2 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <linux/netfilter/nf_tables_compat.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/netfilter_arp/arp_tables.h>
24 #include <net/netfilter/nf_tables.h>
27 struct list_head head
;
28 struct nft_expr_ops ops
;
31 /* Unlike other expressions, ops doesn't have static storage duration.
32 * nft core assumes they do. We use kfree_rcu so that nft core can
33 * can check expr->ops->size even after nft_compat->destroy() frees
34 * the nft_xt struct that holds the ops structure.
36 struct rcu_head rcu_head
;
39 /* Used for matches where *info is larger than X byte */
40 #define NFT_MATCH_LARGE_THRESH 192
42 struct nft_xt_match_priv
{
46 static bool nft_xt_put(struct nft_xt
*xt
)
48 if (--xt
->refcnt
== 0) {
50 kfree_rcu(xt
, rcu_head
);
57 static int nft_compat_chain_validate_dependency(const char *tablename
,
58 const struct nft_chain
*chain
)
60 const struct nft_base_chain
*basechain
;
63 !nft_is_base_chain(chain
))
66 basechain
= nft_base_chain(chain
);
67 if (strcmp(tablename
, "nat") == 0 &&
68 basechain
->type
->type
!= NFT_CHAIN_T_NAT
)
78 struct arpt_entry arp
;
82 nft_compat_set_par(struct xt_action_param
*par
, void *xt
, const void *xt_info
)
85 par
->targinfo
= xt_info
;
89 static void nft_target_eval_xt(const struct nft_expr
*expr
,
90 struct nft_regs
*regs
,
91 const struct nft_pktinfo
*pkt
)
93 void *info
= nft_expr_priv(expr
);
94 struct xt_target
*target
= expr
->ops
->data
;
95 struct sk_buff
*skb
= pkt
->skb
;
98 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
100 ret
= target
->target(skb
, &pkt
->xt
);
107 regs
->verdict
.code
= NFT_CONTINUE
;
110 regs
->verdict
.code
= ret
;
115 static void nft_target_eval_bridge(const struct nft_expr
*expr
,
116 struct nft_regs
*regs
,
117 const struct nft_pktinfo
*pkt
)
119 void *info
= nft_expr_priv(expr
);
120 struct xt_target
*target
= expr
->ops
->data
;
121 struct sk_buff
*skb
= pkt
->skb
;
124 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
126 ret
= target
->target(skb
, &pkt
->xt
);
133 regs
->verdict
.code
= NF_ACCEPT
;
136 regs
->verdict
.code
= NF_DROP
;
139 regs
->verdict
.code
= NFT_CONTINUE
;
142 regs
->verdict
.code
= NFT_RETURN
;
145 regs
->verdict
.code
= ret
;
150 static const struct nla_policy nft_target_policy
[NFTA_TARGET_MAX
+ 1] = {
151 [NFTA_TARGET_NAME
] = { .type
= NLA_NUL_STRING
},
152 [NFTA_TARGET_REV
] = { .type
= NLA_U32
},
153 [NFTA_TARGET_INFO
] = { .type
= NLA_BINARY
},
157 nft_target_set_tgchk_param(struct xt_tgchk_param
*par
,
158 const struct nft_ctx
*ctx
,
159 struct xt_target
*target
, void *info
,
160 union nft_entry
*entry
, u16 proto
, bool inv
)
163 par
->table
= ctx
->table
->name
;
164 switch (ctx
->afi
->family
) {
166 entry
->e4
.ip
.proto
= proto
;
167 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
171 entry
->e6
.ipv6
.flags
|= IP6T_F_PROTO
;
173 entry
->e6
.ipv6
.proto
= proto
;
174 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
177 entry
->ebt
.ethproto
= (__force __be16
)proto
;
178 entry
->ebt
.invflags
= inv
? EBT_IPROTO
: 0;
183 par
->entryinfo
= entry
;
184 par
->target
= target
;
185 par
->targinfo
= info
;
186 if (nft_is_base_chain(ctx
->chain
)) {
187 const struct nft_base_chain
*basechain
=
188 nft_base_chain(ctx
->chain
);
189 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
191 par
->hook_mask
= 1 << ops
->hooknum
;
195 par
->family
= ctx
->afi
->family
;
196 par
->nft_compat
= true;
199 static void target_compat_from_user(struct xt_target
*t
, void *in
, void *out
)
203 memcpy(out
, in
, t
->targetsize
);
204 pad
= XT_ALIGN(t
->targetsize
) - t
->targetsize
;
206 memset(out
+ t
->targetsize
, 0, pad
);
209 static const struct nla_policy nft_rule_compat_policy
[NFTA_RULE_COMPAT_MAX
+ 1] = {
210 [NFTA_RULE_COMPAT_PROTO
] = { .type
= NLA_U32
},
211 [NFTA_RULE_COMPAT_FLAGS
] = { .type
= NLA_U32
},
214 static int nft_parse_compat(const struct nlattr
*attr
, u16
*proto
, bool *inv
)
216 struct nlattr
*tb
[NFTA_RULE_COMPAT_MAX
+1];
220 err
= nla_parse_nested(tb
, NFTA_RULE_COMPAT_MAX
, attr
,
221 nft_rule_compat_policy
, NULL
);
225 if (!tb
[NFTA_RULE_COMPAT_PROTO
] || !tb
[NFTA_RULE_COMPAT_FLAGS
])
228 flags
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_FLAGS
]));
229 if (flags
& ~NFT_RULE_COMPAT_F_MASK
)
231 if (flags
& NFT_RULE_COMPAT_F_INV
)
234 *proto
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_PROTO
]));
239 nft_target_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
240 const struct nlattr
* const tb
[])
242 void *info
= nft_expr_priv(expr
);
243 struct xt_target
*target
= expr
->ops
->data
;
244 struct xt_tgchk_param par
;
245 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_TARGET_INFO
]));
246 struct nft_xt
*nft_xt
;
249 union nft_entry e
= {};
252 target_compat_from_user(target
, nla_data(tb
[NFTA_TARGET_INFO
]), info
);
254 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
255 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
260 nft_target_set_tgchk_param(&par
, ctx
, target
, info
, &e
, proto
, inv
);
262 ret
= xt_check_target(&par
, size
, proto
, inv
);
266 /* The standard target cannot be used */
270 nft_xt
= container_of(expr
->ops
, struct nft_xt
, ops
);
276 nft_target_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
278 struct xt_target
*target
= expr
->ops
->data
;
279 void *info
= nft_expr_priv(expr
);
280 struct xt_tgdtor_param par
;
285 par
.family
= ctx
->afi
->family
;
286 if (par
.target
->destroy
!= NULL
)
287 par
.target
->destroy(&par
);
289 if (nft_xt_put(container_of(expr
->ops
, struct nft_xt
, ops
)))
290 module_put(target
->me
);
293 static int nft_target_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
295 const struct xt_target
*target
= expr
->ops
->data
;
296 void *info
= nft_expr_priv(expr
);
298 if (nla_put_string(skb
, NFTA_TARGET_NAME
, target
->name
) ||
299 nla_put_be32(skb
, NFTA_TARGET_REV
, htonl(target
->revision
)) ||
300 nla_put(skb
, NFTA_TARGET_INFO
, XT_ALIGN(target
->targetsize
), info
))
301 goto nla_put_failure
;
309 static int nft_target_validate(const struct nft_ctx
*ctx
,
310 const struct nft_expr
*expr
,
311 const struct nft_data
**data
)
313 struct xt_target
*target
= expr
->ops
->data
;
314 unsigned int hook_mask
= 0;
317 if (nft_is_base_chain(ctx
->chain
)) {
318 const struct nft_base_chain
*basechain
=
319 nft_base_chain(ctx
->chain
);
320 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
322 hook_mask
= 1 << ops
->hooknum
;
323 if (target
->hooks
&& !(hook_mask
& target
->hooks
))
326 ret
= nft_compat_chain_validate_dependency(target
->table
,
334 static void __nft_match_eval(const struct nft_expr
*expr
,
335 struct nft_regs
*regs
,
336 const struct nft_pktinfo
*pkt
,
339 struct xt_match
*match
= expr
->ops
->data
;
340 struct sk_buff
*skb
= pkt
->skb
;
343 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, match
, info
);
345 ret
= match
->match(skb
, (struct xt_action_param
*)&pkt
->xt
);
347 if (pkt
->xt
.hotdrop
) {
348 regs
->verdict
.code
= NF_DROP
;
352 switch (ret
? 1 : 0) {
354 regs
->verdict
.code
= NFT_CONTINUE
;
357 regs
->verdict
.code
= NFT_BREAK
;
362 static void nft_match_large_eval(const struct nft_expr
*expr
,
363 struct nft_regs
*regs
,
364 const struct nft_pktinfo
*pkt
)
366 struct nft_xt_match_priv
*priv
= nft_expr_priv(expr
);
368 __nft_match_eval(expr
, regs
, pkt
, priv
->info
);
371 static void nft_match_eval(const struct nft_expr
*expr
,
372 struct nft_regs
*regs
,
373 const struct nft_pktinfo
*pkt
)
375 __nft_match_eval(expr
, regs
, pkt
, nft_expr_priv(expr
));
378 static const struct nla_policy nft_match_policy
[NFTA_MATCH_MAX
+ 1] = {
379 [NFTA_MATCH_NAME
] = { .type
= NLA_NUL_STRING
},
380 [NFTA_MATCH_REV
] = { .type
= NLA_U32
},
381 [NFTA_MATCH_INFO
] = { .type
= NLA_BINARY
},
384 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
386 nft_match_set_mtchk_param(struct xt_mtchk_param
*par
, const struct nft_ctx
*ctx
,
387 struct xt_match
*match
, void *info
,
388 union nft_entry
*entry
, u16 proto
, bool inv
)
391 par
->table
= ctx
->table
->name
;
392 switch (ctx
->afi
->family
) {
394 entry
->e4
.ip
.proto
= proto
;
395 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
399 entry
->e6
.ipv6
.flags
|= IP6T_F_PROTO
;
401 entry
->e6
.ipv6
.proto
= proto
;
402 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
405 entry
->ebt
.ethproto
= (__force __be16
)proto
;
406 entry
->ebt
.invflags
= inv
? EBT_IPROTO
: 0;
411 par
->entryinfo
= entry
;
413 par
->matchinfo
= info
;
414 if (nft_is_base_chain(ctx
->chain
)) {
415 const struct nft_base_chain
*basechain
=
416 nft_base_chain(ctx
->chain
);
417 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
419 par
->hook_mask
= 1 << ops
->hooknum
;
423 par
->family
= ctx
->afi
->family
;
424 par
->nft_compat
= true;
427 static void match_compat_from_user(struct xt_match
*m
, void *in
, void *out
)
431 memcpy(out
, in
, m
->matchsize
);
432 pad
= XT_ALIGN(m
->matchsize
) - m
->matchsize
;
434 memset(out
+ m
->matchsize
, 0, pad
);
438 __nft_match_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
439 const struct nlattr
* const tb
[],
442 struct xt_match
*match
= expr
->ops
->data
;
443 struct xt_mtchk_param par
;
444 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_MATCH_INFO
]));
445 struct nft_xt
*nft_xt
;
448 union nft_entry e
= {};
451 match_compat_from_user(match
, nla_data(tb
[NFTA_MATCH_INFO
]), info
);
453 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
454 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
459 nft_match_set_mtchk_param(&par
, ctx
, match
, info
, &e
, proto
, inv
);
461 ret
= xt_check_match(&par
, size
, proto
, inv
);
465 nft_xt
= container_of(expr
->ops
, struct nft_xt
, ops
);
471 nft_match_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
472 const struct nlattr
* const tb
[])
474 return __nft_match_init(ctx
, expr
, tb
, nft_expr_priv(expr
));
478 nft_match_large_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
479 const struct nlattr
* const tb
[])
481 struct nft_xt_match_priv
*priv
= nft_expr_priv(expr
);
482 struct xt_match
*m
= expr
->ops
->data
;
485 priv
->info
= kmalloc(XT_ALIGN(m
->matchsize
), GFP_KERNEL
);
489 ret
= __nft_match_init(ctx
, expr
, tb
, priv
->info
);
496 __nft_match_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
499 struct xt_match
*match
= expr
->ops
->data
;
500 struct xt_mtdtor_param par
;
504 par
.matchinfo
= info
;
505 par
.family
= ctx
->afi
->family
;
506 if (par
.match
->destroy
!= NULL
)
507 par
.match
->destroy(&par
);
509 if (nft_xt_put(container_of(expr
->ops
, struct nft_xt
, ops
)))
510 module_put(match
->me
);
514 nft_match_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
516 __nft_match_destroy(ctx
, expr
, nft_expr_priv(expr
));
520 nft_match_large_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
522 struct nft_xt_match_priv
*priv
= nft_expr_priv(expr
);
524 __nft_match_destroy(ctx
, expr
, priv
->info
);
528 static int __nft_match_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
,
531 struct xt_match
*match
= expr
->ops
->data
;
533 if (nla_put_string(skb
, NFTA_MATCH_NAME
, match
->name
) ||
534 nla_put_be32(skb
, NFTA_MATCH_REV
, htonl(match
->revision
)) ||
535 nla_put(skb
, NFTA_MATCH_INFO
, XT_ALIGN(match
->matchsize
), info
))
536 goto nla_put_failure
;
544 static int nft_match_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
546 return __nft_match_dump(skb
, expr
, nft_expr_priv(expr
));
549 static int nft_match_large_dump(struct sk_buff
*skb
, const struct nft_expr
*e
)
551 struct nft_xt_match_priv
*priv
= nft_expr_priv(e
);
553 return __nft_match_dump(skb
, e
, priv
->info
);
556 static int nft_match_validate(const struct nft_ctx
*ctx
,
557 const struct nft_expr
*expr
,
558 const struct nft_data
**data
)
560 struct xt_match
*match
= expr
->ops
->data
;
561 unsigned int hook_mask
= 0;
564 if (nft_is_base_chain(ctx
->chain
)) {
565 const struct nft_base_chain
*basechain
=
566 nft_base_chain(ctx
->chain
);
567 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
569 hook_mask
= 1 << ops
->hooknum
;
570 if (match
->hooks
&& !(hook_mask
& match
->hooks
))
573 ret
= nft_compat_chain_validate_dependency(match
->table
,
582 nfnl_compat_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
583 int event
, u16 family
, const char *name
,
586 struct nlmsghdr
*nlh
;
587 struct nfgenmsg
*nfmsg
;
588 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
590 event
= nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT
, event
);
591 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
595 nfmsg
= nlmsg_data(nlh
);
596 nfmsg
->nfgen_family
= family
;
597 nfmsg
->version
= NFNETLINK_V0
;
600 if (nla_put_string(skb
, NFTA_COMPAT_NAME
, name
) ||
601 nla_put_be32(skb
, NFTA_COMPAT_REV
, htonl(rev
)) ||
602 nla_put_be32(skb
, NFTA_COMPAT_TYPE
, htonl(target
)))
603 goto nla_put_failure
;
610 nlmsg_cancel(skb
, nlh
);
614 static int nfnl_compat_get(struct net
*net
, struct sock
*nfnl
,
615 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
616 const struct nlattr
* const tb
[],
617 struct netlink_ext_ack
*extack
)
620 struct nfgenmsg
*nfmsg
;
624 struct sk_buff
*skb2
;
626 if (tb
[NFTA_COMPAT_NAME
] == NULL
||
627 tb
[NFTA_COMPAT_REV
] == NULL
||
628 tb
[NFTA_COMPAT_TYPE
] == NULL
)
631 name
= nla_data(tb
[NFTA_COMPAT_NAME
]);
632 rev
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_REV
]));
633 target
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_TYPE
]));
635 nfmsg
= nlmsg_data(nlh
);
637 switch(nfmsg
->nfgen_family
) {
651 pr_err("nft_compat: unsupported protocol %d\n",
652 nfmsg
->nfgen_family
);
656 try_then_request_module(xt_find_revision(nfmsg
->nfgen_family
, name
,
663 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
667 /* include the best revision for this extension in the message */
668 if (nfnl_compat_fill_info(skb2
, NETLINK_CB(skb
).portid
,
670 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
673 name
, ret
, target
) <= 0) {
678 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
683 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
686 static const struct nla_policy nfnl_compat_policy_get
[NFTA_COMPAT_MAX
+1] = {
687 [NFTA_COMPAT_NAME
] = { .type
= NLA_NUL_STRING
,
688 .len
= NFT_COMPAT_NAME_MAX
-1 },
689 [NFTA_COMPAT_REV
] = { .type
= NLA_U32
},
690 [NFTA_COMPAT_TYPE
] = { .type
= NLA_U32
},
693 static const struct nfnl_callback nfnl_nft_compat_cb
[NFNL_MSG_COMPAT_MAX
] = {
694 [NFNL_MSG_COMPAT_GET
] = { .call
= nfnl_compat_get
,
695 .attr_count
= NFTA_COMPAT_MAX
,
696 .policy
= nfnl_compat_policy_get
},
699 static const struct nfnetlink_subsystem nfnl_compat_subsys
= {
700 .name
= "nft-compat",
701 .subsys_id
= NFNL_SUBSYS_NFT_COMPAT
,
702 .cb_count
= NFNL_MSG_COMPAT_MAX
,
703 .cb
= nfnl_nft_compat_cb
,
706 static LIST_HEAD(nft_match_list
);
708 static struct nft_expr_type nft_match_type
;
710 static bool nft_match_cmp(const struct xt_match
*match
,
711 const char *name
, u32 rev
, u32 family
)
713 return strcmp(match
->name
, name
) == 0 && match
->revision
== rev
&&
714 (match
->family
== NFPROTO_UNSPEC
|| match
->family
== family
);
717 static const struct nft_expr_ops
*
718 nft_match_select_ops(const struct nft_ctx
*ctx
,
719 const struct nlattr
* const tb
[])
721 struct nft_xt
*nft_match
;
722 struct xt_match
*match
;
723 unsigned int matchsize
;
728 if (tb
[NFTA_MATCH_NAME
] == NULL
||
729 tb
[NFTA_MATCH_REV
] == NULL
||
730 tb
[NFTA_MATCH_INFO
] == NULL
)
731 return ERR_PTR(-EINVAL
);
733 mt_name
= nla_data(tb
[NFTA_MATCH_NAME
]);
734 rev
= ntohl(nla_get_be32(tb
[NFTA_MATCH_REV
]));
735 family
= ctx
->afi
->family
;
737 /* Re-use the existing match if it's already loaded. */
738 list_for_each_entry(nft_match
, &nft_match_list
, head
) {
739 struct xt_match
*match
= nft_match
->ops
.data
;
741 if (nft_match_cmp(match
, mt_name
, rev
, family
))
742 return &nft_match
->ops
;
745 match
= xt_request_find_match(family
, mt_name
, rev
);
747 return ERR_PTR(-ENOENT
);
749 if (match
->matchsize
> nla_len(tb
[NFTA_MATCH_INFO
])) {
754 /* This is the first time we use this match, allocate operations */
755 nft_match
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
756 if (nft_match
== NULL
) {
761 nft_match
->refcnt
= 0;
762 nft_match
->ops
.type
= &nft_match_type
;
763 nft_match
->ops
.eval
= nft_match_eval
;
764 nft_match
->ops
.init
= nft_match_init
;
765 nft_match
->ops
.destroy
= nft_match_destroy
;
766 nft_match
->ops
.dump
= nft_match_dump
;
767 nft_match
->ops
.validate
= nft_match_validate
;
768 nft_match
->ops
.data
= match
;
770 matchsize
= NFT_EXPR_SIZE(XT_ALIGN(match
->matchsize
));
771 if (matchsize
> NFT_MATCH_LARGE_THRESH
) {
772 matchsize
= NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv
));
774 nft_match
->ops
.eval
= nft_match_large_eval
;
775 nft_match
->ops
.init
= nft_match_large_init
;
776 nft_match
->ops
.destroy
= nft_match_large_destroy
;
777 nft_match
->ops
.dump
= nft_match_large_dump
;
780 nft_match
->ops
.size
= matchsize
;
782 list_add(&nft_match
->head
, &nft_match_list
);
784 return &nft_match
->ops
;
786 module_put(match
->me
);
790 static struct nft_expr_type nft_match_type __read_mostly
= {
792 .select_ops
= nft_match_select_ops
,
793 .policy
= nft_match_policy
,
794 .maxattr
= NFTA_MATCH_MAX
,
795 .owner
= THIS_MODULE
,
798 static LIST_HEAD(nft_target_list
);
800 static struct nft_expr_type nft_target_type
;
802 static bool nft_target_cmp(const struct xt_target
*tg
,
803 const char *name
, u32 rev
, u32 family
)
805 return strcmp(tg
->name
, name
) == 0 && tg
->revision
== rev
&&
806 (tg
->family
== NFPROTO_UNSPEC
|| tg
->family
== family
);
809 static const struct nft_expr_ops
*
810 nft_target_select_ops(const struct nft_ctx
*ctx
,
811 const struct nlattr
* const tb
[])
813 struct nft_xt
*nft_target
;
814 struct xt_target
*target
;
819 if (tb
[NFTA_TARGET_NAME
] == NULL
||
820 tb
[NFTA_TARGET_REV
] == NULL
||
821 tb
[NFTA_TARGET_INFO
] == NULL
)
822 return ERR_PTR(-EINVAL
);
824 tg_name
= nla_data(tb
[NFTA_TARGET_NAME
]);
825 rev
= ntohl(nla_get_be32(tb
[NFTA_TARGET_REV
]));
826 family
= ctx
->afi
->family
;
828 /* Re-use the existing target if it's already loaded. */
829 list_for_each_entry(nft_target
, &nft_target_list
, head
) {
830 struct xt_target
*target
= nft_target
->ops
.data
;
832 if (nft_target_cmp(target
, tg_name
, rev
, family
))
833 return &nft_target
->ops
;
836 target
= xt_request_find_target(family
, tg_name
, rev
);
838 return ERR_PTR(-ENOENT
);
840 if (target
->targetsize
> nla_len(tb
[NFTA_TARGET_INFO
])) {
845 /* This is the first time we use this target, allocate operations */
846 nft_target
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
847 if (nft_target
== NULL
) {
852 nft_target
->refcnt
= 0;
853 nft_target
->ops
.type
= &nft_target_type
;
854 nft_target
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(target
->targetsize
));
855 nft_target
->ops
.init
= nft_target_init
;
856 nft_target
->ops
.destroy
= nft_target_destroy
;
857 nft_target
->ops
.dump
= nft_target_dump
;
858 nft_target
->ops
.validate
= nft_target_validate
;
859 nft_target
->ops
.data
= target
;
861 if (family
== NFPROTO_BRIDGE
)
862 nft_target
->ops
.eval
= nft_target_eval_bridge
;
864 nft_target
->ops
.eval
= nft_target_eval_xt
;
866 list_add(&nft_target
->head
, &nft_target_list
);
868 return &nft_target
->ops
;
870 module_put(target
->me
);
874 static struct nft_expr_type nft_target_type __read_mostly
= {
876 .select_ops
= nft_target_select_ops
,
877 .policy
= nft_target_policy
,
878 .maxattr
= NFTA_TARGET_MAX
,
879 .owner
= THIS_MODULE
,
882 static int __init
nft_compat_module_init(void)
886 ret
= nft_register_expr(&nft_match_type
);
890 ret
= nft_register_expr(&nft_target_type
);
894 ret
= nfnetlink_subsys_register(&nfnl_compat_subsys
);
896 pr_err("nft_compat: cannot register with nfnetlink.\n");
900 pr_info("nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>\n");
905 nft_unregister_expr(&nft_target_type
);
907 nft_unregister_expr(&nft_match_type
);
911 static void __exit
nft_compat_module_exit(void)
913 struct nft_xt
*xt
, *next
;
915 /* list should be empty here, it can be non-empty only in case there
916 * was an error that caused nft_xt expr to not be initialized fully
917 * and noone else requested the same expression later.
919 * In this case, the lists contain 0-refcount entries that still
920 * hold module reference.
922 list_for_each_entry_safe(xt
, next
, &nft_target_list
, head
) {
923 struct xt_target
*target
= xt
->ops
.data
;
925 if (WARN_ON_ONCE(xt
->refcnt
))
927 module_put(target
->me
);
931 list_for_each_entry_safe(xt
, next
, &nft_match_list
, head
) {
932 struct xt_match
*match
= xt
->ops
.data
;
934 if (WARN_ON_ONCE(xt
->refcnt
))
936 module_put(match
->me
);
939 nfnetlink_subsys_unregister(&nfnl_compat_subsys
);
940 nft_unregister_expr(&nft_target_type
);
941 nft_unregister_expr(&nft_match_type
);
944 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT
);
946 module_init(nft_compat_module_init
);
947 module_exit(nft_compat_module_exit
);
949 MODULE_LICENSE("GPL");
950 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
951 MODULE_ALIAS_NFT_EXPR("match");
952 MODULE_ALIAS_NFT_EXPR("target");