1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 #include <linux/module.h>
9 #include <linux/init.h>
10 #include <linux/list.h>
11 #include <linux/skbuff.h>
12 #include <linux/netlink.h>
13 #include <linux/vmalloc.h>
14 #include <linux/rhashtable.h>
15 #include <linux/audit.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nfnetlink.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_flow_table.h>
20 #include <net/netfilter/nf_tables_core.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_offload.h>
23 #include <net/net_namespace.h>
26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
28 static LIST_HEAD(nf_tables_expressions
);
29 static LIST_HEAD(nf_tables_objects
);
30 static LIST_HEAD(nf_tables_flowtables
);
31 static LIST_HEAD(nf_tables_destroy_list
);
32 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock
);
33 static u64 table_handle
;
36 NFT_VALIDATE_SKIP
= 0,
41 static struct rhltable nft_objname_ht
;
43 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
);
44 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
);
45 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*, const void *);
47 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
);
48 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
);
49 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*, const void *);
51 static const struct rhashtable_params nft_chain_ht_params
= {
52 .head_offset
= offsetof(struct nft_chain
, rhlhead
),
53 .key_offset
= offsetof(struct nft_chain
, name
),
54 .hashfn
= nft_chain_hash
,
55 .obj_hashfn
= nft_chain_hash_obj
,
56 .obj_cmpfn
= nft_chain_hash_cmp
,
57 .automatic_shrinking
= true,
60 static const struct rhashtable_params nft_objname_ht_params
= {
61 .head_offset
= offsetof(struct nft_object
, rhlhead
),
62 .key_offset
= offsetof(struct nft_object
, key
),
63 .hashfn
= nft_objname_hash
,
64 .obj_hashfn
= nft_objname_hash_obj
,
65 .obj_cmpfn
= nft_objname_hash_cmp
,
66 .automatic_shrinking
= true,
69 static void nft_validate_state_update(struct net
*net
, u8 new_validate_state
)
71 switch (net
->nft
.validate_state
) {
72 case NFT_VALIDATE_SKIP
:
73 WARN_ON_ONCE(new_validate_state
== NFT_VALIDATE_DO
);
75 case NFT_VALIDATE_NEED
:
78 if (new_validate_state
== NFT_VALIDATE_NEED
)
82 net
->nft
.validate_state
= new_validate_state
;
84 static void nf_tables_trans_destroy_work(struct work_struct
*w
);
85 static DECLARE_WORK(trans_destroy_work
, nf_tables_trans_destroy_work
);
87 static void nft_ctx_init(struct nft_ctx
*ctx
,
89 const struct sk_buff
*skb
,
90 const struct nlmsghdr
*nlh
,
92 struct nft_table
*table
,
93 struct nft_chain
*chain
,
94 const struct nlattr
* const *nla
)
102 ctx
->portid
= NETLINK_CB(skb
).portid
;
103 ctx
->report
= nlmsg_report(nlh
);
104 ctx
->flags
= nlh
->nlmsg_flags
;
105 ctx
->seq
= nlh
->nlmsg_seq
;
108 static struct nft_trans
*nft_trans_alloc_gfp(const struct nft_ctx
*ctx
,
109 int msg_type
, u32 size
, gfp_t gfp
)
111 struct nft_trans
*trans
;
113 trans
= kzalloc(sizeof(struct nft_trans
) + size
, gfp
);
117 trans
->msg_type
= msg_type
;
123 static struct nft_trans
*nft_trans_alloc(const struct nft_ctx
*ctx
,
124 int msg_type
, u32 size
)
126 return nft_trans_alloc_gfp(ctx
, msg_type
, size
, GFP_KERNEL
);
129 static void nft_trans_destroy(struct nft_trans
*trans
)
131 list_del(&trans
->list
);
135 static void nft_set_trans_bind(const struct nft_ctx
*ctx
, struct nft_set
*set
)
137 struct net
*net
= ctx
->net
;
138 struct nft_trans
*trans
;
140 if (!nft_set_is_anonymous(set
))
143 list_for_each_entry_reverse(trans
, &net
->nft
.commit_list
, list
) {
144 switch (trans
->msg_type
) {
146 if (nft_trans_set(trans
) == set
)
147 nft_trans_set_bound(trans
) = true;
149 case NFT_MSG_NEWSETELEM
:
150 if (nft_trans_elem_set(trans
) == set
)
151 nft_trans_elem_set_bound(trans
) = true;
157 static int nft_netdev_register_hooks(struct net
*net
,
158 struct list_head
*hook_list
)
160 struct nft_hook
*hook
;
164 list_for_each_entry(hook
, hook_list
, list
) {
165 err
= nf_register_net_hook(net
, &hook
->ops
);
174 list_for_each_entry(hook
, hook_list
, list
) {
178 nf_unregister_net_hook(net
, &hook
->ops
);
183 static void nft_netdev_unregister_hooks(struct net
*net
,
184 struct list_head
*hook_list
)
186 struct nft_hook
*hook
;
188 list_for_each_entry(hook
, hook_list
, list
)
189 nf_unregister_net_hook(net
, &hook
->ops
);
192 static int nf_tables_register_hook(struct net
*net
,
193 const struct nft_table
*table
,
194 struct nft_chain
*chain
)
196 struct nft_base_chain
*basechain
;
197 const struct nf_hook_ops
*ops
;
199 if (table
->flags
& NFT_TABLE_F_DORMANT
||
200 !nft_is_base_chain(chain
))
203 basechain
= nft_base_chain(chain
);
204 ops
= &basechain
->ops
;
206 if (basechain
->type
->ops_register
)
207 return basechain
->type
->ops_register(net
, ops
);
209 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
210 return nft_netdev_register_hooks(net
, &basechain
->hook_list
);
212 return nf_register_net_hook(net
, &basechain
->ops
);
215 static void nf_tables_unregister_hook(struct net
*net
,
216 const struct nft_table
*table
,
217 struct nft_chain
*chain
)
219 struct nft_base_chain
*basechain
;
220 const struct nf_hook_ops
*ops
;
222 if (table
->flags
& NFT_TABLE_F_DORMANT
||
223 !nft_is_base_chain(chain
))
225 basechain
= nft_base_chain(chain
);
226 ops
= &basechain
->ops
;
228 if (basechain
->type
->ops_unregister
)
229 return basechain
->type
->ops_unregister(net
, ops
);
231 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
232 nft_netdev_unregister_hooks(net
, &basechain
->hook_list
);
234 nf_unregister_net_hook(net
, &basechain
->ops
);
237 static int nft_trans_table_add(struct nft_ctx
*ctx
, int msg_type
)
239 struct nft_trans
*trans
;
241 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_table
));
245 if (msg_type
== NFT_MSG_NEWTABLE
)
246 nft_activate_next(ctx
->net
, ctx
->table
);
248 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
252 static int nft_deltable(struct nft_ctx
*ctx
)
256 err
= nft_trans_table_add(ctx
, NFT_MSG_DELTABLE
);
260 nft_deactivate_next(ctx
->net
, ctx
->table
);
264 static struct nft_trans
*nft_trans_chain_add(struct nft_ctx
*ctx
, int msg_type
)
266 struct nft_trans
*trans
;
268 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_chain
));
270 return ERR_PTR(-ENOMEM
);
272 if (msg_type
== NFT_MSG_NEWCHAIN
) {
273 nft_activate_next(ctx
->net
, ctx
->chain
);
275 if (ctx
->nla
[NFTA_CHAIN_ID
]) {
276 nft_trans_chain_id(trans
) =
277 ntohl(nla_get_be32(ctx
->nla
[NFTA_CHAIN_ID
]));
281 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
285 static int nft_delchain(struct nft_ctx
*ctx
)
287 struct nft_trans
*trans
;
289 trans
= nft_trans_chain_add(ctx
, NFT_MSG_DELCHAIN
);
291 return PTR_ERR(trans
);
294 nft_deactivate_next(ctx
->net
, ctx
->chain
);
299 static void nft_rule_expr_activate(const struct nft_ctx
*ctx
,
300 struct nft_rule
*rule
)
302 struct nft_expr
*expr
;
304 expr
= nft_expr_first(rule
);
305 while (nft_expr_more(rule
, expr
)) {
306 if (expr
->ops
->activate
)
307 expr
->ops
->activate(ctx
, expr
);
309 expr
= nft_expr_next(expr
);
313 static void nft_rule_expr_deactivate(const struct nft_ctx
*ctx
,
314 struct nft_rule
*rule
,
315 enum nft_trans_phase phase
)
317 struct nft_expr
*expr
;
319 expr
= nft_expr_first(rule
);
320 while (nft_expr_more(rule
, expr
)) {
321 if (expr
->ops
->deactivate
)
322 expr
->ops
->deactivate(ctx
, expr
, phase
);
324 expr
= nft_expr_next(expr
);
329 nf_tables_delrule_deactivate(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
331 /* You cannot delete the same rule twice */
332 if (nft_is_active_next(ctx
->net
, rule
)) {
333 nft_deactivate_next(ctx
->net
, rule
);
340 static struct nft_trans
*nft_trans_rule_add(struct nft_ctx
*ctx
, int msg_type
,
341 struct nft_rule
*rule
)
343 struct nft_trans
*trans
;
345 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_rule
));
349 if (msg_type
== NFT_MSG_NEWRULE
&& ctx
->nla
[NFTA_RULE_ID
] != NULL
) {
350 nft_trans_rule_id(trans
) =
351 ntohl(nla_get_be32(ctx
->nla
[NFTA_RULE_ID
]));
353 nft_trans_rule(trans
) = rule
;
354 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
359 static int nft_delrule(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
361 struct nft_flow_rule
*flow
;
362 struct nft_trans
*trans
;
365 trans
= nft_trans_rule_add(ctx
, NFT_MSG_DELRULE
, rule
);
369 if (ctx
->chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
370 flow
= nft_flow_rule_create(ctx
->net
, rule
);
372 nft_trans_destroy(trans
);
373 return PTR_ERR(flow
);
376 nft_trans_flow_rule(trans
) = flow
;
379 err
= nf_tables_delrule_deactivate(ctx
, rule
);
381 nft_trans_destroy(trans
);
384 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_PREPARE
);
389 static int nft_delrule_by_chain(struct nft_ctx
*ctx
)
391 struct nft_rule
*rule
;
394 list_for_each_entry(rule
, &ctx
->chain
->rules
, list
) {
395 if (!nft_is_active_next(ctx
->net
, rule
))
398 err
= nft_delrule(ctx
, rule
);
405 static int nft_trans_set_add(const struct nft_ctx
*ctx
, int msg_type
,
408 struct nft_trans
*trans
;
410 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_set
));
414 if (msg_type
== NFT_MSG_NEWSET
&& ctx
->nla
[NFTA_SET_ID
] != NULL
) {
415 nft_trans_set_id(trans
) =
416 ntohl(nla_get_be32(ctx
->nla
[NFTA_SET_ID
]));
417 nft_activate_next(ctx
->net
, set
);
419 nft_trans_set(trans
) = set
;
420 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
425 static int nft_delset(const struct nft_ctx
*ctx
, struct nft_set
*set
)
429 err
= nft_trans_set_add(ctx
, NFT_MSG_DELSET
, set
);
433 nft_deactivate_next(ctx
->net
, set
);
439 static int nft_trans_obj_add(struct nft_ctx
*ctx
, int msg_type
,
440 struct nft_object
*obj
)
442 struct nft_trans
*trans
;
444 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_obj
));
448 if (msg_type
== NFT_MSG_NEWOBJ
)
449 nft_activate_next(ctx
->net
, obj
);
451 nft_trans_obj(trans
) = obj
;
452 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
457 static int nft_delobj(struct nft_ctx
*ctx
, struct nft_object
*obj
)
461 err
= nft_trans_obj_add(ctx
, NFT_MSG_DELOBJ
, obj
);
465 nft_deactivate_next(ctx
->net
, obj
);
471 static int nft_trans_flowtable_add(struct nft_ctx
*ctx
, int msg_type
,
472 struct nft_flowtable
*flowtable
)
474 struct nft_trans
*trans
;
476 trans
= nft_trans_alloc(ctx
, msg_type
,
477 sizeof(struct nft_trans_flowtable
));
481 if (msg_type
== NFT_MSG_NEWFLOWTABLE
)
482 nft_activate_next(ctx
->net
, flowtable
);
484 nft_trans_flowtable(trans
) = flowtable
;
485 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
490 static int nft_delflowtable(struct nft_ctx
*ctx
,
491 struct nft_flowtable
*flowtable
)
495 err
= nft_trans_flowtable_add(ctx
, NFT_MSG_DELFLOWTABLE
, flowtable
);
499 nft_deactivate_next(ctx
->net
, flowtable
);
509 static struct nft_table
*nft_table_lookup(const struct net
*net
,
510 const struct nlattr
*nla
,
511 u8 family
, u8 genmask
, u32 nlpid
)
513 struct nft_table
*table
;
516 return ERR_PTR(-EINVAL
);
518 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
,
519 lockdep_is_held(&net
->nft
.commit_mutex
)) {
520 if (!nla_strcmp(nla
, table
->name
) &&
521 table
->family
== family
&&
522 nft_active_genmask(table
, genmask
)) {
523 if (nft_table_has_owner(table
) &&
524 table
->nlpid
!= nlpid
)
525 return ERR_PTR(-EPERM
);
531 return ERR_PTR(-ENOENT
);
534 static struct nft_table
*nft_table_lookup_byhandle(const struct net
*net
,
535 const struct nlattr
*nla
,
538 struct nft_table
*table
;
540 list_for_each_entry(table
, &net
->nft
.tables
, list
) {
541 if (be64_to_cpu(nla_get_be64(nla
)) == table
->handle
&&
542 nft_active_genmask(table
, genmask
))
546 return ERR_PTR(-ENOENT
);
549 static inline u64
nf_tables_alloc_handle(struct nft_table
*table
)
551 return ++table
->hgenerator
;
554 static const struct nft_chain_type
*chain_type
[NFPROTO_NUMPROTO
][NFT_CHAIN_T_MAX
];
556 static const struct nft_chain_type
*
557 __nft_chain_type_get(u8 family
, enum nft_chain_types type
)
559 if (family
>= NFPROTO_NUMPROTO
||
560 type
>= NFT_CHAIN_T_MAX
)
563 return chain_type
[family
][type
];
566 static const struct nft_chain_type
*
567 __nf_tables_chain_type_lookup(const struct nlattr
*nla
, u8 family
)
569 const struct nft_chain_type
*type
;
572 for (i
= 0; i
< NFT_CHAIN_T_MAX
; i
++) {
573 type
= __nft_chain_type_get(family
, i
);
576 if (!nla_strcmp(nla
, type
->name
))
582 struct nft_module_request
{
583 struct list_head list
;
584 char module
[MODULE_NAME_LEN
];
588 #ifdef CONFIG_MODULES
589 static __printf(2, 3) int nft_request_module(struct net
*net
, const char *fmt
,
592 char module_name
[MODULE_NAME_LEN
];
593 struct nft_module_request
*req
;
598 ret
= vsnprintf(module_name
, MODULE_NAME_LEN
, fmt
, args
);
600 if (ret
>= MODULE_NAME_LEN
)
603 list_for_each_entry(req
, &net
->nft
.module_list
, list
) {
604 if (!strcmp(req
->module
, module_name
)) {
608 /* A request to load this module already exists. */
613 req
= kmalloc(sizeof(*req
), GFP_KERNEL
);
618 strlcpy(req
->module
, module_name
, MODULE_NAME_LEN
);
619 list_add_tail(&req
->list
, &net
->nft
.module_list
);
625 static void lockdep_nfnl_nft_mutex_not_held(void)
627 #ifdef CONFIG_PROVE_LOCKING
629 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES
));
633 static const struct nft_chain_type
*
634 nf_tables_chain_type_lookup(struct net
*net
, const struct nlattr
*nla
,
635 u8 family
, bool autoload
)
637 const struct nft_chain_type
*type
;
639 type
= __nf_tables_chain_type_lookup(nla
, family
);
643 lockdep_nfnl_nft_mutex_not_held();
644 #ifdef CONFIG_MODULES
646 if (nft_request_module(net
, "nft-chain-%u-%.*s", family
,
648 (const char *)nla_data(nla
)) == -EAGAIN
)
649 return ERR_PTR(-EAGAIN
);
652 return ERR_PTR(-ENOENT
);
655 static const struct nla_policy nft_table_policy
[NFTA_TABLE_MAX
+ 1] = {
656 [NFTA_TABLE_NAME
] = { .type
= NLA_STRING
,
657 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
658 [NFTA_TABLE_FLAGS
] = { .type
= NLA_U32
},
659 [NFTA_TABLE_HANDLE
] = { .type
= NLA_U64
},
660 [NFTA_TABLE_USERDATA
] = { .type
= NLA_BINARY
,
661 .len
= NFT_USERDATA_MAXLEN
}
664 static int nf_tables_fill_table_info(struct sk_buff
*skb
, struct net
*net
,
665 u32 portid
, u32 seq
, int event
, u32 flags
,
666 int family
, const struct nft_table
*table
)
668 struct nlmsghdr
*nlh
;
669 struct nfgenmsg
*nfmsg
;
671 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
672 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
), flags
);
674 goto nla_put_failure
;
676 nfmsg
= nlmsg_data(nlh
);
677 nfmsg
->nfgen_family
= family
;
678 nfmsg
->version
= NFNETLINK_V0
;
679 nfmsg
->res_id
= htons(net
->nft
.base_seq
& 0xffff);
681 if (nla_put_string(skb
, NFTA_TABLE_NAME
, table
->name
) ||
682 nla_put_be32(skb
, NFTA_TABLE_FLAGS
, htonl(table
->flags
)) ||
683 nla_put_be32(skb
, NFTA_TABLE_USE
, htonl(table
->use
)) ||
684 nla_put_be64(skb
, NFTA_TABLE_HANDLE
, cpu_to_be64(table
->handle
),
686 goto nla_put_failure
;
687 if (nft_table_has_owner(table
) &&
688 nla_put_be32(skb
, NFTA_TABLE_OWNER
, htonl(table
->nlpid
)))
689 goto nla_put_failure
;
692 if (nla_put(skb
, NFTA_TABLE_USERDATA
, table
->udlen
, table
->udata
))
693 goto nla_put_failure
;
700 nlmsg_trim(skb
, nlh
);
704 struct nftnl_skb_parms
{
707 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb))
709 static void nft_notify_enqueue(struct sk_buff
*skb
, bool report
,
710 struct list_head
*notify_list
)
712 NFT_CB(skb
).report
= report
;
713 list_add_tail(&skb
->list
, notify_list
);
716 static void nf_tables_table_notify(const struct nft_ctx
*ctx
, int event
)
720 char *buf
= kasprintf(GFP_KERNEL
, "%s:%llu;?:0",
721 ctx
->table
->name
, ctx
->table
->handle
);
726 event
== NFT_MSG_NEWTABLE
?
727 AUDIT_NFT_OP_TABLE_REGISTER
:
728 AUDIT_NFT_OP_TABLE_UNREGISTER
,
733 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
736 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
740 err
= nf_tables_fill_table_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
741 event
, 0, ctx
->family
, ctx
->table
);
747 nft_notify_enqueue(skb
, ctx
->report
, &ctx
->net
->nft
.notify_list
);
750 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
753 static int nf_tables_dump_tables(struct sk_buff
*skb
,
754 struct netlink_callback
*cb
)
756 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
757 const struct nft_table
*table
;
758 unsigned int idx
= 0, s_idx
= cb
->args
[0];
759 struct net
*net
= sock_net(skb
->sk
);
760 int family
= nfmsg
->nfgen_family
;
763 cb
->seq
= net
->nft
.base_seq
;
765 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
) {
766 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
772 memset(&cb
->args
[1], 0,
773 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
774 if (!nft_is_active(net
, table
))
776 if (nf_tables_fill_table_info(skb
, net
,
777 NETLINK_CB(cb
->skb
).portid
,
779 NFT_MSG_NEWTABLE
, NLM_F_MULTI
,
780 table
->family
, table
) < 0)
783 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
793 static int nft_netlink_dump_start_rcu(struct sock
*nlsk
, struct sk_buff
*skb
,
794 const struct nlmsghdr
*nlh
,
795 struct netlink_dump_control
*c
)
799 if (!try_module_get(THIS_MODULE
))
803 err
= netlink_dump_start(nlsk
, skb
, nlh
, c
);
805 module_put(THIS_MODULE
);
810 /* called with rcu_read_lock held */
811 static int nf_tables_gettable(struct net
*net
, struct sock
*nlsk
,
812 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
813 const struct nlattr
* const nla
[],
814 struct netlink_ext_ack
*extack
)
816 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
817 u8 genmask
= nft_genmask_cur(net
);
818 const struct nft_table
*table
;
819 struct sk_buff
*skb2
;
820 int family
= nfmsg
->nfgen_family
;
823 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
824 struct netlink_dump_control c
= {
825 .dump
= nf_tables_dump_tables
,
826 .module
= THIS_MODULE
,
829 return nft_netlink_dump_start_rcu(nlsk
, skb
, nlh
, &c
);
832 table
= nft_table_lookup(net
, nla
[NFTA_TABLE_NAME
], family
, genmask
, 0);
834 NL_SET_BAD_ATTR(extack
, nla
[NFTA_TABLE_NAME
]);
835 return PTR_ERR(table
);
838 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
842 err
= nf_tables_fill_table_info(skb2
, net
, NETLINK_CB(skb
).portid
,
843 nlh
->nlmsg_seq
, NFT_MSG_NEWTABLE
, 0,
846 goto err_fill_table_info
;
848 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
855 static void nft_table_disable(struct net
*net
, struct nft_table
*table
, u32 cnt
)
857 struct nft_chain
*chain
;
860 list_for_each_entry(chain
, &table
->chains
, list
) {
861 if (!nft_is_active_next(net
, chain
))
863 if (!nft_is_base_chain(chain
))
866 if (cnt
&& i
++ == cnt
)
869 nf_tables_unregister_hook(net
, table
, chain
);
873 static int nf_tables_table_enable(struct net
*net
, struct nft_table
*table
)
875 struct nft_chain
*chain
;
878 list_for_each_entry(chain
, &table
->chains
, list
) {
879 if (!nft_is_active_next(net
, chain
))
881 if (!nft_is_base_chain(chain
))
884 err
= nf_tables_register_hook(net
, table
, chain
);
886 goto err_register_hooks
;
894 nft_table_disable(net
, table
, i
);
898 static void nf_tables_table_disable(struct net
*net
, struct nft_table
*table
)
900 nft_table_disable(net
, table
, 0);
903 static int nf_tables_updtable(struct nft_ctx
*ctx
)
905 struct nft_trans
*trans
;
909 if (!ctx
->nla
[NFTA_TABLE_FLAGS
])
912 flags
= ntohl(nla_get_be32(ctx
->nla
[NFTA_TABLE_FLAGS
]));
913 if (flags
& ~NFT_TABLE_F_MASK
)
916 if (flags
== ctx
->table
->flags
)
919 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWTABLE
,
920 sizeof(struct nft_trans_table
));
924 if ((flags
& NFT_TABLE_F_DORMANT
) &&
925 !(ctx
->table
->flags
& NFT_TABLE_F_DORMANT
)) {
926 nft_trans_table_enable(trans
) = false;
927 } else if (!(flags
& NFT_TABLE_F_DORMANT
) &&
928 ctx
->table
->flags
& NFT_TABLE_F_DORMANT
) {
929 ctx
->table
->flags
&= ~NFT_TABLE_F_DORMANT
;
930 ret
= nf_tables_table_enable(ctx
->net
, ctx
->table
);
932 nft_trans_table_enable(trans
) = true;
934 ctx
->table
->flags
|= NFT_TABLE_F_DORMANT
;
939 nft_trans_table_update(trans
) = true;
940 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
943 nft_trans_destroy(trans
);
947 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
)
949 const char *name
= data
;
951 return jhash(name
, strlen(name
), seed
);
954 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
)
956 const struct nft_chain
*chain
= data
;
958 return nft_chain_hash(chain
->name
, 0, seed
);
961 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*arg
,
964 const struct nft_chain
*chain
= ptr
;
965 const char *name
= arg
->key
;
967 return strcmp(chain
->name
, name
);
970 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
)
972 const struct nft_object_hash_key
*k
= data
;
974 seed
^= hash_ptr(k
->table
, 32);
976 return jhash(k
->name
, strlen(k
->name
), seed
);
979 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
)
981 const struct nft_object
*obj
= data
;
983 return nft_objname_hash(&obj
->key
, 0, seed
);
986 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*arg
,
989 const struct nft_object_hash_key
*k
= arg
->key
;
990 const struct nft_object
*obj
= ptr
;
992 if (obj
->key
.table
!= k
->table
)
995 return strcmp(obj
->key
.name
, k
->name
);
998 static int nf_tables_newtable(struct net
*net
, struct sock
*nlsk
,
999 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
1000 const struct nlattr
* const nla
[],
1001 struct netlink_ext_ack
*extack
)
1003 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
1004 u8 genmask
= nft_genmask_next(net
);
1005 int family
= nfmsg
->nfgen_family
;
1006 const struct nlattr
*attr
;
1007 struct nft_table
*table
;
1012 lockdep_assert_held(&net
->nft
.commit_mutex
);
1013 attr
= nla
[NFTA_TABLE_NAME
];
1014 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1015 NETLINK_CB(skb
).portid
);
1016 if (IS_ERR(table
)) {
1017 if (PTR_ERR(table
) != -ENOENT
)
1018 return PTR_ERR(table
);
1020 if (nlh
->nlmsg_flags
& NLM_F_EXCL
) {
1021 NL_SET_BAD_ATTR(extack
, attr
);
1024 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
)
1027 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
1028 return nf_tables_updtable(&ctx
);
1031 if (nla
[NFTA_TABLE_FLAGS
]) {
1032 flags
= ntohl(nla_get_be32(nla
[NFTA_TABLE_FLAGS
]));
1033 if (flags
& ~NFT_TABLE_F_MASK
)
1038 table
= kzalloc(sizeof(*table
), GFP_KERNEL
);
1042 table
->name
= nla_strdup(attr
, GFP_KERNEL
);
1043 if (table
->name
== NULL
)
1046 if (nla
[NFTA_TABLE_USERDATA
]) {
1047 table
->udata
= nla_memdup(nla
[NFTA_TABLE_USERDATA
], GFP_KERNEL
);
1048 if (table
->udata
== NULL
)
1049 goto err_table_udata
;
1051 table
->udlen
= nla_len(nla
[NFTA_TABLE_USERDATA
]);
1054 err
= rhltable_init(&table
->chains_ht
, &nft_chain_ht_params
);
1058 INIT_LIST_HEAD(&table
->chains
);
1059 INIT_LIST_HEAD(&table
->sets
);
1060 INIT_LIST_HEAD(&table
->objects
);
1061 INIT_LIST_HEAD(&table
->flowtables
);
1062 table
->family
= family
;
1063 table
->flags
= flags
;
1064 table
->handle
= ++table_handle
;
1065 if (table
->flags
& NFT_TABLE_F_OWNER
)
1066 table
->nlpid
= NETLINK_CB(skb
).portid
;
1068 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
1069 err
= nft_trans_table_add(&ctx
, NFT_MSG_NEWTABLE
);
1073 list_add_tail_rcu(&table
->list
, &net
->nft
.tables
);
1076 rhltable_destroy(&table
->chains_ht
);
1078 kfree(table
->udata
);
1087 static int nft_flush_table(struct nft_ctx
*ctx
)
1089 struct nft_flowtable
*flowtable
, *nft
;
1090 struct nft_chain
*chain
, *nc
;
1091 struct nft_object
*obj
, *ne
;
1092 struct nft_set
*set
, *ns
;
1095 list_for_each_entry(chain
, &ctx
->table
->chains
, list
) {
1096 if (!nft_is_active_next(ctx
->net
, chain
))
1099 if (nft_chain_is_bound(chain
))
1104 err
= nft_delrule_by_chain(ctx
);
1109 list_for_each_entry_safe(set
, ns
, &ctx
->table
->sets
, list
) {
1110 if (!nft_is_active_next(ctx
->net
, set
))
1113 if (nft_set_is_anonymous(set
) &&
1114 !list_empty(&set
->bindings
))
1117 err
= nft_delset(ctx
, set
);
1122 list_for_each_entry_safe(flowtable
, nft
, &ctx
->table
->flowtables
, list
) {
1123 if (!nft_is_active_next(ctx
->net
, flowtable
))
1126 err
= nft_delflowtable(ctx
, flowtable
);
1131 list_for_each_entry_safe(obj
, ne
, &ctx
->table
->objects
, list
) {
1132 if (!nft_is_active_next(ctx
->net
, obj
))
1135 err
= nft_delobj(ctx
, obj
);
1140 list_for_each_entry_safe(chain
, nc
, &ctx
->table
->chains
, list
) {
1141 if (!nft_is_active_next(ctx
->net
, chain
))
1144 if (nft_chain_is_bound(chain
))
1149 err
= nft_delchain(ctx
);
1154 err
= nft_deltable(ctx
);
1159 static int nft_flush(struct nft_ctx
*ctx
, int family
)
1161 struct nft_table
*table
, *nt
;
1162 const struct nlattr
* const *nla
= ctx
->nla
;
1165 list_for_each_entry_safe(table
, nt
, &ctx
->net
->nft
.tables
, list
) {
1166 if (family
!= AF_UNSPEC
&& table
->family
!= family
)
1169 ctx
->family
= table
->family
;
1171 if (!nft_is_active_next(ctx
->net
, table
))
1174 if (nft_table_has_owner(table
) && table
->nlpid
!= ctx
->portid
)
1177 if (nla
[NFTA_TABLE_NAME
] &&
1178 nla_strcmp(nla
[NFTA_TABLE_NAME
], table
->name
) != 0)
1183 err
= nft_flush_table(ctx
);
1191 static int nf_tables_deltable(struct net
*net
, struct sock
*nlsk
,
1192 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
1193 const struct nlattr
* const nla
[],
1194 struct netlink_ext_ack
*extack
)
1196 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
1197 u8 genmask
= nft_genmask_next(net
);
1198 int family
= nfmsg
->nfgen_family
;
1199 const struct nlattr
*attr
;
1200 struct nft_table
*table
;
1203 nft_ctx_init(&ctx
, net
, skb
, nlh
, 0, NULL
, NULL
, nla
);
1204 if (family
== AF_UNSPEC
||
1205 (!nla
[NFTA_TABLE_NAME
] && !nla
[NFTA_TABLE_HANDLE
]))
1206 return nft_flush(&ctx
, family
);
1208 if (nla
[NFTA_TABLE_HANDLE
]) {
1209 attr
= nla
[NFTA_TABLE_HANDLE
];
1210 table
= nft_table_lookup_byhandle(net
, attr
, genmask
);
1212 attr
= nla
[NFTA_TABLE_NAME
];
1213 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1214 NETLINK_CB(skb
).portid
);
1217 if (IS_ERR(table
)) {
1218 NL_SET_BAD_ATTR(extack
, attr
);
1219 return PTR_ERR(table
);
1222 if (nlh
->nlmsg_flags
& NLM_F_NONREC
&&
1226 ctx
.family
= family
;
1229 return nft_flush_table(&ctx
);
1232 static void nf_tables_table_destroy(struct nft_ctx
*ctx
)
1234 if (WARN_ON(ctx
->table
->use
> 0))
1237 rhltable_destroy(&ctx
->table
->chains_ht
);
1238 kfree(ctx
->table
->name
);
1239 kfree(ctx
->table
->udata
);
1243 void nft_register_chain_type(const struct nft_chain_type
*ctype
)
1245 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1246 if (WARN_ON(__nft_chain_type_get(ctype
->family
, ctype
->type
))) {
1247 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1250 chain_type
[ctype
->family
][ctype
->type
] = ctype
;
1251 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1253 EXPORT_SYMBOL_GPL(nft_register_chain_type
);
1255 void nft_unregister_chain_type(const struct nft_chain_type
*ctype
)
1257 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1258 chain_type
[ctype
->family
][ctype
->type
] = NULL
;
1259 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1261 EXPORT_SYMBOL_GPL(nft_unregister_chain_type
);
1267 static struct nft_chain
*
1268 nft_chain_lookup_byhandle(const struct nft_table
*table
, u64 handle
, u8 genmask
)
1270 struct nft_chain
*chain
;
1272 list_for_each_entry(chain
, &table
->chains
, list
) {
1273 if (chain
->handle
== handle
&&
1274 nft_active_genmask(chain
, genmask
))
1278 return ERR_PTR(-ENOENT
);
1281 static bool lockdep_commit_lock_is_held(const struct net
*net
)
1283 #ifdef CONFIG_PROVE_LOCKING
1284 return lockdep_is_held(&net
->nft
.commit_mutex
);
1290 static struct nft_chain
*nft_chain_lookup(struct net
*net
,
1291 struct nft_table
*table
,
1292 const struct nlattr
*nla
, u8 genmask
)
1294 char search
[NFT_CHAIN_MAXNAMELEN
+ 1];
1295 struct rhlist_head
*tmp
, *list
;
1296 struct nft_chain
*chain
;
1299 return ERR_PTR(-EINVAL
);
1301 nla_strscpy(search
, nla
, sizeof(search
));
1303 WARN_ON(!rcu_read_lock_held() &&
1304 !lockdep_commit_lock_is_held(net
));
1306 chain
= ERR_PTR(-ENOENT
);
1308 list
= rhltable_lookup(&table
->chains_ht
, search
, nft_chain_ht_params
);
1312 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
1313 if (nft_active_genmask(chain
, genmask
))
1316 chain
= ERR_PTR(-ENOENT
);
1322 static const struct nla_policy nft_chain_policy
[NFTA_CHAIN_MAX
+ 1] = {
1323 [NFTA_CHAIN_TABLE
] = { .type
= NLA_STRING
,
1324 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
1325 [NFTA_CHAIN_HANDLE
] = { .type
= NLA_U64
},
1326 [NFTA_CHAIN_NAME
] = { .type
= NLA_STRING
,
1327 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
1328 [NFTA_CHAIN_HOOK
] = { .type
= NLA_NESTED
},
1329 [NFTA_CHAIN_POLICY
] = { .type
= NLA_U32
},
1330 [NFTA_CHAIN_TYPE
] = { .type
= NLA_STRING
,
1331 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
1332 [NFTA_CHAIN_COUNTERS
] = { .type
= NLA_NESTED
},
1333 [NFTA_CHAIN_FLAGS
] = { .type
= NLA_U32
},
1334 [NFTA_CHAIN_ID
] = { .type
= NLA_U32
},
1335 [NFTA_CHAIN_USERDATA
] = { .type
= NLA_BINARY
,
1336 .len
= NFT_USERDATA_MAXLEN
},
1339 static const struct nla_policy nft_hook_policy
[NFTA_HOOK_MAX
+ 1] = {
1340 [NFTA_HOOK_HOOKNUM
] = { .type
= NLA_U32
},
1341 [NFTA_HOOK_PRIORITY
] = { .type
= NLA_U32
},
1342 [NFTA_HOOK_DEV
] = { .type
= NLA_STRING
,
1343 .len
= IFNAMSIZ
- 1 },
1346 static int nft_dump_stats(struct sk_buff
*skb
, struct nft_stats __percpu
*stats
)
1348 struct nft_stats
*cpu_stats
, total
;
1349 struct nlattr
*nest
;
1357 memset(&total
, 0, sizeof(total
));
1358 for_each_possible_cpu(cpu
) {
1359 cpu_stats
= per_cpu_ptr(stats
, cpu
);
1361 seq
= u64_stats_fetch_begin_irq(&cpu_stats
->syncp
);
1362 pkts
= cpu_stats
->pkts
;
1363 bytes
= cpu_stats
->bytes
;
1364 } while (u64_stats_fetch_retry_irq(&cpu_stats
->syncp
, seq
));
1366 total
.bytes
+= bytes
;
1368 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_COUNTERS
);
1370 goto nla_put_failure
;
1372 if (nla_put_be64(skb
, NFTA_COUNTER_PACKETS
, cpu_to_be64(total
.pkts
),
1373 NFTA_COUNTER_PAD
) ||
1374 nla_put_be64(skb
, NFTA_COUNTER_BYTES
, cpu_to_be64(total
.bytes
),
1376 goto nla_put_failure
;
1378 nla_nest_end(skb
, nest
);
1385 static int nft_dump_basechain_hook(struct sk_buff
*skb
, int family
,
1386 const struct nft_base_chain
*basechain
)
1388 const struct nf_hook_ops
*ops
= &basechain
->ops
;
1389 struct nft_hook
*hook
, *first
= NULL
;
1390 struct nlattr
*nest
, *nest_devs
;
1393 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_HOOK
);
1395 goto nla_put_failure
;
1396 if (nla_put_be32(skb
, NFTA_HOOK_HOOKNUM
, htonl(ops
->hooknum
)))
1397 goto nla_put_failure
;
1398 if (nla_put_be32(skb
, NFTA_HOOK_PRIORITY
, htonl(ops
->priority
)))
1399 goto nla_put_failure
;
1401 if (nft_base_chain_netdev(family
, ops
->hooknum
)) {
1402 nest_devs
= nla_nest_start_noflag(skb
, NFTA_HOOK_DEVS
);
1403 list_for_each_entry(hook
, &basechain
->hook_list
, list
) {
1407 if (nla_put_string(skb
, NFTA_DEVICE_NAME
,
1408 hook
->ops
.dev
->name
))
1409 goto nla_put_failure
;
1412 nla_nest_end(skb
, nest_devs
);
1415 nla_put_string(skb
, NFTA_HOOK_DEV
, first
->ops
.dev
->name
))
1416 goto nla_put_failure
;
1418 nla_nest_end(skb
, nest
);
1425 static int nf_tables_fill_chain_info(struct sk_buff
*skb
, struct net
*net
,
1426 u32 portid
, u32 seq
, int event
, u32 flags
,
1427 int family
, const struct nft_table
*table
,
1428 const struct nft_chain
*chain
)
1430 struct nlmsghdr
*nlh
;
1431 struct nfgenmsg
*nfmsg
;
1433 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
1434 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
), flags
);
1436 goto nla_put_failure
;
1438 nfmsg
= nlmsg_data(nlh
);
1439 nfmsg
->nfgen_family
= family
;
1440 nfmsg
->version
= NFNETLINK_V0
;
1441 nfmsg
->res_id
= htons(net
->nft
.base_seq
& 0xffff);
1443 if (nla_put_string(skb
, NFTA_CHAIN_TABLE
, table
->name
))
1444 goto nla_put_failure
;
1445 if (nla_put_be64(skb
, NFTA_CHAIN_HANDLE
, cpu_to_be64(chain
->handle
),
1447 goto nla_put_failure
;
1448 if (nla_put_string(skb
, NFTA_CHAIN_NAME
, chain
->name
))
1449 goto nla_put_failure
;
1451 if (nft_is_base_chain(chain
)) {
1452 const struct nft_base_chain
*basechain
= nft_base_chain(chain
);
1453 struct nft_stats __percpu
*stats
;
1455 if (nft_dump_basechain_hook(skb
, family
, basechain
))
1456 goto nla_put_failure
;
1458 if (nla_put_be32(skb
, NFTA_CHAIN_POLICY
,
1459 htonl(basechain
->policy
)))
1460 goto nla_put_failure
;
1462 if (nla_put_string(skb
, NFTA_CHAIN_TYPE
, basechain
->type
->name
))
1463 goto nla_put_failure
;
1465 stats
= rcu_dereference_check(basechain
->stats
,
1466 lockdep_commit_lock_is_held(net
));
1467 if (nft_dump_stats(skb
, stats
))
1468 goto nla_put_failure
;
1472 nla_put_be32(skb
, NFTA_CHAIN_FLAGS
, htonl(chain
->flags
)))
1473 goto nla_put_failure
;
1475 if (nla_put_be32(skb
, NFTA_CHAIN_USE
, htonl(chain
->use
)))
1476 goto nla_put_failure
;
1479 nla_put(skb
, NFTA_CHAIN_USERDATA
, chain
->udlen
, chain
->udata
))
1480 goto nla_put_failure
;
1482 nlmsg_end(skb
, nlh
);
1486 nlmsg_trim(skb
, nlh
);
1490 static void nf_tables_chain_notify(const struct nft_ctx
*ctx
, int event
)
1492 struct sk_buff
*skb
;
1494 char *buf
= kasprintf(GFP_KERNEL
, "%s:%llu;%s:%llu",
1495 ctx
->table
->name
, ctx
->table
->handle
,
1496 ctx
->chain
->name
, ctx
->chain
->handle
);
1498 audit_log_nfcfg(buf
,
1501 event
== NFT_MSG_NEWCHAIN
?
1502 AUDIT_NFT_OP_CHAIN_REGISTER
:
1503 AUDIT_NFT_OP_CHAIN_UNREGISTER
,
1508 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
1511 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
1515 err
= nf_tables_fill_chain_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
1516 event
, 0, ctx
->family
, ctx
->table
,
1523 nft_notify_enqueue(skb
, ctx
->report
, &ctx
->net
->nft
.notify_list
);
1526 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
1529 static int nf_tables_dump_chains(struct sk_buff
*skb
,
1530 struct netlink_callback
*cb
)
1532 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1533 const struct nft_table
*table
;
1534 const struct nft_chain
*chain
;
1535 unsigned int idx
= 0, s_idx
= cb
->args
[0];
1536 struct net
*net
= sock_net(skb
->sk
);
1537 int family
= nfmsg
->nfgen_family
;
1540 cb
->seq
= net
->nft
.base_seq
;
1542 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
) {
1543 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
1546 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
1550 memset(&cb
->args
[1], 0,
1551 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
1552 if (!nft_is_active(net
, chain
))
1554 if (nf_tables_fill_chain_info(skb
, net
,
1555 NETLINK_CB(cb
->skb
).portid
,
1559 table
->family
, table
,
1563 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
1574 /* called with rcu_read_lock held */
1575 static int nf_tables_getchain(struct net
*net
, struct sock
*nlsk
,
1576 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
1577 const struct nlattr
* const nla
[],
1578 struct netlink_ext_ack
*extack
)
1580 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
1581 u8 genmask
= nft_genmask_cur(net
);
1582 const struct nft_chain
*chain
;
1583 struct nft_table
*table
;
1584 struct sk_buff
*skb2
;
1585 int family
= nfmsg
->nfgen_family
;
1588 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1589 struct netlink_dump_control c
= {
1590 .dump
= nf_tables_dump_chains
,
1591 .module
= THIS_MODULE
,
1594 return nft_netlink_dump_start_rcu(nlsk
, skb
, nlh
, &c
);
1597 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
, 0);
1598 if (IS_ERR(table
)) {
1599 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
1600 return PTR_ERR(table
);
1603 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_CHAIN_NAME
], genmask
);
1604 if (IS_ERR(chain
)) {
1605 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
1606 return PTR_ERR(chain
);
1609 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
1613 err
= nf_tables_fill_chain_info(skb2
, net
, NETLINK_CB(skb
).portid
,
1614 nlh
->nlmsg_seq
, NFT_MSG_NEWCHAIN
, 0,
1615 family
, table
, chain
);
1617 goto err_fill_chain_info
;
1619 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
1621 err_fill_chain_info
:
1626 static const struct nla_policy nft_counter_policy
[NFTA_COUNTER_MAX
+ 1] = {
1627 [NFTA_COUNTER_PACKETS
] = { .type
= NLA_U64
},
1628 [NFTA_COUNTER_BYTES
] = { .type
= NLA_U64
},
1631 static struct nft_stats __percpu
*nft_stats_alloc(const struct nlattr
*attr
)
1633 struct nlattr
*tb
[NFTA_COUNTER_MAX
+1];
1634 struct nft_stats __percpu
*newstats
;
1635 struct nft_stats
*stats
;
1638 err
= nla_parse_nested_deprecated(tb
, NFTA_COUNTER_MAX
, attr
,
1639 nft_counter_policy
, NULL
);
1641 return ERR_PTR(err
);
1643 if (!tb
[NFTA_COUNTER_BYTES
] || !tb
[NFTA_COUNTER_PACKETS
])
1644 return ERR_PTR(-EINVAL
);
1646 newstats
= netdev_alloc_pcpu_stats(struct nft_stats
);
1647 if (newstats
== NULL
)
1648 return ERR_PTR(-ENOMEM
);
1650 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1651 * are not exposed to userspace.
1654 stats
= this_cpu_ptr(newstats
);
1655 stats
->bytes
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_BYTES
]));
1656 stats
->pkts
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_PACKETS
]));
1662 static void nft_chain_stats_replace(struct nft_trans
*trans
)
1664 struct nft_base_chain
*chain
= nft_base_chain(trans
->ctx
.chain
);
1666 if (!nft_trans_chain_stats(trans
))
1669 nft_trans_chain_stats(trans
) =
1670 rcu_replace_pointer(chain
->stats
, nft_trans_chain_stats(trans
),
1671 lockdep_commit_lock_is_held(trans
->ctx
.net
));
1673 if (!nft_trans_chain_stats(trans
))
1674 static_branch_inc(&nft_counters_enabled
);
1677 static void nf_tables_chain_free_chain_rules(struct nft_chain
*chain
)
1679 struct nft_rule
**g0
= rcu_dereference_raw(chain
->rules_gen_0
);
1680 struct nft_rule
**g1
= rcu_dereference_raw(chain
->rules_gen_1
);
1686 /* should be NULL either via abort or via successful commit */
1687 WARN_ON_ONCE(chain
->rules_next
);
1688 kvfree(chain
->rules_next
);
1691 void nf_tables_chain_destroy(struct nft_ctx
*ctx
)
1693 struct nft_chain
*chain
= ctx
->chain
;
1694 struct nft_hook
*hook
, *next
;
1696 if (WARN_ON(chain
->use
> 0))
1699 /* no concurrent access possible anymore */
1700 nf_tables_chain_free_chain_rules(chain
);
1702 if (nft_is_base_chain(chain
)) {
1703 struct nft_base_chain
*basechain
= nft_base_chain(chain
);
1705 if (nft_base_chain_netdev(ctx
->family
, basechain
->ops
.hooknum
)) {
1706 list_for_each_entry_safe(hook
, next
,
1707 &basechain
->hook_list
, list
) {
1708 list_del_rcu(&hook
->list
);
1709 kfree_rcu(hook
, rcu
);
1712 module_put(basechain
->type
->owner
);
1713 if (rcu_access_pointer(basechain
->stats
)) {
1714 static_branch_dec(&nft_counters_enabled
);
1715 free_percpu(rcu_dereference_raw(basechain
->stats
));
1718 kfree(chain
->udata
);
1722 kfree(chain
->udata
);
1727 static struct nft_hook
*nft_netdev_hook_alloc(struct net
*net
,
1728 const struct nlattr
*attr
)
1730 struct net_device
*dev
;
1731 char ifname
[IFNAMSIZ
];
1732 struct nft_hook
*hook
;
1735 hook
= kmalloc(sizeof(struct nft_hook
), GFP_KERNEL
);
1738 goto err_hook_alloc
;
1741 nla_strscpy(ifname
, attr
, IFNAMSIZ
);
1742 /* nf_tables_netdev_event() is called under rtnl_mutex, this is
1743 * indirectly serializing all the other holders of the commit_mutex with
1746 dev
= __dev_get_by_name(net
, ifname
);
1751 hook
->ops
.dev
= dev
;
1752 hook
->inactive
= false;
1759 return ERR_PTR(err
);
1762 static struct nft_hook
*nft_hook_list_find(struct list_head
*hook_list
,
1763 const struct nft_hook
*this)
1765 struct nft_hook
*hook
;
1767 list_for_each_entry(hook
, hook_list
, list
) {
1768 if (this->ops
.dev
== hook
->ops
.dev
)
1775 static int nf_tables_parse_netdev_hooks(struct net
*net
,
1776 const struct nlattr
*attr
,
1777 struct list_head
*hook_list
)
1779 struct nft_hook
*hook
, *next
;
1780 const struct nlattr
*tmp
;
1781 int rem
, n
= 0, err
;
1783 nla_for_each_nested(tmp
, attr
, rem
) {
1784 if (nla_type(tmp
) != NFTA_DEVICE_NAME
) {
1789 hook
= nft_netdev_hook_alloc(net
, tmp
);
1791 err
= PTR_ERR(hook
);
1794 if (nft_hook_list_find(hook_list
, hook
)) {
1799 list_add_tail(&hook
->list
, hook_list
);
1802 if (n
== NFT_NETDEVICE_MAX
) {
1811 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
1812 list_del(&hook
->list
);
1818 struct nft_chain_hook
{
1821 const struct nft_chain_type
*type
;
1822 struct list_head list
;
1825 static int nft_chain_parse_netdev(struct net
*net
,
1826 struct nlattr
*tb
[],
1827 struct list_head
*hook_list
)
1829 struct nft_hook
*hook
;
1832 if (tb
[NFTA_HOOK_DEV
]) {
1833 hook
= nft_netdev_hook_alloc(net
, tb
[NFTA_HOOK_DEV
]);
1835 return PTR_ERR(hook
);
1837 list_add_tail(&hook
->list
, hook_list
);
1838 } else if (tb
[NFTA_HOOK_DEVS
]) {
1839 err
= nf_tables_parse_netdev_hooks(net
, tb
[NFTA_HOOK_DEVS
],
1844 if (list_empty(hook_list
))
1853 static int nft_chain_parse_hook(struct net
*net
,
1854 const struct nlattr
* const nla
[],
1855 struct nft_chain_hook
*hook
, u8 family
,
1858 struct nlattr
*ha
[NFTA_HOOK_MAX
+ 1];
1859 const struct nft_chain_type
*type
;
1862 lockdep_assert_held(&net
->nft
.commit_mutex
);
1863 lockdep_nfnl_nft_mutex_not_held();
1865 err
= nla_parse_nested_deprecated(ha
, NFTA_HOOK_MAX
,
1866 nla
[NFTA_CHAIN_HOOK
],
1867 nft_hook_policy
, NULL
);
1871 if (ha
[NFTA_HOOK_HOOKNUM
] == NULL
||
1872 ha
[NFTA_HOOK_PRIORITY
] == NULL
)
1875 hook
->num
= ntohl(nla_get_be32(ha
[NFTA_HOOK_HOOKNUM
]));
1876 hook
->priority
= ntohl(nla_get_be32(ha
[NFTA_HOOK_PRIORITY
]));
1878 type
= __nft_chain_type_get(family
, NFT_CHAIN_T_DEFAULT
);
1882 if (nla
[NFTA_CHAIN_TYPE
]) {
1883 type
= nf_tables_chain_type_lookup(net
, nla
[NFTA_CHAIN_TYPE
],
1886 return PTR_ERR(type
);
1888 if (hook
->num
>= NFT_MAX_HOOKS
|| !(type
->hook_mask
& (1 << hook
->num
)))
1891 if (type
->type
== NFT_CHAIN_T_NAT
&&
1892 hook
->priority
<= NF_IP_PRI_CONNTRACK
)
1895 if (!try_module_get(type
->owner
))
1900 INIT_LIST_HEAD(&hook
->list
);
1901 if (nft_base_chain_netdev(family
, hook
->num
)) {
1902 err
= nft_chain_parse_netdev(net
, ha
, &hook
->list
);
1904 module_put(type
->owner
);
1907 } else if (ha
[NFTA_HOOK_DEV
] || ha
[NFTA_HOOK_DEVS
]) {
1908 module_put(type
->owner
);
1915 static void nft_chain_release_hook(struct nft_chain_hook
*hook
)
1917 struct nft_hook
*h
, *next
;
1919 list_for_each_entry_safe(h
, next
, &hook
->list
, list
) {
1923 module_put(hook
->type
->owner
);
1926 struct nft_rules_old
{
1928 struct nft_rule
**start
;
1931 static struct nft_rule
**nf_tables_chain_alloc_rules(const struct nft_chain
*chain
,
1934 if (alloc
> INT_MAX
)
1937 alloc
+= 1; /* NULL, ends rules */
1938 if (sizeof(struct nft_rule
*) > INT_MAX
/ alloc
)
1941 alloc
*= sizeof(struct nft_rule
*);
1942 alloc
+= sizeof(struct nft_rules_old
);
1944 return kvmalloc(alloc
, GFP_KERNEL
);
1947 static void nft_basechain_hook_init(struct nf_hook_ops
*ops
, u8 family
,
1948 const struct nft_chain_hook
*hook
,
1949 struct nft_chain
*chain
)
1952 ops
->hooknum
= hook
->num
;
1953 ops
->priority
= hook
->priority
;
1955 ops
->hook
= hook
->type
->hooks
[ops
->hooknum
];
1958 static int nft_basechain_init(struct nft_base_chain
*basechain
, u8 family
,
1959 struct nft_chain_hook
*hook
, u32 flags
)
1961 struct nft_chain
*chain
;
1964 basechain
->type
= hook
->type
;
1965 INIT_LIST_HEAD(&basechain
->hook_list
);
1966 chain
= &basechain
->chain
;
1968 if (nft_base_chain_netdev(family
, hook
->num
)) {
1969 list_splice_init(&hook
->list
, &basechain
->hook_list
);
1970 list_for_each_entry(h
, &basechain
->hook_list
, list
)
1971 nft_basechain_hook_init(&h
->ops
, family
, hook
, chain
);
1973 basechain
->ops
.hooknum
= hook
->num
;
1974 basechain
->ops
.priority
= hook
->priority
;
1976 nft_basechain_hook_init(&basechain
->ops
, family
, hook
, chain
);
1979 chain
->flags
|= NFT_CHAIN_BASE
| flags
;
1980 basechain
->policy
= NF_ACCEPT
;
1981 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
&&
1982 nft_chain_offload_priority(basechain
) < 0)
1985 flow_block_init(&basechain
->flow_block
);
1990 static int nft_chain_add(struct nft_table
*table
, struct nft_chain
*chain
)
1994 err
= rhltable_insert_key(&table
->chains_ht
, chain
->name
,
1995 &chain
->rhlhead
, nft_chain_ht_params
);
1999 list_add_tail_rcu(&chain
->list
, &table
->chains
);
2004 static u64 chain_id
;
2006 static int nf_tables_addchain(struct nft_ctx
*ctx
, u8 family
, u8 genmask
,
2007 u8 policy
, u32 flags
)
2009 const struct nlattr
* const *nla
= ctx
->nla
;
2010 struct nft_table
*table
= ctx
->table
;
2011 struct nft_base_chain
*basechain
;
2012 struct nft_stats __percpu
*stats
;
2013 struct net
*net
= ctx
->net
;
2014 char name
[NFT_NAME_MAXLEN
];
2015 struct nft_trans
*trans
;
2016 struct nft_chain
*chain
;
2017 struct nft_rule
**rules
;
2020 if (table
->use
== UINT_MAX
)
2023 if (nla
[NFTA_CHAIN_HOOK
]) {
2024 struct nft_chain_hook hook
;
2026 if (flags
& NFT_CHAIN_BINDING
)
2029 err
= nft_chain_parse_hook(net
, nla
, &hook
, family
, true);
2033 basechain
= kzalloc(sizeof(*basechain
), GFP_KERNEL
);
2034 if (basechain
== NULL
) {
2035 nft_chain_release_hook(&hook
);
2038 chain
= &basechain
->chain
;
2040 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2041 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2042 if (IS_ERR(stats
)) {
2043 nft_chain_release_hook(&hook
);
2045 return PTR_ERR(stats
);
2047 rcu_assign_pointer(basechain
->stats
, stats
);
2048 static_branch_inc(&nft_counters_enabled
);
2051 err
= nft_basechain_init(basechain
, family
, &hook
, flags
);
2053 nft_chain_release_hook(&hook
);
2058 if (flags
& NFT_CHAIN_BASE
)
2060 if (flags
& NFT_CHAIN_HW_OFFLOAD
)
2063 chain
= kzalloc(sizeof(*chain
), GFP_KERNEL
);
2067 chain
->flags
= flags
;
2071 INIT_LIST_HEAD(&chain
->rules
);
2072 chain
->handle
= nf_tables_alloc_handle(table
);
2073 chain
->table
= table
;
2075 if (nla
[NFTA_CHAIN_NAME
]) {
2076 chain
->name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL
);
2078 if (!(flags
& NFT_CHAIN_BINDING
)) {
2080 goto err_destroy_chain
;
2083 snprintf(name
, sizeof(name
), "__chain%llu", ++chain_id
);
2084 chain
->name
= kstrdup(name
, GFP_KERNEL
);
2089 goto err_destroy_chain
;
2092 if (nla
[NFTA_CHAIN_USERDATA
]) {
2093 chain
->udata
= nla_memdup(nla
[NFTA_CHAIN_USERDATA
], GFP_KERNEL
);
2094 if (chain
->udata
== NULL
) {
2096 goto err_destroy_chain
;
2098 chain
->udlen
= nla_len(nla
[NFTA_CHAIN_USERDATA
]);
2101 rules
= nf_tables_chain_alloc_rules(chain
, 0);
2104 goto err_destroy_chain
;
2108 rcu_assign_pointer(chain
->rules_gen_0
, rules
);
2109 rcu_assign_pointer(chain
->rules_gen_1
, rules
);
2111 err
= nf_tables_register_hook(net
, table
, chain
);
2113 goto err_destroy_chain
;
2115 trans
= nft_trans_chain_add(ctx
, NFT_MSG_NEWCHAIN
);
2116 if (IS_ERR(trans
)) {
2117 err
= PTR_ERR(trans
);
2118 goto err_unregister_hook
;
2121 nft_trans_chain_policy(trans
) = NFT_CHAIN_POLICY_UNSET
;
2122 if (nft_is_base_chain(chain
))
2123 nft_trans_chain_policy(trans
) = policy
;
2125 err
= nft_chain_add(table
, chain
);
2127 nft_trans_destroy(trans
);
2128 goto err_unregister_hook
;
2134 err_unregister_hook
:
2135 nf_tables_unregister_hook(net
, table
, chain
);
2137 nf_tables_chain_destroy(ctx
);
2142 static bool nft_hook_list_equal(struct list_head
*hook_list1
,
2143 struct list_head
*hook_list2
)
2145 struct nft_hook
*hook
;
2149 list_for_each_entry(hook
, hook_list2
, list
) {
2150 if (!nft_hook_list_find(hook_list1
, hook
))
2155 list_for_each_entry(hook
, hook_list1
, list
)
2161 static int nf_tables_updchain(struct nft_ctx
*ctx
, u8 genmask
, u8 policy
,
2162 u32 flags
, const struct nlattr
*attr
,
2163 struct netlink_ext_ack
*extack
)
2165 const struct nlattr
* const *nla
= ctx
->nla
;
2166 struct nft_table
*table
= ctx
->table
;
2167 struct nft_chain
*chain
= ctx
->chain
;
2168 struct nft_base_chain
*basechain
;
2169 struct nft_stats
*stats
= NULL
;
2170 struct nft_chain_hook hook
;
2171 struct nf_hook_ops
*ops
;
2172 struct nft_trans
*trans
;
2175 if (chain
->flags
^ flags
)
2178 if (nla
[NFTA_CHAIN_HOOK
]) {
2179 if (!nft_is_base_chain(chain
)) {
2180 NL_SET_BAD_ATTR(extack
, attr
);
2183 err
= nft_chain_parse_hook(ctx
->net
, nla
, &hook
, ctx
->family
,
2188 basechain
= nft_base_chain(chain
);
2189 if (basechain
->type
!= hook
.type
) {
2190 nft_chain_release_hook(&hook
);
2191 NL_SET_BAD_ATTR(extack
, attr
);
2195 if (nft_base_chain_netdev(ctx
->family
, hook
.num
)) {
2196 if (!nft_hook_list_equal(&basechain
->hook_list
,
2198 nft_chain_release_hook(&hook
);
2199 NL_SET_BAD_ATTR(extack
, attr
);
2203 ops
= &basechain
->ops
;
2204 if (ops
->hooknum
!= hook
.num
||
2205 ops
->priority
!= hook
.priority
) {
2206 nft_chain_release_hook(&hook
);
2207 NL_SET_BAD_ATTR(extack
, attr
);
2211 nft_chain_release_hook(&hook
);
2214 if (nla
[NFTA_CHAIN_HANDLE
] &&
2215 nla
[NFTA_CHAIN_NAME
]) {
2216 struct nft_chain
*chain2
;
2218 chain2
= nft_chain_lookup(ctx
->net
, table
,
2219 nla
[NFTA_CHAIN_NAME
], genmask
);
2220 if (!IS_ERR(chain2
)) {
2221 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2226 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2227 if (!nft_is_base_chain(chain
))
2230 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2232 return PTR_ERR(stats
);
2236 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWCHAIN
,
2237 sizeof(struct nft_trans_chain
));
2241 nft_trans_chain_stats(trans
) = stats
;
2242 nft_trans_chain_update(trans
) = true;
2244 if (nla
[NFTA_CHAIN_POLICY
])
2245 nft_trans_chain_policy(trans
) = policy
;
2247 nft_trans_chain_policy(trans
) = -1;
2249 if (nla
[NFTA_CHAIN_HANDLE
] &&
2250 nla
[NFTA_CHAIN_NAME
]) {
2251 struct nft_trans
*tmp
;
2255 name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL
);
2260 list_for_each_entry(tmp
, &ctx
->net
->nft
.commit_list
, list
) {
2261 if (tmp
->msg_type
== NFT_MSG_NEWCHAIN
&&
2262 tmp
->ctx
.table
== table
&&
2263 nft_trans_chain_update(tmp
) &&
2264 nft_trans_chain_name(tmp
) &&
2265 strcmp(name
, nft_trans_chain_name(tmp
)) == 0) {
2266 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2272 nft_trans_chain_name(trans
) = name
;
2274 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
2283 static struct nft_chain
*nft_chain_lookup_byid(const struct net
*net
,
2284 const struct nlattr
*nla
)
2286 u32 id
= ntohl(nla_get_be32(nla
));
2287 struct nft_trans
*trans
;
2289 list_for_each_entry(trans
, &net
->nft
.commit_list
, list
) {
2290 struct nft_chain
*chain
= trans
->ctx
.chain
;
2292 if (trans
->msg_type
== NFT_MSG_NEWCHAIN
&&
2293 id
== nft_trans_chain_id(trans
))
2296 return ERR_PTR(-ENOENT
);
2299 static int nf_tables_newchain(struct net
*net
, struct sock
*nlsk
,
2300 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
2301 const struct nlattr
* const nla
[],
2302 struct netlink_ext_ack
*extack
)
2304 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
2305 u8 genmask
= nft_genmask_next(net
);
2306 int family
= nfmsg
->nfgen_family
;
2307 struct nft_chain
*chain
= NULL
;
2308 const struct nlattr
*attr
;
2309 struct nft_table
*table
;
2310 u8 policy
= NF_ACCEPT
;
2315 lockdep_assert_held(&net
->nft
.commit_mutex
);
2317 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2318 NETLINK_CB(skb
).portid
);
2319 if (IS_ERR(table
)) {
2320 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2321 return PTR_ERR(table
);
2325 attr
= nla
[NFTA_CHAIN_NAME
];
2327 if (nla
[NFTA_CHAIN_HANDLE
]) {
2328 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_CHAIN_HANDLE
]));
2329 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2330 if (IS_ERR(chain
)) {
2331 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_HANDLE
]);
2332 return PTR_ERR(chain
);
2334 attr
= nla
[NFTA_CHAIN_HANDLE
];
2335 } else if (nla
[NFTA_CHAIN_NAME
]) {
2336 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2337 if (IS_ERR(chain
)) {
2338 if (PTR_ERR(chain
) != -ENOENT
) {
2339 NL_SET_BAD_ATTR(extack
, attr
);
2340 return PTR_ERR(chain
);
2344 } else if (!nla
[NFTA_CHAIN_ID
]) {
2348 if (nla
[NFTA_CHAIN_POLICY
]) {
2349 if (chain
!= NULL
&&
2350 !nft_is_base_chain(chain
)) {
2351 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2355 if (chain
== NULL
&&
2356 nla
[NFTA_CHAIN_HOOK
] == NULL
) {
2357 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2361 policy
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_POLICY
]));
2371 if (nla
[NFTA_CHAIN_FLAGS
])
2372 flags
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_FLAGS
]));
2374 flags
= chain
->flags
;
2376 if (flags
& ~NFT_CHAIN_FLAGS
)
2379 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, chain
, nla
);
2381 if (chain
!= NULL
) {
2382 if (nlh
->nlmsg_flags
& NLM_F_EXCL
) {
2383 NL_SET_BAD_ATTR(extack
, attr
);
2386 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
)
2389 flags
|= chain
->flags
& NFT_CHAIN_BASE
;
2390 return nf_tables_updchain(&ctx
, genmask
, policy
, flags
, attr
,
2394 return nf_tables_addchain(&ctx
, family
, genmask
, policy
, flags
);
2397 static int nf_tables_delchain(struct net
*net
, struct sock
*nlsk
,
2398 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
2399 const struct nlattr
* const nla
[],
2400 struct netlink_ext_ack
*extack
)
2402 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
2403 u8 genmask
= nft_genmask_next(net
);
2404 int family
= nfmsg
->nfgen_family
;
2405 const struct nlattr
*attr
;
2406 struct nft_table
*table
;
2407 struct nft_chain
*chain
;
2408 struct nft_rule
*rule
;
2414 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2415 NETLINK_CB(skb
).portid
);
2416 if (IS_ERR(table
)) {
2417 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2418 return PTR_ERR(table
);
2421 if (nla
[NFTA_CHAIN_HANDLE
]) {
2422 attr
= nla
[NFTA_CHAIN_HANDLE
];
2423 handle
= be64_to_cpu(nla_get_be64(attr
));
2424 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2426 attr
= nla
[NFTA_CHAIN_NAME
];
2427 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2429 if (IS_ERR(chain
)) {
2430 NL_SET_BAD_ATTR(extack
, attr
);
2431 return PTR_ERR(chain
);
2434 if (nlh
->nlmsg_flags
& NLM_F_NONREC
&&
2438 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, chain
, nla
);
2441 list_for_each_entry(rule
, &chain
->rules
, list
) {
2442 if (!nft_is_active_next(net
, rule
))
2446 err
= nft_delrule(&ctx
, rule
);
2451 /* There are rules and elements that are still holding references to us,
2452 * we cannot do a recursive removal in this case.
2455 NL_SET_BAD_ATTR(extack
, attr
);
2459 return nft_delchain(&ctx
);
2467 * nft_register_expr - register nf_tables expr type
2470 * Registers the expr type for use with nf_tables. Returns zero on
2471 * success or a negative errno code otherwise.
2473 int nft_register_expr(struct nft_expr_type
*type
)
2475 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2476 if (type
->family
== NFPROTO_UNSPEC
)
2477 list_add_tail_rcu(&type
->list
, &nf_tables_expressions
);
2479 list_add_rcu(&type
->list
, &nf_tables_expressions
);
2480 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2483 EXPORT_SYMBOL_GPL(nft_register_expr
);
2486 * nft_unregister_expr - unregister nf_tables expr type
2489 * Unregisters the expr typefor use with nf_tables.
2491 void nft_unregister_expr(struct nft_expr_type
*type
)
2493 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2494 list_del_rcu(&type
->list
);
2495 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2497 EXPORT_SYMBOL_GPL(nft_unregister_expr
);
2499 static const struct nft_expr_type
*__nft_expr_type_get(u8 family
,
2502 const struct nft_expr_type
*type
, *candidate
= NULL
;
2504 list_for_each_entry(type
, &nf_tables_expressions
, list
) {
2505 if (!nla_strcmp(nla
, type
->name
)) {
2506 if (!type
->family
&& !candidate
)
2508 else if (type
->family
== family
)
2515 #ifdef CONFIG_MODULES
2516 static int nft_expr_type_request_module(struct net
*net
, u8 family
,
2519 if (nft_request_module(net
, "nft-expr-%u-%.*s", family
,
2520 nla_len(nla
), (char *)nla_data(nla
)) == -EAGAIN
)
2527 static const struct nft_expr_type
*nft_expr_type_get(struct net
*net
,
2531 const struct nft_expr_type
*type
;
2534 return ERR_PTR(-EINVAL
);
2536 type
= __nft_expr_type_get(family
, nla
);
2537 if (type
!= NULL
&& try_module_get(type
->owner
))
2540 lockdep_nfnl_nft_mutex_not_held();
2541 #ifdef CONFIG_MODULES
2543 if (nft_expr_type_request_module(net
, family
, nla
) == -EAGAIN
)
2544 return ERR_PTR(-EAGAIN
);
2546 if (nft_request_module(net
, "nft-expr-%.*s",
2548 (char *)nla_data(nla
)) == -EAGAIN
)
2549 return ERR_PTR(-EAGAIN
);
2552 return ERR_PTR(-ENOENT
);
2555 static const struct nla_policy nft_expr_policy
[NFTA_EXPR_MAX
+ 1] = {
2556 [NFTA_EXPR_NAME
] = { .type
= NLA_STRING
,
2557 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
2558 [NFTA_EXPR_DATA
] = { .type
= NLA_NESTED
},
2561 static int nf_tables_fill_expr_info(struct sk_buff
*skb
,
2562 const struct nft_expr
*expr
)
2564 if (nla_put_string(skb
, NFTA_EXPR_NAME
, expr
->ops
->type
->name
))
2565 goto nla_put_failure
;
2567 if (expr
->ops
->dump
) {
2568 struct nlattr
*data
= nla_nest_start_noflag(skb
,
2571 goto nla_put_failure
;
2572 if (expr
->ops
->dump(skb
, expr
) < 0)
2573 goto nla_put_failure
;
2574 nla_nest_end(skb
, data
);
2583 int nft_expr_dump(struct sk_buff
*skb
, unsigned int attr
,
2584 const struct nft_expr
*expr
)
2586 struct nlattr
*nest
;
2588 nest
= nla_nest_start_noflag(skb
, attr
);
2590 goto nla_put_failure
;
2591 if (nf_tables_fill_expr_info(skb
, expr
) < 0)
2592 goto nla_put_failure
;
2593 nla_nest_end(skb
, nest
);
2600 struct nft_expr_info
{
2601 const struct nft_expr_ops
*ops
;
2602 const struct nlattr
*attr
;
2603 struct nlattr
*tb
[NFT_EXPR_MAXATTR
+ 1];
2606 static int nf_tables_expr_parse(const struct nft_ctx
*ctx
,
2607 const struct nlattr
*nla
,
2608 struct nft_expr_info
*info
)
2610 const struct nft_expr_type
*type
;
2611 const struct nft_expr_ops
*ops
;
2612 struct nlattr
*tb
[NFTA_EXPR_MAX
+ 1];
2615 err
= nla_parse_nested_deprecated(tb
, NFTA_EXPR_MAX
, nla
,
2616 nft_expr_policy
, NULL
);
2620 type
= nft_expr_type_get(ctx
->net
, ctx
->family
, tb
[NFTA_EXPR_NAME
]);
2622 return PTR_ERR(type
);
2624 if (tb
[NFTA_EXPR_DATA
]) {
2625 err
= nla_parse_nested_deprecated(info
->tb
, type
->maxattr
,
2627 type
->policy
, NULL
);
2631 memset(info
->tb
, 0, sizeof(info
->tb
[0]) * (type
->maxattr
+ 1));
2633 if (type
->select_ops
!= NULL
) {
2634 ops
= type
->select_ops(ctx
,
2635 (const struct nlattr
* const *)info
->tb
);
2638 #ifdef CONFIG_MODULES
2640 if (nft_expr_type_request_module(ctx
->net
,
2642 tb
[NFTA_EXPR_NAME
]) != -EAGAIN
)
2656 module_put(type
->owner
);
2660 static int nf_tables_newexpr(const struct nft_ctx
*ctx
,
2661 const struct nft_expr_info
*info
,
2662 struct nft_expr
*expr
)
2664 const struct nft_expr_ops
*ops
= info
->ops
;
2669 err
= ops
->init(ctx
, expr
, (const struct nlattr
**)info
->tb
);
2680 static void nf_tables_expr_destroy(const struct nft_ctx
*ctx
,
2681 struct nft_expr
*expr
)
2683 const struct nft_expr_type
*type
= expr
->ops
->type
;
2685 if (expr
->ops
->destroy
)
2686 expr
->ops
->destroy(ctx
, expr
);
2687 module_put(type
->owner
);
2690 static struct nft_expr
*nft_expr_init(const struct nft_ctx
*ctx
,
2691 const struct nlattr
*nla
)
2693 struct nft_expr_info info
;
2694 struct nft_expr
*expr
;
2695 struct module
*owner
;
2698 err
= nf_tables_expr_parse(ctx
, nla
, &info
);
2703 expr
= kzalloc(info
.ops
->size
, GFP_KERNEL
);
2707 err
= nf_tables_newexpr(ctx
, &info
, expr
);
2715 owner
= info
.ops
->type
->owner
;
2716 if (info
.ops
->type
->release_ops
)
2717 info
.ops
->type
->release_ops(info
.ops
);
2721 return ERR_PTR(err
);
2724 int nft_expr_clone(struct nft_expr
*dst
, struct nft_expr
*src
)
2728 if (src
->ops
->clone
) {
2729 dst
->ops
= src
->ops
;
2730 err
= src
->ops
->clone(dst
, src
);
2734 memcpy(dst
, src
, src
->ops
->size
);
2737 __module_get(src
->ops
->type
->owner
);
2742 void nft_expr_destroy(const struct nft_ctx
*ctx
, struct nft_expr
*expr
)
2744 nf_tables_expr_destroy(ctx
, expr
);
2752 static struct nft_rule
*__nft_rule_lookup(const struct nft_chain
*chain
,
2755 struct nft_rule
*rule
;
2757 // FIXME: this sucks
2758 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
2759 if (handle
== rule
->handle
)
2763 return ERR_PTR(-ENOENT
);
2766 static struct nft_rule
*nft_rule_lookup(const struct nft_chain
*chain
,
2767 const struct nlattr
*nla
)
2770 return ERR_PTR(-EINVAL
);
2772 return __nft_rule_lookup(chain
, be64_to_cpu(nla_get_be64(nla
)));
2775 static const struct nla_policy nft_rule_policy
[NFTA_RULE_MAX
+ 1] = {
2776 [NFTA_RULE_TABLE
] = { .type
= NLA_STRING
,
2777 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
2778 [NFTA_RULE_CHAIN
] = { .type
= NLA_STRING
,
2779 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
2780 [NFTA_RULE_HANDLE
] = { .type
= NLA_U64
},
2781 [NFTA_RULE_EXPRESSIONS
] = { .type
= NLA_NESTED
},
2782 [NFTA_RULE_COMPAT
] = { .type
= NLA_NESTED
},
2783 [NFTA_RULE_POSITION
] = { .type
= NLA_U64
},
2784 [NFTA_RULE_USERDATA
] = { .type
= NLA_BINARY
,
2785 .len
= NFT_USERDATA_MAXLEN
},
2786 [NFTA_RULE_ID
] = { .type
= NLA_U32
},
2787 [NFTA_RULE_POSITION_ID
] = { .type
= NLA_U32
},
2788 [NFTA_RULE_CHAIN_ID
] = { .type
= NLA_U32
},
2791 static int nf_tables_fill_rule_info(struct sk_buff
*skb
, struct net
*net
,
2792 u32 portid
, u32 seq
, int event
,
2793 u32 flags
, int family
,
2794 const struct nft_table
*table
,
2795 const struct nft_chain
*chain
,
2796 const struct nft_rule
*rule
,
2797 const struct nft_rule
*prule
)
2799 struct nlmsghdr
*nlh
;
2800 struct nfgenmsg
*nfmsg
;
2801 const struct nft_expr
*expr
, *next
;
2802 struct nlattr
*list
;
2803 u16 type
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
2805 nlh
= nlmsg_put(skb
, portid
, seq
, type
, sizeof(struct nfgenmsg
), flags
);
2807 goto nla_put_failure
;
2809 nfmsg
= nlmsg_data(nlh
);
2810 nfmsg
->nfgen_family
= family
;
2811 nfmsg
->version
= NFNETLINK_V0
;
2812 nfmsg
->res_id
= htons(net
->nft
.base_seq
& 0xffff);
2814 if (nla_put_string(skb
, NFTA_RULE_TABLE
, table
->name
))
2815 goto nla_put_failure
;
2816 if (nla_put_string(skb
, NFTA_RULE_CHAIN
, chain
->name
))
2817 goto nla_put_failure
;
2818 if (nla_put_be64(skb
, NFTA_RULE_HANDLE
, cpu_to_be64(rule
->handle
),
2820 goto nla_put_failure
;
2822 if (event
!= NFT_MSG_DELRULE
&& prule
) {
2823 if (nla_put_be64(skb
, NFTA_RULE_POSITION
,
2824 cpu_to_be64(prule
->handle
),
2826 goto nla_put_failure
;
2829 list
= nla_nest_start_noflag(skb
, NFTA_RULE_EXPRESSIONS
);
2831 goto nla_put_failure
;
2832 nft_rule_for_each_expr(expr
, next
, rule
) {
2833 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
) < 0)
2834 goto nla_put_failure
;
2836 nla_nest_end(skb
, list
);
2839 struct nft_userdata
*udata
= nft_userdata(rule
);
2840 if (nla_put(skb
, NFTA_RULE_USERDATA
, udata
->len
+ 1,
2842 goto nla_put_failure
;
2845 nlmsg_end(skb
, nlh
);
2849 nlmsg_trim(skb
, nlh
);
2853 static void nf_tables_rule_notify(const struct nft_ctx
*ctx
,
2854 const struct nft_rule
*rule
, int event
)
2856 struct sk_buff
*skb
;
2858 char *buf
= kasprintf(GFP_KERNEL
, "%s:%llu;%s:%llu",
2859 ctx
->table
->name
, ctx
->table
->handle
,
2860 ctx
->chain
->name
, ctx
->chain
->handle
);
2862 audit_log_nfcfg(buf
,
2865 event
== NFT_MSG_NEWRULE
?
2866 AUDIT_NFT_OP_RULE_REGISTER
:
2867 AUDIT_NFT_OP_RULE_UNREGISTER
,
2872 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
2875 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
2879 err
= nf_tables_fill_rule_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
2880 event
, 0, ctx
->family
, ctx
->table
,
2881 ctx
->chain
, rule
, NULL
);
2887 nft_notify_enqueue(skb
, ctx
->report
, &ctx
->net
->nft
.notify_list
);
2890 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
2893 struct nft_rule_dump_ctx
{
2898 static int __nf_tables_dump_rules(struct sk_buff
*skb
,
2900 struct netlink_callback
*cb
,
2901 const struct nft_table
*table
,
2902 const struct nft_chain
*chain
)
2904 struct net
*net
= sock_net(skb
->sk
);
2905 const struct nft_rule
*rule
, *prule
;
2906 unsigned int s_idx
= cb
->args
[0];
2909 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
2910 if (!nft_is_active(net
, rule
))
2915 memset(&cb
->args
[1], 0,
2916 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
2918 if (nf_tables_fill_rule_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
2921 NLM_F_MULTI
| NLM_F_APPEND
,
2923 table
, chain
, rule
, prule
) < 0)
2926 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
2935 static int nf_tables_dump_rules(struct sk_buff
*skb
,
2936 struct netlink_callback
*cb
)
2938 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
2939 const struct nft_rule_dump_ctx
*ctx
= cb
->data
;
2940 struct nft_table
*table
;
2941 const struct nft_chain
*chain
;
2942 unsigned int idx
= 0;
2943 struct net
*net
= sock_net(skb
->sk
);
2944 int family
= nfmsg
->nfgen_family
;
2947 cb
->seq
= net
->nft
.base_seq
;
2949 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
) {
2950 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
2953 if (ctx
&& ctx
->table
&& strcmp(ctx
->table
, table
->name
) != 0)
2956 if (ctx
&& ctx
->table
&& ctx
->chain
) {
2957 struct rhlist_head
*list
, *tmp
;
2959 list
= rhltable_lookup(&table
->chains_ht
, ctx
->chain
,
2960 nft_chain_ht_params
);
2964 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
2965 if (!nft_is_active(net
, chain
))
2967 __nf_tables_dump_rules(skb
, &idx
,
2974 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
2975 if (__nf_tables_dump_rules(skb
, &idx
, cb
, table
, chain
))
2979 if (ctx
&& ctx
->table
)
2989 static int nf_tables_dump_rules_start(struct netlink_callback
*cb
)
2991 const struct nlattr
* const *nla
= cb
->data
;
2992 struct nft_rule_dump_ctx
*ctx
= NULL
;
2994 if (nla
[NFTA_RULE_TABLE
] || nla
[NFTA_RULE_CHAIN
]) {
2995 ctx
= kzalloc(sizeof(*ctx
), GFP_ATOMIC
);
2999 if (nla
[NFTA_RULE_TABLE
]) {
3000 ctx
->table
= nla_strdup(nla
[NFTA_RULE_TABLE
],
3007 if (nla
[NFTA_RULE_CHAIN
]) {
3008 ctx
->chain
= nla_strdup(nla
[NFTA_RULE_CHAIN
],
3022 static int nf_tables_dump_rules_done(struct netlink_callback
*cb
)
3024 struct nft_rule_dump_ctx
*ctx
= cb
->data
;
3034 /* called with rcu_read_lock held */
3035 static int nf_tables_getrule(struct net
*net
, struct sock
*nlsk
,
3036 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
3037 const struct nlattr
* const nla
[],
3038 struct netlink_ext_ack
*extack
)
3040 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3041 u8 genmask
= nft_genmask_cur(net
);
3042 const struct nft_chain
*chain
;
3043 const struct nft_rule
*rule
;
3044 struct nft_table
*table
;
3045 struct sk_buff
*skb2
;
3046 int family
= nfmsg
->nfgen_family
;
3049 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3050 struct netlink_dump_control c
= {
3051 .start
= nf_tables_dump_rules_start
,
3052 .dump
= nf_tables_dump_rules
,
3053 .done
= nf_tables_dump_rules_done
,
3054 .module
= THIS_MODULE
,
3055 .data
= (void *)nla
,
3058 return nft_netlink_dump_start_rcu(nlsk
, skb
, nlh
, &c
);
3061 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
, 0);
3062 if (IS_ERR(table
)) {
3063 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3064 return PTR_ERR(table
);
3067 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
], genmask
);
3068 if (IS_ERR(chain
)) {
3069 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3070 return PTR_ERR(chain
);
3073 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
3075 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3076 return PTR_ERR(rule
);
3079 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
3083 err
= nf_tables_fill_rule_info(skb2
, net
, NETLINK_CB(skb
).portid
,
3084 nlh
->nlmsg_seq
, NFT_MSG_NEWRULE
, 0,
3085 family
, table
, chain
, rule
, NULL
);
3087 goto err_fill_rule_info
;
3089 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
3096 static void nf_tables_rule_destroy(const struct nft_ctx
*ctx
,
3097 struct nft_rule
*rule
)
3099 struct nft_expr
*expr
, *next
;
3102 * Careful: some expressions might not be initialized in case this
3103 * is called on error from nf_tables_newrule().
3105 expr
= nft_expr_first(rule
);
3106 while (nft_expr_more(rule
, expr
)) {
3107 next
= nft_expr_next(expr
);
3108 nf_tables_expr_destroy(ctx
, expr
);
3114 void nf_tables_rule_release(const struct nft_ctx
*ctx
, struct nft_rule
*rule
)
3116 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_RELEASE
);
3117 nf_tables_rule_destroy(ctx
, rule
);
3120 int nft_chain_validate(const struct nft_ctx
*ctx
, const struct nft_chain
*chain
)
3122 struct nft_expr
*expr
, *last
;
3123 const struct nft_data
*data
;
3124 struct nft_rule
*rule
;
3127 if (ctx
->level
== NFT_JUMP_STACK_SIZE
)
3130 list_for_each_entry(rule
, &chain
->rules
, list
) {
3131 if (!nft_is_active_next(ctx
->net
, rule
))
3134 nft_rule_for_each_expr(expr
, last
, rule
) {
3135 if (!expr
->ops
->validate
)
3138 err
= expr
->ops
->validate(ctx
, expr
, &data
);
3146 EXPORT_SYMBOL_GPL(nft_chain_validate
);
3148 static int nft_table_validate(struct net
*net
, const struct nft_table
*table
)
3150 struct nft_chain
*chain
;
3151 struct nft_ctx ctx
= {
3153 .family
= table
->family
,
3157 list_for_each_entry(chain
, &table
->chains
, list
) {
3158 if (!nft_is_base_chain(chain
))
3162 err
= nft_chain_validate(&ctx
, chain
);
3170 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
3171 const struct nlattr
*nla
);
3173 #define NFT_RULE_MAXEXPRS 128
3175 static int nf_tables_newrule(struct net
*net
, struct sock
*nlsk
,
3176 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
3177 const struct nlattr
* const nla
[],
3178 struct netlink_ext_ack
*extack
)
3180 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3181 u8 genmask
= nft_genmask_next(net
);
3182 struct nft_expr_info
*info
= NULL
;
3183 int family
= nfmsg
->nfgen_family
;
3184 struct nft_flow_rule
*flow
;
3185 struct nft_table
*table
;
3186 struct nft_chain
*chain
;
3187 struct nft_rule
*rule
, *old_rule
= NULL
;
3188 struct nft_userdata
*udata
;
3189 struct nft_trans
*trans
= NULL
;
3190 struct nft_expr
*expr
;
3193 unsigned int size
, i
, n
, ulen
= 0, usize
= 0;
3195 u64 handle
, pos_handle
;
3197 lockdep_assert_held(&net
->nft
.commit_mutex
);
3199 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
3200 NETLINK_CB(skb
).portid
);
3201 if (IS_ERR(table
)) {
3202 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3203 return PTR_ERR(table
);
3206 if (nla
[NFTA_RULE_CHAIN
]) {
3207 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
3209 if (IS_ERR(chain
)) {
3210 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3211 return PTR_ERR(chain
);
3213 if (nft_chain_is_bound(chain
))
3216 } else if (nla
[NFTA_RULE_CHAIN_ID
]) {
3217 chain
= nft_chain_lookup_byid(net
, nla
[NFTA_RULE_CHAIN_ID
]);
3218 if (IS_ERR(chain
)) {
3219 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN_ID
]);
3220 return PTR_ERR(chain
);
3226 if (nla
[NFTA_RULE_HANDLE
]) {
3227 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_HANDLE
]));
3228 rule
= __nft_rule_lookup(chain
, handle
);
3230 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3231 return PTR_ERR(rule
);
3234 if (nlh
->nlmsg_flags
& NLM_F_EXCL
) {
3235 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3238 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3243 if (!(nlh
->nlmsg_flags
& NLM_F_CREATE
) ||
3244 nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3246 handle
= nf_tables_alloc_handle(table
);
3248 if (chain
->use
== UINT_MAX
)
3251 if (nla
[NFTA_RULE_POSITION
]) {
3252 pos_handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_POSITION
]));
3253 old_rule
= __nft_rule_lookup(chain
, pos_handle
);
3254 if (IS_ERR(old_rule
)) {
3255 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION
]);
3256 return PTR_ERR(old_rule
);
3258 } else if (nla
[NFTA_RULE_POSITION_ID
]) {
3259 old_rule
= nft_rule_lookup_byid(net
, nla
[NFTA_RULE_POSITION_ID
]);
3260 if (IS_ERR(old_rule
)) {
3261 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION_ID
]);
3262 return PTR_ERR(old_rule
);
3267 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, chain
, nla
);
3271 if (nla
[NFTA_RULE_EXPRESSIONS
]) {
3272 info
= kvmalloc_array(NFT_RULE_MAXEXPRS
,
3273 sizeof(struct nft_expr_info
),
3278 nla_for_each_nested(tmp
, nla
[NFTA_RULE_EXPRESSIONS
], rem
) {
3280 if (nla_type(tmp
) != NFTA_LIST_ELEM
)
3282 if (n
== NFT_RULE_MAXEXPRS
)
3284 err
= nf_tables_expr_parse(&ctx
, tmp
, &info
[n
]);
3287 size
+= info
[n
].ops
->size
;
3291 /* Check for overflow of dlen field */
3293 if (size
>= 1 << 12)
3296 if (nla
[NFTA_RULE_USERDATA
]) {
3297 ulen
= nla_len(nla
[NFTA_RULE_USERDATA
]);
3299 usize
= sizeof(struct nft_userdata
) + ulen
;
3303 rule
= kzalloc(sizeof(*rule
) + size
+ usize
, GFP_KERNEL
);
3307 nft_activate_next(net
, rule
);
3309 rule
->handle
= handle
;
3311 rule
->udata
= ulen
? 1 : 0;
3314 udata
= nft_userdata(rule
);
3315 udata
->len
= ulen
- 1;
3316 nla_memcpy(udata
->data
, nla
[NFTA_RULE_USERDATA
], ulen
);
3319 expr
= nft_expr_first(rule
);
3320 for (i
= 0; i
< n
; i
++) {
3321 err
= nf_tables_newexpr(&ctx
, &info
[i
], expr
);
3323 NL_SET_BAD_ATTR(extack
, info
[i
].attr
);
3327 if (info
[i
].ops
->validate
)
3328 nft_validate_state_update(net
, NFT_VALIDATE_NEED
);
3331 expr
= nft_expr_next(expr
);
3334 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
3335 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
3336 if (trans
== NULL
) {
3340 err
= nft_delrule(&ctx
, old_rule
);
3342 nft_trans_destroy(trans
);
3346 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
3348 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
3354 if (nlh
->nlmsg_flags
& NLM_F_APPEND
) {
3356 list_add_rcu(&rule
->list
, &old_rule
->list
);
3358 list_add_tail_rcu(&rule
->list
, &chain
->rules
);
3361 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
3363 list_add_rcu(&rule
->list
, &chain
->rules
);
3369 if (net
->nft
.validate_state
== NFT_VALIDATE_DO
)
3370 return nft_table_validate(net
, table
);
3372 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
3373 flow
= nft_flow_rule_create(net
, rule
);
3375 return PTR_ERR(flow
);
3377 nft_trans_flow_rule(trans
) = flow
;
3382 nf_tables_rule_release(&ctx
, rule
);
3384 for (i
= 0; i
< n
; i
++) {
3386 module_put(info
[i
].ops
->type
->owner
);
3387 if (info
[i
].ops
->type
->release_ops
)
3388 info
[i
].ops
->type
->release_ops(info
[i
].ops
);
3395 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
3396 const struct nlattr
*nla
)
3398 u32 id
= ntohl(nla_get_be32(nla
));
3399 struct nft_trans
*trans
;
3401 list_for_each_entry(trans
, &net
->nft
.commit_list
, list
) {
3402 struct nft_rule
*rule
= nft_trans_rule(trans
);
3404 if (trans
->msg_type
== NFT_MSG_NEWRULE
&&
3405 id
== nft_trans_rule_id(trans
))
3408 return ERR_PTR(-ENOENT
);
3411 static int nf_tables_delrule(struct net
*net
, struct sock
*nlsk
,
3412 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
3413 const struct nlattr
* const nla
[],
3414 struct netlink_ext_ack
*extack
)
3416 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3417 u8 genmask
= nft_genmask_next(net
);
3418 struct nft_table
*table
;
3419 struct nft_chain
*chain
= NULL
;
3420 struct nft_rule
*rule
;
3421 int family
= nfmsg
->nfgen_family
, err
= 0;
3424 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
3425 NETLINK_CB(skb
).portid
);
3426 if (IS_ERR(table
)) {
3427 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3428 return PTR_ERR(table
);
3431 if (nla
[NFTA_RULE_CHAIN
]) {
3432 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
3434 if (IS_ERR(chain
)) {
3435 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3436 return PTR_ERR(chain
);
3438 if (nft_chain_is_bound(chain
))
3442 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, chain
, nla
);
3445 if (nla
[NFTA_RULE_HANDLE
]) {
3446 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
3448 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3449 return PTR_ERR(rule
);
3452 err
= nft_delrule(&ctx
, rule
);
3453 } else if (nla
[NFTA_RULE_ID
]) {
3454 rule
= nft_rule_lookup_byid(net
, nla
[NFTA_RULE_ID
]);
3456 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_ID
]);
3457 return PTR_ERR(rule
);
3460 err
= nft_delrule(&ctx
, rule
);
3462 err
= nft_delrule_by_chain(&ctx
);
3465 list_for_each_entry(chain
, &table
->chains
, list
) {
3466 if (!nft_is_active_next(net
, chain
))
3470 err
= nft_delrule_by_chain(&ctx
);
3482 static const struct nft_set_type
*nft_set_types
[] = {
3483 &nft_set_hash_fast_type
,
3485 &nft_set_rhash_type
,
3486 &nft_set_bitmap_type
,
3487 &nft_set_rbtree_type
,
3488 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
3489 &nft_set_pipapo_avx2_type
,
3491 &nft_set_pipapo_type
,
3494 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
3495 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3498 static bool nft_set_ops_candidate(const struct nft_set_type
*type
, u32 flags
)
3500 return (flags
& type
->features
) == (flags
& NFT_SET_FEATURES
);
3504 * Select a set implementation based on the data characteristics and the
3505 * given policy. The total memory use might not be known if no size is
3506 * given, in that case the amount of memory per element is used.
3508 static const struct nft_set_ops
*
3509 nft_select_set_ops(const struct nft_ctx
*ctx
,
3510 const struct nlattr
* const nla
[],
3511 const struct nft_set_desc
*desc
,
3512 enum nft_set_policies policy
)
3514 const struct nft_set_ops
*ops
, *bops
;
3515 struct nft_set_estimate est
, best
;
3516 const struct nft_set_type
*type
;
3520 lockdep_assert_held(&ctx
->net
->nft
.commit_mutex
);
3521 lockdep_nfnl_nft_mutex_not_held();
3523 if (nla
[NFTA_SET_FLAGS
] != NULL
)
3524 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
3531 for (i
= 0; i
< ARRAY_SIZE(nft_set_types
); i
++) {
3532 type
= nft_set_types
[i
];
3535 if (!nft_set_ops_candidate(type
, flags
))
3537 if (!ops
->estimate(desc
, flags
, &est
))
3541 case NFT_SET_POL_PERFORMANCE
:
3542 if (est
.lookup
< best
.lookup
)
3544 if (est
.lookup
== best
.lookup
&&
3545 est
.space
< best
.space
)
3548 case NFT_SET_POL_MEMORY
:
3550 if (est
.space
< best
.space
)
3552 if (est
.space
== best
.space
&&
3553 est
.lookup
< best
.lookup
)
3555 } else if (est
.size
< best
.size
|| !bops
) {
3570 return ERR_PTR(-EOPNOTSUPP
);
3573 static const struct nla_policy nft_set_policy
[NFTA_SET_MAX
+ 1] = {
3574 [NFTA_SET_TABLE
] = { .type
= NLA_STRING
,
3575 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
3576 [NFTA_SET_NAME
] = { .type
= NLA_STRING
,
3577 .len
= NFT_SET_MAXNAMELEN
- 1 },
3578 [NFTA_SET_FLAGS
] = { .type
= NLA_U32
},
3579 [NFTA_SET_KEY_TYPE
] = { .type
= NLA_U32
},
3580 [NFTA_SET_KEY_LEN
] = { .type
= NLA_U32
},
3581 [NFTA_SET_DATA_TYPE
] = { .type
= NLA_U32
},
3582 [NFTA_SET_DATA_LEN
] = { .type
= NLA_U32
},
3583 [NFTA_SET_POLICY
] = { .type
= NLA_U32
},
3584 [NFTA_SET_DESC
] = { .type
= NLA_NESTED
},
3585 [NFTA_SET_ID
] = { .type
= NLA_U32
},
3586 [NFTA_SET_TIMEOUT
] = { .type
= NLA_U64
},
3587 [NFTA_SET_GC_INTERVAL
] = { .type
= NLA_U32
},
3588 [NFTA_SET_USERDATA
] = { .type
= NLA_BINARY
,
3589 .len
= NFT_USERDATA_MAXLEN
},
3590 [NFTA_SET_OBJ_TYPE
] = { .type
= NLA_U32
},
3591 [NFTA_SET_HANDLE
] = { .type
= NLA_U64
},
3592 [NFTA_SET_EXPR
] = { .type
= NLA_NESTED
},
3593 [NFTA_SET_EXPRESSIONS
] = { .type
= NLA_NESTED
},
3596 static const struct nla_policy nft_set_desc_policy
[NFTA_SET_DESC_MAX
+ 1] = {
3597 [NFTA_SET_DESC_SIZE
] = { .type
= NLA_U32
},
3598 [NFTA_SET_DESC_CONCAT
] = { .type
= NLA_NESTED
},
3601 static int nft_ctx_init_from_setattr(struct nft_ctx
*ctx
, struct net
*net
,
3602 const struct sk_buff
*skb
,
3603 const struct nlmsghdr
*nlh
,
3604 const struct nlattr
* const nla
[],
3605 struct netlink_ext_ack
*extack
,
3606 u8 genmask
, u32 nlpid
)
3608 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3609 int family
= nfmsg
->nfgen_family
;
3610 struct nft_table
*table
= NULL
;
3612 if (nla
[NFTA_SET_TABLE
] != NULL
) {
3613 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
,
3615 if (IS_ERR(table
)) {
3616 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
3617 return PTR_ERR(table
);
3621 nft_ctx_init(ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
3625 static struct nft_set
*nft_set_lookup(const struct nft_table
*table
,
3626 const struct nlattr
*nla
, u8 genmask
)
3628 struct nft_set
*set
;
3631 return ERR_PTR(-EINVAL
);
3633 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
3634 if (!nla_strcmp(nla
, set
->name
) &&
3635 nft_active_genmask(set
, genmask
))
3638 return ERR_PTR(-ENOENT
);
3641 static struct nft_set
*nft_set_lookup_byhandle(const struct nft_table
*table
,
3642 const struct nlattr
*nla
,
3645 struct nft_set
*set
;
3647 list_for_each_entry(set
, &table
->sets
, list
) {
3648 if (be64_to_cpu(nla_get_be64(nla
)) == set
->handle
&&
3649 nft_active_genmask(set
, genmask
))
3652 return ERR_PTR(-ENOENT
);
3655 static struct nft_set
*nft_set_lookup_byid(const struct net
*net
,
3656 const struct nlattr
*nla
, u8 genmask
)
3658 struct nft_trans
*trans
;
3659 u32 id
= ntohl(nla_get_be32(nla
));
3661 list_for_each_entry(trans
, &net
->nft
.commit_list
, list
) {
3662 if (trans
->msg_type
== NFT_MSG_NEWSET
) {
3663 struct nft_set
*set
= nft_trans_set(trans
);
3665 if (id
== nft_trans_set_id(trans
) &&
3666 nft_active_genmask(set
, genmask
))
3670 return ERR_PTR(-ENOENT
);
3673 struct nft_set
*nft_set_lookup_global(const struct net
*net
,
3674 const struct nft_table
*table
,
3675 const struct nlattr
*nla_set_name
,
3676 const struct nlattr
*nla_set_id
,
3679 struct nft_set
*set
;
3681 set
= nft_set_lookup(table
, nla_set_name
, genmask
);
3686 set
= nft_set_lookup_byid(net
, nla_set_id
, genmask
);
3690 EXPORT_SYMBOL_GPL(nft_set_lookup_global
);
3692 static int nf_tables_set_alloc_name(struct nft_ctx
*ctx
, struct nft_set
*set
,
3695 const struct nft_set
*i
;
3697 unsigned long *inuse
;
3698 unsigned int n
= 0, min
= 0;
3700 p
= strchr(name
, '%');
3702 if (p
[1] != 'd' || strchr(p
+ 2, '%'))
3705 inuse
= (unsigned long *)get_zeroed_page(GFP_KERNEL
);
3709 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
3712 if (!nft_is_active_next(ctx
->net
, set
))
3714 if (!sscanf(i
->name
, name
, &tmp
))
3716 if (tmp
< min
|| tmp
>= min
+ BITS_PER_BYTE
* PAGE_SIZE
)
3719 set_bit(tmp
- min
, inuse
);
3722 n
= find_first_zero_bit(inuse
, BITS_PER_BYTE
* PAGE_SIZE
);
3723 if (n
>= BITS_PER_BYTE
* PAGE_SIZE
) {
3724 min
+= BITS_PER_BYTE
* PAGE_SIZE
;
3725 memset(inuse
, 0, PAGE_SIZE
);
3728 free_page((unsigned long)inuse
);
3731 set
->name
= kasprintf(GFP_KERNEL
, name
, min
+ n
);
3735 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
3736 if (!nft_is_active_next(ctx
->net
, i
))
3738 if (!strcmp(set
->name
, i
->name
)) {
3747 int nf_msecs_to_jiffies64(const struct nlattr
*nla
, u64
*result
)
3749 u64 ms
= be64_to_cpu(nla_get_be64(nla
));
3750 u64 max
= (u64
)(~((u64
)0));
3752 max
= div_u64(max
, NSEC_PER_MSEC
);
3756 ms
*= NSEC_PER_MSEC
;
3757 *result
= nsecs_to_jiffies64(ms
);
3761 __be64
nf_jiffies64_to_msecs(u64 input
)
3763 return cpu_to_be64(jiffies64_to_msecs(input
));
3766 static int nf_tables_fill_set_concat(struct sk_buff
*skb
,
3767 const struct nft_set
*set
)
3769 struct nlattr
*concat
, *field
;
3772 concat
= nla_nest_start_noflag(skb
, NFTA_SET_DESC_CONCAT
);
3776 for (i
= 0; i
< set
->field_count
; i
++) {
3777 field
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
3781 if (nla_put_be32(skb
, NFTA_SET_FIELD_LEN
,
3782 htonl(set
->field_len
[i
])))
3785 nla_nest_end(skb
, field
);
3788 nla_nest_end(skb
, concat
);
3793 static int nf_tables_fill_set(struct sk_buff
*skb
, const struct nft_ctx
*ctx
,
3794 const struct nft_set
*set
, u16 event
, u16 flags
)
3796 struct nfgenmsg
*nfmsg
;
3797 struct nlmsghdr
*nlh
;
3798 u32 portid
= ctx
->portid
;
3799 struct nlattr
*nest
;
3803 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
3804 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
),
3807 goto nla_put_failure
;
3809 nfmsg
= nlmsg_data(nlh
);
3810 nfmsg
->nfgen_family
= ctx
->family
;
3811 nfmsg
->version
= NFNETLINK_V0
;
3812 nfmsg
->res_id
= htons(ctx
->net
->nft
.base_seq
& 0xffff);
3814 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
3815 goto nla_put_failure
;
3816 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
3817 goto nla_put_failure
;
3818 if (nla_put_be64(skb
, NFTA_SET_HANDLE
, cpu_to_be64(set
->handle
),
3820 goto nla_put_failure
;
3821 if (set
->flags
!= 0)
3822 if (nla_put_be32(skb
, NFTA_SET_FLAGS
, htonl(set
->flags
)))
3823 goto nla_put_failure
;
3825 if (nla_put_be32(skb
, NFTA_SET_KEY_TYPE
, htonl(set
->ktype
)))
3826 goto nla_put_failure
;
3827 if (nla_put_be32(skb
, NFTA_SET_KEY_LEN
, htonl(set
->klen
)))
3828 goto nla_put_failure
;
3829 if (set
->flags
& NFT_SET_MAP
) {
3830 if (nla_put_be32(skb
, NFTA_SET_DATA_TYPE
, htonl(set
->dtype
)))
3831 goto nla_put_failure
;
3832 if (nla_put_be32(skb
, NFTA_SET_DATA_LEN
, htonl(set
->dlen
)))
3833 goto nla_put_failure
;
3835 if (set
->flags
& NFT_SET_OBJECT
&&
3836 nla_put_be32(skb
, NFTA_SET_OBJ_TYPE
, htonl(set
->objtype
)))
3837 goto nla_put_failure
;
3840 nla_put_be64(skb
, NFTA_SET_TIMEOUT
,
3841 nf_jiffies64_to_msecs(set
->timeout
),
3843 goto nla_put_failure
;
3845 nla_put_be32(skb
, NFTA_SET_GC_INTERVAL
, htonl(set
->gc_int
)))
3846 goto nla_put_failure
;
3848 if (set
->policy
!= NFT_SET_POL_PERFORMANCE
) {
3849 if (nla_put_be32(skb
, NFTA_SET_POLICY
, htonl(set
->policy
)))
3850 goto nla_put_failure
;
3854 nla_put(skb
, NFTA_SET_USERDATA
, set
->udlen
, set
->udata
))
3855 goto nla_put_failure
;
3857 nest
= nla_nest_start_noflag(skb
, NFTA_SET_DESC
);
3859 goto nla_put_failure
;
3861 nla_put_be32(skb
, NFTA_SET_DESC_SIZE
, htonl(set
->size
)))
3862 goto nla_put_failure
;
3864 if (set
->field_count
> 1 &&
3865 nf_tables_fill_set_concat(skb
, set
))
3866 goto nla_put_failure
;
3868 nla_nest_end(skb
, nest
);
3870 if (set
->num_exprs
== 1) {
3871 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPR
);
3872 if (nf_tables_fill_expr_info(skb
, set
->exprs
[0]) < 0)
3873 goto nla_put_failure
;
3875 nla_nest_end(skb
, nest
);
3876 } else if (set
->num_exprs
> 1) {
3877 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPRESSIONS
);
3879 goto nla_put_failure
;
3881 for (i
= 0; i
< set
->num_exprs
; i
++) {
3882 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
,
3884 goto nla_put_failure
;
3886 nla_nest_end(skb
, nest
);
3889 nlmsg_end(skb
, nlh
);
3893 nlmsg_trim(skb
, nlh
);
3897 static void nf_tables_set_notify(const struct nft_ctx
*ctx
,
3898 const struct nft_set
*set
, int event
,
3901 struct sk_buff
*skb
;
3902 u32 portid
= ctx
->portid
;
3904 char *buf
= kasprintf(gfp_flags
, "%s:%llu;%s:%llu",
3905 ctx
->table
->name
, ctx
->table
->handle
,
3906 set
->name
, set
->handle
);
3908 audit_log_nfcfg(buf
,
3911 event
== NFT_MSG_NEWSET
?
3912 AUDIT_NFT_OP_SET_REGISTER
:
3913 AUDIT_NFT_OP_SET_UNREGISTER
,
3918 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
3921 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp_flags
);
3925 err
= nf_tables_fill_set(skb
, ctx
, set
, event
, 0);
3931 nft_notify_enqueue(skb
, ctx
->report
, &ctx
->net
->nft
.notify_list
);
3934 nfnetlink_set_err(ctx
->net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
3937 static int nf_tables_dump_sets(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3939 const struct nft_set
*set
;
3940 unsigned int idx
, s_idx
= cb
->args
[0];
3941 struct nft_table
*table
, *cur_table
= (struct nft_table
*)cb
->args
[2];
3942 struct net
*net
= sock_net(skb
->sk
);
3943 struct nft_ctx
*ctx
= cb
->data
, ctx_set
;
3949 cb
->seq
= net
->nft
.base_seq
;
3951 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
) {
3952 if (ctx
->family
!= NFPROTO_UNSPEC
&&
3953 ctx
->family
!= table
->family
)
3956 if (ctx
->table
&& ctx
->table
!= table
)
3960 if (cur_table
!= table
)
3966 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
3969 if (!nft_is_active(net
, set
))
3973 ctx_set
.table
= table
;
3974 ctx_set
.family
= table
->family
;
3976 if (nf_tables_fill_set(skb
, &ctx_set
, set
,
3980 cb
->args
[2] = (unsigned long) table
;
3983 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
3996 static int nf_tables_dump_sets_start(struct netlink_callback
*cb
)
3998 struct nft_ctx
*ctx_dump
= NULL
;
4000 ctx_dump
= kmemdup(cb
->data
, sizeof(*ctx_dump
), GFP_ATOMIC
);
4001 if (ctx_dump
== NULL
)
4004 cb
->data
= ctx_dump
;
4008 static int nf_tables_dump_sets_done(struct netlink_callback
*cb
)
4014 /* called with rcu_read_lock held */
4015 static int nf_tables_getset(struct net
*net
, struct sock
*nlsk
,
4016 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
4017 const struct nlattr
* const nla
[],
4018 struct netlink_ext_ack
*extack
)
4020 u8 genmask
= nft_genmask_cur(net
);
4021 const struct nft_set
*set
;
4023 struct sk_buff
*skb2
;
4024 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
4027 /* Verify existence before starting dump */
4028 err
= nft_ctx_init_from_setattr(&ctx
, net
, skb
, nlh
, nla
, extack
,
4033 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
4034 struct netlink_dump_control c
= {
4035 .start
= nf_tables_dump_sets_start
,
4036 .dump
= nf_tables_dump_sets
,
4037 .done
= nf_tables_dump_sets_done
,
4039 .module
= THIS_MODULE
,
4042 return nft_netlink_dump_start_rcu(nlsk
, skb
, nlh
, &c
);
4045 /* Only accept unspec with dump */
4046 if (nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
4047 return -EAFNOSUPPORT
;
4048 if (!nla
[NFTA_SET_TABLE
])
4051 set
= nft_set_lookup(ctx
.table
, nla
[NFTA_SET_NAME
], genmask
);
4053 return PTR_ERR(set
);
4055 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
4059 err
= nf_tables_fill_set(skb2
, &ctx
, set
, NFT_MSG_NEWSET
, 0);
4061 goto err_fill_set_info
;
4063 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
4070 static const struct nla_policy nft_concat_policy
[NFTA_SET_FIELD_MAX
+ 1] = {
4071 [NFTA_SET_FIELD_LEN
] = { .type
= NLA_U32
},
4074 static int nft_set_desc_concat_parse(const struct nlattr
*attr
,
4075 struct nft_set_desc
*desc
)
4077 struct nlattr
*tb
[NFTA_SET_FIELD_MAX
+ 1];
4081 err
= nla_parse_nested_deprecated(tb
, NFTA_SET_FIELD_MAX
, attr
,
4082 nft_concat_policy
, NULL
);
4086 if (!tb
[NFTA_SET_FIELD_LEN
])
4089 len
= ntohl(nla_get_be32(tb
[NFTA_SET_FIELD_LEN
]));
4091 if (len
* BITS_PER_BYTE
/ 32 > NFT_REG32_COUNT
)
4094 desc
->field_len
[desc
->field_count
++] = len
;
4099 static int nft_set_desc_concat(struct nft_set_desc
*desc
,
4100 const struct nlattr
*nla
)
4102 struct nlattr
*attr
;
4105 nla_for_each_nested(attr
, nla
, rem
) {
4106 if (nla_type(attr
) != NFTA_LIST_ELEM
)
4109 err
= nft_set_desc_concat_parse(attr
, desc
);
4117 static int nf_tables_set_desc_parse(struct nft_set_desc
*desc
,
4118 const struct nlattr
*nla
)
4120 struct nlattr
*da
[NFTA_SET_DESC_MAX
+ 1];
4123 err
= nla_parse_nested_deprecated(da
, NFTA_SET_DESC_MAX
, nla
,
4124 nft_set_desc_policy
, NULL
);
4128 if (da
[NFTA_SET_DESC_SIZE
] != NULL
)
4129 desc
->size
= ntohl(nla_get_be32(da
[NFTA_SET_DESC_SIZE
]));
4130 if (da
[NFTA_SET_DESC_CONCAT
])
4131 err
= nft_set_desc_concat(desc
, da
[NFTA_SET_DESC_CONCAT
]);
4136 static int nf_tables_newset(struct net
*net
, struct sock
*nlsk
,
4137 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
4138 const struct nlattr
* const nla
[],
4139 struct netlink_ext_ack
*extack
)
4141 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
4142 u8 genmask
= nft_genmask_next(net
);
4143 int family
= nfmsg
->nfgen_family
;
4144 const struct nft_set_ops
*ops
;
4145 struct nft_expr
*expr
= NULL
;
4146 struct nft_table
*table
;
4147 struct nft_set
*set
;
4152 u32 ktype
, dtype
, flags
, policy
, gc_int
, objtype
;
4153 struct nft_set_desc desc
;
4154 unsigned char *udata
;
4159 if (nla
[NFTA_SET_TABLE
] == NULL
||
4160 nla
[NFTA_SET_NAME
] == NULL
||
4161 nla
[NFTA_SET_KEY_LEN
] == NULL
||
4162 nla
[NFTA_SET_ID
] == NULL
)
4165 memset(&desc
, 0, sizeof(desc
));
4167 ktype
= NFT_DATA_VALUE
;
4168 if (nla
[NFTA_SET_KEY_TYPE
] != NULL
) {
4169 ktype
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_TYPE
]));
4170 if ((ktype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
)
4174 desc
.klen
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_LEN
]));
4175 if (desc
.klen
== 0 || desc
.klen
> NFT_DATA_VALUE_MAXLEN
)
4179 if (nla
[NFTA_SET_FLAGS
] != NULL
) {
4180 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
4181 if (flags
& ~(NFT_SET_ANONYMOUS
| NFT_SET_CONSTANT
|
4182 NFT_SET_INTERVAL
| NFT_SET_TIMEOUT
|
4183 NFT_SET_MAP
| NFT_SET_EVAL
|
4184 NFT_SET_OBJECT
| NFT_SET_CONCAT
| NFT_SET_EXPR
))
4186 /* Only one of these operations is supported */
4187 if ((flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
)) ==
4188 (NFT_SET_MAP
| NFT_SET_OBJECT
))
4190 if ((flags
& (NFT_SET_EVAL
| NFT_SET_OBJECT
)) ==
4191 (NFT_SET_EVAL
| NFT_SET_OBJECT
))
4196 if (nla
[NFTA_SET_DATA_TYPE
] != NULL
) {
4197 if (!(flags
& NFT_SET_MAP
))
4200 dtype
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_TYPE
]));
4201 if ((dtype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
&&
4202 dtype
!= NFT_DATA_VERDICT
)
4205 if (dtype
!= NFT_DATA_VERDICT
) {
4206 if (nla
[NFTA_SET_DATA_LEN
] == NULL
)
4208 desc
.dlen
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_LEN
]));
4209 if (desc
.dlen
== 0 || desc
.dlen
> NFT_DATA_VALUE_MAXLEN
)
4212 desc
.dlen
= sizeof(struct nft_verdict
);
4213 } else if (flags
& NFT_SET_MAP
)
4216 if (nla
[NFTA_SET_OBJ_TYPE
] != NULL
) {
4217 if (!(flags
& NFT_SET_OBJECT
))
4220 objtype
= ntohl(nla_get_be32(nla
[NFTA_SET_OBJ_TYPE
]));
4221 if (objtype
== NFT_OBJECT_UNSPEC
||
4222 objtype
> NFT_OBJECT_MAX
)
4224 } else if (flags
& NFT_SET_OBJECT
)
4227 objtype
= NFT_OBJECT_UNSPEC
;
4230 if (nla
[NFTA_SET_TIMEOUT
] != NULL
) {
4231 if (!(flags
& NFT_SET_TIMEOUT
))
4234 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_TIMEOUT
], &timeout
);
4239 if (nla
[NFTA_SET_GC_INTERVAL
] != NULL
) {
4240 if (!(flags
& NFT_SET_TIMEOUT
))
4242 gc_int
= ntohl(nla_get_be32(nla
[NFTA_SET_GC_INTERVAL
]));
4245 policy
= NFT_SET_POL_PERFORMANCE
;
4246 if (nla
[NFTA_SET_POLICY
] != NULL
)
4247 policy
= ntohl(nla_get_be32(nla
[NFTA_SET_POLICY
]));
4249 if (nla
[NFTA_SET_DESC
] != NULL
) {
4250 err
= nf_tables_set_desc_parse(&desc
, nla
[NFTA_SET_DESC
]);
4255 if (nla
[NFTA_SET_EXPR
] || nla
[NFTA_SET_EXPRESSIONS
])
4258 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
, genmask
,
4259 NETLINK_CB(skb
).portid
);
4260 if (IS_ERR(table
)) {
4261 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4262 return PTR_ERR(table
);
4265 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
4267 set
= nft_set_lookup(table
, nla
[NFTA_SET_NAME
], genmask
);
4269 if (PTR_ERR(set
) != -ENOENT
) {
4270 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
4271 return PTR_ERR(set
);
4274 if (nlh
->nlmsg_flags
& NLM_F_EXCL
) {
4275 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
4278 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
)
4284 if (!(nlh
->nlmsg_flags
& NLM_F_CREATE
))
4287 ops
= nft_select_set_ops(&ctx
, nla
, &desc
, policy
);
4289 return PTR_ERR(ops
);
4292 if (nla
[NFTA_SET_USERDATA
])
4293 udlen
= nla_len(nla
[NFTA_SET_USERDATA
]);
4296 if (ops
->privsize
!= NULL
)
4297 size
= ops
->privsize(nla
, &desc
);
4299 set
= kvzalloc(sizeof(*set
) + size
+ udlen
, GFP_KERNEL
);
4303 name
= nla_strdup(nla
[NFTA_SET_NAME
], GFP_KERNEL
);
4309 err
= nf_tables_set_alloc_name(&ctx
, set
, name
);
4312 goto err_set_alloc_name
;
4314 if (nla
[NFTA_SET_EXPR
]) {
4315 expr
= nft_set_elem_expr_alloc(&ctx
, set
, nla
[NFTA_SET_EXPR
]);
4317 err
= PTR_ERR(expr
);
4318 goto err_set_alloc_name
;
4320 set
->exprs
[0] = expr
;
4322 } else if (nla
[NFTA_SET_EXPRESSIONS
]) {
4323 struct nft_expr
*expr
;
4327 if (!(flags
& NFT_SET_EXPR
)) {
4329 goto err_set_alloc_name
;
4332 nla_for_each_nested(tmp
, nla
[NFTA_SET_EXPRESSIONS
], left
) {
4333 if (i
== NFT_SET_EXPR_MAX
) {
4337 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
4341 expr
= nft_set_elem_expr_alloc(&ctx
, set
, tmp
);
4343 err
= PTR_ERR(expr
);
4346 set
->exprs
[i
++] = expr
;
4353 udata
= set
->data
+ size
;
4354 nla_memcpy(udata
, nla
[NFTA_SET_USERDATA
], udlen
);
4357 INIT_LIST_HEAD(&set
->bindings
);
4359 write_pnet(&set
->net
, net
);
4362 set
->klen
= desc
.klen
;
4364 set
->objtype
= objtype
;
4365 set
->dlen
= desc
.dlen
;
4367 set
->size
= desc
.size
;
4368 set
->policy
= policy
;
4371 set
->timeout
= timeout
;
4372 set
->gc_int
= gc_int
;
4373 set
->handle
= nf_tables_alloc_handle(table
);
4375 set
->field_count
= desc
.field_count
;
4376 for (i
= 0; i
< desc
.field_count
; i
++)
4377 set
->field_len
[i
] = desc
.field_len
[i
];
4379 err
= ops
->init(set
, &desc
, nla
);
4383 err
= nft_trans_set_add(&ctx
, NFT_MSG_NEWSET
, set
);
4387 list_add_tail_rcu(&set
->list
, &table
->sets
);
4394 for (i
= 0; i
< set
->num_exprs
; i
++)
4395 nft_expr_destroy(&ctx
, set
->exprs
[i
]);
4403 static void nft_set_destroy(const struct nft_ctx
*ctx
, struct nft_set
*set
)
4407 if (WARN_ON(set
->use
> 0))
4410 for (i
= 0; i
< set
->num_exprs
; i
++)
4411 nft_expr_destroy(ctx
, set
->exprs
[i
]);
4413 set
->ops
->destroy(set
);
4418 static int nf_tables_delset(struct net
*net
, struct sock
*nlsk
,
4419 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
4420 const struct nlattr
* const nla
[],
4421 struct netlink_ext_ack
*extack
)
4423 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
4424 u8 genmask
= nft_genmask_next(net
);
4425 const struct nlattr
*attr
;
4426 struct nft_set
*set
;
4430 if (nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
4431 return -EAFNOSUPPORT
;
4432 if (nla
[NFTA_SET_TABLE
] == NULL
)
4435 err
= nft_ctx_init_from_setattr(&ctx
, net
, skb
, nlh
, nla
, extack
,
4436 genmask
, NETLINK_CB(skb
).portid
);
4440 if (nla
[NFTA_SET_HANDLE
]) {
4441 attr
= nla
[NFTA_SET_HANDLE
];
4442 set
= nft_set_lookup_byhandle(ctx
.table
, attr
, genmask
);
4444 attr
= nla
[NFTA_SET_NAME
];
4445 set
= nft_set_lookup(ctx
.table
, attr
, genmask
);
4449 NL_SET_BAD_ATTR(extack
, attr
);
4450 return PTR_ERR(set
);
4453 (nlh
->nlmsg_flags
& NLM_F_NONREC
&& atomic_read(&set
->nelems
) > 0)) {
4454 NL_SET_BAD_ATTR(extack
, attr
);
4458 return nft_delset(&ctx
, set
);
4461 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
4462 enum nft_registers reg
,
4463 const struct nft_data
*data
,
4464 enum nft_data_types type
,
4467 static int nf_tables_bind_check_setelem(const struct nft_ctx
*ctx
,
4468 struct nft_set
*set
,
4469 const struct nft_set_iter
*iter
,
4470 struct nft_set_elem
*elem
)
4472 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
4473 enum nft_registers dreg
;
4475 dreg
= nft_type_to_reg(set
->dtype
);
4476 return nft_validate_register_store(ctx
, dreg
, nft_set_ext_data(ext
),
4477 set
->dtype
== NFT_DATA_VERDICT
?
4478 NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
4482 int nf_tables_bind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4483 struct nft_set_binding
*binding
)
4485 struct nft_set_binding
*i
;
4486 struct nft_set_iter iter
;
4488 if (set
->use
== UINT_MAX
)
4491 if (!list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
4494 if (binding
->flags
& NFT_SET_MAP
) {
4495 /* If the set is already bound to the same chain all
4496 * jumps are already validated for that chain.
4498 list_for_each_entry(i
, &set
->bindings
, list
) {
4499 if (i
->flags
& NFT_SET_MAP
&&
4500 i
->chain
== binding
->chain
)
4504 iter
.genmask
= nft_genmask_next(ctx
->net
);
4508 iter
.fn
= nf_tables_bind_check_setelem
;
4510 set
->ops
->walk(ctx
, set
, &iter
);
4515 binding
->chain
= ctx
->chain
;
4516 list_add_tail_rcu(&binding
->list
, &set
->bindings
);
4517 nft_set_trans_bind(ctx
, set
);
4522 EXPORT_SYMBOL_GPL(nf_tables_bind_set
);
4524 static void nf_tables_unbind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4525 struct nft_set_binding
*binding
, bool event
)
4527 list_del_rcu(&binding
->list
);
4529 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
)) {
4530 list_del_rcu(&set
->list
);
4532 nf_tables_set_notify(ctx
, set
, NFT_MSG_DELSET
,
4537 void nf_tables_deactivate_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
4538 struct nft_set_binding
*binding
,
4539 enum nft_trans_phase phase
)
4542 case NFT_TRANS_PREPARE
:
4545 case NFT_TRANS_ABORT
:
4546 case NFT_TRANS_RELEASE
:
4550 nf_tables_unbind_set(ctx
, set
, binding
,
4551 phase
== NFT_TRANS_COMMIT
);
4554 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set
);
4556 void nf_tables_destroy_set(const struct nft_ctx
*ctx
, struct nft_set
*set
)
4558 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
4559 nft_set_destroy(ctx
, set
);
4561 EXPORT_SYMBOL_GPL(nf_tables_destroy_set
);
4563 const struct nft_set_ext_type nft_set_ext_types
[] = {
4564 [NFT_SET_EXT_KEY
] = {
4565 .align
= __alignof__(u32
),
4567 [NFT_SET_EXT_DATA
] = {
4568 .align
= __alignof__(u32
),
4570 [NFT_SET_EXT_EXPRESSIONS
] = {
4571 .align
= __alignof__(struct nft_set_elem_expr
),
4573 [NFT_SET_EXT_OBJREF
] = {
4574 .len
= sizeof(struct nft_object
*),
4575 .align
= __alignof__(struct nft_object
*),
4577 [NFT_SET_EXT_FLAGS
] = {
4579 .align
= __alignof__(u8
),
4581 [NFT_SET_EXT_TIMEOUT
] = {
4583 .align
= __alignof__(u64
),
4585 [NFT_SET_EXT_EXPIRATION
] = {
4587 .align
= __alignof__(u64
),
4589 [NFT_SET_EXT_USERDATA
] = {
4590 .len
= sizeof(struct nft_userdata
),
4591 .align
= __alignof__(struct nft_userdata
),
4593 [NFT_SET_EXT_KEY_END
] = {
4594 .align
= __alignof__(u32
),
4602 static const struct nla_policy nft_set_elem_policy
[NFTA_SET_ELEM_MAX
+ 1] = {
4603 [NFTA_SET_ELEM_KEY
] = { .type
= NLA_NESTED
},
4604 [NFTA_SET_ELEM_DATA
] = { .type
= NLA_NESTED
},
4605 [NFTA_SET_ELEM_FLAGS
] = { .type
= NLA_U32
},
4606 [NFTA_SET_ELEM_TIMEOUT
] = { .type
= NLA_U64
},
4607 [NFTA_SET_ELEM_EXPIRATION
] = { .type
= NLA_U64
},
4608 [NFTA_SET_ELEM_USERDATA
] = { .type
= NLA_BINARY
,
4609 .len
= NFT_USERDATA_MAXLEN
},
4610 [NFTA_SET_ELEM_EXPR
] = { .type
= NLA_NESTED
},
4611 [NFTA_SET_ELEM_OBJREF
] = { .type
= NLA_STRING
,
4612 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
4613 [NFTA_SET_ELEM_KEY_END
] = { .type
= NLA_NESTED
},
4614 [NFTA_SET_ELEM_EXPRESSIONS
] = { .type
= NLA_NESTED
},
4617 static const struct nla_policy nft_set_elem_list_policy
[NFTA_SET_ELEM_LIST_MAX
+ 1] = {
4618 [NFTA_SET_ELEM_LIST_TABLE
] = { .type
= NLA_STRING
,
4619 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
4620 [NFTA_SET_ELEM_LIST_SET
] = { .type
= NLA_STRING
,
4621 .len
= NFT_SET_MAXNAMELEN
- 1 },
4622 [NFTA_SET_ELEM_LIST_ELEMENTS
] = { .type
= NLA_NESTED
},
4623 [NFTA_SET_ELEM_LIST_SET_ID
] = { .type
= NLA_U32
},
4626 static int nft_ctx_init_from_elemattr(struct nft_ctx
*ctx
, struct net
*net
,
4627 const struct sk_buff
*skb
,
4628 const struct nlmsghdr
*nlh
,
4629 const struct nlattr
* const nla
[],
4630 struct netlink_ext_ack
*extack
,
4631 u8 genmask
, u32 nlpid
)
4633 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
4634 int family
= nfmsg
->nfgen_family
;
4635 struct nft_table
*table
;
4637 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
4639 if (IS_ERR(table
)) {
4640 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
4641 return PTR_ERR(table
);
4644 nft_ctx_init(ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
4648 static int nft_set_elem_expr_dump(struct sk_buff
*skb
,
4649 const struct nft_set
*set
,
4650 const struct nft_set_ext
*ext
)
4652 struct nft_set_elem_expr
*elem_expr
;
4653 u32 size
, num_exprs
= 0;
4654 struct nft_expr
*expr
;
4655 struct nlattr
*nest
;
4657 elem_expr
= nft_set_ext_expr(ext
);
4658 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
4661 if (num_exprs
== 1) {
4662 expr
= nft_setelem_expr_at(elem_expr
, 0);
4663 if (nft_expr_dump(skb
, NFTA_SET_ELEM_EXPR
, expr
) < 0)
4667 } else if (num_exprs
> 1) {
4668 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_EXPRESSIONS
);
4670 goto nla_put_failure
;
4672 nft_setelem_expr_foreach(expr
, elem_expr
, size
) {
4673 expr
= nft_setelem_expr_at(elem_expr
, size
);
4674 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
) < 0)
4675 goto nla_put_failure
;
4677 nla_nest_end(skb
, nest
);
4685 static int nf_tables_fill_setelem(struct sk_buff
*skb
,
4686 const struct nft_set
*set
,
4687 const struct nft_set_elem
*elem
)
4689 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
4690 unsigned char *b
= skb_tail_pointer(skb
);
4691 struct nlattr
*nest
;
4693 nest
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
4695 goto nla_put_failure
;
4697 if (nft_data_dump(skb
, NFTA_SET_ELEM_KEY
, nft_set_ext_key(ext
),
4698 NFT_DATA_VALUE
, set
->klen
) < 0)
4699 goto nla_put_failure
;
4701 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
) &&
4702 nft_data_dump(skb
, NFTA_SET_ELEM_KEY_END
, nft_set_ext_key_end(ext
),
4703 NFT_DATA_VALUE
, set
->klen
) < 0)
4704 goto nla_put_failure
;
4706 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
4707 nft_data_dump(skb
, NFTA_SET_ELEM_DATA
, nft_set_ext_data(ext
),
4708 set
->dtype
== NFT_DATA_VERDICT
? NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
4710 goto nla_put_failure
;
4712 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
) &&
4713 nft_set_elem_expr_dump(skb
, set
, ext
))
4714 goto nla_put_failure
;
4716 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
4717 nla_put_string(skb
, NFTA_SET_ELEM_OBJREF
,
4718 (*nft_set_ext_obj(ext
))->key
.name
) < 0)
4719 goto nla_put_failure
;
4721 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
4722 nla_put_be32(skb
, NFTA_SET_ELEM_FLAGS
,
4723 htonl(*nft_set_ext_flags(ext
))))
4724 goto nla_put_failure
;
4726 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
) &&
4727 nla_put_be64(skb
, NFTA_SET_ELEM_TIMEOUT
,
4728 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext
)),
4730 goto nla_put_failure
;
4732 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
4733 u64 expires
, now
= get_jiffies_64();
4735 expires
= *nft_set_ext_expiration(ext
);
4736 if (time_before64(now
, expires
))
4741 if (nla_put_be64(skb
, NFTA_SET_ELEM_EXPIRATION
,
4742 nf_jiffies64_to_msecs(expires
),
4744 goto nla_put_failure
;
4747 if (nft_set_ext_exists(ext
, NFT_SET_EXT_USERDATA
)) {
4748 struct nft_userdata
*udata
;
4750 udata
= nft_set_ext_userdata(ext
);
4751 if (nla_put(skb
, NFTA_SET_ELEM_USERDATA
,
4752 udata
->len
+ 1, udata
->data
))
4753 goto nla_put_failure
;
4756 nla_nest_end(skb
, nest
);
4764 struct nft_set_dump_args
{
4765 const struct netlink_callback
*cb
;
4766 struct nft_set_iter iter
;
4767 struct sk_buff
*skb
;
4770 static int nf_tables_dump_setelem(const struct nft_ctx
*ctx
,
4771 struct nft_set
*set
,
4772 const struct nft_set_iter
*iter
,
4773 struct nft_set_elem
*elem
)
4775 struct nft_set_dump_args
*args
;
4777 args
= container_of(iter
, struct nft_set_dump_args
, iter
);
4778 return nf_tables_fill_setelem(args
->skb
, set
, elem
);
4781 struct nft_set_dump_ctx
{
4782 const struct nft_set
*set
;
4786 static int nf_tables_dump_set(struct sk_buff
*skb
, struct netlink_callback
*cb
)
4788 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
4789 struct net
*net
= sock_net(skb
->sk
);
4790 struct nft_table
*table
;
4791 struct nft_set
*set
;
4792 struct nft_set_dump_args args
;
4793 bool set_found
= false;
4794 struct nfgenmsg
*nfmsg
;
4795 struct nlmsghdr
*nlh
;
4796 struct nlattr
*nest
;
4801 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
) {
4802 if (dump_ctx
->ctx
.family
!= NFPROTO_UNSPEC
&&
4803 dump_ctx
->ctx
.family
!= table
->family
)
4806 if (table
!= dump_ctx
->ctx
.table
)
4809 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
4810 if (set
== dump_ctx
->set
) {
4823 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWSETELEM
);
4824 portid
= NETLINK_CB(cb
->skb
).portid
;
4825 seq
= cb
->nlh
->nlmsg_seq
;
4827 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
),
4830 goto nla_put_failure
;
4832 nfmsg
= nlmsg_data(nlh
);
4833 nfmsg
->nfgen_family
= table
->family
;
4834 nfmsg
->version
= NFNETLINK_V0
;
4835 nfmsg
->res_id
= htons(net
->nft
.base_seq
& 0xffff);
4837 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_TABLE
, table
->name
))
4838 goto nla_put_failure
;
4839 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_SET
, set
->name
))
4840 goto nla_put_failure
;
4842 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
4844 goto nla_put_failure
;
4848 args
.iter
.genmask
= nft_genmask_cur(net
);
4849 args
.iter
.skip
= cb
->args
[0];
4850 args
.iter
.count
= 0;
4852 args
.iter
.fn
= nf_tables_dump_setelem
;
4853 set
->ops
->walk(&dump_ctx
->ctx
, set
, &args
.iter
);
4856 nla_nest_end(skb
, nest
);
4857 nlmsg_end(skb
, nlh
);
4859 if (args
.iter
.err
&& args
.iter
.err
!= -EMSGSIZE
)
4860 return args
.iter
.err
;
4861 if (args
.iter
.count
== cb
->args
[0])
4864 cb
->args
[0] = args
.iter
.count
;
4872 static int nf_tables_dump_set_start(struct netlink_callback
*cb
)
4874 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
4876 cb
->data
= kmemdup(dump_ctx
, sizeof(*dump_ctx
), GFP_ATOMIC
);
4878 return cb
->data
? 0 : -ENOMEM
;
4881 static int nf_tables_dump_set_done(struct netlink_callback
*cb
)
4887 static int nf_tables_fill_setelem_info(struct sk_buff
*skb
,
4888 const struct nft_ctx
*ctx
, u32 seq
,
4889 u32 portid
, int event
, u16 flags
,
4890 const struct nft_set
*set
,
4891 const struct nft_set_elem
*elem
)
4893 struct nfgenmsg
*nfmsg
;
4894 struct nlmsghdr
*nlh
;
4895 struct nlattr
*nest
;
4898 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
4899 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
),
4902 goto nla_put_failure
;
4904 nfmsg
= nlmsg_data(nlh
);
4905 nfmsg
->nfgen_family
= ctx
->family
;
4906 nfmsg
->version
= NFNETLINK_V0
;
4907 nfmsg
->res_id
= htons(ctx
->net
->nft
.base_seq
& 0xffff);
4909 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
4910 goto nla_put_failure
;
4911 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
4912 goto nla_put_failure
;
4914 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
4916 goto nla_put_failure
;
4918 err
= nf_tables_fill_setelem(skb
, set
, elem
);
4920 goto nla_put_failure
;
4922 nla_nest_end(skb
, nest
);
4924 nlmsg_end(skb
, nlh
);
4928 nlmsg_trim(skb
, nlh
);
4932 static int nft_setelem_parse_flags(const struct nft_set
*set
,
4933 const struct nlattr
*attr
, u32
*flags
)
4938 *flags
= ntohl(nla_get_be32(attr
));
4939 if (*flags
& ~NFT_SET_ELEM_INTERVAL_END
)
4941 if (!(set
->flags
& NFT_SET_INTERVAL
) &&
4942 *flags
& NFT_SET_ELEM_INTERVAL_END
)
4948 static int nft_setelem_parse_key(struct nft_ctx
*ctx
, struct nft_set
*set
,
4949 struct nft_data
*key
, struct nlattr
*attr
)
4951 struct nft_data_desc desc
;
4954 err
= nft_data_init(ctx
, key
, NFT_DATA_VALUE_MAXLEN
, &desc
, attr
);
4958 if (desc
.type
!= NFT_DATA_VALUE
|| desc
.len
!= set
->klen
) {
4959 nft_data_release(key
, desc
.type
);
4966 static int nft_setelem_parse_data(struct nft_ctx
*ctx
, struct nft_set
*set
,
4967 struct nft_data_desc
*desc
,
4968 struct nft_data
*data
,
4969 struct nlattr
*attr
)
4973 err
= nft_data_init(ctx
, data
, NFT_DATA_VALUE_MAXLEN
, desc
, attr
);
4977 if (desc
->type
!= NFT_DATA_VERDICT
&& desc
->len
!= set
->dlen
) {
4978 nft_data_release(data
, desc
->type
);
4985 static int nft_get_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
4986 const struct nlattr
*attr
)
4988 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
4989 struct nft_set_elem elem
;
4990 struct sk_buff
*skb
;
4995 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
4996 nft_set_elem_policy
, NULL
);
5000 if (!nla
[NFTA_SET_ELEM_KEY
])
5003 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
5007 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
5008 nla
[NFTA_SET_ELEM_KEY
]);
5012 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
5013 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
5014 nla
[NFTA_SET_ELEM_KEY_END
]);
5019 priv
= set
->ops
->get(ctx
->net
, set
, &elem
, flags
);
5021 return PTR_ERR(priv
);
5026 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_ATOMIC
);
5030 err
= nf_tables_fill_setelem_info(skb
, ctx
, ctx
->seq
, ctx
->portid
,
5031 NFT_MSG_NEWSETELEM
, 0, set
, &elem
);
5033 goto err_fill_setelem
;
5035 return nfnetlink_unicast(skb
, ctx
->net
, ctx
->portid
);
5042 /* called with rcu_read_lock held */
5043 static int nf_tables_getsetelem(struct net
*net
, struct sock
*nlsk
,
5044 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
5045 const struct nlattr
* const nla
[],
5046 struct netlink_ext_ack
*extack
)
5048 u8 genmask
= nft_genmask_cur(net
);
5049 struct nft_set
*set
;
5050 struct nlattr
*attr
;
5054 err
= nft_ctx_init_from_elemattr(&ctx
, net
, skb
, nlh
, nla
, extack
,
5055 genmask
, NETLINK_CB(skb
).portid
);
5059 set
= nft_set_lookup(ctx
.table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
5061 return PTR_ERR(set
);
5063 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
5064 struct netlink_dump_control c
= {
5065 .start
= nf_tables_dump_set_start
,
5066 .dump
= nf_tables_dump_set
,
5067 .done
= nf_tables_dump_set_done
,
5068 .module
= THIS_MODULE
,
5070 struct nft_set_dump_ctx dump_ctx
= {
5076 return nft_netlink_dump_start_rcu(nlsk
, skb
, nlh
, &c
);
5079 if (!nla
[NFTA_SET_ELEM_LIST_ELEMENTS
])
5082 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
5083 err
= nft_get_set_elem(&ctx
, set
, attr
);
5091 static void nf_tables_setelem_notify(const struct nft_ctx
*ctx
,
5092 const struct nft_set
*set
,
5093 const struct nft_set_elem
*elem
,
5094 int event
, u16 flags
)
5096 struct net
*net
= ctx
->net
;
5097 u32 portid
= ctx
->portid
;
5098 struct sk_buff
*skb
;
5100 char *buf
= kasprintf(GFP_KERNEL
, "%s:%llu;%s:%llu",
5101 ctx
->table
->name
, ctx
->table
->handle
,
5102 set
->name
, set
->handle
);
5104 audit_log_nfcfg(buf
,
5107 event
== NFT_MSG_NEWSETELEM
?
5108 AUDIT_NFT_OP_SETELEM_REGISTER
:
5109 AUDIT_NFT_OP_SETELEM_UNREGISTER
,
5113 if (!ctx
->report
&& !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
5116 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
5120 err
= nf_tables_fill_setelem_info(skb
, ctx
, 0, portid
, event
, flags
,
5127 nft_notify_enqueue(skb
, ctx
->report
, &ctx
->net
->nft
.notify_list
);
5130 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
5133 static struct nft_trans
*nft_trans_elem_alloc(struct nft_ctx
*ctx
,
5135 struct nft_set
*set
)
5137 struct nft_trans
*trans
;
5139 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_elem
));
5143 nft_trans_elem_set(trans
) = set
;
5147 struct nft_expr
*nft_set_elem_expr_alloc(const struct nft_ctx
*ctx
,
5148 const struct nft_set
*set
,
5149 const struct nlattr
*attr
)
5151 struct nft_expr
*expr
;
5154 expr
= nft_expr_init(ctx
, attr
);
5159 if (!(expr
->ops
->type
->flags
& NFT_EXPR_STATEFUL
))
5160 goto err_set_elem_expr
;
5162 if (expr
->ops
->type
->flags
& NFT_EXPR_GC
) {
5163 if (set
->flags
& NFT_SET_TIMEOUT
)
5164 goto err_set_elem_expr
;
5165 if (!set
->ops
->gc_init
)
5166 goto err_set_elem_expr
;
5167 set
->ops
->gc_init(set
);
5173 nft_expr_destroy(ctx
, expr
);
5174 return ERR_PTR(err
);
5177 void *nft_set_elem_init(const struct nft_set
*set
,
5178 const struct nft_set_ext_tmpl
*tmpl
,
5179 const u32
*key
, const u32
*key_end
,
5180 const u32
*data
, u64 timeout
, u64 expiration
, gfp_t gfp
)
5182 struct nft_set_ext
*ext
;
5185 elem
= kzalloc(set
->ops
->elemsize
+ tmpl
->len
, gfp
);
5189 ext
= nft_set_elem_ext(set
, elem
);
5190 nft_set_ext_init(ext
, tmpl
);
5192 memcpy(nft_set_ext_key(ext
), key
, set
->klen
);
5193 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
))
5194 memcpy(nft_set_ext_key_end(ext
), key_end
, set
->klen
);
5195 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5196 memcpy(nft_set_ext_data(ext
), data
, set
->dlen
);
5197 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
5198 *nft_set_ext_expiration(ext
) = get_jiffies_64() + expiration
;
5199 if (expiration
== 0)
5200 *nft_set_ext_expiration(ext
) += timeout
;
5202 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
))
5203 *nft_set_ext_timeout(ext
) = timeout
;
5208 static void __nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
5209 struct nft_expr
*expr
)
5211 if (expr
->ops
->destroy_clone
) {
5212 expr
->ops
->destroy_clone(ctx
, expr
);
5213 module_put(expr
->ops
->type
->owner
);
5215 nf_tables_expr_destroy(ctx
, expr
);
5219 static void nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
5220 struct nft_set_elem_expr
*elem_expr
)
5222 struct nft_expr
*expr
;
5225 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
5226 __nft_set_elem_expr_destroy(ctx
, expr
);
5229 void nft_set_elem_destroy(const struct nft_set
*set
, void *elem
,
5232 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
);
5233 struct nft_ctx ctx
= {
5234 .net
= read_pnet(&set
->net
),
5235 .family
= set
->table
->family
,
5238 nft_data_release(nft_set_ext_key(ext
), NFT_DATA_VALUE
);
5239 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5240 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
5241 if (destroy_expr
&& nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
5242 nft_set_elem_expr_destroy(&ctx
, nft_set_ext_expr(ext
));
5244 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
5245 (*nft_set_ext_obj(ext
))->use
--;
5248 EXPORT_SYMBOL_GPL(nft_set_elem_destroy
);
5250 /* Only called from commit path, nft_set_elem_deactivate() already deals with
5251 * the refcounting from the preparation phase.
5253 static void nf_tables_set_elem_destroy(const struct nft_ctx
*ctx
,
5254 const struct nft_set
*set
, void *elem
)
5256 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
);
5258 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
5259 nft_set_elem_expr_destroy(ctx
, nft_set_ext_expr(ext
));
5264 int nft_set_elem_expr_clone(const struct nft_ctx
*ctx
, struct nft_set
*set
,
5265 struct nft_expr
*expr_array
[])
5267 struct nft_expr
*expr
;
5270 for (i
= 0; i
< set
->num_exprs
; i
++) {
5271 expr
= kzalloc(set
->exprs
[i
]->ops
->size
, GFP_KERNEL
);
5275 err
= nft_expr_clone(expr
, set
->exprs
[i
]);
5277 nft_expr_destroy(ctx
, expr
);
5280 expr_array
[i
] = expr
;
5286 for (k
= i
- 1; k
>= 0; k
--)
5287 nft_expr_destroy(ctx
, expr_array
[k
]);
5292 static void nft_set_elem_expr_setup(const struct nft_set_ext
*ext
, int i
,
5293 struct nft_expr
*expr_array
[])
5295 struct nft_set_elem_expr
*elem_expr
= nft_set_ext_expr(ext
);
5296 struct nft_expr
*expr
= nft_setelem_expr_at(elem_expr
, elem_expr
->size
);
5298 memcpy(expr
, expr_array
[i
], expr_array
[i
]->ops
->size
);
5299 elem_expr
->size
+= expr_array
[i
]->ops
->size
;
5300 kfree(expr_array
[i
]);
5301 expr_array
[i
] = NULL
;
5304 static int nft_add_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
5305 const struct nlattr
*attr
, u32 nlmsg_flags
)
5307 struct nft_expr
*expr_array
[NFT_SET_EXPR_MAX
] = {};
5308 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
5309 u8 genmask
= nft_genmask_next(ctx
->net
);
5310 u32 flags
= 0, size
= 0, num_exprs
= 0;
5311 struct nft_set_ext_tmpl tmpl
;
5312 struct nft_set_ext
*ext
, *ext2
;
5313 struct nft_set_elem elem
;
5314 struct nft_set_binding
*binding
;
5315 struct nft_object
*obj
= NULL
;
5316 struct nft_userdata
*udata
;
5317 struct nft_data_desc desc
;
5318 enum nft_registers dreg
;
5319 struct nft_trans
*trans
;
5325 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
5326 nft_set_elem_policy
, NULL
);
5330 if (nla
[NFTA_SET_ELEM_KEY
] == NULL
)
5333 nft_set_ext_prepare(&tmpl
);
5335 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
5339 nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
5341 if (set
->flags
& NFT_SET_MAP
) {
5342 if (nla
[NFTA_SET_ELEM_DATA
] == NULL
&&
5343 !(flags
& NFT_SET_ELEM_INTERVAL_END
))
5346 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
5350 if ((flags
& NFT_SET_ELEM_INTERVAL_END
) &&
5351 (nla
[NFTA_SET_ELEM_DATA
] ||
5352 nla
[NFTA_SET_ELEM_OBJREF
] ||
5353 nla
[NFTA_SET_ELEM_TIMEOUT
] ||
5354 nla
[NFTA_SET_ELEM_EXPIRATION
] ||
5355 nla
[NFTA_SET_ELEM_USERDATA
] ||
5356 nla
[NFTA_SET_ELEM_EXPR
] ||
5357 nla
[NFTA_SET_ELEM_EXPRESSIONS
]))
5361 if (nla
[NFTA_SET_ELEM_TIMEOUT
] != NULL
) {
5362 if (!(set
->flags
& NFT_SET_TIMEOUT
))
5364 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_TIMEOUT
],
5368 } else if (set
->flags
& NFT_SET_TIMEOUT
) {
5369 timeout
= set
->timeout
;
5373 if (nla
[NFTA_SET_ELEM_EXPIRATION
] != NULL
) {
5374 if (!(set
->flags
& NFT_SET_TIMEOUT
))
5376 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_EXPIRATION
],
5382 if (nla
[NFTA_SET_ELEM_EXPR
]) {
5383 struct nft_expr
*expr
;
5385 if (set
->num_exprs
&& set
->num_exprs
!= 1)
5388 expr
= nft_set_elem_expr_alloc(ctx
, set
,
5389 nla
[NFTA_SET_ELEM_EXPR
]);
5391 return PTR_ERR(expr
);
5393 expr_array
[0] = expr
;
5396 if (set
->num_exprs
&& set
->exprs
[0]->ops
!= expr
->ops
) {
5398 goto err_set_elem_expr
;
5400 } else if (nla
[NFTA_SET_ELEM_EXPRESSIONS
]) {
5401 struct nft_expr
*expr
;
5406 nla_for_each_nested(tmp
, nla
[NFTA_SET_ELEM_EXPRESSIONS
], left
) {
5407 if (i
== NFT_SET_EXPR_MAX
||
5408 (set
->num_exprs
&& set
->num_exprs
== i
)) {
5410 goto err_set_elem_expr
;
5412 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
5414 goto err_set_elem_expr
;
5416 expr
= nft_set_elem_expr_alloc(ctx
, set
, tmp
);
5418 err
= PTR_ERR(expr
);
5419 goto err_set_elem_expr
;
5421 expr_array
[i
] = expr
;
5424 if (set
->num_exprs
&& expr
->ops
!= set
->exprs
[i
]->ops
) {
5426 goto err_set_elem_expr
;
5430 if (set
->num_exprs
&& set
->num_exprs
!= i
) {
5432 goto err_set_elem_expr
;
5434 } else if (set
->num_exprs
> 0) {
5435 err
= nft_set_elem_expr_clone(ctx
, set
, expr_array
);
5437 goto err_set_elem_expr_clone
;
5439 num_exprs
= set
->num_exprs
;
5442 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
5443 nla
[NFTA_SET_ELEM_KEY
]);
5445 goto err_set_elem_expr
;
5447 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
5449 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
5450 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
5451 nla
[NFTA_SET_ELEM_KEY_END
]);
5455 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
5459 nft_set_ext_add(&tmpl
, NFT_SET_EXT_EXPIRATION
);
5460 if (timeout
!= set
->timeout
)
5461 nft_set_ext_add(&tmpl
, NFT_SET_EXT_TIMEOUT
);
5465 for (i
= 0; i
< num_exprs
; i
++)
5466 size
+= expr_array
[i
]->ops
->size
;
5468 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_EXPRESSIONS
,
5469 sizeof(struct nft_set_elem_expr
) +
5473 if (nla
[NFTA_SET_ELEM_OBJREF
] != NULL
) {
5474 if (!(set
->flags
& NFT_SET_OBJECT
)) {
5476 goto err_parse_key_end
;
5478 obj
= nft_obj_lookup(ctx
->net
, ctx
->table
,
5479 nla
[NFTA_SET_ELEM_OBJREF
],
5480 set
->objtype
, genmask
);
5483 goto err_parse_key_end
;
5485 nft_set_ext_add(&tmpl
, NFT_SET_EXT_OBJREF
);
5488 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
) {
5489 err
= nft_setelem_parse_data(ctx
, set
, &desc
, &elem
.data
.val
,
5490 nla
[NFTA_SET_ELEM_DATA
]);
5492 goto err_parse_key_end
;
5494 dreg
= nft_type_to_reg(set
->dtype
);
5495 list_for_each_entry(binding
, &set
->bindings
, list
) {
5496 struct nft_ctx bind_ctx
= {
5498 .family
= ctx
->family
,
5499 .table
= ctx
->table
,
5500 .chain
= (struct nft_chain
*)binding
->chain
,
5503 if (!(binding
->flags
& NFT_SET_MAP
))
5506 err
= nft_validate_register_store(&bind_ctx
, dreg
,
5508 desc
.type
, desc
.len
);
5510 goto err_parse_data
;
5512 if (desc
.type
== NFT_DATA_VERDICT
&&
5513 (elem
.data
.val
.verdict
.code
== NFT_GOTO
||
5514 elem
.data
.val
.verdict
.code
== NFT_JUMP
))
5515 nft_validate_state_update(ctx
->net
,
5519 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_DATA
, desc
.len
);
5522 /* The full maximum length of userdata can exceed the maximum
5523 * offset value (U8_MAX) for following extensions, therefor it
5524 * must be the last extension added.
5527 if (nla
[NFTA_SET_ELEM_USERDATA
] != NULL
) {
5528 ulen
= nla_len(nla
[NFTA_SET_ELEM_USERDATA
]);
5530 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_USERDATA
,
5535 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
5536 elem
.key_end
.val
.data
, elem
.data
.val
.data
,
5537 timeout
, expiration
, GFP_KERNEL
);
5538 if (elem
.priv
== NULL
)
5539 goto err_parse_data
;
5541 ext
= nft_set_elem_ext(set
, elem
.priv
);
5543 *nft_set_ext_flags(ext
) = flags
;
5545 udata
= nft_set_ext_userdata(ext
);
5546 udata
->len
= ulen
- 1;
5547 nla_memcpy(&udata
->data
, nla
[NFTA_SET_ELEM_USERDATA
], ulen
);
5550 *nft_set_ext_obj(ext
) = obj
;
5553 for (i
= 0; i
< num_exprs
; i
++)
5554 nft_set_elem_expr_setup(ext
, i
, expr_array
);
5556 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_NEWSETELEM
, set
);
5560 ext
->genmask
= nft_genmask_cur(ctx
->net
) | NFT_SET_ELEM_BUSY_MASK
;
5561 err
= set
->ops
->insert(ctx
->net
, set
, &elem
, &ext2
);
5563 if (err
== -EEXIST
) {
5564 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) ^
5565 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) ||
5566 nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) ^
5567 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
))
5568 goto err_element_clash
;
5569 if ((nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
5570 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) &&
5571 memcmp(nft_set_ext_data(ext
),
5572 nft_set_ext_data(ext2
), set
->dlen
) != 0) ||
5573 (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
5574 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
) &&
5575 *nft_set_ext_obj(ext
) != *nft_set_ext_obj(ext2
)))
5576 goto err_element_clash
;
5577 else if (!(nlmsg_flags
& NLM_F_EXCL
))
5579 } else if (err
== -ENOTEMPTY
) {
5580 /* ENOTEMPTY reports overlapping between this element
5581 * and an existing one.
5585 goto err_element_clash
;
5589 !atomic_add_unless(&set
->nelems
, 1, set
->size
+ set
->ndeact
)) {
5594 nft_trans_elem(trans
) = elem
;
5595 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
5599 set
->ops
->remove(ctx
->net
, set
, &elem
);
5606 nf_tables_set_elem_destroy(ctx
, set
, elem
.priv
);
5608 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
5609 nft_data_release(&elem
.data
.val
, desc
.type
);
5611 nft_data_release(&elem
.key_end
.val
, NFT_DATA_VALUE
);
5613 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
5615 for (i
= 0; i
< num_exprs
&& expr_array
[i
]; i
++)
5616 nft_expr_destroy(ctx
, expr_array
[i
]);
5617 err_set_elem_expr_clone
:
5621 static int nf_tables_newsetelem(struct net
*net
, struct sock
*nlsk
,
5622 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
5623 const struct nlattr
* const nla
[],
5624 struct netlink_ext_ack
*extack
)
5626 u8 genmask
= nft_genmask_next(net
);
5627 const struct nlattr
*attr
;
5628 struct nft_set
*set
;
5632 if (nla
[NFTA_SET_ELEM_LIST_ELEMENTS
] == NULL
)
5635 err
= nft_ctx_init_from_elemattr(&ctx
, net
, skb
, nlh
, nla
, extack
,
5636 genmask
, NETLINK_CB(skb
).portid
);
5640 set
= nft_set_lookup_global(net
, ctx
.table
, nla
[NFTA_SET_ELEM_LIST_SET
],
5641 nla
[NFTA_SET_ELEM_LIST_SET_ID
], genmask
);
5643 return PTR_ERR(set
);
5645 if (!list_empty(&set
->bindings
) && set
->flags
& NFT_SET_CONSTANT
)
5648 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
5649 err
= nft_add_set_elem(&ctx
, set
, attr
, nlh
->nlmsg_flags
);
5654 if (net
->nft
.validate_state
== NFT_VALIDATE_DO
)
5655 return nft_table_validate(net
, ctx
.table
);
5661 * nft_data_hold - hold a nft_data item
5663 * @data: struct nft_data to release
5664 * @type: type of data
5666 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5667 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
5668 * NFT_GOTO verdicts. This function must be called on active data objects
5669 * from the second phase of the commit protocol.
5671 void nft_data_hold(const struct nft_data
*data
, enum nft_data_types type
)
5673 struct nft_chain
*chain
;
5674 struct nft_rule
*rule
;
5676 if (type
== NFT_DATA_VERDICT
) {
5677 switch (data
->verdict
.code
) {
5680 chain
= data
->verdict
.chain
;
5683 if (!nft_chain_is_bound(chain
))
5686 chain
->table
->use
++;
5687 list_for_each_entry(rule
, &chain
->rules
, list
)
5690 nft_chain_add(chain
->table
, chain
);
5696 static void nft_set_elem_activate(const struct net
*net
,
5697 const struct nft_set
*set
,
5698 struct nft_set_elem
*elem
)
5700 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
5702 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5703 nft_data_hold(nft_set_ext_data(ext
), set
->dtype
);
5704 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
5705 (*nft_set_ext_obj(ext
))->use
++;
5708 static void nft_set_elem_deactivate(const struct net
*net
,
5709 const struct nft_set
*set
,
5710 struct nft_set_elem
*elem
)
5712 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
5714 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
5715 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
5716 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
5717 (*nft_set_ext_obj(ext
))->use
--;
5720 static int nft_del_setelem(struct nft_ctx
*ctx
, struct nft_set
*set
,
5721 const struct nlattr
*attr
)
5723 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
5724 struct nft_set_ext_tmpl tmpl
;
5725 struct nft_set_elem elem
;
5726 struct nft_set_ext
*ext
;
5727 struct nft_trans
*trans
;
5732 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
5733 nft_set_elem_policy
, NULL
);
5737 if (nla
[NFTA_SET_ELEM_KEY
] == NULL
)
5740 nft_set_ext_prepare(&tmpl
);
5742 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
5746 nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
5748 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
5749 nla
[NFTA_SET_ELEM_KEY
]);
5753 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
5755 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
5756 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
5757 nla
[NFTA_SET_ELEM_KEY_END
]);
5761 nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
5765 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
5766 elem
.key_end
.val
.data
, NULL
, 0, 0,
5768 if (elem
.priv
== NULL
)
5771 ext
= nft_set_elem_ext(set
, elem
.priv
);
5773 *nft_set_ext_flags(ext
) = flags
;
5775 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_DELSETELEM
, set
);
5779 priv
= set
->ops
->deactivate(ctx
->net
, set
, &elem
);
5787 nft_set_elem_deactivate(ctx
->net
, set
, &elem
);
5789 nft_trans_elem(trans
) = elem
;
5790 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
5798 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
5802 static int nft_flush_set(const struct nft_ctx
*ctx
,
5803 struct nft_set
*set
,
5804 const struct nft_set_iter
*iter
,
5805 struct nft_set_elem
*elem
)
5807 struct nft_trans
*trans
;
5810 trans
= nft_trans_alloc_gfp(ctx
, NFT_MSG_DELSETELEM
,
5811 sizeof(struct nft_trans_elem
), GFP_ATOMIC
);
5815 if (!set
->ops
->flush(ctx
->net
, set
, elem
->priv
)) {
5821 nft_set_elem_deactivate(ctx
->net
, set
, elem
);
5822 nft_trans_elem_set(trans
) = set
;
5823 nft_trans_elem(trans
) = *elem
;
5824 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
5832 static int nf_tables_delsetelem(struct net
*net
, struct sock
*nlsk
,
5833 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
5834 const struct nlattr
* const nla
[],
5835 struct netlink_ext_ack
*extack
)
5837 u8 genmask
= nft_genmask_next(net
);
5838 const struct nlattr
*attr
;
5839 struct nft_set
*set
;
5843 err
= nft_ctx_init_from_elemattr(&ctx
, net
, skb
, nlh
, nla
, extack
,
5844 genmask
, NETLINK_CB(skb
).portid
);
5848 set
= nft_set_lookup(ctx
.table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
5850 return PTR_ERR(set
);
5851 if (!list_empty(&set
->bindings
) && set
->flags
& NFT_SET_CONSTANT
)
5854 if (nla
[NFTA_SET_ELEM_LIST_ELEMENTS
] == NULL
) {
5855 struct nft_set_iter iter
= {
5857 .fn
= nft_flush_set
,
5859 set
->ops
->walk(&ctx
, set
, &iter
);
5864 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
5865 err
= nft_del_setelem(&ctx
, set
, attr
);
5874 void nft_set_gc_batch_release(struct rcu_head
*rcu
)
5876 struct nft_set_gc_batch
*gcb
;
5879 gcb
= container_of(rcu
, struct nft_set_gc_batch
, head
.rcu
);
5880 for (i
= 0; i
< gcb
->head
.cnt
; i
++)
5881 nft_set_elem_destroy(gcb
->head
.set
, gcb
->elems
[i
], true);
5885 struct nft_set_gc_batch
*nft_set_gc_batch_alloc(const struct nft_set
*set
,
5888 struct nft_set_gc_batch
*gcb
;
5890 gcb
= kzalloc(sizeof(*gcb
), gfp
);
5893 gcb
->head
.set
= set
;
5902 * nft_register_obj- register nf_tables stateful object type
5903 * @obj_type: object type
5905 * Registers the object type for use with nf_tables. Returns zero on
5906 * success or a negative errno code otherwise.
5908 int nft_register_obj(struct nft_object_type
*obj_type
)
5910 if (obj_type
->type
== NFT_OBJECT_UNSPEC
)
5913 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
5914 list_add_rcu(&obj_type
->list
, &nf_tables_objects
);
5915 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
5918 EXPORT_SYMBOL_GPL(nft_register_obj
);
5921 * nft_unregister_obj - unregister nf_tables object type
5922 * @obj_type: object type
5924 * Unregisters the object type for use with nf_tables.
5926 void nft_unregister_obj(struct nft_object_type
*obj_type
)
5928 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
5929 list_del_rcu(&obj_type
->list
);
5930 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
5932 EXPORT_SYMBOL_GPL(nft_unregister_obj
);
5934 struct nft_object
*nft_obj_lookup(const struct net
*net
,
5935 const struct nft_table
*table
,
5936 const struct nlattr
*nla
, u32 objtype
,
5939 struct nft_object_hash_key k
= { .table
= table
};
5940 char search
[NFT_OBJ_MAXNAMELEN
];
5941 struct rhlist_head
*tmp
, *list
;
5942 struct nft_object
*obj
;
5944 nla_strscpy(search
, nla
, sizeof(search
));
5947 WARN_ON_ONCE(!rcu_read_lock_held() &&
5948 !lockdep_commit_lock_is_held(net
));
5951 list
= rhltable_lookup(&nft_objname_ht
, &k
, nft_objname_ht_params
);
5955 rhl_for_each_entry_rcu(obj
, tmp
, list
, rhlhead
) {
5956 if (objtype
== obj
->ops
->type
->type
&&
5957 nft_active_genmask(obj
, genmask
)) {
5964 return ERR_PTR(-ENOENT
);
5966 EXPORT_SYMBOL_GPL(nft_obj_lookup
);
5968 static struct nft_object
*nft_obj_lookup_byhandle(const struct nft_table
*table
,
5969 const struct nlattr
*nla
,
5970 u32 objtype
, u8 genmask
)
5972 struct nft_object
*obj
;
5974 list_for_each_entry(obj
, &table
->objects
, list
) {
5975 if (be64_to_cpu(nla_get_be64(nla
)) == obj
->handle
&&
5976 objtype
== obj
->ops
->type
->type
&&
5977 nft_active_genmask(obj
, genmask
))
5980 return ERR_PTR(-ENOENT
);
5983 static const struct nla_policy nft_obj_policy
[NFTA_OBJ_MAX
+ 1] = {
5984 [NFTA_OBJ_TABLE
] = { .type
= NLA_STRING
,
5985 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
5986 [NFTA_OBJ_NAME
] = { .type
= NLA_STRING
,
5987 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
5988 [NFTA_OBJ_TYPE
] = { .type
= NLA_U32
},
5989 [NFTA_OBJ_DATA
] = { .type
= NLA_NESTED
},
5990 [NFTA_OBJ_HANDLE
] = { .type
= NLA_U64
},
5991 [NFTA_OBJ_USERDATA
] = { .type
= NLA_BINARY
,
5992 .len
= NFT_USERDATA_MAXLEN
},
5995 static struct nft_object
*nft_obj_init(const struct nft_ctx
*ctx
,
5996 const struct nft_object_type
*type
,
5997 const struct nlattr
*attr
)
6000 const struct nft_object_ops
*ops
;
6001 struct nft_object
*obj
;
6004 tb
= kmalloc_array(type
->maxattr
+ 1, sizeof(*tb
), GFP_KERNEL
);
6009 err
= nla_parse_nested_deprecated(tb
, type
->maxattr
, attr
,
6010 type
->policy
, NULL
);
6014 memset(tb
, 0, sizeof(tb
[0]) * (type
->maxattr
+ 1));
6017 if (type
->select_ops
) {
6018 ops
= type
->select_ops(ctx
, (const struct nlattr
* const *)tb
);
6028 obj
= kzalloc(sizeof(*obj
) + ops
->size
, GFP_KERNEL
);
6032 err
= ops
->init(ctx
, (const struct nlattr
* const *)tb
, obj
);
6045 return ERR_PTR(err
);
6048 static int nft_object_dump(struct sk_buff
*skb
, unsigned int attr
,
6049 struct nft_object
*obj
, bool reset
)
6051 struct nlattr
*nest
;
6053 nest
= nla_nest_start_noflag(skb
, attr
);
6055 goto nla_put_failure
;
6056 if (obj
->ops
->dump(skb
, obj
, reset
) < 0)
6057 goto nla_put_failure
;
6058 nla_nest_end(skb
, nest
);
6065 static const struct nft_object_type
*__nft_obj_type_get(u32 objtype
)
6067 const struct nft_object_type
*type
;
6069 list_for_each_entry(type
, &nf_tables_objects
, list
) {
6070 if (objtype
== type
->type
)
6076 static const struct nft_object_type
*
6077 nft_obj_type_get(struct net
*net
, u32 objtype
)
6079 const struct nft_object_type
*type
;
6081 type
= __nft_obj_type_get(objtype
);
6082 if (type
!= NULL
&& try_module_get(type
->owner
))
6085 lockdep_nfnl_nft_mutex_not_held();
6086 #ifdef CONFIG_MODULES
6088 if (nft_request_module(net
, "nft-obj-%u", objtype
) == -EAGAIN
)
6089 return ERR_PTR(-EAGAIN
);
6092 return ERR_PTR(-ENOENT
);
6095 static int nf_tables_updobj(const struct nft_ctx
*ctx
,
6096 const struct nft_object_type
*type
,
6097 const struct nlattr
*attr
,
6098 struct nft_object
*obj
)
6100 struct nft_object
*newobj
;
6101 struct nft_trans
*trans
;
6104 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWOBJ
,
6105 sizeof(struct nft_trans_obj
));
6109 newobj
= nft_obj_init(ctx
, type
, attr
);
6110 if (IS_ERR(newobj
)) {
6111 err
= PTR_ERR(newobj
);
6112 goto err_free_trans
;
6115 nft_trans_obj(trans
) = obj
;
6116 nft_trans_obj_update(trans
) = true;
6117 nft_trans_obj_newobj(trans
) = newobj
;
6118 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
6127 static int nf_tables_newobj(struct net
*net
, struct sock
*nlsk
,
6128 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
6129 const struct nlattr
* const nla
[],
6130 struct netlink_ext_ack
*extack
)
6132 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
6133 const struct nft_object_type
*type
;
6134 u8 genmask
= nft_genmask_next(net
);
6135 int family
= nfmsg
->nfgen_family
;
6136 struct nft_table
*table
;
6137 struct nft_object
*obj
;
6142 if (!nla
[NFTA_OBJ_TYPE
] ||
6143 !nla
[NFTA_OBJ_NAME
] ||
6144 !nla
[NFTA_OBJ_DATA
])
6147 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
6148 NETLINK_CB(skb
).portid
);
6149 if (IS_ERR(table
)) {
6150 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6151 return PTR_ERR(table
);
6154 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6155 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
6158 if (err
!= -ENOENT
) {
6159 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6163 if (nlh
->nlmsg_flags
& NLM_F_EXCL
) {
6164 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6167 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
)
6170 type
= __nft_obj_type_get(objtype
);
6171 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
6173 return nf_tables_updobj(&ctx
, type
, nla
[NFTA_OBJ_DATA
], obj
);
6176 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
6178 type
= nft_obj_type_get(net
, objtype
);
6180 return PTR_ERR(type
);
6182 obj
= nft_obj_init(&ctx
, type
, nla
[NFTA_OBJ_DATA
]);
6187 obj
->key
.table
= table
;
6188 obj
->handle
= nf_tables_alloc_handle(table
);
6190 obj
->key
.name
= nla_strdup(nla
[NFTA_OBJ_NAME
], GFP_KERNEL
);
6191 if (!obj
->key
.name
) {
6196 if (nla
[NFTA_OBJ_USERDATA
]) {
6197 obj
->udata
= nla_memdup(nla
[NFTA_OBJ_USERDATA
], GFP_KERNEL
);
6198 if (obj
->udata
== NULL
)
6201 obj
->udlen
= nla_len(nla
[NFTA_OBJ_USERDATA
]);
6204 err
= nft_trans_obj_add(&ctx
, NFT_MSG_NEWOBJ
, obj
);
6208 err
= rhltable_insert(&nft_objname_ht
, &obj
->rhlhead
,
6209 nft_objname_ht_params
);
6213 list_add_tail_rcu(&obj
->list
, &table
->objects
);
6217 /* queued in transaction log */
6218 INIT_LIST_HEAD(&obj
->list
);
6221 kfree(obj
->key
.name
);
6225 if (obj
->ops
->destroy
)
6226 obj
->ops
->destroy(&ctx
, obj
);
6229 module_put(type
->owner
);
6233 static int nf_tables_fill_obj_info(struct sk_buff
*skb
, struct net
*net
,
6234 u32 portid
, u32 seq
, int event
, u32 flags
,
6235 int family
, const struct nft_table
*table
,
6236 struct nft_object
*obj
, bool reset
)
6238 struct nfgenmsg
*nfmsg
;
6239 struct nlmsghdr
*nlh
;
6241 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
6242 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
), flags
);
6244 goto nla_put_failure
;
6246 nfmsg
= nlmsg_data(nlh
);
6247 nfmsg
->nfgen_family
= family
;
6248 nfmsg
->version
= NFNETLINK_V0
;
6249 nfmsg
->res_id
= htons(net
->nft
.base_seq
& 0xffff);
6251 if (nla_put_string(skb
, NFTA_OBJ_TABLE
, table
->name
) ||
6252 nla_put_string(skb
, NFTA_OBJ_NAME
, obj
->key
.name
) ||
6253 nla_put_be32(skb
, NFTA_OBJ_TYPE
, htonl(obj
->ops
->type
->type
)) ||
6254 nla_put_be32(skb
, NFTA_OBJ_USE
, htonl(obj
->use
)) ||
6255 nft_object_dump(skb
, NFTA_OBJ_DATA
, obj
, reset
) ||
6256 nla_put_be64(skb
, NFTA_OBJ_HANDLE
, cpu_to_be64(obj
->handle
),
6258 goto nla_put_failure
;
6261 nla_put(skb
, NFTA_OBJ_USERDATA
, obj
->udlen
, obj
->udata
))
6262 goto nla_put_failure
;
6264 nlmsg_end(skb
, nlh
);
6268 nlmsg_trim(skb
, nlh
);
6272 struct nft_obj_filter
{
6277 static int nf_tables_dump_obj(struct sk_buff
*skb
, struct netlink_callback
*cb
)
6279 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
6280 const struct nft_table
*table
;
6281 unsigned int idx
= 0, s_idx
= cb
->args
[0];
6282 struct nft_obj_filter
*filter
= cb
->data
;
6283 struct net
*net
= sock_net(skb
->sk
);
6284 int family
= nfmsg
->nfgen_family
;
6285 struct nft_object
*obj
;
6288 if (NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
6292 cb
->seq
= net
->nft
.base_seq
;
6294 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
) {
6295 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
6298 list_for_each_entry_rcu(obj
, &table
->objects
, list
) {
6299 if (!nft_is_active(net
, obj
))
6304 memset(&cb
->args
[1], 0,
6305 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
6306 if (filter
&& filter
->table
&&
6307 strcmp(filter
->table
, table
->name
))
6310 filter
->type
!= NFT_OBJECT_UNSPEC
&&
6311 obj
->ops
->type
->type
!= filter
->type
)
6315 char *buf
= kasprintf(GFP_ATOMIC
,
6320 audit_log_nfcfg(buf
,
6323 AUDIT_NFT_OP_OBJ_RESET
,
6328 if (nf_tables_fill_obj_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
6331 NLM_F_MULTI
| NLM_F_APPEND
,
6332 table
->family
, table
,
6336 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
6348 static int nf_tables_dump_obj_start(struct netlink_callback
*cb
)
6350 const struct nlattr
* const *nla
= cb
->data
;
6351 struct nft_obj_filter
*filter
= NULL
;
6353 if (nla
[NFTA_OBJ_TABLE
] || nla
[NFTA_OBJ_TYPE
]) {
6354 filter
= kzalloc(sizeof(*filter
), GFP_ATOMIC
);
6358 if (nla
[NFTA_OBJ_TABLE
]) {
6359 filter
->table
= nla_strdup(nla
[NFTA_OBJ_TABLE
], GFP_ATOMIC
);
6360 if (!filter
->table
) {
6366 if (nla
[NFTA_OBJ_TYPE
])
6367 filter
->type
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6374 static int nf_tables_dump_obj_done(struct netlink_callback
*cb
)
6376 struct nft_obj_filter
*filter
= cb
->data
;
6379 kfree(filter
->table
);
6386 /* called with rcu_read_lock held */
6387 static int nf_tables_getobj(struct net
*net
, struct sock
*nlsk
,
6388 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
6389 const struct nlattr
* const nla
[],
6390 struct netlink_ext_ack
*extack
)
6392 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
6393 u8 genmask
= nft_genmask_cur(net
);
6394 int family
= nfmsg
->nfgen_family
;
6395 const struct nft_table
*table
;
6396 struct nft_object
*obj
;
6397 struct sk_buff
*skb2
;
6402 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
6403 struct netlink_dump_control c
= {
6404 .start
= nf_tables_dump_obj_start
,
6405 .dump
= nf_tables_dump_obj
,
6406 .done
= nf_tables_dump_obj_done
,
6407 .module
= THIS_MODULE
,
6408 .data
= (void *)nla
,
6411 return nft_netlink_dump_start_rcu(nlsk
, skb
, nlh
, &c
);
6414 if (!nla
[NFTA_OBJ_NAME
] ||
6415 !nla
[NFTA_OBJ_TYPE
])
6418 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
, 0);
6419 if (IS_ERR(table
)) {
6420 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6421 return PTR_ERR(table
);
6424 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6425 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
6427 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
6428 return PTR_ERR(obj
);
6431 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
6435 if (NFNL_MSG_TYPE(nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
6439 char *buf
= kasprintf(GFP_ATOMIC
, "%s:%llu;?:0",
6440 table
->name
, table
->handle
);
6442 audit_log_nfcfg(buf
,
6445 AUDIT_NFT_OP_OBJ_RESET
,
6450 err
= nf_tables_fill_obj_info(skb2
, net
, NETLINK_CB(skb
).portid
,
6451 nlh
->nlmsg_seq
, NFT_MSG_NEWOBJ
, 0,
6452 family
, table
, obj
, reset
);
6454 goto err_fill_obj_info
;
6456 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
6463 static void nft_obj_destroy(const struct nft_ctx
*ctx
, struct nft_object
*obj
)
6465 if (obj
->ops
->destroy
)
6466 obj
->ops
->destroy(ctx
, obj
);
6468 module_put(obj
->ops
->type
->owner
);
6469 kfree(obj
->key
.name
);
6474 static int nf_tables_delobj(struct net
*net
, struct sock
*nlsk
,
6475 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
6476 const struct nlattr
* const nla
[],
6477 struct netlink_ext_ack
*extack
)
6479 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
6480 u8 genmask
= nft_genmask_next(net
);
6481 int family
= nfmsg
->nfgen_family
;
6482 const struct nlattr
*attr
;
6483 struct nft_table
*table
;
6484 struct nft_object
*obj
;
6488 if (!nla
[NFTA_OBJ_TYPE
] ||
6489 (!nla
[NFTA_OBJ_NAME
] && !nla
[NFTA_OBJ_HANDLE
]))
6492 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
6493 NETLINK_CB(skb
).portid
);
6494 if (IS_ERR(table
)) {
6495 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
6496 return PTR_ERR(table
);
6499 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
6500 if (nla
[NFTA_OBJ_HANDLE
]) {
6501 attr
= nla
[NFTA_OBJ_HANDLE
];
6502 obj
= nft_obj_lookup_byhandle(table
, attr
, objtype
, genmask
);
6504 attr
= nla
[NFTA_OBJ_NAME
];
6505 obj
= nft_obj_lookup(net
, table
, attr
, objtype
, genmask
);
6509 NL_SET_BAD_ATTR(extack
, attr
);
6510 return PTR_ERR(obj
);
6513 NL_SET_BAD_ATTR(extack
, attr
);
6517 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
6519 return nft_delobj(&ctx
, obj
);
6522 void nft_obj_notify(struct net
*net
, const struct nft_table
*table
,
6523 struct nft_object
*obj
, u32 portid
, u32 seq
, int event
,
6524 int family
, int report
, gfp_t gfp
)
6526 struct sk_buff
*skb
;
6528 char *buf
= kasprintf(gfp
, "%s:%llu;?:0",
6529 table
->name
, table
->handle
);
6531 audit_log_nfcfg(buf
,
6534 event
== NFT_MSG_NEWOBJ
?
6535 AUDIT_NFT_OP_OBJ_REGISTER
:
6536 AUDIT_NFT_OP_OBJ_UNREGISTER
,
6541 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
6544 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp
);
6548 err
= nf_tables_fill_obj_info(skb
, net
, portid
, seq
, event
, 0, family
,
6555 nft_notify_enqueue(skb
, report
, &net
->nft
.notify_list
);
6558 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
6560 EXPORT_SYMBOL_GPL(nft_obj_notify
);
6562 static void nf_tables_obj_notify(const struct nft_ctx
*ctx
,
6563 struct nft_object
*obj
, int event
)
6565 nft_obj_notify(ctx
->net
, ctx
->table
, obj
, ctx
->portid
, ctx
->seq
, event
,
6566 ctx
->family
, ctx
->report
, GFP_KERNEL
);
6572 void nft_register_flowtable_type(struct nf_flowtable_type
*type
)
6574 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
6575 list_add_tail_rcu(&type
->list
, &nf_tables_flowtables
);
6576 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
6578 EXPORT_SYMBOL_GPL(nft_register_flowtable_type
);
6580 void nft_unregister_flowtable_type(struct nf_flowtable_type
*type
)
6582 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
6583 list_del_rcu(&type
->list
);
6584 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
6586 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type
);
6588 static const struct nla_policy nft_flowtable_policy
[NFTA_FLOWTABLE_MAX
+ 1] = {
6589 [NFTA_FLOWTABLE_TABLE
] = { .type
= NLA_STRING
,
6590 .len
= NFT_NAME_MAXLEN
- 1 },
6591 [NFTA_FLOWTABLE_NAME
] = { .type
= NLA_STRING
,
6592 .len
= NFT_NAME_MAXLEN
- 1 },
6593 [NFTA_FLOWTABLE_HOOK
] = { .type
= NLA_NESTED
},
6594 [NFTA_FLOWTABLE_HANDLE
] = { .type
= NLA_U64
},
6595 [NFTA_FLOWTABLE_FLAGS
] = { .type
= NLA_U32
},
6598 struct nft_flowtable
*nft_flowtable_lookup(const struct nft_table
*table
,
6599 const struct nlattr
*nla
, u8 genmask
)
6601 struct nft_flowtable
*flowtable
;
6603 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
6604 if (!nla_strcmp(nla
, flowtable
->name
) &&
6605 nft_active_genmask(flowtable
, genmask
))
6608 return ERR_PTR(-ENOENT
);
6610 EXPORT_SYMBOL_GPL(nft_flowtable_lookup
);
6612 void nf_tables_deactivate_flowtable(const struct nft_ctx
*ctx
,
6613 struct nft_flowtable
*flowtable
,
6614 enum nft_trans_phase phase
)
6617 case NFT_TRANS_PREPARE
:
6618 case NFT_TRANS_ABORT
:
6619 case NFT_TRANS_RELEASE
:
6626 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable
);
6628 static struct nft_flowtable
*
6629 nft_flowtable_lookup_byhandle(const struct nft_table
*table
,
6630 const struct nlattr
*nla
, u8 genmask
)
6632 struct nft_flowtable
*flowtable
;
6634 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
6635 if (be64_to_cpu(nla_get_be64(nla
)) == flowtable
->handle
&&
6636 nft_active_genmask(flowtable
, genmask
))
6639 return ERR_PTR(-ENOENT
);
6642 struct nft_flowtable_hook
{
6645 struct list_head list
;
6648 static const struct nla_policy nft_flowtable_hook_policy
[NFTA_FLOWTABLE_HOOK_MAX
+ 1] = {
6649 [NFTA_FLOWTABLE_HOOK_NUM
] = { .type
= NLA_U32
},
6650 [NFTA_FLOWTABLE_HOOK_PRIORITY
] = { .type
= NLA_U32
},
6651 [NFTA_FLOWTABLE_HOOK_DEVS
] = { .type
= NLA_NESTED
},
6654 static int nft_flowtable_parse_hook(const struct nft_ctx
*ctx
,
6655 const struct nlattr
*attr
,
6656 struct nft_flowtable_hook
*flowtable_hook
,
6657 struct nft_flowtable
*flowtable
, bool add
)
6659 struct nlattr
*tb
[NFTA_FLOWTABLE_HOOK_MAX
+ 1];
6660 struct nft_hook
*hook
;
6661 int hooknum
, priority
;
6664 INIT_LIST_HEAD(&flowtable_hook
->list
);
6666 err
= nla_parse_nested_deprecated(tb
, NFTA_FLOWTABLE_HOOK_MAX
, attr
,
6667 nft_flowtable_hook_policy
, NULL
);
6672 if (!tb
[NFTA_FLOWTABLE_HOOK_NUM
] ||
6673 !tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
])
6676 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
6677 if (hooknum
!= NF_NETDEV_INGRESS
)
6680 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
6682 flowtable_hook
->priority
= priority
;
6683 flowtable_hook
->num
= hooknum
;
6685 if (tb
[NFTA_FLOWTABLE_HOOK_NUM
]) {
6686 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
6687 if (hooknum
!= flowtable
->hooknum
)
6691 if (tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]) {
6692 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
6693 if (priority
!= flowtable
->data
.priority
)
6697 flowtable_hook
->priority
= flowtable
->data
.priority
;
6698 flowtable_hook
->num
= flowtable
->hooknum
;
6701 if (tb
[NFTA_FLOWTABLE_HOOK_DEVS
]) {
6702 err
= nf_tables_parse_netdev_hooks(ctx
->net
,
6703 tb
[NFTA_FLOWTABLE_HOOK_DEVS
],
6704 &flowtable_hook
->list
);
6709 list_for_each_entry(hook
, &flowtable_hook
->list
, list
) {
6710 hook
->ops
.pf
= NFPROTO_NETDEV
;
6711 hook
->ops
.hooknum
= flowtable_hook
->num
;
6712 hook
->ops
.priority
= flowtable_hook
->priority
;
6713 hook
->ops
.priv
= &flowtable
->data
;
6714 hook
->ops
.hook
= flowtable
->data
.type
->hook
;
6720 static const struct nf_flowtable_type
*__nft_flowtable_type_get(u8 family
)
6722 const struct nf_flowtable_type
*type
;
6724 list_for_each_entry(type
, &nf_tables_flowtables
, list
) {
6725 if (family
== type
->family
)
6731 static const struct nf_flowtable_type
*
6732 nft_flowtable_type_get(struct net
*net
, u8 family
)
6734 const struct nf_flowtable_type
*type
;
6736 type
= __nft_flowtable_type_get(family
);
6737 if (type
!= NULL
&& try_module_get(type
->owner
))
6740 lockdep_nfnl_nft_mutex_not_held();
6741 #ifdef CONFIG_MODULES
6743 if (nft_request_module(net
, "nf-flowtable-%u", family
) == -EAGAIN
)
6744 return ERR_PTR(-EAGAIN
);
6747 return ERR_PTR(-ENOENT
);
6750 /* Only called from error and netdev event paths. */
6751 static void nft_unregister_flowtable_hook(struct net
*net
,
6752 struct nft_flowtable
*flowtable
,
6753 struct nft_hook
*hook
)
6755 nf_unregister_net_hook(net
, &hook
->ops
);
6756 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
6760 static void nft_unregister_flowtable_net_hooks(struct net
*net
,
6761 struct list_head
*hook_list
)
6763 struct nft_hook
*hook
;
6765 list_for_each_entry(hook
, hook_list
, list
)
6766 nf_unregister_net_hook(net
, &hook
->ops
);
6769 static int nft_register_flowtable_net_hooks(struct net
*net
,
6770 struct nft_table
*table
,
6771 struct list_head
*hook_list
,
6772 struct nft_flowtable
*flowtable
)
6774 struct nft_hook
*hook
, *hook2
, *next
;
6775 struct nft_flowtable
*ft
;
6778 list_for_each_entry(hook
, hook_list
, list
) {
6779 list_for_each_entry(ft
, &table
->flowtables
, list
) {
6780 list_for_each_entry(hook2
, &ft
->hook_list
, list
) {
6781 if (hook
->ops
.dev
== hook2
->ops
.dev
&&
6782 hook
->ops
.pf
== hook2
->ops
.pf
) {
6784 goto err_unregister_net_hooks
;
6789 err
= flowtable
->data
.type
->setup(&flowtable
->data
,
6793 goto err_unregister_net_hooks
;
6795 err
= nf_register_net_hook(net
, &hook
->ops
);
6797 flowtable
->data
.type
->setup(&flowtable
->data
,
6800 goto err_unregister_net_hooks
;
6808 err_unregister_net_hooks
:
6809 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
6813 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
6814 list_del_rcu(&hook
->list
);
6815 kfree_rcu(hook
, rcu
);
6821 static void nft_flowtable_hooks_destroy(struct list_head
*hook_list
)
6823 struct nft_hook
*hook
, *next
;
6825 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
6826 list_del_rcu(&hook
->list
);
6827 kfree_rcu(hook
, rcu
);
6831 static int nft_flowtable_update(struct nft_ctx
*ctx
, const struct nlmsghdr
*nlh
,
6832 struct nft_flowtable
*flowtable
)
6834 const struct nlattr
* const *nla
= ctx
->nla
;
6835 struct nft_flowtable_hook flowtable_hook
;
6836 struct nft_hook
*hook
, *next
;
6837 struct nft_trans
*trans
;
6838 bool unregister
= false;
6841 err
= nft_flowtable_parse_hook(ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
6842 &flowtable_hook
, flowtable
, false);
6846 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
6847 if (nft_hook_list_find(&flowtable
->hook_list
, hook
)) {
6848 list_del(&hook
->list
);
6853 err
= nft_register_flowtable_net_hooks(ctx
->net
, ctx
->table
,
6854 &flowtable_hook
.list
, flowtable
);
6856 goto err_flowtable_update_hook
;
6858 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWFLOWTABLE
,
6859 sizeof(struct nft_trans_flowtable
));
6863 goto err_flowtable_update_hook
;
6866 nft_trans_flowtable(trans
) = flowtable
;
6867 nft_trans_flowtable_update(trans
) = true;
6868 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
6869 list_splice(&flowtable_hook
.list
, &nft_trans_flowtable_hooks(trans
));
6871 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
6875 err_flowtable_update_hook
:
6876 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
6878 nft_unregister_flowtable_hook(ctx
->net
, flowtable
, hook
);
6879 list_del_rcu(&hook
->list
);
6880 kfree_rcu(hook
, rcu
);
6887 static int nf_tables_newflowtable(struct net
*net
, struct sock
*nlsk
,
6888 struct sk_buff
*skb
,
6889 const struct nlmsghdr
*nlh
,
6890 const struct nlattr
* const nla
[],
6891 struct netlink_ext_ack
*extack
)
6893 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
6894 struct nft_flowtable_hook flowtable_hook
;
6895 const struct nf_flowtable_type
*type
;
6896 u8 genmask
= nft_genmask_next(net
);
6897 int family
= nfmsg
->nfgen_family
;
6898 struct nft_flowtable
*flowtable
;
6899 struct nft_hook
*hook
, *next
;
6900 struct nft_table
*table
;
6904 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
6905 !nla
[NFTA_FLOWTABLE_NAME
] ||
6906 !nla
[NFTA_FLOWTABLE_HOOK
])
6909 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
6910 genmask
, NETLINK_CB(skb
).portid
);
6911 if (IS_ERR(table
)) {
6912 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
6913 return PTR_ERR(table
);
6916 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
6918 if (IS_ERR(flowtable
)) {
6919 err
= PTR_ERR(flowtable
);
6920 if (err
!= -ENOENT
) {
6921 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
6925 if (nlh
->nlmsg_flags
& NLM_F_EXCL
) {
6926 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
6930 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
6932 return nft_flowtable_update(&ctx
, nlh
, flowtable
);
6935 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
6937 flowtable
= kzalloc(sizeof(*flowtable
), GFP_KERNEL
);
6941 flowtable
->table
= table
;
6942 flowtable
->handle
= nf_tables_alloc_handle(table
);
6943 INIT_LIST_HEAD(&flowtable
->hook_list
);
6945 flowtable
->name
= nla_strdup(nla
[NFTA_FLOWTABLE_NAME
], GFP_KERNEL
);
6946 if (!flowtable
->name
) {
6951 type
= nft_flowtable_type_get(net
, family
);
6953 err
= PTR_ERR(type
);
6957 if (nla
[NFTA_FLOWTABLE_FLAGS
]) {
6958 flowtable
->data
.flags
=
6959 ntohl(nla_get_be32(nla
[NFTA_FLOWTABLE_FLAGS
]));
6960 if (flowtable
->data
.flags
& ~NFT_FLOWTABLE_MASK
)
6964 write_pnet(&flowtable
->data
.net
, net
);
6965 flowtable
->data
.type
= type
;
6966 err
= type
->init(&flowtable
->data
);
6970 err
= nft_flowtable_parse_hook(&ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
6971 &flowtable_hook
, flowtable
, true);
6975 list_splice(&flowtable_hook
.list
, &flowtable
->hook_list
);
6976 flowtable
->data
.priority
= flowtable_hook
.priority
;
6977 flowtable
->hooknum
= flowtable_hook
.num
;
6979 err
= nft_register_flowtable_net_hooks(ctx
.net
, table
,
6980 &flowtable
->hook_list
,
6983 nft_flowtable_hooks_destroy(&flowtable
->hook_list
);
6987 err
= nft_trans_flowtable_add(&ctx
, NFT_MSG_NEWFLOWTABLE
, flowtable
);
6991 list_add_tail_rcu(&flowtable
->list
, &table
->flowtables
);
6996 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
6997 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
6998 list_del_rcu(&hook
->list
);
6999 kfree_rcu(hook
, rcu
);
7002 flowtable
->data
.type
->free(&flowtable
->data
);
7004 module_put(type
->owner
);
7006 kfree(flowtable
->name
);
7012 static void nft_flowtable_hook_release(struct nft_flowtable_hook
*flowtable_hook
)
7014 struct nft_hook
*this, *next
;
7016 list_for_each_entry_safe(this, next
, &flowtable_hook
->list
, list
) {
7017 list_del(&this->list
);
7022 static int nft_delflowtable_hook(struct nft_ctx
*ctx
,
7023 struct nft_flowtable
*flowtable
)
7025 const struct nlattr
* const *nla
= ctx
->nla
;
7026 struct nft_flowtable_hook flowtable_hook
;
7027 struct nft_hook
*this, *hook
;
7028 struct nft_trans
*trans
;
7031 err
= nft_flowtable_parse_hook(ctx
, nla
[NFTA_FLOWTABLE_HOOK
],
7032 &flowtable_hook
, flowtable
, false);
7036 list_for_each_entry(this, &flowtable_hook
.list
, list
) {
7037 hook
= nft_hook_list_find(&flowtable
->hook_list
, this);
7040 goto err_flowtable_del_hook
;
7042 hook
->inactive
= true;
7045 trans
= nft_trans_alloc(ctx
, NFT_MSG_DELFLOWTABLE
,
7046 sizeof(struct nft_trans_flowtable
));
7049 goto err_flowtable_del_hook
;
7052 nft_trans_flowtable(trans
) = flowtable
;
7053 nft_trans_flowtable_update(trans
) = true;
7054 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
7055 nft_flowtable_hook_release(&flowtable_hook
);
7057 list_add_tail(&trans
->list
, &ctx
->net
->nft
.commit_list
);
7061 err_flowtable_del_hook
:
7062 list_for_each_entry(this, &flowtable_hook
.list
, list
) {
7063 hook
= nft_hook_list_find(&flowtable
->hook_list
, this);
7067 hook
->inactive
= false;
7069 nft_flowtable_hook_release(&flowtable_hook
);
7074 static int nf_tables_delflowtable(struct net
*net
, struct sock
*nlsk
,
7075 struct sk_buff
*skb
,
7076 const struct nlmsghdr
*nlh
,
7077 const struct nlattr
* const nla
[],
7078 struct netlink_ext_ack
*extack
)
7080 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
7081 u8 genmask
= nft_genmask_next(net
);
7082 int family
= nfmsg
->nfgen_family
;
7083 struct nft_flowtable
*flowtable
;
7084 const struct nlattr
*attr
;
7085 struct nft_table
*table
;
7088 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
7089 (!nla
[NFTA_FLOWTABLE_NAME
] &&
7090 !nla
[NFTA_FLOWTABLE_HANDLE
]))
7093 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7094 genmask
, NETLINK_CB(skb
).portid
);
7095 if (IS_ERR(table
)) {
7096 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
7097 return PTR_ERR(table
);
7100 if (nla
[NFTA_FLOWTABLE_HANDLE
]) {
7101 attr
= nla
[NFTA_FLOWTABLE_HANDLE
];
7102 flowtable
= nft_flowtable_lookup_byhandle(table
, attr
, genmask
);
7104 attr
= nla
[NFTA_FLOWTABLE_NAME
];
7105 flowtable
= nft_flowtable_lookup(table
, attr
, genmask
);
7108 if (IS_ERR(flowtable
)) {
7109 NL_SET_BAD_ATTR(extack
, attr
);
7110 return PTR_ERR(flowtable
);
7113 nft_ctx_init(&ctx
, net
, skb
, nlh
, family
, table
, NULL
, nla
);
7115 if (nla
[NFTA_FLOWTABLE_HOOK
])
7116 return nft_delflowtable_hook(&ctx
, flowtable
);
7118 if (flowtable
->use
> 0) {
7119 NL_SET_BAD_ATTR(extack
, attr
);
7123 return nft_delflowtable(&ctx
, flowtable
);
7126 static int nf_tables_fill_flowtable_info(struct sk_buff
*skb
, struct net
*net
,
7127 u32 portid
, u32 seq
, int event
,
7128 u32 flags
, int family
,
7129 struct nft_flowtable
*flowtable
,
7130 struct list_head
*hook_list
)
7132 struct nlattr
*nest
, *nest_devs
;
7133 struct nfgenmsg
*nfmsg
;
7134 struct nft_hook
*hook
;
7135 struct nlmsghdr
*nlh
;
7137 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
7138 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
), flags
);
7140 goto nla_put_failure
;
7142 nfmsg
= nlmsg_data(nlh
);
7143 nfmsg
->nfgen_family
= family
;
7144 nfmsg
->version
= NFNETLINK_V0
;
7145 nfmsg
->res_id
= htons(net
->nft
.base_seq
& 0xffff);
7147 if (nla_put_string(skb
, NFTA_FLOWTABLE_TABLE
, flowtable
->table
->name
) ||
7148 nla_put_string(skb
, NFTA_FLOWTABLE_NAME
, flowtable
->name
) ||
7149 nla_put_be32(skb
, NFTA_FLOWTABLE_USE
, htonl(flowtable
->use
)) ||
7150 nla_put_be64(skb
, NFTA_FLOWTABLE_HANDLE
, cpu_to_be64(flowtable
->handle
),
7151 NFTA_FLOWTABLE_PAD
) ||
7152 nla_put_be32(skb
, NFTA_FLOWTABLE_FLAGS
, htonl(flowtable
->data
.flags
)))
7153 goto nla_put_failure
;
7155 nest
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK
);
7157 goto nla_put_failure
;
7158 if (nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_NUM
, htonl(flowtable
->hooknum
)) ||
7159 nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_PRIORITY
, htonl(flowtable
->data
.priority
)))
7160 goto nla_put_failure
;
7162 nest_devs
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK_DEVS
);
7164 goto nla_put_failure
;
7166 list_for_each_entry_rcu(hook
, hook_list
, list
) {
7167 if (nla_put_string(skb
, NFTA_DEVICE_NAME
, hook
->ops
.dev
->name
))
7168 goto nla_put_failure
;
7170 nla_nest_end(skb
, nest_devs
);
7171 nla_nest_end(skb
, nest
);
7173 nlmsg_end(skb
, nlh
);
7177 nlmsg_trim(skb
, nlh
);
7181 struct nft_flowtable_filter
{
7185 static int nf_tables_dump_flowtable(struct sk_buff
*skb
,
7186 struct netlink_callback
*cb
)
7188 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
7189 struct nft_flowtable_filter
*filter
= cb
->data
;
7190 unsigned int idx
= 0, s_idx
= cb
->args
[0];
7191 struct net
*net
= sock_net(skb
->sk
);
7192 int family
= nfmsg
->nfgen_family
;
7193 struct nft_flowtable
*flowtable
;
7194 const struct nft_table
*table
;
7197 cb
->seq
= net
->nft
.base_seq
;
7199 list_for_each_entry_rcu(table
, &net
->nft
.tables
, list
) {
7200 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
7203 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
7204 if (!nft_is_active(net
, flowtable
))
7209 memset(&cb
->args
[1], 0,
7210 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
7211 if (filter
&& filter
->table
&&
7212 strcmp(filter
->table
, table
->name
))
7215 if (nf_tables_fill_flowtable_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
7217 NFT_MSG_NEWFLOWTABLE
,
7218 NLM_F_MULTI
| NLM_F_APPEND
,
7221 &flowtable
->hook_list
) < 0)
7224 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
7236 static int nf_tables_dump_flowtable_start(struct netlink_callback
*cb
)
7238 const struct nlattr
* const *nla
= cb
->data
;
7239 struct nft_flowtable_filter
*filter
= NULL
;
7241 if (nla
[NFTA_FLOWTABLE_TABLE
]) {
7242 filter
= kzalloc(sizeof(*filter
), GFP_ATOMIC
);
7246 filter
->table
= nla_strdup(nla
[NFTA_FLOWTABLE_TABLE
],
7248 if (!filter
->table
) {
7258 static int nf_tables_dump_flowtable_done(struct netlink_callback
*cb
)
7260 struct nft_flowtable_filter
*filter
= cb
->data
;
7265 kfree(filter
->table
);
7271 /* called with rcu_read_lock held */
7272 static int nf_tables_getflowtable(struct net
*net
, struct sock
*nlsk
,
7273 struct sk_buff
*skb
,
7274 const struct nlmsghdr
*nlh
,
7275 const struct nlattr
* const nla
[],
7276 struct netlink_ext_ack
*extack
)
7278 const struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
7279 u8 genmask
= nft_genmask_cur(net
);
7280 int family
= nfmsg
->nfgen_family
;
7281 struct nft_flowtable
*flowtable
;
7282 const struct nft_table
*table
;
7283 struct sk_buff
*skb2
;
7286 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
7287 struct netlink_dump_control c
= {
7288 .start
= nf_tables_dump_flowtable_start
,
7289 .dump
= nf_tables_dump_flowtable
,
7290 .done
= nf_tables_dump_flowtable_done
,
7291 .module
= THIS_MODULE
,
7292 .data
= (void *)nla
,
7295 return nft_netlink_dump_start_rcu(nlsk
, skb
, nlh
, &c
);
7298 if (!nla
[NFTA_FLOWTABLE_NAME
])
7301 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
7304 return PTR_ERR(table
);
7306 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
7308 if (IS_ERR(flowtable
))
7309 return PTR_ERR(flowtable
);
7311 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
7315 err
= nf_tables_fill_flowtable_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7317 NFT_MSG_NEWFLOWTABLE
, 0, family
,
7318 flowtable
, &flowtable
->hook_list
);
7320 goto err_fill_flowtable_info
;
7322 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
7324 err_fill_flowtable_info
:
7329 static void nf_tables_flowtable_notify(struct nft_ctx
*ctx
,
7330 struct nft_flowtable
*flowtable
,
7331 struct list_head
*hook_list
,
7334 struct sk_buff
*skb
;
7336 char *buf
= kasprintf(GFP_KERNEL
, "%s:%llu;%s:%llu",
7337 flowtable
->table
->name
, flowtable
->table
->handle
,
7338 flowtable
->name
, flowtable
->handle
);
7340 audit_log_nfcfg(buf
,
7343 event
== NFT_MSG_NEWFLOWTABLE
?
7344 AUDIT_NFT_OP_FLOWTABLE_REGISTER
:
7345 AUDIT_NFT_OP_FLOWTABLE_UNREGISTER
,
7350 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
7353 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
7357 err
= nf_tables_fill_flowtable_info(skb
, ctx
->net
, ctx
->portid
,
7359 ctx
->family
, flowtable
, hook_list
);
7365 nft_notify_enqueue(skb
, ctx
->report
, &ctx
->net
->nft
.notify_list
);
7368 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
7371 static void nf_tables_flowtable_destroy(struct nft_flowtable
*flowtable
)
7373 struct nft_hook
*hook
, *next
;
7375 flowtable
->data
.type
->free(&flowtable
->data
);
7376 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
7377 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
7379 list_del_rcu(&hook
->list
);
7382 kfree(flowtable
->name
);
7383 module_put(flowtable
->data
.type
->owner
);
7387 static int nf_tables_fill_gen_info(struct sk_buff
*skb
, struct net
*net
,
7388 u32 portid
, u32 seq
)
7390 struct nlmsghdr
*nlh
;
7391 struct nfgenmsg
*nfmsg
;
7392 char buf
[TASK_COMM_LEN
];
7393 int event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWGEN
);
7395 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(struct nfgenmsg
), 0);
7397 goto nla_put_failure
;
7399 nfmsg
= nlmsg_data(nlh
);
7400 nfmsg
->nfgen_family
= AF_UNSPEC
;
7401 nfmsg
->version
= NFNETLINK_V0
;
7402 nfmsg
->res_id
= htons(net
->nft
.base_seq
& 0xffff);
7404 if (nla_put_be32(skb
, NFTA_GEN_ID
, htonl(net
->nft
.base_seq
)) ||
7405 nla_put_be32(skb
, NFTA_GEN_PROC_PID
, htonl(task_pid_nr(current
))) ||
7406 nla_put_string(skb
, NFTA_GEN_PROC_NAME
, get_task_comm(buf
, current
)))
7407 goto nla_put_failure
;
7409 nlmsg_end(skb
, nlh
);
7413 nlmsg_trim(skb
, nlh
);
7417 static void nft_flowtable_event(unsigned long event
, struct net_device
*dev
,
7418 struct nft_flowtable
*flowtable
)
7420 struct nft_hook
*hook
;
7422 list_for_each_entry(hook
, &flowtable
->hook_list
, list
) {
7423 if (hook
->ops
.dev
!= dev
)
7426 /* flow_offload_netdev_event() cleans up entries for us. */
7427 nft_unregister_flowtable_hook(dev_net(dev
), flowtable
, hook
);
7428 list_del_rcu(&hook
->list
);
7429 kfree_rcu(hook
, rcu
);
7434 static int nf_tables_flowtable_event(struct notifier_block
*this,
7435 unsigned long event
, void *ptr
)
7437 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
7438 struct nft_flowtable
*flowtable
;
7439 struct nft_table
*table
;
7442 if (event
!= NETDEV_UNREGISTER
)
7446 mutex_lock(&net
->nft
.commit_mutex
);
7447 list_for_each_entry(table
, &net
->nft
.tables
, list
) {
7448 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
7449 nft_flowtable_event(event
, dev
, flowtable
);
7452 mutex_unlock(&net
->nft
.commit_mutex
);
7457 static struct notifier_block nf_tables_flowtable_notifier
= {
7458 .notifier_call
= nf_tables_flowtable_event
,
7461 static void nf_tables_gen_notify(struct net
*net
, struct sk_buff
*skb
,
7464 struct nlmsghdr
*nlh
= nlmsg_hdr(skb
);
7465 struct sk_buff
*skb2
;
7468 audit_log_nfcfg("?:0;?:0", 0, net
->nft
.base_seq
,
7469 AUDIT_NFT_OP_GEN_REGISTER
, GFP_KERNEL
);
7471 if (!nlmsg_report(nlh
) &&
7472 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
7475 skb2
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
7479 err
= nf_tables_fill_gen_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7486 nfnetlink_send(skb2
, net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
7487 nlmsg_report(nlh
), GFP_KERNEL
);
7490 nfnetlink_set_err(net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
7494 static int nf_tables_getgen(struct net
*net
, struct sock
*nlsk
,
7495 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
7496 const struct nlattr
* const nla
[],
7497 struct netlink_ext_ack
*extack
)
7499 struct sk_buff
*skb2
;
7502 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
7506 err
= nf_tables_fill_gen_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7509 goto err_fill_gen_info
;
7511 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
7518 static const struct nfnl_callback nf_tables_cb
[NFT_MSG_MAX
] = {
7519 [NFT_MSG_NEWTABLE
] = {
7520 .call_batch
= nf_tables_newtable
,
7521 .attr_count
= NFTA_TABLE_MAX
,
7522 .policy
= nft_table_policy
,
7524 [NFT_MSG_GETTABLE
] = {
7525 .call_rcu
= nf_tables_gettable
,
7526 .attr_count
= NFTA_TABLE_MAX
,
7527 .policy
= nft_table_policy
,
7529 [NFT_MSG_DELTABLE
] = {
7530 .call_batch
= nf_tables_deltable
,
7531 .attr_count
= NFTA_TABLE_MAX
,
7532 .policy
= nft_table_policy
,
7534 [NFT_MSG_NEWCHAIN
] = {
7535 .call_batch
= nf_tables_newchain
,
7536 .attr_count
= NFTA_CHAIN_MAX
,
7537 .policy
= nft_chain_policy
,
7539 [NFT_MSG_GETCHAIN
] = {
7540 .call_rcu
= nf_tables_getchain
,
7541 .attr_count
= NFTA_CHAIN_MAX
,
7542 .policy
= nft_chain_policy
,
7544 [NFT_MSG_DELCHAIN
] = {
7545 .call_batch
= nf_tables_delchain
,
7546 .attr_count
= NFTA_CHAIN_MAX
,
7547 .policy
= nft_chain_policy
,
7549 [NFT_MSG_NEWRULE
] = {
7550 .call_batch
= nf_tables_newrule
,
7551 .attr_count
= NFTA_RULE_MAX
,
7552 .policy
= nft_rule_policy
,
7554 [NFT_MSG_GETRULE
] = {
7555 .call_rcu
= nf_tables_getrule
,
7556 .attr_count
= NFTA_RULE_MAX
,
7557 .policy
= nft_rule_policy
,
7559 [NFT_MSG_DELRULE
] = {
7560 .call_batch
= nf_tables_delrule
,
7561 .attr_count
= NFTA_RULE_MAX
,
7562 .policy
= nft_rule_policy
,
7564 [NFT_MSG_NEWSET
] = {
7565 .call_batch
= nf_tables_newset
,
7566 .attr_count
= NFTA_SET_MAX
,
7567 .policy
= nft_set_policy
,
7569 [NFT_MSG_GETSET
] = {
7570 .call_rcu
= nf_tables_getset
,
7571 .attr_count
= NFTA_SET_MAX
,
7572 .policy
= nft_set_policy
,
7574 [NFT_MSG_DELSET
] = {
7575 .call_batch
= nf_tables_delset
,
7576 .attr_count
= NFTA_SET_MAX
,
7577 .policy
= nft_set_policy
,
7579 [NFT_MSG_NEWSETELEM
] = {
7580 .call_batch
= nf_tables_newsetelem
,
7581 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
7582 .policy
= nft_set_elem_list_policy
,
7584 [NFT_MSG_GETSETELEM
] = {
7585 .call_rcu
= nf_tables_getsetelem
,
7586 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
7587 .policy
= nft_set_elem_list_policy
,
7589 [NFT_MSG_DELSETELEM
] = {
7590 .call_batch
= nf_tables_delsetelem
,
7591 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
7592 .policy
= nft_set_elem_list_policy
,
7594 [NFT_MSG_GETGEN
] = {
7595 .call_rcu
= nf_tables_getgen
,
7597 [NFT_MSG_NEWOBJ
] = {
7598 .call_batch
= nf_tables_newobj
,
7599 .attr_count
= NFTA_OBJ_MAX
,
7600 .policy
= nft_obj_policy
,
7602 [NFT_MSG_GETOBJ
] = {
7603 .call_rcu
= nf_tables_getobj
,
7604 .attr_count
= NFTA_OBJ_MAX
,
7605 .policy
= nft_obj_policy
,
7607 [NFT_MSG_DELOBJ
] = {
7608 .call_batch
= nf_tables_delobj
,
7609 .attr_count
= NFTA_OBJ_MAX
,
7610 .policy
= nft_obj_policy
,
7612 [NFT_MSG_GETOBJ_RESET
] = {
7613 .call_rcu
= nf_tables_getobj
,
7614 .attr_count
= NFTA_OBJ_MAX
,
7615 .policy
= nft_obj_policy
,
7617 [NFT_MSG_NEWFLOWTABLE
] = {
7618 .call_batch
= nf_tables_newflowtable
,
7619 .attr_count
= NFTA_FLOWTABLE_MAX
,
7620 .policy
= nft_flowtable_policy
,
7622 [NFT_MSG_GETFLOWTABLE
] = {
7623 .call_rcu
= nf_tables_getflowtable
,
7624 .attr_count
= NFTA_FLOWTABLE_MAX
,
7625 .policy
= nft_flowtable_policy
,
7627 [NFT_MSG_DELFLOWTABLE
] = {
7628 .call_batch
= nf_tables_delflowtable
,
7629 .attr_count
= NFTA_FLOWTABLE_MAX
,
7630 .policy
= nft_flowtable_policy
,
7634 static int nf_tables_validate(struct net
*net
)
7636 struct nft_table
*table
;
7638 switch (net
->nft
.validate_state
) {
7639 case NFT_VALIDATE_SKIP
:
7641 case NFT_VALIDATE_NEED
:
7642 nft_validate_state_update(net
, NFT_VALIDATE_DO
);
7644 case NFT_VALIDATE_DO
:
7645 list_for_each_entry(table
, &net
->nft
.tables
, list
) {
7646 if (nft_table_validate(net
, table
) < 0)
7655 /* a drop policy has to be deferred until all rules have been activated,
7656 * otherwise a large ruleset that contains a drop-policy base chain will
7657 * cause all packets to get dropped until the full transaction has been
7660 * We defer the drop policy until the transaction has been finalized.
7662 static void nft_chain_commit_drop_policy(struct nft_trans
*trans
)
7664 struct nft_base_chain
*basechain
;
7666 if (nft_trans_chain_policy(trans
) != NF_DROP
)
7669 if (!nft_is_base_chain(trans
->ctx
.chain
))
7672 basechain
= nft_base_chain(trans
->ctx
.chain
);
7673 basechain
->policy
= NF_DROP
;
7676 static void nft_chain_commit_update(struct nft_trans
*trans
)
7678 struct nft_base_chain
*basechain
;
7680 if (nft_trans_chain_name(trans
)) {
7681 rhltable_remove(&trans
->ctx
.table
->chains_ht
,
7682 &trans
->ctx
.chain
->rhlhead
,
7683 nft_chain_ht_params
);
7684 swap(trans
->ctx
.chain
->name
, nft_trans_chain_name(trans
));
7685 rhltable_insert_key(&trans
->ctx
.table
->chains_ht
,
7686 trans
->ctx
.chain
->name
,
7687 &trans
->ctx
.chain
->rhlhead
,
7688 nft_chain_ht_params
);
7691 if (!nft_is_base_chain(trans
->ctx
.chain
))
7694 nft_chain_stats_replace(trans
);
7696 basechain
= nft_base_chain(trans
->ctx
.chain
);
7698 switch (nft_trans_chain_policy(trans
)) {
7701 basechain
->policy
= nft_trans_chain_policy(trans
);
7706 static void nft_obj_commit_update(struct nft_trans
*trans
)
7708 struct nft_object
*newobj
;
7709 struct nft_object
*obj
;
7711 obj
= nft_trans_obj(trans
);
7712 newobj
= nft_trans_obj_newobj(trans
);
7714 if (obj
->ops
->update
)
7715 obj
->ops
->update(obj
, newobj
);
7720 static void nft_commit_release(struct nft_trans
*trans
)
7722 switch (trans
->msg_type
) {
7723 case NFT_MSG_DELTABLE
:
7724 nf_tables_table_destroy(&trans
->ctx
);
7726 case NFT_MSG_NEWCHAIN
:
7727 free_percpu(nft_trans_chain_stats(trans
));
7728 kfree(nft_trans_chain_name(trans
));
7730 case NFT_MSG_DELCHAIN
:
7731 nf_tables_chain_destroy(&trans
->ctx
);
7733 case NFT_MSG_DELRULE
:
7734 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
7736 case NFT_MSG_DELSET
:
7737 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
7739 case NFT_MSG_DELSETELEM
:
7740 nf_tables_set_elem_destroy(&trans
->ctx
,
7741 nft_trans_elem_set(trans
),
7742 nft_trans_elem(trans
).priv
);
7744 case NFT_MSG_DELOBJ
:
7745 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
7747 case NFT_MSG_DELFLOWTABLE
:
7748 if (nft_trans_flowtable_update(trans
))
7749 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
7751 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
7756 put_net(trans
->ctx
.net
);
7761 static void nf_tables_trans_destroy_work(struct work_struct
*w
)
7763 struct nft_trans
*trans
, *next
;
7766 spin_lock(&nf_tables_destroy_list_lock
);
7767 list_splice_init(&nf_tables_destroy_list
, &head
);
7768 spin_unlock(&nf_tables_destroy_list_lock
);
7770 if (list_empty(&head
))
7775 list_for_each_entry_safe(trans
, next
, &head
, list
) {
7776 list_del(&trans
->list
);
7777 nft_commit_release(trans
);
7781 void nf_tables_trans_destroy_flush_work(void)
7783 flush_work(&trans_destroy_work
);
7785 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work
);
7787 static int nf_tables_commit_chain_prepare(struct net
*net
, struct nft_chain
*chain
)
7789 struct nft_rule
*rule
;
7790 unsigned int alloc
= 0;
7793 /* already handled or inactive chain? */
7794 if (chain
->rules_next
|| !nft_is_active_next(net
, chain
))
7797 rule
= list_entry(&chain
->rules
, struct nft_rule
, list
);
7800 list_for_each_entry_continue(rule
, &chain
->rules
, list
) {
7801 if (nft_is_active_next(net
, rule
))
7805 chain
->rules_next
= nf_tables_chain_alloc_rules(chain
, alloc
);
7806 if (!chain
->rules_next
)
7809 list_for_each_entry_continue(rule
, &chain
->rules
, list
) {
7810 if (nft_is_active_next(net
, rule
))
7811 chain
->rules_next
[i
++] = rule
;
7814 chain
->rules_next
[i
] = NULL
;
7818 static void nf_tables_commit_chain_prepare_cancel(struct net
*net
)
7820 struct nft_trans
*trans
, *next
;
7822 list_for_each_entry_safe(trans
, next
, &net
->nft
.commit_list
, list
) {
7823 struct nft_chain
*chain
= trans
->ctx
.chain
;
7825 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
7826 trans
->msg_type
== NFT_MSG_DELRULE
) {
7827 kvfree(chain
->rules_next
);
7828 chain
->rules_next
= NULL
;
7833 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head
*h
)
7835 struct nft_rules_old
*o
= container_of(h
, struct nft_rules_old
, h
);
7840 static void nf_tables_commit_chain_free_rules_old(struct nft_rule
**rules
)
7842 struct nft_rule
**r
= rules
;
7843 struct nft_rules_old
*old
;
7848 r
++; /* rcu_head is after end marker */
7852 call_rcu(&old
->h
, __nf_tables_commit_chain_free_rules_old
);
7855 static void nf_tables_commit_chain(struct net
*net
, struct nft_chain
*chain
)
7857 struct nft_rule
**g0
, **g1
;
7860 next_genbit
= nft_gencursor_next(net
);
7862 g0
= rcu_dereference_protected(chain
->rules_gen_0
,
7863 lockdep_commit_lock_is_held(net
));
7864 g1
= rcu_dereference_protected(chain
->rules_gen_1
,
7865 lockdep_commit_lock_is_held(net
));
7867 /* No changes to this chain? */
7868 if (chain
->rules_next
== NULL
) {
7869 /* chain had no change in last or next generation */
7873 * chain had no change in this generation; make sure next
7874 * one uses same rules as current generation.
7877 rcu_assign_pointer(chain
->rules_gen_1
, g0
);
7878 nf_tables_commit_chain_free_rules_old(g1
);
7880 rcu_assign_pointer(chain
->rules_gen_0
, g1
);
7881 nf_tables_commit_chain_free_rules_old(g0
);
7888 rcu_assign_pointer(chain
->rules_gen_1
, chain
->rules_next
);
7890 rcu_assign_pointer(chain
->rules_gen_0
, chain
->rules_next
);
7892 chain
->rules_next
= NULL
;
7898 nf_tables_commit_chain_free_rules_old(g1
);
7900 nf_tables_commit_chain_free_rules_old(g0
);
7903 static void nft_obj_del(struct nft_object
*obj
)
7905 rhltable_remove(&nft_objname_ht
, &obj
->rhlhead
, nft_objname_ht_params
);
7906 list_del_rcu(&obj
->list
);
7909 void nft_chain_del(struct nft_chain
*chain
)
7911 struct nft_table
*table
= chain
->table
;
7913 WARN_ON_ONCE(rhltable_remove(&table
->chains_ht
, &chain
->rhlhead
,
7914 nft_chain_ht_params
));
7915 list_del_rcu(&chain
->list
);
7918 static void nft_flowtable_hooks_del(struct nft_flowtable
*flowtable
,
7919 struct list_head
*hook_list
)
7921 struct nft_hook
*hook
, *next
;
7923 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
7925 list_move(&hook
->list
, hook_list
);
7929 static void nf_tables_module_autoload_cleanup(struct net
*net
)
7931 struct nft_module_request
*req
, *next
;
7933 WARN_ON_ONCE(!list_empty(&net
->nft
.commit_list
));
7934 list_for_each_entry_safe(req
, next
, &net
->nft
.module_list
, list
) {
7935 WARN_ON_ONCE(!req
->done
);
7936 list_del(&req
->list
);
7941 static void nf_tables_commit_release(struct net
*net
)
7943 struct nft_trans
*trans
;
7945 /* all side effects have to be made visible.
7946 * For example, if a chain named 'foo' has been deleted, a
7947 * new transaction must not find it anymore.
7949 * Memory reclaim happens asynchronously from work queue
7950 * to prevent expensive synchronize_rcu() in commit phase.
7952 if (list_empty(&net
->nft
.commit_list
)) {
7953 nf_tables_module_autoload_cleanup(net
);
7954 mutex_unlock(&net
->nft
.commit_mutex
);
7958 trans
= list_last_entry(&net
->nft
.commit_list
,
7959 struct nft_trans
, list
);
7960 get_net(trans
->ctx
.net
);
7961 WARN_ON_ONCE(trans
->put_net
);
7963 trans
->put_net
= true;
7964 spin_lock(&nf_tables_destroy_list_lock
);
7965 list_splice_tail_init(&net
->nft
.commit_list
, &nf_tables_destroy_list
);
7966 spin_unlock(&nf_tables_destroy_list_lock
);
7968 nf_tables_module_autoload_cleanup(net
);
7969 schedule_work(&trans_destroy_work
);
7971 mutex_unlock(&net
->nft
.commit_mutex
);
7974 static void nft_commit_notify(struct net
*net
, u32 portid
)
7976 struct sk_buff
*batch_skb
= NULL
, *nskb
, *skb
;
7977 unsigned char *data
;
7980 list_for_each_entry_safe(skb
, nskb
, &net
->nft
.notify_list
, list
) {
7984 len
= NLMSG_GOODSIZE
- skb
->len
;
7985 list_del(&skb
->list
);
7989 if (len
> 0 && NFT_CB(skb
).report
== NFT_CB(batch_skb
).report
) {
7990 data
= skb_put(batch_skb
, skb
->len
);
7991 memcpy(data
, skb
->data
, skb
->len
);
7992 list_del(&skb
->list
);
7996 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
7997 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
8002 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
8003 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
8006 WARN_ON_ONCE(!list_empty(&net
->nft
.notify_list
));
8009 static int nf_tables_commit(struct net
*net
, struct sk_buff
*skb
)
8011 struct nft_trans
*trans
, *next
;
8012 struct nft_trans_elem
*te
;
8013 struct nft_chain
*chain
;
8014 struct nft_table
*table
;
8017 if (list_empty(&net
->nft
.commit_list
)) {
8018 mutex_unlock(&net
->nft
.commit_mutex
);
8022 /* 0. Validate ruleset, otherwise roll back for error reporting. */
8023 if (nf_tables_validate(net
) < 0)
8026 err
= nft_flow_rule_offload_commit(net
);
8030 /* 1. Allocate space for next generation rules_gen_X[] */
8031 list_for_each_entry_safe(trans
, next
, &net
->nft
.commit_list
, list
) {
8034 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
8035 trans
->msg_type
== NFT_MSG_DELRULE
) {
8036 chain
= trans
->ctx
.chain
;
8038 ret
= nf_tables_commit_chain_prepare(net
, chain
);
8040 nf_tables_commit_chain_prepare_cancel(net
);
8046 /* step 2. Make rules_gen_X visible to packet path */
8047 list_for_each_entry(table
, &net
->nft
.tables
, list
) {
8048 list_for_each_entry(chain
, &table
->chains
, list
)
8049 nf_tables_commit_chain(net
, chain
);
8053 * Bump generation counter, invalidate any dump in progress.
8054 * Cannot fail after this point.
8056 while (++net
->nft
.base_seq
== 0);
8058 /* step 3. Start new generation, rules_gen_X now in use. */
8059 net
->nft
.gencursor
= nft_gencursor_next(net
);
8061 list_for_each_entry_safe(trans
, next
, &net
->nft
.commit_list
, list
) {
8062 switch (trans
->msg_type
) {
8063 case NFT_MSG_NEWTABLE
:
8064 if (nft_trans_table_update(trans
)) {
8065 if (!nft_trans_table_enable(trans
)) {
8066 nf_tables_table_disable(net
,
8068 trans
->ctx
.table
->flags
|= NFT_TABLE_F_DORMANT
;
8071 nft_clear(net
, trans
->ctx
.table
);
8073 nf_tables_table_notify(&trans
->ctx
, NFT_MSG_NEWTABLE
);
8074 nft_trans_destroy(trans
);
8076 case NFT_MSG_DELTABLE
:
8077 list_del_rcu(&trans
->ctx
.table
->list
);
8078 nf_tables_table_notify(&trans
->ctx
, NFT_MSG_DELTABLE
);
8080 case NFT_MSG_NEWCHAIN
:
8081 if (nft_trans_chain_update(trans
)) {
8082 nft_chain_commit_update(trans
);
8083 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
);
8084 /* trans destroyed after rcu grace period */
8086 nft_chain_commit_drop_policy(trans
);
8087 nft_clear(net
, trans
->ctx
.chain
);
8088 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
);
8089 nft_trans_destroy(trans
);
8092 case NFT_MSG_DELCHAIN
:
8093 nft_chain_del(trans
->ctx
.chain
);
8094 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_DELCHAIN
);
8095 nf_tables_unregister_hook(trans
->ctx
.net
,
8099 case NFT_MSG_NEWRULE
:
8100 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
8101 nf_tables_rule_notify(&trans
->ctx
,
8102 nft_trans_rule(trans
),
8104 nft_trans_destroy(trans
);
8106 case NFT_MSG_DELRULE
:
8107 list_del_rcu(&nft_trans_rule(trans
)->list
);
8108 nf_tables_rule_notify(&trans
->ctx
,
8109 nft_trans_rule(trans
),
8111 nft_rule_expr_deactivate(&trans
->ctx
,
8112 nft_trans_rule(trans
),
8115 case NFT_MSG_NEWSET
:
8116 nft_clear(net
, nft_trans_set(trans
));
8117 /* This avoids hitting -EBUSY when deleting the table
8118 * from the transaction.
8120 if (nft_set_is_anonymous(nft_trans_set(trans
)) &&
8121 !list_empty(&nft_trans_set(trans
)->bindings
))
8122 trans
->ctx
.table
->use
--;
8124 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
8125 NFT_MSG_NEWSET
, GFP_KERNEL
);
8126 nft_trans_destroy(trans
);
8128 case NFT_MSG_DELSET
:
8129 list_del_rcu(&nft_trans_set(trans
)->list
);
8130 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
8131 NFT_MSG_DELSET
, GFP_KERNEL
);
8133 case NFT_MSG_NEWSETELEM
:
8134 te
= (struct nft_trans_elem
*)trans
->data
;
8136 te
->set
->ops
->activate(net
, te
->set
, &te
->elem
);
8137 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
8139 NFT_MSG_NEWSETELEM
, 0);
8140 nft_trans_destroy(trans
);
8142 case NFT_MSG_DELSETELEM
:
8143 te
= (struct nft_trans_elem
*)trans
->data
;
8145 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
8147 NFT_MSG_DELSETELEM
, 0);
8148 te
->set
->ops
->remove(net
, te
->set
, &te
->elem
);
8149 atomic_dec(&te
->set
->nelems
);
8152 case NFT_MSG_NEWOBJ
:
8153 if (nft_trans_obj_update(trans
)) {
8154 nft_obj_commit_update(trans
);
8155 nf_tables_obj_notify(&trans
->ctx
,
8156 nft_trans_obj(trans
),
8159 nft_clear(net
, nft_trans_obj(trans
));
8160 nf_tables_obj_notify(&trans
->ctx
,
8161 nft_trans_obj(trans
),
8163 nft_trans_destroy(trans
);
8166 case NFT_MSG_DELOBJ
:
8167 nft_obj_del(nft_trans_obj(trans
));
8168 nf_tables_obj_notify(&trans
->ctx
, nft_trans_obj(trans
),
8171 case NFT_MSG_NEWFLOWTABLE
:
8172 if (nft_trans_flowtable_update(trans
)) {
8173 nf_tables_flowtable_notify(&trans
->ctx
,
8174 nft_trans_flowtable(trans
),
8175 &nft_trans_flowtable_hooks(trans
),
8176 NFT_MSG_NEWFLOWTABLE
);
8177 list_splice(&nft_trans_flowtable_hooks(trans
),
8178 &nft_trans_flowtable(trans
)->hook_list
);
8180 nft_clear(net
, nft_trans_flowtable(trans
));
8181 nf_tables_flowtable_notify(&trans
->ctx
,
8182 nft_trans_flowtable(trans
),
8183 &nft_trans_flowtable(trans
)->hook_list
,
8184 NFT_MSG_NEWFLOWTABLE
);
8186 nft_trans_destroy(trans
);
8188 case NFT_MSG_DELFLOWTABLE
:
8189 if (nft_trans_flowtable_update(trans
)) {
8190 nft_flowtable_hooks_del(nft_trans_flowtable(trans
),
8191 &nft_trans_flowtable_hooks(trans
));
8192 nf_tables_flowtable_notify(&trans
->ctx
,
8193 nft_trans_flowtable(trans
),
8194 &nft_trans_flowtable_hooks(trans
),
8195 NFT_MSG_DELFLOWTABLE
);
8196 nft_unregister_flowtable_net_hooks(net
,
8197 &nft_trans_flowtable_hooks(trans
));
8199 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
8200 nf_tables_flowtable_notify(&trans
->ctx
,
8201 nft_trans_flowtable(trans
),
8202 &nft_trans_flowtable(trans
)->hook_list
,
8203 NFT_MSG_DELFLOWTABLE
);
8204 nft_unregister_flowtable_net_hooks(net
,
8205 &nft_trans_flowtable(trans
)->hook_list
);
8211 nft_commit_notify(net
, NETLINK_CB(skb
).portid
);
8212 nf_tables_gen_notify(net
, skb
, NFT_MSG_NEWGEN
);
8213 nf_tables_commit_release(net
);
8218 static void nf_tables_module_autoload(struct net
*net
)
8220 struct nft_module_request
*req
, *next
;
8221 LIST_HEAD(module_list
);
8223 list_splice_init(&net
->nft
.module_list
, &module_list
);
8224 mutex_unlock(&net
->nft
.commit_mutex
);
8225 list_for_each_entry_safe(req
, next
, &module_list
, list
) {
8226 request_module("%s", req
->module
);
8229 mutex_lock(&net
->nft
.commit_mutex
);
8230 list_splice(&module_list
, &net
->nft
.module_list
);
8233 static void nf_tables_abort_release(struct nft_trans
*trans
)
8235 switch (trans
->msg_type
) {
8236 case NFT_MSG_NEWTABLE
:
8237 nf_tables_table_destroy(&trans
->ctx
);
8239 case NFT_MSG_NEWCHAIN
:
8240 nf_tables_chain_destroy(&trans
->ctx
);
8242 case NFT_MSG_NEWRULE
:
8243 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
8245 case NFT_MSG_NEWSET
:
8246 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
8248 case NFT_MSG_NEWSETELEM
:
8249 nft_set_elem_destroy(nft_trans_elem_set(trans
),
8250 nft_trans_elem(trans
).priv
, true);
8252 case NFT_MSG_NEWOBJ
:
8253 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
8255 case NFT_MSG_NEWFLOWTABLE
:
8256 if (nft_trans_flowtable_update(trans
))
8257 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
8259 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
8265 static int __nf_tables_abort(struct net
*net
, enum nfnl_abort_action action
)
8267 struct nft_trans
*trans
, *next
;
8268 struct nft_trans_elem
*te
;
8269 struct nft_hook
*hook
;
8271 if (action
== NFNL_ABORT_VALIDATE
&&
8272 nf_tables_validate(net
) < 0)
8275 list_for_each_entry_safe_reverse(trans
, next
, &net
->nft
.commit_list
,
8277 switch (trans
->msg_type
) {
8278 case NFT_MSG_NEWTABLE
:
8279 if (nft_trans_table_update(trans
)) {
8280 if (nft_trans_table_enable(trans
)) {
8281 nf_tables_table_disable(net
,
8283 trans
->ctx
.table
->flags
|= NFT_TABLE_F_DORMANT
;
8285 nft_trans_destroy(trans
);
8287 list_del_rcu(&trans
->ctx
.table
->list
);
8290 case NFT_MSG_DELTABLE
:
8291 nft_clear(trans
->ctx
.net
, trans
->ctx
.table
);
8292 nft_trans_destroy(trans
);
8294 case NFT_MSG_NEWCHAIN
:
8295 if (nft_trans_chain_update(trans
)) {
8296 free_percpu(nft_trans_chain_stats(trans
));
8297 kfree(nft_trans_chain_name(trans
));
8298 nft_trans_destroy(trans
);
8300 if (nft_chain_is_bound(trans
->ctx
.chain
)) {
8301 nft_trans_destroy(trans
);
8304 trans
->ctx
.table
->use
--;
8305 nft_chain_del(trans
->ctx
.chain
);
8306 nf_tables_unregister_hook(trans
->ctx
.net
,
8311 case NFT_MSG_DELCHAIN
:
8312 trans
->ctx
.table
->use
++;
8313 nft_clear(trans
->ctx
.net
, trans
->ctx
.chain
);
8314 nft_trans_destroy(trans
);
8316 case NFT_MSG_NEWRULE
:
8317 trans
->ctx
.chain
->use
--;
8318 list_del_rcu(&nft_trans_rule(trans
)->list
);
8319 nft_rule_expr_deactivate(&trans
->ctx
,
8320 nft_trans_rule(trans
),
8323 case NFT_MSG_DELRULE
:
8324 trans
->ctx
.chain
->use
++;
8325 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
8326 nft_rule_expr_activate(&trans
->ctx
, nft_trans_rule(trans
));
8327 nft_trans_destroy(trans
);
8329 case NFT_MSG_NEWSET
:
8330 trans
->ctx
.table
->use
--;
8331 if (nft_trans_set_bound(trans
)) {
8332 nft_trans_destroy(trans
);
8335 list_del_rcu(&nft_trans_set(trans
)->list
);
8337 case NFT_MSG_DELSET
:
8338 trans
->ctx
.table
->use
++;
8339 nft_clear(trans
->ctx
.net
, nft_trans_set(trans
));
8340 nft_trans_destroy(trans
);
8342 case NFT_MSG_NEWSETELEM
:
8343 if (nft_trans_elem_set_bound(trans
)) {
8344 nft_trans_destroy(trans
);
8347 te
= (struct nft_trans_elem
*)trans
->data
;
8348 te
->set
->ops
->remove(net
, te
->set
, &te
->elem
);
8349 atomic_dec(&te
->set
->nelems
);
8351 case NFT_MSG_DELSETELEM
:
8352 te
= (struct nft_trans_elem
*)trans
->data
;
8354 nft_set_elem_activate(net
, te
->set
, &te
->elem
);
8355 te
->set
->ops
->activate(net
, te
->set
, &te
->elem
);
8358 nft_trans_destroy(trans
);
8360 case NFT_MSG_NEWOBJ
:
8361 if (nft_trans_obj_update(trans
)) {
8362 kfree(nft_trans_obj_newobj(trans
));
8363 nft_trans_destroy(trans
);
8365 trans
->ctx
.table
->use
--;
8366 nft_obj_del(nft_trans_obj(trans
));
8369 case NFT_MSG_DELOBJ
:
8370 trans
->ctx
.table
->use
++;
8371 nft_clear(trans
->ctx
.net
, nft_trans_obj(trans
));
8372 nft_trans_destroy(trans
);
8374 case NFT_MSG_NEWFLOWTABLE
:
8375 if (nft_trans_flowtable_update(trans
)) {
8376 nft_unregister_flowtable_net_hooks(net
,
8377 &nft_trans_flowtable_hooks(trans
));
8379 trans
->ctx
.table
->use
--;
8380 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
8381 nft_unregister_flowtable_net_hooks(net
,
8382 &nft_trans_flowtable(trans
)->hook_list
);
8385 case NFT_MSG_DELFLOWTABLE
:
8386 if (nft_trans_flowtable_update(trans
)) {
8387 list_for_each_entry(hook
, &nft_trans_flowtable(trans
)->hook_list
, list
)
8388 hook
->inactive
= false;
8390 trans
->ctx
.table
->use
++;
8391 nft_clear(trans
->ctx
.net
, nft_trans_flowtable(trans
));
8393 nft_trans_destroy(trans
);
8400 list_for_each_entry_safe_reverse(trans
, next
,
8401 &net
->nft
.commit_list
, list
) {
8402 list_del(&trans
->list
);
8403 nf_tables_abort_release(trans
);
8406 if (action
== NFNL_ABORT_AUTOLOAD
)
8407 nf_tables_module_autoload(net
);
8409 nf_tables_module_autoload_cleanup(net
);
8414 static void nf_tables_cleanup(struct net
*net
)
8416 nft_validate_state_update(net
, NFT_VALIDATE_SKIP
);
8419 static int nf_tables_abort(struct net
*net
, struct sk_buff
*skb
,
8420 enum nfnl_abort_action action
)
8422 int ret
= __nf_tables_abort(net
, action
);
8424 mutex_unlock(&net
->nft
.commit_mutex
);
8429 static bool nf_tables_valid_genid(struct net
*net
, u32 genid
)
8433 mutex_lock(&net
->nft
.commit_mutex
);
8435 genid_ok
= genid
== 0 || net
->nft
.base_seq
== genid
;
8437 mutex_unlock(&net
->nft
.commit_mutex
);
8439 /* else, commit mutex has to be released by commit or abort function */
8443 static const struct nfnetlink_subsystem nf_tables_subsys
= {
8444 .name
= "nf_tables",
8445 .subsys_id
= NFNL_SUBSYS_NFTABLES
,
8446 .cb_count
= NFT_MSG_MAX
,
8448 .commit
= nf_tables_commit
,
8449 .abort
= nf_tables_abort
,
8450 .cleanup
= nf_tables_cleanup
,
8451 .valid_genid
= nf_tables_valid_genid
,
8452 .owner
= THIS_MODULE
,
8455 int nft_chain_validate_dependency(const struct nft_chain
*chain
,
8456 enum nft_chain_types type
)
8458 const struct nft_base_chain
*basechain
;
8460 if (nft_is_base_chain(chain
)) {
8461 basechain
= nft_base_chain(chain
);
8462 if (basechain
->type
->type
!= type
)
8467 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency
);
8469 int nft_chain_validate_hooks(const struct nft_chain
*chain
,
8470 unsigned int hook_flags
)
8472 struct nft_base_chain
*basechain
;
8474 if (nft_is_base_chain(chain
)) {
8475 basechain
= nft_base_chain(chain
);
8477 if ((1 << basechain
->ops
.hooknum
) & hook_flags
)
8485 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks
);
8488 * Loop detection - walk through the ruleset beginning at the destination chain
8489 * of a new jump until either the source chain is reached (loop) or all
8490 * reachable chains have been traversed.
8492 * The loop check is performed whenever a new jump verdict is added to an
8493 * expression or verdict map or a verdict map is bound to a new chain.
8496 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
8497 const struct nft_chain
*chain
);
8499 static int nf_tables_loop_check_setelem(const struct nft_ctx
*ctx
,
8500 struct nft_set
*set
,
8501 const struct nft_set_iter
*iter
,
8502 struct nft_set_elem
*elem
)
8504 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem
->priv
);
8505 const struct nft_data
*data
;
8507 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
8508 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_INTERVAL_END
)
8511 data
= nft_set_ext_data(ext
);
8512 switch (data
->verdict
.code
) {
8515 return nf_tables_check_loops(ctx
, data
->verdict
.chain
);
8521 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
8522 const struct nft_chain
*chain
)
8524 const struct nft_rule
*rule
;
8525 const struct nft_expr
*expr
, *last
;
8526 struct nft_set
*set
;
8527 struct nft_set_binding
*binding
;
8528 struct nft_set_iter iter
;
8530 if (ctx
->chain
== chain
)
8533 list_for_each_entry(rule
, &chain
->rules
, list
) {
8534 nft_rule_for_each_expr(expr
, last
, rule
) {
8535 struct nft_immediate_expr
*priv
;
8536 const struct nft_data
*data
;
8539 if (strcmp(expr
->ops
->type
->name
, "immediate"))
8542 priv
= nft_expr_priv(expr
);
8543 if (priv
->dreg
!= NFT_REG_VERDICT
)
8547 switch (data
->verdict
.code
) {
8550 err
= nf_tables_check_loops(ctx
,
8551 data
->verdict
.chain
);
8560 list_for_each_entry(set
, &ctx
->table
->sets
, list
) {
8561 if (!nft_is_active_next(ctx
->net
, set
))
8563 if (!(set
->flags
& NFT_SET_MAP
) ||
8564 set
->dtype
!= NFT_DATA_VERDICT
)
8567 list_for_each_entry(binding
, &set
->bindings
, list
) {
8568 if (!(binding
->flags
& NFT_SET_MAP
) ||
8569 binding
->chain
!= chain
)
8572 iter
.genmask
= nft_genmask_next(ctx
->net
);
8576 iter
.fn
= nf_tables_loop_check_setelem
;
8578 set
->ops
->walk(ctx
, set
, &iter
);
8588 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
8590 * @attr: netlink attribute to fetch value from
8591 * @max: maximum value to be stored in dest
8592 * @dest: pointer to the variable
8594 * Parse, check and store a given u32 netlink attribute into variable.
8595 * This function returns -ERANGE if the value goes over maximum value.
8596 * Otherwise a 0 is returned and the attribute value is stored in the
8597 * destination variable.
8599 int nft_parse_u32_check(const struct nlattr
*attr
, int max
, u32
*dest
)
8603 val
= ntohl(nla_get_be32(attr
));
8610 EXPORT_SYMBOL_GPL(nft_parse_u32_check
);
8613 * nft_parse_register - parse a register value from a netlink attribute
8615 * @attr: netlink attribute
8617 * Parse and translate a register value from a netlink attribute.
8618 * Registers used to be 128 bit wide, these register numbers will be
8619 * mapped to the corresponding 32 bit register numbers.
8621 static unsigned int nft_parse_register(const struct nlattr
*attr
)
8625 reg
= ntohl(nla_get_be32(attr
));
8627 case NFT_REG_VERDICT
...NFT_REG_4
:
8628 return reg
* NFT_REG_SIZE
/ NFT_REG32_SIZE
;
8630 return reg
+ NFT_REG_SIZE
/ NFT_REG32_SIZE
- NFT_REG32_00
;
8635 * nft_dump_register - dump a register value to a netlink attribute
8637 * @skb: socket buffer
8638 * @attr: attribute number
8639 * @reg: register number
8641 * Construct a netlink attribute containing the register number. For
8642 * compatibility reasons, register numbers being a multiple of 4 are
8643 * translated to the corresponding 128 bit register numbers.
8645 int nft_dump_register(struct sk_buff
*skb
, unsigned int attr
, unsigned int reg
)
8647 if (reg
% (NFT_REG_SIZE
/ NFT_REG32_SIZE
) == 0)
8648 reg
= reg
/ (NFT_REG_SIZE
/ NFT_REG32_SIZE
);
8650 reg
= reg
- NFT_REG_SIZE
/ NFT_REG32_SIZE
+ NFT_REG32_00
;
8652 return nla_put_be32(skb
, attr
, htonl(reg
));
8654 EXPORT_SYMBOL_GPL(nft_dump_register
);
8657 * nft_validate_register_load - validate a load from a register
8659 * @reg: the register number
8660 * @len: the length of the data
8662 * Validate that the input register is one of the general purpose
8663 * registers and that the length of the load is within the bounds.
8665 static int nft_validate_register_load(enum nft_registers reg
, unsigned int len
)
8667 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
8671 if (reg
* NFT_REG32_SIZE
+ len
> sizeof_field(struct nft_regs
, data
))
8677 int nft_parse_register_load(const struct nlattr
*attr
, u8
*sreg
, u32 len
)
8682 reg
= nft_parse_register(attr
);
8683 err
= nft_validate_register_load(reg
, len
);
8690 EXPORT_SYMBOL_GPL(nft_parse_register_load
);
8693 * nft_validate_register_store - validate an expressions' register store
8695 * @ctx: context of the expression performing the load
8696 * @reg: the destination register number
8697 * @data: the data to load
8698 * @type: the data type
8699 * @len: the length of the data
8701 * Validate that a data load uses the appropriate data type for
8702 * the destination register and the length is within the bounds.
8703 * A value of NULL for the data means that its runtime gathered
8706 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
8707 enum nft_registers reg
,
8708 const struct nft_data
*data
,
8709 enum nft_data_types type
,
8715 case NFT_REG_VERDICT
:
8716 if (type
!= NFT_DATA_VERDICT
)
8720 (data
->verdict
.code
== NFT_GOTO
||
8721 data
->verdict
.code
== NFT_JUMP
)) {
8722 err
= nf_tables_check_loops(ctx
, data
->verdict
.chain
);
8729 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
8733 if (reg
* NFT_REG32_SIZE
+ len
>
8734 sizeof_field(struct nft_regs
, data
))
8737 if (data
!= NULL
&& type
!= NFT_DATA_VALUE
)
8743 int nft_parse_register_store(const struct nft_ctx
*ctx
,
8744 const struct nlattr
*attr
, u8
*dreg
,
8745 const struct nft_data
*data
,
8746 enum nft_data_types type
, unsigned int len
)
8751 reg
= nft_parse_register(attr
);
8752 err
= nft_validate_register_store(ctx
, reg
, data
, type
, len
);
8759 EXPORT_SYMBOL_GPL(nft_parse_register_store
);
8761 static const struct nla_policy nft_verdict_policy
[NFTA_VERDICT_MAX
+ 1] = {
8762 [NFTA_VERDICT_CODE
] = { .type
= NLA_U32
},
8763 [NFTA_VERDICT_CHAIN
] = { .type
= NLA_STRING
,
8764 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
8765 [NFTA_VERDICT_CHAIN_ID
] = { .type
= NLA_U32
},
8768 static int nft_verdict_init(const struct nft_ctx
*ctx
, struct nft_data
*data
,
8769 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
8771 u8 genmask
= nft_genmask_next(ctx
->net
);
8772 struct nlattr
*tb
[NFTA_VERDICT_MAX
+ 1];
8773 struct nft_chain
*chain
;
8776 err
= nla_parse_nested_deprecated(tb
, NFTA_VERDICT_MAX
, nla
,
8777 nft_verdict_policy
, NULL
);
8781 if (!tb
[NFTA_VERDICT_CODE
])
8783 data
->verdict
.code
= ntohl(nla_get_be32(tb
[NFTA_VERDICT_CODE
]));
8785 switch (data
->verdict
.code
) {
8787 switch (data
->verdict
.code
& NF_VERDICT_MASK
) {
8802 if (tb
[NFTA_VERDICT_CHAIN
]) {
8803 chain
= nft_chain_lookup(ctx
->net
, ctx
->table
,
8804 tb
[NFTA_VERDICT_CHAIN
],
8806 } else if (tb
[NFTA_VERDICT_CHAIN_ID
]) {
8807 chain
= nft_chain_lookup_byid(ctx
->net
,
8808 tb
[NFTA_VERDICT_CHAIN_ID
]);
8810 return PTR_ERR(chain
);
8816 return PTR_ERR(chain
);
8817 if (nft_is_base_chain(chain
))
8821 data
->verdict
.chain
= chain
;
8825 desc
->len
= sizeof(data
->verdict
);
8826 desc
->type
= NFT_DATA_VERDICT
;
8830 static void nft_verdict_uninit(const struct nft_data
*data
)
8832 struct nft_chain
*chain
;
8833 struct nft_rule
*rule
;
8835 switch (data
->verdict
.code
) {
8838 chain
= data
->verdict
.chain
;
8841 if (!nft_chain_is_bound(chain
))
8844 chain
->table
->use
--;
8845 list_for_each_entry(rule
, &chain
->rules
, list
)
8848 nft_chain_del(chain
);
8853 int nft_verdict_dump(struct sk_buff
*skb
, int type
, const struct nft_verdict
*v
)
8855 struct nlattr
*nest
;
8857 nest
= nla_nest_start_noflag(skb
, type
);
8859 goto nla_put_failure
;
8861 if (nla_put_be32(skb
, NFTA_VERDICT_CODE
, htonl(v
->code
)))
8862 goto nla_put_failure
;
8867 if (nla_put_string(skb
, NFTA_VERDICT_CHAIN
,
8869 goto nla_put_failure
;
8871 nla_nest_end(skb
, nest
);
8878 static int nft_value_init(const struct nft_ctx
*ctx
,
8879 struct nft_data
*data
, unsigned int size
,
8880 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
8890 nla_memcpy(data
->data
, nla
, len
);
8891 desc
->type
= NFT_DATA_VALUE
;
8896 static int nft_value_dump(struct sk_buff
*skb
, const struct nft_data
*data
,
8899 return nla_put(skb
, NFTA_DATA_VALUE
, len
, data
->data
);
8902 static const struct nla_policy nft_data_policy
[NFTA_DATA_MAX
+ 1] = {
8903 [NFTA_DATA_VALUE
] = { .type
= NLA_BINARY
},
8904 [NFTA_DATA_VERDICT
] = { .type
= NLA_NESTED
},
8908 * nft_data_init - parse nf_tables data netlink attributes
8910 * @ctx: context of the expression using the data
8911 * @data: destination struct nft_data
8912 * @size: maximum data length
8913 * @desc: data description
8914 * @nla: netlink attribute containing data
8916 * Parse the netlink data attributes and initialize a struct nft_data.
8917 * The type and length of data are returned in the data description.
8919 * The caller can indicate that it only wants to accept data of type
8920 * NFT_DATA_VALUE by passing NULL for the ctx argument.
8922 int nft_data_init(const struct nft_ctx
*ctx
,
8923 struct nft_data
*data
, unsigned int size
,
8924 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
8926 struct nlattr
*tb
[NFTA_DATA_MAX
+ 1];
8929 err
= nla_parse_nested_deprecated(tb
, NFTA_DATA_MAX
, nla
,
8930 nft_data_policy
, NULL
);
8934 if (tb
[NFTA_DATA_VALUE
])
8935 return nft_value_init(ctx
, data
, size
, desc
,
8936 tb
[NFTA_DATA_VALUE
]);
8937 if (tb
[NFTA_DATA_VERDICT
] && ctx
!= NULL
)
8938 return nft_verdict_init(ctx
, data
, desc
, tb
[NFTA_DATA_VERDICT
]);
8941 EXPORT_SYMBOL_GPL(nft_data_init
);
8944 * nft_data_release - release a nft_data item
8946 * @data: struct nft_data to release
8947 * @type: type of data
8949 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
8950 * all others need to be released by calling this function.
8952 void nft_data_release(const struct nft_data
*data
, enum nft_data_types type
)
8954 if (type
< NFT_DATA_VERDICT
)
8957 case NFT_DATA_VERDICT
:
8958 return nft_verdict_uninit(data
);
8963 EXPORT_SYMBOL_GPL(nft_data_release
);
8965 int nft_data_dump(struct sk_buff
*skb
, int attr
, const struct nft_data
*data
,
8966 enum nft_data_types type
, unsigned int len
)
8968 struct nlattr
*nest
;
8971 nest
= nla_nest_start_noflag(skb
, attr
);
8976 case NFT_DATA_VALUE
:
8977 err
= nft_value_dump(skb
, data
, len
);
8979 case NFT_DATA_VERDICT
:
8980 err
= nft_verdict_dump(skb
, NFTA_DATA_VERDICT
, &data
->verdict
);
8987 nla_nest_end(skb
, nest
);
8990 EXPORT_SYMBOL_GPL(nft_data_dump
);
8992 int __nft_release_basechain(struct nft_ctx
*ctx
)
8994 struct nft_rule
*rule
, *nr
;
8996 if (WARN_ON(!nft_is_base_chain(ctx
->chain
)))
8999 nf_tables_unregister_hook(ctx
->net
, ctx
->chain
->table
, ctx
->chain
);
9000 list_for_each_entry_safe(rule
, nr
, &ctx
->chain
->rules
, list
) {
9001 list_del(&rule
->list
);
9003 nf_tables_rule_release(ctx
, rule
);
9005 nft_chain_del(ctx
->chain
);
9007 nf_tables_chain_destroy(ctx
);
9011 EXPORT_SYMBOL_GPL(__nft_release_basechain
);
9013 static void __nft_release_hook(struct net
*net
, struct nft_table
*table
)
9015 struct nft_chain
*chain
;
9017 list_for_each_entry(chain
, &table
->chains
, list
)
9018 nf_tables_unregister_hook(net
, table
, chain
);
9021 static void __nft_release_hooks(struct net
*net
)
9023 struct nft_table
*table
;
9025 list_for_each_entry(table
, &net
->nft
.tables
, list
)
9026 __nft_release_hook(net
, table
);
9029 static void __nft_release_table(struct net
*net
, struct nft_table
*table
)
9031 struct nft_flowtable
*flowtable
, *nf
;
9032 struct nft_chain
*chain
, *nc
;
9033 struct nft_object
*obj
, *ne
;
9034 struct nft_rule
*rule
, *nr
;
9035 struct nft_set
*set
, *ns
;
9036 struct nft_ctx ctx
= {
9038 .family
= NFPROTO_NETDEV
,
9041 ctx
.family
= table
->family
;
9043 list_for_each_entry(chain
, &table
->chains
, list
) {
9045 list_for_each_entry_safe(rule
, nr
, &chain
->rules
, list
) {
9046 list_del(&rule
->list
);
9048 nf_tables_rule_release(&ctx
, rule
);
9051 list_for_each_entry_safe(flowtable
, nf
, &table
->flowtables
, list
) {
9052 list_del(&flowtable
->list
);
9054 nf_tables_flowtable_destroy(flowtable
);
9056 list_for_each_entry_safe(set
, ns
, &table
->sets
, list
) {
9057 list_del(&set
->list
);
9059 nft_set_destroy(&ctx
, set
);
9061 list_for_each_entry_safe(obj
, ne
, &table
->objects
, list
) {
9064 nft_obj_destroy(&ctx
, obj
);
9066 list_for_each_entry_safe(chain
, nc
, &table
->chains
, list
) {
9068 nft_chain_del(chain
);
9070 nf_tables_chain_destroy(&ctx
);
9072 list_del(&table
->list
);
9073 nf_tables_table_destroy(&ctx
);
9076 static void __nft_release_tables(struct net
*net
, u32 nlpid
)
9078 struct nft_table
*table
, *nt
;
9080 list_for_each_entry_safe(table
, nt
, &net
->nft
.tables
, list
) {
9081 if (nft_table_has_owner(table
) &&
9082 nlpid
!= table
->nlpid
)
9085 __nft_release_table(net
, table
);
9089 static int nft_rcv_nl_event(struct notifier_block
*this, unsigned long event
,
9092 struct netlink_notify
*n
= ptr
;
9093 struct nft_table
*table
, *nt
;
9094 struct net
*net
= n
->net
;
9095 bool release
= false;
9097 if (event
!= NETLINK_URELEASE
|| n
->protocol
!= NETLINK_NETFILTER
)
9100 mutex_lock(&net
->nft
.commit_mutex
);
9101 list_for_each_entry(table
, &net
->nft
.tables
, list
) {
9102 if (nft_table_has_owner(table
) &&
9103 n
->portid
== table
->nlpid
) {
9104 __nft_release_hook(net
, table
);
9110 list_for_each_entry_safe(table
, nt
, &net
->nft
.tables
, list
) {
9111 if (nft_table_has_owner(table
) &&
9112 n
->portid
== table
->nlpid
)
9113 __nft_release_table(net
, table
);
9116 mutex_unlock(&net
->nft
.commit_mutex
);
9121 static struct notifier_block nft_nl_notifier
= {
9122 .notifier_call
= nft_rcv_nl_event
,
9125 static int __net_init
nf_tables_init_net(struct net
*net
)
9127 INIT_LIST_HEAD(&net
->nft
.tables
);
9128 INIT_LIST_HEAD(&net
->nft
.commit_list
);
9129 INIT_LIST_HEAD(&net
->nft
.module_list
);
9130 INIT_LIST_HEAD(&net
->nft
.notify_list
);
9131 mutex_init(&net
->nft
.commit_mutex
);
9132 net
->nft
.base_seq
= 1;
9133 net
->nft
.validate_state
= NFT_VALIDATE_SKIP
;
9138 static void __net_exit
nf_tables_pre_exit_net(struct net
*net
)
9140 __nft_release_hooks(net
);
9143 static void __net_exit
nf_tables_exit_net(struct net
*net
)
9145 mutex_lock(&net
->nft
.commit_mutex
);
9146 if (!list_empty(&net
->nft
.commit_list
))
9147 __nf_tables_abort(net
, NFNL_ABORT_NONE
);
9148 __nft_release_tables(net
, 0);
9149 mutex_unlock(&net
->nft
.commit_mutex
);
9150 WARN_ON_ONCE(!list_empty(&net
->nft
.tables
));
9151 WARN_ON_ONCE(!list_empty(&net
->nft
.module_list
));
9152 WARN_ON_ONCE(!list_empty(&net
->nft
.notify_list
));
9155 static struct pernet_operations nf_tables_net_ops
= {
9156 .init
= nf_tables_init_net
,
9157 .pre_exit
= nf_tables_pre_exit_net
,
9158 .exit
= nf_tables_exit_net
,
9161 static int __init
nf_tables_module_init(void)
9165 spin_lock_init(&nf_tables_destroy_list_lock
);
9166 err
= register_pernet_subsys(&nf_tables_net_ops
);
9170 err
= nft_chain_filter_init();
9172 goto err_chain_filter
;
9174 err
= nf_tables_core_module_init();
9176 goto err_core_module
;
9178 err
= register_netdevice_notifier(&nf_tables_flowtable_notifier
);
9180 goto err_netdev_notifier
;
9182 err
= rhltable_init(&nft_objname_ht
, &nft_objname_ht_params
);
9184 goto err_rht_objname
;
9186 err
= nft_offload_init();
9190 err
= netlink_register_notifier(&nft_nl_notifier
);
9192 goto err_netlink_notifier
;
9195 err
= nfnetlink_subsys_register(&nf_tables_subsys
);
9197 goto err_nfnl_subsys
;
9199 nft_chain_route_init();
9204 netlink_unregister_notifier(&nft_nl_notifier
);
9205 err_netlink_notifier
:
9208 rhltable_destroy(&nft_objname_ht
);
9210 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
9211 err_netdev_notifier
:
9212 nf_tables_core_module_exit();
9214 nft_chain_filter_fini();
9216 unregister_pernet_subsys(&nf_tables_net_ops
);
9220 static void __exit
nf_tables_module_exit(void)
9222 nfnetlink_subsys_unregister(&nf_tables_subsys
);
9223 netlink_unregister_notifier(&nft_nl_notifier
);
9225 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
9226 nft_chain_filter_fini();
9227 nft_chain_route_fini();
9228 unregister_pernet_subsys(&nf_tables_net_ops
);
9229 cancel_work_sync(&trans_destroy_work
);
9231 rhltable_destroy(&nft_objname_ht
);
9232 nf_tables_core_module_exit();
9235 module_init(nf_tables_module_init
);
9236 module_exit(nf_tables_module_exit
);
9238 MODULE_LICENSE("GPL");
9239 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
9240 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES
);