->rules_next
= nf_tables_chain_alloc_rules(chain
, alloc
);
8267 if (!chain
->rules_next
)
8270 list_for_each_entry_continue(rule
, &chain
->rules
, list
) {
8271 if (nft_is_active_next(net
, rule
))
8272 chain
->rules_next
[i
++] = rule
;
8275 chain
->rules_next
[i
] = NULL
;
8279 static void nf_tables_commit_chain_prepare_cancel(struct net
*net
)
8281 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8282 struct nft_trans
*trans
, *next
;
8284 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
8285 struct nft_chain
*chain
= trans
->ctx
.chain
;
8287 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
8288 trans
->msg_type
== NFT_MSG_DELRULE
) {
8289 kvfree(chain
->rules_next
);
8290 chain
->rules_next
= NULL
;
8295 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head
*h
)
8297 struct nft_rules_old
*o
= container_of(h
, struct nft_rules_old
, h
);
8302 static void nf_tables_commit_chain_free_rules_old(struct nft_rule
**rules
)
8304 struct nft_rule
**r
= rules
;
8305 struct nft_rules_old
*old
;
8310 r
++; /* rcu_head is after end marker */
8314 call_rcu(&old
->h
, __nf_tables_commit_chain_free_rules_old
);
8317 static void nf_tables_commit_chain(struct net
*net
, struct nft_chain
*chain
)
8319 struct nft_rule
**g0
, **g1
;
8322 next_genbit
= nft_gencursor_next(net
);
8324 g0
= rcu_dereference_protected(chain
->rules_gen_0
,
8325 lockdep_commit_lock_is_held(net
));
8326 g1
= rcu_dereference_protected(chain
->rules_gen_1
,
8327 lockdep_commit_lock_is_held(net
));
8329 /* No changes to this chain? */
8330 if (chain
->rules_next
== NULL
) {
8331 /* chain had no change in last or next generation */
8335 * chain had no change in this generation; make sure next
8336 * one uses same rules as current generation.
8339 rcu_assign_pointer(chain
->rules_gen_1
, g0
);
8340 nf_tables_commit_chain_free_rules_old(g1
);
8342 rcu_assign_pointer(chain
->rules_gen_0
, g1
);
8343 nf_tables_commit_chain_free_rules_old(g0
);
8350 rcu_assign_pointer(chain
->rules_gen_1
, chain
->rules_next
);
8352 rcu_assign_pointer(chain
->rules_gen_0
, chain
->rules_next
);
8354 chain
->rules_next
= NULL
;
8360 nf_tables_commit_chain_free_rules_old(g1
);
8362 nf_tables_commit_chain_free_rules_old(g0
);
8365 static void nft_obj_del(struct nft_object
*obj
)
8367 rhltable_remove(&nft_objname_ht
, &obj
->rhlhead
, nft_objname_ht_params
);
8368 list_del_rcu(&obj
->list
);
8371 void nft_chain_del(struct nft_chain
*chain
)
8373 struct nft_table
*table
= chain
->table
;
8375 WARN_ON_ONCE(rhltable_remove(&table
->chains_ht
, &chain
->rhlhead
,
8376 nft_chain_ht_params
));
8377 list_del_rcu(&chain
->list
);
8380 static void nft_flowtable_hooks_del(struct nft_flowtable
*flowtable
,
8381 struct list_head
*hook_list
)
8383 struct nft_hook
*hook
, *next
;
8385 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
8387 list_move(&hook
->list
, hook_list
);
8391 static void nf_tables_module_autoload_cleanup(struct net
*net
)
8393 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8394 struct nft_module_request
*req
, *next
;
8396 WARN_ON_ONCE(!list_empty(&nft_net
->commit_list
));
8397 list_for_each_entry_safe(req
, next
, &nft_net
->module_list
, list
) {
8398 WARN_ON_ONCE(!req
->done
);
8399 list_del(&req
->list
);
8404 static void nf_tables_commit_release(struct net
*net
)
8406 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8407 struct nft_trans
*trans
;
8409 /* all side effects have to be made visible.
8410 * For example, if a chain named 'foo' has been deleted, a
8411 * new transaction must not find it anymore.
8413 * Memory reclaim happens asynchronously from work queue
8414 * to prevent expensive synchronize_rcu() in commit phase.
8416 if (list_empty(&nft_net
->commit_list
)) {
8417 nf_tables_module_autoload_cleanup(net
);
8418 mutex_unlock(&nft_net
->commit_mutex
);
8422 trans
= list_last_entry(&nft_net
->commit_list
,
8423 struct nft_trans
, list
);
8424 get_net(trans
->ctx
.net
);
8425 WARN_ON_ONCE(trans
->put_net
);
8427 trans
->put_net
= true;
8428 spin_lock(&nf_tables_destroy_list_lock
);
8429 list_splice_tail_init(&nft_net
->commit_list
, &nf_tables_destroy_list
);
8430 spin_unlock(&nf_tables_destroy_list_lock
);
8432 nf_tables_module_autoload_cleanup(net
);
8433 schedule_work(&trans_destroy_work
);
8435 mutex_unlock(&nft_net
->commit_mutex
);
8438 static void nft_commit_notify(struct net
*net
, u32 portid
)
8440 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8441 struct sk_buff
*batch_skb
= NULL
, *nskb
, *skb
;
8442 unsigned char *data
;
8445 list_for_each_entry_safe(skb
, nskb
, &nft_net
->notify_list
, list
) {
8449 len
= NLMSG_GOODSIZE
- skb
->len
;
8450 list_del(&skb
->list
);
8454 if (len
> 0 && NFT_CB(skb
).report
== NFT_CB(batch_skb
).report
) {
8455 data
= skb_put(batch_skb
, skb
->len
);
8456 memcpy(data
, skb
->data
, skb
->len
);
8457 list_del(&skb
->list
);
8461 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
8462 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
8467 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
8468 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
8471 WARN_ON_ONCE(!list_empty(&nft_net
->notify_list
));
8474 static int nf_tables_commit_audit_alloc(struct list_head
*adl
,
8475 struct nft_table
*table
)
8477 struct nft_audit_data
*adp
;
8479 list_for_each_entry(adp
, adl
, list
) {
8480 if (adp
->table
== table
)
8483 adp
= kzalloc(sizeof(*adp
), GFP_KERNEL
);
8487 list_add(&adp
->list
, adl
);
8491 static void nf_tables_commit_audit_free(struct list_head
*adl
)
8493 struct nft_audit_data
*adp
, *adn
;
8495 list_for_each_entry_safe(adp
, adn
, adl
, list
) {
8496 list_del(&adp
->list
);
8501 static void nf_tables_commit_audit_collect(struct list_head
*adl
,
8502 struct nft_table
*table
, u32 op
)
8504 struct nft_audit_data
*adp
;
8506 list_for_each_entry(adp
, adl
, list
) {
8507 if (adp
->table
== table
)
8510 WARN_ONCE(1, "table=%s not expected in commit list", table
->name
);
8514 if (!adp
->op
|| adp
->op
> op
)
8518 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22)
8520 static void nf_tables_commit_audit_log(struct list_head
*adl
, u32 generation
)
8522 struct nft_audit_data
*adp
, *adn
;
8523 char aubuf
[AUNFTABLENAMELEN
];
8525 list_for_each_entry_safe(adp
, adn
, adl
, list
) {
8526 snprintf(aubuf
, AUNFTABLENAMELEN
, "%s:%u", adp
->table
->name
,
8528 audit_log_nfcfg(aubuf
, adp
->table
->family
, adp
->entries
,
8529 nft2audit_op
[adp
->op
], GFP_KERNEL
);
8530 list_del(&adp
->list
);
8535 static int nf_tables_commit(struct net
*net
, struct sk_buff
*skb
)
8537 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8538 struct nft_trans
*trans
, *next
;
8539 struct nft_trans_elem
*te
;
8540 struct nft_chain
*chain
;
8541 struct nft_table
*table
;
8545 if (list_empty(&nft_net
->commit_list
)) {
8546 mutex_unlock(&nft_net
->commit_mutex
);
8550 /* 0. Validate ruleset, otherwise roll back for error reporting. */
8551 if (nf_tables_validate(net
) < 0)
8554 err
= nft_flow_rule_offload_commit(net
);
8558 /* 1. Allocate space for next generation rules_gen_X[] */
8559 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
8562 ret
= nf_tables_commit_audit_alloc(&adl
, trans
->ctx
.table
);
8564 nf_tables_commit_chain_prepare_cancel(net
);
8565 nf_tables_commit_audit_free(&adl
);
8568 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
8569 trans
->msg_type
== NFT_MSG_DELRULE
) {
8570 chain
= trans
->ctx
.chain
;
8572 ret
= nf_tables_commit_chain_prepare(net
, chain
);
8574 nf_tables_commit_chain_prepare_cancel(net
);
8575 nf_tables_commit_audit_free(&adl
);
8581 /* step 2. Make rules_gen_X visible to packet path */
8582 list_for_each_entry(table
, &nft_net
->tables
, list
) {
8583 list_for_each_entry(chain
, &table
->chains
, list
)
8584 nf_tables_commit_chain(net
, chain
);
8588 * Bump generation counter, invalidate any dump in progress.
8589 * Cannot fail after this point.
8591 while (++nft_net
->base_seq
== 0)
8594 /* step 3. Start new generation, rules_gen_X now in use. */
8595 net
->nft
.gencursor
= nft_gencursor_next(net
);
8597 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
8598 nf_tables_commit_audit_collect(&adl
, trans
->ctx
.table
,
8600 switch (trans
->msg_type
) {
8601 case NFT_MSG_NEWTABLE
:
8602 if (nft_trans_table_update(trans
)) {
8603 if (!(trans
->ctx
.table
->flags
& __NFT_TABLE_F_UPDATE
)) {
8604 nft_trans_destroy(trans
);
8607 if (trans
->ctx
.table
->flags
& NFT_TABLE_F_DORMANT
)
8608 nf_tables_table_disable(net
, trans
->ctx
.table
);
8610 trans
->ctx
.table
->flags
&= ~__NFT_TABLE_F_UPDATE
;
8612 nft_clear(net
, trans
->ctx
.table
);
8614 nf_tables_table_notify(&trans
->ctx
, NFT_MSG_NEWTABLE
);
8615 nft_trans_destroy(trans
);
8617 case NFT_MSG_DELTABLE
:
8618 list_del_rcu(&trans
->ctx
.table
->list
);
8619 nf_tables_table_notify(&trans
->ctx
, NFT_MSG_DELTABLE
);
8621 case NFT_MSG_NEWCHAIN
:
8622 if (nft_trans_chain_update(trans
)) {
8623 nft_chain_commit_update(trans
);
8624 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
);
8625 /* trans destroyed after rcu grace period */
8627 nft_chain_commit_drop_policy(trans
);
8628 nft_clear(net
, trans
->ctx
.chain
);
8629 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
);
8630 nft_trans_destroy(trans
);
8633 case NFT_MSG_DELCHAIN
:
8634 nft_chain_del(trans
->ctx
.chain
);
8635 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_DELCHAIN
);
8636 nf_tables_unregister_hook(trans
->ctx
.net
,
8640 case NFT_MSG_NEWRULE
:
8641 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
8642 nf_tables_rule_notify(&trans
->ctx
,
8643 nft_trans_rule(trans
),
8645 nft_trans_destroy(trans
);
8647 case NFT_MSG_DELRULE
:
8648 list_del_rcu(&nft_trans_rule(trans
)->list
);
8649 nf_tables_rule_notify(&trans
->ctx
,
8650 nft_trans_rule(trans
),
8652 nft_rule_expr_deactivate(&trans
->ctx
,
8653 nft_trans_rule(trans
),
8656 case NFT_MSG_NEWSET
:
8657 nft_clear(net
, nft_trans_set(trans
));
8658 /* This avoids hitting -EBUSY when deleting the table
8659 * from the transaction.
8661 if (nft_set_is_anonymous(nft_trans_set(trans
)) &&
8662 !list_empty(&nft_trans_set(trans
)->bindings
))
8663 trans
->ctx
.table
->use
--;
8665 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
8666 NFT_MSG_NEWSET
, GFP_KERNEL
);
8667 nft_trans_destroy(trans
);
8669 case NFT_MSG_DELSET
:
8670 list_del_rcu(&nft_trans_set(trans
)->list
);
8671 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
8672 NFT_MSG_DELSET
, GFP_KERNEL
);
8674 case NFT_MSG_NEWSETELEM
:
8675 te
= (struct nft_trans_elem
*)trans
->data
;
8677 nft_setelem_activate(net
, te
->set
, &te
->elem
);
8678 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
8680 NFT_MSG_NEWSETELEM
);
8681 nft_trans_destroy(trans
);
8683 case NFT_MSG_DELSETELEM
:
8684 te
= (struct nft_trans_elem
*)trans
->data
;
8686 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
8688 NFT_MSG_DELSETELEM
);
8689 nft_setelem_remove(net
, te
->set
, &te
->elem
);
8690 if (!nft_setelem_is_catchall(te
->set
, &te
->elem
)) {
8691 atomic_dec(&te
->set
->nelems
);
8695 case NFT_MSG_NEWOBJ
:
8696 if (nft_trans_obj_update(trans
)) {
8697 nft_obj_commit_update(trans
);
8698 nf_tables_obj_notify(&trans
->ctx
,
8699 nft_trans_obj(trans
),
8702 nft_clear(net
, nft_trans_obj(trans
));
8703 nf_tables_obj_notify(&trans
->ctx
,
8704 nft_trans_obj(trans
),
8706 nft_trans_destroy(trans
);
8709 case NFT_MSG_DELOBJ
:
8710 nft_obj_del(nft_trans_obj(trans
));
8711 nf_tables_obj_notify(&trans
->ctx
, nft_trans_obj(trans
),
8714 case NFT_MSG_NEWFLOWTABLE
:
8715 if (nft_trans_flowtable_update(trans
)) {
8716 nft_trans_flowtable(trans
)->data
.flags
=
8717 nft_trans_flowtable_flags(trans
);
8718 nf_tables_flowtable_notify(&trans
->ctx
,
8719 nft_trans_flowtable(trans
),
8720 &nft_trans_flowtable_hooks(trans
),
8721 NFT_MSG_NEWFLOWTABLE
);
8722 list_splice(&nft_trans_flowtable_hooks(trans
),
8723 &nft_trans_flowtable(trans
)->hook_list
);
8725 nft_clear(net
, nft_trans_flowtable(trans
));
8726 nf_tables_flowtable_notify(&trans
->ctx
,
8727 nft_trans_flowtable(trans
),
8728 &nft_trans_flowtable(trans
)->hook_list
,
8729 NFT_MSG_NEWFLOWTABLE
);
8731 nft_trans_destroy(trans
);
8733 case NFT_MSG_DELFLOWTABLE
:
8734 if (nft_trans_flowtable_update(trans
)) {
8735 nft_flowtable_hooks_del(nft_trans_flowtable(trans
),
8736 &nft_trans_flowtable_hooks(trans
));
8737 nf_tables_flowtable_notify(&trans
->ctx
,
8738 nft_trans_flowtable(trans
),
8739 &nft_trans_flowtable_hooks(trans
),
8740 NFT_MSG_DELFLOWTABLE
);
8741 nft_unregister_flowtable_net_hooks(net
,
8742 &nft_trans_flowtable_hooks(trans
));
8744 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
8745 nf_tables_flowtable_notify(&trans
->ctx
,
8746 nft_trans_flowtable(trans
),
8747 &nft_trans_flowtable(trans
)->hook_list
,
8748 NFT_MSG_DELFLOWTABLE
);
8749 nft_unregister_flowtable_net_hooks(net
,
8750 &nft_trans_flowtable(trans
)->hook_list
);
8756 nft_commit_notify(net
, NETLINK_CB(skb
).portid
);
8757 nf_tables_gen_notify(net
, skb
, NFT_MSG_NEWGEN
);
8758 nf_tables_commit_audit_log(&adl
, nft_net
->base_seq
);
8759 nf_tables_commit_release(net
);
8764 static void nf_tables_module_autoload(struct net
*net
)
8766 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8767 struct nft_module_request
*req
, *next
;
8768 LIST_HEAD(module_list
);
8770 list_splice_init(&nft_net
->module_list
, &module_list
);
8771 mutex_unlock(&nft_net
->commit_mutex
);
8772 list_for_each_entry_safe(req
, next
, &module_list
, list
) {
8773 request_module("%s", req
->module
);
8776 mutex_lock(&nft_net
->commit_mutex
);
8777 list_splice(&module_list
, &nft_net
->module_list
);
8780 static void nf_tables_abort_release(struct nft_trans
*trans
)
8782 switch (trans
->msg_type
) {
8783 case NFT_MSG_NEWTABLE
:
8784 nf_tables_table_destroy(&trans
->ctx
);
8786 case NFT_MSG_NEWCHAIN
:
8787 nf_tables_chain_destroy(&trans
->ctx
);
8789 case NFT_MSG_NEWRULE
:
8790 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
8792 case NFT_MSG_NEWSET
:
8793 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
8795 case NFT_MSG_NEWSETELEM
:
8796 nft_set_elem_destroy(nft_trans_elem_set(trans
),
8797 nft_trans_elem(trans
).priv
, true);
8799 case NFT_MSG_NEWOBJ
:
8800 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
8802 case NFT_MSG_NEWFLOWTABLE
:
8803 if (nft_trans_flowtable_update(trans
))
8804 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
8806 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
8812 static int __nf_tables_abort(struct net
*net
, enum nfnl_abort_action action
)
8814 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8815 struct nft_trans
*trans
, *next
;
8816 struct nft_trans_elem
*te
;
8817 struct nft_hook
*hook
;
8819 if (action
== NFNL_ABORT_VALIDATE
&&
8820 nf_tables_validate(net
) < 0)
8823 list_for_each_entry_safe_reverse(trans
, next
, &nft_net
->commit_list
,
8825 switch (trans
->msg_type
) {
8826 case NFT_MSG_NEWTABLE
:
8827 if (nft_trans_table_update(trans
)) {
8828 if (!(trans
->ctx
.table
->flags
& __NFT_TABLE_F_UPDATE
)) {
8829 nft_trans_destroy(trans
);
8832 if (trans
->ctx
.table
->flags
& __NFT_TABLE_F_WAS_DORMANT
) {
8833 nf_tables_table_disable(net
, trans
->ctx
.table
);
8834 trans
->ctx
.table
->flags
|= NFT_TABLE_F_DORMANT
;
8835 } else if (trans
->ctx
.table
->flags
& __NFT_TABLE_F_WAS_AWAKEN
) {
8836 trans
->ctx
.table
->flags
&= ~NFT_TABLE_F_DORMANT
;
8838 trans
->ctx
.table
->flags
&= ~__NFT_TABLE_F_UPDATE
;
8839 nft_trans_destroy(trans
);
8841 list_del_rcu(&trans
->ctx
.table
->list
);
8844 case NFT_MSG_DELTABLE
:
8845 nft_clear(trans
->ctx
.net
, trans
->ctx
.table
);
8846 nft_trans_destroy(trans
);
8848 case NFT_MSG_NEWCHAIN
:
8849 if (nft_trans_chain_update(trans
)) {
8850 free_percpu(nft_trans_chain_stats(trans
));
8851 kfree(nft_trans_chain_name(trans
));
8852 nft_trans_destroy(trans
);
8854 if (nft_chain_is_bound(trans
->ctx
.chain
)) {
8855 nft_trans_destroy(trans
);
8858 trans
->ctx
.table
->use
--;
8859 nft_chain_del(trans
->ctx
.chain
);
8860 nf_tables_unregister_hook(trans
->ctx
.net
,
8865 case NFT_MSG_DELCHAIN
:
8866 trans
->ctx
.table
->use
++;
8867 nft_clear(trans
->ctx
.net
, trans
->ctx
.chain
);
8868 nft_trans_destroy(trans
);
8870 case NFT_MSG_NEWRULE
:
8871 trans
->ctx
.chain
->use
--;
8872 list_del_rcu(&nft_trans_rule(trans
)->list
);
8873 nft_rule_expr_deactivate(&trans
->ctx
,
8874 nft_trans_rule(trans
),
8876 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
8877 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
8879 case NFT_MSG_DELRULE
:
8880 trans
->ctx
.chain
->use
++;
8881 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
8882 nft_rule_expr_activate(&trans
->ctx
, nft_trans_rule(trans
));
8883 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
8884 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
8886 nft_trans_destroy(trans
);
8888 case NFT_MSG_NEWSET
:
8889 trans
->ctx
.table
->use
--;
8890 if (nft_trans_set_bound(trans
)) {
8891 nft_trans_destroy(trans
);
8894 list_del_rcu(&nft_trans_set(trans
)->list
);
8896 case NFT_MSG_DELSET
:
8897 trans
->ctx
.table
->use
++;
8898 nft_clear(trans
->ctx
.net
, nft_trans_set(trans
));
8899 nft_trans_destroy(trans
);
8901 case NFT_MSG_NEWSETELEM
:
8902 if (nft_trans_elem_set_bound(trans
)) {
8903 nft_trans_destroy(trans
);
8906 te
= (struct nft_trans_elem
*)trans
->data
;
8907 nft_setelem_remove(net
, te
->set
, &te
->elem
);
8908 if (!nft_setelem_is_catchall(te
->set
, &te
->elem
))
8909 atomic_dec(&te
->set
->nelems
);
8911 case NFT_MSG_DELSETELEM
:
8912 te
= (struct nft_trans_elem
*)trans
->data
;
8914 nft_setelem_data_activate(net
, te
->set
, &te
->elem
);
8915 nft_setelem_activate(net
, te
->set
, &te
->elem
);
8916 if (!nft_setelem_is_catchall(te
->set
, &te
->elem
))
8919 nft_trans_destroy(trans
);
8921 case NFT_MSG_NEWOBJ
:
8922 if (nft_trans_obj_update(trans
)) {
8923 nft_obj_destroy(&trans
->ctx
, nft_trans_obj_newobj(trans
));
8924 nft_trans_destroy(trans
);
8926 trans
->ctx
.table
->use
--;
8927 nft_obj_del(nft_trans_obj(trans
));
8930 case NFT_MSG_DELOBJ
:
8931 trans
->ctx
.table
->use
++;
8932 nft_clear(trans
->ctx
.net
, nft_trans_obj(trans
));
8933 nft_trans_destroy(trans
);
8935 case NFT_MSG_NEWFLOWTABLE
:
8936 if (nft_trans_flowtable_update(trans
)) {
8937 nft_unregister_flowtable_net_hooks(net
,
8938 &nft_trans_flowtable_hooks(trans
));
8940 trans
->ctx
.table
->use
--;
8941 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
8942 nft_unregister_flowtable_net_hooks(net
,
8943 &nft_trans_flowtable(trans
)->hook_list
);
8946 case NFT_MSG_DELFLOWTABLE
:
8947 if (nft_trans_flowtable_update(trans
)) {
8948 list_for_each_entry(hook
, &nft_trans_flowtable(trans
)->hook_list
, list
)
8949 hook
->inactive
= false;
8951 trans
->ctx
.table
->use
++;
8952 nft_clear(trans
->ctx
.net
, nft_trans_flowtable(trans
));
8954 nft_trans_destroy(trans
);
8961 list_for_each_entry_safe_reverse(trans
, next
,
8962 &nft_net
->commit_list
, list
) {
8963 list_del(&trans
->list
);
8964 nf_tables_abort_release(trans
);
8967 if (action
== NFNL_ABORT_AUTOLOAD
)
8968 nf_tables_module_autoload(net
);
8970 nf_tables_module_autoload_cleanup(net
);
8975 static void nf_tables_cleanup(struct net
*net
)
8977 nft_validate_state_update(net
, NFT_VALIDATE_SKIP
);
8980 static int nf_tables_abort(struct net
*net
, struct sk_buff
*skb
,
8981 enum nfnl_abort_action action
)
8983 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8984 int ret
= __nf_tables_abort(net
, action
);
8986 mutex_unlock(&nft_net
->commit_mutex
);
8991 static bool nf_tables_valid_genid(struct net
*net
, u32 genid
)
8993 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8996 mutex_lock(&nft_net
->commit_mutex
);
8998 genid_ok
= genid
== 0 || nft_net
->base_seq
== genid
;
9000 mutex_unlock(&nft_net
->commit_mutex
);
9002 /* else, commit mutex has to be released by commit or abort function */
9006 static const struct nfnetlink_subsystem nf_tables_subsys
= {
9007 .name
= "nf_tables",
9008 .subsys_id
= NFNL_SUBSYS_NFTABLES
,
9009 .cb_count
= NFT_MSG_MAX
,
9011 .commit
= nf_tables_commit
,
9012 .abort
= nf_tables_abort
,
9013 .cleanup
= nf_tables_cleanup
,
9014 .valid_genid
= nf_tables_valid_genid
,
9015 .owner
= THIS_MODULE
,
9018 int nft_chain_validate_dependency(const struct nft_chain
*chain
,
9019 enum nft_chain_types type
)
9021 const struct nft_base_chain
*basechain
;
9023 if (nft_is_base_chain(chain
)) {
9024 basechain
= nft_base_chain(chain
);
9025 if (basechain
->type
->type
!= type
)
9030 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency
);
9032 int nft_chain_validate_hooks(const struct nft_chain
*chain
,
9033 unsigned int hook_flags
)
9035 struct nft_base_chain
*basechain
;
9037 if (nft_is_base_chain(chain
)) {
9038 basechain
= nft_base_chain(chain
);
9040 if ((1 << basechain
->ops
.hooknum
) & hook_flags
)
9048 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks
);
9051 * Loop detection - walk through the ruleset beginning at the destination chain
9052 * of a new jump until either the source chain is reached (loop) or all
9053 * reachable chains have been traversed.
9055 * The loop check is performed whenever a new jump verdict is added to an
9056 * expression or verdict map or a verdict map is bound to a new chain.
9059 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
9060 const struct nft_chain
*chain
);
9062 static int nft_check_loops(const struct nft_ctx
*ctx
,
9063 const struct nft_set_ext
*ext
)
9065 const struct nft_data
*data
;
9068 data
= nft_set_ext_data(ext
);
9069 switch (data
->verdict
.code
) {
9072 ret
= nf_tables_check_loops(ctx
, data
->verdict
.chain
);
9082 static int nf_tables_loop_check_setelem(const struct nft_ctx
*ctx
,
9083 struct nft_set
*set
,
9084 const struct nft_set_iter
*iter
,
9085 struct nft_set_elem
*elem
)
9087 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
9089 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
9090 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_INTERVAL_END
)
9093 return nft_check_loops(ctx
, ext
);
9096 static int nft_set_catchall_loops(const struct nft_ctx
*ctx
,
9097 struct nft_set
*set
)
9099 u8 genmask
= nft_genmask_next(ctx
->net
);
9100 struct nft_set_elem_catchall
*catchall
;
9101 struct nft_set_ext
*ext
;
9104 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
9105 ext
= nft_set_elem_ext(set
, catchall
->elem
);
9106 if (!nft_set_elem_active(ext
, genmask
))
9109 ret
= nft_check_loops(ctx
, ext
);
9117 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
9118 const struct nft_chain
*chain
)
9120 const struct nft_rule
*rule
;
9121 const struct nft_expr
*expr
, *last
;
9122 struct nft_set
*set
;
9123 struct nft_set_binding
*binding
;
9124 struct nft_set_iter iter
;
9126 if (ctx
->chain
== chain
)
9129 list_for_each_entry(rule
, &chain
->rules
, list
) {
9130 nft_rule_for_each_expr(expr
, last
, rule
) {
9131 struct nft_immediate_expr
*priv
;
9132 const struct nft_data
*data
;
9135 if (strcmp(expr
->ops
->type
->name
, "immediate"))
9138 priv
= nft_expr_priv(expr
);
9139 if (priv
->dreg
!= NFT_REG_VERDICT
)
9143 switch (data
->verdict
.code
) {
9146 err
= nf_tables_check_loops(ctx
,
9147 data
->verdict
.chain
);
9157 list_for_each_entry(set
, &ctx
->table
->sets
, list
) {
9158 if (!nft_is_active_next(ctx
->net
, set
))
9160 if (!(set
->flags
& NFT_SET_MAP
) ||
9161 set
->dtype
!= NFT_DATA_VERDICT
)
9164 list_for_each_entry(binding
, &set
->bindings
, list
) {
9165 if (!(binding
->flags
& NFT_SET_MAP
) ||
9166 binding
->chain
!= chain
)
9169 iter
.genmask
= nft_genmask_next(ctx
->net
);
9173 iter
.fn
= nf_tables_loop_check_setelem
;
9175 set
->ops
->walk(ctx
, set
, &iter
);
9177 iter
.err
= nft_set_catchall_loops(ctx
, set
);
9188 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
9190 * @attr: netlink attribute to fetch value from
9191 * @max: maximum value to be stored in dest
9192 * @dest: pointer to the variable
9194 * Parse, check and store a given u32 netlink attribute into variable.
9195 * This function returns -ERANGE if the value goes over maximum value.
9196 * Otherwise a 0 is returned and the attribute value is stored in the
9197 * destination variable.
9199 int nft_parse_u32_check(const struct nlattr
*attr
, int max
, u32
*dest
)
9203 val
= ntohl(nla_get_be32(attr
));
9210 EXPORT_SYMBOL_GPL(nft_parse_u32_check
);
9212 static int nft_parse_register(const struct nlattr
*attr
, u32
*preg
)
9216 reg
= ntohl(nla_get_be32(attr
));
9218 case NFT_REG_VERDICT
...NFT_REG_4
:
9219 *preg
= reg
* NFT_REG_SIZE
/ NFT_REG32_SIZE
;
9221 case NFT_REG32_00
...NFT_REG32_15
:
9222 *preg
= reg
+ NFT_REG_SIZE
/ NFT_REG32_SIZE
- NFT_REG32_00
;
9232 * nft_dump_register - dump a register value to a netlink attribute
9234 * @skb: socket buffer
9235 * @attr: attribute number
9236 * @reg: register number
9238 * Construct a netlink attribute containing the register number. For
9239 * compatibility reasons, register numbers being a multiple of 4 are
9240 * translated to the corresponding 128 bit register numbers.
9242 int nft_dump_register(struct sk_buff
*skb
, unsigned int attr
, unsigned int reg
)
9244 if (reg
% (NFT_REG_SIZE
/ NFT_REG32_SIZE
) == 0)
9245 reg
= reg
/ (NFT_REG_SIZE
/ NFT_REG32_SIZE
);
9247 reg
= reg
- NFT_REG_SIZE
/ NFT_REG32_SIZE
+ NFT_REG32_00
;
9249 return nla_put_be32(skb
, attr
, htonl(reg
));
9251 EXPORT_SYMBOL_GPL(nft_dump_register
);
9253 static int nft_validate_register_load(enum nft_registers reg
, unsigned int len
)
9255 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
9259 if (reg
* NFT_REG32_SIZE
+ len
> sizeof_field(struct nft_regs
, data
))
9265 int nft_parse_register_load(const struct nlattr
*attr
, u8
*sreg
, u32 len
)
9270 err
= nft_parse_register(attr
, ®
);
9274 err
= nft_validate_register_load(reg
, len
);
9281 EXPORT_SYMBOL_GPL(nft_parse_register_load
);
9283 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
9284 enum nft_registers reg
,
9285 const struct nft_data
*data
,
9286 enum nft_data_types type
,
9292 case NFT_REG_VERDICT
:
9293 if (type
!= NFT_DATA_VERDICT
)
9297 (data
->verdict
.code
== NFT_GOTO
||
9298 data
->verdict
.code
== NFT_JUMP
)) {
9299 err
= nf_tables_check_loops(ctx
, data
->verdict
.chain
);
9306 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
9310 if (reg
* NFT_REG32_SIZE
+ len
>
9311 sizeof_field(struct nft_regs
, data
))
9314 if (data
!= NULL
&& type
!= NFT_DATA_VALUE
)
9320 int nft_parse_register_store(const struct nft_ctx
*ctx
,
9321 const struct nlattr
*attr
, u8
*dreg
,
9322 const struct nft_data
*data
,
9323 enum nft_data_types type
, unsigned int len
)
9328 err
= nft_parse_register(attr
, ®
);
9332 err
= nft_validate_register_store(ctx
, reg
, data
, type
, len
);
9339 EXPORT_SYMBOL_GPL(nft_parse_register_store
);
9341 static const struct nla_policy nft_verdict_policy
[NFTA_VERDICT_MAX
+ 1] = {
9342 [NFTA_VERDICT_CODE
] = { .type
= NLA_U32
},
9343 [NFTA_VERDICT_CHAIN
] = { .type
= NLA_STRING
,
9344 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
9345 [NFTA_VERDICT_CHAIN_ID
] = { .type
= NLA_U32
},
9348 static int nft_verdict_init(const struct nft_ctx
*ctx
, struct nft_data
*data
,
9349 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
9351 u8 genmask
= nft_genmask_next(ctx
->net
);
9352 struct nlattr
*tb
[NFTA_VERDICT_MAX
+ 1];
9353 struct nft_chain
*chain
;
9356 err
= nla_parse_nested_deprecated(tb
, NFTA_VERDICT_MAX
, nla
,
9357 nft_verdict_policy
, NULL
);
9361 if (!tb
[NFTA_VERDICT_CODE
])
9363 data
->verdict
.code
= ntohl(nla_get_be32(tb
[NFTA_VERDICT_CODE
]));
9365 switch (data
->verdict
.code
) {
9367 switch (data
->verdict
.code
& NF_VERDICT_MASK
) {
9382 if (tb
[NFTA_VERDICT_CHAIN
]) {
9383 chain
= nft_chain_lookup(ctx
->net
, ctx
->table
,
9384 tb
[NFTA_VERDICT_CHAIN
],
9386 } else if (tb
[NFTA_VERDICT_CHAIN_ID
]) {
9387 chain
= nft_chain_lookup_byid(ctx
->net
,
9388 tb
[NFTA_VERDICT_CHAIN_ID
]);
9390 return PTR_ERR(chain
);
9396 return PTR_ERR(chain
);
9397 if (nft_is_base_chain(chain
))
9401 data
->verdict
.chain
= chain
;
9405 desc
->len
= sizeof(data
->verdict
);
9406 desc
->type
= NFT_DATA_VERDICT
;
9410 static void nft_verdict_uninit(const struct nft_data
*data
)
9412 struct nft_chain
*chain
;
9413 struct nft_rule
*rule
;
9415 switch (data
->verdict
.code
) {
9418 chain
= data
->verdict
.chain
;
9421 if (!nft_chain_is_bound(chain
))
9424 chain
->table
->use
--;
9425 list_for_each_entry(rule
, &chain
->rules
, list
)
9428 nft_chain_del(chain
);
9433 int nft_verdict_dump(struct sk_buff
*skb
, int type
, const struct nft_verdict
*v
)
9435 struct nlattr
*nest
;
9437 nest
= nla_nest_start_noflag(skb
, type
);
9439 goto nla_put_failure
;
9441 if (nla_put_be32(skb
, NFTA_VERDICT_CODE
, htonl(v
->code
)))
9442 goto nla_put_failure
;
9447 if (nla_put_string(skb
, NFTA_VERDICT_CHAIN
,
9449 goto nla_put_failure
;
9451 nla_nest_end(skb
, nest
);
9458 static int nft_value_init(const struct nft_ctx
*ctx
,
9459 struct nft_data
*data
, unsigned int size
,
9460 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
9470 nla_memcpy(data
->data
, nla
, len
);
9471 desc
->type
= NFT_DATA_VALUE
;
9476 static int nft_value_dump(struct sk_buff
*skb
, const struct nft_data
*data
,
9479 return nla_put(skb
, NFTA_DATA_VALUE
, len
, data
->data
);
9482 static const struct nla_policy nft_data_policy
[NFTA_DATA_MAX
+ 1] = {
9483 [NFTA_DATA_VALUE
] = { .type
= NLA_BINARY
},
9484 [NFTA_DATA_VERDICT
] = { .type
= NLA_NESTED
},
9488 * nft_data_init - parse nf_tables data netlink attributes
9490 * @ctx: context of the expression using the data
9491 * @data: destination struct nft_data
9492 * @size: maximum data length
9493 * @desc: data description
9494 * @nla: netlink attribute containing data
9496 * Parse the netlink data attributes and initialize a struct nft_data.
9497 * The type and length of data are returned in the data description.
9499 * The caller can indicate that it only wants to accept data of type
9500 * NFT_DATA_VALUE by passing NULL for the ctx argument.
9502 int nft_data_init(const struct nft_ctx
*ctx
,
9503 struct nft_data
*data
, unsigned int size
,
9504 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
9506 struct nlattr
*tb
[NFTA_DATA_MAX
+ 1];
9509 err
= nla_parse_nested_deprecated(tb
, NFTA_DATA_MAX
, nla
,
9510 nft_data_policy
, NULL
);
9514 if (tb
[NFTA_DATA_VALUE
])
9515 return nft_value_init(ctx
, data
, size
, desc
,
9516 tb
[NFTA_DATA_VALUE
]);
9517 if (tb
[NFTA_DATA_VERDICT
] && ctx
!= NULL
)
9518 return nft_verdict_init(ctx
, data
, desc
, tb
[NFTA_DATA_VERDICT
]);
9521 EXPORT_SYMBOL_GPL(nft_data_init
);
9524 * nft_data_release - release a nft_data item
9526 * @data: struct nft_data to release
9527 * @type: type of data
9529 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
9530 * all others need to be released by calling this function.
9532 void nft_data_release(const struct nft_data
*data
, enum nft_data_types type
)
9534 if (type
< NFT_DATA_VERDICT
)
9537 case NFT_DATA_VERDICT
:
9538 return nft_verdict_uninit(data
);
9543 EXPORT_SYMBOL_GPL(nft_data_release
);
9545 int nft_data_dump(struct sk_buff
*skb
, int attr
, const struct nft_data
*data
,
9546 enum nft_data_types type
, unsigned int len
)
9548 struct nlattr
*nest
;
9551 nest
= nla_nest_start_noflag(skb
, attr
);
9556 case NFT_DATA_VALUE
:
9557 err
= nft_value_dump(skb
, data
, len
);
9559 case NFT_DATA_VERDICT
:
9560 err
= nft_verdict_dump(skb
, NFTA_DATA_VERDICT
, &data
->verdict
);
9567 nla_nest_end(skb
, nest
);
9570 EXPORT_SYMBOL_GPL(nft_data_dump
);
9572 int __nft_release_basechain(struct nft_ctx
*ctx
)
9574 struct nft_rule
*rule
, *nr
;
9576 if (WARN_ON(!nft_is_base_chain(ctx
->chain
)))
9579 nf_tables_unregister_hook(ctx
->net
, ctx
->chain
->table
, ctx
->chain
);
9580 list_for_each_entry_safe(rule
, nr
, &ctx
->chain
->rules
, list
) {
9581 list_del(&rule
->list
);
9583 nf_tables_rule_release(ctx
, rule
);
9585 nft_chain_del(ctx
->chain
);
9587 nf_tables_chain_destroy(ctx
);
9591 EXPORT_SYMBOL_GPL(__nft_release_basechain
);
9593 static void __nft_release_hook(struct net
*net
, struct nft_table
*table
)
9595 struct nft_flowtable
*flowtable
;
9596 struct nft_chain
*chain
;
9598 list_for_each_entry(chain
, &table
->chains
, list
)
9599 nf_tables_unregister_hook(net
, table
, chain
);
9600 list_for_each_entry(flowtable
, &table
->flowtables
, list
)
9601 nft_unregister_flowtable_net_hooks(net
, &flowtable
->hook_list
);
9604 static void __nft_release_hooks(struct net
*net
)
9606 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9607 struct nft_table
*table
;
9609 list_for_each_entry(table
, &nft_net
->tables
, list
) {
9610 if (nft_table_has_owner(table
))
9613 __nft_release_hook(net
, table
);
9617 static void __nft_release_table(struct net
*net
, struct nft_table
*table
)
9619 struct nft_flowtable
*flowtable
, *nf
;
9620 struct nft_chain
*chain
, *nc
;
9621 struct nft_object
*obj
, *ne
;
9622 struct nft_rule
*rule
, *nr
;
9623 struct nft_set
*set
, *ns
;
9624 struct nft_ctx ctx
= {
9626 .family
= NFPROTO_NETDEV
,
9629 ctx
.family
= table
->family
;
9631 list_for_each_entry(chain
, &table
->chains
, list
) {
9633 list_for_each_entry_safe(rule
, nr
, &chain
->rules
, list
) {
9634 list_del(&rule
->list
);
9636 nf_tables_rule_release(&ctx
, rule
);
9639 list_for_each_entry_safe(flowtable
, nf
, &table
->flowtables
, list
) {
9640 list_del(&flowtable
->list
);
9642 nf_tables_flowtable_destroy(flowtable
);
9644 list_for_each_entry_safe(set
, ns
, &table
->sets
, list
) {
9645 list_del(&set
->list
);
9647 nft_set_destroy(&ctx
, set
);
9649 list_for_each_entry_safe(obj
, ne
, &table
->objects
, list
) {
9652 nft_obj_destroy(&ctx
, obj
);
9654 list_for_each_entry_safe(chain
, nc
, &table
->chains
, list
) {
9656 nft_chain_del(chain
);
9658 nf_tables_chain_destroy(&ctx
);
9660 nf_tables_table_destroy(&ctx
);
9663 static void __nft_release_tables(struct net
*net
)
9665 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9666 struct nft_table
*table
, *nt
;
9668 list_for_each_entry_safe(table
, nt
, &nft_net
->tables
, list
) {
9669 if (nft_table_has_owner(table
))
9672 list_del(&table
->list
);
9674 __nft_release_table(net
, table
);
9678 static int nft_rcv_nl_event(struct notifier_block
*this, unsigned long event
,
9681 struct nft_table
*table
, *to_delete
[8];
9682 struct nftables_pernet
*nft_net
;
9683 struct netlink_notify
*n
= ptr
;
9684 struct net
*net
= n
->net
;
9685 unsigned int deleted
;
9686 bool restart
= false;
9688 if (event
!= NETLINK_URELEASE
|| n
->protocol
!= NETLINK_NETFILTER
)
9691 nft_net
= nft_pernet(net
);
9693 mutex_lock(&nft_net
->commit_mutex
);
9695 list_for_each_entry(table
, &nft_net
->tables
, list
) {
9696 if (nft_table_has_owner(table
) &&
9697 n
->portid
== table
->nlpid
) {
9698 __nft_release_hook(net
, table
);
9699 list_del_rcu(&table
->list
);
9700 to_delete
[deleted
++] = table
;
9701 if (deleted
>= ARRAY_SIZE(to_delete
))
9706 restart
= deleted
>= ARRAY_SIZE(to_delete
);
9709 __nft_release_table(net
, to_delete
[--deleted
]);
9714 mutex_unlock(&nft_net
->commit_mutex
);
9719 static struct notifier_block nft_nl_notifier
= {
9720 .notifier_call
= nft_rcv_nl_event
,
9723 static int __net_init
nf_tables_init_net(struct net
*net
)
9725 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9727 INIT_LIST_HEAD(&nft_net
->tables
);
9728 INIT_LIST_HEAD(&nft_net
->commit_list
);
9729 INIT_LIST_HEAD(&nft_net
->module_list
);
9730 INIT_LIST_HEAD(&nft_net
->notify_list
);
9731 mutex_init(&nft_net
->commit_mutex
);
9732 nft_net
->base_seq
= 1;
9733 nft_net
->validate_state
= NFT_VALIDATE_SKIP
;
9738 static void __net_exit
nf_tables_pre_exit_net(struct net
*net
)
9740 __nft_release_hooks(net
);
9743 static void __net_exit
nf_tables_exit_net(struct net
*net
)
9745 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9747 mutex_lock(&nft_net
->commit_mutex
);
9748 if (!list_empty(&nft_net
->commit_list
))
9749 __nf_tables_abort(net
, NFNL_ABORT_NONE
);
9750 __nft_release_tables(net
);
9751 mutex_unlock(&nft_net
->commit_mutex
);
9752 WARN_ON_ONCE(!list_empty(&nft_net
->tables
));
9753 WARN_ON_ONCE(!list_empty(&nft_net
->module_list
));
9754 WARN_ON_ONCE(!list_empty(&nft_net
->notify_list
));
9757 static struct pernet_operations nf_tables_net_ops
= {
9758 .init
= nf_tables_init_net
,
9759 .pre_exit
= nf_tables_pre_exit_net
,
9760 .exit
= nf_tables_exit_net
,
9761 .id
= &nf_tables_net_id
,
9762 .size
= sizeof(struct nftables_pernet
),
9765 static int __init
nf_tables_module_init(void)
9769 err
= register_pernet_subsys(&nf_tables_net_ops
);
9773 err
= nft_chain_filter_init();
9775 goto err_chain_filter
;
9777 err
= nf_tables_core_module_init();
9779 goto err_core_module
;
9781 err
= register_netdevice_notifier(&nf_tables_flowtable_notifier
);
9783 goto err_netdev_notifier
;
9785 err
= rhltable_init(&nft_objname_ht
, &nft_objname_ht_params
);
9787 goto err_rht_objname
;
9789 err
= nft_offload_init();
9793 err
= netlink_register_notifier(&nft_nl_notifier
);
9795 goto err_netlink_notifier
;
9798 err
= nfnetlink_subsys_register(&nf_tables_subsys
);
9800 goto err_nfnl_subsys
;
9802 nft_chain_route_init();
9807 netlink_unregister_notifier(&nft_nl_notifier
);
9808 err_netlink_notifier
:
9811 rhltable_destroy(&nft_objname_ht
);
9813 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
9814 err_netdev_notifier
:
9815 nf_tables_core_module_exit();
9817 nft_chain_filter_fini();
9819 unregister_pernet_subsys(&nf_tables_net_ops
);
9823 static void __exit
nf_tables_module_exit(void)
9825 nfnetlink_subsys_unregister(&nf_tables_subsys
);
9826 netlink_unregister_notifier(&nft_nl_notifier
);
9828 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
9829 nft_chain_filter_fini();
9830 nft_chain_route_fini();
9831 unregister_pernet_subsys(&nf_tables_net_ops
);
9832 cancel_work_sync(&trans_destroy_work
);
9834 rhltable_destroy(&nft_objname_ht
);
9835 nf_tables_core_module_exit();
9838 module_init(nf_tables_module_init
);
9839 module_exit(nf_tables_module_exit
);
9841 MODULE_LICENSE("GPL");
9842 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
9843 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES
);