1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 #include <linux/module.h>
9 #include <linux/init.h>
10 #include <linux/list.h>
11 #include <linux/skbuff.h>
12 #include <linux/netlink.h>
13 #include <linux/vmalloc.h>
14 #include <linux/rhashtable.h>
15 #include <linux/audit.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nfnetlink.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_flow_table.h>
20 #include <net/netfilter/nf_tables_core.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_offload.h>
23 #include <net/net_namespace.h>
26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
28 unsigned int nf_tables_net_id __read_mostly
;
30 static LIST_HEAD(nf_tables_expressions
);
31 static LIST_HEAD(nf_tables_objects
);
32 static LIST_HEAD(nf_tables_flowtables
);
33 static LIST_HEAD(nf_tables_destroy_list
);
34 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock
);
35 static u64 table_handle
;
38 NFT_VALIDATE_SKIP
= 0,
43 static struct rhltable nft_objname_ht
;
45 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
);
46 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
);
47 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*, const void *);
49 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
);
50 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
);
51 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*, const void *);
53 static const struct rhashtable_params nft_chain_ht_params
= {
54 .head_offset
= offsetof(struct nft_chain
, rhlhead
),
55 .key_offset
= offsetof(struct nft_chain
, name
),
56 .hashfn
= nft_chain_hash
,
57 .obj_hashfn
= nft_chain_hash_obj
,
58 .obj_cmpfn
= nft_chain_hash_cmp
,
59 .automatic_shrinking
= true,
62 static const struct rhashtable_params nft_objname_ht_params
= {
63 .head_offset
= offsetof(struct nft_object
, rhlhead
),
64 .key_offset
= offsetof(struct nft_object
, key
),
65 .hashfn
= nft_objname_hash
,
66 .obj_hashfn
= nft_objname_hash_obj
,
67 .obj_cmpfn
= nft_objname_hash_cmp
,
68 .automatic_shrinking
= true,
71 struct nft_audit_data
{
72 struct nft_table
*table
;
75 struct list_head list
;
78 static const u8 nft2audit_op
[NFT_MSG_MAX
] = { // enum nf_tables_msg_types
79 [NFT_MSG_NEWTABLE
] = AUDIT_NFT_OP_TABLE_REGISTER
,
80 [NFT_MSG_GETTABLE
] = AUDIT_NFT_OP_INVALID
,
81 [NFT_MSG_DELTABLE
] = AUDIT_NFT_OP_TABLE_UNREGISTER
,
82 [NFT_MSG_NEWCHAIN
] = AUDIT_NFT_OP_CHAIN_REGISTER
,
83 [NFT_MSG_GETCHAIN
] = AUDIT_NFT_OP_INVALID
,
84 [NFT_MSG_DELCHAIN
] = AUDIT_NFT_OP_CHAIN_UNREGISTER
,
85 [NFT_MSG_NEWRULE
] = AUDIT_NFT_OP_RULE_REGISTER
,
86 [NFT_MSG_GETRULE
] = AUDIT_NFT_OP_INVALID
,
87 [NFT_MSG_DELRULE
] = AUDIT_NFT_OP_RULE_UNREGISTER
,
88 [NFT_MSG_NEWSET
] = AUDIT_NFT_OP_SET_REGISTER
,
89 [NFT_MSG_GETSET
] = AUDIT_NFT_OP_INVALID
,
90 [NFT_MSG_DELSET
] = AUDIT_NFT_OP_SET_UNREGISTER
,
91 [NFT_MSG_NEWSETELEM
] = AUDIT_NFT_OP_SETELEM_REGISTER
,
92 [NFT_MSG_GETSETELEM
] = AUDIT_NFT_OP_INVALID
,
93 [NFT_MSG_DELSETELEM
] = AUDIT_NFT_OP_SETELEM_UNREGISTER
,
94 [NFT_MSG_NEWGEN
] = AUDIT_NFT_OP_GEN_REGISTER
,
95 [NFT_MSG_GETGEN
] = AUDIT_NFT_OP_INVALID
,
96 [NFT_MSG_TRACE
] = AUDIT_NFT_OP_INVALID
,
97 [NFT_MSG_NEWOBJ
] = AUDIT_NFT_OP_OBJ_REGISTER
,
98 [NFT_MSG_GETOBJ
] = AUDIT_NFT_OP_INVALID
,
99 [NFT_MSG_DELOBJ
] = AUDIT_NFT_OP_OBJ_UNREGISTER
,
100 [NFT_MSG_GETOBJ_RESET
] = AUDIT_NFT_OP_OBJ_RESET
,
101 [NFT_MSG_NEWFLOWTABLE
] = AUDIT_NFT_OP_FLOWTABLE_REGISTER
,
102 [NFT_MSG_GETFLOWTABLE
] = AUDIT_NFT_OP_INVALID
,
103 [NFT_MSG_DELFLOWTABLE
] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER
,
106 static void nft_validate_state_update(struct net
*net
, u8 new_validate_state
)
108 struct nftables_pernet
*nft_net
= nft_pernet(net
);
110 switch (nft_net
->validate_state
) {
111 case NFT_VALIDATE_SKIP
:
112 WARN_ON_ONCE(new_validate_state
== NFT_VALIDATE_DO
);
114 case NFT_VALIDATE_NEED
:
116 case NFT_VALIDATE_DO
:
117 if (new_validate_state
== NFT_VALIDATE_NEED
)
121 nft_net
->validate_state
= new_validate_state
;
123 static void nf_tables_trans_destroy_work(struct work_struct
*w
);
124 static DECLARE_WORK(trans_destroy_work
, nf_tables_trans_destroy_work
);
126 static void nft_ctx_init(struct nft_ctx
*ctx
,
128 const struct sk_buff
*skb
,
129 const struct nlmsghdr
*nlh
,
131 struct nft_table
*table
,
132 struct nft_chain
*chain
,
133 const struct nlattr
* const *nla
)
136 ctx
->family
= family
;
141 ctx
->portid
= NETLINK_CB(skb
).portid
;
142 ctx
->report
= nlmsg_report(nlh
);
143 ctx
->flags
= nlh
->nlmsg_flags
;
144 ctx
->seq
= nlh
->nlmsg_seq
;
147 static struct nft_trans
*nft_trans_alloc_gfp(const struct nft_ctx
*ctx
,
148 int msg_type
, u32 size
, gfp_t gfp
)
150 struct nft_trans
*trans
;
152 trans
= kzalloc(sizeof(struct nft_trans
) + size
, gfp
);
156 trans
->msg_type
= msg_type
;
162 static struct nft_trans
*nft_trans_alloc(const struct nft_ctx
*ctx
,
163 int msg_type
, u32 size
)
165 return nft_trans_alloc_gfp(ctx
, msg_type
, size
, GFP_KERNEL
);
168 static void nft_trans_destroy(struct nft_trans
*trans
)
170 list_del(&trans
->list
);
174 static void nft_set_trans_bind(const struct nft_ctx
*ctx
, struct nft_set
*set
)
176 struct nftables_pernet
*nft_net
;
177 struct net
*net
= ctx
->net
;
178 struct nft_trans
*trans
;
180 if (!nft_set_is_anonymous(set
))
183 nft_net
= nft_pernet(net
);
184 list_for_each_entry_reverse(trans
, &nft_net
->commit_list
, list
) {
185 switch (trans
->msg_type
) {
187 if (nft_trans_set(trans
) == set
)
188 nft_trans_set_bound(trans
) = true;
190 case NFT_MSG_NEWSETELEM
:
191 if (nft_trans_elem_set(trans
) == set
)
192 nft_trans_elem_set_bound(trans
) = true;
198 static int nft_netdev_register_hooks(struct net
*net
,
199 struct list_head
*hook_list
)
201 struct nft_hook
*hook
;
205 list_for_each_entry(hook
, hook_list
, list
) {
206 err
= nf_register_net_hook(net
, &hook
->ops
);
215 list_for_each_entry(hook
, hook_list
, list
) {
219 nf_unregister_net_hook(net
, &hook
->ops
);
224 static void nft_netdev_unregister_hooks(struct net
*net
,
225 struct list_head
*hook_list
)
227 struct nft_hook
*hook
;
229 list_for_each_entry(hook
, hook_list
, list
)
230 nf_unregister_net_hook(net
, &hook
->ops
);
233 static int nf_tables_register_hook(struct net
*net
,
234 const struct nft_table
*table
,
235 struct nft_chain
*chain
)
237 struct nft_base_chain
*basechain
;
238 const struct nf_hook_ops
*ops
;
240 if (table
->flags
& NFT_TABLE_F_DORMANT
||
241 !nft_is_base_chain(chain
))
244 basechain
= nft_base_chain(chain
);
245 ops
= &basechain
->ops
;
247 if (basechain
->type
->ops_register
)
248 return basechain
->type
->ops_register(net
, ops
);
250 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
251 return nft_netdev_register_hooks(net
, &basechain
->hook_list
);
253 return nf_register_net_hook(net
, &basechain
->ops
);
256 static void nf_tables_unregister_hook(struct net
*net
,
257 const struct nft_table
*table
,
258 struct nft_chain
*chain
)
260 struct nft_base_chain
*basechain
;
261 const struct nf_hook_ops
*ops
;
263 if (table
->flags
& NFT_TABLE_F_DORMANT
||
264 !nft_is_base_chain(chain
))
266 basechain
= nft_base_chain(chain
);
267 ops
= &basechain
->ops
;
269 if (basechain
->type
->ops_unregister
)
270 return basechain
->type
->ops_unregister(net
, ops
);
272 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
273 nft_netdev_unregister_hooks(net
, &basechain
->hook_list
);
275 nf_unregister_net_hook(net
, &basechain
->ops
);
278 static void nft_trans_commit_list_add_tail(struct net
*net
, struct nft_trans
*trans
)
280 struct nftables_pernet
*nft_net
= nft_pernet(net
);
282 list_add_tail(&trans
->list
, &nft_net
->commit_list
);
285 static int nft_trans_table_add(struct nft_ctx
*ctx
, int msg_type
)
287 struct nft_trans
*trans
;
289 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_table
));
293 if (msg_type
== NFT_MSG_NEWTABLE
)
294 nft_activate_next(ctx
->net
, ctx
->table
);
296 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
300 static int nft_deltable(struct nft_ctx
*ctx
)
304 err
= nft_trans_table_add(ctx
, NFT_MSG_DELTABLE
);
308 nft_deactivate_next(ctx
->net
, ctx
->table
);
312 static struct nft_trans
*nft_trans_chain_add(struct nft_ctx
*ctx
, int msg_type
)
314 struct nft_trans
*trans
;
316 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_chain
));
318 return ERR_PTR(-ENOMEM
);
320 if (msg_type
== NFT_MSG_NEWCHAIN
) {
321 nft_activate_next(ctx
->net
, ctx
->chain
);
323 if (ctx
->nla
[NFTA_CHAIN_ID
]) {
324 nft_trans_chain_id(trans
) =
325 ntohl(nla_get_be32(ctx
->nla
[NFTA_CHAIN_ID
]));
329 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
333 static int nft_delchain(struct nft_ctx
*ctx
)
335 struct nft_trans
*trans
;
337 trans
= nft_trans_chain_add(ctx
, NFT_MSG_DELCHAIN
);
339 return PTR_ERR(trans
);
342 nft_deactivate_next(ctx
->net
, ctx
->chain
);
347 static void nft_rule_expr_activate(const struct nft_ctx
*ctx
,
348 struct nft_rule
*rule
)
350 struct nft_expr
*expr
;
352 expr
= nft_expr_first(rule
);
353 while (nft_expr_more(rule
, expr
)) {
354 if (expr
->ops
->activate
)
355 expr
->ops
->activate(ctx
, expr
);
357 expr
= nft_expr_next(expr
);
361 static void nft_rule_expr_deactivate(const struct nft_ctx
*ctx
,
362 struct nft_rule
*rule
,
363 enum nft_trans_phase phase
)
365 struct nft_expr
*expr
;
367 expr
= nft_expr_first(rule
);
368 while (nft_expr_more(rule
, expr
)) {
369 if (expr
->ops
->deactivate
)
370 expr
->ops
->deactivate(ctx
, expr
, phase
);
372 expr
= nft_expr_next(expr
);
377 nf_tables_delrule_deactivate(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
379 /* You cannot delete the same rule twice */
380 if (nft_is_active_next(ctx
->net
, rule
)) {
381 nft_deactivate_next(ctx
->net
, rule
);
388 static struct nft_trans
*nft_trans_rule_add(struct nft_ctx
*ctx
, int msg_type
,
389 struct nft_rule
*rule
)
391 struct nft_trans
*trans
;
393 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_rule
));
397 if (msg_type
== NFT_MSG_NEWRULE
&& ctx
->nla
[NFTA_RULE_ID
] != NULL
) {
398 nft_trans_rule_id(trans
) =
399 ntohl(nla_get_be32(ctx
->nla
[NFTA_RULE_ID
]));
401 nft_trans_rule(trans
) = rule
;
402 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
407 static int nft_delrule(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
409 struct nft_flow_rule
*flow
;
410 struct nft_trans
*trans
;
413 trans
= nft_trans_rule_add(ctx
, NFT_MSG_DELRULE
, rule
);
417 if (ctx
->chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
418 flow
= nft_flow_rule_create(ctx
->net
, rule
);
420 nft_trans_destroy(trans
);
421 return PTR_ERR(flow
);
424 nft_trans_flow_rule(trans
) = flow
;
427 err
= nf_tables_delrule_deactivate(ctx
, rule
);
429 nft_trans_destroy(trans
);
432 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_PREPARE
);
437 static int nft_delrule_by_chain(struct nft_ctx
*ctx
)
439 struct nft_rule
*rule
;
442 list_for_each_entry(rule
, &ctx
->chain
->rules
, list
) {
443 if (!nft_is_active_next(ctx
->net
, rule
))
446 err
= nft_delrule(ctx
, rule
);
453 static int nft_trans_set_add(const struct nft_ctx
*ctx
, int msg_type
,
456 struct nft_trans
*trans
;
458 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_set
));
462 if (msg_type
== NFT_MSG_NEWSET
&& ctx
->nla
[NFTA_SET_ID
] != NULL
) {
463 nft_trans_set_id(trans
) =
464 ntohl(nla_get_be32(ctx
->nla
[NFTA_SET_ID
]));
465 nft_activate_next(ctx
->net
, set
);
467 nft_trans_set(trans
) = set
;
468 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
473 static int nft_delset(const struct nft_ctx
*ctx
, struct nft_set
*set
)
477 err
= nft_trans_set_add(ctx
, NFT_MSG_DELSET
, set
);
481 nft_deactivate_next(ctx
->net
, set
);
487 static int nft_trans_obj_add(struct nft_ctx
*ctx
, int msg_type
,
488 struct nft_object
*obj
)
490 struct nft_trans
*trans
;
492 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_obj
));
496 if (msg_type
== NFT_MSG_NEWOBJ
)
497 nft_activate_next(ctx
->net
, obj
);
499 nft_trans_obj(trans
) = obj
;
500 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
505 static int nft_delobj(struct nft_ctx
*ctx
, struct nft_object
*obj
)
509 err
= nft_trans_obj_add(ctx
, NFT_MSG_DELOBJ
, obj
);
513 nft_deactivate_next(ctx
->net
, obj
);
519 static int nft_trans_flowtable_add(struct nft_ctx
*ctx
, int msg_type
,
520 struct nft_flowtable
*flowtable
)
522 struct nft_trans
*trans
;
524 trans
= nft_trans_alloc(ctx
, msg_type
,
525 sizeof(struct nft_trans_flowtable
));
529 if (msg_type
== NFT_MSG_NEWFLOWTABLE
)
530 nft_activate_next(ctx
->net
, flowtable
);
532 nft_trans_flowtable(trans
) = flowtable
;
533 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
538 static int nft_delflowtable(struct nft_ctx
*ctx
,
539 struct nft_flowtable
*flowtable
)
543 err
= nft_trans_flowtable_add(ctx
, NFT_MSG_DELFLOWTABLE
, flowtable
);
547 nft_deactivate_next(ctx
->net
, flowtable
);
557 static struct nft_table
*nft_table_lookup(const struct net
*net
,
558 const struct nlattr
*nla
,
559 u8 family
, u8 genmask
, u32 nlpid
)
561 struct nftables_pernet
*nft_net
;
562 struct nft_table
*table
;
565 return ERR_PTR(-EINVAL
);
567 nft_net
= nft_pernet(net
);
568 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
,
569 lockdep_is_held(&nft_net
->commit_mutex
)) {
570 if (!nla_strcmp(nla
, table
->name
) &&
571 table
->family
== family
&&
572 nft_active_genmask(table
, genmask
)) {
573 if (nft_table_has_owner(table
) &&
574 nlpid
&& table
->nlpid
!= nlpid
)
575 return ERR_PTR(-EPERM
);
581 return ERR_PTR(-ENOENT
);
584 static struct nft_table
*nft_table_lookup_byhandle(const struct net
*net
,
585 const struct nlattr
*nla
,
586 u8 genmask
, u32 nlpid
)
588 struct nftables_pernet
*nft_net
;
589 struct nft_table
*table
;
591 nft_net
= nft_pernet(net
);
592 list_for_each_entry(table
, &nft_net
->tables
, list
) {
593 if (be64_to_cpu(nla_get_be64(nla
)) == table
->handle
&&
594 nft_active_genmask(table
, genmask
)) {
595 if (nft_table_has_owner(table
) &&
596 nlpid
&& table
->nlpid
!= nlpid
)
597 return ERR_PTR(-EPERM
);
603 return ERR_PTR(-ENOENT
);
606 static inline u64
nf_tables_alloc_handle(struct nft_table
*table
)
608 return ++table
->hgenerator
;
611 static const struct nft_chain_type
*chain_type
[NFPROTO_NUMPROTO
][NFT_CHAIN_T_MAX
];
613 static const struct nft_chain_type
*
614 __nft_chain_type_get(u8 family
, enum nft_chain_types type
)
616 if (family
>= NFPROTO_NUMPROTO
||
617 type
>= NFT_CHAIN_T_MAX
)
620 return chain_type
[family
][type
];
623 static const struct nft_chain_type
*
624 __nf_tables_chain_type_lookup(const struct nlattr
*nla
, u8 family
)
626 const struct nft_chain_type
*type
;
629 for (i
= 0; i
< NFT_CHAIN_T_MAX
; i
++) {
630 type
= __nft_chain_type_get(family
, i
);
633 if (!nla_strcmp(nla
, type
->name
))
639 struct nft_module_request
{
640 struct list_head list
;
641 char module
[MODULE_NAME_LEN
];
645 #ifdef CONFIG_MODULES
646 __printf(2, 3) int nft_request_module(struct net
*net
, const char *fmt
,
649 char module_name
[MODULE_NAME_LEN
];
650 struct nftables_pernet
*nft_net
;
651 struct nft_module_request
*req
;
656 ret
= vsnprintf(module_name
, MODULE_NAME_LEN
, fmt
, args
);
658 if (ret
>= MODULE_NAME_LEN
)
661 nft_net
= nft_pernet(net
);
662 list_for_each_entry(req
, &nft_net
->module_list
, list
) {
663 if (!strcmp(req
->module
, module_name
)) {
667 /* A request to load this module already exists. */
672 req
= kmalloc(sizeof(*req
), GFP_KERNEL
);
677 strlcpy(req
->module
, module_name
, MODULE_NAME_LEN
);
678 list_add_tail(&req
->list
, &nft_net
->module_list
);
682 EXPORT_SYMBOL_GPL(nft_request_module
);
685 static void lockdep_nfnl_nft_mutex_not_held(void)
687 #ifdef CONFIG_PROVE_LOCKING
689 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES
));
693 static const struct nft_chain_type
*
694 nf_tables_chain_type_lookup(struct net
*net
, const struct nlattr
*nla
,
695 u8 family
, bool autoload
)
697 const struct nft_chain_type
*type
;
699 type
= __nf_tables_chain_type_lookup(nla
, family
);
703 lockdep_nfnl_nft_mutex_not_held();
704 #ifdef CONFIG_MODULES
706 if (nft_request_module(net
, "nft-chain-%u-%.*s", family
,
708 (const char *)nla_data(nla
)) == -EAGAIN
)
709 return ERR_PTR(-EAGAIN
);
712 return ERR_PTR(-ENOENT
);
715 static __be16
nft_base_seq(const struct net
*net
)
717 struct nftables_pernet
*nft_net
= nft_pernet(net
);
719 return htons(nft_net
->base_seq
& 0xffff);
722 static const struct nla_policy nft_table_policy
[NFTA_TABLE_MAX
+ 1] = {
723 [NFTA_TABLE_NAME
] = { .type
= NLA_STRING
,
724 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
725 [NFTA_TABLE_FLAGS
] = { .type
= NLA_U32
},
726 [NFTA_TABLE_HANDLE
] = { .type
= NLA_U64
},
727 [NFTA_TABLE_USERDATA
] = { .type
= NLA_BINARY
,
728 .len
= NFT_USERDATA_MAXLEN
}
731 static int nf_tables_fill_table_info(struct sk_buff
*skb
, struct net
*net
,
732 u32 portid
, u32 seq
, int event
, u32 flags
,
733 int family
, const struct nft_table
*table
)
735 struct nlmsghdr
*nlh
;
737 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
738 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
739 NFNETLINK_V0
, nft_base_seq(net
));
741 goto nla_put_failure
;
743 if (nla_put_string(skb
, NFTA_TABLE_NAME
, table
->name
) ||
744 nla_put_be32(skb
, NFTA_TABLE_FLAGS
,
745 htonl(table
->flags
& NFT_TABLE_F_MASK
)) ||
746 nla_put_be32(skb
, NFTA_TABLE_USE
, htonl(table
->use
)) ||
747 nla_put_be64(skb
, NFTA_TABLE_HANDLE
, cpu_to_be64(table
->handle
),
749 goto nla_put_failure
;
750 if (nft_table_has_owner(table
) &&
751 nla_put_be32(skb
, NFTA_TABLE_OWNER
, htonl(table
->nlpid
)))
752 goto nla_put_failure
;
755 if (nla_put(skb
, NFTA_TABLE_USERDATA
, table
->udlen
, table
->udata
))
756 goto nla_put_failure
;
763 nlmsg_trim(skb
, nlh
);
767 struct nftnl_skb_parms
{
770 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb))
772 static void nft_notify_enqueue(struct sk_buff
*skb
, bool report
,
773 struct list_head
*notify_list
)
775 NFT_CB(skb
).report
= report
;
776 list_add_tail(&skb
->list
, notify_list
);
779 static void nf_tables_table_notify(const struct nft_ctx
*ctx
, int event
)
781 struct nftables_pernet
*nft_net
;
787 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
790 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
794 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
795 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
797 err
= nf_tables_fill_table_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
798 event
, flags
, ctx
->family
, ctx
->table
);
804 nft_net
= nft_pernet(ctx
->net
);
805 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
808 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
811 static int nf_tables_dump_tables(struct sk_buff
*skb
,
812 struct netlink_callback
*cb
)
814 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
815 struct nftables_pernet
*nft_net
;
816 const struct nft_table
*table
;
817 unsigned int idx
= 0, s_idx
= cb
->args
[0];
818 struct net
*net
= sock_net(skb
->sk
);
819 int family
= nfmsg
->nfgen_family
;
822 nft_net
= nft_pernet(net
);
823 cb
->seq
= nft_net
->base_seq
;
825 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
826 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
832 memset(&cb
->args
[1], 0,
833 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
834 if (!nft_is_active(net
, table
))
836 if (nf_tables_fill_table_info(skb
, net
,
837 NETLINK_CB(cb
->skb
).portid
,
839 NFT_MSG_NEWTABLE
, NLM_F_MULTI
,
840 table
->family
, table
) < 0)
843 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
853 static int nft_netlink_dump_start_rcu(struct sock
*nlsk
, struct sk_buff
*skb
,
854 const struct nlmsghdr
*nlh
,
855 struct netlink_dump_control
*c
)
859 if (!try_module_get(THIS_MODULE
))
863 err
= netlink_dump_start(nlsk
, skb
, nlh
, c
);
865 module_put(THIS_MODULE
);
870 /* called with rcu_read_lock held */
871 static int nf_tables_gettable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
872 const struct nlattr
* const nla
[])
874 struct netlink_ext_ack
*extack
= info
->extack
;
875 u8 genmask
= nft_genmask_cur(info
->net
);
876 u8 family
= info
->nfmsg
->nfgen_family
;
877 const struct nft_table
*table
;
878 struct net
*net
= info
->net
;
879 struct sk_buff
*skb2
;
882 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
883 struct netlink_dump_control c
= {
884 .dump
= nf_tables_dump_tables
,
885 .module
= THIS_MODULE
,
888 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
891 table
= nft_table_lookup(net
, nla
[NFTA_TABLE_NAME
], family
, genmask
, 0);
893 NL_SET_BAD_ATTR(extack
, nla
[NFTA_TABLE_NAME
]);
894 return PTR_ERR(table
);
897 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
901 err
= nf_tables_fill_table_info(skb2
, net
, NETLINK_CB(skb
).portid
,
902 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWTABLE
,
905 goto err_fill_table_info
;
907 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
914 static void nft_table_disable(struct net
*net
, struct nft_table
*table
, u32 cnt
)
916 struct nft_chain
*chain
;
919 list_for_each_entry(chain
, &table
->chains
, list
) {
920 if (!nft_is_active_next(net
, chain
))
922 if (!nft_is_base_chain(chain
))
925 if (cnt
&& i
++ == cnt
)
928 nf_tables_unregister_hook(net
, table
, chain
);
932 static int nf_tables_table_enable(struct net
*net
, struct nft_table
*table
)
934 struct nft_chain
*chain
;
937 list_for_each_entry(chain
, &table
->chains
, list
) {
938 if (!nft_is_active_next(net
, chain
))
940 if (!nft_is_base_chain(chain
))
943 err
= nf_tables_register_hook(net
, table
, chain
);
945 goto err_register_hooks
;
953 nft_table_disable(net
, table
, i
);
957 static void nf_tables_table_disable(struct net
*net
, struct nft_table
*table
)
959 table
->flags
&= ~NFT_TABLE_F_DORMANT
;
960 nft_table_disable(net
, table
, 0);
961 table
->flags
|= NFT_TABLE_F_DORMANT
;
964 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1)
965 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0)
966 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1)
967 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \
968 __NFT_TABLE_F_WAS_AWAKEN)
970 static int nf_tables_updtable(struct nft_ctx
*ctx
)
972 struct nft_trans
*trans
;
976 if (!ctx
->nla
[NFTA_TABLE_FLAGS
])
979 flags
= ntohl(nla_get_be32(ctx
->nla
[NFTA_TABLE_FLAGS
]));
980 if (flags
& ~NFT_TABLE_F_MASK
)
983 if (flags
== ctx
->table
->flags
)
986 if ((nft_table_has_owner(ctx
->table
) &&
987 !(flags
& NFT_TABLE_F_OWNER
)) ||
988 (!nft_table_has_owner(ctx
->table
) &&
989 flags
& NFT_TABLE_F_OWNER
))
992 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWTABLE
,
993 sizeof(struct nft_trans_table
));
997 if ((flags
& NFT_TABLE_F_DORMANT
) &&
998 !(ctx
->table
->flags
& NFT_TABLE_F_DORMANT
)) {
999 ctx
->table
->flags
|= NFT_TABLE_F_DORMANT
;
1000 if (!(ctx
->table
->flags
& __NFT_TABLE_F_UPDATE
))
1001 ctx
->table
->flags
|= __NFT_TABLE_F_WAS_AWAKEN
;
1002 } else if (!(flags
& NFT_TABLE_F_DORMANT
) &&
1003 ctx
->table
->flags
& NFT_TABLE_F_DORMANT
) {
1004 ctx
->table
->flags
&= ~NFT_TABLE_F_DORMANT
;
1005 if (!(ctx
->table
->flags
& __NFT_TABLE_F_UPDATE
)) {
1006 ret
= nf_tables_table_enable(ctx
->net
, ctx
->table
);
1008 goto err_register_hooks
;
1010 ctx
->table
->flags
|= __NFT_TABLE_F_WAS_DORMANT
;
1014 nft_trans_table_update(trans
) = true;
1015 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
1020 nft_trans_destroy(trans
);
1024 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
)
1026 const char *name
= data
;
1028 return jhash(name
, strlen(name
), seed
);
1031 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
)
1033 const struct nft_chain
*chain
= data
;
1035 return nft_chain_hash(chain
->name
, 0, seed
);
1038 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*arg
,
1041 const struct nft_chain
*chain
= ptr
;
1042 const char *name
= arg
->key
;
1044 return strcmp(chain
->name
, name
);
1047 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
)
1049 const struct nft_object_hash_key
*k
= data
;
1051 seed
^= hash_ptr(k
->table
, 32);
1053 return jhash(k
->name
, strlen(k
->name
), seed
);
1056 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
)
1058 const struct nft_object
*obj
= data
;
1060 return nft_objname_hash(&obj
->key
, 0, seed
);
1063 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*arg
,
1066 const struct nft_object_hash_key
*k
= arg
->key
;
1067 const struct nft_object
*obj
= ptr
;
1069 if (obj
->key
.table
!= k
->table
)
1072 return strcmp(obj
->key
.name
, k
->name
);
1075 static int nf_tables_newtable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1076 const struct nlattr
* const nla
[])
1078 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
1079 struct netlink_ext_ack
*extack
= info
->extack
;
1080 u8 genmask
= nft_genmask_next(info
->net
);
1081 u8 family
= info
->nfmsg
->nfgen_family
;
1082 struct net
*net
= info
->net
;
1083 const struct nlattr
*attr
;
1084 struct nft_table
*table
;
1089 lockdep_assert_held(&nft_net
->commit_mutex
);
1090 attr
= nla
[NFTA_TABLE_NAME
];
1091 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1092 NETLINK_CB(skb
).portid
);
1093 if (IS_ERR(table
)) {
1094 if (PTR_ERR(table
) != -ENOENT
)
1095 return PTR_ERR(table
);
1097 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
1098 NL_SET_BAD_ATTR(extack
, attr
);
1101 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
1104 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
1106 return nf_tables_updtable(&ctx
);
1109 if (nla
[NFTA_TABLE_FLAGS
]) {
1110 flags
= ntohl(nla_get_be32(nla
[NFTA_TABLE_FLAGS
]));
1111 if (flags
& ~NFT_TABLE_F_MASK
)
1116 table
= kzalloc(sizeof(*table
), GFP_KERNEL
);
1120 table
->name
= nla_strdup(attr
, GFP_KERNEL
);
1121 if (table
->name
== NULL
)
1124 if (nla
[NFTA_TABLE_USERDATA
]) {
1125 table
->udata
= nla_memdup(nla
[NFTA_TABLE_USERDATA
], GFP_KERNEL
);
1126 if (table
->udata
== NULL
)
1127 goto err_table_udata
;
1129 table
->udlen
= nla_len(nla
[NFTA_TABLE_USERDATA
]);
1132 err
= rhltable_init(&table
->chains_ht
, &nft_chain_ht_params
);
1136 INIT_LIST_HEAD(&table
->chains
);
1137 INIT_LIST_HEAD(&table
->sets
);
1138 INIT_LIST_HEAD(&table
->objects
);
1139 INIT_LIST_HEAD(&table
->flowtables
);
1140 table
->family
= family
;
1141 table
->flags
= flags
;
1142 table
->handle
= ++table_handle
;
1143 if (table
->flags
& NFT_TABLE_F_OWNER
)
1144 table
->nlpid
= NETLINK_CB(skb
).portid
;
1146 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
1147 err
= nft_trans_table_add(&ctx
, NFT_MSG_NEWTABLE
);
1151 list_add_tail_rcu(&table
->list
, &nft_net
->tables
);
1154 rhltable_destroy(&table
->chains_ht
);
1156 kfree(table
->udata
);
1165 static int nft_flush_table(struct nft_ctx
*ctx
)
1167 struct nft_flowtable
*flowtable
, *nft
;
1168 struct nft_chain
*chain
, *nc
;
1169 struct nft_object
*obj
, *ne
;
1170 struct nft_set
*set
, *ns
;
1173 list_for_each_entry(chain
, &ctx
->table
->chains
, list
) {
1174 if (!nft_is_active_next(ctx
->net
, chain
))
1177 if (nft_chain_is_bound(chain
))
1182 err
= nft_delrule_by_chain(ctx
);
1187 list_for_each_entry_safe(set
, ns
, &ctx
->table
->sets
, list
) {
1188 if (!nft_is_active_next(ctx
->net
, set
))
1191 if (nft_set_is_anonymous(set
) &&
1192 !list_empty(&set
->bindings
))
1195 err
= nft_delset(ctx
, set
);
1200 list_for_each_entry_safe(flowtable
, nft
, &ctx
->table
->flowtables
, list
) {
1201 if (!nft_is_active_next(ctx
->net
, flowtable
))
1204 err
= nft_delflowtable(ctx
, flowtable
);
1209 list_for_each_entry_safe(obj
, ne
, &ctx
->table
->objects
, list
) {
1210 if (!nft_is_active_next(ctx
->net
, obj
))
1213 err
= nft_delobj(ctx
, obj
);
1218 list_for_each_entry_safe(chain
, nc
, &ctx
->table
->chains
, list
) {
1219 if (!nft_is_active_next(ctx
->net
, chain
))
1222 if (nft_chain_is_bound(chain
))
1227 err
= nft_delchain(ctx
);
1232 err
= nft_deltable(ctx
);
1237 static int nft_flush(struct nft_ctx
*ctx
, int family
)
1239 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
1240 const struct nlattr
* const *nla
= ctx
->nla
;
1241 struct nft_table
*table
, *nt
;
1244 list_for_each_entry_safe(table
, nt
, &nft_net
->tables
, list
) {
1245 if (family
!= AF_UNSPEC
&& table
->family
!= family
)
1248 ctx
->family
= table
->family
;
1250 if (!nft_is_active_next(ctx
->net
, table
))
1253 if (nft_table_has_owner(table
) && table
->nlpid
!= ctx
->portid
)
1256 if (nla
[NFTA_TABLE_NAME
] &&
1257 nla_strcmp(nla
[NFTA_TABLE_NAME
], table
->name
) != 0)
1262 err
= nft_flush_table(ctx
);
1270 static int nf_tables_deltable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1271 const struct nlattr
* const nla
[])
1273 struct netlink_ext_ack
*extack
= info
->extack
;
1274 u8 genmask
= nft_genmask_next(info
->net
);
1275 u8 family
= info
->nfmsg
->nfgen_family
;
1276 struct net
*net
= info
->net
;
1277 const struct nlattr
*attr
;
1278 struct nft_table
*table
;
1281 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, 0, NULL
, NULL
, nla
);
1282 if (family
== AF_UNSPEC
||
1283 (!nla
[NFTA_TABLE_NAME
] && !nla
[NFTA_TABLE_HANDLE
]))
1284 return nft_flush(&ctx
, family
);
1286 if (nla
[NFTA_TABLE_HANDLE
]) {
1287 attr
= nla
[NFTA_TABLE_HANDLE
];
1288 table
= nft_table_lookup_byhandle(net
, attr
, genmask
,
1289 NETLINK_CB(skb
).portid
);
1291 attr
= nla
[NFTA_TABLE_NAME
];
1292 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1293 NETLINK_CB(skb
).portid
);
1296 if (IS_ERR(table
)) {
1297 NL_SET_BAD_ATTR(extack
, attr
);
1298 return PTR_ERR(table
);
1301 if (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
1305 ctx
.family
= family
;
1308 return nft_flush_table(&ctx
);
1311 static void nf_tables_table_destroy(struct nft_ctx
*ctx
)
1313 if (WARN_ON(ctx
->table
->use
> 0))
1316 rhltable_destroy(&ctx
->table
->chains_ht
);
1317 kfree(ctx
->table
->name
);
1318 kfree(ctx
->table
->udata
);
1322 void nft_register_chain_type(const struct nft_chain_type
*ctype
)
1324 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1325 if (WARN_ON(__nft_chain_type_get(ctype
->family
, ctype
->type
))) {
1326 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1329 chain_type
[ctype
->family
][ctype
->type
] = ctype
;
1330 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1332 EXPORT_SYMBOL_GPL(nft_register_chain_type
);
1334 void nft_unregister_chain_type(const struct nft_chain_type
*ctype
)
1336 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1337 chain_type
[ctype
->family
][ctype
->type
] = NULL
;
1338 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1340 EXPORT_SYMBOL_GPL(nft_unregister_chain_type
);
1346 static struct nft_chain
*
1347 nft_chain_lookup_byhandle(const struct nft_table
*table
, u64 handle
, u8 genmask
)
1349 struct nft_chain
*chain
;
1351 list_for_each_entry(chain
, &table
->chains
, list
) {
1352 if (chain
->handle
== handle
&&
1353 nft_active_genmask(chain
, genmask
))
1357 return ERR_PTR(-ENOENT
);
1360 static bool lockdep_commit_lock_is_held(const struct net
*net
)
1362 #ifdef CONFIG_PROVE_LOCKING
1363 struct nftables_pernet
*nft_net
= nft_pernet(net
);
1365 return lockdep_is_held(&nft_net
->commit_mutex
);
1371 static struct nft_chain
*nft_chain_lookup(struct net
*net
,
1372 struct nft_table
*table
,
1373 const struct nlattr
*nla
, u8 genmask
)
1375 char search
[NFT_CHAIN_MAXNAMELEN
+ 1];
1376 struct rhlist_head
*tmp
, *list
;
1377 struct nft_chain
*chain
;
1380 return ERR_PTR(-EINVAL
);
1382 nla_strscpy(search
, nla
, sizeof(search
));
1384 WARN_ON(!rcu_read_lock_held() &&
1385 !lockdep_commit_lock_is_held(net
));
1387 chain
= ERR_PTR(-ENOENT
);
1389 list
= rhltable_lookup(&table
->chains_ht
, search
, nft_chain_ht_params
);
1393 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
1394 if (nft_active_genmask(chain
, genmask
))
1397 chain
= ERR_PTR(-ENOENT
);
1403 static const struct nla_policy nft_chain_policy
[NFTA_CHAIN_MAX
+ 1] = {
1404 [NFTA_CHAIN_TABLE
] = { .type
= NLA_STRING
,
1405 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
1406 [NFTA_CHAIN_HANDLE
] = { .type
= NLA_U64
},
1407 [NFTA_CHAIN_NAME
] = { .type
= NLA_STRING
,
1408 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
1409 [NFTA_CHAIN_HOOK
] = { .type
= NLA_NESTED
},
1410 [NFTA_CHAIN_POLICY
] = { .type
= NLA_U32
},
1411 [NFTA_CHAIN_TYPE
] = { .type
= NLA_STRING
,
1412 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
1413 [NFTA_CHAIN_COUNTERS
] = { .type
= NLA_NESTED
},
1414 [NFTA_CHAIN_FLAGS
] = { .type
= NLA_U32
},
1415 [NFTA_CHAIN_ID
] = { .type
= NLA_U32
},
1416 [NFTA_CHAIN_USERDATA
] = { .type
= NLA_BINARY
,
1417 .len
= NFT_USERDATA_MAXLEN
},
1420 static const struct nla_policy nft_hook_policy
[NFTA_HOOK_MAX
+ 1] = {
1421 [NFTA_HOOK_HOOKNUM
] = { .type
= NLA_U32
},
1422 [NFTA_HOOK_PRIORITY
] = { .type
= NLA_U32
},
1423 [NFTA_HOOK_DEV
] = { .type
= NLA_STRING
,
1424 .len
= IFNAMSIZ
- 1 },
1427 static int nft_dump_stats(struct sk_buff
*skb
, struct nft_stats __percpu
*stats
)
1429 struct nft_stats
*cpu_stats
, total
;
1430 struct nlattr
*nest
;
1438 memset(&total
, 0, sizeof(total
));
1439 for_each_possible_cpu(cpu
) {
1440 cpu_stats
= per_cpu_ptr(stats
, cpu
);
1442 seq
= u64_stats_fetch_begin_irq(&cpu_stats
->syncp
);
1443 pkts
= cpu_stats
->pkts
;
1444 bytes
= cpu_stats
->bytes
;
1445 } while (u64_stats_fetch_retry_irq(&cpu_stats
->syncp
, seq
));
1447 total
.bytes
+= bytes
;
1449 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_COUNTERS
);
1451 goto nla_put_failure
;
1453 if (nla_put_be64(skb
, NFTA_COUNTER_PACKETS
, cpu_to_be64(total
.pkts
),
1454 NFTA_COUNTER_PAD
) ||
1455 nla_put_be64(skb
, NFTA_COUNTER_BYTES
, cpu_to_be64(total
.bytes
),
1457 goto nla_put_failure
;
1459 nla_nest_end(skb
, nest
);
1466 static int nft_dump_basechain_hook(struct sk_buff
*skb
, int family
,
1467 const struct nft_base_chain
*basechain
)
1469 const struct nf_hook_ops
*ops
= &basechain
->ops
;
1470 struct nft_hook
*hook
, *first
= NULL
;
1471 struct nlattr
*nest
, *nest_devs
;
1474 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_HOOK
);
1476 goto nla_put_failure
;
1477 if (nla_put_be32(skb
, NFTA_HOOK_HOOKNUM
, htonl(ops
->hooknum
)))
1478 goto nla_put_failure
;
1479 if (nla_put_be32(skb
, NFTA_HOOK_PRIORITY
, htonl(ops
->priority
)))
1480 goto nla_put_failure
;
1482 if (nft_base_chain_netdev(family
, ops
->hooknum
)) {
1483 nest_devs
= nla_nest_start_noflag(skb
, NFTA_HOOK_DEVS
);
1484 list_for_each_entry(hook
, &basechain
->hook_list
, list
) {
1488 if (nla_put_string(skb
, NFTA_DEVICE_NAME
,
1489 hook
->ops
.dev
->name
))
1490 goto nla_put_failure
;
1493 nla_nest_end(skb
, nest_devs
);
1496 nla_put_string(skb
, NFTA_HOOK_DEV
, first
->ops
.dev
->name
))
1497 goto nla_put_failure
;
1499 nla_nest_end(skb
, nest
);
1506 static int nf_tables_fill_chain_info(struct sk_buff
*skb
, struct net
*net
,
1507 u32 portid
, u32 seq
, int event
, u32 flags
,
1508 int family
, const struct nft_table
*table
,
1509 const struct nft_chain
*chain
)
1511 struct nlmsghdr
*nlh
;
1513 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
1514 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
1515 NFNETLINK_V0
, nft_base_seq(net
));
1517 goto nla_put_failure
;
1519 if (nla_put_string(skb
, NFTA_CHAIN_TABLE
, table
->name
))
1520 goto nla_put_failure
;
1521 if (nla_put_be64(skb
, NFTA_CHAIN_HANDLE
, cpu_to_be64(chain
->handle
),
1523 goto nla_put_failure
;
1524 if (nla_put_string(skb
, NFTA_CHAIN_NAME
, chain
->name
))
1525 goto nla_put_failure
;
1527 if (nft_is_base_chain(chain
)) {
1528 const struct nft_base_chain
*basechain
= nft_base_chain(chain
);
1529 struct nft_stats __percpu
*stats
;
1531 if (nft_dump_basechain_hook(skb
, family
, basechain
))
1532 goto nla_put_failure
;
1534 if (nla_put_be32(skb
, NFTA_CHAIN_POLICY
,
1535 htonl(basechain
->policy
)))
1536 goto nla_put_failure
;
1538 if (nla_put_string(skb
, NFTA_CHAIN_TYPE
, basechain
->type
->name
))
1539 goto nla_put_failure
;
1541 stats
= rcu_dereference_check(basechain
->stats
,
1542 lockdep_commit_lock_is_held(net
));
1543 if (nft_dump_stats(skb
, stats
))
1544 goto nla_put_failure
;
1548 nla_put_be32(skb
, NFTA_CHAIN_FLAGS
, htonl(chain
->flags
)))
1549 goto nla_put_failure
;
1551 if (nla_put_be32(skb
, NFTA_CHAIN_USE
, htonl(chain
->use
)))
1552 goto nla_put_failure
;
1555 nla_put(skb
, NFTA_CHAIN_USERDATA
, chain
->udlen
, chain
->udata
))
1556 goto nla_put_failure
;
1558 nlmsg_end(skb
, nlh
);
1562 nlmsg_trim(skb
, nlh
);
1566 static void nf_tables_chain_notify(const struct nft_ctx
*ctx
, int event
)
1568 struct nftables_pernet
*nft_net
;
1569 struct sk_buff
*skb
;
1574 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
1577 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
1581 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
1582 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
1584 err
= nf_tables_fill_chain_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
1585 event
, flags
, ctx
->family
, ctx
->table
,
1592 nft_net
= nft_pernet(ctx
->net
);
1593 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
1596 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
1599 static int nf_tables_dump_chains(struct sk_buff
*skb
,
1600 struct netlink_callback
*cb
)
1602 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1603 unsigned int idx
= 0, s_idx
= cb
->args
[0];
1604 struct net
*net
= sock_net(skb
->sk
);
1605 int family
= nfmsg
->nfgen_family
;
1606 struct nftables_pernet
*nft_net
;
1607 const struct nft_table
*table
;
1608 const struct nft_chain
*chain
;
1611 nft_net
= nft_pernet(net
);
1612 cb
->seq
= nft_net
->base_seq
;
1614 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
1615 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
1618 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
1622 memset(&cb
->args
[1], 0,
1623 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
1624 if (!nft_is_active(net
, chain
))
1626 if (nf_tables_fill_chain_info(skb
, net
,
1627 NETLINK_CB(cb
->skb
).portid
,
1631 table
->family
, table
,
1635 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
1646 /* called with rcu_read_lock held */
1647 static int nf_tables_getchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1648 const struct nlattr
* const nla
[])
1650 struct netlink_ext_ack
*extack
= info
->extack
;
1651 u8 genmask
= nft_genmask_cur(info
->net
);
1652 u8 family
= info
->nfmsg
->nfgen_family
;
1653 const struct nft_chain
*chain
;
1654 struct net
*net
= info
->net
;
1655 struct nft_table
*table
;
1656 struct sk_buff
*skb2
;
1659 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1660 struct netlink_dump_control c
= {
1661 .dump
= nf_tables_dump_chains
,
1662 .module
= THIS_MODULE
,
1665 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
1668 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
, 0);
1669 if (IS_ERR(table
)) {
1670 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
1671 return PTR_ERR(table
);
1674 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_CHAIN_NAME
], genmask
);
1675 if (IS_ERR(chain
)) {
1676 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
1677 return PTR_ERR(chain
);
1680 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
1684 err
= nf_tables_fill_chain_info(skb2
, net
, NETLINK_CB(skb
).portid
,
1685 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWCHAIN
,
1686 0, family
, table
, chain
);
1688 goto err_fill_chain_info
;
1690 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
1692 err_fill_chain_info
:
1697 static const struct nla_policy nft_counter_policy
[NFTA_COUNTER_MAX
+ 1] = {
1698 [NFTA_COUNTER_PACKETS
] = { .type
= NLA_U64
},
1699 [NFTA_COUNTER_BYTES
] = { .type
= NLA_U64
},
1702 static struct nft_stats __percpu
*nft_stats_alloc(const struct nlattr
*attr
)
1704 struct nlattr
*tb
[NFTA_COUNTER_MAX
+1];
1705 struct nft_stats __percpu
*newstats
;
1706 struct nft_stats
*stats
;
1709 err
= nla_parse_nested_deprecated(tb
, NFTA_COUNTER_MAX
, attr
,
1710 nft_counter_policy
, NULL
);
1712 return ERR_PTR(err
);
1714 if (!tb
[NFTA_COUNTER_BYTES
] || !tb
[NFTA_COUNTER_PACKETS
])
1715 return ERR_PTR(-EINVAL
);
1717 newstats
= netdev_alloc_pcpu_stats(struct nft_stats
);
1718 if (newstats
== NULL
)
1719 return ERR_PTR(-ENOMEM
);
1721 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1722 * are not exposed to userspace.
1725 stats
= this_cpu_ptr(newstats
);
1726 stats
->bytes
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_BYTES
]));
1727 stats
->pkts
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_PACKETS
]));
1733 static void nft_chain_stats_replace(struct nft_trans
*trans
)
1735 struct nft_base_chain
*chain
= nft_base_chain(trans
->ctx
.chain
);
1737 if (!nft_trans_chain_stats(trans
))
1740 nft_trans_chain_stats(trans
) =
1741 rcu_replace_pointer(chain
->stats
, nft_trans_chain_stats(trans
),
1742 lockdep_commit_lock_is_held(trans
->ctx
.net
));
1744 if (!nft_trans_chain_stats(trans
))
1745 static_branch_inc(&nft_counters_enabled
);
1748 static void nf_tables_chain_free_chain_rules(struct nft_chain
*chain
)
1750 struct nft_rule
**g0
= rcu_dereference_raw(chain
->rules_gen_0
);
1751 struct nft_rule
**g1
= rcu_dereference_raw(chain
->rules_gen_1
);
1757 /* should be NULL either via abort or via successful commit */
1758 WARN_ON_ONCE(chain
->rules_next
);
1759 kvfree(chain
->rules_next
);
1762 void nf_tables_chain_destroy(struct nft_ctx
*ctx
)
1764 struct nft_chain
*chain
= ctx
->chain
;
1765 struct nft_hook
*hook
, *next
;
1767 if (WARN_ON(chain
->use
> 0))
1770 /* no concurrent access possible anymore */
1771 nf_tables_chain_free_chain_rules(chain
);
1773 if (nft_is_base_chain(chain
)) {
1774 struct nft_base_chain
*basechain
= nft_base_chain(chain
);
1776 if (nft_base_chain_netdev(ctx
->family
, basechain
->ops
.hooknum
)) {
1777 list_for_each_entry_safe(hook
, next
,
1778 &basechain
->hook_list
, list
) {
1779 list_del_rcu(&hook
->list
);
1780 kfree_rcu(hook
, rcu
);
1783 module_put(basechain
->type
->owner
);
1784 if (rcu_access_pointer(basechain
->stats
)) {
1785 static_branch_dec(&nft_counters_enabled
);
1786 free_percpu(rcu_dereference_raw(basechain
->stats
));
1789 kfree(chain
->udata
);
1793 kfree(chain
->udata
);
1798 static struct nft_hook
*nft_netdev_hook_alloc(struct net
*net
,
1799 const struct nlattr
*attr
)
1801 struct net_device
*dev
;
1802 char ifname
[IFNAMSIZ
];
1803 struct nft_hook
*hook
;
1806 hook
= kmalloc(sizeof(struct nft_hook
), GFP_KERNEL
);
1809 goto err_hook_alloc
;
1812 nla_strscpy(ifname
, attr
, IFNAMSIZ
);
1813 /* nf_tables_netdev_event() is called under rtnl_mutex, this is
1814 * indirectly serializing all the other holders of the commit_mutex with
1817 dev
= __dev_get_by_name(net
, ifname
);
1822 hook
->ops
.dev
= dev
;
1823 hook
->inactive
= false;
1830 return ERR_PTR(err
);
1833 static struct nft_hook
*nft_hook_list_find(struct list_head
*hook_list
,
1834 const struct nft_hook
*this)
1836 struct nft_hook
*hook
;
1838 list_for_each_entry(hook
, hook_list
, list
) {
1839 if (this->ops
.dev
== hook
->ops
.dev
)
1846 static int nf_tables_parse_netdev_hooks(struct net
*net
,
1847 const struct nlattr
*attr
,
1848 struct list_head
*hook_list
)
1850 struct nft_hook
*hook
, *next
;
1851 const struct nlattr
*tmp
;
1852 int rem
, n
= 0, err
;
1854 nla_for_each_nested(tmp
, attr
, rem
) {
1855 if (nla_type(tmp
) != NFTA_DEVICE_NAME
) {
1860 hook
= nft_netdev_hook_alloc(net
, tmp
);
1862 err
= PTR_ERR(hook
);
1865 if (nft_hook_list_find(hook_list
, hook
)) {
1870 list_add_tail(&hook
->list
, hook_list
);
1873 if (n
== NFT_NETDEVICE_MAX
) {
1882 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
1883 list_del(&hook
->list
);
1889 struct nft_chain_hook
{
1892 const struct nft_chain_type
*type
;
1893 struct list_head list
;
1896 static int nft_chain_parse_netdev(struct net
*net
,
1897 struct nlattr
*tb
[],
1898 struct list_head
*hook_list
)
1900 struct nft_hook
*hook
;
1903 if (tb
[NFTA_HOOK_DEV
]) {
1904 hook
= nft_netdev_hook_alloc(net
, tb
[NFTA_HOOK_DEV
]);
1906 return PTR_ERR(hook
);
1908 list_add_tail(&hook
->list
, hook_list
);
1909 } else if (tb
[NFTA_HOOK_DEVS
]) {
1910 err
= nf_tables_parse_netdev_hooks(net
, tb
[NFTA_HOOK_DEVS
],
1915 if (list_empty(hook_list
))
1924 static int nft_chain_parse_hook(struct net
*net
,
1925 const struct nlattr
* const nla
[],
1926 struct nft_chain_hook
*hook
, u8 family
,
1927 struct netlink_ext_ack
*extack
, bool autoload
)
1929 struct nftables_pernet
*nft_net
= nft_pernet(net
);
1930 struct nlattr
*ha
[NFTA_HOOK_MAX
+ 1];
1931 const struct nft_chain_type
*type
;
1934 lockdep_assert_held(&nft_net
->commit_mutex
);
1935 lockdep_nfnl_nft_mutex_not_held();
1937 err
= nla_parse_nested_deprecated(ha
, NFTA_HOOK_MAX
,
1938 nla
[NFTA_CHAIN_HOOK
],
1939 nft_hook_policy
, NULL
);
1943 if (ha
[NFTA_HOOK_HOOKNUM
] == NULL
||
1944 ha
[NFTA_HOOK_PRIORITY
] == NULL
)
1947 hook
->num
= ntohl(nla_get_be32(ha
[NFTA_HOOK_HOOKNUM
]));
1948 hook
->priority
= ntohl(nla_get_be32(ha
[NFTA_HOOK_PRIORITY
]));
1950 type
= __nft_chain_type_get(family
, NFT_CHAIN_T_DEFAULT
);
1954 if (nla
[NFTA_CHAIN_TYPE
]) {
1955 type
= nf_tables_chain_type_lookup(net
, nla
[NFTA_CHAIN_TYPE
],
1958 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TYPE
]);
1959 return PTR_ERR(type
);
1962 if (hook
->num
>= NFT_MAX_HOOKS
|| !(type
->hook_mask
& (1 << hook
->num
)))
1965 if (type
->type
== NFT_CHAIN_T_NAT
&&
1966 hook
->priority
<= NF_IP_PRI_CONNTRACK
)
1969 if (!try_module_get(type
->owner
)) {
1970 if (nla
[NFTA_CHAIN_TYPE
])
1971 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TYPE
]);
1977 INIT_LIST_HEAD(&hook
->list
);
1978 if (nft_base_chain_netdev(family
, hook
->num
)) {
1979 err
= nft_chain_parse_netdev(net
, ha
, &hook
->list
);
1981 module_put(type
->owner
);
1984 } else if (ha
[NFTA_HOOK_DEV
] || ha
[NFTA_HOOK_DEVS
]) {
1985 module_put(type
->owner
);
1992 static void nft_chain_release_hook(struct nft_chain_hook
*hook
)
1994 struct nft_hook
*h
, *next
;
1996 list_for_each_entry_safe(h
, next
, &hook
->list
, list
) {
2000 module_put(hook
->type
->owner
);
2003 struct nft_rules_old
{
2005 struct nft_rule
**start
;
2008 static struct nft_rule
**nf_tables_chain_alloc_rules(const struct nft_chain
*chain
,
2011 if (alloc
> INT_MAX
)
2014 alloc
+= 1; /* NULL, ends rules */
2015 if (sizeof(struct nft_rule
*) > INT_MAX
/ alloc
)
2018 alloc
*= sizeof(struct nft_rule
*);
2019 alloc
+= sizeof(struct nft_rules_old
);
2021 return kvmalloc(alloc
, GFP_KERNEL
);
2024 static void nft_basechain_hook_init(struct nf_hook_ops
*ops
, u8 family
,
2025 const struct nft_chain_hook
*hook
,
2026 struct nft_chain
*chain
)
2029 ops
->hooknum
= hook
->num
;
2030 ops
->priority
= hook
->priority
;
2032 ops
->hook
= hook
->type
->hooks
[ops
->hooknum
];
2033 ops
->hook_ops_type
= NF_HOOK_OP_NF_TABLES
;
2036 static int nft_basechain_init(struct nft_base_chain
*basechain
, u8 family
,
2037 struct nft_chain_hook
*hook
, u32 flags
)
2039 struct nft_chain
*chain
;
2042 basechain
->type
= hook
->type
;
2043 INIT_LIST_HEAD(&basechain
->hook_list
);
2044 chain
= &basechain
->chain
;
2046 if (nft_base_chain_netdev(family
, hook
->num
)) {
2047 list_splice_init(&hook
->list
, &basechain
->hook_list
);
2048 list_for_each_entry(h
, &basechain
->hook_list
, list
)
2049 nft_basechain_hook_init(&h
->ops
, family
, hook
, chain
);
2051 basechain
->ops
.hooknum
= hook
->num
;
2052 basechain
->ops
.priority
= hook
->priority
;
2054 nft_basechain_hook_init(&basechain
->ops
, family
, hook
, chain
);
2057 chain
->flags
|= NFT_CHAIN_BASE
| flags
;
2058 basechain
->policy
= NF_ACCEPT
;
2059 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
&&
2060 nft_chain_offload_priority(basechain
) < 0)
2063 flow_block_init(&basechain
->flow_block
);
2068 static int nft_chain_add(struct nft_table
*table
, struct nft_chain
*chain
)
2072 err
= rhltable_insert_key(&table
->chains_ht
, chain
->name
,
2073 &chain
->rhlhead
, nft_chain_ht_params
);
2077 list_add_tail_rcu(&chain
->list
, &table
->chains
);
2082 static u64 chain_id
;
2084 static int nf_tables_addchain(struct nft_ctx
*ctx
, u8 family
, u8 genmask
,
2085 u8 policy
, u32 flags
,
2086 struct netlink_ext_ack
*extack
)
2088 const struct nlattr
* const *nla
= ctx
->nla
;
2089 struct nft_table
*table
= ctx
->table
;
2090 struct nft_base_chain
*basechain
;
2091 struct nft_stats __percpu
*stats
;
2092 struct net
*net
= ctx
->net
;
2093 char name
[NFT_NAME_MAXLEN
];
2094 struct nft_trans
*trans
;
2095 struct nft_chain
*chain
;
2096 struct nft_rule
**rules
;
2099 if (table
->use
== UINT_MAX
)
2102 if (nla
[NFTA_CHAIN_HOOK
]) {
2103 struct nft_chain_hook hook
;
2105 if (flags
& NFT_CHAIN_BINDING
)
2108 err
= nft_chain_parse_hook(net
, nla
, &hook
, family
, extack
,
2113 basechain
= kzalloc(sizeof(*basechain
), GFP_KERNEL
);
2114 if (basechain
== NULL
) {
2115 nft_chain_release_hook(&hook
);
2118 chain
= &basechain
->chain
;
2120 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2121 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2122 if (IS_ERR(stats
)) {
2123 nft_chain_release_hook(&hook
);
2125 return PTR_ERR(stats
);
2127 rcu_assign_pointer(basechain
->stats
, stats
);
2128 static_branch_inc(&nft_counters_enabled
);
2131 err
= nft_basechain_init(basechain
, family
, &hook
, flags
);
2133 nft_chain_release_hook(&hook
);
2138 if (flags
& NFT_CHAIN_BASE
)
2140 if (flags
& NFT_CHAIN_HW_OFFLOAD
)
2143 chain
= kzalloc(sizeof(*chain
), GFP_KERNEL
);
2147 chain
->flags
= flags
;
2151 INIT_LIST_HEAD(&chain
->rules
);
2152 chain
->handle
= nf_tables_alloc_handle(table
);
2153 chain
->table
= table
;
2155 if (nla
[NFTA_CHAIN_NAME
]) {
2156 chain
->name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL
);
2158 if (!(flags
& NFT_CHAIN_BINDING
)) {
2160 goto err_destroy_chain
;
2163 snprintf(name
, sizeof(name
), "__chain%llu", ++chain_id
);
2164 chain
->name
= kstrdup(name
, GFP_KERNEL
);
2169 goto err_destroy_chain
;
2172 if (nla
[NFTA_CHAIN_USERDATA
]) {
2173 chain
->udata
= nla_memdup(nla
[NFTA_CHAIN_USERDATA
], GFP_KERNEL
);
2174 if (chain
->udata
== NULL
) {
2176 goto err_destroy_chain
;
2178 chain
->udlen
= nla_len(nla
[NFTA_CHAIN_USERDATA
]);
2181 rules
= nf_tables_chain_alloc_rules(chain
, 0);
2184 goto err_destroy_chain
;
2188 rcu_assign_pointer(chain
->rules_gen_0
, rules
);
2189 rcu_assign_pointer(chain
->rules_gen_1
, rules
);
2191 err
= nf_tables_register_hook(net
, table
, chain
);
2193 goto err_destroy_chain
;
2195 trans
= nft_trans_chain_add(ctx
, NFT_MSG_NEWCHAIN
);
2196 if (IS_ERR(trans
)) {
2197 err
= PTR_ERR(trans
);
2198 goto err_unregister_hook
;
2201 nft_trans_chain_policy(trans
) = NFT_CHAIN_POLICY_UNSET
;
2202 if (nft_is_base_chain(chain
))
2203 nft_trans_chain_policy(trans
) = policy
;
2205 err
= nft_chain_add(table
, chain
);
2207 nft_trans_destroy(trans
);
2208 goto err_unregister_hook
;
2214 err_unregister_hook
:
2215 nf_tables_unregister_hook(net
, table
, chain
);
2217 nf_tables_chain_destroy(ctx
);
2222 static bool nft_hook_list_equal(struct list_head
*hook_list1
,
2223 struct list_head
*hook_list2
)
2225 struct nft_hook
*hook
;
2229 list_for_each_entry(hook
, hook_list2
, list
) {
2230 if (!nft_hook_list_find(hook_list1
, hook
))
2235 list_for_each_entry(hook
, hook_list1
, list
)
2241 static int nf_tables_updchain(struct nft_ctx
*ctx
, u8 genmask
, u8 policy
,
2242 u32 flags
, const struct nlattr
*attr
,
2243 struct netlink_ext_ack
*extack
)
2245 const struct nlattr
* const *nla
= ctx
->nla
;
2246 struct nft_table
*table
= ctx
->table
;
2247 struct nft_chain
*chain
= ctx
->chain
;
2248 struct nft_base_chain
*basechain
;
2249 struct nft_stats
*stats
= NULL
;
2250 struct nft_chain_hook hook
;
2251 struct nf_hook_ops
*ops
;
2252 struct nft_trans
*trans
;
2255 if (chain
->flags
^ flags
)
2258 if (nla
[NFTA_CHAIN_HOOK
]) {
2259 if (!nft_is_base_chain(chain
)) {
2260 NL_SET_BAD_ATTR(extack
, attr
);
2263 err
= nft_chain_parse_hook(ctx
->net
, nla
, &hook
, ctx
->family
,
2268 basechain
= nft_base_chain(chain
);
2269 if (basechain
->type
!= hook
.type
) {
2270 nft_chain_release_hook(&hook
);
2271 NL_SET_BAD_ATTR(extack
, attr
);
2275 if (nft_base_chain_netdev(ctx
->family
, hook
.num
)) {
2276 if (!nft_hook_list_equal(&basechain
->hook_list
,
2278 nft_chain_release_hook(&hook
);
2279 NL_SET_BAD_ATTR(extack
, attr
);
2283 ops
= &basechain
->ops
;
2284 if (ops
->hooknum
!= hook
.num
||
2285 ops
->priority
!= hook
.priority
) {
2286 nft_chain_release_hook(&hook
);
2287 NL_SET_BAD_ATTR(extack
, attr
);
2291 nft_chain_release_hook(&hook
);
2294 if (nla
[NFTA_CHAIN_HANDLE
] &&
2295 nla
[NFTA_CHAIN_NAME
]) {
2296 struct nft_chain
*chain2
;
2298 chain2
= nft_chain_lookup(ctx
->net
, table
,
2299 nla
[NFTA_CHAIN_NAME
], genmask
);
2300 if (!IS_ERR(chain2
)) {
2301 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2306 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2307 if (!nft_is_base_chain(chain
))
2310 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2312 return PTR_ERR(stats
);
2316 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWCHAIN
,
2317 sizeof(struct nft_trans_chain
));
2321 nft_trans_chain_stats(trans
) = stats
;
2322 nft_trans_chain_update(trans
) = true;
2324 if (nla
[NFTA_CHAIN_POLICY
])
2325 nft_trans_chain_policy(trans
) = policy
;
2327 nft_trans_chain_policy(trans
) = -1;
2329 if (nla
[NFTA_CHAIN_HANDLE
] &&
2330 nla
[NFTA_CHAIN_NAME
]) {
2331 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
2332 struct nft_trans
*tmp
;
2336 name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL
);
2341 list_for_each_entry(tmp
, &nft_net
->commit_list
, list
) {
2342 if (tmp
->msg_type
== NFT_MSG_NEWCHAIN
&&
2343 tmp
->ctx
.table
== table
&&
2344 nft_trans_chain_update(tmp
) &&
2345 nft_trans_chain_name(tmp
) &&
2346 strcmp(name
, nft_trans_chain_name(tmp
)) == 0) {
2347 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2353 nft_trans_chain_name(trans
) = name
;
2355 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
2364 static struct nft_chain
*nft_chain_lookup_byid(const struct net
*net
,
2365 const struct nlattr
*nla
)
2367 struct nftables_pernet
*nft_net
= nft_pernet(net
);
2368 u32 id
= ntohl(nla_get_be32(nla
));
2369 struct nft_trans
*trans
;
2371 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
2372 struct nft_chain
*chain
= trans
->ctx
.chain
;
2374 if (trans
->msg_type
== NFT_MSG_NEWCHAIN
&&
2375 id
== nft_trans_chain_id(trans
))
2378 return ERR_PTR(-ENOENT
);
2381 static int nf_tables_newchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
2382 const struct nlattr
* const nla
[])
2384 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
2385 struct netlink_ext_ack
*extack
= info
->extack
;
2386 u8 genmask
= nft_genmask_next(info
->net
);
2387 u8 family
= info
->nfmsg
->nfgen_family
;
2388 struct nft_chain
*chain
= NULL
;
2389 struct net
*net
= info
->net
;
2390 const struct nlattr
*attr
;
2391 struct nft_table
*table
;
2392 u8 policy
= NF_ACCEPT
;
2397 lockdep_assert_held(&nft_net
->commit_mutex
);
2399 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2400 NETLINK_CB(skb
).portid
);
2401 if (IS_ERR(table
)) {
2402 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2403 return PTR_ERR(table
);
2407 attr
= nla
[NFTA_CHAIN_NAME
];
2409 if (nla
[NFTA_CHAIN_HANDLE
]) {
2410 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_CHAIN_HANDLE
]));
2411 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2412 if (IS_ERR(chain
)) {
2413 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_HANDLE
]);
2414 return PTR_ERR(chain
);
2416 attr
= nla
[NFTA_CHAIN_HANDLE
];
2417 } else if (nla
[NFTA_CHAIN_NAME
]) {
2418 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2419 if (IS_ERR(chain
)) {
2420 if (PTR_ERR(chain
) != -ENOENT
) {
2421 NL_SET_BAD_ATTR(extack
, attr
);
2422 return PTR_ERR(chain
);
2426 } else if (!nla
[NFTA_CHAIN_ID
]) {
2430 if (nla
[NFTA_CHAIN_POLICY
]) {
2431 if (chain
!= NULL
&&
2432 !nft_is_base_chain(chain
)) {
2433 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2437 if (chain
== NULL
&&
2438 nla
[NFTA_CHAIN_HOOK
] == NULL
) {
2439 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2443 policy
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_POLICY
]));
2453 if (nla
[NFTA_CHAIN_FLAGS
])
2454 flags
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_FLAGS
]));
2456 flags
= chain
->flags
;
2458 if (flags
& ~NFT_CHAIN_FLAGS
)
2461 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
2463 if (chain
!= NULL
) {
2464 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
2465 NL_SET_BAD_ATTR(extack
, attr
);
2468 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
2471 flags
|= chain
->flags
& NFT_CHAIN_BASE
;
2472 return nf_tables_updchain(&ctx
, genmask
, policy
, flags
, attr
,
2476 return nf_tables_addchain(&ctx
, family
, genmask
, policy
, flags
, extack
);
2479 static int nf_tables_delchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
2480 const struct nlattr
* const nla
[])
2482 struct netlink_ext_ack
*extack
= info
->extack
;
2483 u8 genmask
= nft_genmask_next(info
->net
);
2484 u8 family
= info
->nfmsg
->nfgen_family
;
2485 struct net
*net
= info
->net
;
2486 const struct nlattr
*attr
;
2487 struct nft_table
*table
;
2488 struct nft_chain
*chain
;
2489 struct nft_rule
*rule
;
2495 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2496 NETLINK_CB(skb
).portid
);
2497 if (IS_ERR(table
)) {
2498 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2499 return PTR_ERR(table
);
2502 if (nla
[NFTA_CHAIN_HANDLE
]) {
2503 attr
= nla
[NFTA_CHAIN_HANDLE
];
2504 handle
= be64_to_cpu(nla_get_be64(attr
));
2505 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2507 attr
= nla
[NFTA_CHAIN_NAME
];
2508 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2510 if (IS_ERR(chain
)) {
2511 NL_SET_BAD_ATTR(extack
, attr
);
2512 return PTR_ERR(chain
);
2515 if (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
2519 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
2522 list_for_each_entry(rule
, &chain
->rules
, list
) {
2523 if (!nft_is_active_next(net
, rule
))
2527 err
= nft_delrule(&ctx
, rule
);
2532 /* There are rules and elements that are still holding references to us,
2533 * we cannot do a recursive removal in this case.
2536 NL_SET_BAD_ATTR(extack
, attr
);
2540 return nft_delchain(&ctx
);
2548 * nft_register_expr - register nf_tables expr type
2551 * Registers the expr type for use with nf_tables. Returns zero on
2552 * success or a negative errno code otherwise.
2554 int nft_register_expr(struct nft_expr_type
*type
)
2556 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2557 if (type
->family
== NFPROTO_UNSPEC
)
2558 list_add_tail_rcu(&type
->list
, &nf_tables_expressions
);
2560 list_add_rcu(&type
->list
, &nf_tables_expressions
);
2561 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2564 EXPORT_SYMBOL_GPL(nft_register_expr
);
2567 * nft_unregister_expr - unregister nf_tables expr type
2570 * Unregisters the expr typefor use with nf_tables.
2572 void nft_unregister_expr(struct nft_expr_type
*type
)
2574 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2575 list_del_rcu(&type
->list
);
2576 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2578 EXPORT_SYMBOL_GPL(nft_unregister_expr
);
2580 static const struct nft_expr_type
*__nft_expr_type_get(u8 family
,
2583 const struct nft_expr_type
*type
, *candidate
= NULL
;
2585 list_for_each_entry(type
, &nf_tables_expressions
, list
) {
2586 if (!nla_strcmp(nla
, type
->name
)) {
2587 if (!type
->family
&& !candidate
)
2589 else if (type
->family
== family
)
2596 #ifdef CONFIG_MODULES
2597 static int nft_expr_type_request_module(struct net
*net
, u8 family
,
2600 if (nft_request_module(net
, "nft-expr-%u-%.*s", family
,
2601 nla_len(nla
), (char *)nla_data(nla
)) == -EAGAIN
)
2608 static const struct nft_expr_type
*nft_expr_type_get(struct net
*net
,
2612 const struct nft_expr_type
*type
;
2615 return ERR_PTR(-EINVAL
);
2617 type
= __nft_expr_type_get(family
, nla
);
2618 if (type
!= NULL
&& try_module_get(type
->owner
))
2621 lockdep_nfnl_nft_mutex_not_held();
2622 #ifdef CONFIG_MODULES
2624 if (nft_expr_type_request_module(net
, family
, nla
) == -EAGAIN
)
2625 return ERR_PTR(-EAGAIN
);
2627 if (nft_request_module(net
, "nft-expr-%.*s",
2629 (char *)nla_data(nla
)) == -EAGAIN
)
2630 return ERR_PTR(-EAGAIN
);
2633 return ERR_PTR(-ENOENT
);
2636 static const struct nla_policy nft_expr_policy
[NFTA_EXPR_MAX
+ 1] = {
2637 [NFTA_EXPR_NAME
] = { .type
= NLA_STRING
,
2638 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
2639 [NFTA_EXPR_DATA
] = { .type
= NLA_NESTED
},
2642 static int nf_tables_fill_expr_info(struct sk_buff
*skb
,
2643 const struct nft_expr
*expr
)
2645 if (nla_put_string(skb
, NFTA_EXPR_NAME
, expr
->ops
->type
->name
))
2646 goto nla_put_failure
;
2648 if (expr
->ops
->dump
) {
2649 struct nlattr
*data
= nla_nest_start_noflag(skb
,
2652 goto nla_put_failure
;
2653 if (expr
->ops
->dump(skb
, expr
) < 0)
2654 goto nla_put_failure
;
2655 nla_nest_end(skb
, data
);
2664 int nft_expr_dump(struct sk_buff
*skb
, unsigned int attr
,
2665 const struct nft_expr
*expr
)
2667 struct nlattr
*nest
;
2669 nest
= nla_nest_start_noflag(skb
, attr
);
2671 goto nla_put_failure
;
2672 if (nf_tables_fill_expr_info(skb
, expr
) < 0)
2673 goto nla_put_failure
;
2674 nla_nest_end(skb
, nest
);
2681 struct nft_expr_info
{
2682 const struct nft_expr_ops
*ops
;
2683 const struct nlattr
*attr
;
2684 struct nlattr
*tb
[NFT_EXPR_MAXATTR
+ 1];
2687 static int nf_tables_expr_parse(const struct nft_ctx
*ctx
,
2688 const struct nlattr
*nla
,
2689 struct nft_expr_info
*info
)
2691 const struct nft_expr_type
*type
;
2692 const struct nft_expr_ops
*ops
;
2693 struct nlattr
*tb
[NFTA_EXPR_MAX
+ 1];
2696 err
= nla_parse_nested_deprecated(tb
, NFTA_EXPR_MAX
, nla
,
2697 nft_expr_policy
, NULL
);
2701 type
= nft_expr_type_get(ctx
->net
, ctx
->family
, tb
[NFTA_EXPR_NAME
]);
2703 return PTR_ERR(type
);
2705 if (tb
[NFTA_EXPR_DATA
]) {
2706 err
= nla_parse_nested_deprecated(info
->tb
, type
->maxattr
,
2708 type
->policy
, NULL
);
2712 memset(info
->tb
, 0, sizeof(info
->tb
[0]) * (type
->maxattr
+ 1));
2714 if (type
->select_ops
!= NULL
) {
2715 ops
= type
->select_ops(ctx
,
2716 (const struct nlattr
* const *)info
->tb
);
2719 #ifdef CONFIG_MODULES
2721 if (nft_expr_type_request_module(ctx
->net
,
2723 tb
[NFTA_EXPR_NAME
]) != -EAGAIN
)
2737 module_put(type
->owner
);
2741 static int nf_tables_newexpr(const struct nft_ctx
*ctx
,
2742 const struct nft_expr_info
*expr_info
,
2743 struct nft_expr
*expr
)
2745 const struct nft_expr_ops
*ops
= expr_info
->ops
;
2750 err
= ops
->init(ctx
, expr
, (const struct nlattr
**)expr_info
->tb
);
2761 static void nf_tables_expr_destroy(const struct nft_ctx
*ctx
,
2762 struct nft_expr
*expr
)
2764 const struct nft_expr_type
*type
= expr
->ops
->type
;
2766 if (expr
->ops
->destroy
)
2767 expr
->ops
->destroy(ctx
, expr
);
2768 module_put(type
->owner
);
2771 static struct nft_expr
*nft_expr_init(const struct nft_ctx
*ctx
,
2772 const struct nlattr
*nla
)
2774 struct nft_expr_info expr_info
;
2775 struct nft_expr
*expr
;
2776 struct module
*owner
;
2779 err
= nf_tables_expr_parse(ctx
, nla
, &expr_info
);
2781 goto err_expr_parse
;
2784 if (!(expr_info
.ops
->type
->flags
& NFT_EXPR_STATEFUL
))
2785 goto err_expr_stateful
;
2788 expr
= kzalloc(expr_info
.ops
->size
, GFP_KERNEL
);
2790 goto err_expr_stateful
;
2792 err
= nf_tables_newexpr(ctx
, &expr_info
, expr
);
2800 owner
= expr_info
.ops
->type
->owner
;
2801 if (expr_info
.ops
->type
->release_ops
)
2802 expr_info
.ops
->type
->release_ops(expr_info
.ops
);
2806 return ERR_PTR(err
);
2809 int nft_expr_clone(struct nft_expr
*dst
, struct nft_expr
*src
)
2813 if (src
->ops
->clone
) {
2814 dst
->ops
= src
->ops
;
2815 err
= src
->ops
->clone(dst
, src
);
2819 memcpy(dst
, src
, src
->ops
->size
);
2822 __module_get(src
->ops
->type
->owner
);
2827 void nft_expr_destroy(const struct nft_ctx
*ctx
, struct nft_expr
*expr
)
2829 nf_tables_expr_destroy(ctx
, expr
);
2837 static struct nft_rule
*__nft_rule_lookup(const struct nft_chain
*chain
,
2840 struct nft_rule
*rule
;
2842 // FIXME: this sucks
2843 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
2844 if (handle
== rule
->handle
)
2848 return ERR_PTR(-ENOENT
);
2851 static struct nft_rule
*nft_rule_lookup(const struct nft_chain
*chain
,
2852 const struct nlattr
*nla
)
2855 return ERR_PTR(-EINVAL
);
2857 return __nft_rule_lookup(chain
, be64_to_cpu(nla_get_be64(nla
)));
2860 static const struct nla_policy nft_rule_policy
[NFTA_RULE_MAX
+ 1] = {
2861 [NFTA_RULE_TABLE
] = { .type
= NLA_STRING
,
2862 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
2863 [NFTA_RULE_CHAIN
] = { .type
= NLA_STRING
,
2864 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
2865 [NFTA_RULE_HANDLE
] = { .type
= NLA_U64
},
2866 [NFTA_RULE_EXPRESSIONS
] = { .type
= NLA_NESTED
},
2867 [NFTA_RULE_COMPAT
] = { .type
= NLA_NESTED
},
2868 [NFTA_RULE_POSITION
] = { .type
= NLA_U64
},
2869 [NFTA_RULE_USERDATA
] = { .type
= NLA_BINARY
,
2870 .len
= NFT_USERDATA_MAXLEN
},
2871 [NFTA_RULE_ID
] = { .type
= NLA_U32
},
2872 [NFTA_RULE_POSITION_ID
] = { .type
= NLA_U32
},
2873 [NFTA_RULE_CHAIN_ID
] = { .type
= NLA_U32
},
2876 static int nf_tables_fill_rule_info(struct sk_buff
*skb
, struct net
*net
,
2877 u32 portid
, u32 seq
, int event
,
2878 u32 flags
, int family
,
2879 const struct nft_table
*table
,
2880 const struct nft_chain
*chain
,
2881 const struct nft_rule
*rule
, u64 handle
)
2883 struct nlmsghdr
*nlh
;
2884 const struct nft_expr
*expr
, *next
;
2885 struct nlattr
*list
;
2886 u16 type
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
2888 nlh
= nfnl_msg_put(skb
, portid
, seq
, type
, flags
, family
, NFNETLINK_V0
,
2891 goto nla_put_failure
;
2893 if (nla_put_string(skb
, NFTA_RULE_TABLE
, table
->name
))
2894 goto nla_put_failure
;
2895 if (nla_put_string(skb
, NFTA_RULE_CHAIN
, chain
->name
))
2896 goto nla_put_failure
;
2897 if (nla_put_be64(skb
, NFTA_RULE_HANDLE
, cpu_to_be64(rule
->handle
),
2899 goto nla_put_failure
;
2901 if (event
!= NFT_MSG_DELRULE
&& handle
) {
2902 if (nla_put_be64(skb
, NFTA_RULE_POSITION
, cpu_to_be64(handle
),
2904 goto nla_put_failure
;
2907 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
2908 nft_flow_rule_stats(chain
, rule
);
2910 list
= nla_nest_start_noflag(skb
, NFTA_RULE_EXPRESSIONS
);
2912 goto nla_put_failure
;
2913 nft_rule_for_each_expr(expr
, next
, rule
) {
2914 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
) < 0)
2915 goto nla_put_failure
;
2917 nla_nest_end(skb
, list
);
2920 struct nft_userdata
*udata
= nft_userdata(rule
);
2921 if (nla_put(skb
, NFTA_RULE_USERDATA
, udata
->len
+ 1,
2923 goto nla_put_failure
;
2926 nlmsg_end(skb
, nlh
);
2930 nlmsg_trim(skb
, nlh
);
2934 static void nf_tables_rule_notify(const struct nft_ctx
*ctx
,
2935 const struct nft_rule
*rule
, int event
)
2937 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
2938 const struct nft_rule
*prule
;
2939 struct sk_buff
*skb
;
2945 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
2948 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
2952 if (event
== NFT_MSG_NEWRULE
&&
2953 !list_is_first(&rule
->list
, &ctx
->chain
->rules
) &&
2954 !list_is_last(&rule
->list
, &ctx
->chain
->rules
)) {
2955 prule
= list_prev_entry(rule
, list
);
2956 handle
= prule
->handle
;
2958 if (ctx
->flags
& (NLM_F_APPEND
| NLM_F_REPLACE
))
2959 flags
|= NLM_F_APPEND
;
2960 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
2961 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
2963 err
= nf_tables_fill_rule_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
2964 event
, flags
, ctx
->family
, ctx
->table
,
2965 ctx
->chain
, rule
, handle
);
2971 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
2974 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
2977 struct nft_rule_dump_ctx
{
2982 static int __nf_tables_dump_rules(struct sk_buff
*skb
,
2984 struct netlink_callback
*cb
,
2985 const struct nft_table
*table
,
2986 const struct nft_chain
*chain
)
2988 struct net
*net
= sock_net(skb
->sk
);
2989 const struct nft_rule
*rule
, *prule
;
2990 unsigned int s_idx
= cb
->args
[0];
2994 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
2995 if (!nft_is_active(net
, rule
))
3000 memset(&cb
->args
[1], 0,
3001 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
3004 handle
= prule
->handle
;
3008 if (nf_tables_fill_rule_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
3011 NLM_F_MULTI
| NLM_F_APPEND
,
3013 table
, chain
, rule
, handle
) < 0)
3016 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
3025 static int nf_tables_dump_rules(struct sk_buff
*skb
,
3026 struct netlink_callback
*cb
)
3028 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
3029 const struct nft_rule_dump_ctx
*ctx
= cb
->data
;
3030 struct nft_table
*table
;
3031 const struct nft_chain
*chain
;
3032 unsigned int idx
= 0;
3033 struct net
*net
= sock_net(skb
->sk
);
3034 int family
= nfmsg
->nfgen_family
;
3035 struct nftables_pernet
*nft_net
;
3038 nft_net
= nft_pernet(net
);
3039 cb
->seq
= nft_net
->base_seq
;
3041 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
3042 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
3045 if (ctx
&& ctx
->table
&& strcmp(ctx
->table
, table
->name
) != 0)
3048 if (ctx
&& ctx
->table
&& ctx
->chain
) {
3049 struct rhlist_head
*list
, *tmp
;
3051 list
= rhltable_lookup(&table
->chains_ht
, ctx
->chain
,
3052 nft_chain_ht_params
);
3056 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
3057 if (!nft_is_active(net
, chain
))
3059 __nf_tables_dump_rules(skb
, &idx
,
3066 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
3067 if (__nf_tables_dump_rules(skb
, &idx
, cb
, table
, chain
))
3071 if (ctx
&& ctx
->table
)
3081 static int nf_tables_dump_rules_start(struct netlink_callback
*cb
)
3083 const struct nlattr
* const *nla
= cb
->data
;
3084 struct nft_rule_dump_ctx
*ctx
= NULL
;
3086 if (nla
[NFTA_RULE_TABLE
] || nla
[NFTA_RULE_CHAIN
]) {
3087 ctx
= kzalloc(sizeof(*ctx
), GFP_ATOMIC
);
3091 if (nla
[NFTA_RULE_TABLE
]) {
3092 ctx
->table
= nla_strdup(nla
[NFTA_RULE_TABLE
],
3099 if (nla
[NFTA_RULE_CHAIN
]) {
3100 ctx
->chain
= nla_strdup(nla
[NFTA_RULE_CHAIN
],
3114 static int nf_tables_dump_rules_done(struct netlink_callback
*cb
)
3116 struct nft_rule_dump_ctx
*ctx
= cb
->data
;
3126 /* called with rcu_read_lock held */
3127 static int nf_tables_getrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3128 const struct nlattr
* const nla
[])
3130 struct netlink_ext_ack
*extack
= info
->extack
;
3131 u8 genmask
= nft_genmask_cur(info
->net
);
3132 u8 family
= info
->nfmsg
->nfgen_family
;
3133 const struct nft_chain
*chain
;
3134 const struct nft_rule
*rule
;
3135 struct net
*net
= info
->net
;
3136 struct nft_table
*table
;
3137 struct sk_buff
*skb2
;
3140 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3141 struct netlink_dump_control c
= {
3142 .start
= nf_tables_dump_rules_start
,
3143 .dump
= nf_tables_dump_rules
,
3144 .done
= nf_tables_dump_rules_done
,
3145 .module
= THIS_MODULE
,
3146 .data
= (void *)nla
,
3149 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
3152 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
, 0);
3153 if (IS_ERR(table
)) {
3154 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3155 return PTR_ERR(table
);
3158 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
], genmask
);
3159 if (IS_ERR(chain
)) {
3160 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3161 return PTR_ERR(chain
);
3164 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
3166 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3167 return PTR_ERR(rule
);
3170 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
3174 err
= nf_tables_fill_rule_info(skb2
, net
, NETLINK_CB(skb
).portid
,
3175 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWRULE
, 0,
3176 family
, table
, chain
, rule
, 0);
3178 goto err_fill_rule_info
;
3180 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
3187 static void nf_tables_rule_destroy(const struct nft_ctx
*ctx
,
3188 struct nft_rule
*rule
)
3190 struct nft_expr
*expr
, *next
;
3193 * Careful: some expressions might not be initialized in case this
3194 * is called on error from nf_tables_newrule().
3196 expr
= nft_expr_first(rule
);
3197 while (nft_expr_more(rule
, expr
)) {
3198 next
= nft_expr_next(expr
);
3199 nf_tables_expr_destroy(ctx
, expr
);
3205 void nf_tables_rule_release(const struct nft_ctx
*ctx
, struct nft_rule
*rule
)
3207 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_RELEASE
);
3208 nf_tables_rule_destroy(ctx
, rule
);
3211 int nft_chain_validate(const struct nft_ctx
*ctx
, const struct nft_chain
*chain
)
3213 struct nft_expr
*expr
, *last
;
3214 const struct nft_data
*data
;
3215 struct nft_rule
*rule
;
3218 if (ctx
->level
== NFT_JUMP_STACK_SIZE
)
3221 list_for_each_entry(rule
, &chain
->rules
, list
) {
3222 if (!nft_is_active_next(ctx
->net
, rule
))
3225 nft_rule_for_each_expr(expr
, last
, rule
) {
3226 if (!expr
->ops
->validate
)
3229 err
= expr
->ops
->validate(ctx
, expr
, &data
);
3237 EXPORT_SYMBOL_GPL(nft_chain_validate
);
3239 static int nft_table_validate(struct net
*net
, const struct nft_table
*table
)
3241 struct nft_chain
*chain
;
3242 struct nft_ctx ctx
= {
3244 .family
= table
->family
,
3248 list_for_each_entry(chain
, &table
->chains
, list
) {
3249 if (!nft_is_base_chain(chain
))
3253 err
= nft_chain_validate(&ctx
, chain
);
3261 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
3262 const struct nlattr
*nla
);
3264 #define NFT_RULE_MAXEXPRS 128
3266 static int nf_tables_newrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3267 const struct nlattr
* const nla
[])
3269 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
3270 struct netlink_ext_ack
*extack
= info
->extack
;
3271 unsigned int size
, i
, n
, ulen
= 0, usize
= 0;
3272 u8 genmask
= nft_genmask_next(info
->net
);
3273 struct nft_rule
*rule
, *old_rule
= NULL
;
3274 struct nft_expr_info
*expr_info
= NULL
;
3275 u8 family
= info
->nfmsg
->nfgen_family
;
3276 struct nft_flow_rule
*flow
= NULL
;
3277 struct net
*net
= info
->net
;
3278 struct nft_userdata
*udata
;
3279 struct nft_table
*table
;
3280 struct nft_chain
*chain
;
3281 struct nft_trans
*trans
;
3282 u64 handle
, pos_handle
;
3283 struct nft_expr
*expr
;
3288 lockdep_assert_held(&nft_net
->commit_mutex
);
3290 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
3291 NETLINK_CB(skb
).portid
);
3292 if (IS_ERR(table
)) {
3293 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3294 return PTR_ERR(table
);
3297 if (nla
[NFTA_RULE_CHAIN
]) {
3298 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
3300 if (IS_ERR(chain
)) {
3301 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3302 return PTR_ERR(chain
);
3304 if (nft_chain_is_bound(chain
))
3307 } else if (nla
[NFTA_RULE_CHAIN_ID
]) {
3308 chain
= nft_chain_lookup_byid(net
, nla
[NFTA_RULE_CHAIN_ID
]);
3309 if (IS_ERR(chain
)) {
3310 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN_ID
]);
3311 return PTR_ERR(chain
);
3317 if (nla
[NFTA_RULE_HANDLE
]) {
3318 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_HANDLE
]));
3319 rule
= __nft_rule_lookup(chain
, handle
);
3321 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3322 return PTR_ERR(rule
);
3325 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
3326 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3329 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3334 if (!(info
->nlh
->nlmsg_flags
& NLM_F_CREATE
) ||
3335 info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3337 handle
= nf_tables_alloc_handle(table
);
3339 if (chain
->use
== UINT_MAX
)
3342 if (nla
[NFTA_RULE_POSITION
]) {
3343 pos_handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_POSITION
]));
3344 old_rule
= __nft_rule_lookup(chain
, pos_handle
);
3345 if (IS_ERR(old_rule
)) {
3346 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION
]);
3347 return PTR_ERR(old_rule
);
3349 } else if (nla
[NFTA_RULE_POSITION_ID
]) {
3350 old_rule
= nft_rule_lookup_byid(net
, nla
[NFTA_RULE_POSITION_ID
]);
3351 if (IS_ERR(old_rule
)) {
3352 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION_ID
]);
3353 return PTR_ERR(old_rule
);
3358 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
3362 if (nla
[NFTA_RULE_EXPRESSIONS
]) {
3363 expr_info
= kvmalloc_array(NFT_RULE_MAXEXPRS
,
3364 sizeof(struct nft_expr_info
),
3369 nla_for_each_nested(tmp
, nla
[NFTA_RULE_EXPRESSIONS
], rem
) {
3371 if (nla_type(tmp
) != NFTA_LIST_ELEM
)
3372 goto err_release_expr
;
3373 if (n
== NFT_RULE_MAXEXPRS
)
3374 goto err_release_expr
;
3375 err
= nf_tables_expr_parse(&ctx
, tmp
, &expr_info
[n
]);
3377 NL_SET_BAD_ATTR(extack
, tmp
);
3378 goto err_release_expr
;
3380 size
+= expr_info
[n
].ops
->size
;
3384 /* Check for overflow of dlen field */
3386 if (size
>= 1 << 12)
3387 goto err_release_expr
;
3389 if (nla
[NFTA_RULE_USERDATA
]) {
3390 ulen
= nla_len(nla
[NFTA_RULE_USERDATA
]);
3392 usize
= sizeof(struct nft_userdata
) + ulen
;
3396 rule
= kzalloc(sizeof(*rule
) + size
+ usize
, GFP_KERNEL
);
3398 goto err_release_expr
;
3400 nft_activate_next(net
, rule
);
3402 rule
->handle
= handle
;
3404 rule
->udata
= ulen
? 1 : 0;
3407 udata
= nft_userdata(rule
);
3408 udata
->len
= ulen
- 1;
3409 nla_memcpy(udata
->data
, nla
[NFTA_RULE_USERDATA
], ulen
);
3412 expr
= nft_expr_first(rule
);
3413 for (i
= 0; i
< n
; i
++) {
3414 err
= nf_tables_newexpr(&ctx
, &expr_info
[i
], expr
);
3416 NL_SET_BAD_ATTR(extack
, expr_info
[i
].attr
);
3417 goto err_release_rule
;
3420 if (expr_info
[i
].ops
->validate
)
3421 nft_validate_state_update(net
, NFT_VALIDATE_NEED
);
3423 expr_info
[i
].ops
= NULL
;
3424 expr
= nft_expr_next(expr
);
3427 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
3428 flow
= nft_flow_rule_create(net
, rule
);
3430 err
= PTR_ERR(flow
);
3431 goto err_release_rule
;
3435 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
3436 err
= nft_delrule(&ctx
, old_rule
);
3438 goto err_destroy_flow_rule
;
3440 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
3441 if (trans
== NULL
) {
3443 goto err_destroy_flow_rule
;
3445 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
3447 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
3450 goto err_destroy_flow_rule
;
3453 if (info
->nlh
->nlmsg_flags
& NLM_F_APPEND
) {
3455 list_add_rcu(&rule
->list
, &old_rule
->list
);
3457 list_add_tail_rcu(&rule
->list
, &chain
->rules
);
3460 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
3462 list_add_rcu(&rule
->list
, &chain
->rules
);
3469 nft_trans_flow_rule(trans
) = flow
;
3471 if (nft_net
->validate_state
== NFT_VALIDATE_DO
)
3472 return nft_table_validate(net
, table
);
3476 err_destroy_flow_rule
:
3478 nft_flow_rule_destroy(flow
);
3480 nf_tables_rule_release(&ctx
, rule
);
3482 for (i
= 0; i
< n
; i
++) {
3483 if (expr_info
[i
].ops
) {
3484 module_put(expr_info
[i
].ops
->type
->owner
);
3485 if (expr_info
[i
].ops
->type
->release_ops
)
3486 expr_info
[i
].ops
->type
->release_ops(expr_info
[i
].ops
);
3494 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
3495 const struct nlattr
*nla
)
3497 struct nftables_pernet
*nft_net
= nft_pernet(net
);
3498 u32 id
= ntohl(nla_get_be32(nla
));
3499 struct nft_trans
*trans
;
3501 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
3502 struct nft_rule
*rule
= nft_trans_rule(trans
);
3504 if (trans
->msg_type
== NFT_MSG_NEWRULE
&&
3505 id
== nft_trans_rule_id(trans
))
3508 return ERR_PTR(-ENOENT
);
3511 static int nf_tables_delrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3512 const struct nlattr
* const nla
[])
3514 struct netlink_ext_ack
*extack
= info
->extack
;
3515 u8 genmask
= nft_genmask_next(info
->net
);
3516 u8 family
= info
->nfmsg
->nfgen_family
;
3517 struct nft_chain
*chain
= NULL
;
3518 struct net
*net
= info
->net
;
3519 struct nft_table
*table
;
3520 struct nft_rule
*rule
;
3524 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
3525 NETLINK_CB(skb
).portid
);
3526 if (IS_ERR(table
)) {
3527 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3528 return PTR_ERR(table
);
3531 if (nla
[NFTA_RULE_CHAIN
]) {
3532 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
3534 if (IS_ERR(chain
)) {
3535 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3536 return PTR_ERR(chain
);
3538 if (nft_chain_is_bound(chain
))
3542 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
3545 if (nla
[NFTA_RULE_HANDLE
]) {
3546 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
3548 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3549 return PTR_ERR(rule
);
3552 err
= nft_delrule(&ctx
, rule
);
3553 } else if (nla
[NFTA_RULE_ID
]) {
3554 rule
= nft_rule_lookup_byid(net
, nla
[NFTA_RULE_ID
]);
3556 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_ID
]);
3557 return PTR_ERR(rule
);
3560 err
= nft_delrule(&ctx
, rule
);
3562 err
= nft_delrule_by_chain(&ctx
);
3565 list_for_each_entry(chain
, &table
->chains
, list
) {
3566 if (!nft_is_active_next(net
, chain
))
3570 err
= nft_delrule_by_chain(&ctx
);
3582 static const struct nft_set_type
*nft_set_types
[] = {
3583 &nft_set_hash_fast_type
,
3585 &nft_set_rhash_type
,
3586 &nft_set_bitmap_type
,
3587 &nft_set_rbtree_type
,
3588 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
3589 &nft_set_pipapo_avx2_type
,
3591 &nft_set_pipapo_type
,
3594 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
3595 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3598 static bool nft_set_ops_candidate(const struct nft_set_type
*type
, u32 flags
)
3600 return (flags
& type
->features
) == (flags
& NFT_SET_FEATURES
);
3604 * Select a set implementation based on the data characteristics and the
3605 * given policy. The total memory use might not be known if no size is
3606 * given, in that case the amount of memory per element is used.
3608 static const struct nft_set_ops
*
3609 nft_select_set_ops(const struct nft_ctx
*ctx
,
3610 const struct nlattr
* const nla
[],
3611 const struct nft_set_desc
*desc
,
3612 enum nft_set_policies policy
)
3614 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
3615 const struct nft_set_ops
*ops
, *bops
;
3616 struct nft_set_estimate est
, best
;
3617 const struct nft_set_type
*type
;
3621 lockdep_assert_held(&nft_net
->commit_mutex
);
3622 lockdep_nfnl_nft_mutex_not_held();
3624 if (nla
[NFTA_SET_FLAGS
] != NULL
)
3625 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
3632 for (i
= 0; i
< ARRAY_SIZE(nft_set_types
); i
++) {
3633 type
= nft_set_types
[i
];
3636 if (!nft_set_ops_candidate(type
, flags
))
3638 if (!ops
->estimate(desc
, flags
, &est
))
3642 case NFT_SET_POL_PERFORMANCE
:
3643 if (est
.lookup
< best
.lookup
)
3645 if (est
.lookup
== best
.lookup
&&
3646 est
.space
< best
.space
)
3649 case NFT_SET_POL_MEMORY
:
3651 if (est
.space
< best
.space
)
3653 if (est
.space
== best
.space
&&
3654 est
.lookup
< best
.lookup
)
3656 } else if (est
.size
< best
.size
|| !bops
) {
3671 return ERR_PTR(-EOPNOTSUPP
);
3674 static const struct nla_policy nft_set_policy
[NFTA_SET_MAX
+ 1] = {
3675 [NFTA_SET_TABLE
] = { .type
= NLA_STRING
,
3676 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
3677 [NFTA_SET_NAME
] = { .type
= NLA_STRING
,
3678 .len
= NFT_SET_MAXNAMELEN
- 1 },
3679 [NFTA_SET_FLAGS
] = { .type
= NLA_U32
},
3680 [NFTA_SET_KEY_TYPE
] = { .type
= NLA_U32
},
3681 [NFTA_SET_KEY_LEN
] = { .type
= NLA_U32
},
3682 [NFTA_SET_DATA_TYPE
] = { .type
= NLA_U32
},
3683 [NFTA_SET_DATA_LEN
] = { .type
= NLA_U32
},
3684 [NFTA_SET_POLICY
] = { .type
= NLA_U32
},
3685 [NFTA_SET_DESC
] = { .type
= NLA_NESTED
},
3686 [NFTA_SET_ID
] = { .type
= NLA_U32
},
3687 [NFTA_SET_TIMEOUT
] = { .type
= NLA_U64
},
3688 [NFTA_SET_GC_INTERVAL
] = { .type
= NLA_U32
},
3689 [NFTA_SET_USERDATA
] = { .type
= NLA_BINARY
,
3690 .len
= NFT_USERDATA_MAXLEN
},
3691 [NFTA_SET_OBJ_TYPE
] = { .type
= NLA_U32
},
3692 [NFTA_SET_HANDLE
] = { .type
= NLA_U64
},
3693 [NFTA_SET_EXPR
] = { .type
= NLA_NESTED
},
3694 [NFTA_SET_EXPRESSIONS
] = { .type
= NLA_NESTED
},
3697 static const struct nla_policy nft_set_desc_policy
[NFTA_SET_DESC_MAX
+ 1] = {
3698 [NFTA_SET_DESC_SIZE
] = { .type
= NLA_U32
},
3699 [NFTA_SET_DESC_CONCAT
] = { .type
= NLA_NESTED
},
3702 static struct nft_set
*nft_set_lookup(const struct nft_table
*table
,
3703 const struct nlattr
*nla
, u8 genmask
)
3705 struct nft_set
*set
;
3708 return ERR_PTR(-EINVAL
);
3710 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
3711 if (!nla_strcmp(nla
, set
->name
) &&
3712 nft_active_genmask(set
, genmask
))
3715 return ERR_PTR(-ENOENT
);
3718 static struct nft_set
*nft_set_lookup_byhandle(const struct nft_table
*table
,
3719 const struct nlattr
*nla
,
3722 struct nft_set
*set
;
3724 list_for_each_entry(set
, &table
->sets
, list
) {
3725 if (be64_to_cpu(nla_get_be64(nla
)) == set
->handle
&&
3726 nft_active_genmask(set
, genmask
))
3729 return ERR_PTR(-ENOENT
);
3732 static struct nft_set
*nft_set_lookup_byid(const struct net
*net
,
3733 const struct nlattr
*nla
, u8 genmask
)
3735 struct nftables_pernet
*nft_net
= nft_pernet(net
);
3736 u32 id
= ntohl(nla_get_be32(nla
));
3737 struct nft_trans
*trans
;
3739 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
3740 if (trans
->msg_type
== NFT_MSG_NEWSET
) {
3741 struct nft_set
*set
= nft_trans_set(trans
);
3743 if (id
== nft_trans_set_id(trans
) &&
3744 nft_active_genmask(set
, genmask
))
3748 return ERR_PTR(-ENOENT
);
3751 struct nft_set
*nft_set_lookup_global(const struct net
*net
,
3752 const struct nft_table
*table
,
3753 const struct nlattr
*nla_set_name
,
3754 const struct nlattr
*nla_set_id
,
3757 struct nft_set
*set
;
3759 set
= nft_set_lookup(table
, nla_set_name
, genmask
);
3764 set
= nft_set_lookup_byid(net
, nla_set_id
, genmask
);
3768 EXPORT_SYMBOL_GPL(nft_set_lookup_global
);
3770 static int nf_tables_set_alloc_name(struct nft_ctx
*ctx
, struct nft_set
*set
,
3773 const struct nft_set
*i
;
3775 unsigned long *inuse
;
3776 unsigned int n
= 0, min
= 0;
3778 p
= strchr(name
, '%');
3780 if (p
[1] != 'd' || strchr(p
+ 2, '%'))
3783 inuse
= (unsigned long *)get_zeroed_page(GFP_KERNEL
);
3787 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
3790 if (!nft_is_active_next(ctx
->net
, set
))
3792 if (!sscanf(i
->name
, name
, &tmp
))
3794 if (tmp
< min
|| tmp
>= min
+ BITS_PER_BYTE
* PAGE_SIZE
)
3797 set_bit(tmp
- min
, inuse
);
3800 n
= find_first_zero_bit(inuse
, BITS_PER_BYTE
* PAGE_SIZE
);
3801 if (n
>= BITS_PER_BYTE
* PAGE_SIZE
) {
3802 min
+= BITS_PER_BYTE
* PAGE_SIZE
;
3803 memset(inuse
, 0, PAGE_SIZE
);
3806 free_page((unsigned long)inuse
);
3809 set
->name
= kasprintf(GFP_KERNEL
, name
, min
+ n
);
3813 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
3814 if (!nft_is_active_next(ctx
->net
, i
))
3816 if (!strcmp(set
->name
, i
->name
)) {
3825 int nf_msecs_to_jiffies64(const struct nlattr
*nla
, u64
*result
)
3827 u64 ms
= be64_to_cpu(nla_get_be64(nla
));
3828 u64 max
= (u64
)(~((u64
)0));
3830 max
= div_u64(max
, NSEC_PER_MSEC
);
3834 ms
*= NSEC_PER_MSEC
;
3835 *result
= nsecs_to_jiffies64(ms
);
3839 __be64
nf_jiffies64_to_msecs(u64 input
)
3841 return cpu_to_be64(jiffies64_to_msecs(input
));
3844 static int nf_tables_fill_set_concat(struct sk_buff
*skb
,
3845 const struct nft_set
*set
)
3847 struct nlattr
*concat
, *field
;
3850 concat
= nla_nest_start_noflag(skb
, NFTA_SET_DESC_CONCAT
);
3854 for (i
= 0; i
< set
->field_count
; i
++) {
3855 field
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
3859 if (nla_put_be32(skb
, NFTA_SET_FIELD_LEN
,
3860 htonl(set
->field_len
[i
])))
3863 nla_nest_end(skb
, field
);
3866 nla_nest_end(skb
, concat
);
3871 static int nf_tables_fill_set(struct sk_buff
*skb
, const struct nft_ctx
*ctx
,
3872 const struct nft_set
*set
, u16 event
, u16 flags
)
3874 struct nlmsghdr
*nlh
;
3875 u32 portid
= ctx
->portid
;
3876 struct nlattr
*nest
;
3880 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
3881 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, ctx
->family
,
3882 NFNETLINK_V0
, nft_base_seq(ctx
->net
));
3884 goto nla_put_failure
;
3886 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
3887 goto nla_put_failure
;
3888 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
3889 goto nla_put_failure
;
3890 if (nla_put_be64(skb
, NFTA_SET_HANDLE
, cpu_to_be64(set
->handle
),
3892 goto nla_put_failure
;
3893 if (set
->flags
!= 0)
3894 if (nla_put_be32(skb
, NFTA_SET_FLAGS
, htonl(set
->flags
)))
3895 goto nla_put_failure
;
3897 if (nla_put_be32(skb
, NFTA_SET_KEY_TYPE
, htonl(set
->ktype
)))
3898 goto nla_put_failure
;
3899 if (nla_put_be32(skb
, NFTA_SET_KEY_LEN
, htonl(set
->klen
)))
3900 goto nla_put_failure
;
3901 if (set
->flags
& NFT_SET_MAP
) {
3902 if (nla_put_be32(skb
, NFTA_SET_DATA_TYPE
, htonl(set
->dtype
)))
3903 goto nla_put_failure
;
3904 if (nla_put_be32(skb
, NFTA_SET_DATA_LEN
, htonl(set
->dlen
)))
3905 goto nla_put_failure
;
3907 if (set
->flags
& NFT_SET_OBJECT
&&
3908 nla_put_be32(skb
, NFTA_SET_OBJ_TYPE
, htonl(set
->objtype
)))
3909 goto nla_put_failure
;
3912 nla_put_be64(skb
, NFTA_SET_TIMEOUT
,
3913 nf_jiffies64_to_msecs(set
->timeout
),
3915 goto nla_put_failure
;
3917 nla_put_be32(skb
, NFTA_SET_GC_INTERVAL
, htonl(set
->gc_int
)))
3918 goto nla_put_failure
;
3920 if (set
->policy
!= NFT_SET_POL_PERFORMANCE
) {
3921 if (nla_put_be32(skb
, NFTA_SET_POLICY
, htonl(set
->policy
)))
3922 goto nla_put_failure
;
3926 nla_put(skb
, NFTA_SET_USERDATA
, set
->udlen
, set
->udata
))
3927 goto nla_put_failure
;
3929 nest
= nla_nest_start_noflag(skb
, NFTA_SET_DESC
);
3931 goto nla_put_failure
;
3933 nla_put_be32(skb
, NFTA_SET_DESC_SIZE
, htonl(set
->size
)))
3934 goto nla_put_failure
;
3936 if (set
->field_count
> 1 &&
3937 nf_tables_fill_set_concat(skb
, set
))
3938 goto nla_put_failure
;
3940 nla_nest_end(skb
, nest
);
3942 if (set
->num_exprs
== 1) {
3943 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPR
);
3944 if (nf_tables_fill_expr_info(skb
, set
->exprs
[0]) < 0)
3945 goto nla_put_failure
;
3947 nla_nest_end(skb
, nest
);
3948 } else if (set
->num_exprs
> 1) {
3949 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPRESSIONS
);
3951 goto nla_put_failure
;
3953 for (i
= 0; i
< set
->num_exprs
; i
++) {
3954 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
,
3956 goto nla_put_failure
;
3958 nla_nest_end(skb
, nest
);
3961 nlmsg_end(skb
, nlh
);
3965 nlmsg_trim(skb
, nlh
);
3969 static void nf_tables_set_notify(const struct nft_ctx
*ctx
,
3970 const struct nft_set
*set
, int event
,
3973 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
3974 u32 portid
= ctx
->portid
;
3975 struct sk_buff
*skb
;
3980 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
3983 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp_flags
);
3987 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
3988 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
3990 err
= nf_tables_fill_set(skb
, ctx
, set
, event
, flags
);
3996 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
3999 nfnetlink_set_err(ctx
->net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
4002 static int nf_tables_dump_sets(struct sk_buff
*skb
, struct netlink_callback
*cb
)
4004 const struct nft_set
*set
;
4005 unsigned int idx
, s_idx
= cb
->args
[0];
4006 struct nft_table
*table
, *cur_table
= (struct nft_table
*)cb
->args
[2];
4007 struct net
*net
= sock_net(skb
->sk
);
4008 struct nft_ctx
*ctx
= cb
->data
, ctx_set
;
4009 struct nftables_pernet
*nft_net
;
4015 nft_net
= nft_pernet(net
);
4016 cb
->seq
= nft_net
->base_seq
;
4018 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
4019 if (ctx
->family
!= NFPROTO_UNSPEC
&&
4020 ctx
->family
!= table
->family
)
4023 if (ctx
->table
&& ctx
->table
!= table
)
4027 if (cur_table
!= table
)
4033 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
4036 if (!nft_is_active(net
, set
))
4040 ctx_set
.table
= table
;
4041 ctx_set
.family
= table
->family
;
4043 if (nf_tables_fill_set(skb
, &ctx_set
, set
,
4047 cb
->args
[2] = (unsigned long) table
;
4050 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
4063 static int nf_tables_dump_sets_start(struct netlink_callback
*cb
)
4065 struct nft_ctx
*ctx_dump
= NULL
;
4067 ctx_dump
= kmemdup(cb
->data
, sizeof(*ctx_dump
), GFP_ATOMIC
);
4068 if (ctx_dump
== NULL
)
4071 cb
->data
= ctx_dump
;
4075 static int nf_tables_dump_sets_done(struct netlink_callback
*cb
)
4081 /* called with rcu_read_lock held */
4082 static int nf_tables_getset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4083 const struct nlattr
* const nla
[])
4085 struct netlink_ext_ack
*extack
= info
->extack
;
4086 u8 genmask
= nft_genmask_cur(info
->net
);
4087 u8 family
= info
->nfmsg
->nfgen_family
;
4088 struct nft_table
*table
= NULL
;
4089 struct net
*net
= info
->net
;
4090 const struct nft_set
*set
;
4091 struct sk_buff
*skb2
;
4095 if (nla
[NFTA_SET_TABLE
]) {
4096 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
,
4098 if (IS_ERR(table
)) {
4099 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4100 return PTR_ERR(table
);
4104 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
4106 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
4107 struct netlink_dump_control c
= {
4108 .start
= nf_tables_dump_sets_start
,
4109 .dump
= nf_tables_dump_sets
,
4110 .done
= nf_tables_dump_sets_done
,
4112 .module
= THIS_MODULE
,
4115 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
4118 /* Only accept unspec with dump */
4119 if (info
->nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
4120 return -EAFNOSUPPORT
;
4121 if (!nla
[NFTA_SET_TABLE
])
4124 set
= nft_set_lookup(table
, nla
[NFTA_SET_NAME
], genmask
);
4126 return PTR_ERR(set
);
4128 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
4132 err
= nf_tables_fill_set(skb2
, &ctx
, set
, NFT_MSG_NEWSET
, 0);
4134 goto err_fill_set_info
;
4136 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
4143 static const struct nla_policy nft_concat_policy
[NFTA_SET_FIELD_MAX
+ 1] = {
4144 [NFTA_SET_FIELD_LEN
] = { .type
= NLA_U32
},
4147 static int nft_set_desc_concat_parse(const struct nlattr
*attr
,
4148 struct nft_set_desc
*desc
)
4150 struct nlattr
*tb
[NFTA_SET_FIELD_MAX
+ 1];
4154 if (desc
->field_count
>= ARRAY_SIZE(desc
->field_len
))
4157 err
= nla_parse_nested_deprecated(tb
, NFTA_SET_FIELD_MAX
, attr
,
4158 nft_concat_policy
, NULL
);
4162 if (!tb
[NFTA_SET_FIELD_LEN
])
4165 len
= ntohl(nla_get_be32(tb
[NFTA_SET_FIELD_LEN
]));
4166 if (!len
|| len
> U8_MAX
)
4169 desc
->field_len
[desc
->field_count
++] = len
;
4174 static int nft_set_desc_concat(struct nft_set_desc
*desc
,
4175 const struct nlattr
*nla
)
4177 struct nlattr
*attr
;
4181 nla_for_each_nested(attr
, nla
, rem
) {
4182 if (nla_type(attr
) != NFTA_LIST_ELEM
)
4185 err
= nft_set_desc_concat_parse(attr
, desc
);
4190 for (i
= 0; i
< desc
->field_count
; i
++)
4191 num_regs
+= DIV_ROUND_UP(desc
->field_len
[i
], sizeof(u32
));
4193 if (num_regs
> NFT_REG32_COUNT
)
4199 static int nf_tables_set_desc_parse(struct nft_set_desc
*desc
,
4200 const struct nlattr
*nla
)
4202 struct nlattr
*da
[NFTA_SET_DESC_MAX
+ 1];
4205 err
= nla_parse_nested_deprecated(da
, NFTA_SET_DESC_MAX
, nla
,
4206 nft_set_desc_policy
, NULL
);
4210 if (da
[NFTA_SET_DESC_SIZE
] != NULL
)
4211 desc
->size
= ntohl(nla_get_be32(da
[NFTA_SET_DESC_SIZE
]));
4212 if (da
[NFTA_SET_DESC_CONCAT
])
4213 err
= nft_set_desc_concat(desc
, da
[NFTA_SET_DESC_CONCAT
]);
4218 static int nf_tables_newset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4219 const struct nlattr
* const nla
[])
4221 u32 ktype
, dtype
, flags
, policy
, gc_int
, objtype
;
4222 struct netlink_ext_ack
*extack
= info
->extack
;
4223 u8 genmask
= nft_genmask_next(info
->net
);
4224 u8 family
= info
->nfmsg
->nfgen_family
;
4225 const struct nft_set_ops
*ops
;
4226 struct nft_expr
*expr
= NULL
;
4227 struct net
*net
= info
->net
;
4228 struct nft_set_desc desc
;
4229 struct nft_table
*table
;
4230 unsigned char *udata
;
4231 struct nft_set
*set
;
4240 if (nla
[NFTA_SET_TABLE
] == NULL
||
4241 nla
[NFTA_SET_NAME
] == NULL
||
4242 nla
[NFTA_SET_KEY_LEN
] == NULL
||
4243 nla
[NFTA_SET_ID
] == NULL
)
4246 memset(&desc
, 0, sizeof(desc
));
4248 ktype
= NFT_DATA_VALUE
;
4249 if (nla
[NFTA_SET_KEY_TYPE
] != NULL
) {
4250 ktype
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_TYPE
]));
4251 if ((ktype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
)
4255 desc
.klen
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_LEN
]));
4256 if (desc
.klen
== 0 || desc
.klen
> NFT_DATA_VALUE_MAXLEN
)
4260 if (nla
[NFTA_SET_FLAGS
] != NULL
) {
4261 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
4262 if (flags
& ~(NFT_SET_ANONYMOUS
| NFT_SET_CONSTANT
|
4263 NFT_SET_INTERVAL
| NFT_SET_TIMEOUT
|
4264 NFT_SET_MAP
| NFT_SET_EVAL
|
4265 NFT_SET_OBJECT
| NFT_SET_CONCAT
| NFT_SET_EXPR
))
4267 /* Only one of these operations is supported */
4268 if ((flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
)) ==
4269 (NFT_SET_MAP
| NFT_SET_OBJECT
))
4271 if ((flags
& (NFT_SET_EVAL
| NFT_SET_OBJECT
)) ==
4272 (NFT_SET_EVAL
| NFT_SET_OBJECT
))
4277 if (nla
[NFTA_SET_DATA_TYPE
] != NULL
) {
4278 if (!(flags
& NFT_SET_MAP
))
4281 dtype
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_TYPE
]));
4282 if ((dtype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
&&
4283 dtype
!= NFT_DATA_VERDICT
)
4286 if (dtype
!= NFT_DATA_VERDICT
) {
4287 if (nla
[NFTA_SET_DATA_LEN
] == NULL
)
4289 desc
.dlen
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_LEN
]));
4290 if (desc
.dlen
== 0 || desc
.dlen
> NFT_DATA_VALUE_MAXLEN
)
4293 desc
.dlen
= sizeof(struct nft_verdict
);
4294 } else if (flags
& NFT_SET_MAP
)
4297 if (nla
[NFTA_SET_OBJ_TYPE
] != NULL
) {
4298 if (!(flags
& NFT_SET_OBJECT
))
4301 objtype
= ntohl(nla_get_be32(nla
[NFTA_SET_OBJ_TYPE
]));
4302 if (objtype
== NFT_OBJECT_UNSPEC
||
4303 objtype
> NFT_OBJECT_MAX
)
4305 } else if (flags
& NFT_SET_OBJECT
)
4308 objtype
= NFT_OBJECT_UNSPEC
;
4311 if (nla
[NFTA_SET_TIMEOUT
] != NULL
) {
4312 if (!(flags
& NFT_SET_TIMEOUT
))
4315 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_TIMEOUT
], &timeout
);
4320 if (nla
[NFTA_SET_GC_INTERVAL
] != NULL
) {
4321 if (!(flags
& NFT_SET_TIMEOUT
))
4323 gc_int
= ntohl(nla_get_be32(nla
[NFTA_SET_GC_INTERVAL
]));
4326 policy
= NFT_SET_POL_PERFORMANCE
;
4327 if (nla
[NFTA_SET_POLICY
] != NULL
)
4328 policy
= ntohl(nla_get_be32(nla
[NFTA_SET_POLICY
]));
4330 if (nla
[NFTA_SET_DESC
] != NULL
) {
4331 err
= nf_tables_set_desc_parse(&desc
, nla
[NFTA_SET_DESC
]);
4336 if (nla
[NFTA_SET_EXPR
] || nla
[NFTA_SET_EXPRESSIONS
])
4339 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
, genmask
,
4340 NETLINK_CB(skb
).portid
);
4341 if (IS_ERR(table
)) {
4342 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4343 return PTR_ERR(table
);
4346 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
4348 set
= nft_set_lookup(table
, nla
[NFTA_SET_NAME
], genmask
);
4350 if (PTR_ERR(set
) != -ENOENT
) {
4351 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
4352 return PTR_ERR(set
);
4355 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
4356 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
4359 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
4365 if (!(info
->nlh
->nlmsg_flags
& NLM_F_CREATE
))
4368 ops
= nft_select_set_ops(&ctx
, nla
, &desc
, policy
);
4370 return PTR_ERR(ops
);
4373 if (nla
[NFTA_SET_USERDATA
])
4374 udlen
= nla_len(nla
[NFTA_SET_USERDATA
]);
4377 if (ops
->privsize
!= NULL
)
4378 size
= ops
->privsize(nla
, &desc
);
4379 alloc_size
= sizeof(*set
) + size
+ udlen
;
4380 if (alloc_size
< size
|| alloc_size
> INT_MAX
)
4382 set
= kvzalloc(alloc_size
, GFP_KERNEL
);
4386 name
= nla_strdup(nla
[NFTA_SET_NAME
], GFP_KERNEL
);
4392 err
= nf_tables_set_alloc_name(&ctx
, set
, name
);
4399 udata
= set
->data
+ size
;
4400 nla_memcpy(udata
, nla
[NFTA_SET_USERDATA
], udlen
);
4403 INIT_LIST_HEAD(&set
->bindings
);
4404 INIT_LIST_HEAD(&set
->catchall_list
);
4406 write_pnet(&set
->net
, net
);
4409 set
->klen
= desc
.klen
;
4411 set
->objtype
= objtype
;
4412 set
->dlen
= desc
.dlen
;
4414 set
->size
= desc
.size
;
4415 set
->policy
= policy
;
4418 set
->timeout
= timeout
;
4419 set
->gc_int
= gc_int
;
4421 set
->field_count
= desc
.field_count
;
4422 for (i
= 0; i
< desc
.field_count
; i
++)
4423 set
->field_len
[i
] = desc
.field_len
[i
];
4425 err
= ops
->init(set
, &desc
, nla
);
4429 if (nla
[NFTA_SET_EXPR
]) {
4430 expr
= nft_set_elem_expr_alloc(&ctx
, set
, nla
[NFTA_SET_EXPR
]);
4432 err
= PTR_ERR(expr
);
4433 goto err_set_expr_alloc
;
4435 set
->exprs
[0] = expr
;
4437 } else if (nla
[NFTA_SET_EXPRESSIONS
]) {
4438 struct nft_expr
*expr
;
4442 if (!(flags
& NFT_SET_EXPR
)) {
4444 goto err_set_expr_alloc
;
4447 nla_for_each_nested(tmp
, nla
[NFTA_SET_EXPRESSIONS
], left
) {
4448 if (i
== NFT_SET_EXPR_MAX
) {
4450 goto err_set_expr_alloc
;
4452 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
4454 goto err_set_expr_alloc
;
4456 expr
= nft_set_elem_expr_alloc(&ctx
, set
, tmp
);
4458 err
= PTR_ERR(expr
);
4459 goto err_set_expr_alloc
;
4461 set
->exprs
[i
++] = expr
;
4466 set
->handle
= nf_tables_alloc_handle(table
);
4468 err
= nft_trans_set_add(&ctx
, NFT_MSG_NEWSET
, set
);
4470 goto err_set_expr_alloc
;
4472 list_add_tail_rcu(&set
->list
, &table
->sets
);
4477 for (i
= 0; i
< set
->num_exprs
; i
++)
4478 nft_expr_destroy(&ctx
, set
->exprs
[i
]);
4488 struct nft_set_elem_catchall
{
4489 struct list_head list
;
4490 struct rcu_head rcu
;
4494 static void nft_set_catchall_destroy(const struct nft_ctx
*ctx
,
4495 struct nft_set
*set
)
4497 struct nft_set_elem_catchall
*next
, *catchall
;
4499 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
4500 list_del_rcu(&catchall
->list
);
4501 nft_set_elem_destroy(set
, catchall
->elem
, true);
4502 kfree_rcu(catchall
, rcu
);
4506 static void nft_set_destroy(const struct nft_ctx
*ctx
, struct nft_set
*set
)
4510 if (WARN_ON(set
->use
> 0))
4513 for (i
= 0; i
< set
->num_exprs
; i
++)
4514 nft_expr_destroy(ctx
, set
->exprs
[i
]);
4516 set
->ops
->destroy(set
);
4517 nft_set_catchall_destroy(ctx
, set
);
4522 static int nf_tables_delset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4523 const struct nlattr
* const nla
[])
4525 struct netlink_ext_ack
*extack
= info
->extack
;
4526 u8 genmask
= nft_genmask_next(info
->net
);
4527 u8 family
= info
->nfmsg
->nfgen_family
;
4528 struct net
*net
= info
->net
;
4529 const struct nlattr
*attr
;
4530 struct nft_table
*table
;
4531 struct nft_set
*set
;
4534 if (info
->nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
4535 return -EAFNOSUPPORT
;
4537 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
,
4538 genmask
, NETLINK_CB(skb
).portid
);
4539 if (IS_ERR(table
)) {
4540 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4541 return PTR_ERR(table
);
4544 if (nla
[NFTA_SET_HANDLE
]) {
4545 attr
= nla
[NFTA_SET_HANDLE
];
4546 set
= nft_set_lookup_byhandle(table
, attr
, genmask
);
4548 attr
= nla
[NFTA_SET_NAME
];
4549 set
= nft_set_lookup(table
, attr
, genmask
);
4553 NL_SET_BAD_ATTR(extack
, attr
);
4554 return PTR_ERR(set
);
4557 (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
4558 atomic_read(&set
->nelems
) > 0)) {
4559 NL_SET_BAD_ATTR(extack
, attr
);
4563 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
4565 return nft_delset(&ctx
, set
);
4568 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
4569 enum nft_registers reg
,
4570 const struct nft_data
*data
,
4571 enum nft_data_types type
,
4574 static int nft_setelem_data_validate(const struct nft_ctx
*ctx
,
4575 struct nft_set
*set
,
4576 struct nft_set_elem
*elem
)
4578 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
4579 enum nft_registers dreg
;
4581 dreg
= nft_type_to_reg(set
->dtype
);
4582 return nft_validate_register_store(ctx
, dreg
, nft_set_ext_data(ext
),
4583 set
->dtype
== NFT_DATA_VERDICT
?
4584 NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
4588 static int nf_tables_bind_check_setelem(const struct nft_ctx
*ctx
,
4589 struct nft_set
*set
,
4590 const struct nft_set_iter
*iter
,
4591 struct nft_set_elem
*elem
)
4593 return nft_setelem_data_validate(ctx
, set
, elem
);
4596 static int nft_set_catchall_bind_check(const struct nft_ctx
*ctx
,
4597 struct nft_set
*set
)
4599 u8 genmask
= nft_genmask_next(ctx
->net
);
4600 struct nft_set_elem_catchall
*catchall
;
4601 struct nft_set_elem elem
;
4602 struct nft_set_ext
*ext
;
4605 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
4606 ext
= nft_set_elem_ext(set
, catchall
->elem
);
4607 if (!nft_set_elem_active(ext
, genmask
))
4610 elem
.priv
= catchall
->elem
;
4611 ret
= nft_setelem_data_validate(ctx
, set
, &elem
);
4619 int nf_tables_bind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4620 struct nft_set_binding
*binding
)
4622 struct nft_set_binding
*i
;
4623 struct nft_set_iter iter
;
4625 if (set
->use
== UINT_MAX
)
4628 if (!list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
4631 if (binding
->flags
& NFT_SET_MAP
) {
4632 /* If the set is already bound to the same chain all
4633 * jumps are already validated for that chain.
4635 list_for_each_entry(i
, &set
->bindings
, list
) {
4636 if (i
->flags
& NFT_SET_MAP
&&
4637 i
->chain
== binding
->chain
)
4641 iter
.genmask
= nft_genmask_next(ctx
->net
);
4645 iter
.fn
= nf_tables_bind_check_setelem
;
4647 set
->ops
->walk(ctx
, set
, &iter
);
4649 iter
.err
= nft_set_catchall_bind_check(ctx
, set
);
4655 binding
->chain
= ctx
->chain
;
4656 list_add_tail_rcu(&binding
->list
, &set
->bindings
);
4657 nft_set_trans_bind(ctx
, set
);
4662 EXPORT_SYMBOL_GPL(nf_tables_bind_set
);
4664 static void nf_tables_unbind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4665 struct nft_set_binding
*binding
, bool event
)
4667 list_del_rcu(&binding
->list
);
4669 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
)) {
4670 list_del_rcu(&set
->list
);
4672 nf_tables_set_notify(ctx
, set
, NFT_MSG_DELSET
,
4677 void nf_tables_deactivate_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4678 struct nft_set_binding
*binding
,
4679 enum nft_trans_phase phase
)
4682 case NFT_TRANS_PREPARE
:
4685 case NFT_TRANS_ABORT
:
4686 case NFT_TRANS_RELEASE
:
4690 nf_tables_unbind_set(ctx
, set
, binding
,
4691 phase
== NFT_TRANS_COMMIT
);
4694 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set
);
4696 void nf_tables_destroy_set(const struct nft_ctx
*ctx
, struct nft_set
*set
)
4698 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
4699 nft_set_destroy(ctx
, set
);
4701 EXPORT_SYMBOL_GPL(nf_tables_destroy_set
);
4703 const struct nft_set_ext_type nft_set_ext_types
[] = {
4704 [NFT_SET_EXT_KEY
] = {
4705 .align
= __alignof__(u32
),
4707 [NFT_SET_EXT_DATA
] = {
4708 .align
= __alignof__(u32
),
4710 [NFT_SET_EXT_EXPRESSIONS
] = {
4711 .align
= __alignof__(struct nft_set_elem_expr
),
4713 [NFT_SET_EXT_OBJREF
] = {
4714 .len
= sizeof(struct nft_object
*),
4715 .align
= __alignof__(struct nft_object
*),
4717 [NFT_SET_EXT_FLAGS
] = {
4719 .align
= __alignof__(u8
),
4721 [NFT_SET_EXT_TIMEOUT
] = {
4723 .align
= __alignof__(u64
),
4725 [NFT_SET_EXT_EXPIRATION
] = {
4727 .align
= __alignof__(u64
),
4729 [NFT_SET_EXT_USERDATA
] = {
4730 .len
= sizeof(struct nft_userdata
),
4731 .align
= __alignof__(struct nft_userdata
),
4733 [NFT_SET_EXT_KEY_END
] = {
4734 .align
= __alignof__(u32
),
4742 static const struct nla_policy nft_set_elem_policy
[NFTA_SET_ELEM_MAX
+ 1] = {
4743 [NFTA_SET_ELEM_KEY
] = { .type
= NLA_NESTED
},
4744 [NFTA_SET_ELEM_DATA
] = { .type
= NLA_NESTED
},
4745 [NFTA_SET_ELEM_FLAGS
] = { .type
= NLA_U32
},
4746 [NFTA_SET_ELEM_TIMEOUT
] = { .type
= NLA_U64
},
4747 [NFTA_SET_ELEM_EXPIRATION
] = { .type
= NLA_U64
},
4748 [NFTA_SET_ELEM_USERDATA
] = { .type
= NLA_BINARY
,
4749 .len
= NFT_USERDATA_MAXLEN
},
4750 [NFTA_SET_ELEM_EXPR
] = { .type
= NLA_NESTED
},
4751 [NFTA_SET_ELEM_OBJREF
] = { .type
= NLA_STRING
,
4752 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
4753 [NFTA_SET_ELEM_KEY_END
] = { .type
= NLA_NESTED
},
4754 [NFTA_SET_ELEM_EXPRESSIONS
] = { .type
= NLA_NESTED
},
4757 static const struct nla_policy nft_set_elem_list_policy
[NFTA_SET_ELEM_LIST_MAX
+ 1] = {
4758 [NFTA_SET_ELEM_LIST_TABLE
] = { .type
= NLA_STRING
,
4759 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
4760 [NFTA_SET_ELEM_LIST_SET
] = { .type
= NLA_STRING
,
4761 .len
= NFT_SET_MAXNAMELEN
- 1 },
4762 [NFTA_SET_ELEM_LIST_ELEMENTS
] = { .type
= NLA_NESTED
},
4763 [NFTA_SET_ELEM_LIST_SET_ID
] = { .type
= NLA_U32
},
4766 static int nft_set_elem_expr_dump(struct sk_buff
*skb
,
4767 const struct nft_set
*set
,
4768 const struct nft_set_ext
*ext
)
4770 struct nft_set_elem_expr
*elem_expr
;
4771 u32 size
, num_exprs
= 0;
4772 struct nft_expr
*expr
;
4773 struct nlattr
*nest
;
4775 elem_expr
= nft_set_ext_expr(ext
);
4776 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
4779 if (num_exprs
== 1) {
4780 expr
= nft_setelem_expr_at(elem_expr
, 0);
4781 if (nft_expr_dump(skb
, NFTA_SET_ELEM_EXPR
, expr
) < 0)
4785 } else if (num_exprs
> 1) {
4786 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_EXPRESSIONS
);
4788 goto nla_put_failure
;
4790 nft_setelem_expr_foreach(expr
, elem_expr
, size
) {
4791 expr
= nft_setelem_expr_at(elem_expr
, size
);
4792 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
) < 0)
4793 goto nla_put_failure
;
4795 nla_nest_end(skb
, nest
);
4803 static int nf_tables_fill_setelem(struct sk_buff
*skb
,
4804 const struct nft_set
*set
,
4805 const struct nft_set_elem
*elem
)
4807 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
4808 unsigned char *b
= skb_tail_pointer(skb
);
4809 struct nlattr
*nest
;
4811 nest
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
4813 goto nla_put_failure
;
4815 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY
) &&
4816 nft_data_dump(skb
, NFTA_SET_ELEM_KEY
, nft_set_ext_key(ext
),
4817 NFT_DATA_VALUE
, set
->klen
) < 0)
4818 goto nla_put_failure
;
4820 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
) &&
4821 nft_data_dump(skb
, NFTA_SET_ELEM_KEY_END
, nft_set_ext_key_end(ext
),
4822 NFT_DATA_VALUE
, set
->klen
) < 0)
4823 goto nla_put_failure
;
4825 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
4826 nft_data_dump(skb
, NFTA_SET_ELEM_DATA
, nft_set_ext_data(ext
),
4827 set
->dtype
== NFT_DATA_VERDICT
? NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
4829 goto nla_put_failure
;
4831 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
) &&
4832 nft_set_elem_expr_dump(skb
, set
, ext
))
4833 goto nla_put_failure
;
4835 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
4836 nla_put_string(skb
, NFTA_SET_ELEM_OBJREF
,
4837 (*nft_set_ext_obj(ext
))->key
.name
) < 0)
4838 goto nla_put_failure
;
4840 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
4841 nla_put_be32(skb
, NFTA_SET_ELEM_FLAGS
,
4842 htonl(*nft_set_ext_flags(ext
))))
4843 goto nla_put_failure
;
4845 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
) &&
4846 nla_put_be64(skb
, NFTA_SET_ELEM_TIMEOUT
,
4847 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext
)),
4849 goto nla_put_failure
;
4851 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
4852 u64 expires
, now
= get_jiffies_64();
4854 expires
= *nft_set_ext_expiration(ext
);
4855 if (time_before64(now
, expires
))
4860 if (nla_put_be64(skb
, NFTA_SET_ELEM_EXPIRATION
,
4861 nf_jiffies64_to_msecs(expires
),
4863 goto nla_put_failure
;
4866 if (nft_set_ext_exists(ext
, NFT_SET_EXT_USERDATA
)) {
4867 struct nft_userdata
*udata
;
4869 udata
= nft_set_ext_userdata(ext
);
4870 if (nla_put(skb
, NFTA_SET_ELEM_USERDATA
,
4871 udata
->len
+ 1, udata
->data
))
4872 goto nla_put_failure
;
4875 nla_nest_end(skb
, nest
);
4883 struct nft_set_dump_args
{
4884 const struct netlink_callback
*cb
;
4885 struct nft_set_iter iter
;
4886 struct sk_buff
*skb
;
4889 static int nf_tables_dump_setelem(const struct nft_ctx
*ctx
,
4890 struct nft_set
*set
,
4891 const struct nft_set_iter
*iter
,
4892 struct nft_set_elem
*elem
)
4894 struct nft_set_dump_args
*args
;
4896 args
= container_of(iter
, struct nft_set_dump_args
, iter
);
4897 return nf_tables_fill_setelem(args
->skb
, set
, elem
);
4900 struct nft_set_dump_ctx
{
4901 const struct nft_set
*set
;
4905 static int nft_set_catchall_dump(struct net
*net
, struct sk_buff
*skb
,
4906 const struct nft_set
*set
)
4908 struct nft_set_elem_catchall
*catchall
;
4909 u8 genmask
= nft_genmask_cur(net
);
4910 struct nft_set_elem elem
;
4911 struct nft_set_ext
*ext
;
4914 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
4915 ext
= nft_set_elem_ext(set
, catchall
->elem
);
4916 if (!nft_set_elem_active(ext
, genmask
) ||
4917 nft_set_elem_expired(ext
))
4920 elem
.priv
= catchall
->elem
;
4921 ret
= nf_tables_fill_setelem(skb
, set
, &elem
);
4928 static int nf_tables_dump_set(struct sk_buff
*skb
, struct netlink_callback
*cb
)
4930 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
4931 struct net
*net
= sock_net(skb
->sk
);
4932 struct nftables_pernet
*nft_net
;
4933 struct nft_table
*table
;
4934 struct nft_set
*set
;
4935 struct nft_set_dump_args args
;
4936 bool set_found
= false;
4937 struct nlmsghdr
*nlh
;
4938 struct nlattr
*nest
;
4943 nft_net
= nft_pernet(net
);
4944 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
4945 if (dump_ctx
->ctx
.family
!= NFPROTO_UNSPEC
&&
4946 dump_ctx
->ctx
.family
!= table
->family
)
4949 if (table
!= dump_ctx
->ctx
.table
)
4952 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
4953 if (set
== dump_ctx
->set
) {
4966 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWSETELEM
);
4967 portid
= NETLINK_CB(cb
->skb
).portid
;
4968 seq
= cb
->nlh
->nlmsg_seq
;
4970 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, NLM_F_MULTI
,
4971 table
->family
, NFNETLINK_V0
, nft_base_seq(net
));
4973 goto nla_put_failure
;
4975 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_TABLE
, table
->name
))
4976 goto nla_put_failure
;
4977 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_SET
, set
->name
))
4978 goto nla_put_failure
;
4980 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
4982 goto nla_put_failure
;
4986 args
.iter
.genmask
= nft_genmask_cur(net
);
4987 args
.iter
.skip
= cb
->args
[0];
4988 args
.iter
.count
= 0;
4990 args
.iter
.fn
= nf_tables_dump_setelem
;
4991 set
->ops
->walk(&dump_ctx
->ctx
, set
, &args
.iter
);
4993 if (!args
.iter
.err
&& args
.iter
.count
== cb
->args
[0])
4994 args
.iter
.err
= nft_set_catchall_dump(net
, skb
, set
);
4997 nla_nest_end(skb
, nest
);
4998 nlmsg_end(skb
, nlh
);
5000 if (args
.iter
.err
&& args
.iter
.err
!= -EMSGSIZE
)
5001 return args
.iter
.err
;
5002 if (args
.iter
.count
== cb
->args
[0])
5005 cb
->args
[0] = args
.iter
.count
;
5013 static int nf_tables_dump_set_start(struct netlink_callback
*cb
)
5015 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
5017 cb
->data
= kmemdup(dump_ctx
, sizeof(*dump_ctx
), GFP_ATOMIC
);
5019 return cb
->data
? 0 : -ENOMEM
;
5022 static int nf_tables_dump_set_done(struct netlink_callback
*cb
)
5028 static int nf_tables_fill_setelem_info(struct sk_buff
*skb
,
5029 const struct nft_ctx
*ctx
, u32 seq
,
5030 u32 portid
, int event
, u16 flags
,
5031 const struct nft_set
*set
,
5032 const struct nft_set_elem
*elem
)
5034 struct nlmsghdr
*nlh
;
5035 struct nlattr
*nest
;
5038 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
5039 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, ctx
->family
,
5040 NFNETLINK_V0
, nft_base_seq(ctx
->net
));
5042 goto nla_put_failure
;
5044 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
5045 goto nla_put_failure
;
5046 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
5047 goto nla_put_failure
;
5049 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
5051 goto nla_put_failure
;
5053 err
= nf_tables_fill_setelem(skb
, set
, elem
);
5055 goto nla_put_failure
;
5057 nla_nest_end(skb
, nest
);
5059 nlmsg_end(skb
, nlh
);
5063 nlmsg_trim(skb
, nlh
);
5067 static int nft_setelem_parse_flags(const struct nft_set
*set
,
5068 const struct nlattr
*attr
, u32
*flags
)
5073 *flags
= ntohl(nla_get_be32(attr
));
5074 if (*flags
& ~(NFT_SET_ELEM_INTERVAL_END
| NFT_SET_ELEM_CATCHALL
))
5076 if (!(set
->flags
& NFT_SET_INTERVAL
) &&
5077 *flags
& NFT_SET_ELEM_INTERVAL_END
)
5083 static int nft_setelem_parse_key(struct nft_ctx
*ctx
, struct nft_set
*set
,
5084 struct nft_data
*key
, struct nlattr
*attr
)
5086 struct nft_data_desc desc
;
5089 err
= nft_data_init(ctx
, key
, NFT_DATA_VALUE_MAXLEN
, &desc
, attr
);
5093 if (desc
.type
!= NFT_DATA_VALUE
|| desc
.len
!= set
->klen
) {
5094 nft_data_release(key
, desc
.type
);
5101 static int nft_setelem_parse_data(struct nft_ctx
*ctx
, struct nft_set
*set
,
5102 struct nft_data_desc
*desc
,
5103 struct nft_data
*data
,
5104 struct nlattr
*attr
)
5108 err
= nft_data_init(ctx
, data
, NFT_DATA_VALUE_MAXLEN
, desc
, attr
);
5112 if (desc
->type
!= NFT_DATA_VERDICT
&& desc
->len
!= set
->dlen
) {
5113 nft_data_release(data
, desc
->type
);
5120 static void *nft_setelem_catchall_get(const struct net
*net
,
5121 const struct nft_set
*set
)
5123 struct nft_set_elem_catchall
*catchall
;
5124 u8 genmask
= nft_genmask_cur(net
);
5125 struct nft_set_ext
*ext
;
5128 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
5129 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5130 if (!nft_set_elem_active(ext
, genmask
) ||
5131 nft_set_elem_expired(ext
))
5134 priv
= catchall
->elem
;
5141 static int nft_setelem_get(struct nft_ctx
*ctx
, struct nft_set
*set
,
5142 struct nft_set_elem
*elem
, u32 flags
)
5146 if (!(flags
& NFT_SET_ELEM_CATCHALL
)) {
5147 priv
= set
->ops
->get(ctx
->net
, set
, elem
, flags
);
5149 return PTR_ERR(priv
);
5151 priv
= nft_setelem_catchall_get(ctx
->net
, set
);
5160 static int nft_get_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
5161 const struct nlattr
*attr
)
5163 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
5164 struct nft_set_elem elem
;
5165 struct sk_buff
*skb
;
5169 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
5170 nft_set_elem_policy
, NULL
);
5174 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
5178 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
5181 if (nla
[NFTA_SET_ELEM_KEY
]) {
5182 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
5183 nla
[NFTA_SET_ELEM_KEY
]);
5188 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
5189 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
5190 nla
[NFTA_SET_ELEM_KEY_END
]);
5195 err
= nft_setelem_get(ctx
, set
, &elem
, flags
);
5200 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_ATOMIC
);
5204 err
= nf_tables_fill_setelem_info(skb
, ctx
, ctx
->seq
, ctx
->portid
,
5205 NFT_MSG_NEWSETELEM
, 0, set
, &elem
);
5207 goto err_fill_setelem
;
5209 return nfnetlink_unicast(skb
, ctx
->net
, ctx
->portid
);
5216 /* called with rcu_read_lock held */
5217 static int nf_tables_getsetelem(struct sk_buff
*skb
,
5218 const struct nfnl_info
*info
,
5219 const struct nlattr
* const nla
[])
5221 struct netlink_ext_ack
*extack
= info
->extack
;
5222 u8 genmask
= nft_genmask_cur(info
->net
);
5223 u8 family
= info
->nfmsg
->nfgen_family
;
5224 struct net
*net
= info
->net
;
5225 struct nft_table
*table
;
5226 struct nft_set
*set
;
5227 struct nlattr
*attr
;
5231 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
5232 genmask
, NETLINK_CB(skb
).portid
);
5233 if (IS_ERR(table
)) {
5234 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
5235 return PTR_ERR(table
);
5238 set
= nft_set_lookup(table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
5240 return PTR_ERR(set
);
5242 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
5244 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
5245 struct netlink_dump_control c
= {
5246 .start
= nf_tables_dump_set_start
,
5247 .dump
= nf_tables_dump_set
,
5248 .done
= nf_tables_dump_set_done
,
5249 .module
= THIS_MODULE
,
5251 struct nft_set_dump_ctx dump_ctx
= {
5257 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
5260 if (!nla
[NFTA_SET_ELEM_LIST_ELEMENTS
])
5263 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
5264 err
= nft_get_set_elem(&ctx
, set
, attr
);
5272 static void nf_tables_setelem_notify(const struct nft_ctx
*ctx
,
5273 const struct nft_set
*set
,
5274 const struct nft_set_elem
*elem
,
5277 struct nftables_pernet
*nft_net
;
5278 struct net
*net
= ctx
->net
;
5279 u32 portid
= ctx
->portid
;
5280 struct sk_buff
*skb
;
5284 if (!ctx
->report
&& !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
5287 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
5291 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
5292 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
5294 err
= nf_tables_fill_setelem_info(skb
, ctx
, 0, portid
, event
, flags
,
5301 nft_net
= nft_pernet(net
);
5302 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
5305 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
5308 static struct nft_trans
*nft_trans_elem_alloc(struct nft_ctx
*ctx
,
5310 struct nft_set
*set
)
5312 struct nft_trans
*trans
;
5314 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_elem
));
5318 nft_trans_elem_set(trans
) = set
;
5322 struct nft_expr
*nft_set_elem_expr_alloc(const struct nft_ctx
*ctx
,
5323 const struct nft_set
*set
,
5324 const struct nlattr
*attr
)
5326 struct nft_expr
*expr
;
5329 expr
= nft_expr_init(ctx
, attr
);
5334 if (expr
->ops
->type
->flags
& NFT_EXPR_GC
) {
5335 if (set
->flags
& NFT_SET_TIMEOUT
)
5336 goto err_set_elem_expr
;
5337 if (!set
->ops
->gc_init
)
5338 goto err_set_elem_expr
;
5339 set
->ops
->gc_init(set
);
5345 nft_expr_destroy(ctx
, expr
);
5346 return ERR_PTR(err
);
5349 void *nft_set_elem_init(const struct nft_set
*set
,
5350 const struct nft_set_ext_tmpl
*tmpl
,
5351 const u32
*key
, const u32
*key_end
,
5352 const u32
*data
, u64 timeout
, u64 expiration
, gfp_t gfp
)
5354 struct nft_set_ext
*ext
;
5357 elem
= kzalloc(set
->ops
->elemsize
+ tmpl
->len
, gfp
);
5361 ext
= nft_set_elem_ext(set
, elem
);
5362 nft_set_ext_init(ext
, tmpl
);
5364 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY
))
5365 memcpy(nft_set_ext_key(ext
), key
, set
->klen
);
5366 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
))
5367 memcpy(nft_set_ext_key_end(ext
), key_end
, set
->klen
);
5368 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5369 memcpy(nft_set_ext_data(ext
), data
, set
->dlen
);
5370 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
5371 *nft_set_ext_expiration(ext
) = get_jiffies_64() + expiration
;
5372 if (expiration
== 0)
5373 *nft_set_ext_expiration(ext
) += timeout
;
5375 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
))
5376 *nft_set_ext_timeout(ext
) = timeout
;
5381 static void __nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
5382 struct nft_expr
*expr
)
5384 if (expr
->ops
->destroy_clone
) {
5385 expr
->ops
->destroy_clone(ctx
, expr
);
5386 module_put(expr
->ops
->type
->owner
);
5388 nf_tables_expr_destroy(ctx
, expr
);
5392 static void nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
5393 struct nft_set_elem_expr
*elem_expr
)
5395 struct nft_expr
*expr
;
5398 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
5399 __nft_set_elem_expr_destroy(ctx
, expr
);
5402 void nft_set_elem_destroy(const struct nft_set
*set
, void *elem
,
5405 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
);
5406 struct nft_ctx ctx
= {
5407 .net
= read_pnet(&set
->net
),
5408 .family
= set
->table
->family
,
5411 nft_data_release(nft_set_ext_key(ext
), NFT_DATA_VALUE
);
5412 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5413 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
5414 if (destroy_expr
&& nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
5415 nft_set_elem_expr_destroy(&ctx
, nft_set_ext_expr(ext
));
5417 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
5418 (*nft_set_ext_obj(ext
))->use
--;
5421 EXPORT_SYMBOL_GPL(nft_set_elem_destroy
);
5423 /* Only called from commit path, nft_setelem_data_deactivate() already deals
5424 * with the refcounting from the preparation phase.
5426 static void nf_tables_set_elem_destroy(const struct nft_ctx
*ctx
,
5427 const struct nft_set
*set
, void *elem
)
5429 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
);
5431 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
5432 nft_set_elem_expr_destroy(ctx
, nft_set_ext_expr(ext
));
5437 int nft_set_elem_expr_clone(const struct nft_ctx
*ctx
, struct nft_set
*set
,
5438 struct nft_expr
*expr_array
[])
5440 struct nft_expr
*expr
;
5443 for (i
= 0; i
< set
->num_exprs
; i
++) {
5444 expr
= kzalloc(set
->exprs
[i
]->ops
->size
, GFP_KERNEL
);
5448 err
= nft_expr_clone(expr
, set
->exprs
[i
]);
5450 nft_expr_destroy(ctx
, expr
);
5453 expr_array
[i
] = expr
;
5459 for (k
= i
- 1; k
>= 0; k
--)
5460 nft_expr_destroy(ctx
, expr_array
[k
]);
5465 static int nft_set_elem_expr_setup(struct nft_ctx
*ctx
,
5466 const struct nft_set_ext
*ext
,
5467 struct nft_expr
*expr_array
[],
5470 struct nft_set_elem_expr
*elem_expr
= nft_set_ext_expr(ext
);
5471 struct nft_expr
*expr
;
5474 for (i
= 0; i
< num_exprs
; i
++) {
5475 expr
= nft_setelem_expr_at(elem_expr
, elem_expr
->size
);
5476 err
= nft_expr_clone(expr
, expr_array
[i
]);
5478 goto err_elem_expr_setup
;
5480 elem_expr
->size
+= expr_array
[i
]->ops
->size
;
5481 nft_expr_destroy(ctx
, expr_array
[i
]);
5482 expr_array
[i
] = NULL
;
5487 err_elem_expr_setup
:
5488 for (; i
< num_exprs
; i
++) {
5489 nft_expr_destroy(ctx
, expr_array
[i
]);
5490 expr_array
[i
] = NULL
;
5496 struct nft_set_ext
*nft_set_catchall_lookup(const struct net
*net
,
5497 const struct nft_set
*set
)
5499 struct nft_set_elem_catchall
*catchall
;
5500 u8 genmask
= nft_genmask_cur(net
);
5501 struct nft_set_ext
*ext
;
5503 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
5504 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5505 if (nft_set_elem_active(ext
, genmask
) &&
5506 !nft_set_elem_expired(ext
))
5512 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup
);
5514 void *nft_set_catchall_gc(const struct nft_set
*set
)
5516 struct nft_set_elem_catchall
*catchall
, *next
;
5517 struct nft_set_ext
*ext
;
5520 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
5521 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5523 if (!nft_set_elem_expired(ext
) ||
5524 nft_set_elem_mark_busy(ext
))
5527 elem
= catchall
->elem
;
5528 list_del_rcu(&catchall
->list
);
5529 kfree_rcu(catchall
, rcu
);
5535 EXPORT_SYMBOL_GPL(nft_set_catchall_gc
);
5537 static int nft_setelem_catchall_insert(const struct net
*net
,
5538 struct nft_set
*set
,
5539 const struct nft_set_elem
*elem
,
5540 struct nft_set_ext
**pext
)
5542 struct nft_set_elem_catchall
*catchall
;
5543 u8 genmask
= nft_genmask_next(net
);
5544 struct nft_set_ext
*ext
;
5546 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
5547 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5548 if (nft_set_elem_active(ext
, genmask
)) {
5554 catchall
= kmalloc(sizeof(*catchall
), GFP_KERNEL
);
5558 catchall
->elem
= elem
->priv
;
5559 list_add_tail_rcu(&catchall
->list
, &set
->catchall_list
);
5564 static int nft_setelem_insert(const struct net
*net
,
5565 struct nft_set
*set
,
5566 const struct nft_set_elem
*elem
,
5567 struct nft_set_ext
**ext
, unsigned int flags
)
5571 if (flags
& NFT_SET_ELEM_CATCHALL
)
5572 ret
= nft_setelem_catchall_insert(net
, set
, elem
, ext
);
5574 ret
= set
->ops
->insert(net
, set
, elem
, ext
);
5579 static bool nft_setelem_is_catchall(const struct nft_set
*set
,
5580 const struct nft_set_elem
*elem
)
5582 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
5584 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
5585 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_CATCHALL
)
5591 static void nft_setelem_activate(struct net
*net
, struct nft_set
*set
,
5592 struct nft_set_elem
*elem
)
5594 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
5596 if (nft_setelem_is_catchall(set
, elem
)) {
5597 nft_set_elem_change_active(net
, set
, ext
);
5598 nft_set_elem_clear_busy(ext
);
5600 set
->ops
->activate(net
, set
, elem
);
5604 static int nft_setelem_catchall_deactivate(const struct net
*net
,
5605 struct nft_set
*set
,
5606 struct nft_set_elem
*elem
)
5608 struct nft_set_elem_catchall
*catchall
;
5609 struct nft_set_ext
*ext
;
5611 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
5612 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5613 if (!nft_is_active(net
, ext
) ||
5614 nft_set_elem_mark_busy(ext
))
5618 elem
->priv
= catchall
->elem
;
5619 nft_set_elem_change_active(net
, set
, ext
);
5626 static int __nft_setelem_deactivate(const struct net
*net
,
5627 struct nft_set
*set
,
5628 struct nft_set_elem
*elem
)
5632 priv
= set
->ops
->deactivate(net
, set
, elem
);
5643 static int nft_setelem_deactivate(const struct net
*net
,
5644 struct nft_set
*set
,
5645 struct nft_set_elem
*elem
, u32 flags
)
5649 if (flags
& NFT_SET_ELEM_CATCHALL
)
5650 ret
= nft_setelem_catchall_deactivate(net
, set
, elem
);
5652 ret
= __nft_setelem_deactivate(net
, set
, elem
);
5657 static void nft_setelem_catchall_remove(const struct net
*net
,
5658 const struct nft_set
*set
,
5659 const struct nft_set_elem
*elem
)
5661 struct nft_set_elem_catchall
*catchall
, *next
;
5663 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
5664 if (catchall
->elem
== elem
->priv
) {
5665 list_del_rcu(&catchall
->list
);
5666 kfree_rcu(catchall
, rcu
);
5672 static void nft_setelem_remove(const struct net
*net
,
5673 const struct nft_set
*set
,
5674 const struct nft_set_elem
*elem
)
5676 if (nft_setelem_is_catchall(set
, elem
))
5677 nft_setelem_catchall_remove(net
, set
, elem
);
5679 set
->ops
->remove(net
, set
, elem
);
5682 static int nft_add_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
5683 const struct nlattr
*attr
, u32 nlmsg_flags
)
5685 struct nft_expr
*expr_array
[NFT_SET_EXPR_MAX
] = {};
5686 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
5687 u8 genmask
= nft_genmask_next(ctx
->net
);
5688 u32 flags
= 0, size
= 0, num_exprs
= 0;
5689 struct nft_set_ext_tmpl tmpl
;
5690 struct nft_set_ext
*ext
, *ext2
;
5691 struct nft_set_elem elem
;
5692 struct nft_set_binding
*binding
;
5693 struct nft_object
*obj
= NULL
;
5694 struct nft_userdata
*udata
;
5695 struct nft_data_desc desc
;
5696 enum nft_registers dreg
;
5697 struct nft_trans
*trans
;
5703 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
5704 nft_set_elem_policy
, NULL
);
5708 nft_set_ext_prepare(&tmpl
);
5710 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
5714 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
5718 nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
5720 if (set
->flags
& NFT_SET_MAP
) {
5721 if (nla
[NFTA_SET_ELEM_DATA
] == NULL
&&
5722 !(flags
& NFT_SET_ELEM_INTERVAL_END
))
5725 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
5729 if ((flags
& NFT_SET_ELEM_INTERVAL_END
) &&
5730 (nla
[NFTA_SET_ELEM_DATA
] ||
5731 nla
[NFTA_SET_ELEM_OBJREF
] ||
5732 nla
[NFTA_SET_ELEM_TIMEOUT
] ||
5733 nla
[NFTA_SET_ELEM_EXPIRATION
] ||
5734 nla
[NFTA_SET_ELEM_USERDATA
] ||
5735 nla
[NFTA_SET_ELEM_EXPR
] ||
5736 nla
[NFTA_SET_ELEM_EXPRESSIONS
]))
5740 if (nla
[NFTA_SET_ELEM_TIMEOUT
] != NULL
) {
5741 if (!(set
->flags
& NFT_SET_TIMEOUT
))
5743 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_TIMEOUT
],
5747 } else if (set
->flags
& NFT_SET_TIMEOUT
) {
5748 timeout
= set
->timeout
;
5752 if (nla
[NFTA_SET_ELEM_EXPIRATION
] != NULL
) {
5753 if (!(set
->flags
& NFT_SET_TIMEOUT
))
5755 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_EXPIRATION
],
5761 if (nla
[NFTA_SET_ELEM_EXPR
]) {
5762 struct nft_expr
*expr
;
5764 if (set
->num_exprs
&& set
->num_exprs
!= 1)
5767 expr
= nft_set_elem_expr_alloc(ctx
, set
,
5768 nla
[NFTA_SET_ELEM_EXPR
]);
5770 return PTR_ERR(expr
);
5772 expr_array
[0] = expr
;
5775 if (set
->num_exprs
&& set
->exprs
[0]->ops
!= expr
->ops
) {
5777 goto err_set_elem_expr
;
5779 } else if (nla
[NFTA_SET_ELEM_EXPRESSIONS
]) {
5780 struct nft_expr
*expr
;
5785 nla_for_each_nested(tmp
, nla
[NFTA_SET_ELEM_EXPRESSIONS
], left
) {
5786 if (i
== NFT_SET_EXPR_MAX
||
5787 (set
->num_exprs
&& set
->num_exprs
== i
)) {
5789 goto err_set_elem_expr
;
5791 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
5793 goto err_set_elem_expr
;
5795 expr
= nft_set_elem_expr_alloc(ctx
, set
, tmp
);
5797 err
= PTR_ERR(expr
);
5798 goto err_set_elem_expr
;
5800 expr_array
[i
] = expr
;
5803 if (set
->num_exprs
&& expr
->ops
!= set
->exprs
[i
]->ops
) {
5805 goto err_set_elem_expr
;
5809 if (set
->num_exprs
&& set
->num_exprs
!= i
) {
5811 goto err_set_elem_expr
;
5813 } else if (set
->num_exprs
> 0) {
5814 err
= nft_set_elem_expr_clone(ctx
, set
, expr_array
);
5816 goto err_set_elem_expr_clone
;
5818 num_exprs
= set
->num_exprs
;
5821 if (nla
[NFTA_SET_ELEM_KEY
]) {
5822 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
5823 nla
[NFTA_SET_ELEM_KEY
]);
5825 goto err_set_elem_expr
;
5827 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
5830 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
5831 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
5832 nla
[NFTA_SET_ELEM_KEY_END
]);
5836 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
5840 nft_set_ext_add(&tmpl
, NFT_SET_EXT_EXPIRATION
);
5841 if (timeout
!= set
->timeout
)
5842 nft_set_ext_add(&tmpl
, NFT_SET_EXT_TIMEOUT
);
5846 for (i
= 0; i
< num_exprs
; i
++)
5847 size
+= expr_array
[i
]->ops
->size
;
5849 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_EXPRESSIONS
,
5850 sizeof(struct nft_set_elem_expr
) +
5854 if (nla
[NFTA_SET_ELEM_OBJREF
] != NULL
) {
5855 if (!(set
->flags
& NFT_SET_OBJECT
)) {
5857 goto err_parse_key_end
;
5859 obj
= nft_obj_lookup(ctx
->net
, ctx
->table
,
5860 nla
[NFTA_SET_ELEM_OBJREF
],
5861 set
->objtype
, genmask
);
5864 goto err_parse_key_end
;
5866 nft_set_ext_add(&tmpl
, NFT_SET_EXT_OBJREF
);
5869 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
) {
5870 err
= nft_setelem_parse_data(ctx
, set
, &desc
, &elem
.data
.val
,
5871 nla
[NFTA_SET_ELEM_DATA
]);
5873 goto err_parse_key_end
;
5875 dreg
= nft_type_to_reg(set
->dtype
);
5876 list_for_each_entry(binding
, &set
->bindings
, list
) {
5877 struct nft_ctx bind_ctx
= {
5879 .family
= ctx
->family
,
5880 .table
= ctx
->table
,
5881 .chain
= (struct nft_chain
*)binding
->chain
,
5884 if (!(binding
->flags
& NFT_SET_MAP
))
5887 err
= nft_validate_register_store(&bind_ctx
, dreg
,
5889 desc
.type
, desc
.len
);
5891 goto err_parse_data
;
5893 if (desc
.type
== NFT_DATA_VERDICT
&&
5894 (elem
.data
.val
.verdict
.code
== NFT_GOTO
||
5895 elem
.data
.val
.verdict
.code
== NFT_JUMP
))
5896 nft_validate_state_update(ctx
->net
,
5900 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_DATA
, desc
.len
);
5903 /* The full maximum length of userdata can exceed the maximum
5904 * offset value (U8_MAX) for following extensions, therefor it
5905 * must be the last extension added.
5908 if (nla
[NFTA_SET_ELEM_USERDATA
] != NULL
) {
5909 ulen
= nla_len(nla
[NFTA_SET_ELEM_USERDATA
]);
5911 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_USERDATA
,
5916 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
5917 elem
.key_end
.val
.data
, elem
.data
.val
.data
,
5918 timeout
, expiration
, GFP_KERNEL
);
5919 if (elem
.priv
== NULL
)
5920 goto err_parse_data
;
5922 ext
= nft_set_elem_ext(set
, elem
.priv
);
5924 *nft_set_ext_flags(ext
) = flags
;
5926 udata
= nft_set_ext_userdata(ext
);
5927 udata
->len
= ulen
- 1;
5928 nla_memcpy(&udata
->data
, nla
[NFTA_SET_ELEM_USERDATA
], ulen
);
5931 *nft_set_ext_obj(ext
) = obj
;
5934 err
= nft_set_elem_expr_setup(ctx
, ext
, expr_array
, num_exprs
);
5938 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_NEWSETELEM
, set
);
5939 if (trans
== NULL
) {
5944 ext
->genmask
= nft_genmask_cur(ctx
->net
) | NFT_SET_ELEM_BUSY_MASK
;
5946 err
= nft_setelem_insert(ctx
->net
, set
, &elem
, &ext2
, flags
);
5948 if (err
== -EEXIST
) {
5949 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) ^
5950 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) ||
5951 nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) ^
5952 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
))
5953 goto err_element_clash
;
5954 if ((nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
5955 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) &&
5956 memcmp(nft_set_ext_data(ext
),
5957 nft_set_ext_data(ext2
), set
->dlen
) != 0) ||
5958 (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
5959 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
) &&
5960 *nft_set_ext_obj(ext
) != *nft_set_ext_obj(ext2
)))
5961 goto err_element_clash
;
5962 else if (!(nlmsg_flags
& NLM_F_EXCL
))
5964 } else if (err
== -ENOTEMPTY
) {
5965 /* ENOTEMPTY reports overlapping between this element
5966 * and an existing one.
5970 goto err_element_clash
;
5973 if (!(flags
& NFT_SET_ELEM_CATCHALL
) && set
->size
&&
5974 !atomic_add_unless(&set
->nelems
, 1, set
->size
+ set
->ndeact
)) {
5979 nft_trans_elem(trans
) = elem
;
5980 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
5984 nft_setelem_remove(ctx
->net
, set
, &elem
);
5991 nf_tables_set_elem_destroy(ctx
, set
, elem
.priv
);
5993 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
5994 nft_data_release(&elem
.data
.val
, desc
.type
);
5996 nft_data_release(&elem
.key_end
.val
, NFT_DATA_VALUE
);
5998 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
6000 for (i
= 0; i
< num_exprs
&& expr_array
[i
]; i
++)
6001 nft_expr_destroy(ctx
, expr_array
[i
]);
6002 err_set_elem_expr_clone
:
6006 static int nf_tables_newsetelem(struct sk_buff
*skb
,
6007 const struct nfnl_info
*info
,
6008 const struct nlattr
* const nla
[])
6010 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
6011 struct netlink_ext_ack
*extack
= info
->extack
;
6012 u8 genmask
= nft_genmask_next(info
->net
);
6013 u8 family
= info
->nfmsg
->nfgen_family
;
6014 struct net
*net
= info
->net
;
6015 const struct nlattr
*attr
;
6016 struct nft_table
*table
;
6017 struct nft_set
*set
;
6021 if (nla
[NFTA_SET_ELEM_LIST_ELEMENTS
] == NULL
)
6024 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
6025 genmask
, NETLINK_CB(skb
).portid
);
6026 if (IS_ERR(table
)) {
6027 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
6028 return PTR_ERR(table
);
6031 set
= nft_set_lookup_global(net
, table
, nla
[NFTA_SET_ELEM_LIST_SET
],
6032 nla
[NFTA_SET_ELEM_LIST_SET_ID
], genmask
);
6034 return PTR_ERR(set
);
6036 if (!list_empty(&set
->bindings
) && set
->flags
& NFT_SET_CONSTANT
)
6039 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6041 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
6042 err
= nft_add_set_elem(&ctx
, set
, attr
, info
->nlh
->nlmsg_flags
);
6047 if (nft_net
->validate_state
== NFT_VALIDATE_DO
)
6048 return nft_table_validate(net
, table
);
6054 * nft_data_hold - hold a nft_data item
6056 * @data: struct nft_data to release
6057 * @type: type of data
6059 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6060 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
6061 * NFT_GOTO verdicts. This function must be called on active data objects
6062 * from the second phase of the commit protocol.
6064 void nft_data_hold(const struct nft_data
*data
, enum nft_data_types type
)
6066 struct nft_chain
*chain
;
6067 struct nft_rule
*rule
;
6069 if (type
== NFT_DATA_VERDICT
) {
6070 switch (data
->verdict
.code
) {
6073 chain
= data
->verdict
.chain
;
6076 if (!nft_chain_is_bound(chain
))
6079 chain
->table
->use
++;
6080 list_for_each_entry(rule
, &chain
->rules
, list
)
6083 nft_chain_add(chain
->table
, chain
);
6089 static void nft_setelem_data_activate(const struct net
*net
,
6090 const struct nft_set
*set
,
6091 struct nft_set_elem
*elem
)
6093 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
6095 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
6096 nft_data_hold(nft_set_ext_data(ext
), set
->dtype
);
6097 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
6098 (*nft_set_ext_obj(ext
))->use
++;
6101 static void nft_setelem_data_deactivate(const struct net
*net
,
6102 const struct nft_set
*set
,
6103 struct nft_set_elem
*elem
)
6105 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
6107 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
6108 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
6109 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
6110 (*nft_set_ext_obj(ext
))->use
--;
6113 static int nft_del_setelem(struct nft_ctx
*ctx
, struct nft_set
*set
,
6114 const struct nlattr
*attr
)
6116 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
6117 struct nft_set_ext_tmpl tmpl
;
6118 struct nft_set_elem elem
;
6119 struct nft_set_ext
*ext
;
6120 struct nft_trans
*trans
;
6124 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
6125 nft_set_elem_policy
, NULL
);
6129 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
6133 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
6136 nft_set_ext_prepare(&tmpl
);
6139 nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
6141 if (nla
[NFTA_SET_ELEM_KEY
]) {
6142 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
6143 nla
[NFTA_SET_ELEM_KEY
]);
6147 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
6150 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
6151 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
6152 nla
[NFTA_SET_ELEM_KEY_END
]);
6156 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
6160 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
6161 elem
.key_end
.val
.data
, NULL
, 0, 0,
6163 if (elem
.priv
== NULL
)
6166 ext
= nft_set_elem_ext(set
, elem
.priv
);
6168 *nft_set_ext_flags(ext
) = flags
;
6170 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_DELSETELEM
, set
);
6174 err
= nft_setelem_deactivate(ctx
->net
, set
, &elem
, flags
);
6178 nft_setelem_data_deactivate(ctx
->net
, set
, &elem
);
6180 nft_trans_elem(trans
) = elem
;
6181 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6189 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
6193 static int nft_setelem_flush(const struct nft_ctx
*ctx
,
6194 struct nft_set
*set
,
6195 const struct nft_set_iter
*iter
,
6196 struct nft_set_elem
*elem
)
6198 struct nft_trans
*trans
;
6201 trans
= nft_trans_alloc_gfp(ctx
, NFT_MSG_DELSETELEM
,
6202 sizeof(struct nft_trans_elem
), GFP_ATOMIC
);
6206 if (!set
->ops
->flush(ctx
->net
, set
, elem
->priv
)) {
6212 nft_setelem_data_deactivate(ctx
->net
, set
, elem
);
6213 nft_trans_elem_set(trans
) = set
;
6214 nft_trans_elem(trans
) = *elem
;
6215 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6223 static int __nft_set_catchall_flush(const struct nft_ctx
*ctx
,
6224 struct nft_set
*set
,
6225 struct nft_set_elem
*elem
)
6227 struct nft_trans
*trans
;
6229 trans
= nft_trans_alloc_gfp(ctx
, NFT_MSG_DELSETELEM
,
6230 sizeof(struct nft_trans_elem
), GFP_KERNEL
);
6234 nft_setelem_data_deactivate(ctx
->net
, set
, elem
);
6235 nft_trans_elem_set(trans
) = set
;
6236 nft_trans_elem(trans
) = *elem
;
6237 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6242 static int nft_set_catchall_flush(const struct nft_ctx
*ctx
,
6243 struct nft_set
*set
)
6245 u8 genmask
= nft_genmask_next(ctx
->net
);
6246 struct nft_set_elem_catchall
*catchall
;
6247 struct nft_set_elem elem
;
6248 struct nft_set_ext
*ext
;
6251 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
6252 ext
= nft_set_elem_ext(set
, catchall
->elem
);
6253 if (!nft_set_elem_active(ext
, genmask
) ||
6254 nft_set_elem_mark_busy(ext
))
6257 elem
.priv
= catchall
->elem
;
6258 ret
= __nft_set_catchall_flush(ctx
, set
, &elem
);
6266 static int nft_set_flush(struct nft_ctx
*ctx
, struct nft_set
*set
, u8 genmask
)
6268 struct nft_set_iter iter
= {
6270 .fn
= nft_setelem_flush
,
6273 set
->ops
->walk(ctx
, set
, &iter
);
6275 iter
.err
= nft_set_catchall_flush(ctx
, set
);
6280 static int nf_tables_delsetelem(struct sk_buff
*skb
,
6281 const struct nfnl_info
*info
,
6282 const struct nlattr
* const nla
[])
6284 struct netlink_ext_ack
*extack
= info
->extack
;
6285 u8 genmask
= nft_genmask_next(info
->net
);
6286 u8 family
= info
->nfmsg
->nfgen_family
;
6287 struct net
*net
= info
->net
;
6288 const struct nlattr
*attr
;
6289 struct nft_table
*table
;
6290 struct nft_set
*set
;
6294 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
6295 genmask
, NETLINK_CB(skb
).portid
);
6296 if (IS_ERR(table
)) {
6297 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
6298 return PTR_ERR(table
);
6301 set
= nft_set_lookup(table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
6303 return PTR_ERR(set
);
6304 if (!list_empty(&set
->bindings
) && set
->flags
& NFT_SET_CONSTANT
)
6307 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6309 if (!nla
[NFTA_SET_ELEM_LIST_ELEMENTS
])
6310 return nft_set_flush(&ctx
, set
, genmask
);
6312 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
6313 err
= nft_del_setelem(&ctx
, set
, attr
);
6320 void nft_set_gc_batch_release(struct rcu_head
*rcu
)
6322 struct nft_set_gc_batch
*gcb
;
6325 gcb
= container_of(rcu
, struct nft_set_gc_batch
, head
.rcu
);
6326 for (i
= 0; i
< gcb
->head
.cnt
; i
++)
6327 nft_set_elem_destroy(gcb
->head
.set
, gcb
->elems
[i
], true);
6331 struct nft_set_gc_batch
*nft_set_gc_batch_alloc(const struct nft_set
*set
,
6334 struct nft_set_gc_batch
*gcb
;
6336 gcb
= kzalloc(sizeof(*gcb
), gfp
);
6339 gcb
->head
.set
= set
;
6348 * nft_register_obj- register nf_tables stateful object type
6349 * @obj_type: object type
6351 * Registers the object type for use with nf_tables. Returns zero on
6352 * success or a negative errno code otherwise.
6354 int nft_register_obj(struct nft_object_type
*obj_type
)
6356 if (obj_type
->type
== NFT_OBJECT_UNSPEC
)
6359 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
6360 list_add_rcu(&obj_type
->list
, &nf_tables_objects
);
6361 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
6364 EXPORT_SYMBOL_GPL(nft_register_obj
);
6367 * nft_unregister_obj - unregister nf_tables object type
6368 * @obj_type: object type
6370 * Unregisters the object type for use with nf_tables.
6372 void nft_unregister_obj(struct nft_object_type
*obj_type
)
6374 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
6375 list_del_rcu(&obj_type
->list
);
6376 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
6378 EXPORT_SYMBOL_GPL(nft_unregister_obj
);
6380 struct nft_object
*nft_obj_lookup(const struct net
*net
,
6381 const struct nft_table
*table
,
6382 const struct nlattr
*nla
, u32 objtype
,
6385 struct nft_object_hash_key k
= { .table
= table
};
6386 char search
[NFT_OBJ_MAXNAMELEN
];
6387 struct rhlist_head
*tmp
, *list
;
6388 struct nft_object
*obj
;
6390 nla_strscpy(search
, nla
, sizeof(search
));
6393 WARN_ON_ONCE(!rcu_read_lock_held() &&
6394 !lockdep_commit_lock_is_held(net
));
6397 list
= rhltable_lookup(&nft_objname_ht
, &k
, nft_objname_ht_params
);
6401 rhl_for_each_entry_rcu(obj
, tmp
, list
, rhlhead
) {
6402 if (objtype
== obj
->ops
->type
->type
&&
6403 nft_active_genmask(obj
, genmask
)) {
6410 return ERR_PTR(-ENOENT
);
6412 EXPORT_SYMBOL_GPL(nft_obj_lookup
);
6414 static struct nft_object
*nft_obj_lookup_byhandle(const struct nft_table
*table
,
6415 const struct nlattr
*nla
,
6416 u32 objtype
, u8 genmask
)
6418 struct nft_object
*obj
;
6420 list_for_each_entry(obj
, &table
->objects
, list
) {
6421 if (be64_to_cpu(nla_get_be64(nla
)) == obj
->handle
&&
6422 objtype
== obj
->ops
->type
->type
&&
6423 nft_active_genmask(obj
, genmask
))
6426 return ERR_PTR(-ENOENT
);
6429 static const struct nla_policy nft_obj_policy
[NFTA_OBJ_MAX
+ 1] = {
6430 [NFTA_OBJ_TABLE
] = { .type
= NLA_STRING
,
6431 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
6432 [NFTA_OBJ_NAME
] = { .type
= NLA_STRING
,
6433 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
6434 [NFTA_OBJ_TYPE
] = { .type
= NLA_U32
},
6435 [NFTA_OBJ_DATA
] = { .type
= NLA_NESTED
},
6436 [NFTA_OBJ_HANDLE
] = { .type
= NLA_U64
},
6437 [NFTA_OBJ_USERDATA
] = { .type
= NLA_BINARY
,
6438 .len
= NFT_USERDATA_MAXLEN
},
6441 static struct nft_object
*nft_obj_init(const struct nft_ctx
*ctx
,
6442 const struct nft_object_type
*type
,
6443 const struct nlattr
*attr
)
6446 const struct nft_object_ops
*ops
;
6447 struct nft_object
*obj
;
6450 tb
= kmalloc_array(type
->maxattr
+ 1, sizeof(*tb
), GFP_KERNEL
);
6455 err
= nla_parse_nested_deprecated(tb
, type
->maxattr
, attr
,
6456 type
->policy
, NULL
);
6460 memset(tb
, 0, sizeof(tb
[0]) * (type
->maxattr
+ 1));
6463 if (type
->select_ops
) {
6464 ops
= type
->select_ops(ctx
, (const struct nlattr
* const *)tb
);
6474 obj
= kzalloc(sizeof(*obj
) + ops
->size
, GFP_KERNEL
);
6478 err
= ops
->init(ctx
, (const struct nlattr
* const *)tb
, obj
);
6491 return ERR_PTR(err
);
6494 static int nft_object_dump(struct sk_buff
*skb
, unsigned int attr
,
6495 struct nft_object
*obj
, bool reset
)
6497 struct nlattr
*nest
;
6499 nest
= nla_nest_start_noflag(skb
, attr
);
6501 goto nla_put_failure
;
6502 if (obj
->ops
->dump(skb
, obj
, reset
) < 0)
6503 goto nla_put_failure
;
6504 nla_nest_end(skb
, nest
);
6511 static const struct nft_object_type
*__nft_obj_type_get(u32 objtype
)
6513 const struct nft_object_type
*type
;
6515 list_for_each_entry(type
, &nf_tables_objects
, list
) {
6516 if (objtype
== type
->type
)
6522 static const struct nft_object_type
*
6523 nft_obj_type_get(struct net
*net
, u32 objtype
)
6525 const struct nft_object_type
*type
;
6527 type
= __nft_obj_type_get(objtype
);
6528 if (type
!= NULL
&& try_module_get(type
->owner
))
6531 lockdep_nfnl_nft_mutex_not_held();
6532 #ifdef CONFIG_MODULES
6534 if (nft_request_module(net
, "nft-obj-%u", objtype
) == -EAGAIN
)
6535 return ERR_PTR(-EAGAIN
);
6538 return ERR_PTR(-ENOENT
);
6541 static int nf_tables_updobj(const struct nft_ctx
*ctx
,
6542 const struct nft_object_type
*type
,
6543 const struct nlattr
*attr
,
6544 struct nft_object
*obj
)
6546 struct nft_object
*newobj
;
6547 struct nft_trans
*trans
;
6550 if (!try_module_get(type
->owner
))
6553 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWOBJ
,
6554 sizeof(struct nft_trans_obj
));
6558 newobj
= nft_obj_init(ctx
, type
, attr
);
6559 if (IS_ERR(newobj
)) {
6560 err
= PTR_ERR(newobj
);
6561 goto err_free_trans
;
6564 nft_trans_obj(trans
) = obj
;
6565 nft_trans_obj_update(trans
) = true;
6566 nft_trans_obj_newobj(trans
) = newobj
;
6567 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6574 module_put(type
->owner
);
6578 static int nf_tables_newobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
6579 const struct nlattr
* const nla
[])
6581 struct netlink_ext_ack
*extack
= info
->extack
;
6582 u8 genmask
= nft_genmask_next(info
->net
);
6583 u8 family
= info
->nfmsg
->nfgen_family
;
6584 const struct nft_object_type
*type
;
6585 struct net
*net
= info
->net
;
6586 struct nft_table
*table
;
6587 struct nft_object
*obj
;
6592 if (!nla
[NFTA_OBJ_TYPE
] ||
6593 !nla
[NFTA_OBJ_NAME
] ||
6594 !nla
[NFTA_OBJ_DATA
])
6597 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
6598 NETLINK_CB(skb
).portid
);
6599 if (IS_ERR(table
)) {
6600 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6601 return PTR_ERR(table
);
6604 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6605 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
6608 if (err
!= -ENOENT
) {
6609 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6613 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
6614 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6617 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
6620 type
= __nft_obj_type_get(objtype
);
6621 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6623 return nf_tables_updobj(&ctx
, type
, nla
[NFTA_OBJ_DATA
], obj
);
6626 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6628 type
= nft_obj_type_get(net
, objtype
);
6630 return PTR_ERR(type
);
6632 obj
= nft_obj_init(&ctx
, type
, nla
[NFTA_OBJ_DATA
]);
6637 obj
->key
.table
= table
;
6638 obj
->handle
= nf_tables_alloc_handle(table
);
6640 obj
->key
.name
= nla_strdup(nla
[NFTA_OBJ_NAME
], GFP_KERNEL
);
6641 if (!obj
->key
.name
) {
6646 if (nla
[NFTA_OBJ_USERDATA
]) {
6647 obj
->udata
= nla_memdup(nla
[NFTA_OBJ_USERDATA
], GFP_KERNEL
);
6648 if (obj
->udata
== NULL
)
6651 obj
->udlen
= nla_len(nla
[NFTA_OBJ_USERDATA
]);
6654 err
= nft_trans_obj_add(&ctx
, NFT_MSG_NEWOBJ
, obj
);
6658 err
= rhltable_insert(&nft_objname_ht
, &obj
->rhlhead
,
6659 nft_objname_ht_params
);
6663 list_add_tail_rcu(&obj
->list
, &table
->objects
);
6667 /* queued in transaction log */
6668 INIT_LIST_HEAD(&obj
->list
);
6673 kfree(obj
->key
.name
);
6675 if (obj
->ops
->destroy
)
6676 obj
->ops
->destroy(&ctx
, obj
);
6679 module_put(type
->owner
);
6683 static int nf_tables_fill_obj_info(struct sk_buff
*skb
, struct net
*net
,
6684 u32 portid
, u32 seq
, int event
, u32 flags
,
6685 int family
, const struct nft_table
*table
,
6686 struct nft_object
*obj
, bool reset
)
6688 struct nlmsghdr
*nlh
;
6690 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
6691 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
6692 NFNETLINK_V0
, nft_base_seq(net
));
6694 goto nla_put_failure
;
6696 if (nla_put_string(skb
, NFTA_OBJ_TABLE
, table
->name
) ||
6697 nla_put_string(skb
, NFTA_OBJ_NAME
, obj
->key
.name
) ||
6698 nla_put_be32(skb
, NFTA_OBJ_TYPE
, htonl(obj
->ops
->type
->type
)) ||
6699 nla_put_be32(skb
, NFTA_OBJ_USE
, htonl(obj
->use
)) ||
6700 nft_object_dump(skb
, NFTA_OBJ_DATA
, obj
, reset
) ||
6701 nla_put_be64(skb
, NFTA_OBJ_HANDLE
, cpu_to_be64(obj
->handle
),
6703 goto nla_put_failure
;
6706 nla_put(skb
, NFTA_OBJ_USERDATA
, obj
->udlen
, obj
->udata
))
6707 goto nla_put_failure
;
6709 nlmsg_end(skb
, nlh
);
6713 nlmsg_trim(skb
, nlh
);
6717 struct nft_obj_filter
{
6722 static int nf_tables_dump_obj(struct sk_buff
*skb
, struct netlink_callback
*cb
)
6724 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
6725 const struct nft_table
*table
;
6726 unsigned int idx
= 0, s_idx
= cb
->args
[0];
6727 struct nft_obj_filter
*filter
= cb
->data
;
6728 struct net
*net
= sock_net(skb
->sk
);
6729 int family
= nfmsg
->nfgen_family
;
6730 struct nftables_pernet
*nft_net
;
6731 struct nft_object
*obj
;
6734 if (NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
6738 nft_net
= nft_pernet(net
);
6739 cb
->seq
= nft_net
->base_seq
;
6741 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
6742 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
6745 list_for_each_entry_rcu(obj
, &table
->objects
, list
) {
6746 if (!nft_is_active(net
, obj
))
6751 memset(&cb
->args
[1], 0,
6752 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
6753 if (filter
&& filter
->table
&&
6754 strcmp(filter
->table
, table
->name
))
6757 filter
->type
!= NFT_OBJECT_UNSPEC
&&
6758 obj
->ops
->type
->type
!= filter
->type
)
6761 char *buf
= kasprintf(GFP_ATOMIC
,
6766 audit_log_nfcfg(buf
,
6769 AUDIT_NFT_OP_OBJ_RESET
,
6774 if (nf_tables_fill_obj_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
6777 NLM_F_MULTI
| NLM_F_APPEND
,
6778 table
->family
, table
,
6782 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
6794 static int nf_tables_dump_obj_start(struct netlink_callback
*cb
)
6796 const struct nlattr
* const *nla
= cb
->data
;
6797 struct nft_obj_filter
*filter
= NULL
;
6799 if (nla
[NFTA_OBJ_TABLE
] || nla
[NFTA_OBJ_TYPE
]) {
6800 filter
= kzalloc(sizeof(*filter
), GFP_ATOMIC
);
6804 if (nla
[NFTA_OBJ_TABLE
]) {
6805 filter
->table
= nla_strdup(nla
[NFTA_OBJ_TABLE
], GFP_ATOMIC
);
6806 if (!filter
->table
) {
6812 if (nla
[NFTA_OBJ_TYPE
])
6813 filter
->type
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6820 static int nf_tables_dump_obj_done(struct netlink_callback
*cb
)
6822 struct nft_obj_filter
*filter
= cb
->data
;
6825 kfree(filter
->table
);
6832 /* called with rcu_read_lock held */
6833 static int nf_tables_getobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
6834 const struct nlattr
* const nla
[])
6836 struct netlink_ext_ack
*extack
= info
->extack
;
6837 u8 genmask
= nft_genmask_cur(info
->net
);
6838 u8 family
= info
->nfmsg
->nfgen_family
;
6839 const struct nft_table
*table
;
6840 struct net
*net
= info
->net
;
6841 struct nft_object
*obj
;
6842 struct sk_buff
*skb2
;
6847 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
6848 struct netlink_dump_control c
= {
6849 .start
= nf_tables_dump_obj_start
,
6850 .dump
= nf_tables_dump_obj
,
6851 .done
= nf_tables_dump_obj_done
,
6852 .module
= THIS_MODULE
,
6853 .data
= (void *)nla
,
6856 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
6859 if (!nla
[NFTA_OBJ_NAME
] ||
6860 !nla
[NFTA_OBJ_TYPE
])
6863 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
, 0);
6864 if (IS_ERR(table
)) {
6865 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6866 return PTR_ERR(table
);
6869 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6870 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
6872 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6873 return PTR_ERR(obj
);
6876 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
6880 if (NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
6884 const struct nftables_pernet
*nft_net
;
6887 nft_net
= nft_pernet(net
);
6888 buf
= kasprintf(GFP_ATOMIC
, "%s:%u", table
->name
, nft_net
->base_seq
);
6890 audit_log_nfcfg(buf
,
6893 AUDIT_NFT_OP_OBJ_RESET
,
6898 err
= nf_tables_fill_obj_info(skb2
, net
, NETLINK_CB(skb
).portid
,
6899 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWOBJ
, 0,
6900 family
, table
, obj
, reset
);
6902 goto err_fill_obj_info
;
6904 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
6911 static void nft_obj_destroy(const struct nft_ctx
*ctx
, struct nft_object
*obj
)
6913 if (obj
->ops
->destroy
)
6914 obj
->ops
->destroy(ctx
, obj
);
6916 module_put(obj
->ops
->type
->owner
);
6917 kfree(obj
->key
.name
);
6922 static int nf_tables_delobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
6923 const struct nlattr
* const nla
[])
6925 struct netlink_ext_ack
*extack
= info
->extack
;
6926 u8 genmask
= nft_genmask_next(info
->net
);
6927 u8 family
= info
->nfmsg
->nfgen_family
;
6928 struct net
*net
= info
->net
;
6929 const struct nlattr
*attr
;
6930 struct nft_table
*table
;
6931 struct nft_object
*obj
;
6935 if (!nla
[NFTA_OBJ_TYPE
] ||
6936 (!nla
[NFTA_OBJ_NAME
] && !nla
[NFTA_OBJ_HANDLE
]))
6939 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
6940 NETLINK_CB(skb
).portid
);
6941 if (IS_ERR(table
)) {
6942 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6943 return PTR_ERR(table
);
6946 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6947 if (nla
[NFTA_OBJ_HANDLE
]) {
6948 attr
= nla
[NFTA_OBJ_HANDLE
];
6949 obj
= nft_obj_lookup_byhandle(table
, attr
, objtype
, genmask
);
6951 attr
= nla
[NFTA_OBJ_NAME
];
6952 obj
= nft_obj_lookup(net
, table
, attr
, objtype
, genmask
);
6956 NL_SET_BAD_ATTR(extack
, attr
);
6957 return PTR_ERR(obj
);
6960 NL_SET_BAD_ATTR(extack
, attr
);
6964 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6966 return nft_delobj(&ctx
, obj
);
6969 void nft_obj_notify(struct net
*net
, const struct nft_table
*table
,
6970 struct nft_object
*obj
, u32 portid
, u32 seq
, int event
,
6971 u16 flags
, int family
, int report
, gfp_t gfp
)
6973 struct nftables_pernet
*nft_net
= nft_pernet(net
);
6974 struct sk_buff
*skb
;
6976 char *buf
= kasprintf(gfp
, "%s:%u",
6977 table
->name
, nft_net
->base_seq
);
6979 audit_log_nfcfg(buf
,
6982 event
== NFT_MSG_NEWOBJ
?
6983 AUDIT_NFT_OP_OBJ_REGISTER
:
6984 AUDIT_NFT_OP_OBJ_UNREGISTER
,
6989 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
6992 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp
);
6996 err
= nf_tables_fill_obj_info(skb
, net
, portid
, seq
, event
,
6997 flags
& (NLM_F_CREATE
| NLM_F_EXCL
),
6998 family
, table
, obj
, false);
7004 nft_notify_enqueue(skb
, report
, &nft_net
->notify_list
);
7007 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
7009 EXPORT_SYMBOL_GPL(nft_obj_notify
);
7011 static void nf_tables_obj_notify(const struct nft_ctx
*ctx
,
7012 struct nft_object
*obj
, int event
)
7014 nft_obj_notify(ctx
->net
, ctx
->table
, obj
, ctx
->portid
, ctx
->seq
, event
,
7015 ctx
->flags
, ctx
->family
, ctx
->report
, GFP_KERNEL
);
7021 void nft_register_flowtable_type(struct nf_flowtable_type
*type
)
7023 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7024 list_add_tail_rcu(&type
->list
, &nf_tables_flowtables
);
7025 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7027 EXPORT_SYMBOL_GPL(nft_register_flowtable_type
);
7029 void nft_unregister_flowtable_type(struct nf_flowtable_type
*type
)
7031 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7032 list_del_rcu(&type
->list
);
7033 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7035 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type
);
7037 static const struct nla_policy nft_flowtable_policy
[NFTA_FLOWTABLE_MAX
+ 1] = {
7038 [NFTA_FLOWTABLE_TABLE
] = { .type
= NLA_STRING
,
7039 .len
= NFT_NAME_MAXLEN
- 1 },
7040 [NFTA_FLOWTABLE_NAME
] = { .type
= NLA_STRING
,
7041 .len
= NFT_NAME_MAXLEN
- 1 },
7042 [NFTA_FLOWTABLE_HOOK
] = { .type
= NLA_NESTED
},
7043 [NFTA_FLOWTABLE_HANDLE
] = { .type
= NLA_U64
},
7044 [NFTA_FLOWTABLE_FLAGS
] = { .type
= NLA_U32
},
7047 struct nft_flowtable
*nft_flowtable_lookup(const struct nft_table
*table
,
7048 const struct nlattr
*nla
, u8 genmask
)
7050 struct nft_flowtable
*flowtable
;
7052 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
7053 if (!nla_strcmp(nla
, flowtable
->name
) &&
7054 nft_active_genmask(flowtable
, genmask
))
7057 return ERR_PTR(-ENOENT
);
7059 EXPORT_SYMBOL_GPL(nft_flowtable_lookup
);
7061 void nf_tables_deactivate_flowtable(const struct nft_ctx
*ctx
,
7062 struct nft_flowtable
*flowtable
,
7063 enum nft_trans_phase phase
)
7066 case NFT_TRANS_PREPARE
:
7067 case NFT_TRANS_ABORT
:
7068 case NFT_TRANS_RELEASE
:
7075 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable
);
7077 static struct nft_flowtable
*
7078 nft_flowtable_lookup_byhandle(const struct nft_table
*table
,
7079 const struct nlattr
*nla
, u8 genmask
)
7081 struct nft_flowtable
*flowtable
;
7083 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
7084 if (be64_to_cpu(nla_get_be64(nla
)) == flowtable
->handle
&&
7085 nft_active_genmask(flowtable
, genmask
))
7088 return ERR_PTR(-ENOENT
);
7091 struct nft_flowtable_hook
{
7094 struct list_head list
;
7097 static const struct nla_policy nft_flowtable_hook_policy
[NFTA_FLOWTABLE_HOOK_MAX
+ 1] = {
7098 [NFTA_FLOWTABLE_HOOK_NUM
] = { .type
= NLA_U32
},
7099 [NFTA_FLOWTABLE_HOOK_PRIORITY
] = { .type
= NLA_U32
},
7100 [NFTA_FLOWTABLE_HOOK_DEVS
] = { .type
= NLA_NESTED
},
7103 static int nft_flowtable_parse_hook(const struct nft_ctx
*ctx
,
7104 const struct nlattr
*attr
,
7105 struct nft_flowtable_hook
*flowtable_hook
,
7106 struct nft_flowtable
*flowtable
, bool add
)
7108 struct nlattr
*tb
[NFTA_FLOWTABLE_HOOK_MAX
+ 1];
7109 struct nft_hook
*hook
;
7110 int hooknum
, priority
;
7113 INIT_LIST_HEAD(&flowtable_hook
->list
);
7115 err
= nla_parse_nested_deprecated(tb
, NFTA_FLOWTABLE_HOOK_MAX
, attr
,
7116 nft_flowtable_hook_policy
, NULL
);
7121 if (!tb
[NFTA_FLOWTABLE_HOOK_NUM
] ||
7122 !tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
])
7125 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
7126 if (hooknum
!= NF_NETDEV_INGRESS
)
7129 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
7131 flowtable_hook
->priority
= priority
;
7132 flowtable_hook
->num
= hooknum
;
7134 if (tb
[NFTA_FLOWTABLE_HOOK_NUM
]) {
7135 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
7136 if (hooknum
!= flowtable
->hooknum
)
7140 if (tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]) {
7141 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
7142 if (priority
!= flowtable
->data
.priority
)
7146 flowtable_hook
->priority
= flowtable
->data
.priority
;
7147 flowtable_hook
->num
= flowtable
->hooknum
;
7150 if (tb
[NFTA_FLOWTABLE_HOOK_DEVS
]) {
7151 err
= nf_tables_parse_netdev_hooks(ctx
->net
,
7152 tb
[NFTA_FLOWTABLE_HOOK_DEVS
],
7153 &flowtable_hook
->list
);
7158 list_for_each_entry(hook
, &flowtable_hook
->list
, list
) {
7159 hook
->ops
.pf
= NFPROTO_NETDEV
;
7160 hook
->ops
.hooknum
= flowtable_hook
->num
;
7161 hook
->ops
.priority
= flowtable_hook
->priority
;
7162 hook
->ops
.priv
= &flowtable
->data
;
7163 hook
->ops
.hook
= flowtable
->data
.type
->hook
;
7169 static const struct nf_flowtable_type
*__nft_flowtable_type_get(u8 family
)
7171 const struct nf_flowtable_type
*type
;
7173 list_for_each_entry(type
, &nf_tables_flowtables
, list
) {
7174 if (family
== type
->family
)
7180 static const struct nf_flowtable_type
*
7181 nft_flowtable_type_get(struct net
*net
, u8 family
)
7183 const struct nf_flowtable_type
*type
;
7185 type
= __nft_flowtable_type_get(family
);
7186 if (type
!= NULL
&& try_module_get(type
->owner
))
7189 lockdep_nfnl_nft_mutex_not_held();
7190 #ifdef CONFIG_MODULES
7192 if (nft_request_module(net
, "nf-flowtable-%u", family
) == -EAGAIN
)
7193 return ERR_PTR(-EAGAIN
);
7196 return ERR_PTR(-ENOENT
);
7199 /* Only called from error and netdev event paths. */
7200 static void nft_unregister_flowtable_hook(struct net
*net
,
7201 struct nft_flowtable
*flowtable
,
7202 struct nft_hook
*hook
)
7204 nf_unregister_net_hook(net
, &hook
->ops
);
7205 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
7209 static void nft_unregister_flowtable_net_hooks(struct net
*net
,
7210 struct list_head
*hook_list
)
7212 struct nft_hook
*hook
;
7214 list_for_each_entry(hook
, hook_list
, list
)
7215 nf_unregister_net_hook(net
, &hook
->ops
);
7218 static int nft_register_flowtable_net_hooks(struct net
*net
,
7219 struct nft_table
*table
,
7220 struct list_head
*hook_list
,
7221 struct nft_flowtable
*flowtable
)
7223 struct nft_hook
*hook
, *hook2
, *next
;
7224 struct nft_flowtable
*ft
;
7227 list_for_each_entry(hook
, hook_list
, list
) {
7228 list_for_each_entry(ft
, &table
->flowtables
, list
) {
7229 if (!nft_is_active_next(net
, ft
))
7232 list_for_each_entry(hook2
, &ft
->hook_list
, list
) {
7233 if (hook
->ops
.dev
== hook2
->ops
.dev
&&
7234 hook
->ops
.pf
== hook2
->ops
.pf
) {
7236 goto err_unregister_net_hooks
;
7241 err
= flowtable
->data
.type
->setup(&flowtable
->data
,
7245 goto err_unregister_net_hooks
;
7247 err
= nf_register_net_hook(net
, &hook
->ops
);
7249 flowtable
->data
.type
->setup(&flowtable
->data
,
7252 goto err_unregister_net_hooks
;
7260 err_unregister_net_hooks
:
7261 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
7265 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
7266 list_del_rcu(&hook
->list
);
7267 kfree_rcu(hook
, rcu
);
7273 static void nft_flowtable_hooks_destroy(struct list_head
*hook_list
)
7275 struct nft_hook
*hook
, *next
;
7277 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
7278 list_del_rcu(&hook
->list
);
7279 kfree_rcu(hook
, rcu
);
7283 static int nft_flowtable_update(struct nft_ctx
*ctx
, const struct nlmsghdr
*nlh
,
7284 struct nft_flowtable
*flowtable
)
7286 const struct nlattr
* const *nla
= ctx
->nla
;
7287 struct nft_flowtable_hook flowtable_hook
;
7288 struct nft_hook
*hook
, *next
;
7289 struct nft_trans
*trans
;
7290 bool unregister
= false;
7294 err
= nft_flowtable_parse_hook(ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
7295 &flowtable_hook
, flowtable
, false);
7299 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
7300 if (nft_hook_list_find(&flowtable
->hook_list
, hook
)) {
7301 list_del(&hook
->list
);
7306 if (nla
[NFTA_FLOWTABLE_FLAGS
]) {
7307 flags
= ntohl(nla_get_be32(nla
[NFTA_FLOWTABLE_FLAGS
]));
7308 if (flags
& ~NFT_FLOWTABLE_MASK
)
7310 if ((flowtable
->data
.flags
& NFT_FLOWTABLE_HW_OFFLOAD
) ^
7311 (flags
& NFT_FLOWTABLE_HW_OFFLOAD
))
7314 flags
= flowtable
->data
.flags
;
7317 err
= nft_register_flowtable_net_hooks(ctx
->net
, ctx
->table
,
7318 &flowtable_hook
.list
, flowtable
);
7320 goto err_flowtable_update_hook
;
7322 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWFLOWTABLE
,
7323 sizeof(struct nft_trans_flowtable
));
7327 goto err_flowtable_update_hook
;
7330 nft_trans_flowtable_flags(trans
) = flags
;
7331 nft_trans_flowtable(trans
) = flowtable
;
7332 nft_trans_flowtable_update(trans
) = true;
7333 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
7334 list_splice(&flowtable_hook
.list
, &nft_trans_flowtable_hooks(trans
));
7336 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7340 err_flowtable_update_hook
:
7341 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
7343 nft_unregister_flowtable_hook(ctx
->net
, flowtable
, hook
);
7344 list_del_rcu(&hook
->list
);
7345 kfree_rcu(hook
, rcu
);
7352 static int nf_tables_newflowtable(struct sk_buff
*skb
,
7353 const struct nfnl_info
*info
,
7354 const struct nlattr
* const nla
[])
7356 struct netlink_ext_ack
*extack
= info
->extack
;
7357 struct nft_flowtable_hook flowtable_hook
;
7358 u8 genmask
= nft_genmask_next(info
->net
);
7359 u8 family
= info
->nfmsg
->nfgen_family
;
7360 const struct nf_flowtable_type
*type
;
7361 struct nft_flowtable
*flowtable
;
7362 struct nft_hook
*hook
, *next
;
7363 struct net
*net
= info
->net
;
7364 struct nft_table
*table
;
7368 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
7369 !nla
[NFTA_FLOWTABLE_NAME
] ||
7370 !nla
[NFTA_FLOWTABLE_HOOK
])
7373 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7374 genmask
, NETLINK_CB(skb
).portid
);
7375 if (IS_ERR(table
)) {
7376 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
7377 return PTR_ERR(table
);
7380 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
7382 if (IS_ERR(flowtable
)) {
7383 err
= PTR_ERR(flowtable
);
7384 if (err
!= -ENOENT
) {
7385 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
7389 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
7390 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
7394 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7396 return nft_flowtable_update(&ctx
, info
->nlh
, flowtable
);
7399 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7401 flowtable
= kzalloc(sizeof(*flowtable
), GFP_KERNEL
);
7405 flowtable
->table
= table
;
7406 flowtable
->handle
= nf_tables_alloc_handle(table
);
7407 INIT_LIST_HEAD(&flowtable
->hook_list
);
7409 flowtable
->name
= nla_strdup(nla
[NFTA_FLOWTABLE_NAME
], GFP_KERNEL
);
7410 if (!flowtable
->name
) {
7415 type
= nft_flowtable_type_get(net
, family
);
7417 err
= PTR_ERR(type
);
7421 if (nla
[NFTA_FLOWTABLE_FLAGS
]) {
7422 flowtable
->data
.flags
=
7423 ntohl(nla_get_be32(nla
[NFTA_FLOWTABLE_FLAGS
]));
7424 if (flowtable
->data
.flags
& ~NFT_FLOWTABLE_MASK
) {
7430 write_pnet(&flowtable
->data
.net
, net
);
7431 flowtable
->data
.type
= type
;
7432 err
= type
->init(&flowtable
->data
);
7436 err
= nft_flowtable_parse_hook(&ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
7437 &flowtable_hook
, flowtable
, true);
7441 list_splice(&flowtable_hook
.list
, &flowtable
->hook_list
);
7442 flowtable
->data
.priority
= flowtable_hook
.priority
;
7443 flowtable
->hooknum
= flowtable_hook
.num
;
7445 err
= nft_register_flowtable_net_hooks(ctx
.net
, table
,
7446 &flowtable
->hook_list
,
7449 nft_flowtable_hooks_destroy(&flowtable
->hook_list
);
7453 err
= nft_trans_flowtable_add(&ctx
, NFT_MSG_NEWFLOWTABLE
, flowtable
);
7457 list_add_tail_rcu(&flowtable
->list
, &table
->flowtables
);
7462 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
7463 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
7464 list_del_rcu(&hook
->list
);
7465 kfree_rcu(hook
, rcu
);
7468 flowtable
->data
.type
->free(&flowtable
->data
);
7470 module_put(type
->owner
);
7472 kfree(flowtable
->name
);
7478 static void nft_flowtable_hook_release(struct nft_flowtable_hook
*flowtable_hook
)
7480 struct nft_hook
*this, *next
;
7482 list_for_each_entry_safe(this, next
, &flowtable_hook
->list
, list
) {
7483 list_del(&this->list
);
7488 static int nft_delflowtable_hook(struct nft_ctx
*ctx
,
7489 struct nft_flowtable
*flowtable
)
7491 const struct nlattr
* const *nla
= ctx
->nla
;
7492 struct nft_flowtable_hook flowtable_hook
;
7493 struct nft_hook
*this, *hook
;
7494 struct nft_trans
*trans
;
7497 err
= nft_flowtable_parse_hook(ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
7498 &flowtable_hook
, flowtable
, false);
7502 list_for_each_entry(this, &flowtable_hook
.list
, list
) {
7503 hook
= nft_hook_list_find(&flowtable
->hook_list
, this);
7506 goto err_flowtable_del_hook
;
7508 hook
->inactive
= true;
7511 trans
= nft_trans_alloc(ctx
, NFT_MSG_DELFLOWTABLE
,
7512 sizeof(struct nft_trans_flowtable
));
7515 goto err_flowtable_del_hook
;
7518 nft_trans_flowtable(trans
) = flowtable
;
7519 nft_trans_flowtable_update(trans
) = true;
7520 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
7521 nft_flowtable_hook_release(&flowtable_hook
);
7523 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7527 err_flowtable_del_hook
:
7528 list_for_each_entry(this, &flowtable_hook
.list
, list
) {
7529 hook
= nft_hook_list_find(&flowtable
->hook_list
, this);
7533 hook
->inactive
= false;
7535 nft_flowtable_hook_release(&flowtable_hook
);
7540 static int nf_tables_delflowtable(struct sk_buff
*skb
,
7541 const struct nfnl_info
*info
,
7542 const struct nlattr
* const nla
[])
7544 struct netlink_ext_ack
*extack
= info
->extack
;
7545 u8 genmask
= nft_genmask_next(info
->net
);
7546 u8 family
= info
->nfmsg
->nfgen_family
;
7547 struct nft_flowtable
*flowtable
;
7548 struct net
*net
= info
->net
;
7549 const struct nlattr
*attr
;
7550 struct nft_table
*table
;
7553 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
7554 (!nla
[NFTA_FLOWTABLE_NAME
] &&
7555 !nla
[NFTA_FLOWTABLE_HANDLE
]))
7558 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7559 genmask
, NETLINK_CB(skb
).portid
);
7560 if (IS_ERR(table
)) {
7561 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
7562 return PTR_ERR(table
);
7565 if (nla
[NFTA_FLOWTABLE_HANDLE
]) {
7566 attr
= nla
[NFTA_FLOWTABLE_HANDLE
];
7567 flowtable
= nft_flowtable_lookup_byhandle(table
, attr
, genmask
);
7569 attr
= nla
[NFTA_FLOWTABLE_NAME
];
7570 flowtable
= nft_flowtable_lookup(table
, attr
, genmask
);
7573 if (IS_ERR(flowtable
)) {
7574 NL_SET_BAD_ATTR(extack
, attr
);
7575 return PTR_ERR(flowtable
);
7578 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7580 if (nla
[NFTA_FLOWTABLE_HOOK
])
7581 return nft_delflowtable_hook(&ctx
, flowtable
);
7583 if (flowtable
->use
> 0) {
7584 NL_SET_BAD_ATTR(extack
, attr
);
7588 return nft_delflowtable(&ctx
, flowtable
);
7591 static int nf_tables_fill_flowtable_info(struct sk_buff
*skb
, struct net
*net
,
7592 u32 portid
, u32 seq
, int event
,
7593 u32 flags
, int family
,
7594 struct nft_flowtable
*flowtable
,
7595 struct list_head
*hook_list
)
7597 struct nlattr
*nest
, *nest_devs
;
7598 struct nft_hook
*hook
;
7599 struct nlmsghdr
*nlh
;
7601 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
7602 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
7603 NFNETLINK_V0
, nft_base_seq(net
));
7605 goto nla_put_failure
;
7607 if (nla_put_string(skb
, NFTA_FLOWTABLE_TABLE
, flowtable
->table
->name
) ||
7608 nla_put_string(skb
, NFTA_FLOWTABLE_NAME
, flowtable
->name
) ||
7609 nla_put_be32(skb
, NFTA_FLOWTABLE_USE
, htonl(flowtable
->use
)) ||
7610 nla_put_be64(skb
, NFTA_FLOWTABLE_HANDLE
, cpu_to_be64(flowtable
->handle
),
7611 NFTA_FLOWTABLE_PAD
) ||
7612 nla_put_be32(skb
, NFTA_FLOWTABLE_FLAGS
, htonl(flowtable
->data
.flags
)))
7613 goto nla_put_failure
;
7615 nest
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK
);
7617 goto nla_put_failure
;
7618 if (nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_NUM
, htonl(flowtable
->hooknum
)) ||
7619 nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_PRIORITY
, htonl(flowtable
->data
.priority
)))
7620 goto nla_put_failure
;
7622 nest_devs
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK_DEVS
);
7624 goto nla_put_failure
;
7626 list_for_each_entry_rcu(hook
, hook_list
, list
) {
7627 if (nla_put_string(skb
, NFTA_DEVICE_NAME
, hook
->ops
.dev
->name
))
7628 goto nla_put_failure
;
7630 nla_nest_end(skb
, nest_devs
);
7631 nla_nest_end(skb
, nest
);
7633 nlmsg_end(skb
, nlh
);
7637 nlmsg_trim(skb
, nlh
);
7641 struct nft_flowtable_filter
{
7645 static int nf_tables_dump_flowtable(struct sk_buff
*skb
,
7646 struct netlink_callback
*cb
)
7648 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
7649 struct nft_flowtable_filter
*filter
= cb
->data
;
7650 unsigned int idx
= 0, s_idx
= cb
->args
[0];
7651 struct net
*net
= sock_net(skb
->sk
);
7652 int family
= nfmsg
->nfgen_family
;
7653 struct nft_flowtable
*flowtable
;
7654 struct nftables_pernet
*nft_net
;
7655 const struct nft_table
*table
;
7658 nft_net
= nft_pernet(net
);
7659 cb
->seq
= nft_net
->base_seq
;
7661 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
7662 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
7665 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
7666 if (!nft_is_active(net
, flowtable
))
7671 memset(&cb
->args
[1], 0,
7672 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
7673 if (filter
&& filter
->table
&&
7674 strcmp(filter
->table
, table
->name
))
7677 if (nf_tables_fill_flowtable_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
7679 NFT_MSG_NEWFLOWTABLE
,
7680 NLM_F_MULTI
| NLM_F_APPEND
,
7683 &flowtable
->hook_list
) < 0)
7686 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
7698 static int nf_tables_dump_flowtable_start(struct netlink_callback
*cb
)
7700 const struct nlattr
* const *nla
= cb
->data
;
7701 struct nft_flowtable_filter
*filter
= NULL
;
7703 if (nla
[NFTA_FLOWTABLE_TABLE
]) {
7704 filter
= kzalloc(sizeof(*filter
), GFP_ATOMIC
);
7708 filter
->table
= nla_strdup(nla
[NFTA_FLOWTABLE_TABLE
],
7710 if (!filter
->table
) {
7720 static int nf_tables_dump_flowtable_done(struct netlink_callback
*cb
)
7722 struct nft_flowtable_filter
*filter
= cb
->data
;
7727 kfree(filter
->table
);
7733 /* called with rcu_read_lock held */
7734 static int nf_tables_getflowtable(struct sk_buff
*skb
,
7735 const struct nfnl_info
*info
,
7736 const struct nlattr
* const nla
[])
7738 u8 genmask
= nft_genmask_cur(info
->net
);
7739 u8 family
= info
->nfmsg
->nfgen_family
;
7740 struct nft_flowtable
*flowtable
;
7741 const struct nft_table
*table
;
7742 struct net
*net
= info
->net
;
7743 struct sk_buff
*skb2
;
7746 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
7747 struct netlink_dump_control c
= {
7748 .start
= nf_tables_dump_flowtable_start
,
7749 .dump
= nf_tables_dump_flowtable
,
7750 .done
= nf_tables_dump_flowtable_done
,
7751 .module
= THIS_MODULE
,
7752 .data
= (void *)nla
,
7755 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
7758 if (!nla
[NFTA_FLOWTABLE_NAME
])
7761 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7764 return PTR_ERR(table
);
7766 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
7768 if (IS_ERR(flowtable
))
7769 return PTR_ERR(flowtable
);
7771 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
7775 err
= nf_tables_fill_flowtable_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7776 info
->nlh
->nlmsg_seq
,
7777 NFT_MSG_NEWFLOWTABLE
, 0, family
,
7778 flowtable
, &flowtable
->hook_list
);
7780 goto err_fill_flowtable_info
;
7782 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
7784 err_fill_flowtable_info
:
7789 static void nf_tables_flowtable_notify(struct nft_ctx
*ctx
,
7790 struct nft_flowtable
*flowtable
,
7791 struct list_head
*hook_list
,
7794 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
7795 struct sk_buff
*skb
;
7800 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
7803 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
7807 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
7808 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
7810 err
= nf_tables_fill_flowtable_info(skb
, ctx
->net
, ctx
->portid
,
7811 ctx
->seq
, event
, flags
,
7812 ctx
->family
, flowtable
, hook_list
);
7818 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
7821 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
7824 static void nf_tables_flowtable_destroy(struct nft_flowtable
*flowtable
)
7826 struct nft_hook
*hook
, *next
;
7828 flowtable
->data
.type
->free(&flowtable
->data
);
7829 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
7830 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
7832 list_del_rcu(&hook
->list
);
7835 kfree(flowtable
->name
);
7836 module_put(flowtable
->data
.type
->owner
);
7840 static int nf_tables_fill_gen_info(struct sk_buff
*skb
, struct net
*net
,
7841 u32 portid
, u32 seq
)
7843 struct nftables_pernet
*nft_net
= nft_pernet(net
);
7844 struct nlmsghdr
*nlh
;
7845 char buf
[TASK_COMM_LEN
];
7846 int event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWGEN
);
7848 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, 0, AF_UNSPEC
,
7849 NFNETLINK_V0
, nft_base_seq(net
));
7851 goto nla_put_failure
;
7853 if (nla_put_be32(skb
, NFTA_GEN_ID
, htonl(nft_net
->base_seq
)) ||
7854 nla_put_be32(skb
, NFTA_GEN_PROC_PID
, htonl(task_pid_nr(current
))) ||
7855 nla_put_string(skb
, NFTA_GEN_PROC_NAME
, get_task_comm(buf
, current
)))
7856 goto nla_put_failure
;
7858 nlmsg_end(skb
, nlh
);
7862 nlmsg_trim(skb
, nlh
);
7866 static void nft_flowtable_event(unsigned long event
, struct net_device
*dev
,
7867 struct nft_flowtable
*flowtable
)
7869 struct nft_hook
*hook
;
7871 list_for_each_entry(hook
, &flowtable
->hook_list
, list
) {
7872 if (hook
->ops
.dev
!= dev
)
7875 /* flow_offload_netdev_event() cleans up entries for us. */
7876 nft_unregister_flowtable_hook(dev_net(dev
), flowtable
, hook
);
7877 list_del_rcu(&hook
->list
);
7878 kfree_rcu(hook
, rcu
);
7883 static int nf_tables_flowtable_event(struct notifier_block
*this,
7884 unsigned long event
, void *ptr
)
7886 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
7887 struct nft_flowtable
*flowtable
;
7888 struct nftables_pernet
*nft_net
;
7889 struct nft_table
*table
;
7892 if (event
!= NETDEV_UNREGISTER
)
7896 nft_net
= nft_pernet(net
);
7897 mutex_lock(&nft_net
->commit_mutex
);
7898 list_for_each_entry(table
, &nft_net
->tables
, list
) {
7899 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
7900 nft_flowtable_event(event
, dev
, flowtable
);
7903 mutex_unlock(&nft_net
->commit_mutex
);
7908 static struct notifier_block nf_tables_flowtable_notifier
= {
7909 .notifier_call
= nf_tables_flowtable_event
,
7912 static void nf_tables_gen_notify(struct net
*net
, struct sk_buff
*skb
,
7915 struct nlmsghdr
*nlh
= nlmsg_hdr(skb
);
7916 struct sk_buff
*skb2
;
7919 if (!nlmsg_report(nlh
) &&
7920 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
7923 skb2
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
7927 err
= nf_tables_fill_gen_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7934 nfnetlink_send(skb2
, net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
7935 nlmsg_report(nlh
), GFP_KERNEL
);
7938 nfnetlink_set_err(net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
7942 static int nf_tables_getgen(struct sk_buff
*skb
, const struct nfnl_info
*info
,
7943 const struct nlattr
* const nla
[])
7945 struct sk_buff
*skb2
;
7948 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
7952 err
= nf_tables_fill_gen_info(skb2
, info
->net
, NETLINK_CB(skb
).portid
,
7953 info
->nlh
->nlmsg_seq
);
7955 goto err_fill_gen_info
;
7957 return nfnetlink_unicast(skb2
, info
->net
, NETLINK_CB(skb
).portid
);
7964 static const struct nfnl_callback nf_tables_cb
[NFT_MSG_MAX
] = {
7965 [NFT_MSG_NEWTABLE
] = {
7966 .call
= nf_tables_newtable
,
7967 .type
= NFNL_CB_BATCH
,
7968 .attr_count
= NFTA_TABLE_MAX
,
7969 .policy
= nft_table_policy
,
7971 [NFT_MSG_GETTABLE
] = {
7972 .call
= nf_tables_gettable
,
7973 .type
= NFNL_CB_RCU
,
7974 .attr_count
= NFTA_TABLE_MAX
,
7975 .policy
= nft_table_policy
,
7977 [NFT_MSG_DELTABLE
] = {
7978 .call
= nf_tables_deltable
,
7979 .type
= NFNL_CB_BATCH
,
7980 .attr_count
= NFTA_TABLE_MAX
,
7981 .policy
= nft_table_policy
,
7983 [NFT_MSG_NEWCHAIN
] = {
7984 .call
= nf_tables_newchain
,
7985 .type
= NFNL_CB_BATCH
,
7986 .attr_count
= NFTA_CHAIN_MAX
,
7987 .policy
= nft_chain_policy
,
7989 [NFT_MSG_GETCHAIN
] = {
7990 .call
= nf_tables_getchain
,
7991 .type
= NFNL_CB_RCU
,
7992 .attr_count
= NFTA_CHAIN_MAX
,
7993 .policy
= nft_chain_policy
,
7995 [NFT_MSG_DELCHAIN
] = {
7996 .call
= nf_tables_delchain
,
7997 .type
= NFNL_CB_BATCH
,
7998 .attr_count
= NFTA_CHAIN_MAX
,
7999 .policy
= nft_chain_policy
,
8001 [NFT_MSG_NEWRULE
] = {
8002 .call
= nf_tables_newrule
,
8003 .type
= NFNL_CB_BATCH
,
8004 .attr_count
= NFTA_RULE_MAX
,
8005 .policy
= nft_rule_policy
,
8007 [NFT_MSG_GETRULE
] = {
8008 .call
= nf_tables_getrule
,
8009 .type
= NFNL_CB_RCU
,
8010 .attr_count
= NFTA_RULE_MAX
,
8011 .policy
= nft_rule_policy
,
8013 [NFT_MSG_DELRULE
] = {
8014 .call
= nf_tables_delrule
,
8015 .type
= NFNL_CB_BATCH
,
8016 .attr_count
= NFTA_RULE_MAX
,
8017 .policy
= nft_rule_policy
,
8019 [NFT_MSG_NEWSET
] = {
8020 .call
= nf_tables_newset
,
8021 .type
= NFNL_CB_BATCH
,
8022 .attr_count
= NFTA_SET_MAX
,
8023 .policy
= nft_set_policy
,
8025 [NFT_MSG_GETSET
] = {
8026 .call
= nf_tables_getset
,
8027 .type
= NFNL_CB_RCU
,
8028 .attr_count
= NFTA_SET_MAX
,
8029 .policy
= nft_set_policy
,
8031 [NFT_MSG_DELSET
] = {
8032 .call
= nf_tables_delset
,
8033 .type
= NFNL_CB_BATCH
,
8034 .attr_count
= NFTA_SET_MAX
,
8035 .policy
= nft_set_policy
,
8037 [NFT_MSG_NEWSETELEM
] = {
8038 .call
= nf_tables_newsetelem
,
8039 .type
= NFNL_CB_BATCH
,
8040 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
8041 .policy
= nft_set_elem_list_policy
,
8043 [NFT_MSG_GETSETELEM
] = {
8044 .call
= nf_tables_getsetelem
,
8045 .type
= NFNL_CB_RCU
,
8046 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
8047 .policy
= nft_set_elem_list_policy
,
8049 [NFT_MSG_DELSETELEM
] = {
8050 .call
= nf_tables_delsetelem
,
8051 .type
= NFNL_CB_BATCH
,
8052 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
8053 .policy
= nft_set_elem_list_policy
,
8055 [NFT_MSG_GETGEN
] = {
8056 .call
= nf_tables_getgen
,
8057 .type
= NFNL_CB_RCU
,
8059 [NFT_MSG_NEWOBJ
] = {
8060 .call
= nf_tables_newobj
,
8061 .type
= NFNL_CB_BATCH
,
8062 .attr_count
= NFTA_OBJ_MAX
,
8063 .policy
= nft_obj_policy
,
8065 [NFT_MSG_GETOBJ
] = {
8066 .call
= nf_tables_getobj
,
8067 .type
= NFNL_CB_RCU
,
8068 .attr_count
= NFTA_OBJ_MAX
,
8069 .policy
= nft_obj_policy
,
8071 [NFT_MSG_DELOBJ
] = {
8072 .call
= nf_tables_delobj
,
8073 .type
= NFNL_CB_BATCH
,
8074 .attr_count
= NFTA_OBJ_MAX
,
8075 .policy
= nft_obj_policy
,
8077 [NFT_MSG_GETOBJ_RESET
] = {
8078 .call
= nf_tables_getobj
,
8079 .type
= NFNL_CB_RCU
,
8080 .attr_count
= NFTA_OBJ_MAX
,
8081 .policy
= nft_obj_policy
,
8083 [NFT_MSG_NEWFLOWTABLE
] = {
8084 .call
= nf_tables_newflowtable
,
8085 .type
= NFNL_CB_BATCH
,
8086 .attr_count
= NFTA_FLOWTABLE_MAX
,
8087 .policy
= nft_flowtable_policy
,
8089 [NFT_MSG_GETFLOWTABLE
] = {
8090 .call
= nf_tables_getflowtable
,
8091 .type
= NFNL_CB_RCU
,
8092 .attr_count
= NFTA_FLOWTABLE_MAX
,
8093 .policy
= nft_flowtable_policy
,
8095 [NFT_MSG_DELFLOWTABLE
] = {
8096 .call
= nf_tables_delflowtable
,
8097 .type
= NFNL_CB_BATCH
,
8098 .attr_count
= NFTA_FLOWTABLE_MAX
,
8099 .policy
= nft_flowtable_policy
,
8103 static int nf_tables_validate(struct net
*net
)
8105 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8106 struct nft_table
*table
;
8108 switch (nft_net
->validate_state
) {
8109 case NFT_VALIDATE_SKIP
:
8111 case NFT_VALIDATE_NEED
:
8112 nft_validate_state_update(net
, NFT_VALIDATE_DO
);
8114 case NFT_VALIDATE_DO
:
8115 list_for_each_entry(table
, &nft_net
->tables
, list
) {
8116 if (nft_table_validate(net
, table
) < 0)
8125 /* a drop policy has to be deferred until all rules have been activated,
8126 * otherwise a large ruleset that contains a drop-policy base chain will
8127 * cause all packets to get dropped until the full transaction has been
8130 * We defer the drop policy until the transaction has been finalized.
8132 static void nft_chain_commit_drop_policy(struct nft_trans
*trans
)
8134 struct nft_base_chain
*basechain
;
8136 if (nft_trans_chain_policy(trans
) != NF_DROP
)
8139 if (!nft_is_base_chain(trans
->ctx
.chain
))
8142 basechain
= nft_base_chain(trans
->ctx
.chain
);
8143 basechain
->policy
= NF_DROP
;
8146 static void nft_chain_commit_update(struct nft_trans
*trans
)
8148 struct nft_base_chain
*basechain
;
8150 if (nft_trans_chain_name(trans
)) {
8151 rhltable_remove(&trans
->ctx
.table
->chains_ht
,
8152 &trans
->ctx
.chain
->rhlhead
,
8153 nft_chain_ht_params
);
8154 swap(trans
->ctx
.chain
->name
, nft_trans_chain_name(trans
));
8155 rhltable_insert_key(&trans
->ctx
.table
->chains_ht
,
8156 trans
->ctx
.chain
->name
,
8157 &trans
->ctx
.chain
->rhlhead
,
8158 nft_chain_ht_params
);
8161 if (!nft_is_base_chain(trans
->ctx
.chain
))
8164 nft_chain_stats_replace(trans
);
8166 basechain
= nft_base_chain(trans
->ctx
.chain
);
8168 switch (nft_trans_chain_policy(trans
)) {
8171 basechain
->policy
= nft_trans_chain_policy(trans
);
8176 static void nft_obj_commit_update(struct nft_trans
*trans
)
8178 struct nft_object
*newobj
;
8179 struct nft_object
*obj
;
8181 obj
= nft_trans_obj(trans
);
8182 newobj
= nft_trans_obj_newobj(trans
);
8184 if (obj
->ops
->update
)
8185 obj
->ops
->update(obj
, newobj
);
8187 nft_obj_destroy(&trans
->ctx
, newobj
);
8190 static void nft_commit_release(struct nft_trans
*trans
)
8192 switch (trans
->msg_type
) {
8193 case NFT_MSG_DELTABLE
:
8194 nf_tables_table_destroy(&trans
->ctx
);
8196 case NFT_MSG_NEWCHAIN
:
8197 free_percpu(nft_trans_chain_stats(trans
));
8198 kfree(nft_trans_chain_name(trans
));
8200 case NFT_MSG_DELCHAIN
:
8201 nf_tables_chain_destroy(&trans
->ctx
);
8203 case NFT_MSG_DELRULE
:
8204 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
8206 case NFT_MSG_DELSET
:
8207 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
8209 case NFT_MSG_DELSETELEM
:
8210 nf_tables_set_elem_destroy(&trans
->ctx
,
8211 nft_trans_elem_set(trans
),
8212 nft_trans_elem(trans
).priv
);
8214 case NFT_MSG_DELOBJ
:
8215 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
8217 case NFT_MSG_DELFLOWTABLE
:
8218 if (nft_trans_flowtable_update(trans
))
8219 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
8221 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
8226 put_net(trans
->ctx
.net
);
8231 static void nf_tables_trans_destroy_work(struct work_struct
*w
)
8233 struct nft_trans
*trans
, *next
;
8236 spin_lock(&nf_tables_destroy_list_lock
);
8237 list_splice_init(&nf_tables_destroy_list
, &head
);
8238 spin_unlock(&nf_tables_destroy_list_lock
);
8240 if (list_empty(&head
))
8245 list_for_each_entry_safe(trans
, next
, &head
, list
) {
8246 list_del(&trans
->list
);
8247 nft_commit_release(trans
);
8251 void nf_tables_trans_destroy_flush_work(void)
8253 flush_work(&trans_destroy_work
);
8255 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work
);
8257 static int nf_tables_commit_chain_prepare(struct net
*net
, struct nft_chain
*chain
)
8259 struct nft_rule
*rule
;
8260 unsigned int alloc
= 0;
8263 /* already handled or inactive chain? */
8264 if (chain
->rules_next
|| !nft_is_active_next(net
, chain
))
8267 rule
= list_entry(&chain
->rules
, struct nft_rule
, list
);
8270 list_for_each_entry_continue(rule
, &chain
->rules
, list
) {
8271 if (nft_is_active_next(net
, rule
))
8275 chain
->rules_next
= nf_tables_chain_alloc_rules(chain
, alloc
);
8276 if (!chain
->rules_next
)
8279 list_for_each_entry_continue(rule
, &chain
->rules
, list
) {
8280 if (nft_is_active_next(net
, rule
))
8281 chain
->rules_next
[i
++] = rule
;
8284 chain
->rules_next
[i
] = NULL
;
8288 static void nf_tables_commit_chain_prepare_cancel(struct net
*net
)
8290 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8291 struct nft_trans
*trans
, *next
;
8293 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
8294 struct nft_chain
*chain
= trans
->ctx
.chain
;
8296 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
8297 trans
->msg_type
== NFT_MSG_DELRULE
) {
8298 kvfree(chain
->rules_next
);
8299 chain
->rules_next
= NULL
;
8304 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head
*h
)
8306 struct nft_rules_old
*o
= container_of(h
, struct nft_rules_old
, h
);
8311 static void nf_tables_commit_chain_free_rules_old(struct nft_rule
**rules
)
8313 struct nft_rule
**r
= rules
;
8314 struct nft_rules_old
*old
;
8319 r
++; /* rcu_head is after end marker */
8323 call_rcu(&old
->h
, __nf_tables_commit_chain_free_rules_old
);
8326 static void nf_tables_commit_chain(struct net
*net
, struct nft_chain
*chain
)
8328 struct nft_rule
**g0
, **g1
;
8331 next_genbit
= nft_gencursor_next(net
);
8333 g0
= rcu_dereference_protected(chain
->rules_gen_0
,
8334 lockdep_commit_lock_is_held(net
));
8335 g1
= rcu_dereference_protected(chain
->rules_gen_1
,
8336 lockdep_commit_lock_is_held(net
));
8338 /* No changes to this chain? */
8339 if (chain
->rules_next
== NULL
) {
8340 /* chain had no change in last or next generation */
8344 * chain had no change in this generation; make sure next
8345 * one uses same rules as current generation.
8348 rcu_assign_pointer(chain
->rules_gen_1
, g0
);
8349 nf_tables_commit_chain_free_rules_old(g1
);
8351 rcu_assign_pointer(chain
->rules_gen_0
, g1
);
8352 nf_tables_commit_chain_free_rules_old(g0
);
8359 rcu_assign_pointer(chain
->rules_gen_1
, chain
->rules_next
);
8361 rcu_assign_pointer(chain
->rules_gen_0
, chain
->rules_next
);
8363 chain
->rules_next
= NULL
;
8369 nf_tables_commit_chain_free_rules_old(g1
);
8371 nf_tables_commit_chain_free_rules_old(g0
);
8374 static void nft_obj_del(struct nft_object
*obj
)
8376 rhltable_remove(&nft_objname_ht
, &obj
->rhlhead
, nft_objname_ht_params
);
8377 list_del_rcu(&obj
->list
);
8380 void nft_chain_del(struct nft_chain
*chain
)
8382 struct nft_table
*table
= chain
->table
;
8384 WARN_ON_ONCE(rhltable_remove(&table
->chains_ht
, &chain
->rhlhead
,
8385 nft_chain_ht_params
));
8386 list_del_rcu(&chain
->list
);
8389 static void nft_flowtable_hooks_del(struct nft_flowtable
*flowtable
,
8390 struct list_head
*hook_list
)
8392 struct nft_hook
*hook
, *next
;
8394 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
8396 list_move(&hook
->list
, hook_list
);
8400 static void nf_tables_module_autoload_cleanup(struct net
*net
)
8402 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8403 struct nft_module_request
*req
, *next
;
8405 WARN_ON_ONCE(!list_empty(&nft_net
->commit_list
));
8406 list_for_each_entry_safe(req
, next
, &nft_net
->module_list
, list
) {
8407 WARN_ON_ONCE(!req
->done
);
8408 list_del(&req
->list
);
8413 static void nf_tables_commit_release(struct net
*net
)
8415 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8416 struct nft_trans
*trans
;
8418 /* all side effects have to be made visible.
8419 * For example, if a chain named 'foo' has been deleted, a
8420 * new transaction must not find it anymore.
8422 * Memory reclaim happens asynchronously from work queue
8423 * to prevent expensive synchronize_rcu() in commit phase.
8425 if (list_empty(&nft_net
->commit_list
)) {
8426 nf_tables_module_autoload_cleanup(net
);
8427 mutex_unlock(&nft_net
->commit_mutex
);
8431 trans
= list_last_entry(&nft_net
->commit_list
,
8432 struct nft_trans
, list
);
8433 get_net(trans
->ctx
.net
);
8434 WARN_ON_ONCE(trans
->put_net
);
8436 trans
->put_net
= true;
8437 spin_lock(&nf_tables_destroy_list_lock
);
8438 list_splice_tail_init(&nft_net
->commit_list
, &nf_tables_destroy_list
);
8439 spin_unlock(&nf_tables_destroy_list_lock
);
8441 nf_tables_module_autoload_cleanup(net
);
8442 schedule_work(&trans_destroy_work
);
8444 mutex_unlock(&nft_net
->commit_mutex
);
8447 static void nft_commit_notify(struct net
*net
, u32 portid
)
8449 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8450 struct sk_buff
*batch_skb
= NULL
, *nskb
, *skb
;
8451 unsigned char *data
;
8454 list_for_each_entry_safe(skb
, nskb
, &nft_net
->notify_list
, list
) {
8458 len
= NLMSG_GOODSIZE
- skb
->len
;
8459 list_del(&skb
->list
);
8463 if (len
> 0 && NFT_CB(skb
).report
== NFT_CB(batch_skb
).report
) {
8464 data
= skb_put(batch_skb
, skb
->len
);
8465 memcpy(data
, skb
->data
, skb
->len
);
8466 list_del(&skb
->list
);
8470 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
8471 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
8476 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
8477 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
8480 WARN_ON_ONCE(!list_empty(&nft_net
->notify_list
));
8483 static int nf_tables_commit_audit_alloc(struct list_head
*adl
,
8484 struct nft_table
*table
)
8486 struct nft_audit_data
*adp
;
8488 list_for_each_entry(adp
, adl
, list
) {
8489 if (adp
->table
== table
)
8492 adp
= kzalloc(sizeof(*adp
), GFP_KERNEL
);
8496 list_add(&adp
->list
, adl
);
8500 static void nf_tables_commit_audit_free(struct list_head
*adl
)
8502 struct nft_audit_data
*adp
, *adn
;
8504 list_for_each_entry_safe(adp
, adn
, adl
, list
) {
8505 list_del(&adp
->list
);
8510 static void nf_tables_commit_audit_collect(struct list_head
*adl
,
8511 struct nft_table
*table
, u32 op
)
8513 struct nft_audit_data
*adp
;
8515 list_for_each_entry(adp
, adl
, list
) {
8516 if (adp
->table
== table
)
8519 WARN_ONCE(1, "table=%s not expected in commit list", table
->name
);
8523 if (!adp
->op
|| adp
->op
> op
)
8527 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22)
8529 static void nf_tables_commit_audit_log(struct list_head
*adl
, u32 generation
)
8531 struct nft_audit_data
*adp
, *adn
;
8532 char aubuf
[AUNFTABLENAMELEN
];
8534 list_for_each_entry_safe(adp
, adn
, adl
, list
) {
8535 snprintf(aubuf
, AUNFTABLENAMELEN
, "%s:%u", adp
->table
->name
,
8537 audit_log_nfcfg(aubuf
, adp
->table
->family
, adp
->entries
,
8538 nft2audit_op
[adp
->op
], GFP_KERNEL
);
8539 list_del(&adp
->list
);
8544 static int nf_tables_commit(struct net
*net
, struct sk_buff
*skb
)
8546 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8547 struct nft_trans
*trans
, *next
;
8548 struct nft_trans_elem
*te
;
8549 struct nft_chain
*chain
;
8550 struct nft_table
*table
;
8554 if (list_empty(&nft_net
->commit_list
)) {
8555 mutex_unlock(&nft_net
->commit_mutex
);
8559 /* 0. Validate ruleset, otherwise roll back for error reporting. */
8560 if (nf_tables_validate(net
) < 0)
8563 err
= nft_flow_rule_offload_commit(net
);
8567 /* 1. Allocate space for next generation rules_gen_X[] */
8568 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
8571 ret
= nf_tables_commit_audit_alloc(&adl
, trans
->ctx
.table
);
8573 nf_tables_commit_chain_prepare_cancel(net
);
8574 nf_tables_commit_audit_free(&adl
);
8577 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
8578 trans
->msg_type
== NFT_MSG_DELRULE
) {
8579 chain
= trans
->ctx
.chain
;
8581 ret
= nf_tables_commit_chain_prepare(net
, chain
);
8583 nf_tables_commit_chain_prepare_cancel(net
);
8584 nf_tables_commit_audit_free(&adl
);
8590 /* step 2. Make rules_gen_X visible to packet path */
8591 list_for_each_entry(table
, &nft_net
->tables
, list
) {
8592 list_for_each_entry(chain
, &table
->chains
, list
)
8593 nf_tables_commit_chain(net
, chain
);
8597 * Bump generation counter, invalidate any dump in progress.
8598 * Cannot fail after this point.
8600 while (++nft_net
->base_seq
== 0)
8603 /* step 3. Start new generation, rules_gen_X now in use. */
8604 net
->nft
.gencursor
= nft_gencursor_next(net
);
8606 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
8607 nf_tables_commit_audit_collect(&adl
, trans
->ctx
.table
,
8609 switch (trans
->msg_type
) {
8610 case NFT_MSG_NEWTABLE
:
8611 if (nft_trans_table_update(trans
)) {
8612 if (!(trans
->ctx
.table
->flags
& __NFT_TABLE_F_UPDATE
)) {
8613 nft_trans_destroy(trans
);
8616 if (trans
->ctx
.table
->flags
& NFT_TABLE_F_DORMANT
)
8617 nf_tables_table_disable(net
, trans
->ctx
.table
);
8619 trans
->ctx
.table
->flags
&= ~__NFT_TABLE_F_UPDATE
;
8621 nft_clear(net
, trans
->ctx
.table
);
8623 nf_tables_table_notify(&trans
->ctx
, NFT_MSG_NEWTABLE
);
8624 nft_trans_destroy(trans
);
8626 case NFT_MSG_DELTABLE
:
8627 list_del_rcu(&trans
->ctx
.table
->list
);
8628 nf_tables_table_notify(&trans
->ctx
, NFT_MSG_DELTABLE
);
8630 case NFT_MSG_NEWCHAIN
:
8631 if (nft_trans_chain_update(trans
)) {
8632 nft_chain_commit_update(trans
);
8633 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
);
8634 /* trans destroyed after rcu grace period */
8636 nft_chain_commit_drop_policy(trans
);
8637 nft_clear(net
, trans
->ctx
.chain
);
8638 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
);
8639 nft_trans_destroy(trans
);
8642 case NFT_MSG_DELCHAIN
:
8643 nft_chain_del(trans
->ctx
.chain
);
8644 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_DELCHAIN
);
8645 nf_tables_unregister_hook(trans
->ctx
.net
,
8649 case NFT_MSG_NEWRULE
:
8650 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
8651 nf_tables_rule_notify(&trans
->ctx
,
8652 nft_trans_rule(trans
),
8654 nft_trans_destroy(trans
);
8656 case NFT_MSG_DELRULE
:
8657 list_del_rcu(&nft_trans_rule(trans
)->list
);
8658 nf_tables_rule_notify(&trans
->ctx
,
8659 nft_trans_rule(trans
),
8661 nft_rule_expr_deactivate(&trans
->ctx
,
8662 nft_trans_rule(trans
),
8665 case NFT_MSG_NEWSET
:
8666 nft_clear(net
, nft_trans_set(trans
));
8667 /* This avoids hitting -EBUSY when deleting the table
8668 * from the transaction.
8670 if (nft_set_is_anonymous(nft_trans_set(trans
)) &&
8671 !list_empty(&nft_trans_set(trans
)->bindings
))
8672 trans
->ctx
.table
->use
--;
8674 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
8675 NFT_MSG_NEWSET
, GFP_KERNEL
);
8676 nft_trans_destroy(trans
);
8678 case NFT_MSG_DELSET
:
8679 list_del_rcu(&nft_trans_set(trans
)->list
);
8680 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
8681 NFT_MSG_DELSET
, GFP_KERNEL
);
8683 case NFT_MSG_NEWSETELEM
:
8684 te
= (struct nft_trans_elem
*)trans
->data
;
8686 nft_setelem_activate(net
, te
->set
, &te
->elem
);
8687 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
8689 NFT_MSG_NEWSETELEM
);
8690 nft_trans_destroy(trans
);
8692 case NFT_MSG_DELSETELEM
:
8693 te
= (struct nft_trans_elem
*)trans
->data
;
8695 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
8697 NFT_MSG_DELSETELEM
);
8698 nft_setelem_remove(net
, te
->set
, &te
->elem
);
8699 if (!nft_setelem_is_catchall(te
->set
, &te
->elem
)) {
8700 atomic_dec(&te
->set
->nelems
);
8704 case NFT_MSG_NEWOBJ
:
8705 if (nft_trans_obj_update(trans
)) {
8706 nft_obj_commit_update(trans
);
8707 nf_tables_obj_notify(&trans
->ctx
,
8708 nft_trans_obj(trans
),
8711 nft_clear(net
, nft_trans_obj(trans
));
8712 nf_tables_obj_notify(&trans
->ctx
,
8713 nft_trans_obj(trans
),
8715 nft_trans_destroy(trans
);
8718 case NFT_MSG_DELOBJ
:
8719 nft_obj_del(nft_trans_obj(trans
));
8720 nf_tables_obj_notify(&trans
->ctx
, nft_trans_obj(trans
),
8723 case NFT_MSG_NEWFLOWTABLE
:
8724 if (nft_trans_flowtable_update(trans
)) {
8725 nft_trans_flowtable(trans
)->data
.flags
=
8726 nft_trans_flowtable_flags(trans
);
8727 nf_tables_flowtable_notify(&trans
->ctx
,
8728 nft_trans_flowtable(trans
),
8729 &nft_trans_flowtable_hooks(trans
),
8730 NFT_MSG_NEWFLOWTABLE
);
8731 list_splice(&nft_trans_flowtable_hooks(trans
),
8732 &nft_trans_flowtable(trans
)->hook_list
);
8734 nft_clear(net
, nft_trans_flowtable(trans
));
8735 nf_tables_flowtable_notify(&trans
->ctx
,
8736 nft_trans_flowtable(trans
),
8737 &nft_trans_flowtable(trans
)->hook_list
,
8738 NFT_MSG_NEWFLOWTABLE
);
8740 nft_trans_destroy(trans
);
8742 case NFT_MSG_DELFLOWTABLE
:
8743 if (nft_trans_flowtable_update(trans
)) {
8744 nft_flowtable_hooks_del(nft_trans_flowtable(trans
),
8745 &nft_trans_flowtable_hooks(trans
));
8746 nf_tables_flowtable_notify(&trans
->ctx
,
8747 nft_trans_flowtable(trans
),
8748 &nft_trans_flowtable_hooks(trans
),
8749 NFT_MSG_DELFLOWTABLE
);
8750 nft_unregister_flowtable_net_hooks(net
,
8751 &nft_trans_flowtable_hooks(trans
));
8753 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
8754 nf_tables_flowtable_notify(&trans
->ctx
,
8755 nft_trans_flowtable(trans
),
8756 &nft_trans_flowtable(trans
)->hook_list
,
8757 NFT_MSG_DELFLOWTABLE
);
8758 nft_unregister_flowtable_net_hooks(net
,
8759 &nft_trans_flowtable(trans
)->hook_list
);
8765 nft_commit_notify(net
, NETLINK_CB(skb
).portid
);
8766 nf_tables_gen_notify(net
, skb
, NFT_MSG_NEWGEN
);
8767 nf_tables_commit_audit_log(&adl
, nft_net
->base_seq
);
8768 nf_tables_commit_release(net
);
8773 static void nf_tables_module_autoload(struct net
*net
)
8775 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8776 struct nft_module_request
*req
, *next
;
8777 LIST_HEAD(module_list
);
8779 list_splice_init(&nft_net
->module_list
, &module_list
);
8780 mutex_unlock(&nft_net
->commit_mutex
);
8781 list_for_each_entry_safe(req
, next
, &module_list
, list
) {
8782 request_module("%s", req
->module
);
8785 mutex_lock(&nft_net
->commit_mutex
);
8786 list_splice(&module_list
, &nft_net
->module_list
);
8789 static void nf_tables_abort_release(struct nft_trans
*trans
)
8791 switch (trans
->msg_type
) {
8792 case NFT_MSG_NEWTABLE
:
8793 nf_tables_table_destroy(&trans
->ctx
);
8795 case NFT_MSG_NEWCHAIN
:
8796 nf_tables_chain_destroy(&trans
->ctx
);
8798 case NFT_MSG_NEWRULE
:
8799 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
8801 case NFT_MSG_NEWSET
:
8802 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
8804 case NFT_MSG_NEWSETELEM
:
8805 nft_set_elem_destroy(nft_trans_elem_set(trans
),
8806 nft_trans_elem(trans
).priv
, true);
8808 case NFT_MSG_NEWOBJ
:
8809 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
8811 case NFT_MSG_NEWFLOWTABLE
:
8812 if (nft_trans_flowtable_update(trans
))
8813 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
8815 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
8821 static int __nf_tables_abort(struct net
*net
, enum nfnl_abort_action action
)
8823 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8824 struct nft_trans
*trans
, *next
;
8825 struct nft_trans_elem
*te
;
8826 struct nft_hook
*hook
;
8828 if (action
== NFNL_ABORT_VALIDATE
&&
8829 nf_tables_validate(net
) < 0)
8832 list_for_each_entry_safe_reverse(trans
, next
, &nft_net
->commit_list
,
8834 switch (trans
->msg_type
) {
8835 case NFT_MSG_NEWTABLE
:
8836 if (nft_trans_table_update(trans
)) {
8837 if (!(trans
->ctx
.table
->flags
& __NFT_TABLE_F_UPDATE
)) {
8838 nft_trans_destroy(trans
);
8841 if (trans
->ctx
.table
->flags
& __NFT_TABLE_F_WAS_DORMANT
) {
8842 nf_tables_table_disable(net
, trans
->ctx
.table
);
8843 trans
->ctx
.table
->flags
|= NFT_TABLE_F_DORMANT
;
8844 } else if (trans
->ctx
.table
->flags
& __NFT_TABLE_F_WAS_AWAKEN
) {
8845 trans
->ctx
.table
->flags
&= ~NFT_TABLE_F_DORMANT
;
8847 trans
->ctx
.table
->flags
&= ~__NFT_TABLE_F_UPDATE
;
8848 nft_trans_destroy(trans
);
8850 list_del_rcu(&trans
->ctx
.table
->list
);
8853 case NFT_MSG_DELTABLE
:
8854 nft_clear(trans
->ctx
.net
, trans
->ctx
.table
);
8855 nft_trans_destroy(trans
);
8857 case NFT_MSG_NEWCHAIN
:
8858 if (nft_trans_chain_update(trans
)) {
8859 free_percpu(nft_trans_chain_stats(trans
));
8860 kfree(nft_trans_chain_name(trans
));
8861 nft_trans_destroy(trans
);
8863 if (nft_chain_is_bound(trans
->ctx
.chain
)) {
8864 nft_trans_destroy(trans
);
8867 trans
->ctx
.table
->use
--;
8868 nft_chain_del(trans
->ctx
.chain
);
8869 nf_tables_unregister_hook(trans
->ctx
.net
,
8874 case NFT_MSG_DELCHAIN
:
8875 trans
->ctx
.table
->use
++;
8876 nft_clear(trans
->ctx
.net
, trans
->ctx
.chain
);
8877 nft_trans_destroy(trans
);
8879 case NFT_MSG_NEWRULE
:
8880 trans
->ctx
.chain
->use
--;
8881 list_del_rcu(&nft_trans_rule(trans
)->list
);
8882 nft_rule_expr_deactivate(&trans
->ctx
,
8883 nft_trans_rule(trans
),
8885 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
8886 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
8888 case NFT_MSG_DELRULE
:
8889 trans
->ctx
.chain
->use
++;
8890 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
8891 nft_rule_expr_activate(&trans
->ctx
, nft_trans_rule(trans
));
8892 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
8893 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
8895 nft_trans_destroy(trans
);
8897 case NFT_MSG_NEWSET
:
8898 trans
->ctx
.table
->use
--;
8899 if (nft_trans_set_bound(trans
)) {
8900 nft_trans_destroy(trans
);
8903 list_del_rcu(&nft_trans_set(trans
)->list
);
8905 case NFT_MSG_DELSET
:
8906 trans
->ctx
.table
->use
++;
8907 nft_clear(trans
->ctx
.net
, nft_trans_set(trans
));
8908 nft_trans_destroy(trans
);
8910 case NFT_MSG_NEWSETELEM
:
8911 if (nft_trans_elem_set_bound(trans
)) {
8912 nft_trans_destroy(trans
);
8915 te
= (struct nft_trans_elem
*)trans
->data
;
8916 nft_setelem_remove(net
, te
->set
, &te
->elem
);
8917 if (!nft_setelem_is_catchall(te
->set
, &te
->elem
))
8918 atomic_dec(&te
->set
->nelems
);
8920 case NFT_MSG_DELSETELEM
:
8921 te
= (struct nft_trans_elem
*)trans
->data
;
8923 nft_setelem_data_activate(net
, te
->set
, &te
->elem
);
8924 nft_setelem_activate(net
, te
->set
, &te
->elem
);
8925 if (!nft_setelem_is_catchall(te
->set
, &te
->elem
))
8928 nft_trans_destroy(trans
);
8930 case NFT_MSG_NEWOBJ
:
8931 if (nft_trans_obj_update(trans
)) {
8932 nft_obj_destroy(&trans
->ctx
, nft_trans_obj_newobj(trans
));
8933 nft_trans_destroy(trans
);
8935 trans
->ctx
.table
->use
--;
8936 nft_obj_del(nft_trans_obj(trans
));
8939 case NFT_MSG_DELOBJ
:
8940 trans
->ctx
.table
->use
++;
8941 nft_clear(trans
->ctx
.net
, nft_trans_obj(trans
));
8942 nft_trans_destroy(trans
);
8944 case NFT_MSG_NEWFLOWTABLE
:
8945 if (nft_trans_flowtable_update(trans
)) {
8946 nft_unregister_flowtable_net_hooks(net
,
8947 &nft_trans_flowtable_hooks(trans
));
8949 trans
->ctx
.table
->use
--;
8950 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
8951 nft_unregister_flowtable_net_hooks(net
,
8952 &nft_trans_flowtable(trans
)->hook_list
);
8955 case NFT_MSG_DELFLOWTABLE
:
8956 if (nft_trans_flowtable_update(trans
)) {
8957 list_for_each_entry(hook
, &nft_trans_flowtable(trans
)->hook_list
, list
)
8958 hook
->inactive
= false;
8960 trans
->ctx
.table
->use
++;
8961 nft_clear(trans
->ctx
.net
, nft_trans_flowtable(trans
));
8963 nft_trans_destroy(trans
);
8970 list_for_each_entry_safe_reverse(trans
, next
,
8971 &nft_net
->commit_list
, list
) {
8972 list_del(&trans
->list
);
8973 nf_tables_abort_release(trans
);
8976 if (action
== NFNL_ABORT_AUTOLOAD
)
8977 nf_tables_module_autoload(net
);
8979 nf_tables_module_autoload_cleanup(net
);
8984 static void nf_tables_cleanup(struct net
*net
)
8986 nft_validate_state_update(net
, NFT_VALIDATE_SKIP
);
8989 static int nf_tables_abort(struct net
*net
, struct sk_buff
*skb
,
8990 enum nfnl_abort_action action
)
8992 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8993 int ret
= __nf_tables_abort(net
, action
);
8995 mutex_unlock(&nft_net
->commit_mutex
);
9000 static bool nf_tables_valid_genid(struct net
*net
, u32 genid
)
9002 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9005 mutex_lock(&nft_net
->commit_mutex
);
9007 genid_ok
= genid
== 0 || nft_net
->base_seq
== genid
;
9009 mutex_unlock(&nft_net
->commit_mutex
);
9011 /* else, commit mutex has to be released by commit or abort function */
9015 static const struct nfnetlink_subsystem nf_tables_subsys
= {
9016 .name
= "nf_tables",
9017 .subsys_id
= NFNL_SUBSYS_NFTABLES
,
9018 .cb_count
= NFT_MSG_MAX
,
9020 .commit
= nf_tables_commit
,
9021 .abort
= nf_tables_abort
,
9022 .cleanup
= nf_tables_cleanup
,
9023 .valid_genid
= nf_tables_valid_genid
,
9024 .owner
= THIS_MODULE
,
9027 int nft_chain_validate_dependency(const struct nft_chain
*chain
,
9028 enum nft_chain_types type
)
9030 const struct nft_base_chain
*basechain
;
9032 if (nft_is_base_chain(chain
)) {
9033 basechain
= nft_base_chain(chain
);
9034 if (basechain
->type
->type
!= type
)
9039 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency
);
9041 int nft_chain_validate_hooks(const struct nft_chain
*chain
,
9042 unsigned int hook_flags
)
9044 struct nft_base_chain
*basechain
;
9046 if (nft_is_base_chain(chain
)) {
9047 basechain
= nft_base_chain(chain
);
9049 if ((1 << basechain
->ops
.hooknum
) & hook_flags
)
9057 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks
);
9060 * Loop detection - walk through the ruleset beginning at the destination chain
9061 * of a new jump until either the source chain is reached (loop) or all
9062 * reachable chains have been traversed.
9064 * The loop check is performed whenever a new jump verdict is added to an
9065 * expression or verdict map or a verdict map is bound to a new chain.
9068 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
9069 const struct nft_chain
*chain
);
9071 static int nft_check_loops(const struct nft_ctx
*ctx
,
9072 const struct nft_set_ext
*ext
)
9074 const struct nft_data
*data
;
9077 data
= nft_set_ext_data(ext
);
9078 switch (data
->verdict
.code
) {
9081 ret
= nf_tables_check_loops(ctx
, data
->verdict
.chain
);
9091 static int nf_tables_loop_check_setelem(const struct nft_ctx
*ctx
,
9092 struct nft_set
*set
,
9093 const struct nft_set_iter
*iter
,
9094 struct nft_set_elem
*elem
)
9096 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
9098 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
9099 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_INTERVAL_END
)
9102 return nft_check_loops(ctx
, ext
);
9105 static int nft_set_catchall_loops(const struct nft_ctx
*ctx
,
9106 struct nft_set
*set
)
9108 u8 genmask
= nft_genmask_next(ctx
->net
);
9109 struct nft_set_elem_catchall
*catchall
;
9110 struct nft_set_ext
*ext
;
9113 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
9114 ext
= nft_set_elem_ext(set
, catchall
->elem
);
9115 if (!nft_set_elem_active(ext
, genmask
))
9118 ret
= nft_check_loops(ctx
, ext
);
9126 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
9127 const struct nft_chain
*chain
)
9129 const struct nft_rule
*rule
;
9130 const struct nft_expr
*expr
, *last
;
9131 struct nft_set
*set
;
9132 struct nft_set_binding
*binding
;
9133 struct nft_set_iter iter
;
9135 if (ctx
->chain
== chain
)
9138 list_for_each_entry(rule
, &chain
->rules
, list
) {
9139 nft_rule_for_each_expr(expr
, last
, rule
) {
9140 struct nft_immediate_expr
*priv
;
9141 const struct nft_data
*data
;
9144 if (strcmp(expr
->ops
->type
->name
, "immediate"))
9147 priv
= nft_expr_priv(expr
);
9148 if (priv
->dreg
!= NFT_REG_VERDICT
)
9152 switch (data
->verdict
.code
) {
9155 err
= nf_tables_check_loops(ctx
,
9156 data
->verdict
.chain
);
9166 list_for_each_entry(set
, &ctx
->table
->sets
, list
) {
9167 if (!nft_is_active_next(ctx
->net
, set
))
9169 if (!(set
->flags
& NFT_SET_MAP
) ||
9170 set
->dtype
!= NFT_DATA_VERDICT
)
9173 list_for_each_entry(binding
, &set
->bindings
, list
) {
9174 if (!(binding
->flags
& NFT_SET_MAP
) ||
9175 binding
->chain
!= chain
)
9178 iter
.genmask
= nft_genmask_next(ctx
->net
);
9182 iter
.fn
= nf_tables_loop_check_setelem
;
9184 set
->ops
->walk(ctx
, set
, &iter
);
9186 iter
.err
= nft_set_catchall_loops(ctx
, set
);
9197 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
9199 * @attr: netlink attribute to fetch value from
9200 * @max: maximum value to be stored in dest
9201 * @dest: pointer to the variable
9203 * Parse, check and store a given u32 netlink attribute into variable.
9204 * This function returns -ERANGE if the value goes over maximum value.
9205 * Otherwise a 0 is returned and the attribute value is stored in the
9206 * destination variable.
9208 int nft_parse_u32_check(const struct nlattr
*attr
, int max
, u32
*dest
)
9212 val
= ntohl(nla_get_be32(attr
));
9219 EXPORT_SYMBOL_GPL(nft_parse_u32_check
);
9221 static int nft_parse_register(const struct nlattr
*attr
, u32
*preg
)
9225 reg
= ntohl(nla_get_be32(attr
));
9227 case NFT_REG_VERDICT
...NFT_REG_4
:
9228 *preg
= reg
* NFT_REG_SIZE
/ NFT_REG32_SIZE
;
9230 case NFT_REG32_00
...NFT_REG32_15
:
9231 *preg
= reg
+ NFT_REG_SIZE
/ NFT_REG32_SIZE
- NFT_REG32_00
;
9241 * nft_dump_register - dump a register value to a netlink attribute
9243 * @skb: socket buffer
9244 * @attr: attribute number
9245 * @reg: register number
9247 * Construct a netlink attribute containing the register number. For
9248 * compatibility reasons, register numbers being a multiple of 4 are
9249 * translated to the corresponding 128 bit register numbers.
9251 int nft_dump_register(struct sk_buff
*skb
, unsigned int attr
, unsigned int reg
)
9253 if (reg
% (NFT_REG_SIZE
/ NFT_REG32_SIZE
) == 0)
9254 reg
= reg
/ (NFT_REG_SIZE
/ NFT_REG32_SIZE
);
9256 reg
= reg
- NFT_REG_SIZE
/ NFT_REG32_SIZE
+ NFT_REG32_00
;
9258 return nla_put_be32(skb
, attr
, htonl(reg
));
9260 EXPORT_SYMBOL_GPL(nft_dump_register
);
9262 static int nft_validate_register_load(enum nft_registers reg
, unsigned int len
)
9264 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
9268 if (reg
* NFT_REG32_SIZE
+ len
> sizeof_field(struct nft_regs
, data
))
9274 int nft_parse_register_load(const struct nlattr
*attr
, u8
*sreg
, u32 len
)
9279 err
= nft_parse_register(attr
, ®
);
9283 err
= nft_validate_register_load(reg
, len
);
9290 EXPORT_SYMBOL_GPL(nft_parse_register_load
);
9292 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
9293 enum nft_registers reg
,
9294 const struct nft_data
*data
,
9295 enum nft_data_types type
,
9301 case NFT_REG_VERDICT
:
9302 if (type
!= NFT_DATA_VERDICT
)
9306 (data
->verdict
.code
== NFT_GOTO
||
9307 data
->verdict
.code
== NFT_JUMP
)) {
9308 err
= nf_tables_check_loops(ctx
, data
->verdict
.chain
);
9315 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
9319 if (reg
* NFT_REG32_SIZE
+ len
>
9320 sizeof_field(struct nft_regs
, data
))
9323 if (data
!= NULL
&& type
!= NFT_DATA_VALUE
)
9329 int nft_parse_register_store(const struct nft_ctx
*ctx
,
9330 const struct nlattr
*attr
, u8
*dreg
,
9331 const struct nft_data
*data
,
9332 enum nft_data_types type
, unsigned int len
)
9337 err
= nft_parse_register(attr
, ®
);
9341 err
= nft_validate_register_store(ctx
, reg
, data
, type
, len
);
9348 EXPORT_SYMBOL_GPL(nft_parse_register_store
);
9350 static const struct nla_policy nft_verdict_policy
[NFTA_VERDICT_MAX
+ 1] = {
9351 [NFTA_VERDICT_CODE
] = { .type
= NLA_U32
},
9352 [NFTA_VERDICT_CHAIN
] = { .type
= NLA_STRING
,
9353 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
9354 [NFTA_VERDICT_CHAIN_ID
] = { .type
= NLA_U32
},
9357 static int nft_verdict_init(const struct nft_ctx
*ctx
, struct nft_data
*data
,
9358 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
9360 u8 genmask
= nft_genmask_next(ctx
->net
);
9361 struct nlattr
*tb
[NFTA_VERDICT_MAX
+ 1];
9362 struct nft_chain
*chain
;
9365 err
= nla_parse_nested_deprecated(tb
, NFTA_VERDICT_MAX
, nla
,
9366 nft_verdict_policy
, NULL
);
9370 if (!tb
[NFTA_VERDICT_CODE
])
9372 data
->verdict
.code
= ntohl(nla_get_be32(tb
[NFTA_VERDICT_CODE
]));
9374 switch (data
->verdict
.code
) {
9376 switch (data
->verdict
.code
& NF_VERDICT_MASK
) {
9391 if (tb
[NFTA_VERDICT_CHAIN
]) {
9392 chain
= nft_chain_lookup(ctx
->net
, ctx
->table
,
9393 tb
[NFTA_VERDICT_CHAIN
],
9395 } else if (tb
[NFTA_VERDICT_CHAIN_ID
]) {
9396 chain
= nft_chain_lookup_byid(ctx
->net
,
9397 tb
[NFTA_VERDICT_CHAIN_ID
]);
9399 return PTR_ERR(chain
);
9405 return PTR_ERR(chain
);
9406 if (nft_is_base_chain(chain
))
9410 data
->verdict
.chain
= chain
;
9414 desc
->len
= sizeof(data
->verdict
);
9415 desc
->type
= NFT_DATA_VERDICT
;
9419 static void nft_verdict_uninit(const struct nft_data
*data
)
9421 struct nft_chain
*chain
;
9422 struct nft_rule
*rule
;
9424 switch (data
->verdict
.code
) {
9427 chain
= data
->verdict
.chain
;
9430 if (!nft_chain_is_bound(chain
))
9433 chain
->table
->use
--;
9434 list_for_each_entry(rule
, &chain
->rules
, list
)
9437 nft_chain_del(chain
);
9442 int nft_verdict_dump(struct sk_buff
*skb
, int type
, const struct nft_verdict
*v
)
9444 struct nlattr
*nest
;
9446 nest
= nla_nest_start_noflag(skb
, type
);
9448 goto nla_put_failure
;
9450 if (nla_put_be32(skb
, NFTA_VERDICT_CODE
, htonl(v
->code
)))
9451 goto nla_put_failure
;
9456 if (nla_put_string(skb
, NFTA_VERDICT_CHAIN
,
9458 goto nla_put_failure
;
9460 nla_nest_end(skb
, nest
);
9467 static int nft_value_init(const struct nft_ctx
*ctx
,
9468 struct nft_data
*data
, unsigned int size
,
9469 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
9479 nla_memcpy(data
->data
, nla
, len
);
9480 desc
->type
= NFT_DATA_VALUE
;
9485 static int nft_value_dump(struct sk_buff
*skb
, const struct nft_data
*data
,
9488 return nla_put(skb
, NFTA_DATA_VALUE
, len
, data
->data
);
9491 static const struct nla_policy nft_data_policy
[NFTA_DATA_MAX
+ 1] = {
9492 [NFTA_DATA_VALUE
] = { .type
= NLA_BINARY
},
9493 [NFTA_DATA_VERDICT
] = { .type
= NLA_NESTED
},
9497 * nft_data_init - parse nf_tables data netlink attributes
9499 * @ctx: context of the expression using the data
9500 * @data: destination struct nft_data
9501 * @size: maximum data length
9502 * @desc: data description
9503 * @nla: netlink attribute containing data
9505 * Parse the netlink data attributes and initialize a struct nft_data.
9506 * The type and length of data are returned in the data description.
9508 * The caller can indicate that it only wants to accept data of type
9509 * NFT_DATA_VALUE by passing NULL for the ctx argument.
9511 int nft_data_init(const struct nft_ctx
*ctx
,
9512 struct nft_data
*data
, unsigned int size
,
9513 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
9515 struct nlattr
*tb
[NFTA_DATA_MAX
+ 1];
9518 err
= nla_parse_nested_deprecated(tb
, NFTA_DATA_MAX
, nla
,
9519 nft_data_policy
, NULL
);
9523 if (tb
[NFTA_DATA_VALUE
])
9524 return nft_value_init(ctx
, data
, size
, desc
,
9525 tb
[NFTA_DATA_VALUE
]);
9526 if (tb
[NFTA_DATA_VERDICT
] && ctx
!= NULL
)
9527 return nft_verdict_init(ctx
, data
, desc
, tb
[NFTA_DATA_VERDICT
]);
9530 EXPORT_SYMBOL_GPL(nft_data_init
);
9533 * nft_data_release - release a nft_data item
9535 * @data: struct nft_data to release
9536 * @type: type of data
9538 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
9539 * all others need to be released by calling this function.
9541 void nft_data_release(const struct nft_data
*data
, enum nft_data_types type
)
9543 if (type
< NFT_DATA_VERDICT
)
9546 case NFT_DATA_VERDICT
:
9547 return nft_verdict_uninit(data
);
9552 EXPORT_SYMBOL_GPL(nft_data_release
);
9554 int nft_data_dump(struct sk_buff
*skb
, int attr
, const struct nft_data
*data
,
9555 enum nft_data_types type
, unsigned int len
)
9557 struct nlattr
*nest
;
9560 nest
= nla_nest_start_noflag(skb
, attr
);
9565 case NFT_DATA_VALUE
:
9566 err
= nft_value_dump(skb
, data
, len
);
9568 case NFT_DATA_VERDICT
:
9569 err
= nft_verdict_dump(skb
, NFTA_DATA_VERDICT
, &data
->verdict
);
9576 nla_nest_end(skb
, nest
);
9579 EXPORT_SYMBOL_GPL(nft_data_dump
);
9581 int __nft_release_basechain(struct nft_ctx
*ctx
)
9583 struct nft_rule
*rule
, *nr
;
9585 if (WARN_ON(!nft_is_base_chain(ctx
->chain
)))
9588 nf_tables_unregister_hook(ctx
->net
, ctx
->chain
->table
, ctx
->chain
);
9589 list_for_each_entry_safe(rule
, nr
, &ctx
->chain
->rules
, list
) {
9590 list_del(&rule
->list
);
9592 nf_tables_rule_release(ctx
, rule
);
9594 nft_chain_del(ctx
->chain
);
9596 nf_tables_chain_destroy(ctx
);
9600 EXPORT_SYMBOL_GPL(__nft_release_basechain
);
9602 static void __nft_release_hook(struct net
*net
, struct nft_table
*table
)
9604 struct nft_flowtable
*flowtable
;
9605 struct nft_chain
*chain
;
9607 list_for_each_entry(chain
, &table
->chains
, list
)
9608 nf_tables_unregister_hook(net
, table
, chain
);
9609 list_for_each_entry(flowtable
, &table
->flowtables
, list
)
9610 nft_unregister_flowtable_net_hooks(net
, &flowtable
->hook_list
);
9613 static void __nft_release_hooks(struct net
*net
)
9615 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9616 struct nft_table
*table
;
9618 list_for_each_entry(table
, &nft_net
->tables
, list
) {
9619 if (nft_table_has_owner(table
))
9622 __nft_release_hook(net
, table
);
9626 static void __nft_release_table(struct net
*net
, struct nft_table
*table
)
9628 struct nft_flowtable
*flowtable
, *nf
;
9629 struct nft_chain
*chain
, *nc
;
9630 struct nft_object
*obj
, *ne
;
9631 struct nft_rule
*rule
, *nr
;
9632 struct nft_set
*set
, *ns
;
9633 struct nft_ctx ctx
= {
9635 .family
= NFPROTO_NETDEV
,
9638 ctx
.family
= table
->family
;
9640 list_for_each_entry(chain
, &table
->chains
, list
) {
9642 list_for_each_entry_safe(rule
, nr
, &chain
->rules
, list
) {
9643 list_del(&rule
->list
);
9645 nf_tables_rule_release(&ctx
, rule
);
9648 list_for_each_entry_safe(flowtable
, nf
, &table
->flowtables
, list
) {
9649 list_del(&flowtable
->list
);
9651 nf_tables_flowtable_destroy(flowtable
);
9653 list_for_each_entry_safe(set
, ns
, &table
->sets
, list
) {
9654 list_del(&set
->list
);
9656 nft_set_destroy(&ctx
, set
);
9658 list_for_each_entry_safe(obj
, ne
, &table
->objects
, list
) {
9661 nft_obj_destroy(&ctx
, obj
);
9663 list_for_each_entry_safe(chain
, nc
, &table
->chains
, list
) {
9665 nft_chain_del(chain
);
9667 nf_tables_chain_destroy(&ctx
);
9669 nf_tables_table_destroy(&ctx
);
9672 static void __nft_release_tables(struct net
*net
)
9674 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9675 struct nft_table
*table
, *nt
;
9677 list_for_each_entry_safe(table
, nt
, &nft_net
->tables
, list
) {
9678 if (nft_table_has_owner(table
))
9681 list_del(&table
->list
);
9683 __nft_release_table(net
, table
);
9687 static int nft_rcv_nl_event(struct notifier_block
*this, unsigned long event
,
9690 struct nft_table
*table
, *to_delete
[8];
9691 struct nftables_pernet
*nft_net
;
9692 struct netlink_notify
*n
= ptr
;
9693 struct net
*net
= n
->net
;
9694 unsigned int deleted
;
9695 bool restart
= false;
9697 if (event
!= NETLINK_URELEASE
|| n
->protocol
!= NETLINK_NETFILTER
)
9700 nft_net
= nft_pernet(net
);
9702 mutex_lock(&nft_net
->commit_mutex
);
9704 list_for_each_entry(table
, &nft_net
->tables
, list
) {
9705 if (nft_table_has_owner(table
) &&
9706 n
->portid
== table
->nlpid
) {
9707 __nft_release_hook(net
, table
);
9708 list_del_rcu(&table
->list
);
9709 to_delete
[deleted
++] = table
;
9710 if (deleted
>= ARRAY_SIZE(to_delete
))
9715 restart
= deleted
>= ARRAY_SIZE(to_delete
);
9718 __nft_release_table(net
, to_delete
[--deleted
]);
9723 mutex_unlock(&nft_net
->commit_mutex
);
9728 static struct notifier_block nft_nl_notifier
= {
9729 .notifier_call
= nft_rcv_nl_event
,
9732 static int __net_init
nf_tables_init_net(struct net
*net
)
9734 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9736 INIT_LIST_HEAD(&nft_net
->tables
);
9737 INIT_LIST_HEAD(&nft_net
->commit_list
);
9738 INIT_LIST_HEAD(&nft_net
->module_list
);
9739 INIT_LIST_HEAD(&nft_net
->notify_list
);
9740 mutex_init(&nft_net
->commit_mutex
);
9741 nft_net
->base_seq
= 1;
9742 nft_net
->validate_state
= NFT_VALIDATE_SKIP
;
9747 static void __net_exit
nf_tables_pre_exit_net(struct net
*net
)
9749 __nft_release_hooks(net
);
9752 static void __net_exit
nf_tables_exit_net(struct net
*net
)
9754 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9756 mutex_lock(&nft_net
->commit_mutex
);
9757 if (!list_empty(&nft_net
->commit_list
))
9758 __nf_tables_abort(net
, NFNL_ABORT_NONE
);
9759 __nft_release_tables(net
);
9760 mutex_unlock(&nft_net
->commit_mutex
);
9761 WARN_ON_ONCE(!list_empty(&nft_net
->tables
));
9762 WARN_ON_ONCE(!list_empty(&nft_net
->module_list
));
9763 WARN_ON_ONCE(!list_empty(&nft_net
->notify_list
));
9766 static struct pernet_operations nf_tables_net_ops
= {
9767 .init
= nf_tables_init_net
,
9768 .pre_exit
= nf_tables_pre_exit_net
,
9769 .exit
= nf_tables_exit_net
,
9770 .id
= &nf_tables_net_id
,
9771 .size
= sizeof(struct nftables_pernet
),
9774 static int __init
nf_tables_module_init(void)
9778 err
= register_pernet_subsys(&nf_tables_net_ops
);
9782 err
= nft_chain_filter_init();
9784 goto err_chain_filter
;
9786 err
= nf_tables_core_module_init();
9788 goto err_core_module
;
9790 err
= register_netdevice_notifier(&nf_tables_flowtable_notifier
);
9792 goto err_netdev_notifier
;
9794 err
= rhltable_init(&nft_objname_ht
, &nft_objname_ht_params
);
9796 goto err_rht_objname
;
9798 err
= nft_offload_init();
9802 err
= netlink_register_notifier(&nft_nl_notifier
);
9804 goto err_netlink_notifier
;
9807 err
= nfnetlink_subsys_register(&nf_tables_subsys
);
9809 goto err_nfnl_subsys
;
9811 nft_chain_route_init();
9816 netlink_unregister_notifier(&nft_nl_notifier
);
9817 err_netlink_notifier
:
9820 rhltable_destroy(&nft_objname_ht
);
9822 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
9823 err_netdev_notifier
:
9824 nf_tables_core_module_exit();
9826 nft_chain_filter_fini();
9828 unregister_pernet_subsys(&nf_tables_net_ops
);
9832 static void __exit
nf_tables_module_exit(void)
9834 nfnetlink_subsys_unregister(&nf_tables_subsys
);
9835 netlink_unregister_notifier(&nft_nl_notifier
);
9837 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
9838 nft_chain_filter_fini();
9839 nft_chain_route_fini();
9840 unregister_pernet_subsys(&nf_tables_net_ops
);
9841 cancel_work_sync(&trans_destroy_work
);
9843 rhltable_destroy(&nft_objname_ht
);
9844 nf_tables_core_module_exit();
9847 module_init(nf_tables_module_init
);
9848 module_exit(nf_tables_module_exit
);
9850 MODULE_LICENSE("GPL");
9851 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
9852 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES
);