Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc

[mirror_ubuntu-artful-kernel.git] / net / netfilter / nf_tables_api.c

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 434c739dfecaa8727dc193f8ad86e18133932660..5592250297402fe6e272f3213efa7e02ab230485 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -144,7 +144,7 @@ static int nf_tables_register_hooks(struct net *net,
                                    unsigned int hook_nops)
 {
        if (table->flags & NFT_TABLE_F_DORMANT ||
-           !(chain->flags & NFT_BASE_CHAIN))
+           !nft_is_base_chain(chain))
                return 0;
 
        return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
@@ -157,7 +157,7 @@ static void nf_tables_unregister_hooks(struct net *net,
                                       unsigned int hook_nops)
 {
        if (table->flags & NFT_TABLE_F_DORMANT ||
-           !(chain->flags & NFT_BASE_CHAIN))
+           !nft_is_base_chain(chain))
                return;
 
        nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
@@ -438,7 +438,7 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
        struct nlmsghdr *nlh;
        struct nfgenmsg *nfmsg;
 
-       event |= NFNL_SUBSYS_NFTABLES << 8;
+       event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
        if (nlh == NULL)
                goto nla_put_failure;
@@ -587,7 +587,7 @@ static void _nf_tables_table_disable(struct net *net,
        list_for_each_entry(chain, &table->chains, list) {
                if (!nft_is_active_next(net, chain))
                        continue;
-               if (!(chain->flags & NFT_BASE_CHAIN))
+               if (!nft_is_base_chain(chain))
                        continue;
 
                if (cnt && i++ == cnt)
@@ -608,7 +608,7 @@ static int nf_tables_table_enable(struct net *net,
        list_for_each_entry(chain, &table->chains, list) {
                if (!nft_is_active_next(net, chain))
                        continue;
-               if (!(chain->flags & NFT_BASE_CHAIN))
+               if (!nft_is_base_chain(chain))
                        continue;
 
                err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
@@ -989,7 +989,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
        struct nlmsghdr *nlh;
        struct nfgenmsg *nfmsg;
 
-       event |= NFNL_SUBSYS_NFTABLES << 8;
+       event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
        if (nlh == NULL)
                goto nla_put_failure;
@@ -1007,7 +1007,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
        if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
                goto nla_put_failure;
 
-       if (chain->flags & NFT_BASE_CHAIN) {
+       if (nft_is_base_chain(chain)) {
                const struct nft_base_chain *basechain = nft_base_chain(chain);
                const struct nf_hook_ops *ops = &basechain->ops[0];
                struct nlattr *nest;
@@ -1182,7 +1182,8 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
        struct nft_stats *stats;
        int err;
 
-       err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy);
+       err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
+                              NULL);
        if (err < 0)
                return ERR_PTR(err);
 
@@ -1226,7 +1227,7 @@ static void nf_tables_chain_destroy(struct nft_chain *chain)
 {
        BUG_ON(chain->use > 0);
 
-       if (chain->flags & NFT_BASE_CHAIN) {
+       if (nft_is_base_chain(chain)) {
                struct nft_base_chain *basechain = nft_base_chain(chain);
 
                module_put(basechain->type->owner);
@@ -1257,7 +1258,7 @@ static int nft_chain_parse_hook(struct net *net,
        int err;
 
        err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
-                              nft_hook_policy);
+                              nft_hook_policy, NULL);
        if (err < 0)
                return err;
 
@@ -1364,8 +1365,8 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
        }
 
        if (nla[NFTA_CHAIN_POLICY]) {
-               if ((chain != NULL &&
-                   !(chain->flags & NFT_BASE_CHAIN)))
+               if (chain != NULL &&
+                   !nft_is_base_chain(chain))
                        return -EOPNOTSUPP;
 
                if (chain == NULL &&
@@ -1396,7 +1397,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
                        struct nft_chain_hook hook;
                        struct nf_hook_ops *ops;
 
-                       if (!(chain->flags & NFT_BASE_CHAIN))
+                       if (!nft_is_base_chain(chain))
                                return -EBUSY;
 
                        err = nft_chain_parse_hook(net, nla, afi, &hook,
@@ -1433,7 +1434,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
                }
 
                if (nla[NFTA_CHAIN_COUNTERS]) {
-                       if (!(chain->flags & NFT_BASE_CHAIN))
+                       if (!nft_is_base_chain(chain))
                                return -EOPNOTSUPP;
 
                        stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
@@ -1724,7 +1725,7 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx,
        struct nlattr *tb[NFTA_EXPR_MAX + 1];
        int err;
 
-       err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy);
+       err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
        if (err < 0)
                return err;
 
@@ -1734,7 +1735,7 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx,
 
        if (tb[NFTA_EXPR_DATA]) {
                err = nla_parse_nested(info->tb, type->maxattr,
-                                      tb[NFTA_EXPR_DATA], type->policy);
+                                      tb[NFTA_EXPR_DATA], type->policy, NULL);
                if (err < 0)
                        goto err1;
        } else
@@ -1772,8 +1773,19 @@ static int nf_tables_newexpr(const struct nft_ctx *ctx,
                        goto err1;
        }
 
+       if (ops->validate) {
+               const struct nft_data *data = NULL;
+
+               err = ops->validate(ctx, expr, &data);
+               if (err < 0)
+                       goto err2;
+       }
+
        return 0;
 
+err2:
+       if (ops->destroy)
+               ops->destroy(ctx, expr);
 err1:
        expr->ops = NULL;
        return err;
@@ -1874,10 +1886,9 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
        const struct nft_expr *expr, *next;
        struct nlattr *list;
        const struct nft_rule *prule;
-       int type = event | NFNL_SUBSYS_NFTABLES << 8;
+       u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
 
-       nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg),
-                       flags);
+       nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
        if (nlh == NULL)
                goto nla_put_failure;
 
@@ -1895,7 +1906,7 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
                goto nla_put_failure;
 
        if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
-               prule = list_entry(rule->list.prev, struct nft_rule, list);
+               prule = list_prev_entry(rule, list);
                if (nla_put_be64(skb, NFTA_RULE_POSITION,
                                 cpu_to_be64(prule->handle),
                                 NFTA_RULE_PAD))
@@ -2523,8 +2534,8 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
        return 0;
 }
 
-struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
-                                    const struct nlattr *nla, u8 genmask)
+static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
+                                           const struct nlattr *nla, u8 genmask)
 {
        struct nft_set *set;
 
@@ -2538,11 +2549,10 @@ struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
        }
        return ERR_PTR(-ENOENT);
 }
-EXPORT_SYMBOL_GPL(nf_tables_set_lookup);
 
-struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
-                                         const struct nlattr *nla,
-                                         u8 genmask)
+static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
+                                                const struct nlattr *nla,
+                                                u8 genmask)
 {
        struct nft_trans *trans;
        u32 id = ntohl(nla_get_be32(nla));
@@ -2557,7 +2567,25 @@ struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
        }
        return ERR_PTR(-ENOENT);
 }
-EXPORT_SYMBOL_GPL(nf_tables_set_lookup_byid);
+
+struct nft_set *nft_set_lookup(const struct net *net,
+                              const struct nft_table *table,
+                              const struct nlattr *nla_set_name,
+                              const struct nlattr *nla_set_id,
+                              u8 genmask)
+{
+       struct nft_set *set;
+
+       set = nf_tables_set_lookup(table, nla_set_name, genmask);
+       if (IS_ERR(set)) {
+               if (!nla_set_id)
+                       return set;
+
+               set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
+       }
+       return set;
+}
+EXPORT_SYMBOL_GPL(nft_set_lookup);
 
 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
                                    const char *name)
@@ -2617,7 +2645,7 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
        u32 portid = ctx->portid;
        u32 seq = ctx->seq;
 
-       event |= NFNL_SUBSYS_NFTABLES << 8;
+       event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
                        flags);
        if (nlh == NULL)
@@ -2851,7 +2879,8 @@ static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
        struct nlattr *da[NFTA_SET_DESC_MAX + 1];
        int err;
 
-       err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla, nft_set_desc_policy);
+       err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
+                              nft_set_desc_policy, NULL);
        if (err < 0)
                return err;
 
@@ -3353,7 +3382,8 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
        int event, err;
 
        err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
-                         NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy);
+                         NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy,
+                         NULL);
        if (err < 0)
                return err;
 
@@ -3367,8 +3397,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
        if (IS_ERR(set))
                return PTR_ERR(set);
 
-       event  = NFT_MSG_NEWSETELEM;
-       event |= NFNL_SUBSYS_NFTABLES << 8;
+       event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
        portid = NETLINK_CB(cb->skb).portid;
        seq    = cb->nlh->nlmsg_seq;
 
@@ -3453,7 +3482,7 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb,
        struct nlattr *nest;
        int err;
 
-       event |= NFNL_SUBSYS_NFTABLES << 8;
+       event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
                        flags);
        if (nlh == NULL)
@@ -3612,7 +3641,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
        int err;
 
        err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
-                              nft_set_elem_policy);
+                              nft_set_elem_policy, NULL);
        if (err < 0)
                return err;
 
@@ -3749,6 +3778,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
        err = set->ops->insert(ctx->net, set, &elem, &ext2);
        if (err) {
                if (err == -EEXIST) {
+                       if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
+                           nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
+                           nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
+                           nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
+                               return -EBUSY;
                        if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
                             nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
                             memcmp(nft_set_ext_data(ext),
@@ -3842,7 +3876,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
        int err;
 
        err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
-                              nft_set_elem_policy);
+                              nft_set_elem_policy, NULL);
        if (err < 0)
                goto err1;
 
@@ -4064,7 +4098,8 @@ static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
        [NFTA_OBJ_DATA]         = { .type = NLA_NESTED },
 };
 
-static struct nft_object *nft_obj_init(const struct nft_object_type *type,
+static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
+                                      const struct nft_object_type *type,
                                       const struct nlattr *attr)
 {
        struct nlattr *tb[type->maxattr + 1];
@@ -4072,7 +4107,8 @@ static struct nft_object *nft_obj_init(const struct nft_object_type *type,
        int err;
 
        if (attr) {
-               err = nla_parse_nested(tb, type->maxattr, attr, type->policy);
+               err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
+                                      NULL);
                if (err < 0)
                        goto err1;
        } else {
@@ -4084,7 +4120,7 @@ static struct nft_object *nft_obj_init(const struct nft_object_type *type,
        if (obj == NULL)
                goto err1;
 
-       err = type->init((const struct nlattr * const *)tb, obj);
+       err = type->init(ctx, (const struct nlattr * const *)tb, obj);
        if (err < 0)
                goto err2;
 
@@ -4192,7 +4228,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
        if (IS_ERR(type))
                return PTR_ERR(type);
 
-       obj = nft_obj_init(type, nla[NFTA_OBJ_DATA]);
+       obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
        if (IS_ERR(obj)) {
                err = PTR_ERR(obj);
                goto err1;
@@ -4224,7 +4260,7 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
        struct nfgenmsg *nfmsg;
        struct nlmsghdr *nlh;
 
-       event |= NFNL_SUBSYS_NFTABLES << 8;
+       event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
        if (nlh == NULL)
                goto nla_put_failure;
@@ -4406,8 +4442,6 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
 err:
        kfree_skb(skb2);
        return err;
-
-       return 0;
 }
 
 static void nft_obj_destroy(struct nft_object *obj)
@@ -4497,7 +4531,7 @@ static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
 {
        struct nlmsghdr *nlh;
        struct nfgenmsg *nfmsg;
-       int event = (NFNL_SUBSYS_NFTABLES << 8) | NFT_MSG_NEWGEN;
+       int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
 
        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
        if (nlh == NULL)
@@ -4679,7 +4713,7 @@ static void nft_chain_commit_update(struct nft_trans *trans)
        if (nft_trans_chain_name(trans)[0])
                strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
 
-       if (!(trans->ctx.chain->flags & NFT_BASE_CHAIN))
+       if (!nft_is_base_chain(trans->ctx.chain))
                return;
 
        basechain = nft_base_chain(trans->ctx.chain);
@@ -4993,7 +5027,7 @@ int nft_chain_validate_dependency(const struct nft_chain *chain,
 {
        const struct nft_base_chain *basechain;
 
-       if (chain->flags & NFT_BASE_CHAIN) {
+       if (nft_is_base_chain(chain)) {
                basechain = nft_base_chain(chain);
                if (basechain->type->type != type)
                        return -EOPNOTSUPP;
@@ -5007,7 +5041,7 @@ int nft_chain_validate_hooks(const struct nft_chain *chain,
 {
        struct nft_base_chain *basechain;
 
-       if (chain->flags & NFT_BASE_CHAIN) {
+       if (nft_is_base_chain(chain)) {
                basechain = nft_base_chain(chain);
 
                if ((1 << basechain->ops[0].hooknum) & hook_flags)
@@ -5285,7 +5319,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
        struct nft_chain *chain;
        int err;
 
-       err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy);
+       err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
+                              NULL);
        if (err < 0)
                return err;
 
@@ -5316,7 +5351,7 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
                                               tb[NFTA_VERDICT_CHAIN], genmask);
                if (IS_ERR(chain))
                        return PTR_ERR(chain);
-               if (chain->flags & NFT_BASE_CHAIN)
+               if (nft_is_base_chain(chain))
                        return -EOPNOTSUPP;
 
                chain->use++;
@@ -5415,7 +5450,7 @@ int nft_data_init(const struct nft_ctx *ctx,
        struct nlattr *tb[NFTA_DATA_MAX + 1];
        int err;
 
-       err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy);
+       err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
        if (err < 0)
                return err;
 
@@ -5489,7 +5524,7 @@ int __nft_release_basechain(struct nft_ctx *ctx)
 {
        struct nft_rule *rule, *nr;
 
-       BUG_ON(!(ctx->chain->flags & NFT_BASE_CHAIN));
+       BUG_ON(!nft_is_base_chain(ctx->chain));
 
        nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
                                   ctx->afi->nops);