projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge tag 'modules-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu...
[linux-block.git] / net / netfilter / nf_tables_api.c
CommitLineData
d2912cb1 1// SPDX-License-Identifier: GPL-2.0-only
96518518 2/*
20a69341 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518 4 *
96518518
PM		 5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8#include <linux/module.h>
9#include <linux/init.h>
10#include <linux/list.h>
11#include <linux/skbuff.h>
12#include <linux/netlink.h>
1ff75a3e 13#include <linux/vmalloc.h>
0eb71a9d 14#include <linux/rhashtable.h>
96518518
PM		 15#include <linux/netfilter.h>
16#include <linux/netfilter/nfnetlink.h>
17#include <linux/netfilter/nf_tables.h>
3b49e2e9 18#include <net/netfilter/nf_flow_table.h>
96518518
PM		 19#include <net/netfilter/nf_tables_core.h>
20#include <net/netfilter/nf_tables.h>
c9626a2c 21#include <net/netfilter/nf_tables_offload.h>
99633ab2 22#include <net/net_namespace.h>
96518518
PM		 23#include <net/sock.h>
24
96518518 25static LIST_HEAD(nf_tables_expressions);
e5009240 26static LIST_HEAD(nf_tables_objects);
3b49e2e9 27static LIST_HEAD(nf_tables_flowtables);
0935d558
FW		 28static LIST_HEAD(nf_tables_destroy_list);
29static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
3ecbfd65 30static u64 table_handle;
96518518 31
a654de8f
PNA		 32enum {
33 NFT_VALIDATE_SKIP = 0,
34 NFT_VALIDATE_NEED,
35 NFT_VALIDATE_DO,
36};
37
4d44175a
FW		 38static struct rhltable nft_objname_ht;
39
1b2470e5
FW		 40static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
41static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
42static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
43
4d44175a
FW		 44static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
45static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
46static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
47
1b2470e5
FW		 48static const struct rhashtable_params nft_chain_ht_params = {
49 .head_offset = offsetof(struct nft_chain, rhlhead),
50 .key_offset = offsetof(struct nft_chain, name),
51 .hashfn = nft_chain_hash,
52 .obj_hashfn = nft_chain_hash_obj,
53 .obj_cmpfn = nft_chain_hash_cmp,
1b2470e5
FW		 54 .automatic_shrinking = true,
55};
56
4d44175a
FW		 57static const struct rhashtable_params nft_objname_ht_params = {
58 .head_offset = offsetof(struct nft_object, rhlhead),
59 .key_offset = offsetof(struct nft_object, key),
60 .hashfn = nft_objname_hash,
61 .obj_hashfn = nft_objname_hash_obj,
62 .obj_cmpfn = nft_objname_hash_cmp,
63 .automatic_shrinking = true,
64};
65
a654de8f
PNA		 66static void nft_validate_state_update(struct net *net, u8 new_validate_state)
67{
68 switch (net->nft.validate_state) {
69 case NFT_VALIDATE_SKIP:
70 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
71 break;
72 case NFT_VALIDATE_NEED:
73 break;
74 case NFT_VALIDATE_DO:
75 if (new_validate_state == NFT_VALIDATE_NEED)
76 return;
77 }
78
79 net->nft.validate_state = new_validate_state;
80}
0935d558
FW		 81static void nf_tables_trans_destroy_work(struct work_struct *w);
82static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
a654de8f 83
7c95f6d8 84static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 85 struct net *net,
7c95f6d8
PNA		 86 const struct sk_buff *skb,
87 const struct nlmsghdr *nlh,
36596dad 88 u8 family,
7c95f6d8
PNA		 89 struct nft_table *table,
90 struct nft_chain *chain,
91 const struct nlattr * const *nla)
92{
633c9a84 93 ctx->net = net;
36596dad 94 ctx->family = family;
26b2f552 95 ctx->level = 0;
128ad332
PNA		 96 ctx->table = table;
97 ctx->chain = chain;
98 ctx->nla = nla;
99 ctx->portid = NETLINK_CB(skb).portid;
100 ctx->report = nlmsg_report(nlh);
c9626a2c 101 ctx->flags = nlh->nlmsg_flags;
128ad332 102 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 103}
104
8411b644
PNA		 105static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
106 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 107{
108 struct nft_trans *trans;
109
8411b644 110 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 111 if (trans == NULL)
112 return NULL;
113
b380e5c7 114 trans->msg_type = msg_type;
1081d11b
PNA		 115 trans->ctx = *ctx;
116
117 return trans;
118}
119
8411b644
PNA		 120static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
121 int msg_type, u32 size)
122{
123 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
124}
125
1081d11b
PNA		 126static void nft_trans_destroy(struct nft_trans *trans)
127{
128 list_del(&trans->list);
129 kfree(trans);
130}
131
f6ac8585
PNA		 132static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
133{
134 struct net *net = ctx->net;
135 struct nft_trans *trans;
136
137 if (!nft_set_is_anonymous(set))
138 return;
139
140 list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
6a0a8d10
PNA		 141 switch (trans->msg_type) {
142 case NFT_MSG_NEWSET:
143 if (nft_trans_set(trans) == set)
144 nft_trans_set_bound(trans) = true;
145 break;
146 case NFT_MSG_NEWSETELEM:
147 if (nft_trans_elem_set(trans) == set)
148 nft_trans_elem_set_bound(trans) = true;
f6ac8585
PNA		 149 break;
150 }
151 }
152}
153
d54725cd
PNA		 154static int nft_netdev_register_hooks(struct net *net,
155 struct list_head *hook_list)
156{
157 struct nft_hook *hook;
158 int err, j;
159
160 j = 0;
161 list_for_each_entry(hook, hook_list, list) {
162 err = nf_register_net_hook(net, &hook->ops);
163 if (err < 0)
164 goto err_register;
165
166 j++;
167 }
168 return 0;
169
170err_register:
171 list_for_each_entry(hook, hook_list, list) {
172 if (j-- <= 0)
173 break;
174
175 nf_unregister_net_hook(net, &hook->ops);
176 }
177 return err;
178}
179
180static void nft_netdev_unregister_hooks(struct net *net,
181 struct list_head *hook_list)
182{
183 struct nft_hook *hook;
184
185 list_for_each_entry(hook, hook_list, list)
186 nf_unregister_net_hook(net, &hook->ops);
187}
188
189static int nft_register_basechain_hooks(struct net *net, int family,
190 struct nft_base_chain *basechain)
191{
192 if (family == NFPROTO_NETDEV)
193 return nft_netdev_register_hooks(net, &basechain->hook_list);
194
195 return nf_register_net_hook(net, &basechain->ops);
196}
197
198static void nft_unregister_basechain_hooks(struct net *net, int family,
199 struct nft_base_chain *basechain)
200{
201 if (family == NFPROTO_NETDEV)
202 nft_netdev_unregister_hooks(net, &basechain->hook_list);
203 else
204 nf_unregister_net_hook(net, &basechain->ops);
205}
206
c974a3a3
PNA		 207static int nf_tables_register_hook(struct net *net,
208 const struct nft_table *table,
209 struct nft_chain *chain)
d8ee8f7c 210{
d54725cd 211 struct nft_base_chain *basechain;
a37061a6 212 const struct nf_hook_ops *ops;
ae6153b5 213
d8ee8f7c 214 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 215 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 216 return 0;
217
4e25ceb8
FW		 218 basechain = nft_base_chain(chain);
219 ops = &basechain->ops;
ae6153b5 220
4e25ceb8
FW		 221 if (basechain->type->ops_register)
222 return basechain->type->ops_register(net, ops);
223
d54725cd 224 return nft_register_basechain_hooks(net, table->family, basechain);
d8ee8f7c
PNA		 225}
226
c974a3a3
PNA		 227static void nf_tables_unregister_hook(struct net *net,
228 const struct nft_table *table,
229 struct nft_chain *chain)
c5598794 230{
d54725cd 231 struct nft_base_chain *basechain;
4e25ceb8
FW		 232 const struct nf_hook_ops *ops;
233
d8ee8f7c 234 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 235 !nft_is_base_chain(chain))
d8ee8f7c 236 return;
4e25ceb8
FW		 237 basechain = nft_base_chain(chain);
238 ops = &basechain->ops;
d8ee8f7c 239
4e25ceb8
FW		 240 if (basechain->type->ops_unregister)
241 return basechain->type->ops_unregister(net, ops);
242
d54725cd 243 nft_unregister_basechain_hooks(net, table->family, basechain);
c5598794
AB		 244}
245
ee01d542
AB		 246static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
247{
248 struct nft_trans *trans;
249
250 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
251 if (trans == NULL)
252 return -ENOMEM;
253
254 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 255 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 256
257 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
258 return 0;
259}
260
261static int nft_deltable(struct nft_ctx *ctx)
262{
263 int err;
264
265 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
266 if (err < 0)
267 return err;
268
f2a6d766 269 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 270 return err;
271}
272
66293c46 273static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
ee01d542
AB		 274{
275 struct nft_trans *trans;
276
277 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
278 if (trans == NULL)
66293c46 279 return ERR_PTR(-ENOMEM);
ee01d542
AB		 280
281 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 282 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 283
284 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
66293c46 285 return trans;
ee01d542
AB		 286}
287
288static int nft_delchain(struct nft_ctx *ctx)
289{
66293c46 290 struct nft_trans *trans;
ee01d542 291
66293c46
FW		 292 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
293 if (IS_ERR(trans))
294 return PTR_ERR(trans);
ee01d542
AB		 295
296 ctx->table->use--;
664b0f8c 297 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542 298
66293c46 299 return 0;
ee01d542
AB		 300}
301
bb7b40ae
PNA		 302static void nft_rule_expr_activate(const struct nft_ctx *ctx,
303 struct nft_rule *rule)
304{
305 struct nft_expr *expr;
306
307 expr = nft_expr_first(rule);
308 while (expr != nft_expr_last(rule) && expr->ops) {
309 if (expr->ops->activate)
310 expr->ops->activate(ctx, expr);
311
312 expr = nft_expr_next(expr);
313 }
314}
315
316static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
f6ac8585
PNA		 317 struct nft_rule *rule,
318 enum nft_trans_phase phase)
bb7b40ae
PNA		 319{
320 struct nft_expr *expr;
321
322 expr = nft_expr_first(rule);
323 while (expr != nft_expr_last(rule) && expr->ops) {
324 if (expr->ops->deactivate)
f6ac8585 325 expr->ops->deactivate(ctx, expr, phase);
bb7b40ae
PNA		 326
327 expr = nft_expr_next(expr);
328 }
329}
330
ee01d542
AB		 331static int
332nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
333{
334 /* You cannot delete the same rule twice */
889f7ee7
PNA		 335 if (nft_is_active_next(ctx->net, rule)) {
336 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 337 ctx->chain->use--;
338 return 0;
339 }
340 return -ENOENT;
341}
342
343static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
344 struct nft_rule *rule)
345{
346 struct nft_trans *trans;
347
348 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
349 if (trans == NULL)
350 return NULL;
351
1a94e38d
PNA		 352 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
353 nft_trans_rule_id(trans) =
354 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
355 }
ee01d542
AB		 356 nft_trans_rule(trans) = rule;
357 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
358
359 return trans;
360}
361
362static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
363{
63b48c73 364 struct nft_flow_rule *flow;
ee01d542
AB		 365 struct nft_trans *trans;
366 int err;
367
368 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
369 if (trans == NULL)
370 return -ENOMEM;
371
63b48c73
PNA		 372 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
373 flow = nft_flow_rule_create(ctx->net, rule);
374 if (IS_ERR(flow)) {
375 nft_trans_destroy(trans);
376 return PTR_ERR(flow);
377 }
378
379 nft_trans_flow_rule(trans) = flow;
380 }
381
ee01d542
AB		 382 err = nf_tables_delrule_deactivate(ctx, rule);
383 if (err < 0) {
384 nft_trans_destroy(trans);
385 return err;
386 }
f6ac8585 387 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
ee01d542
AB		 388
389 return 0;
390}
391
392static int nft_delrule_by_chain(struct nft_ctx *ctx)
393{
394 struct nft_rule *rule;
395 int err;
396
397 list_for_each_entry(rule, &ctx->chain->rules, list) {
23b7ca4f
PNA		 398 if (!nft_is_active_next(ctx->net, rule))
399 continue;
400
ee01d542
AB		 401 err = nft_delrule(ctx, rule);
402 if (err < 0)
403 return err;
404 }
405 return 0;
406}
407
cd5125d8 408static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
ee01d542
AB		 409 struct nft_set *set)
410{
411 struct nft_trans *trans;
412
413 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
414 if (trans == NULL)
415 return -ENOMEM;
416
417 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
418 nft_trans_set_id(trans) =
419 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 420 nft_activate_next(ctx->net, set);
ee01d542
AB		 421 }
422 nft_trans_set(trans) = set;
423 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
424
425 return 0;
426}
427
cd5125d8 428static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
ee01d542
AB		 429{
430 int err;
431
432 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
433 if (err < 0)
434 return err;
435
37a9cc52 436 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 437 ctx->table->use--;
438
439 return err;
440}
441
e5009240
PNA		 442static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
443 struct nft_object *obj)
444{
445 struct nft_trans *trans;
446
447 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
448 if (trans == NULL)
449 return -ENOMEM;
450
451 if (msg_type == NFT_MSG_NEWOBJ)
452 nft_activate_next(ctx->net, obj);
453
454 nft_trans_obj(trans) = obj;
455 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
456
457 return 0;
458}
459
460static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
461{
462 int err;
463
464 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
465 if (err < 0)
466 return err;
467
468 nft_deactivate_next(ctx->net, obj);
469 ctx->table->use--;
470
471 return err;
472}
473
3b49e2e9
PNA		 474static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
475 struct nft_flowtable *flowtable)
476{
477 struct nft_trans *trans;
478
479 trans = nft_trans_alloc(ctx, msg_type,
480 sizeof(struct nft_trans_flowtable));
481 if (trans == NULL)
482 return -ENOMEM;
483
484 if (msg_type == NFT_MSG_NEWFLOWTABLE)
485 nft_activate_next(ctx->net, flowtable);
486
487 nft_trans_flowtable(trans) = flowtable;
488 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
489
490 return 0;
491}
492
493static int nft_delflowtable(struct nft_ctx *ctx,
494 struct nft_flowtable *flowtable)
495{
496 int err;
497
498 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
499 if (err < 0)
500 return err;
501
502 nft_deactivate_next(ctx->net, flowtable);
503 ctx->table->use--;
504
505 return err;
506}
507
96518518
PM		 508/*
509 * Tables
510 */
511
36596dad 512static struct nft_table *nft_table_lookup(const struct net *net,
f2a6d766 513 const struct nlattr *nla,
36596dad 514 u8 family, u8 genmask)
96518518
PM		 515{
516 struct nft_table *table;
517
cac20fcd
PNA		 518 if (nla == NULL)
519 return ERR_PTR(-EINVAL);
520
d9adf22a 521 list_for_each_entry_rcu(table, &net->nft.tables, list) {
f2a6d766 522 if (!nla_strcmp(nla, table->name) &&
98319cb9 523 table->family == family &&
f2a6d766 524 nft_active_genmask(table, genmask))
96518518
PM		 525 return table;
526 }
cac20fcd
PNA		 527
528 return ERR_PTR(-ENOENT);
96518518
PM		 529}
530
3ecbfd65
HS		 531static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
532 const struct nlattr *nla,
533 u8 genmask)
534{
535 struct nft_table *table;
536
537 list_for_each_entry(table, &net->nft.tables, list) {
538 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
539 nft_active_genmask(table, genmask))
540 return table;
541 }
3ecbfd65
HS		 542
543 return ERR_PTR(-ENOENT);
544}
545
96518518
PM		 546static inline u64 nf_tables_alloc_handle(struct nft_table *table)
547{
548 return ++table->hgenerator;
549}
550
32537e91 551static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 552
32537e91 553static const struct nft_chain_type *
1ea26cca 554__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
9370761c
PNA		 555{
556 int i;
557
baae3e62 558 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 559 if (chain_type[family][i] != NULL &&
560 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 561 return chain_type[family][i];
9370761c 562 }
baae3e62 563 return NULL;
9370761c
PNA		 564}
565
452238e8
FW		 566/*
567 * Loading a module requires dropping mutex that guards the
568 * transaction.
569 * We first need to abort any pending transactions as once
570 * mutex is unlocked a different client could start a new
571 * transaction. It must not see any 'future generation'
572 * changes * as these changes will never happen.
573 */
574#ifdef CONFIG_MODULES
575static int __nf_tables_abort(struct net *net);
576
577static void nft_request_module(struct net *net, const char *fmt, ...)
578{
579 char module_name[MODULE_NAME_LEN];
580 va_list args;
581 int ret;
582
583 __nf_tables_abort(net);
584
585 va_start(args, fmt);
586 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
587 va_end(args);
588 if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
589 return;
590
f102d66b 591 mutex_unlock(&net->nft.commit_mutex);
452238e8 592 request_module("%s", module_name);
f102d66b 593 mutex_lock(&net->nft.commit_mutex);
452238e8
FW		 594}
595#endif
596
f102d66b
FW		 597static void lockdep_nfnl_nft_mutex_not_held(void)
598{
599#ifdef CONFIG_PROVE_LOCKING
600 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
601#endif
602}
603
32537e91 604static const struct nft_chain_type *
452238e8
FW		 605nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
606 u8 family, bool autoload)
9370761c 607{
32537e91 608 const struct nft_chain_type *type;
9370761c 609
1ea26cca 610 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 611 if (type != NULL)
612 return type;
f102d66b
FW		 613
614 lockdep_nfnl_nft_mutex_not_held();
9370761c 615#ifdef CONFIG_MODULES
93b0806f 616 if (autoload) {
452238e8
FW		 617 nft_request_module(net, "nft-chain-%u-%.*s", family,
618 nla_len(nla), (const char *)nla_data(nla));
1ea26cca 619 type = __nf_tables_chain_type_lookup(nla, family);
93b0806f
PM		 620 if (type != NULL)
621 return ERR_PTR(-EAGAIN);
9370761c
PNA		 622 }
623#endif
93b0806f 624 return ERR_PTR(-ENOENT);
9370761c
PNA		 625}
626
96518518 627static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 628 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
629 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 630 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
3ecbfd65 631 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
96518518
PM		 632};
633
84d7fce6
PNA		 634static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
635 u32 portid, u32 seq, int event, u32 flags,
636 int family, const struct nft_table *table)
96518518
PM		 637{
638 struct nlmsghdr *nlh;
639 struct nfgenmsg *nfmsg;
640
dedb67c4 641 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 642 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
643 if (nlh == NULL)
644 goto nla_put_failure;
645
646 nfmsg = nlmsg_data(nlh);
647 nfmsg->nfgen_family = family;
648 nfmsg->version = NFNETLINK_V0;
84d7fce6 649 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 650
9ddf6323 651 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768 652 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
3ecbfd65
HS		 653 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
654 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
655 NFTA_TABLE_PAD))
96518518
PM		 656 goto nla_put_failure;
657
053c095a
JB		 658 nlmsg_end(skb, nlh);
659 return 0;
96518518
PM		 660
661nla_put_failure:
662 nlmsg_trim(skb, nlh);
663 return -1;
664}
665
25e94a99 666static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 667{
668 struct sk_buff *skb;
96518518
PM		 669 int err;
670
128ad332
PNA		 671 if (!ctx->report &&
672 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 673 return;
96518518 674
96518518
PM		 675 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
676 if (skb == NULL)
677 goto err;
678
84d7fce6 679 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 680 event, 0, ctx->family, ctx->table);
96518518
PM		 681 if (err < 0) {
682 kfree_skb(skb);
683 goto err;
684 }
685
25e94a99
PNA		 686 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
687 ctx->report, GFP_KERNEL);
688 return;
96518518 689err:
25e94a99 690 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 691}
692
693static int nf_tables_dump_tables(struct sk_buff *skb,
694 struct netlink_callback *cb)
695{
696 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 697 const struct nft_table *table;
698 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 699 struct net *net = sock_net(skb->sk);
96518518
PM		 700 int family = nfmsg->nfgen_family;
701
e688a7f8 702 rcu_read_lock();
38e029f1
PNA		 703 cb->seq = net->nft.base_seq;
704
36596dad 705 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 706 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 707 continue;
708
36596dad
PNA		 709 if (idx < s_idx)
710 goto cont;
711 if (idx > s_idx)
712 memset(&cb->args[1], 0,
713 sizeof(cb->args) - sizeof(cb->args[0]));
714 if (!nft_is_active(net, table))
715 continue;
716 if (nf_tables_fill_table_info(skb, net,
717 NETLINK_CB(cb->skb).portid,
718 cb->nlh->nlmsg_seq,
719 NFT_MSG_NEWTABLE, NLM_F_MULTI,
98319cb9 720 table->family, table) < 0)
36596dad
PNA		 721 goto done;
722
723 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 724cont:
36596dad 725 idx++;
96518518
PM		 726 }
727done:
e688a7f8 728 rcu_read_unlock();
96518518
PM		 729 cb->args[0] = idx;
730 return skb->len;
731}
732
d9adf22a
FW		 733static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
734 const struct nlmsghdr *nlh,
735 struct netlink_dump_control *c)
736{
737 int err;
738
739 if (!try_module_get(THIS_MODULE))
740 return -EINVAL;
741
742 rcu_read_unlock();
743 err = netlink_dump_start(nlsk, skb, nlh, c);
744 rcu_read_lock();
745 module_put(THIS_MODULE);
746
747 return err;
748}
749
750/* called with rcu_read_lock held */
7b8002a1
PNA		 751static int nf_tables_gettable(struct net *net, struct sock *nlsk,
752 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 753 const struct nlattr * const nla[],
754 struct netlink_ext_ack *extack)
96518518
PM		 755{
756 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 757 u8 genmask = nft_genmask_cur(net);
96518518
PM		 758 const struct nft_table *table;
759 struct sk_buff *skb2;
760 int family = nfmsg->nfgen_family;
761 int err;
762
763 if (nlh->nlmsg_flags & NLM_F_DUMP) {
764 struct netlink_dump_control c = {
765 .dump = nf_tables_dump_tables,
d9adf22a 766 .module = THIS_MODULE,
96518518 767 };
d9adf22a
FW		 768
769 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 770 }
771
cac20fcd 772 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
36dd1bcc
PNA		 773 if (IS_ERR(table)) {
774 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
96518518 775 return PTR_ERR(table);
36dd1bcc 776 }
96518518 777
d9adf22a 778 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 779 if (!skb2)
780 return -ENOMEM;
781
84d7fce6 782 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 783 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
784 family, table);
785 if (err < 0)
786 goto err;
787
788 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
789
790err:
791 kfree_skb(skb2);
792 return err;
793}
794
c9c17211 795static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
10435c11
F		 796{
797 struct nft_chain *chain;
798 u32 i = 0;
799
800 list_for_each_entry(chain, &table->chains, list) {
801 if (!nft_is_active_next(net, chain))
802 continue;
f323d954 803 if (!nft_is_base_chain(chain))
10435c11
F		 804 continue;
805
806 if (cnt && i++ == cnt)
807 break;
808
d54725cd
PNA		 809 nft_unregister_basechain_hooks(net, table->family,
810 nft_base_chain(chain));
10435c11
F		 811 }
812}
813
c9c17211 814static int nf_tables_table_enable(struct net *net, struct nft_table *table)
9ddf6323
PNA		 815{
816 struct nft_chain *chain;
817 int err, i = 0;
818
819 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 820 if (!nft_is_active_next(net, chain))
821 continue;
f323d954 822 if (!nft_is_base_chain(chain))
d2012975
PNA		 823 continue;
824
d54725cd
PNA		 825 err = nft_register_basechain_hooks(net, table->family,
826 nft_base_chain(chain));
9ddf6323 827 if (err < 0)
d54725cd 828 goto err_register_hooks;
9ddf6323
PNA		 829
830 i++;
831 }
832 return 0;
d54725cd
PNA		 833
834err_register_hooks:
10435c11 835 if (i)
c9c17211 836 nft_table_disable(net, table, i);
9ddf6323
PNA		 837 return err;
838}
839
c9c17211 840static void nf_tables_table_disable(struct net *net, struct nft_table *table)
9ddf6323 841{
c9c17211 842 nft_table_disable(net, table, 0);
9ddf6323
PNA		 843}
844
e1aaca93 845static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 846{
55dd6f93 847 struct nft_trans *trans;
e1aaca93 848 u32 flags;
55dd6f93 849 int ret = 0;
9ddf6323 850
e1aaca93
PNA		 851 if (!ctx->nla[NFTA_TABLE_FLAGS])
852 return 0;
9ddf6323 853
e1aaca93
PNA		 854 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
855 if (flags & ~NFT_TABLE_F_DORMANT)
856 return -EINVAL;
857
63283dd2
PNA		 858 if (flags == ctx->table->flags)
859 return 0;
860
55dd6f93
PNA		 861 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
862 sizeof(struct nft_trans_table));
863 if (trans == NULL)
864 return -ENOMEM;
9ddf6323 865
e1aaca93
PNA		 866 if ((flags & NFT_TABLE_F_DORMANT) &&
867 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 868 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 869 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
870 ctx->table->flags & NFT_TABLE_F_DORMANT) {
c9c17211 871 ret = nf_tables_table_enable(ctx->net, ctx->table);
55dd6f93 872 if (ret >= 0) {
e1aaca93 873 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 874 nft_trans_table_enable(trans) = true;
9ddf6323 875 }
9ddf6323 876 }
e1aaca93
PNA		 877 if (ret < 0)
878 goto err;
9ddf6323 879
55dd6f93
PNA		 880 nft_trans_table_update(trans) = true;
881 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
882 return 0;
9ddf6323 883err:
55dd6f93 884 nft_trans_destroy(trans);
9ddf6323
PNA		 885 return ret;
886}
887
1b2470e5
FW		 888static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
889{
890 const char *name = data;
891
892 return jhash(name, strlen(name), seed);
893}
894
895static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
896{
897 const struct nft_chain *chain = data;
898
899 return nft_chain_hash(chain->name, 0, seed);
900}
901
902static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
903 const void *ptr)
904{
905 const struct nft_chain *chain = ptr;
906 const char *name = arg->key;
907
908 return strcmp(chain->name, name);
909}
910
4d44175a
FW		 911static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
912{
913 const struct nft_object_hash_key *k = data;
914
915 seed ^= hash_ptr(k->table, 32);
916
917 return jhash(k->name, strlen(k->name), seed);
918}
919
920static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
921{
922 const struct nft_object *obj = data;
923
924 return nft_objname_hash(&obj->key, 0, seed);
925}
926
927static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
928 const void *ptr)
929{
930 const struct nft_object_hash_key *k = arg->key;
931 const struct nft_object *obj = ptr;
932
933 if (obj->key.table != k->table)
934 return -1;
935
936 return strcmp(obj->key.name, k->name);
937}
938
633c9a84
PNA		 939static int nf_tables_newtable(struct net *net, struct sock *nlsk,
940 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 941 const struct nlattr * const nla[],
942 struct netlink_ext_ack *extack)
96518518
PM		 943{
944 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 945 u8 genmask = nft_genmask_next(net);
96518518 946 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 947 const struct nlattr *attr;
948 struct nft_table *table;
c5c1f975 949 u32 flags = 0;
e1aaca93 950 struct nft_ctx ctx;
55dd6f93 951 int err;
96518518 952
f102d66b 953 lockdep_assert_held(&net->nft.commit_mutex);
36dd1bcc
PNA		 954 attr = nla[NFTA_TABLE_NAME];
955 table = nft_table_lookup(net, attr, family, genmask);
96518518
PM		 956 if (IS_ERR(table)) {
957 if (PTR_ERR(table) != -ENOENT)
958 return PTR_ERR(table);
1a28ad74 959 } else {
36dd1bcc
PNA		 960 if (nlh->nlmsg_flags & NLM_F_EXCL) {
961 NL_SET_BAD_ATTR(extack, attr);
96518518 962 return -EEXIST;
36dd1bcc 963 }
96518518
PM		 964 if (nlh->nlmsg_flags & NLM_F_REPLACE)
965 return -EOPNOTSUPP;
e1aaca93 966
98319cb9 967 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e1aaca93 968 return nf_tables_updtable(&ctx);
96518518
PM		 969 }
970
c5c1f975
PM		 971 if (nla[NFTA_TABLE_FLAGS]) {
972 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
973 if (flags & ~NFT_TABLE_F_DORMANT)
974 return -EINVAL;
975 }
976
ffdb210e 977 err = -ENOMEM;
1cae565e 978 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 979 if (table == NULL)
98319cb9 980 goto err_kzalloc;
96518518 981
36dd1bcc 982 table->name = nla_strdup(attr, GFP_KERNEL);
e46abbcc 983 if (table->name == NULL)
98319cb9 984 goto err_strdup;
e46abbcc 985
1b2470e5
FW		 986 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
987 if (err)
988 goto err_chain_ht;
989
96518518 990 INIT_LIST_HEAD(&table->chains);
20a69341 991 INIT_LIST_HEAD(&table->sets);
e5009240 992 INIT_LIST_HEAD(&table->objects);
3b49e2e9 993 INIT_LIST_HEAD(&table->flowtables);
98319cb9 994 table->family = family;
c5c1f975 995 table->flags = flags;
3ecbfd65 996 table->handle = ++table_handle;
9ddf6323 997
98319cb9 998 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
55dd6f93 999 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 1000 if (err < 0)
98319cb9 1001 goto err_trans;
ffdb210e 1002
36596dad 1003 list_add_tail_rcu(&table->list, &net->nft.tables);
96518518 1004 return 0;
98319cb9 1005err_trans:
1b2470e5
FW		 1006 rhltable_destroy(&table->chains_ht);
1007err_chain_ht:
e46abbcc 1008 kfree(table->name);
98319cb9 1009err_strdup:
ffdb210e 1010 kfree(table);
98319cb9 1011err_kzalloc:
ffdb210e 1012 return err;
96518518
PM		 1013}
1014
b9ac12ef
AB		 1015static int nft_flush_table(struct nft_ctx *ctx)
1016{
3b49e2e9 1017 struct nft_flowtable *flowtable, *nft;
b9ac12ef 1018 struct nft_chain *chain, *nc;
e5009240 1019 struct nft_object *obj, *ne;
b9ac12ef 1020 struct nft_set *set, *ns;
3b49e2e9 1021 int err;
b9ac12ef 1022
a2f18db0 1023 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 1024 if (!nft_is_active_next(ctx->net, chain))
1025 continue;
1026
b9ac12ef
AB		 1027 ctx->chain = chain;
1028
1029 err = nft_delrule_by_chain(ctx);
1030 if (err < 0)
1031 goto out;
b9ac12ef
AB		 1032 }
1033
1034 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 1035 if (!nft_is_active_next(ctx->net, set))
1036 continue;
1037
408070d6 1038 if (nft_set_is_anonymous(set) &&
b9ac12ef
AB		 1039 !list_empty(&set->bindings))
1040 continue;
1041
1042 err = nft_delset(ctx, set);
1043 if (err < 0)
1044 goto out;
1045 }
1046
3b49e2e9
PNA		 1047 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
1048 err = nft_delflowtable(ctx, flowtable);
1049 if (err < 0)
1050 goto out;
1051 }
1052
e5009240
PNA		 1053 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
1054 err = nft_delobj(ctx, obj);
1055 if (err < 0)
1056 goto out;
1057 }
1058
a2f18db0 1059 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 1060 if (!nft_is_active_next(ctx->net, chain))
1061 continue;
1062
a2f18db0
PNA		 1063 ctx->chain = chain;
1064
1065 err = nft_delchain(ctx);
1066 if (err < 0)
1067 goto out;
1068 }
1069
b9ac12ef
AB		 1070 err = nft_deltable(ctx);
1071out:
1072 return err;
1073}
1074
1075static int nft_flush(struct nft_ctx *ctx, int family)
1076{
b9ac12ef
AB		 1077 struct nft_table *table, *nt;
1078 const struct nlattr * const *nla = ctx->nla;
1079 int err = 0;
1080
36596dad 1081 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
98319cb9 1082 if (family != AF_UNSPEC && table->family != family)
b9ac12ef
AB		 1083 continue;
1084
98319cb9 1085 ctx->family = table->family;
f2a6d766 1086
36596dad
PNA		 1087 if (!nft_is_active_next(ctx->net, table))
1088 continue;
b9ac12ef 1089
36596dad
PNA		 1090 if (nla[NFTA_TABLE_NAME] &&
1091 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1092 continue;
b9ac12ef 1093
36596dad
PNA		 1094 ctx->table = table;
1095
1096 err = nft_flush_table(ctx);
1097 if (err < 0)
1098 goto out;
b9ac12ef
AB		 1099 }
1100out:
1101 return err;
1102}
1103
633c9a84
PNA		 1104static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1105 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1106 const struct nlattr * const nla[],
1107 struct netlink_ext_ack *extack)
96518518
PM		 1108{
1109 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1110 u8 genmask = nft_genmask_next(net);
ee01d542 1111 int family = nfmsg->nfgen_family;
36dd1bcc
PNA		 1112 const struct nlattr *attr;
1113 struct nft_table *table;
55dd6f93 1114 struct nft_ctx ctx;
96518518 1115
36596dad 1116 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
3ecbfd65
HS		 1117 if (family == AF_UNSPEC ||
1118 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
b9ac12ef
AB		 1119 return nft_flush(&ctx, family);
1120
36dd1bcc
PNA		 1121 if (nla[NFTA_TABLE_HANDLE]) {
1122 attr = nla[NFTA_TABLE_HANDLE];
1123 table = nft_table_lookup_byhandle(net, attr, genmask);
1124 } else {
1125 attr = nla[NFTA_TABLE_NAME];
1126 table = nft_table_lookup(net, attr, family, genmask);
1127 }
3ecbfd65 1128
36dd1bcc
PNA		 1129 if (IS_ERR(table)) {
1130 NL_SET_BAD_ATTR(extack, attr);
96518518 1131 return PTR_ERR(table);
36dd1bcc 1132 }
96518518 1133
a8278400
PNA		 1134 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1135 table->use > 0)
1136 return -EBUSY;
1137
98319cb9 1138 ctx.family = family;
b9ac12ef 1139 ctx.table = table;
55dd6f93 1140
b9ac12ef 1141 return nft_flush_table(&ctx);
96518518
PM		 1142}
1143
55dd6f93
PNA		 1144static void nf_tables_table_destroy(struct nft_ctx *ctx)
1145{
fa5950e4
FW		 1146 if (WARN_ON(ctx->table->use > 0))
1147 return;
4fefee57 1148
1b2470e5 1149 rhltable_destroy(&ctx->table->chains_ht);
e46abbcc 1150 kfree(ctx->table->name);
55dd6f93 1151 kfree(ctx->table);
55dd6f93
PNA		 1152}
1153
cc07eeb0 1154void nft_register_chain_type(const struct nft_chain_type *ctype)
96518518 1155{
d8297d4f 1156 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
cc07eeb0 1157 return;
d8297d4f 1158
96518518 1159 nfnl_lock(NFNL_SUBSYS_NFTABLES);
cc07eeb0
PNA		 1160 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
1161 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1162 return;
96518518 1163 }
9370761c 1164 chain_type[ctype->family][ctype->type] = ctype;
96518518 1165 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
96518518 1166}
9370761c 1167EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 1168
32537e91 1169void nft_unregister_chain_type(const struct nft_chain_type *ctype)
96518518 1170{
96518518 1171 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 1172 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 1173 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1174}
9370761c 1175EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 1176
1177/*
1178 * Chains
1179 */
1180
1181static struct nft_chain *
cac20fcd 1182nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
96518518
PM		 1183{
1184 struct nft_chain *chain;
1185
1186 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 1187 if (chain->handle == handle &&
1188 nft_active_genmask(chain, genmask))
96518518
PM		 1189 return chain;
1190 }
1191
1192 return ERR_PTR(-ENOENT);
1193}
1194
4d44175a 1195static bool lockdep_commit_lock_is_held(const struct net *net)
f102d66b
FW		 1196{
1197#ifdef CONFIG_PROVE_LOCKING
1198 return lockdep_is_held(&net->nft.commit_mutex);
1199#else
1200 return true;
1201#endif
1202}
1203
1204static struct nft_chain *nft_chain_lookup(struct net *net,
1205 struct nft_table *table,
cac20fcd 1206 const struct nlattr *nla, u8 genmask)
96518518 1207{
1b2470e5
FW		 1208 char search[NFT_CHAIN_MAXNAMELEN + 1];
1209 struct rhlist_head *tmp, *list;
96518518
PM		 1210 struct nft_chain *chain;
1211
1212 if (nla == NULL)
1213 return ERR_PTR(-EINVAL);
1214
1b2470e5 1215 nla_strlcpy(search, nla, sizeof(search));
96518518 1216
1b2470e5 1217 WARN_ON(!rcu_read_lock_held() &&
f102d66b 1218 !lockdep_commit_lock_is_held(net));
1b2470e5
FW		 1219
1220 chain = ERR_PTR(-ENOENT);
1221 rcu_read_lock();
1222 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1223 if (!list)
1224 goto out_unlock;
1225
1226 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1227 if (nft_active_genmask(chain, genmask))
1228 goto out_unlock;
1229 }
1230 chain = ERR_PTR(-ENOENT);
1231out_unlock:
1232 rcu_read_unlock();
1233 return chain;
96518518
PM		 1234}
1235
1236static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 1237 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1238 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1239 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1240 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1241 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1242 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 1243 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 1244 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 1245 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
c9626a2c 1246 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
96518518
PM		 1247};
1248
1249static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1250 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1251 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 1252 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1253 .len = IFNAMSIZ - 1 },
96518518
PM		 1254};
1255
0ca743a5
PNA		 1256static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1257{
1258 struct nft_stats *cpu_stats, total;
1259 struct nlattr *nest;
ce355e20
ED		 1260 unsigned int seq;
1261 u64 pkts, bytes;
0ca743a5
PNA		 1262 int cpu;
1263
edbd82c5
FW		 1264 if (!stats)
1265 return 0;
1266
0ca743a5
PNA		 1267 memset(&total, 0, sizeof(total));
1268 for_each_possible_cpu(cpu) {
1269 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 1270 do {
1271 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1272 pkts = cpu_stats->pkts;
1273 bytes = cpu_stats->bytes;
1274 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1275 total.pkts += pkts;
1276 total.bytes += bytes;
0ca743a5 1277 }
ae0be8de 1278 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
0ca743a5
PNA		 1279 if (nest == NULL)
1280 goto nla_put_failure;
1281
b46f6ded
ND		 1282 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1283 NFTA_COUNTER_PAD) ||
1284 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1285 NFTA_COUNTER_PAD))
0ca743a5
PNA		 1286 goto nla_put_failure;
1287
1288 nla_nest_end(skb, nest);
1289 return 0;
1290
1291nla_put_failure:
1292 return -ENOSPC;
1293}
1294
d54725cd
PNA		 1295static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
1296 const struct nft_base_chain *basechain)
1297{
1298 const struct nf_hook_ops *ops = &basechain->ops;
1299 struct nft_hook *hook, *first = NULL;
1300 struct nlattr *nest, *nest_devs;
1301 int n = 0;
1302
1303 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1304 if (nest == NULL)
1305 goto nla_put_failure;
1306 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1307 goto nla_put_failure;
1308 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1309 goto nla_put_failure;
1310
1311 if (family == NFPROTO_NETDEV) {
1312 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
1313 list_for_each_entry(hook, &basechain->hook_list, list) {
1314 if (!first)
1315 first = hook;
1316
1317 if (nla_put_string(skb, NFTA_DEVICE_NAME,
1318 hook->ops.dev->name))
1319 goto nla_put_failure;
1320 n++;
1321 }
1322 nla_nest_end(skb, nest_devs);
1323
1324 if (n == 1 &&
1325 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name))
1326 goto nla_put_failure;
1327 }
1328 nla_nest_end(skb, nest);
1329
1330 return 0;
1331nla_put_failure:
1332 return -1;
1333}
1334
84d7fce6
PNA		 1335static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1336 u32 portid, u32 seq, int event, u32 flags,
1337 int family, const struct nft_table *table,
96518518
PM		 1338 const struct nft_chain *chain)
1339{
1340 struct nlmsghdr *nlh;
1341 struct nfgenmsg *nfmsg;
1342
dedb67c4 1343 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1344 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1345 if (nlh == NULL)
1346 goto nla_put_failure;
1347
1348 nfmsg = nlmsg_data(nlh);
1349 nfmsg->nfgen_family = family;
1350 nfmsg->version = NFNETLINK_V0;
84d7fce6 1351 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1352
1353 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1354 goto nla_put_failure;
b46f6ded
ND		 1355 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1356 NFTA_CHAIN_PAD))
96518518
PM		 1357 goto nla_put_failure;
1358 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1359 goto nla_put_failure;
1360
f323d954 1361 if (nft_is_base_chain(chain)) {
0ca743a5 1362 const struct nft_base_chain *basechain = nft_base_chain(chain);
edbd82c5 1363 struct nft_stats __percpu *stats;
0ca743a5 1364
d54725cd 1365 if (nft_dump_basechain_hook(skb, family, basechain))
2cbce139 1366 goto nla_put_failure;
9370761c 1367
0ca743a5
PNA		 1368 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1369 htonl(basechain->policy)))
1370 goto nla_put_failure;
1371
baae3e62
PM		 1372 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1373 goto nla_put_failure;
0ca743a5 1374
edbd82c5
FW		 1375 stats = rcu_dereference_check(basechain->stats,
1376 lockdep_commit_lock_is_held(net));
1377 if (nft_dump_stats(skb, stats))
0ca743a5 1378 goto nla_put_failure;
96518518
PM		 1379 }
1380
0ca743a5
PNA		 1381 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1382 goto nla_put_failure;
1383
053c095a
JB		 1384 nlmsg_end(skb, nlh);
1385 return 0;
96518518
PM		 1386
1387nla_put_failure:
1388 nlmsg_trim(skb, nlh);
1389 return -1;
1390}
1391
25e94a99 1392static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1393{
1394 struct sk_buff *skb;
96518518
PM		 1395 int err;
1396
128ad332
PNA		 1397 if (!ctx->report &&
1398 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1399 return;
96518518 1400
96518518
PM		 1401 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1402 if (skb == NULL)
1403 goto err;
1404
84d7fce6 1405 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 1406 event, 0, ctx->family, ctx->table,
35151d84 1407 ctx->chain);
96518518
PM		 1408 if (err < 0) {
1409 kfree_skb(skb);
1410 goto err;
1411 }
1412
25e94a99
PNA		 1413 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1414 ctx->report, GFP_KERNEL);
1415 return;
96518518 1416err:
25e94a99 1417 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1418}
1419
1420static int nf_tables_dump_chains(struct sk_buff *skb,
1421 struct netlink_callback *cb)
1422{
1423 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
96518518
PM		 1424 const struct nft_table *table;
1425 const struct nft_chain *chain;
1426 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1427 struct net *net = sock_net(skb->sk);
96518518
PM		 1428 int family = nfmsg->nfgen_family;
1429
e688a7f8 1430 rcu_read_lock();
38e029f1
PNA		 1431 cb->seq = net->nft.base_seq;
1432
36596dad 1433 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 1434 if (family != NFPROTO_UNSPEC && family != table->family)
96518518
PM		 1435 continue;
1436
36596dad
PNA		 1437 list_for_each_entry_rcu(chain, &table->chains, list) {
1438 if (idx < s_idx)
1439 goto cont;
1440 if (idx > s_idx)
1441 memset(&cb->args[1], 0,
1442 sizeof(cb->args) - sizeof(cb->args[0]));
1443 if (!nft_is_active(net, chain))
1444 continue;
1445 if (nf_tables_fill_chain_info(skb, net,
1446 NETLINK_CB(cb->skb).portid,
1447 cb->nlh->nlmsg_seq,
1448 NFT_MSG_NEWCHAIN,
1449 NLM_F_MULTI,
98319cb9 1450 table->family, table,
36596dad
PNA		 1451 chain) < 0)
1452 goto done;
38e029f1 1453
36596dad 1454 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518 1455cont:
36596dad 1456 idx++;
96518518
PM		 1457 }
1458 }
1459done:
e688a7f8 1460 rcu_read_unlock();
96518518
PM		 1461 cb->args[0] = idx;
1462 return skb->len;
1463}
1464
d9adf22a 1465/* called with rcu_read_lock held */
7b8002a1
PNA		 1466static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1467 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1468 const struct nlattr * const nla[],
1469 struct netlink_ext_ack *extack)
96518518
PM		 1470{
1471 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1472 u8 genmask = nft_genmask_cur(net);
96518518 1473 const struct nft_chain *chain;
1b2470e5 1474 struct nft_table *table;
96518518
PM		 1475 struct sk_buff *skb2;
1476 int family = nfmsg->nfgen_family;
1477 int err;
1478
1479 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1480 struct netlink_dump_control c = {
1481 .dump = nf_tables_dump_chains,
d9adf22a 1482 .module = THIS_MODULE,
96518518 1483 };
d9adf22a
FW		 1484
1485 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 1486 }
1487
cac20fcd 1488 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 1489 if (IS_ERR(table)) {
1490 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 1491 return PTR_ERR(table);
36dd1bcc 1492 }
96518518 1493
f102d66b 1494 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
36dd1bcc
PNA		 1495 if (IS_ERR(chain)) {
1496 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
96518518 1497 return PTR_ERR(chain);
36dd1bcc 1498 }
96518518 1499
d9adf22a 1500 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 1501 if (!skb2)
1502 return -ENOMEM;
1503
84d7fce6 1504 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1505 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1506 family, table, chain);
1507 if (err < 0)
1508 goto err;
1509
1510 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1511
1512err:
1513 kfree_skb(skb2);
1514 return err;
1515}
1516
0ca743a5
PNA		 1517static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1518 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1519 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1520};
1521
ff3cd7b3 1522static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1523{
1524 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1525 struct nft_stats __percpu *newstats;
1526 struct nft_stats *stats;
1527 int err;
1528
8cb08174
JB		 1529 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1530 nft_counter_policy, NULL);
0ca743a5 1531 if (err < 0)
ff3cd7b3 1532 return ERR_PTR(err);
0ca743a5
PNA		 1533
1534 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1535 return ERR_PTR(-EINVAL);
0ca743a5 1536
ce355e20 1537 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1538 if (newstats == NULL)
ff3cd7b3 1539 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1540
1541 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1542 * are not exposed to userspace.
1543 */
e8781f70 1544 preempt_disable();
0ca743a5
PNA		 1545 stats = this_cpu_ptr(newstats);
1546 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1547 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1548 preempt_enable();
0ca743a5 1549
ff3cd7b3
PNA		 1550 return newstats;
1551}
1552
53315ac6 1553static void nft_chain_stats_replace(struct nft_trans *trans)
ff3cd7b3 1554{
53315ac6 1555 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
0befd061 1556
53315ac6 1557 if (!nft_trans_chain_stats(trans))
b88825de
PNA		 1558 return;
1559
b685b534
PM		 1560 nft_trans_chain_stats(trans) =
1561 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans),
1562 lockdep_commit_lock_is_held(trans->ctx.net));
53315ac6
FW		 1563
1564 if (!nft_trans_chain_stats(trans))
bbb8c61f 1565 static_branch_inc(&nft_counters_enabled);
0ca743a5
PNA		 1566}
1567
0cbc06b3
FW		 1568static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1569{
1570 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1571 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1572
1573 if (g0 != g1)
1574 kvfree(g1);
1575 kvfree(g0);
1576
1577 /* should be NULL either via abort or via successful commit */
1578 WARN_ON_ONCE(chain->rules_next);
1579 kvfree(chain->rules_next);
1580}
1581
43a605f2 1582static void nf_tables_chain_destroy(struct nft_ctx *ctx)
91c7b38d 1583{
43a605f2 1584 struct nft_chain *chain = ctx->chain;
d54725cd 1585 struct nft_hook *hook, *next;
43a605f2 1586
fa5950e4
FW		 1587 if (WARN_ON(chain->use > 0))
1588 return;
91c7b38d 1589
0cbc06b3
FW		 1590 /* no concurrent access possible anymore */
1591 nf_tables_chain_free_chain_rules(chain);
1592
f323d954 1593 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1594 struct nft_base_chain *basechain = nft_base_chain(chain);
1595
d54725cd
PNA		 1596 if (ctx->family == NFPROTO_NETDEV) {
1597 list_for_each_entry_safe(hook, next,
1598 &basechain->hook_list, list) {
1599 list_del_rcu(&hook->list);
1600 kfree_rcu(hook, rcu);
1601 }
1602 }
2cbce139 1603 module_put(basechain->type->owner);
4c05ec47 1604 if (rcu_access_pointer(basechain->stats)) {
9f08ea84 1605 static_branch_dec(&nft_counters_enabled);
4c05ec47
TY		 1606 free_percpu(rcu_dereference_raw(basechain->stats));
1607 }
b7263e07 1608 kfree(chain->name);
2cbce139 1609 kfree(basechain);
91c7b38d 1610 } else {
b7263e07 1611 kfree(chain->name);
91c7b38d
PNA		 1612 kfree(chain);
1613 }
1614}
1615
3f0465a9
PNA		 1616static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
1617 const struct nlattr *attr)
1618{
1619 struct net_device *dev;
1620 char ifname[IFNAMSIZ];
1621 struct nft_hook *hook;
1622 int err;
1623
1624 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1625 if (!hook) {
1626 err = -ENOMEM;
1627 goto err_hook_alloc;
1628 }
1629
1630 nla_strlcpy(ifname, attr, IFNAMSIZ);
1631 dev = __dev_get_by_name(net, ifname);
1632 if (!dev) {
1633 err = -ENOENT;
1634 goto err_hook_dev;
1635 }
1636 hook->ops.dev = dev;
1637
1638 return hook;
1639
1640err_hook_dev:
1641 kfree(hook);
1642err_hook_alloc:
1643 return ERR_PTR(err);
1644}
1645
b75a3e83
PNA		 1646static bool nft_hook_list_find(struct list_head *hook_list,
1647 const struct nft_hook *this)
1648{
1649 struct nft_hook *hook;
1650
1651 list_for_each_entry(hook, hook_list, list) {
1652 if (this->ops.dev == hook->ops.dev)
1653 return true;
1654 }
1655
1656 return false;
1657}
1658
3f0465a9
PNA		 1659static int nf_tables_parse_netdev_hooks(struct net *net,
1660 const struct nlattr *attr,
1661 struct list_head *hook_list)
1662{
1663 struct nft_hook *hook, *next;
1664 const struct nlattr *tmp;
1665 int rem, n = 0, err;
1666
1667 nla_for_each_nested(tmp, attr, rem) {
1668 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
1669 err = -EINVAL;
1670 goto err_hook;
1671 }
1672
1673 hook = nft_netdev_hook_alloc(net, tmp);
1674 if (IS_ERR(hook)) {
1675 err = PTR_ERR(hook);
1676 goto err_hook;
1677 }
b75a3e83
PNA		 1678 if (nft_hook_list_find(hook_list, hook)) {
1679 err = -EEXIST;
1680 goto err_hook;
1681 }
3f0465a9
PNA		 1682 list_add_tail(&hook->list, hook_list);
1683 n++;
1684
cb662ac6 1685 if (n == NFT_NETDEVICE_MAX) {
3f0465a9
PNA		 1686 err = -EFBIG;
1687 goto err_hook;
1688 }
1689 }
1690 if (!n)
1691 return -EINVAL;
1692
1693 return 0;
1694
1695err_hook:
1696 list_for_each_entry_safe(hook, next, hook_list, list) {
1697 list_del(&hook->list);
1698 kfree(hook);
1699 }
1700 return err;
1701}
1702
508f8ccd
PNA		 1703struct nft_chain_hook {
1704 u32 num;
84ba7dd7 1705 s32 priority;
32537e91 1706 const struct nft_chain_type *type;
d54725cd 1707 struct list_head list;
508f8ccd
PNA		 1708};
1709
d54725cd
PNA		 1710static int nft_chain_parse_netdev(struct net *net,
1711 struct nlattr *tb[],
1712 struct list_head *hook_list)
1713{
1714 struct nft_hook *hook;
1715 int err;
1716
1717 if (tb[NFTA_HOOK_DEV]) {
1718 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
1719 if (IS_ERR(hook))
1720 return PTR_ERR(hook);
1721
1722 list_add_tail(&hook->list, hook_list);
1723 } else if (tb[NFTA_HOOK_DEVS]) {
1724 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
1725 hook_list);
1726 if (err < 0)
1727 return err;
1728 } else {
1729 return -EINVAL;
1730 }
1731
1732 return 0;
1733}
1734
508f8ccd
PNA		 1735static int nft_chain_parse_hook(struct net *net,
1736 const struct nlattr * const nla[],
36596dad 1737 struct nft_chain_hook *hook, u8 family,
445509eb 1738 bool autoload)
508f8ccd
PNA		 1739{
1740 struct nlattr *ha[NFTA_HOOK_MAX + 1];
32537e91 1741 const struct nft_chain_type *type;
508f8ccd
PNA		 1742 int err;
1743
f102d66b
FW		 1744 lockdep_assert_held(&net->nft.commit_mutex);
1745 lockdep_nfnl_nft_mutex_not_held();
1746
8cb08174
JB		 1747 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
1748 nla[NFTA_CHAIN_HOOK],
1749 nft_hook_policy, NULL);
508f8ccd
PNA		 1750 if (err < 0)
1751 return err;
1752
1753 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1754 ha[NFTA_HOOK_PRIORITY] == NULL)
1755 return -EINVAL;
1756
1757 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
508f8ccd
PNA		 1758 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1759
36596dad 1760 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
508f8ccd 1761 if (nla[NFTA_CHAIN_TYPE]) {
452238e8 1762 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
445509eb 1763 family, autoload);
508f8ccd
PNA		 1764 if (IS_ERR(type))
1765 return PTR_ERR(type);
1766 }
33d1c018 1767 if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
508f8ccd 1768 return -EOPNOTSUPP;
84ba7dd7
FW		 1769
1770 if (type->type == NFT_CHAIN_T_NAT &&
1771 hook->priority <= NF_IP_PRI_CONNTRACK)
1772 return -EOPNOTSUPP;
1773
508f8ccd
PNA		 1774 if (!try_module_get(type->owner))
1775 return -ENOENT;
1776
1777 hook->type = type;
1778
d54725cd 1779 INIT_LIST_HEAD(&hook->list);
36596dad 1780 if (family == NFPROTO_NETDEV) {
d54725cd
PNA		 1781 err = nft_chain_parse_netdev(net, ha, &hook->list);
1782 if (err < 0) {
508f8ccd 1783 module_put(type->owner);
d54725cd 1784 return err;
508f8ccd 1785 }
d54725cd 1786 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) {
508f8ccd
PNA		 1787 module_put(type->owner);
1788 return -EOPNOTSUPP;
1789 }
1790
1791 return 0;
1792}
1793
1794static void nft_chain_release_hook(struct nft_chain_hook *hook)
1795{
d54725cd
PNA		 1796 struct nft_hook *h, *next;
1797
1798 list_for_each_entry_safe(h, next, &hook->list, list) {
1799 list_del(&h->list);
1800 kfree(h);
1801 }
508f8ccd 1802 module_put(hook->type->owner);
508f8ccd
PNA		 1803}
1804
0cbc06b3
FW		 1805struct nft_rules_old {
1806 struct rcu_head h;
1807 struct nft_rule **start;
1808};
1809
1810static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1811 unsigned int alloc)
1812{
1813 if (alloc > INT_MAX)
1814 return NULL;
1815
1816 alloc += 1; /* NULL, ends rules */
1817 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1818 return NULL;
1819
1820 alloc *= sizeof(struct nft_rule *);
1821 alloc += sizeof(struct nft_rules_old);
1822
1823 return kvmalloc(alloc, GFP_KERNEL);
1824}
1825
d54725cd
PNA		 1826static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family,
1827 const struct nft_chain_hook *hook,
1828 struct nft_chain *chain)
1829{
1830 ops->pf = family;
1831 ops->hooknum = hook->num;
1832 ops->priority = hook->priority;
1833 ops->priv = chain;
1834 ops->hook = hook->type->hooks[ops->hooknum];
1835}
1836
1837static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
1838 struct nft_chain_hook *hook, u32 flags)
1839{
1840 struct nft_chain *chain;
1841 struct nft_hook *h;
1842
1843 basechain->type = hook->type;
1844 INIT_LIST_HEAD(&basechain->hook_list);
1845 chain = &basechain->chain;
1846
1847 if (family == NFPROTO_NETDEV) {
1848 list_splice_init(&hook->list, &basechain->hook_list);
1849 list_for_each_entry(h, &basechain->hook_list, list)
1850 nft_basechain_hook_init(&h->ops, family, hook, chain);
1851
1852 basechain->ops.hooknum = hook->num;
1853 basechain->ops.priority = hook->priority;
1854 } else {
1855 nft_basechain_hook_init(&basechain->ops, family, hook, chain);
1856 }
1857
1858 chain->flags |= NFT_BASE_CHAIN | flags;
1859 basechain->policy = NF_ACCEPT;
1860 if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
1861 nft_chain_offload_priority(basechain) < 0)
1862 return -EOPNOTSUPP;
1863
1864 flow_block_init(&basechain->flow_block);
1865
1866 return 0;
1867}
1868
4035285f 1869static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
c9626a2c 1870 u8 policy, u32 flags)
4035285f
PNA		 1871{
1872 const struct nlattr * const *nla = ctx->nla;
1873 struct nft_table *table = ctx->table;
4035285f
PNA		 1874 struct nft_base_chain *basechain;
1875 struct nft_stats __percpu *stats;
1876 struct net *net = ctx->net;
66293c46 1877 struct nft_trans *trans;
4035285f 1878 struct nft_chain *chain;
0cbc06b3 1879 struct nft_rule **rules;
4035285f
PNA		 1880 int err;
1881
1882 if (table->use == UINT_MAX)
1883 return -EOVERFLOW;
1884
1885 if (nla[NFTA_CHAIN_HOOK]) {
1886 struct nft_chain_hook hook;
4035285f 1887
445509eb 1888 err = nft_chain_parse_hook(net, nla, &hook, family, true);
4035285f
PNA		 1889 if (err < 0)
1890 return err;
1891
1892 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1893 if (basechain == NULL) {
1894 nft_chain_release_hook(&hook);
1895 return -ENOMEM;
1896 }
d54725cd 1897 chain = &basechain->chain;
4035285f
PNA		 1898
1899 if (nla[NFTA_CHAIN_COUNTERS]) {
1900 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1901 if (IS_ERR(stats)) {
1902 nft_chain_release_hook(&hook);
1903 kfree(basechain);
1904 return PTR_ERR(stats);
1905 }
4c05ec47 1906 rcu_assign_pointer(basechain->stats, stats);
4035285f
PNA		 1907 static_branch_inc(&nft_counters_enabled);
1908 }
1909
d54725cd
PNA		 1910 err = nft_basechain_init(basechain, family, &hook, flags);
1911 if (err < 0) {
1912 nft_chain_release_hook(&hook);
1913 kfree(basechain);
1914 return err;
1915 }
4035285f
PNA		 1916 } else {
1917 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1918 if (chain == NULL)
1919 return -ENOMEM;
1920 }
43a605f2
PNA		 1921 ctx->chain = chain;
1922
4035285f
PNA		 1923 INIT_LIST_HEAD(&chain->rules);
1924 chain->handle = nf_tables_alloc_handle(table);
1925 chain->table = table;
1926 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1927 if (!chain->name) {
1928 err = -ENOMEM;
1929 goto err1;
1930 }
1931
0cbc06b3
FW		 1932 rules = nf_tables_chain_alloc_rules(chain, 0);
1933 if (!rules) {
1934 err = -ENOMEM;
1935 goto err1;
1936 }
1937
1938 *rules = NULL;
1939 rcu_assign_pointer(chain->rules_gen_0, rules);
1940 rcu_assign_pointer(chain->rules_gen_1, rules);
1941
c974a3a3 1942 err = nf_tables_register_hook(net, table, chain);
4035285f
PNA		 1943 if (err < 0)
1944 goto err1;
1945
1b2470e5
FW		 1946 err = rhltable_insert_key(&table->chains_ht, chain->name,
1947 &chain->rhlhead, nft_chain_ht_params);
1948 if (err)
1949 goto err2;
1950
66293c46
FW		 1951 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1952 if (IS_ERR(trans)) {
1953 err = PTR_ERR(trans);
1b2470e5
FW		 1954 rhltable_remove(&table->chains_ht, &chain->rhlhead,
1955 nft_chain_ht_params);
4035285f 1956 goto err2;
1b2470e5 1957 }
4035285f 1958
ad652f38 1959 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
66293c46
FW		 1960 if (nft_is_base_chain(chain))
1961 nft_trans_chain_policy(trans) = policy;
1962
4035285f
PNA		 1963 table->use++;
1964 list_add_tail_rcu(&chain->list, &table->chains);
1965
1966 return 0;
1967err2:
c974a3a3 1968 nf_tables_unregister_hook(net, table, chain);
4035285f 1969err1:
43a605f2 1970 nf_tables_chain_destroy(ctx);
4035285f
PNA		 1971
1972 return err;
1973}
1974
d54725cd
PNA		 1975static bool nft_hook_list_equal(struct list_head *hook_list1,
1976 struct list_head *hook_list2)
1977{
1978 struct nft_hook *hook;
1979 int n = 0, m = 0;
1980
1981 n = 0;
1982 list_for_each_entry(hook, hook_list2, list) {
1983 if (!nft_hook_list_find(hook_list1, hook))
1984 return false;
1985
1986 n++;
1987 }
1988 list_for_each_entry(hook, hook_list1, list)
1989 m++;
1990
1991 return n == m;
1992}
1993
c9626a2c
PNA		 1994static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1995 u32 flags)
2c4a488a
PNA		 1996{
1997 const struct nlattr * const *nla = ctx->nla;
1998 struct nft_table *table = ctx->table;
1999 struct nft_chain *chain = ctx->chain;
2c4a488a
PNA		 2000 struct nft_base_chain *basechain;
2001 struct nft_stats *stats = NULL;
2002 struct nft_chain_hook hook;
2c4a488a
PNA		 2003 struct nf_hook_ops *ops;
2004 struct nft_trans *trans;
c974a3a3 2005 int err;
2c4a488a 2006
c9626a2c
PNA		 2007 if (chain->flags ^ flags)
2008 return -EOPNOTSUPP;
2009
2c4a488a
PNA		 2010 if (nla[NFTA_CHAIN_HOOK]) {
2011 if (!nft_is_base_chain(chain))
2012 return -EBUSY;
2013
36596dad 2014 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
445509eb 2015 false);
2c4a488a
PNA		 2016 if (err < 0)
2017 return err;
2018
2019 basechain = nft_base_chain(chain);
2020 if (basechain->type != hook.type) {
2021 nft_chain_release_hook(&hook);
2022 return -EBUSY;
2023 }
2024
d54725cd
PNA		 2025 if (ctx->family == NFPROTO_NETDEV) {
2026 if (!nft_hook_list_equal(&basechain->hook_list,
2027 &hook.list)) {
2028 nft_chain_release_hook(&hook);
2029 return -EBUSY;
2030 }
2031 } else {
2032 ops = &basechain->ops;
2033 if (ops->hooknum != hook.num ||
2034 ops->priority != hook.priority) {
2035 nft_chain_release_hook(&hook);
2036 return -EBUSY;
2037 }
2c4a488a
PNA		 2038 }
2039 nft_chain_release_hook(&hook);
2040 }
2041
2042 if (nla[NFTA_CHAIN_HANDLE] &&
2043 nla[NFTA_CHAIN_NAME]) {
2044 struct nft_chain *chain2;
2045
f102d66b
FW		 2046 chain2 = nft_chain_lookup(ctx->net, table,
2047 nla[NFTA_CHAIN_NAME], genmask);
0d18779b
JC		 2048 if (!IS_ERR(chain2))
2049 return -EEXIST;
2c4a488a
PNA		 2050 }
2051
2052 if (nla[NFTA_CHAIN_COUNTERS]) {
2053 if (!nft_is_base_chain(chain))
2054 return -EOPNOTSUPP;
2055
2056 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2057 if (IS_ERR(stats))
2058 return PTR_ERR(stats);
2059 }
2060
c6cc94df 2061 err = -ENOMEM;
2c4a488a
PNA		 2062 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
2063 sizeof(struct nft_trans_chain));
c6cc94df
FW		 2064 if (trans == NULL)
2065 goto err;
2c4a488a
PNA		 2066
2067 nft_trans_chain_stats(trans) = stats;
2068 nft_trans_chain_update(trans) = true;
2069
2070 if (nla[NFTA_CHAIN_POLICY])
2071 nft_trans_chain_policy(trans) = policy;
2072 else
2073 nft_trans_chain_policy(trans) = -1;
2074
c6cc94df
FW		 2075 if (nla[NFTA_CHAIN_HANDLE] &&
2076 nla[NFTA_CHAIN_NAME]) {
2077 struct nft_trans *tmp;
2078 char *name;
2079
2080 err = -ENOMEM;
2081 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2082 if (!name)
2083 goto err;
2084
2085 err = -EEXIST;
2086 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
2087 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
2088 tmp->ctx.table == table &&
2089 nft_trans_chain_update(tmp) &&
2090 nft_trans_chain_name(tmp) &&
2091 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
2092 kfree(name);
2093 goto err;
2094 }
2c4a488a 2095 }
c6cc94df
FW		 2096
2097 nft_trans_chain_name(trans) = name;
2c4a488a
PNA		 2098 }
2099 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
2100
2101 return 0;
c6cc94df
FW		 2102err:
2103 free_percpu(stats);
2104 kfree(trans);
2105 return err;
2c4a488a
PNA		 2106}
2107
633c9a84
PNA		 2108static int nf_tables_newchain(struct net *net, struct sock *nlsk,
2109 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2110 const struct nlattr * const nla[],
2111 struct netlink_ext_ack *extack)
96518518
PM		 2112{
2113 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4035285f
PNA		 2114 u8 genmask = nft_genmask_next(net);
2115 int family = nfmsg->nfgen_family;
36dd1bcc 2116 const struct nlattr *attr;
96518518
PM		 2117 struct nft_table *table;
2118 struct nft_chain *chain;
57de2a0c 2119 u8 policy = NF_ACCEPT;
4035285f 2120 struct nft_ctx ctx;
96518518 2121 u64 handle = 0;
c9626a2c 2122 u32 flags = 0;
96518518 2123
f102d66b
FW		 2124 lockdep_assert_held(&net->nft.commit_mutex);
2125
cac20fcd 2126 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 2127 if (IS_ERR(table)) {
2128 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 2129 return PTR_ERR(table);
36dd1bcc 2130 }
96518518 2131
96518518 2132 chain = NULL;
36dd1bcc 2133 attr = nla[NFTA_CHAIN_NAME];
96518518
PM		 2134
2135 if (nla[NFTA_CHAIN_HANDLE]) {
2136 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
cac20fcd 2137 chain = nft_chain_lookup_byhandle(table, handle, genmask);
36dd1bcc
PNA		 2138 if (IS_ERR(chain)) {
2139 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
96518518 2140 return PTR_ERR(chain);
36dd1bcc
PNA		 2141 }
2142 attr = nla[NFTA_CHAIN_HANDLE];
96518518 2143 } else {
f102d66b 2144 chain = nft_chain_lookup(net, table, attr, genmask);
96518518 2145 if (IS_ERR(chain)) {
36dd1bcc
PNA		 2146 if (PTR_ERR(chain) != -ENOENT) {
2147 NL_SET_BAD_ATTR(extack, attr);
96518518 2148 return PTR_ERR(chain);
36dd1bcc 2149 }
96518518
PM		 2150 chain = NULL;
2151 }
2152 }
2153
57de2a0c 2154 if (nla[NFTA_CHAIN_POLICY]) {
f323d954 2155 if (chain != NULL &&
36dd1bcc
PNA		 2156 !nft_is_base_chain(chain)) {
2157 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
d6b6cb1d 2158 return -EOPNOTSUPP;
36dd1bcc 2159 }
d6b6cb1d
PNA		 2160
2161 if (chain == NULL &&
36dd1bcc
PNA		 2162 nla[NFTA_CHAIN_HOOK] == NULL) {
2163 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
57de2a0c 2164 return -EOPNOTSUPP;
36dd1bcc 2165 }
57de2a0c 2166
8f46df18 2167 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 2168 switch (policy) {
2169 case NF_DROP:
2170 case NF_ACCEPT:
2171 break;
2172 default:
2173 return -EINVAL;
2174 }
2175 }
2176
c9626a2c
PNA		 2177 if (nla[NFTA_CHAIN_FLAGS])
2178 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
b717273d
FW		 2179 else if (chain)
2180 flags = chain->flags;
c9626a2c 2181
98319cb9 2182 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
4035285f 2183
96518518 2184 if (chain != NULL) {
36dd1bcc
PNA		 2185 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2186 NL_SET_BAD_ATTR(extack, attr);
96518518 2187 return -EEXIST;
36dd1bcc 2188 }
96518518
PM		 2189 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2190 return -EOPNOTSUPP;
2191
1ed012f6 2192 flags |= chain->flags & NFT_BASE_CHAIN;
c9626a2c 2193 return nf_tables_updchain(&ctx, genmask, policy, flags);
96518518
PM		 2194 }
2195
c9626a2c 2196 return nf_tables_addchain(&ctx, family, genmask, policy, flags);
96518518
PM		 2197}
2198
633c9a84
PNA		 2199static int nf_tables_delchain(struct net *net, struct sock *nlsk,
2200 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2201 const struct nlattr * const nla[],
2202 struct netlink_ext_ack *extack)
96518518
PM		 2203{
2204 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2205 u8 genmask = nft_genmask_next(net);
36dd1bcc
PNA		 2206 int family = nfmsg->nfgen_family;
2207 const struct nlattr *attr;
96518518
PM		 2208 struct nft_table *table;
2209 struct nft_chain *chain;
9dee1474 2210 struct nft_rule *rule;
91c7b38d 2211 struct nft_ctx ctx;
3ecbfd65 2212 u64 handle;
9dee1474
PNA		 2213 u32 use;
2214 int err;
96518518 2215
cac20fcd 2216 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
36dd1bcc
PNA		 2217 if (IS_ERR(table)) {
2218 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
96518518 2219 return PTR_ERR(table);
36dd1bcc 2220 }
96518518 2221
3ecbfd65 2222 if (nla[NFTA_CHAIN_HANDLE]) {
36dd1bcc
PNA		 2223 attr = nla[NFTA_CHAIN_HANDLE];
2224 handle = be64_to_cpu(nla_get_be64(attr));
cac20fcd 2225 chain = nft_chain_lookup_byhandle(table, handle, genmask);
3ecbfd65 2226 } else {
36dd1bcc 2227 attr = nla[NFTA_CHAIN_NAME];
f102d66b 2228 chain = nft_chain_lookup(net, table, attr, genmask);
3ecbfd65 2229 }
36dd1bcc
PNA		 2230 if (IS_ERR(chain)) {
2231 NL_SET_BAD_ATTR(extack, attr);
96518518 2232 return PTR_ERR(chain);
36dd1bcc 2233 }
9dee1474
PNA		 2234
2235 if (nlh->nlmsg_flags & NLM_F_NONREC &&
2236 chain->use > 0)
96518518
PM		 2237 return -EBUSY;
2238
98319cb9 2239 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0165d932 2240
9dee1474
PNA		 2241 use = chain->use;
2242 list_for_each_entry(rule, &chain->rules, list) {
2243 if (!nft_is_active_next(net, rule))
2244 continue;
2245 use--;
2246
2247 err = nft_delrule(&ctx, rule);
2248 if (err < 0)
2249 return err;
2250 }
2251
2252 /* There are rules and elements that are still holding references to us,
2253 * we cannot do a recursive removal in this case.
2254 */
36dd1bcc
PNA		 2255 if (use > 0) {
2256 NL_SET_BAD_ATTR(extack, attr);
9dee1474 2257 return -EBUSY;
36dd1bcc 2258 }
9dee1474 2259
ee01d542 2260 return nft_delchain(&ctx);
96518518
PM		 2261}
2262
96518518
PM		 2263/*
2264 * Expressions
2265 */
2266
2267/**
ef1f7df9
PM		 2268 * nft_register_expr - register nf_tables expr type
2269 * @ops: expr type
96518518 2270 *
ef1f7df9 2271 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 2272 * success or a negative errno code otherwise.
2273 */
ef1f7df9 2274int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 2275{
2276 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 2277 if (type->family == NFPROTO_UNSPEC)
e688a7f8 2278 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 2279 else
e688a7f8 2280 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 2281 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2282 return 0;
2283}
2284EXPORT_SYMBOL_GPL(nft_register_expr);
2285
2286/**
ef1f7df9
PM		 2287 * nft_unregister_expr - unregister nf_tables expr type
2288 * @ops: expr type
96518518 2289 *
ef1f7df9 2290 * Unregisters the expr typefor use with nf_tables.
96518518 2291 */
ef1f7df9 2292void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 2293{
2294 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 2295 list_del_rcu(&type->list);
96518518
PM		 2296 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2297}
2298EXPORT_SYMBOL_GPL(nft_unregister_expr);
2299
64d46806
PM		 2300static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2301 struct nlattr *nla)
96518518 2302{
9cff126f 2303 const struct nft_expr_type *type, *candidate = NULL;
96518518 2304
ef1f7df9 2305 list_for_each_entry(type, &nf_tables_expressions, list) {
9cff126f
PNA		 2306 if (!nla_strcmp(nla, type->name)) {
2307 if (!type->family && !candidate)
2308 candidate = type;
2309 else if (type->family == family)
2310 candidate = type;
2311 }
96518518 2312 }
9cff126f 2313 return candidate;
96518518
PM		 2314}
2315
b9c04ae7
PNA		 2316#ifdef CONFIG_MODULES
2317static int nft_expr_type_request_module(struct net *net, u8 family,
2318 struct nlattr *nla)
2319{
2320 nft_request_module(net, "nft-expr-%u-%.*s", family,
2321 nla_len(nla), (char *)nla_data(nla));
2322 if (__nft_expr_type_get(family, nla))
2323 return -EAGAIN;
2324
2325 return 0;
2326}
2327#endif
2328
452238e8
FW		 2329static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2330 u8 family,
64d46806 2331 struct nlattr *nla)
96518518 2332{
ef1f7df9 2333 const struct nft_expr_type *type;
96518518
PM		 2334
2335 if (nla == NULL)
2336 return ERR_PTR(-EINVAL);
2337
64d46806 2338 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 2339 if (type != NULL && try_module_get(type->owner))
2340 return type;
96518518 2341
f102d66b 2342 lockdep_nfnl_nft_mutex_not_held();
96518518 2343#ifdef CONFIG_MODULES
ef1f7df9 2344 if (type == NULL) {
b9c04ae7 2345 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
64d46806
PM		 2346 return ERR_PTR(-EAGAIN);
2347
452238e8
FW		 2348 nft_request_module(net, "nft-expr-%.*s",
2349 nla_len(nla), (char *)nla_data(nla));
64d46806 2350 if (__nft_expr_type_get(family, nla))
96518518
PM		 2351 return ERR_PTR(-EAGAIN);
2352 }
2353#endif
2354 return ERR_PTR(-ENOENT);
2355}
2356
2357static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2358 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
2359 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2360};
2361
2362static int nf_tables_fill_expr_info(struct sk_buff *skb,
2363 const struct nft_expr *expr)
2364{
ef1f7df9 2365 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 2366 goto nla_put_failure;
2367
2368 if (expr->ops->dump) {
ae0be8de
MK		 2369 struct nlattr *data = nla_nest_start_noflag(skb,
2370 NFTA_EXPR_DATA);
96518518
PM		 2371 if (data == NULL)
2372 goto nla_put_failure;
2373 if (expr->ops->dump(skb, expr) < 0)
2374 goto nla_put_failure;
2375 nla_nest_end(skb, data);
2376 }
2377
2378 return skb->len;
2379
2380nla_put_failure:
2381 return -1;
2382};
2383
0b2d8a7b
PM		 2384int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2385 const struct nft_expr *expr)
2386{
2387 struct nlattr *nest;
2388
ae0be8de 2389 nest = nla_nest_start_noflag(skb, attr);
0b2d8a7b
PM		 2390 if (!nest)
2391 goto nla_put_failure;
2392 if (nf_tables_fill_expr_info(skb, expr) < 0)
2393 goto nla_put_failure;
2394 nla_nest_end(skb, nest);
2395 return 0;
2396
2397nla_put_failure:
2398 return -1;
2399}
2400
96518518
PM		 2401struct nft_expr_info {
2402 const struct nft_expr_ops *ops;
ef1f7df9 2403 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 2404};
2405
0ca743a5
PNA		 2406static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2407 const struct nlattr *nla,
96518518
PM		 2408 struct nft_expr_info *info)
2409{
ef1f7df9 2410 const struct nft_expr_type *type;
96518518 2411 const struct nft_expr_ops *ops;
ef1f7df9 2412 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 2413 int err;
2414
8cb08174
JB		 2415 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2416 nft_expr_policy, NULL);
96518518
PM		 2417 if (err < 0)
2418 return err;
2419
452238e8 2420 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 2421 if (IS_ERR(type))
2422 return PTR_ERR(type);
2423
2424 if (tb[NFTA_EXPR_DATA]) {
8cb08174
JB		 2425 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2426 tb[NFTA_EXPR_DATA],
2427 type->policy, NULL);
ef1f7df9
PM		 2428 if (err < 0)
2429 goto err1;
2430 } else
2431 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2432
2433 if (type->select_ops != NULL) {
0ca743a5
PNA		 2434 ops = type->select_ops(ctx,
2435 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 2436 if (IS_ERR(ops)) {
2437 err = PTR_ERR(ops);
0ef1efd1
PNA		 2438#ifdef CONFIG_MODULES
2439 if (err == -EAGAIN)
2440 nft_expr_type_request_module(ctx->net,
2441 ctx->family,
2442 tb[NFTA_EXPR_NAME]);
2443#endif
ef1f7df9
PM		 2444 goto err1;
2445 }
2446 } else
2447 ops = type->ops;
2448
96518518
PM		 2449 info->ops = ops;
2450 return 0;
ef1f7df9
PM		 2451
2452err1:
2453 module_put(type->owner);
2454 return err;
96518518
PM		 2455}
2456
2457static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 2458 const struct nft_expr_info *info,
96518518
PM		 2459 struct nft_expr *expr)
2460{
2461 const struct nft_expr_ops *ops = info->ops;
2462 int err;
2463
2464 expr->ops = ops;
2465 if (ops->init) {
ef1f7df9 2466 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 2467 if (err < 0)
2468 goto err1;
2469 }
2470
96518518 2471 return 0;
96518518
PM		 2472err1:
2473 expr->ops = NULL;
2474 return err;
2475}
2476
62472bce
PM		 2477static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2478 struct nft_expr *expr)
96518518 2479{
3f3a390d
PNA		 2480 const struct nft_expr_type *type = expr->ops->type;
2481
96518518 2482 if (expr->ops->destroy)
62472bce 2483 expr->ops->destroy(ctx, expr);
3f3a390d 2484 module_put(type->owner);
96518518
PM		 2485}
2486
0b2d8a7b
PM		 2487struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2488 const struct nlattr *nla)
2489{
2490 struct nft_expr_info info;
2491 struct nft_expr *expr;
b8e20400 2492 struct module *owner;
0b2d8a7b
PM		 2493 int err;
2494
2495 err = nf_tables_expr_parse(ctx, nla, &info);
2496 if (err < 0)
2497 goto err1;
2498
2499 err = -ENOMEM;
2500 expr = kzalloc(info.ops->size, GFP_KERNEL);
2501 if (expr == NULL)
2502 goto err2;
2503
2504 err = nf_tables_newexpr(ctx, &info, expr);
2505 if (err < 0)
6cafaf47 2506 goto err3;
0b2d8a7b
PM		 2507
2508 return expr;
6cafaf47
LZ		 2509err3:
2510 kfree(expr);
0b2d8a7b 2511err2:
b8e20400
PNA		 2512 owner = info.ops->type->owner;
2513 if (info.ops->type->release_ops)
2514 info.ops->type->release_ops(info.ops);
2515
2516 module_put(owner);
0b2d8a7b
PM		 2517err1:
2518 return ERR_PTR(err);
2519}
2520
2521void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2522{
2523 nf_tables_expr_destroy(ctx, expr);
2524 kfree(expr);
2525}
2526
96518518
PM		 2527/*
2528 * Rules
2529 */
2530
cac20fcd
PNA		 2531static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2532 u64 handle)
96518518
PM		 2533{
2534 struct nft_rule *rule;
2535
2536 // FIXME: this sucks
d9adf22a 2537 list_for_each_entry_rcu(rule, &chain->rules, list) {
96518518
PM		 2538 if (handle == rule->handle)
2539 return rule;
2540 }
2541
2542 return ERR_PTR(-ENOENT);
2543}
2544
cac20fcd
PNA		 2545static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2546 const struct nlattr *nla)
96518518
PM		 2547{
2548 if (nla == NULL)
2549 return ERR_PTR(-EINVAL);
2550
cac20fcd 2551 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
96518518
PM		 2552}
2553
2554static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 2555 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2556 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 2557 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2558 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2559 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2560 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 2561 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 2562 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 2563 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2564 .len = NFT_USERDATA_MAXLEN },
467697d2 2565 [NFTA_RULE_ID] = { .type = NLA_U32 },
0604628b 2566 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
96518518
PM		 2567};
2568
84d7fce6
PNA		 2569static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2570 u32 portid, u32 seq, int event,
2571 u32 flags, int family,
96518518
PM		 2572 const struct nft_table *table,
2573 const struct nft_chain *chain,
2c82c7e7
FW		 2574 const struct nft_rule *rule,
2575 const struct nft_rule *prule)
96518518
PM		 2576{
2577 struct nlmsghdr *nlh;
2578 struct nfgenmsg *nfmsg;
2579 const struct nft_expr *expr, *next;
2580 struct nlattr *list;
dedb67c4 2581 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 2582
dedb67c4 2583 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 2584 if (nlh == NULL)
2585 goto nla_put_failure;
2586
2587 nfmsg = nlmsg_data(nlh);
2588 nfmsg->nfgen_family = family;
2589 nfmsg->version = NFNETLINK_V0;
84d7fce6 2590 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 2591
2592 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2593 goto nla_put_failure;
2594 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2595 goto nla_put_failure;
b46f6ded
ND		 2596 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2597 NFTA_RULE_PAD))
96518518
PM		 2598 goto nla_put_failure;
2599
2c82c7e7 2600 if (event != NFT_MSG_DELRULE && prule) {
5e948466 2601 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 2602 cpu_to_be64(prule->handle),
2603 NFTA_RULE_PAD))
5e948466
EL		 2604 goto nla_put_failure;
2605 }
2606
ae0be8de 2607 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
96518518
PM		 2608 if (list == NULL)
2609 goto nla_put_failure;
2610 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 2611 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 2612 goto nla_put_failure;
96518518
PM		 2613 }
2614 nla_nest_end(skb, list);
2615
86f1ec32
PM		 2616 if (rule->udata) {
2617 struct nft_userdata *udata = nft_userdata(rule);
2618 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2619 udata->data) < 0)
2620 goto nla_put_failure;
2621 }
0768b3b3 2622
053c095a
JB		 2623 nlmsg_end(skb, nlh);
2624 return 0;
96518518
PM		 2625
2626nla_put_failure:
2627 nlmsg_trim(skb, nlh);
2628 return -1;
2629}
2630
25e94a99
PNA		 2631static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2632 const struct nft_rule *rule, int event)
96518518
PM		 2633{
2634 struct sk_buff *skb;
96518518
PM		 2635 int err;
2636
128ad332
PNA		 2637 if (!ctx->report &&
2638 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2639 return;
96518518 2640
96518518
PM		 2641 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2642 if (skb == NULL)
2643 goto err;
2644
84d7fce6 2645 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
36596dad 2646 event, 0, ctx->family, ctx->table,
2c82c7e7 2647 ctx->chain, rule, NULL);
96518518
PM		 2648 if (err < 0) {
2649 kfree_skb(skb);
2650 goto err;
2651 }
2652
25e94a99
PNA		 2653 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2654 ctx->report, GFP_KERNEL);
2655 return;
96518518 2656err:
25e94a99 2657 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2658}
2659
6e1f760e 2660struct nft_rule_dump_ctx {
e46abbcc 2661 char *table;
b7263e07 2662 char *chain;
6e1f760e
PNA		 2663};
2664
241faece
PS		 2665static int __nf_tables_dump_rules(struct sk_buff *skb,
2666 unsigned int *idx,
2667 struct netlink_callback *cb,
2668 const struct nft_table *table,
2669 const struct nft_chain *chain)
2670{
2671 struct net *net = sock_net(skb->sk);
2c82c7e7 2672 const struct nft_rule *rule, *prule;
241faece 2673 unsigned int s_idx = cb->args[0];
241faece 2674
2c82c7e7 2675 prule = NULL;
241faece
PS		 2676 list_for_each_entry_rcu(rule, &chain->rules, list) {
2677 if (!nft_is_active(net, rule))
2c82c7e7 2678 goto cont_skip;
241faece
PS		 2679 if (*idx < s_idx)
2680 goto cont;
2681 if (*idx > s_idx) {
2682 memset(&cb->args[1], 0,
2683 sizeof(cb->args) - sizeof(cb->args[0]));
2684 }
2685 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2686 cb->nlh->nlmsg_seq,
2687 NFT_MSG_NEWRULE,
2688 NLM_F_MULTI | NLM_F_APPEND,
2689 table->family,
2c82c7e7 2690 table, chain, rule, prule) < 0)
310529e6 2691 return 1;
241faece
PS		 2692
2693 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2694cont:
2c82c7e7
FW		 2695 prule = rule;
2696cont_skip:
241faece
PS		 2697 (*idx)++;
2698 }
310529e6 2699 return 0;
241faece
PS		 2700}
2701
96518518
PM		 2702static int nf_tables_dump_rules(struct sk_buff *skb,
2703 struct netlink_callback *cb)
2704{
2705 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2706 const struct nft_rule_dump_ctx *ctx = cb->data;
241faece 2707 struct nft_table *table;
96518518 2708 const struct nft_chain *chain;
241faece 2709 unsigned int idx = 0;
99633ab2 2710 struct net *net = sock_net(skb->sk);
96518518
PM		 2711 int family = nfmsg->nfgen_family;
2712
e688a7f8 2713 rcu_read_lock();
38e029f1
PNA		 2714 cb->seq = net->nft.base_seq;
2715
36596dad 2716 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 2717 if (family != NFPROTO_UNSPEC && family != table->family)
36596dad
PNA		 2718 continue;
2719
2720 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
96518518
PM		 2721 continue;
2722
715849ab 2723 if (ctx && ctx->table && ctx->chain) {
241faece 2724 struct rhlist_head *list, *tmp;
6e1f760e 2725
241faece
PS		 2726 list = rhltable_lookup(&table->chains_ht, ctx->chain,
2727 nft_chain_ht_params);
2728 if (!list)
2729 goto done;
2730
2731 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2732 if (!nft_is_active(net, chain))
2733 continue;
2734 __nf_tables_dump_rules(skb, &idx,
2735 cb, table, chain);
2736 break;
96518518 2737 }
241faece 2738 goto done;
96518518 2739 }
241faece
PS		 2740
2741 list_for_each_entry_rcu(chain, &table->chains, list) {
2742 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2743 goto done;
2744 }
2745
2746 if (ctx && ctx->table)
2747 break;
96518518
PM		 2748 }
2749done:
e688a7f8 2750 rcu_read_unlock();
310529e6
PS		 2751
2752 cb->args[0] = idx;
96518518
PM		 2753 return skb->len;
2754}
2755
90fd131a
FW		 2756static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2757{
2758 const struct nlattr * const *nla = cb->data;
2759 struct nft_rule_dump_ctx *ctx = NULL;
2760
2761 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2762 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2763 if (!ctx)
2764 return -ENOMEM;
2765
2766 if (nla[NFTA_RULE_TABLE]) {
2767 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2768 GFP_ATOMIC);
2769 if (!ctx->table) {
2770 kfree(ctx);
2771 return -ENOMEM;
2772 }
2773 }
2774 if (nla[NFTA_RULE_CHAIN]) {
2775 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2776 GFP_ATOMIC);
2777 if (!ctx->chain) {
2778 kfree(ctx->table);
2779 kfree(ctx);
2780 return -ENOMEM;
2781 }
2782 }
2783 }
2784
2785 cb->data = ctx;
2786 return 0;
2787}
2788
6e1f760e
PNA		 2789static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2790{
e46abbcc
PS		 2791 struct nft_rule_dump_ctx *ctx = cb->data;
2792
2793 if (ctx) {
2794 kfree(ctx->table);
b7263e07 2795 kfree(ctx->chain);
e46abbcc
PS		 2796 kfree(ctx);
2797 }
6e1f760e
PNA		 2798 return 0;
2799}
2800
d9adf22a 2801/* called with rcu_read_lock held */
7b8002a1
PNA		 2802static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2803 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2804 const struct nlattr * const nla[],
2805 struct netlink_ext_ack *extack)
96518518
PM		 2806{
2807 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2808 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2809 const struct nft_chain *chain;
2810 const struct nft_rule *rule;
1b2470e5 2811 struct nft_table *table;
96518518
PM		 2812 struct sk_buff *skb2;
2813 int family = nfmsg->nfgen_family;
2814 int err;
2815
2816 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2817 struct netlink_dump_control c = {
90fd131a 2818 .start= nf_tables_dump_rules_start,
96518518 2819 .dump = nf_tables_dump_rules,
6e1f760e 2820 .done = nf_tables_dump_rules_done,
d9adf22a 2821 .module = THIS_MODULE,
90fd131a 2822 .data = (void *)nla,
96518518 2823 };
6e1f760e 2824
d9adf22a 2825 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
96518518
PM		 2826 }
2827
cac20fcd 2828 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2829 if (IS_ERR(table)) {
2830 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2831 return PTR_ERR(table);
36dd1bcc 2832 }
96518518 2833
f102d66b 2834 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2835 if (IS_ERR(chain)) {
2836 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2837 return PTR_ERR(chain);
36dd1bcc 2838 }
96518518 2839
cac20fcd 2840 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 2841 if (IS_ERR(rule)) {
2842 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2843 return PTR_ERR(rule);
36dd1bcc 2844 }
96518518 2845
d9adf22a 2846 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
96518518
PM		 2847 if (!skb2)
2848 return -ENOMEM;
2849
84d7fce6 2850 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518 2851 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2c82c7e7 2852 family, table, chain, rule, NULL);
96518518
PM		 2853 if (err < 0)
2854 goto err;
2855
2856 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2857
2858err:
2859 kfree_skb(skb2);
2860 return err;
2861}
2862
62472bce
PM		 2863static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2864 struct nft_rule *rule)
96518518 2865{
29e38801 2866 struct nft_expr *expr, *next;
96518518
PM		 2867
2868 /*
2869 * Careful: some expressions might not be initialized in case this
2870 * is called on error from nf_tables_newrule().
2871 */
2872 expr = nft_expr_first(rule);
3e38df13 2873 while (expr != nft_expr_last(rule) && expr->ops) {
29e38801 2874 next = nft_expr_next(expr);
62472bce 2875 nf_tables_expr_destroy(ctx, expr);
29e38801 2876 expr = next;
96518518
PM		 2877 }
2878 kfree(rule);
2879}
2880
bb7b40ae
PNA		 2881static void nf_tables_rule_release(const struct nft_ctx *ctx,
2882 struct nft_rule *rule)
2883{
f6ac8585 2884 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
bb7b40ae
PNA		 2885 nf_tables_rule_destroy(ctx, rule);
2886}
2887
a654de8f
PNA		 2888int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2889{
2890 struct nft_expr *expr, *last;
2891 const struct nft_data *data;
2892 struct nft_rule *rule;
2893 int err;
2894
26b2f552
TY		 2895 if (ctx->level == NFT_JUMP_STACK_SIZE)
2896 return -EMLINK;
2897
a654de8f
PNA		 2898 list_for_each_entry(rule, &chain->rules, list) {
2899 if (!nft_is_active_next(ctx->net, rule))
2900 continue;
2901
2902 nft_rule_for_each_expr(expr, last, rule) {
2903 if (!expr->ops->validate)
2904 continue;
2905
2906 err = expr->ops->validate(ctx, expr, &data);
2907 if (err < 0)
2908 return err;
2909 }
2910 }
2911
2912 return 0;
2913}
2914EXPORT_SYMBOL_GPL(nft_chain_validate);
2915
2916static int nft_table_validate(struct net *net, const struct nft_table *table)
2917{
2918 struct nft_chain *chain;
2919 struct nft_ctx ctx = {
2920 .net = net,
2921 .family = table->family,
2922 };
2923 int err;
2924
2925 list_for_each_entry(chain, &table->chains, list) {
2926 if (!nft_is_base_chain(chain))
2927 continue;
2928
2929 ctx.chain = chain;
2930 err = nft_chain_validate(&ctx, chain);
2931 if (err < 0)
2932 return err;
2933 }
2934
2935 return 0;
2936}
2937
75dd48e2
PS		 2938static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2939 const struct nlattr *nla);
2940
1081d11b
PNA		 2941#define NFT_RULE_MAXEXPRS 128
2942
633c9a84
PNA		 2943static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2944 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2945 const struct nlattr * const nla[],
2946 struct netlink_ext_ack *extack)
96518518
PM		 2947{
2948 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2949 u8 genmask = nft_genmask_next(net);
2a43ecf9 2950 struct nft_expr_info *info = NULL;
98319cb9 2951 int family = nfmsg->nfgen_family;
c9626a2c 2952 struct nft_flow_rule *flow;
96518518
PM		 2953 struct nft_table *table;
2954 struct nft_chain *chain;
2955 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2956 struct nft_userdata *udata;
1081d11b 2957 struct nft_trans *trans = NULL;
96518518
PM		 2958 struct nft_expr *expr;
2959 struct nft_ctx ctx;
2960 struct nlattr *tmp;
86f1ec32 2961 unsigned int size, i, n, ulen = 0, usize = 0;
96518518 2962 int err, rem;
5e948466 2963 u64 handle, pos_handle;
96518518 2964
f102d66b
FW		 2965 lockdep_assert_held(&net->nft.commit_mutex);
2966
cac20fcd 2967 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 2968 if (IS_ERR(table)) {
2969 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 2970 return PTR_ERR(table);
36dd1bcc 2971 }
96518518 2972
f102d66b 2973 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
36dd1bcc
PNA		 2974 if (IS_ERR(chain)) {
2975 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
96518518 2976 return PTR_ERR(chain);
36dd1bcc 2977 }
96518518
PM		 2978
2979 if (nla[NFTA_RULE_HANDLE]) {
2980 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
cac20fcd 2981 rule = __nft_rule_lookup(chain, handle);
36dd1bcc
PNA		 2982 if (IS_ERR(rule)) {
2983 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2984 return PTR_ERR(rule);
36dd1bcc 2985 }
96518518 2986
36dd1bcc
PNA		 2987 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2988 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
96518518 2989 return -EEXIST;
36dd1bcc 2990 }
96518518
PM		 2991 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2992 old_rule = rule;
2993 else
2994 return -EOPNOTSUPP;
2995 } else {
445509eb
PNA		 2996 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
2997 nlh->nlmsg_flags & NLM_F_REPLACE)
96518518
PM		 2998 return -EINVAL;
2999 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 3000
3001 if (chain->use == UINT_MAX)
3002 return -EOVERFLOW;
5e948466 3003
447750f2
FW		 3004 if (nla[NFTA_RULE_POSITION]) {
3005 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
3006 old_rule = __nft_rule_lookup(chain, pos_handle);
3007 if (IS_ERR(old_rule)) {
3008 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
3009 return PTR_ERR(old_rule);
3010 }
75dd48e2
PS		 3011 } else if (nla[NFTA_RULE_POSITION_ID]) {
3012 old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
3013 if (IS_ERR(old_rule)) {
3014 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
3015 return PTR_ERR(old_rule);
3016 }
36dd1bcc 3017 }
5e948466
EL		 3018 }
3019
98319cb9 3020 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0ca743a5 3021
96518518
PM		 3022 n = 0;
3023 size = 0;
3024 if (nla[NFTA_RULE_EXPRESSIONS]) {
2a43ecf9
FW		 3025 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
3026 sizeof(struct nft_expr_info),
3027 GFP_KERNEL);
3028 if (!info)
3029 return -ENOMEM;
3030
96518518
PM		 3031 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
3032 err = -EINVAL;
3033 if (nla_type(tmp) != NFTA_LIST_ELEM)
3034 goto err1;
3035 if (n == NFT_RULE_MAXEXPRS)
3036 goto err1;
0ca743a5 3037 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 3038 if (err < 0)
3039 goto err1;
3040 size += info[n].ops->size;
3041 n++;
3042 }
3043 }
9889840f
PM		 3044 /* Check for overflow of dlen field */
3045 err = -EFBIG;
3046 if (size >= 1 << 12)
3047 goto err1;
96518518 3048
86f1ec32 3049 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 3050 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 3051 if (ulen > 0)
3052 usize = sizeof(struct nft_userdata) + ulen;
3053 }
0768b3b3 3054
96518518 3055 err = -ENOMEM;
86f1ec32 3056 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 3057 if (rule == NULL)
3058 goto err1;
3059
889f7ee7 3060 nft_activate_next(net, rule);
0628b123 3061
96518518
PM		 3062 rule->handle = handle;
3063 rule->dlen = size;
86f1ec32 3064 rule->udata = ulen ? 1 : 0;
0768b3b3 3065
86f1ec32
PM		 3066 if (ulen) {
3067 udata = nft_userdata(rule);
3068 udata->len = ulen - 1;
3069 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
3070 }
96518518 3071
96518518
PM		 3072 expr = nft_expr_first(rule);
3073 for (i = 0; i < n; i++) {
3074 err = nf_tables_newexpr(&ctx, &info[i], expr);
3075 if (err < 0)
3076 goto err2;
a654de8f
PNA		 3077
3078 if (info[i].ops->validate)
3079 nft_validate_state_update(net, NFT_VALIDATE_NEED);
3080
ef1f7df9 3081 info[i].ops = NULL;
96518518
PM		 3082 expr = nft_expr_next(expr);
3083 }
3084
96518518 3085 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
ca089878 3086 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
569ccae6
FW		 3087 if (trans == NULL) {
3088 err = -ENOMEM;
3089 goto err2;
3090 }
ca089878
TY		 3091 err = nft_delrule(&ctx, old_rule);
3092 if (err < 0) {
3093 nft_trans_destroy(trans);
569ccae6
FW		 3094 goto err2;
3095 }
3096
3097 list_add_tail_rcu(&rule->list, &old_rule->list);
3098 } else {
c9626a2c
PNA		 3099 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3100 if (!trans) {
569ccae6
FW		 3101 err = -ENOMEM;
3102 goto err2;
3103 }
3104
3105 if (nlh->nlmsg_flags & NLM_F_APPEND) {
3106 if (old_rule)
3107 list_add_rcu(&rule->list, &old_rule->list);
3108 else
3109 list_add_tail_rcu(&rule->list, &chain->rules);
3110 } else {
3111 if (old_rule)
3112 list_add_tail_rcu(&rule->list, &old_rule->list);
3113 else
3114 list_add_rcu(&rule->list, &chain->rules);
3115 }
0628b123 3116 }
2a43ecf9 3117 kvfree(info);
4fefee57 3118 chain->use++;
96518518 3119
a654de8f
PNA		 3120 if (net->nft.validate_state == NFT_VALIDATE_DO)
3121 return nft_table_validate(net, table);
3122
c9626a2c 3123 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
be2861dc 3124 flow = nft_flow_rule_create(net, rule);
c9626a2c
PNA		 3125 if (IS_ERR(flow))
3126 return PTR_ERR(flow);
3127
3128 nft_trans_flow_rule(trans) = flow;
3129 }
3130
a654de8f 3131 return 0;
96518518 3132err2:
bb7b40ae 3133 nf_tables_rule_release(&ctx, rule);
96518518
PM		 3134err1:
3135 for (i = 0; i < n; i++) {
b25a31bf 3136 if (info[i].ops) {
ef1f7df9 3137 module_put(info[i].ops->type->owner);
b25a31bf
TY		 3138 if (info[i].ops->type->release_ops)
3139 info[i].ops->type->release_ops(info[i].ops);
3140 }
96518518 3141 }
2a43ecf9 3142 kvfree(info);
96518518
PM		 3143 return err;
3144}
3145
1a94e38d
PNA		 3146static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3147 const struct nlattr *nla)
3148{
3149 u32 id = ntohl(nla_get_be32(nla));
3150 struct nft_trans *trans;
3151
3152 list_for_each_entry(trans, &net->nft.commit_list, list) {
3153 struct nft_rule *rule = nft_trans_rule(trans);
3154
3155 if (trans->msg_type == NFT_MSG_NEWRULE &&
3156 id == nft_trans_rule_id(trans))
3157 return rule;
3158 }
3159 return ERR_PTR(-ENOENT);
3160}
3161
633c9a84
PNA		 3162static int nf_tables_delrule(struct net *net, struct sock *nlsk,
3163 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3164 const struct nlattr * const nla[],
3165 struct netlink_ext_ack *extack)
96518518
PM		 3166{
3167 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3168 u8 genmask = nft_genmask_next(net);
7c95f6d8 3169 struct nft_table *table;
cf9dc09d
PNA		 3170 struct nft_chain *chain = NULL;
3171 struct nft_rule *rule;
0628b123
PNA		 3172 int family = nfmsg->nfgen_family, err = 0;
3173 struct nft_ctx ctx;
96518518 3174
cac20fcd 3175 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
36dd1bcc
PNA		 3176 if (IS_ERR(table)) {
3177 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
96518518 3178 return PTR_ERR(table);
36dd1bcc 3179 }
96518518 3180
cf9dc09d 3181 if (nla[NFTA_RULE_CHAIN]) {
f102d66b
FW		 3182 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3183 genmask);
36dd1bcc
PNA		 3184 if (IS_ERR(chain)) {
3185 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
cf9dc09d 3186 return PTR_ERR(chain);
36dd1bcc 3187 }
cf9dc09d 3188 }
96518518 3189
98319cb9 3190 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
0628b123 3191
cf9dc09d
PNA		 3192 if (chain) {
3193 if (nla[NFTA_RULE_HANDLE]) {
cac20fcd 3194 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
36dd1bcc
PNA		 3195 if (IS_ERR(rule)) {
3196 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
cf9dc09d 3197 return PTR_ERR(rule);
36dd1bcc 3198 }
96518518 3199
1a94e38d
PNA		 3200 err = nft_delrule(&ctx, rule);
3201 } else if (nla[NFTA_RULE_ID]) {
3202 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
36dd1bcc
PNA		 3203 if (IS_ERR(rule)) {
3204 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
1a94e38d 3205 return PTR_ERR(rule);
36dd1bcc 3206 }
1a94e38d 3207
5e266fe7 3208 err = nft_delrule(&ctx, rule);
cf9dc09d 3209 } else {
ce24b721 3210 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 3211 }
3212 } else {
3213 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 3214 if (!nft_is_active_next(net, chain))
3215 continue;
3216
cf9dc09d 3217 ctx.chain = chain;
ce24b721 3218 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 3219 if (err < 0)
3220 break;
3221 }
3222 }
3223
3224 return err;
3225}
3226
20a69341
PM		 3227/*
3228 * Sets
3229 */
3230
2b664957 3231static LIST_HEAD(nf_tables_set_types);
20a69341 3232
2b664957 3233int nft_register_set(struct nft_set_type *type)
20a69341
PM		 3234{
3235 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 3236 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 3237 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
3238 return 0;
3239}
3240EXPORT_SYMBOL_GPL(nft_register_set);
3241
2b664957 3242void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 3243{
3244 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 3245 list_del_rcu(&type->list);
20a69341
PM		 3246 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
3247}
3248EXPORT_SYMBOL_GPL(nft_unregister_set);
3249
2b664957 3250#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
71cc0873
PS		 3251 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3252 NFT_SET_EVAL)
2b664957 3253
71cc0873 3254static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2b664957 3255{
71cc0873 3256 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2b664957
PNA		 3257}
3258
c50b960c
PM		 3259/*
3260 * Select a set implementation based on the data characteristics and the
3261 * given policy. The total memory use might not be known if no size is
3262 * given, in that case the amount of memory per element is used.
3263 */
3264static const struct nft_set_ops *
2b664957
PNA		 3265nft_select_set_ops(const struct nft_ctx *ctx,
3266 const struct nlattr * const nla[],
c50b960c
PM		 3267 const struct nft_set_desc *desc,
3268 enum nft_set_policies policy)
20a69341 3269{
c50b960c
PM		 3270 const struct nft_set_ops *ops, *bops;
3271 struct nft_set_estimate est, best;
2b664957
PNA		 3272 const struct nft_set_type *type;
3273 u32 flags = 0;
20a69341 3274
f102d66b
FW		 3275 lockdep_assert_held(&ctx->net->nft.commit_mutex);
3276 lockdep_nfnl_nft_mutex_not_held();
20a69341 3277#ifdef CONFIG_MODULES
2b664957 3278 if (list_empty(&nf_tables_set_types)) {
452238e8 3279 nft_request_module(ctx->net, "nft-set");
2b664957 3280 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 3281 return ERR_PTR(-EAGAIN);
3282 }
3283#endif
2b664957
PNA		 3284 if (nla[NFTA_SET_FLAGS] != NULL)
3285 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 3286
55af753c
PNA		 3287 bops = NULL;
3288 best.size = ~0;
3289 best.lookup = ~0;
0b5a7874 3290 best.space = ~0;
c50b960c 3291
2b664957 3292 list_for_each_entry(type, &nf_tables_set_types, list) {
71cc0873 3293 ops = &type->ops;
2b664957 3294
71cc0873 3295 if (!nft_set_ops_candidate(type, flags))
20a69341 3296 continue;
2b664957 3297 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 3298 continue;
3299
3300 switch (policy) {
3301 case NFT_SET_POL_PERFORMANCE:
55af753c 3302 if (est.lookup < best.lookup)
c50b960c 3303 break;
644e334e
PNA		 3304 if (est.lookup == best.lookup &&
3305 est.space < best.space)
3306 break;
c50b960c
PM		 3307 continue;
3308 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 3309 if (!desc->size) {
3310 if (est.space < best.space)
3311 break;
3312 if (est.space == best.space &&
3313 est.lookup < best.lookup)
3314 break;
4f2921ca 3315 } else if (est.size < best.size || !bops) {
c50b960c 3316 break;
0b5a7874 3317 }
c50b960c
PM		 3318 continue;
3319 default:
3320 break;
3321 }
3322
2b664957 3323 if (!try_module_get(type->owner))
20a69341 3324 continue;
c50b960c 3325 if (bops != NULL)
71cc0873 3326 module_put(to_set_type(bops)->owner);
c50b960c
PM		 3327
3328 bops = ops;
3329 best = est;
20a69341
PM		 3330 }
3331
c50b960c
PM		 3332 if (bops != NULL)
3333 return bops;
3334
20a69341
PM		 3335 return ERR_PTR(-EOPNOTSUPP);
3336}
3337
3338static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 3339 [NFTA_SET_TABLE] = { .type = NLA_STRING,
3340 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 3341 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 3342 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 3343 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
3344 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
3345 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
3346 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
3347 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 3348 [NFTA_SET_POLICY] = { .type = NLA_U32 },
3349 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 3350 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 3351 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
3352 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 3353 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
3354 .len = NFT_USERDATA_MAXLEN },
8aeff920 3355 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3ecbfd65 3356 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
c50b960c
PM		 3357};
3358
3359static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3360 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 3361};
3362
633c9a84 3363static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3364 const struct sk_buff *skb,
3365 const struct nlmsghdr *nlh,
f2a6d766 3366 const struct nlattr * const nla[],
36dd1bcc 3367 struct netlink_ext_ack *extack,
f2a6d766 3368 u8 genmask)
20a69341
PM		 3369{
3370 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 3371 int family = nfmsg->nfgen_family;
7c95f6d8 3372 struct nft_table *table = NULL;
20a69341 3373
20a69341 3374 if (nla[NFTA_SET_TABLE] != NULL) {
cac20fcd
PNA		 3375 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3376 genmask);
36dd1bcc
PNA		 3377 if (IS_ERR(table)) {
3378 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3379 return PTR_ERR(table);
36dd1bcc 3380 }
20a69341
PM		 3381 }
3382
98319cb9 3383 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 3384 return 0;
3385}
3386
cac20fcd
PNA		 3387static struct nft_set *nft_set_lookup(const struct nft_table *table,
3388 const struct nlattr *nla, u8 genmask)
20a69341
PM		 3389{
3390 struct nft_set *set;
3391
3392 if (nla == NULL)
3393 return ERR_PTR(-EINVAL);
3394
d9adf22a 3395 list_for_each_entry_rcu(set, &table->sets, list) {
37a9cc52
PNA		 3396 if (!nla_strcmp(nla, set->name) &&
3397 nft_active_genmask(set, genmask))
20a69341
PM		 3398 return set;
3399 }
3400 return ERR_PTR(-ENOENT);
3401}
3402
cac20fcd
PNA		 3403static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3404 const struct nlattr *nla,
3405 u8 genmask)
3ecbfd65
HS		 3406{
3407 struct nft_set *set;
3408
3ecbfd65
HS		 3409 list_for_each_entry(set, &table->sets, list) {
3410 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3411 nft_active_genmask(set, genmask))
3412 return set;
3413 }
3414 return ERR_PTR(-ENOENT);
3415}
3416
cac20fcd
PNA		 3417static struct nft_set *nft_set_lookup_byid(const struct net *net,
3418 const struct nlattr *nla, u8 genmask)
958bee14
PNA		 3419{
3420 struct nft_trans *trans;
3421 u32 id = ntohl(nla_get_be32(nla));
3422
3423 list_for_each_entry(trans, &net->nft.commit_list, list) {
9c7f96fd
AK		 3424 if (trans->msg_type == NFT_MSG_NEWSET) {
3425 struct nft_set *set = nft_trans_set(trans);
37a9cc52 3426
9c7f96fd
AK		 3427 if (id == nft_trans_set_id(trans) &&
3428 nft_active_genmask(set, genmask))
3429 return set;
3430 }
958bee14
PNA		 3431 }
3432 return ERR_PTR(-ENOENT);
3433}
c7a72e3f 3434
10659cba
PNA		 3435struct nft_set *nft_set_lookup_global(const struct net *net,
3436 const struct nft_table *table,
3437 const struct nlattr *nla_set_name,
3438 const struct nlattr *nla_set_id,
3439 u8 genmask)
c7a72e3f
PNA		 3440{
3441 struct nft_set *set;
3442
cac20fcd 3443 set = nft_set_lookup(table, nla_set_name, genmask);
c7a72e3f
PNA		 3444 if (IS_ERR(set)) {
3445 if (!nla_set_id)
3446 return set;
3447
cac20fcd 3448 set = nft_set_lookup_byid(net, nla_set_id, genmask);
c7a72e3f
PNA		 3449 }
3450 return set;
3451}
10659cba 3452EXPORT_SYMBOL_GPL(nft_set_lookup_global);
958bee14 3453
20a69341
PM		 3454static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3455 const char *name)
3456{
3457 const struct nft_set *i;
3458 const char *p;
3459 unsigned long *inuse;
60eb1894 3460 unsigned int n = 0, min = 0;
20a69341 3461
38745490 3462 p = strchr(name, '%');
20a69341
PM		 3463 if (p != NULL) {
3464 if (p[1] != 'd' || strchr(p + 2, '%'))
3465 return -EINVAL;
3466
3467 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3468 if (inuse == NULL)
3469 return -ENOMEM;
60eb1894 3470cont:
20a69341 3471 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 3472 int tmp;
3473
37a9cc52
PNA		 3474 if (!nft_is_active_next(ctx->net, set))
3475 continue;
14662917 3476 if (!sscanf(i->name, name, &tmp))
20a69341 3477 continue;
60eb1894 3478 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 3479 continue;
14662917 3480
60eb1894 3481 set_bit(tmp - min, inuse);
20a69341
PM		 3482 }
3483
53b70287 3484 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 3485 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3486 min += BITS_PER_BYTE * PAGE_SIZE;
3487 memset(inuse, 0, PAGE_SIZE);
3488 goto cont;
3489 }
20a69341
PM		 3490 free_page((unsigned long)inuse);
3491 }
3492
38745490
PS		 3493 set->name = kasprintf(GFP_KERNEL, name, min + n);
3494 if (!set->name)
3495 return -ENOMEM;
3496
20a69341 3497 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 3498 if (!nft_is_active_next(ctx->net, i))
3499 continue;
e63aaaa6
AY		 3500 if (!strcmp(set->name, i->name)) {
3501 kfree(set->name);
20a69341 3502 return -ENFILE;
e63aaaa6 3503 }
20a69341
PM		 3504 }
3505 return 0;
3506}
3507
8e1102d5
FW		 3508static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3509{
3510 u64 ms = be64_to_cpu(nla_get_be64(nla));
3511 u64 max = (u64)(~((u64)0));
3512
3513 max = div_u64(max, NSEC_PER_MSEC);
3514 if (ms >= max)
3515 return -ERANGE;
3516
3517 ms *= NSEC_PER_MSEC;
3518 *result = nsecs_to_jiffies64(ms);
3519 return 0;
3520}
3521
d6501de8 3522static __be64 nf_jiffies64_to_msecs(u64 input)
8e1102d5 3523{
3b15d09f 3524 return cpu_to_be64(jiffies64_to_msecs(input));
8e1102d5
FW		 3525}
3526
20a69341
PM		 3527static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3528 const struct nft_set *set, u16 event, u16 flags)
3529{
3530 struct nfgenmsg *nfmsg;
3531 struct nlmsghdr *nlh;
c50b960c 3532 struct nlattr *desc;
128ad332
PNA		 3533 u32 portid = ctx->portid;
3534 u32 seq = ctx->seq;
20a69341 3535
dedb67c4 3536 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 3537 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3538 flags);
3539 if (nlh == NULL)
3540 goto nla_put_failure;
3541
3542 nfmsg = nlmsg_data(nlh);
36596dad 3543 nfmsg->nfgen_family = ctx->family;
20a69341 3544 nfmsg->version = NFNETLINK_V0;
84d7fce6 3545 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 3546
3547 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3548 goto nla_put_failure;
3549 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3550 goto nla_put_failure;
3ecbfd65
HS		 3551 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3552 NFTA_SET_PAD))
3553 goto nla_put_failure;
20a69341
PM		 3554 if (set->flags != 0)
3555 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3556 goto nla_put_failure;
3557
3558 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3559 goto nla_put_failure;
3560 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3561 goto nla_put_failure;
3562 if (set->flags & NFT_SET_MAP) {
3563 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3564 goto nla_put_failure;
3565 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3566 goto nla_put_failure;
3567 }
8aeff920
PNA		 3568 if (set->flags & NFT_SET_OBJECT &&
3569 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3570 goto nla_put_failure;
20a69341 3571
761da293 3572 if (set->timeout &&
d3e2a111 3573 nla_put_be64(skb, NFTA_SET_TIMEOUT,
8e1102d5 3574 nf_jiffies64_to_msecs(set->timeout),
b46f6ded 3575 NFTA_SET_PAD))
761da293
PM		 3576 goto nla_put_failure;
3577 if (set->gc_int &&
3578 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3579 goto nla_put_failure;
3580
9363dc4b
AB		 3581 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3582 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3583 goto nla_put_failure;
3584 }
3585
e6d8ecac
CFG		 3586 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3587 goto nla_put_failure;
3588
ae0be8de 3589 desc = nla_nest_start_noflag(skb, NFTA_SET_DESC);
c50b960c
PM		 3590 if (desc == NULL)
3591 goto nla_put_failure;
3592 if (set->size &&
3593 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3594 goto nla_put_failure;
3595 nla_nest_end(skb, desc);
3596
053c095a
JB		 3597 nlmsg_end(skb, nlh);
3598 return 0;
20a69341
PM		 3599
3600nla_put_failure:
3601 nlmsg_trim(skb, nlh);
3602 return -1;
3603}
3604
25e94a99
PNA		 3605static void nf_tables_set_notify(const struct nft_ctx *ctx,
3606 const struct nft_set *set, int event,
3607 gfp_t gfp_flags)
20a69341
PM		 3608{
3609 struct sk_buff *skb;
128ad332 3610 u32 portid = ctx->portid;
20a69341
PM		 3611 int err;
3612
128ad332
PNA		 3613 if (!ctx->report &&
3614 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 3615 return;
20a69341 3616
31f8441c 3617 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 3618 if (skb == NULL)
3619 goto err;
3620
3621 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3622 if (err < 0) {
3623 kfree_skb(skb);
3624 goto err;
3625 }
3626
25e94a99
PNA		 3627 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3628 gfp_flags);
3629 return;
20a69341 3630err:
25e94a99 3631 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 3632}
3633
5b96af77 3634static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 3635{
3636 const struct nft_set *set;
3637 unsigned int idx, s_idx = cb->args[0];
c9c8e485
PNA		 3638 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3639 struct net *net = sock_net(skb->sk);
5b96af77 3640 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 3641
3642 if (cb->args[1])
3643 return skb->len;
3644
e688a7f8 3645 rcu_read_lock();
38e029f1
PNA		 3646 cb->seq = net->nft.base_seq;
3647
36596dad
PNA		 3648 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3649 if (ctx->family != NFPROTO_UNSPEC &&
98319cb9 3650 ctx->family != table->family)
36596dad
PNA		 3651 continue;
3652
3653 if (ctx->table && ctx->table != table)
5b96af77
PNA		 3654 continue;
3655
36596dad
PNA		 3656 if (cur_table) {
3657 if (cur_table != table)
c9c8e485
PNA		 3658 continue;
3659
36596dad 3660 cur_table = NULL;
c9c8e485 3661 }
36596dad
PNA		 3662 idx = 0;
3663 list_for_each_entry_rcu(set, &table->sets, list) {
3664 if (idx < s_idx)
3665 goto cont;
3666 if (!nft_is_active(net, set))
3667 goto cont;
5b96af77 3668
36596dad
PNA		 3669 ctx_set = *ctx;
3670 ctx_set.table = table;
98319cb9 3671 ctx_set.family = table->family;
c9c8e485 3672
36596dad
PNA		 3673 if (nf_tables_fill_set(skb, &ctx_set, set,
3674 NFT_MSG_NEWSET,
3675 NLM_F_MULTI) < 0) {
3676 cb->args[0] = idx;
3677 cb->args[2] = (unsigned long) table;
3678 goto done;
c9c8e485 3679 }
36596dad 3680 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485 3681cont:
36596dad 3682 idx++;
c9c8e485 3683 }
36596dad
PNA		 3684 if (s_idx)
3685 s_idx = 0;
c9c8e485
PNA		 3686 }
3687 cb->args[1] = 1;
3688done:
e688a7f8 3689 rcu_read_unlock();
c9c8e485
PNA		 3690 return skb->len;
3691}
3692
90fd131a
FW		 3693static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3694{
3695 struct nft_ctx *ctx_dump = NULL;
3696
3697 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3698 if (ctx_dump == NULL)
3699 return -ENOMEM;
3700
3701 cb->data = ctx_dump;
3702 return 0;
3703}
3704
5b96af77 3705static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 3706{
5b96af77
PNA		 3707 kfree(cb->data);
3708 return 0;
20a69341
PM		 3709}
3710
d9adf22a 3711/* called with rcu_read_lock held */
7b8002a1
PNA		 3712static int nf_tables_getset(struct net *net, struct sock *nlsk,
3713 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3714 const struct nlattr * const nla[],
3715 struct netlink_ext_ack *extack)
20a69341 3716{
f2a6d766 3717 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3718 const struct nft_set *set;
3719 struct nft_ctx ctx;
3720 struct sk_buff *skb2;
c9c8e485 3721 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 3722 int err;
3723
01cfa0a4 3724 /* Verify existence before starting dump */
36dd1bcc
PNA		 3725 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3726 genmask);
20a69341
PM		 3727 if (err < 0)
3728 return err;
3729
3730 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3731 struct netlink_dump_control c = {
90fd131a 3732 .start = nf_tables_dump_sets_start,
20a69341 3733 .dump = nf_tables_dump_sets,
5b96af77 3734 .done = nf_tables_dump_sets_done,
90fd131a 3735 .data = &ctx,
d9adf22a 3736 .module = THIS_MODULE,
20a69341 3737 };
5b96af77 3738
d9adf22a 3739 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
20a69341
PM		 3740 }
3741
c9c8e485
PNA		 3742 /* Only accept unspec with dump */
3743 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3744 return -EAFNOSUPPORT;
eaa2bcd6
PT		 3745 if (!nla[NFTA_SET_TABLE])
3746 return -EINVAL;
c9c8e485 3747
cac20fcd 3748 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3749 if (IS_ERR(set))
3750 return PTR_ERR(set);
3751
d9adf22a 3752 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
20a69341
PM		 3753 if (skb2 == NULL)
3754 return -ENOMEM;
3755
3756 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3757 if (err < 0)
3758 goto err;
3759
3760 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3761
3762err:
3763 kfree_skb(skb2);
3764 return err;
3765}
3766
f7e840ee 3767static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
c50b960c
PM		 3768 const struct nlattr *nla)
3769{
3770 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3771 int err;
3772
8cb08174
JB		 3773 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
3774 nft_set_desc_policy, NULL);
c50b960c
PM		 3775 if (err < 0)
3776 return err;
3777
3778 if (da[NFTA_SET_DESC_SIZE] != NULL)
3779 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3780
3781 return 0;
3782}
3783
633c9a84
PNA		 3784static int nf_tables_newset(struct net *net, struct sock *nlsk,
3785 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3786 const struct nlattr * const nla[],
3787 struct netlink_ext_ack *extack)
20a69341
PM		 3788{
3789 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3790 u8 genmask = nft_genmask_next(net);
98319cb9 3791 int family = nfmsg->nfgen_family;
20a69341 3792 const struct nft_set_ops *ops;
20a69341
PM		 3793 struct nft_table *table;
3794 struct nft_set *set;
3795 struct nft_ctx ctx;
38745490 3796 char *name;
4ef360dd 3797 u64 size;
761da293 3798 u64 timeout;
8aeff920 3799 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3800 struct nft_set_desc desc;
e6d8ecac
CFG		 3801 unsigned char *udata;
3802 u16 udlen;
20a69341
PM		 3803 int err;
3804
3805 if (nla[NFTA_SET_TABLE] == NULL ||
3806 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3807 nla[NFTA_SET_KEY_LEN] == NULL ||
3808 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3809 return -EINVAL;
3810
c50b960c
PM		 3811 memset(&desc, 0, sizeof(desc));
3812
20a69341
PM		 3813 ktype = NFT_DATA_VALUE;
3814 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3815 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3816 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3817 return -EINVAL;
3818 }
3819
c50b960c 3820 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3821 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3822 return -EINVAL;
3823
3824 flags = 0;
3825 if (nla[NFTA_SET_FLAGS] != NULL) {
3826 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3827 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3828 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3829 NFT_SET_MAP | NFT_SET_EVAL |
3830 NFT_SET_OBJECT))
20a69341 3831 return -EINVAL;
8aeff920 3832 /* Only one of these operations is supported */
acab7131
FW		 3833 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
3834 (NFT_SET_MAP | NFT_SET_OBJECT))
3835 return -EOPNOTSUPP;
3836 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3837 (NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3838 return -EOPNOTSUPP;
20a69341
PM		 3839 }
3840
3841 dtype = 0;
20a69341
PM		 3842 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3843 if (!(flags & NFT_SET_MAP))
3844 return -EINVAL;
3845
3846 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3847 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3848 dtype != NFT_DATA_VERDICT)
3849 return -EINVAL;
3850
3851 if (dtype != NFT_DATA_VERDICT) {
3852 if (nla[NFTA_SET_DATA_LEN] == NULL)
3853 return -EINVAL;
c50b960c 3854 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3855 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3856 return -EINVAL;
3857 } else
7d740264 3858 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3859 } else if (flags & NFT_SET_MAP)
3860 return -EINVAL;
3861
8aeff920
PNA		 3862 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3863 if (!(flags & NFT_SET_OBJECT))
3864 return -EINVAL;
3865
3866 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3867 if (objtype == NFT_OBJECT_UNSPEC ||
3868 objtype > NFT_OBJECT_MAX)
3869 return -EINVAL;
3870 } else if (flags & NFT_SET_OBJECT)
3871 return -EINVAL;
3872 else
3873 objtype = NFT_OBJECT_UNSPEC;
3874
761da293
PM		 3875 timeout = 0;
3876 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3877 if (!(flags & NFT_SET_TIMEOUT))
3878 return -EINVAL;
8e1102d5
FW		 3879
3880 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3881 if (err)
3882 return err;
761da293
PM		 3883 }
3884 gc_int = 0;
3885 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3886 if (!(flags & NFT_SET_TIMEOUT))
3887 return -EINVAL;
3888 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3889 }
3890
c50b960c
PM		 3891 policy = NFT_SET_POL_PERFORMANCE;
3892 if (nla[NFTA_SET_POLICY] != NULL)
3893 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3894
3895 if (nla[NFTA_SET_DESC] != NULL) {
f7e840ee 3896 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
c50b960c
PM		 3897 if (err < 0)
3898 return err;
3899 }
3900
cac20fcd 3901 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
36dd1bcc
PNA		 3902 if (IS_ERR(table)) {
3903 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
20a69341 3904 return PTR_ERR(table);
36dd1bcc 3905 }
20a69341 3906
98319cb9 3907 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
20a69341 3908
cac20fcd 3909 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341 3910 if (IS_ERR(set)) {
36dd1bcc
PNA		 3911 if (PTR_ERR(set) != -ENOENT) {
3912 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3913 return PTR_ERR(set);
36dd1bcc 3914 }
1a28ad74 3915 } else {
36dd1bcc
PNA		 3916 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3917 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
20a69341 3918 return -EEXIST;
36dd1bcc 3919 }
20a69341
PM		 3920 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3921 return -EOPNOTSUPP;
36dd1bcc 3922
20a69341
PM		 3923 return 0;
3924 }
3925
3926 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3927 return -ENOENT;
3928
2b664957 3929 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3930 if (IS_ERR(ops))
3931 return PTR_ERR(ops);
3932
e6d8ecac
CFG		 3933 udlen = 0;
3934 if (nla[NFTA_SET_USERDATA])
3935 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3936
20a69341
PM		 3937 size = 0;
3938 if (ops->privsize != NULL)
347b408d 3939 size = ops->privsize(nla, &desc);
20a69341 3940
1ff75a3e
PNA		 3941 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3942 if (!set) {
3943 err = -ENOMEM;
20a69341 3944 goto err1;
1ff75a3e 3945 }
20a69341 3946
38745490
PS		 3947 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3948 if (!name) {
3949 err = -ENOMEM;
3950 goto err2;
3951 }
3952
20a69341 3953 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3954 kfree(name);
20a69341
PM		 3955 if (err < 0)
3956 goto err2;
3957
e6d8ecac
CFG		 3958 udata = NULL;
3959 if (udlen) {
3960 udata = set->data + size;
3961 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3962 }
3963
20a69341 3964 INIT_LIST_HEAD(&set->bindings);
3453c927
PNA		 3965 set->table = table;
3966 write_pnet(&set->net, net);
20a69341
PM		 3967 set->ops = ops;
3968 set->ktype = ktype;
c50b960c 3969 set->klen = desc.klen;
20a69341 3970 set->dtype = dtype;
8aeff920 3971 set->objtype = objtype;
c50b960c 3972 set->dlen = desc.dlen;
20a69341 3973 set->flags = flags;
c50b960c 3974 set->size = desc.size;
9363dc4b 3975 set->policy = policy;
e6d8ecac
CFG		 3976 set->udlen = udlen;
3977 set->udata = udata;
761da293
PM		 3978 set->timeout = timeout;
3979 set->gc_int = gc_int;
3ecbfd65 3980 set->handle = nf_tables_alloc_handle(table);
20a69341 3981
c50b960c 3982 err = ops->init(set, &desc, nla);
20a69341 3983 if (err < 0)
2f6adf48 3984 goto err3;
20a69341 3985
958bee14 3986 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3987 if (err < 0)
2f6adf48 3988 goto err4;
20a69341 3989
e688a7f8 3990 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3991 table->use++;
20a69341
PM		 3992 return 0;
3993
2f6adf48 3994err4:
c17c3cdf 3995 ops->destroy(set);
2f6adf48
FW		 3996err3:
3997 kfree(set->name);
20a69341 3998err2:
1ff75a3e 3999 kvfree(set);
20a69341 4000err1:
71cc0873 4001 module_put(to_set_type(ops)->owner);
20a69341
PM		 4002 return err;
4003}
4004
958bee14 4005static void nft_set_destroy(struct nft_set *set)
20a69341 4006{
273fe3f1
PNA		 4007 if (WARN_ON(set->use > 0))
4008 return;
4009
20a69341 4010 set->ops->destroy(set);
71cc0873 4011 module_put(to_set_type(set->ops)->owner);
38745490 4012 kfree(set->name);
1ff75a3e 4013 kvfree(set);
20a69341
PM		 4014}
4015
633c9a84
PNA		 4016static int nf_tables_delset(struct net *net, struct sock *nlsk,
4017 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4018 const struct nlattr * const nla[],
4019 struct netlink_ext_ack *extack)
20a69341 4020{
c9c8e485 4021 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 4022 u8 genmask = nft_genmask_next(net);
36dd1bcc 4023 const struct nlattr *attr;
20a69341
PM		 4024 struct nft_set *set;
4025 struct nft_ctx ctx;
4026 int err;
4027
ec2c9935
PM		 4028 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4029 return -EAFNOSUPPORT;
20a69341
PM		 4030 if (nla[NFTA_SET_TABLE] == NULL)
4031 return -EINVAL;
4032
36dd1bcc
PNA		 4033 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
4034 genmask);
20a69341
PM		 4035 if (err < 0)
4036 return err;
4037
36dd1bcc
PNA		 4038 if (nla[NFTA_SET_HANDLE]) {
4039 attr = nla[NFTA_SET_HANDLE];
4040 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
4041 } else {
4042 attr = nla[NFTA_SET_NAME];
4043 set = nft_set_lookup(ctx.table, attr, genmask);
4044 }
a8278400 4045
36dd1bcc
PNA		 4046 if (IS_ERR(set)) {
4047 NL_SET_BAD_ATTR(extack, attr);
4048 return PTR_ERR(set);
4049 }
273fe3f1 4050 if (set->use ||
36dd1bcc
PNA		 4051 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
4052 NL_SET_BAD_ATTR(extack, attr);
20a69341 4053 return -EBUSY;
36dd1bcc 4054 }
20a69341 4055
ee01d542 4056 return nft_delset(&ctx, set);
20a69341
PM		 4057}
4058
4059static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 4060 struct nft_set *set,
20a69341 4061 const struct nft_set_iter *iter,
de70185d 4062 struct nft_set_elem *elem)
20a69341 4063{
fe2811eb 4064 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 4065 enum nft_registers dreg;
4066
4067 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 4068 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
4069 set->dtype == NFT_DATA_VERDICT ?
4070 NFT_DATA_VERDICT : NFT_DATA_VALUE,
4071 set->dlen);
20a69341
PM		 4072}
4073
4074int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
4075 struct nft_set_binding *binding)
4076{
4077 struct nft_set_binding *i;
4078 struct nft_set_iter iter;
4079
273fe3f1
PNA		 4080 if (set->use == UINT_MAX)
4081 return -EOVERFLOW;
4082
408070d6 4083 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
20a69341
PM		 4084 return -EBUSY;
4085
11113e19 4086 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 4087 /* If the set is already bound to the same chain all
4088 * jumps are already validated for that chain.
4089 */
4090 list_for_each_entry(i, &set->bindings, list) {
a4684402 4091 if (i->flags & NFT_SET_MAP &&
11113e19 4092 i->chain == binding->chain)
20a69341
PM		 4093 goto bind;
4094 }
4095
8588ac09 4096 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 4097 iter.skip = 0;
4098 iter.count = 0;
4099 iter.err = 0;
4100 iter.fn = nf_tables_bind_check_setelem;
4101
4102 set->ops->walk(ctx, set, &iter);
a02f4248 4103 if (iter.err < 0)
20a69341 4104 return iter.err;
20a69341
PM		 4105 }
4106bind:
4107 binding->chain = ctx->chain;
e688a7f8 4108 list_add_tail_rcu(&binding->list, &set->bindings);
f6ac8585 4109 nft_set_trans_bind(ctx, set);
273fe3f1 4110 set->use++;
f6ac8585 4111
20a69341
PM		 4112 return 0;
4113}
63aea290 4114EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341 4115
3b0a081d
FW		 4116static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
4117 struct nft_set_binding *binding, bool event)
20a69341 4118{
e688a7f8 4119 list_del_rcu(&binding->list);
20a69341 4120
f6ac8585 4121 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
cd5125d8 4122 list_del_rcu(&set->list);
f6ac8585
PNA		 4123 if (event)
4124 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
4125 GFP_KERNEL);
4126 }
20a69341
PM		 4127}
4128
273fe3f1
PNA		 4129void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
4130 struct nft_set_binding *binding,
4131 enum nft_trans_phase phase)
4132{
4133 switch (phase) {
4134 case NFT_TRANS_PREPARE:
4135 set->use--;
4136 return;
4137 case NFT_TRANS_ABORT:
4138 case NFT_TRANS_RELEASE:
4139 set->use--;
4140 /* fall through */
4141 default:
4142 nf_tables_unbind_set(ctx, set, binding,
4143 phase == NFT_TRANS_COMMIT);
4144 }
4145}
4146EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
4147
cd5125d8
FW		 4148void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
4149{
f6ac8585 4150 if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
cd5125d8 4151 nft_set_destroy(set);
cd5125d8
FW		 4152}
4153EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
4154
3ac4c07a
PM		 4155const struct nft_set_ext_type nft_set_ext_types[] = {
4156 [NFT_SET_EXT_KEY] = {
7d740264 4157 .align = __alignof__(u32),
3ac4c07a
PM		 4158 },
4159 [NFT_SET_EXT_DATA] = {
7d740264 4160 .align = __alignof__(u32),
3ac4c07a 4161 },
f25ad2e9
PM		 4162 [NFT_SET_EXT_EXPR] = {
4163 .align = __alignof__(struct nft_expr),
4164 },
8aeff920
PNA		 4165 [NFT_SET_EXT_OBJREF] = {
4166 .len = sizeof(struct nft_object *),
4167 .align = __alignof__(struct nft_object *),
4168 },
3ac4c07a
PM		 4169 [NFT_SET_EXT_FLAGS] = {
4170 .len = sizeof(u8),
4171 .align = __alignof__(u8),
4172 },
c3e1b005
PM		 4173 [NFT_SET_EXT_TIMEOUT] = {
4174 .len = sizeof(u64),
4175 .align = __alignof__(u64),
4176 },
4177 [NFT_SET_EXT_EXPIRATION] = {
8e1102d5
FW		 4178 .len = sizeof(u64),
4179 .align = __alignof__(u64),
c3e1b005 4180 },
68e942e8
PM		 4181 [NFT_SET_EXT_USERDATA] = {
4182 .len = sizeof(struct nft_userdata),
4183 .align = __alignof__(struct nft_userdata),
4184 },
3ac4c07a
PM		 4185};
4186EXPORT_SYMBOL_GPL(nft_set_ext_types);
4187
20a69341
PM		 4188/*
4189 * Set elements
4190 */
4191
4192static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
4193 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
4194 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
4195 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 4196 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
79ebb5bb 4197 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 },
68e942e8
PM		 4198 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
4199 .len = NFT_USERDATA_MAXLEN },
467697d2
FW		 4200 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
4201 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
20a69341
PM		 4202};
4203
4204static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 4205 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
4206 .len = NFT_TABLE_MAXNAMELEN - 1 },
4207 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
4208 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 4209 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 4210 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 4211};
4212
633c9a84 4213static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 4214 const struct sk_buff *skb,
4215 const struct nlmsghdr *nlh,
f2a6d766 4216 const struct nlattr * const nla[],
36dd1bcc 4217 struct netlink_ext_ack *extack,
f2a6d766 4218 u8 genmask)
20a69341
PM		 4219{
4220 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
98319cb9 4221 int family = nfmsg->nfgen_family;
7c95f6d8 4222 struct nft_table *table;
20a69341 4223
cac20fcd
PNA		 4224 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
4225 genmask);
36dd1bcc
PNA		 4226 if (IS_ERR(table)) {
4227 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341 4228 return PTR_ERR(table);
36dd1bcc 4229 }
20a69341 4230
98319cb9 4231 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
20a69341
PM		 4232 return 0;
4233}
4234
4235static int nf_tables_fill_setelem(struct sk_buff *skb,
4236 const struct nft_set *set,
4237 const struct nft_set_elem *elem)
4238{
fe2811eb 4239 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 4240 unsigned char *b = skb_tail_pointer(skb);
4241 struct nlattr *nest;
4242
ae0be8de 4243 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
20a69341
PM		 4244 if (nest == NULL)
4245 goto nla_put_failure;
4246
fe2811eb
PM		 4247 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4248 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 4249 goto nla_put_failure;
4250
fe2811eb
PM		 4251 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4252 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 4253 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4254 set->dlen) < 0)
4255 goto nla_put_failure;
4256
f25ad2e9
PM		 4257 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
4258 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
4259 goto nla_put_failure;
4260
8aeff920
PNA		 4261 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4262 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
d152159b 4263 (*nft_set_ext_obj(ext))->key.name) < 0)
8aeff920
PNA		 4264 goto nla_put_failure;
4265
fe2811eb
PM		 4266 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4267 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4268 htonl(*nft_set_ext_flags(ext))))
4269 goto nla_put_failure;
20a69341 4270
c3e1b005
PM		 4271 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4272 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
8e1102d5 4273 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
b46f6ded 4274 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 4275 goto nla_put_failure;
4276
4277 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
8e1102d5 4278 u64 expires, now = get_jiffies_64();
c3e1b005
PM		 4279
4280 expires = *nft_set_ext_expiration(ext);
8e1102d5 4281 if (time_before64(now, expires))
c3e1b005
PM		 4282 expires -= now;
4283 else
4284 expires = 0;
4285
4286 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
8e1102d5 4287 nf_jiffies64_to_msecs(expires),
b46f6ded 4288 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 4289 goto nla_put_failure;
4290 }
4291
68e942e8
PM		 4292 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4293 struct nft_userdata *udata;
4294
4295 udata = nft_set_ext_userdata(ext);
4296 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4297 udata->len + 1, udata->data))
4298 goto nla_put_failure;
4299 }
4300
20a69341
PM		 4301 nla_nest_end(skb, nest);
4302 return 0;
4303
4304nla_put_failure:
4305 nlmsg_trim(skb, b);
4306 return -EMSGSIZE;
4307}
4308
4309struct nft_set_dump_args {
4310 const struct netlink_callback *cb;
4311 struct nft_set_iter iter;
4312 struct sk_buff *skb;
4313};
4314
4315static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 4316 struct nft_set *set,
20a69341 4317 const struct nft_set_iter *iter,
de70185d 4318 struct nft_set_elem *elem)
20a69341
PM		 4319{
4320 struct nft_set_dump_args *args;
4321
4322 args = container_of(iter, struct nft_set_dump_args, iter);
4323 return nf_tables_fill_setelem(args->skb, set, elem);
4324}
4325
fa803605
LZ		 4326struct nft_set_dump_ctx {
4327 const struct nft_set *set;
4328 struct nft_ctx ctx;
4329};
4330
20a69341
PM		 4331static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4332{
fa803605 4333 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 4334 struct net *net = sock_net(skb->sk);
fa803605 4335 struct nft_table *table;
de70185d 4336 struct nft_set *set;
20a69341 4337 struct nft_set_dump_args args;
fa803605 4338 bool set_found = false;
20a69341
PM		 4339 struct nfgenmsg *nfmsg;
4340 struct nlmsghdr *nlh;
4341 struct nlattr *nest;
4342 u32 portid, seq;
fa803605 4343 int event;
20a69341 4344
fa803605 4345 rcu_read_lock();
36596dad
PNA		 4346 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4347 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
98319cb9 4348 dump_ctx->ctx.family != table->family)
fa803605 4349 continue;
20a69341 4350
36596dad
PNA		 4351 if (table != dump_ctx->ctx.table)
4352 continue;
20a69341 4353
36596dad
PNA		 4354 list_for_each_entry_rcu(set, &table->sets, list) {
4355 if (set == dump_ctx->set) {
4356 set_found = true;
4357 break;
fa803605 4358 }
fa803605
LZ		 4359 }
4360 break;
4361 }
4362
4363 if (!set_found) {
4364 rcu_read_unlock();
4365 return -ENOENT;
4366 }
20a69341 4367
dedb67c4 4368 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 4369 portid = NETLINK_CB(cb->skb).portid;
4370 seq = cb->nlh->nlmsg_seq;
4371
4372 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4373 NLM_F_MULTI);
4374 if (nlh == NULL)
4375 goto nla_put_failure;
4376
4377 nfmsg = nlmsg_data(nlh);
98319cb9 4378 nfmsg->nfgen_family = table->family;
20a69341 4379 nfmsg->version = NFNETLINK_V0;
fa803605 4380 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 4381
fa803605 4382 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 4383 goto nla_put_failure;
4384 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4385 goto nla_put_failure;
4386
ae0be8de 4387 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
20a69341
PM		 4388 if (nest == NULL)
4389 goto nla_put_failure;
4390
8588ac09
PNA		 4391 args.cb = cb;
4392 args.skb = skb;
fa803605 4393 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 4394 args.iter.skip = cb->args[0];
4395 args.iter.count = 0;
4396 args.iter.err = 0;
4397 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 4398 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4399 rcu_read_unlock();
20a69341
PM		 4400
4401 nla_nest_end(skb, nest);
4402 nlmsg_end(skb, nlh);
4403
4404 if (args.iter.err && args.iter.err != -EMSGSIZE)
4405 return args.iter.err;
4406 if (args.iter.count == cb->args[0])
4407 return 0;
4408
4409 cb->args[0] = args.iter.count;
4410 return skb->len;
4411
4412nla_put_failure:
fa803605 4413 rcu_read_unlock();
20a69341
PM		 4414 return -ENOSPC;
4415}
4416
90fd131a
FW		 4417static int nf_tables_dump_set_start(struct netlink_callback *cb)
4418{
4419 struct nft_set_dump_ctx *dump_ctx = cb->data;
4420
4421 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4422
4423 return cb->data ? 0 : -ENOMEM;
4424}
4425
fa803605
LZ		 4426static int nf_tables_dump_set_done(struct netlink_callback *cb)
4427{
4428 kfree(cb->data);
4429 return 0;
4430}
4431
d60ce62f
AB		 4432static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4433 const struct nft_ctx *ctx, u32 seq,
4434 u32 portid, int event, u16 flags,
4435 const struct nft_set *set,
4436 const struct nft_set_elem *elem)
4437{
4438 struct nfgenmsg *nfmsg;
4439 struct nlmsghdr *nlh;
4440 struct nlattr *nest;
4441 int err;
4442
dedb67c4 4443 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 4444 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4445 flags);
4446 if (nlh == NULL)
4447 goto nla_put_failure;
4448
4449 nfmsg = nlmsg_data(nlh);
36596dad 4450 nfmsg->nfgen_family = ctx->family;
d60ce62f 4451 nfmsg->version = NFNETLINK_V0;
84d7fce6 4452 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 4453
4454 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4455 goto nla_put_failure;
4456 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4457 goto nla_put_failure;
4458
ae0be8de 4459 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
d60ce62f
AB		 4460 if (nest == NULL)
4461 goto nla_put_failure;
4462
4463 err = nf_tables_fill_setelem(skb, set, elem);
4464 if (err < 0)
4465 goto nla_put_failure;
4466
4467 nla_nest_end(skb, nest);
4468
053c095a
JB		 4469 nlmsg_end(skb, nlh);
4470 return 0;
d60ce62f
AB		 4471
4472nla_put_failure:
4473 nlmsg_trim(skb, nlh);
4474 return -1;
4475}
4476
ba0e4d99
PNA		 4477static int nft_setelem_parse_flags(const struct nft_set *set,
4478 const struct nlattr *attr, u32 *flags)
4479{
4480 if (attr == NULL)
4481 return 0;
4482
4483 *flags = ntohl(nla_get_be32(attr));
4484 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4485 return -EINVAL;
4486 if (!(set->flags & NFT_SET_INTERVAL) &&
4487 *flags & NFT_SET_ELEM_INTERVAL_END)
4488 return -EINVAL;
4489
4490 return 0;
4491}
4492
4493static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4494 const struct nlattr *attr)
4495{
4496 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
ba0e4d99
PNA		 4497 struct nft_data_desc desc;
4498 struct nft_set_elem elem;
4499 struct sk_buff *skb;
4500 uint32_t flags = 0;
4501 void *priv;
4502 int err;
4503
8cb08174
JB		 4504 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4505 nft_set_elem_policy, NULL);
ba0e4d99
PNA		 4506 if (err < 0)
4507 return err;
4508
4509 if (!nla[NFTA_SET_ELEM_KEY])
4510 return -EINVAL;
4511
4512 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4513 if (err < 0)
4514 return err;
4515
4516 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4517 nla[NFTA_SET_ELEM_KEY]);
4518 if (err < 0)
4519 return err;
4520
4521 err = -EINVAL;
4522 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4523 return err;
4524
4525 priv = set->ops->get(ctx->net, set, &elem, flags);
4526 if (IS_ERR(priv))
4527 return PTR_ERR(priv);
4528
4529 elem.priv = priv;
ba0e4d99
PNA		 4530
4531 err = -ENOMEM;
d9adf22a 4532 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
ba0e4d99
PNA		 4533 if (skb == NULL)
4534 goto err1;
4535
4536 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4537 NFT_MSG_NEWSETELEM, 0, set, &elem);
4538 if (err < 0)
4539 goto err2;
4540
4541 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4542 /* This avoids a loop in nfnetlink. */
4543 if (err < 0)
4544 goto err1;
4545
4546 return 0;
4547err2:
4548 kfree_skb(skb);
4549err1:
4550 /* this avoids a loop in nfnetlink. */
4551 return err == -EAGAIN ? -ENOBUFS : err;
4552}
4553
d9adf22a 4554/* called with rcu_read_lock held */
ba0e4d99
PNA		 4555static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4556 struct sk_buff *skb, const struct nlmsghdr *nlh,
4557 const struct nlattr * const nla[],
4558 struct netlink_ext_ack *extack)
4559{
4560 u8 genmask = nft_genmask_cur(net);
4561 struct nft_set *set;
4562 struct nlattr *attr;
4563 struct nft_ctx ctx;
4564 int rem, err = 0;
4565
36dd1bcc
PNA		 4566 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4567 genmask);
ba0e4d99
PNA		 4568 if (err < 0)
4569 return err;
4570
cac20fcd 4571 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
ba0e4d99
PNA		 4572 if (IS_ERR(set))
4573 return PTR_ERR(set);
4574
4575 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4576 struct netlink_dump_control c = {
90fd131a 4577 .start = nf_tables_dump_set_start,
ba0e4d99
PNA		 4578 .dump = nf_tables_dump_set,
4579 .done = nf_tables_dump_set_done,
d9adf22a 4580 .module = THIS_MODULE,
ba0e4d99 4581 };
90fd131a
FW		 4582 struct nft_set_dump_ctx dump_ctx = {
4583 .set = set,
4584 .ctx = ctx,
4585 };
ba0e4d99 4586
90fd131a 4587 c.data = &dump_ctx;
d9adf22a 4588 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
ba0e4d99
PNA		 4589 }
4590
4591 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4592 return -EINVAL;
4593
4594 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4595 err = nft_get_set_elem(&ctx, set, attr);
4596 if (err < 0)
4597 break;
4598 }
4599
4600 return err;
4601}
4602
25e94a99
PNA		 4603static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4604 const struct nft_set *set,
4605 const struct nft_set_elem *elem,
4606 int event, u16 flags)
d60ce62f 4607{
128ad332
PNA		 4608 struct net *net = ctx->net;
4609 u32 portid = ctx->portid;
d60ce62f
AB		 4610 struct sk_buff *skb;
4611 int err;
4612
128ad332 4613 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4614 return;
d60ce62f 4615
d60ce62f
AB		 4616 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4617 if (skb == NULL)
4618 goto err;
4619
4620 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4621 set, elem);
4622 if (err < 0) {
4623 kfree_skb(skb);
4624 goto err;
4625 }
4626
25e94a99
PNA		 4627 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4628 GFP_KERNEL);
4629 return;
d60ce62f 4630err:
25e94a99 4631 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 4632}
4633
60319eb1
PNA		 4634static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4635 int msg_type,
4636 struct nft_set *set)
4637{
4638 struct nft_trans *trans;
4639
4640 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4641 if (trans == NULL)
4642 return NULL;
4643
4644 nft_trans_elem_set(trans) = set;
4645 return trans;
4646}
4647
22fe54d5
PM		 4648void *nft_set_elem_init(const struct nft_set *set,
4649 const struct nft_set_ext_tmpl *tmpl,
49499c3e 4650 const u32 *key, const u32 *data,
79ebb5bb 4651 u64 timeout, u64 expiration, gfp_t gfp)
fe2811eb
PM		 4652{
4653 struct nft_set_ext *ext;
4654 void *elem;
4655
4656 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4657 if (elem == NULL)
4658 return NULL;
4659
4660 ext = nft_set_elem_ext(set, elem);
4661 nft_set_ext_init(ext, tmpl);
4662
4663 memcpy(nft_set_ext_key(ext), key, set->klen);
4664 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4665 memcpy(nft_set_ext_data(ext), data, set->dlen);
79ebb5bb
LGL		 4666 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4667 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
4668 if (expiration == 0)
4669 *nft_set_ext_expiration(ext) += timeout;
4670 }
c3e1b005
PM		 4671 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4672 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 4673
4674 return elem;
4675}
4676
61f9e292
LZ		 4677void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4678 bool destroy_expr)
61edafbb
PM		 4679{
4680 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3453c927
PNA		 4681 struct nft_ctx ctx = {
4682 .net = read_pnet(&set->net),
4683 .family = set->table->family,
4684 };
61edafbb 4685
59105446 4686 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 4687 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 4688 nft_data_release(nft_set_ext_data(ext), set->dtype);
371ebcbb
PNA		 4689 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4690 struct nft_expr *expr = nft_set_ext_expr(ext);
4691
4692 if (expr->ops->destroy_clone) {
4693 expr->ops->destroy_clone(&ctx, expr);
4694 module_put(expr->ops->type->owner);
4695 } else {
4696 nf_tables_expr_destroy(&ctx, expr);
4697 }
4698 }
8aeff920
PNA		 4699 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4700 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 4701 kfree(elem);
4702}
4703EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4704
59105446
PNA		 4705/* Only called from commit path, nft_set_elem_deactivate() already deals with
4706 * the refcounting from the preparation phase.
4707 */
3453c927
PNA		 4708static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4709 const struct nft_set *set, void *elem)
59105446
PNA		 4710{
4711 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4712
4713 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3453c927 4714 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
59105446
PNA		 4715 kfree(elem);
4716}
4717
60319eb1 4718static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 4719 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 4720{
4721 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 4722 u8 genmask = nft_genmask_next(ctx->net);
20a69341 4723 struct nft_data_desc d1, d2;
fe2811eb 4724 struct nft_set_ext_tmpl tmpl;
c016c7e4 4725 struct nft_set_ext *ext, *ext2;
20a69341
PM		 4726 struct nft_set_elem elem;
4727 struct nft_set_binding *binding;
8aeff920 4728 struct nft_object *obj = NULL;
68e942e8 4729 struct nft_userdata *udata;
fe2811eb 4730 struct nft_data data;
20a69341 4731 enum nft_registers dreg;
60319eb1 4732 struct nft_trans *trans;
0e9091d6 4733 u32 flags = 0;
c3e1b005 4734 u64 timeout;
79ebb5bb 4735 u64 expiration;
68e942e8 4736 u8 ulen;
20a69341
PM		 4737 int err;
4738
8cb08174
JB		 4739 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4740 nft_set_elem_policy, NULL);
20a69341
PM		 4741 if (err < 0)
4742 return err;
4743
4744 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4745 return -EINVAL;
4746
fe2811eb
PM		 4747 nft_set_ext_prepare(&tmpl);
4748
0e9091d6
PNA		 4749 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4750 if (err < 0)
4751 return err;
4752 if (flags != 0)
4753 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 4754
4755 if (set->flags & NFT_SET_MAP) {
4756 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 4757 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 4758 return -EINVAL;
bd7fc645 4759 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 4760 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 4761 return -EINVAL;
20a69341
PM		 4762 } else {
4763 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4764 return -EINVAL;
4765 }
4766
c3e1b005
PM		 4767 timeout = 0;
4768 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4769 if (!(set->flags & NFT_SET_TIMEOUT))
4770 return -EINVAL;
8e1102d5
FW		 4771 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4772 &timeout);
4773 if (err)
4774 return err;
c3e1b005
PM		 4775 } else if (set->flags & NFT_SET_TIMEOUT) {
4776 timeout = set->timeout;
4777 }
4778
79ebb5bb
LGL		 4779 expiration = 0;
4780 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
4781 if (!(set->flags & NFT_SET_TIMEOUT))
4782 return -EINVAL;
4783 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
4784 &expiration);
4785 if (err)
4786 return err;
4787 }
4788
7d740264 4789 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 4790 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4791 if (err < 0)
4792 goto err1;
4793 err = -EINVAL;
4794 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4795 goto err2;
4796
7d740264 4797 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 4798 if (timeout > 0) {
4799 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4800 if (timeout != set->timeout)
4801 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4802 }
fe2811eb 4803
8aeff920
PNA		 4804 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4805 if (!(set->flags & NFT_SET_OBJECT)) {
4806 err = -EINVAL;
4807 goto err2;
4808 }
4d44175a
FW		 4809 obj = nft_obj_lookup(ctx->net, ctx->table,
4810 nla[NFTA_SET_ELEM_OBJREF],
cac20fcd 4811 set->objtype, genmask);
8aeff920
PNA		 4812 if (IS_ERR(obj)) {
4813 err = PTR_ERR(obj);
4814 goto err2;
4815 }
4816 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4817 }
4818
20a69341 4819 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 4820 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4821 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 4822 if (err < 0)
4823 goto err2;
4824
4825 err = -EINVAL;
4826 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4827 goto err3;
4828
4829 dreg = nft_type_to_reg(set->dtype);
4830 list_for_each_entry(binding, &set->bindings, list) {
4831 struct nft_ctx bind_ctx = {
58c78e10 4832 .net = ctx->net,
36596dad 4833 .family = ctx->family,
20a69341 4834 .table = ctx->table,
7c95f6d8 4835 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 4836 };
4837
11113e19
PM		 4838 if (!(binding->flags & NFT_SET_MAP))
4839 continue;
4840
1ec10212
PM		 4841 err = nft_validate_register_store(&bind_ctx, dreg,
4842 &data,
4843 d2.type, d2.len);
20a69341
PM		 4844 if (err < 0)
4845 goto err3;
a654de8f
PNA		 4846
4847 if (d2.type == NFT_DATA_VERDICT &&
4848 (data.verdict.code == NFT_GOTO ||
4849 data.verdict.code == NFT_JUMP))
4850 nft_validate_state_update(ctx->net,
4851 NFT_VALIDATE_NEED);
20a69341 4852 }
fe2811eb 4853
7d740264 4854 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 4855 }
4856
68e942e8
PM		 4857 /* The full maximum length of userdata can exceed the maximum
4858 * offset value (U8_MAX) for following extensions, therefor it
4859 * must be the last extension added.
4860 */
4861 ulen = 0;
4862 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4863 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4864 if (ulen > 0)
4865 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4866 ulen);
4867 }
4868
fe2811eb 4869 err = -ENOMEM;
7d740264 4870 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
79ebb5bb 4871 timeout, expiration, GFP_KERNEL);
fe2811eb
PM		 4872 if (elem.priv == NULL)
4873 goto err3;
4874
4875 ext = nft_set_elem_ext(set, elem.priv);
4876 if (flags)
4877 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 4878 if (ulen > 0) {
4879 udata = nft_set_ext_userdata(ext);
4880 udata->len = ulen - 1;
4881 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4882 }
8aeff920
PNA		 4883 if (obj) {
4884 *nft_set_ext_obj(ext) = obj;
4885 obj->use++;
4886 }
fe2811eb 4887
60319eb1
PNA		 4888 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4889 if (trans == NULL)
fe2811eb 4890 goto err4;
60319eb1 4891
69086658 4892 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 4893 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4894 if (err) {
4895 if (err == -EEXIST) {
9744a6fc
PNA		 4896 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4897 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4898 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
f0dfd7a2
CIK		 4899 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4900 err = -EBUSY;
4901 goto err5;
4902 }
8aeff920
PNA		 4903 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4904 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4905 memcmp(nft_set_ext_data(ext),
4906 nft_set_ext_data(ext2), set->dlen) != 0) ||
4907 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4908 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4909 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 4910 err = -EBUSY;
4911 else if (!(nlmsg_flags & NLM_F_EXCL))
4912 err = 0;
4913 }
fe2811eb 4914 goto err5;
c016c7e4 4915 }
20a69341 4916
35d0ac90
PNA		 4917 if (set->size &&
4918 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4919 err = -ENFILE;
4920 goto err6;
4921 }
4922
60319eb1 4923 nft_trans_elem(trans) = elem;
46bbafce 4924 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 4925 return 0;
4926
35d0ac90 4927err6:
5cb82a38 4928 set->ops->remove(ctx->net, set, &elem);
fe2811eb 4929err5:
60319eb1 4930 kfree(trans);
fe2811eb 4931err4:
b91d9036
TY		 4932 if (obj)
4933 obj->use--;
fe2811eb 4934 kfree(elem.priv);
20a69341
PM		 4935err3:
4936 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 4937 nft_data_release(&data, d2.type);
20a69341 4938err2:
59105446 4939 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 4940err1:
4941 return err;
4942}
4943
633c9a84
PNA		 4944static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4945 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4946 const struct nlattr * const nla[],
4947 struct netlink_ext_ack *extack)
20a69341 4948{
f2a6d766 4949 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4950 const struct nlattr *attr;
4951 struct nft_set *set;
4952 struct nft_ctx ctx;
a654de8f 4953 int rem, err;
20a69341 4954
7d5570ca
PNA		 4955 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4956 return -EINVAL;
4957
36dd1bcc
PNA		 4958 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4959 genmask);
20a69341
PM		 4960 if (err < 0)
4961 return err;
4962
a3073c17
PNA		 4963 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4964 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4965 if (IS_ERR(set))
4966 return PTR_ERR(set);
958bee14 4967
20a69341
PM		 4968 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4969 return -EBUSY;
4970
4971 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4972 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4973 if (err < 0)
a654de8f 4974 return err;
20a69341 4975 }
a654de8f
PNA		 4976
4977 if (net->nft.validate_state == NFT_VALIDATE_DO)
4978 return nft_table_validate(net, ctx.table);
4979
4980 return 0;
20a69341
PM		 4981}
4982
59105446
PNA		 4983/**
4984 * nft_data_hold - hold a nft_data item
4985 *
4986 * @data: struct nft_data to release
4987 * @type: type of data
4988 *
4989 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4990 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4991 * NFT_GOTO verdicts. This function must be called on active data objects
4992 * from the second phase of the commit protocol.
4993 */
bb7b40ae 4994void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
59105446
PNA		 4995{
4996 if (type == NFT_DATA_VERDICT) {
4997 switch (data->verdict.code) {
4998 case NFT_JUMP:
4999 case NFT_GOTO:
5000 data->verdict.chain->use++;
5001 break;
5002 }
5003 }
5004}
5005
5006static void nft_set_elem_activate(const struct net *net,
5007 const struct nft_set *set,
5008 struct nft_set_elem *elem)
5009{
5010 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5011
5012 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5013 nft_data_hold(nft_set_ext_data(ext), set->dtype);
5014 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5015 (*nft_set_ext_obj(ext))->use++;
5016}
5017
5018static void nft_set_elem_deactivate(const struct net *net,
5019 const struct nft_set *set,
5020 struct nft_set_elem *elem)
5021{
5022 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5023
5024 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5025 nft_data_release(nft_set_ext_data(ext), set->dtype);
5026 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5027 (*nft_set_ext_obj(ext))->use--;
5028}
5029
60319eb1 5030static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 5031 const struct nlattr *attr)
5032{
5033 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 5034 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 5035 struct nft_data_desc desc;
5036 struct nft_set_elem elem;
3971ca14 5037 struct nft_set_ext *ext;
60319eb1 5038 struct nft_trans *trans;
3971ca14
PNA		 5039 u32 flags = 0;
5040 void *priv;
20a69341
PM		 5041 int err;
5042
8cb08174
JB		 5043 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5044 nft_set_elem_policy, NULL);
20a69341
PM		 5045 if (err < 0)
5046 goto err1;
5047
5048 err = -EINVAL;
5049 if (nla[NFTA_SET_ELEM_KEY] == NULL)
5050 goto err1;
5051
3971ca14
PNA		 5052 nft_set_ext_prepare(&tmpl);
5053
5054 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5055 if (err < 0)
5056 return err;
5057 if (flags != 0)
5058 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5059
7d740264 5060 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 5061 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 5062 if (err < 0)
5063 goto err1;
5064
5065 err = -EINVAL;
5066 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
5067 goto err2;
5068
3971ca14
PNA		 5069 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
5070
5071 err = -ENOMEM;
5072 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
79ebb5bb 5073 0, GFP_KERNEL);
3971ca14
PNA		 5074 if (elem.priv == NULL)
5075 goto err2;
5076
5077 ext = nft_set_elem_ext(set, elem.priv);
5078 if (flags)
5079 *nft_set_ext_flags(ext) = flags;
5080
60319eb1 5081 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 5082 if (trans == NULL) {
5083 err = -ENOMEM;
3971ca14 5084 goto err3;
609ccf08 5085 }
20a69341 5086
42a55769 5087 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 5088 if (priv == NULL) {
cc02e457 5089 err = -ENOENT;
3971ca14 5090 goto err4;
cc02e457 5091 }
3971ca14
PNA		 5092 kfree(elem.priv);
5093 elem.priv = priv;
cc02e457 5094
59105446
PNA		 5095 nft_set_elem_deactivate(ctx->net, set, &elem);
5096
60319eb1 5097 nft_trans_elem(trans) = elem;
46bbafce 5098 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 5099 return 0;
cc02e457 5100
3971ca14 5101err4:
cc02e457 5102 kfree(trans);
3971ca14
PNA		 5103err3:
5104 kfree(elem.priv);
20a69341 5105err2:
59105446 5106 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 5107err1:
5108 return err;
5109}
5110
8411b644 5111static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 5112 struct nft_set *set,
8411b644 5113 const struct nft_set_iter *iter,
de70185d 5114 struct nft_set_elem *elem)
8411b644
PNA		 5115{
5116 struct nft_trans *trans;
5117 int err;
5118
5119 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
5120 sizeof(struct nft_trans_elem), GFP_ATOMIC);
5121 if (!trans)
5122 return -ENOMEM;
5123
1ba1c414 5124 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 5125 err = -ENOENT;
5126 goto err1;
5127 }
b2c11e4b 5128 set->ndeact++;
8411b644 5129
7acfda53 5130 nft_set_elem_deactivate(ctx->net, set, elem);
de70185d
PNA		 5131 nft_trans_elem_set(trans) = set;
5132 nft_trans_elem(trans) = *elem;
8411b644
PNA		 5133 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5134
5135 return 0;
5136err1:
5137 kfree(trans);
5138 return err;
5139}
5140
633c9a84
PNA		 5141static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
5142 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5143 const struct nlattr * const nla[],
5144 struct netlink_ext_ack *extack)
20a69341 5145{
f2a6d766 5146 u8 genmask = nft_genmask_next(net);
20a69341
PM		 5147 const struct nlattr *attr;
5148 struct nft_set *set;
5149 struct nft_ctx ctx;
60319eb1 5150 int rem, err = 0;
20a69341 5151
36dd1bcc
PNA		 5152 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5153 genmask);
20a69341
PM		 5154 if (err < 0)
5155 return err;
5156
cac20fcd 5157 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
20a69341
PM		 5158 if (IS_ERR(set))
5159 return PTR_ERR(set);
5160 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5161 return -EBUSY;
5162
8411b644 5163 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 5164 struct nft_set_iter iter = {
5165 .genmask = genmask,
5166 .fn = nft_flush_set,
8411b644 5167 };
baa2d42c 5168 set->ops->walk(&ctx, set, &iter);
8411b644 5169
baa2d42c 5170 return iter.err;
8411b644
PNA		 5171 }
5172
20a69341
PM		 5173 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5174 err = nft_del_setelem(&ctx, set, attr);
5175 if (err < 0)
60319eb1 5176 break;
4fefee57 5177
3dd0673a 5178 set->ndeact++;
20a69341 5179 }
60319eb1 5180 return err;
20a69341
PM		 5181}
5182
cfed7e1b
PM		 5183void nft_set_gc_batch_release(struct rcu_head *rcu)
5184{
5185 struct nft_set_gc_batch *gcb;
5186 unsigned int i;
5187
5188 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
5189 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 5190 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 5191 kfree(gcb);
5192}
5193EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
5194
5195struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
5196 gfp_t gfp)
5197{
5198 struct nft_set_gc_batch *gcb;
5199
5200 gcb = kzalloc(sizeof(*gcb), gfp);
5201 if (gcb == NULL)
5202 return gcb;
5203 gcb->head.set = set;
5204 return gcb;
5205}
5206EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
5207
e5009240
PNA		 5208/*
5209 * Stateful objects
5210 */
5211
5212/**
5213 * nft_register_obj- register nf_tables stateful object type
5214 * @obj: object type
5215 *
5216 * Registers the object type for use with nf_tables. Returns zero on
5217 * success or a negative errno code otherwise.
5218 */
5219int nft_register_obj(struct nft_object_type *obj_type)
5220{
5221 if (obj_type->type == NFT_OBJECT_UNSPEC)
5222 return -EINVAL;
5223
5224 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5225 list_add_rcu(&obj_type->list, &nf_tables_objects);
5226 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5227 return 0;
5228}
5229EXPORT_SYMBOL_GPL(nft_register_obj);
5230
5231/**
5232 * nft_unregister_obj - unregister nf_tables object type
5233 * @obj: object type
5234 *
5235 * Unregisters the object type for use with nf_tables.
5236 */
5237void nft_unregister_obj(struct nft_object_type *obj_type)
5238{
5239 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5240 list_del_rcu(&obj_type->list);
5241 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5242}
5243EXPORT_SYMBOL_GPL(nft_unregister_obj);
5244
4d44175a
FW		 5245struct nft_object *nft_obj_lookup(const struct net *net,
5246 const struct nft_table *table,
cac20fcd
PNA		 5247 const struct nlattr *nla, u32 objtype,
5248 u8 genmask)
e5009240 5249{
4d44175a
FW		 5250 struct nft_object_hash_key k = { .table = table };
5251 char search[NFT_OBJ_MAXNAMELEN];
5252 struct rhlist_head *tmp, *list;
e5009240
PNA		 5253 struct nft_object *obj;
5254
4d44175a
FW		 5255 nla_strlcpy(search, nla, sizeof(search));
5256 k.name = search;
5257
5258 WARN_ON_ONCE(!rcu_read_lock_held() &&
5259 !lockdep_commit_lock_is_held(net));
5260
5261 rcu_read_lock();
5262 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
5263 if (!list)
5264 goto out;
5265
5266 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
5267 if (objtype == obj->ops->type->type &&
5268 nft_active_genmask(obj, genmask)) {
5269 rcu_read_unlock();
e5009240 5270 return obj;
4d44175a 5271 }
e5009240 5272 }
4d44175a
FW		 5273out:
5274 rcu_read_unlock();
e5009240
PNA		 5275 return ERR_PTR(-ENOENT);
5276}
cac20fcd 5277EXPORT_SYMBOL_GPL(nft_obj_lookup);
e5009240 5278
cac20fcd
PNA		 5279static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
5280 const struct nlattr *nla,
5281 u32 objtype, u8 genmask)
3ecbfd65
HS		 5282{
5283 struct nft_object *obj;
5284
5285 list_for_each_entry(obj, &table->objects, list) {
5286 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
5287 objtype == obj->ops->type->type &&
5288 nft_active_genmask(obj, genmask))
5289 return obj;
5290 }
5291 return ERR_PTR(-ENOENT);
5292}
5293
e5009240 5294static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 5295 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
5296 .len = NFT_TABLE_MAXNAMELEN - 1 },
5297 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
5298 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 5299 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
5300 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
3ecbfd65 5301 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
e5009240
PNA		 5302};
5303
84fba055
FW		 5304static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
5305 const struct nft_object_type *type,
e5009240
PNA		 5306 const struct nlattr *attr)
5307{
5b4c6e38 5308 struct nlattr **tb;
dfc46034 5309 const struct nft_object_ops *ops;
e5009240 5310 struct nft_object *obj;
5b4c6e38
GS		 5311 int err = -ENOMEM;
5312
5313 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
5314 if (!tb)
5315 goto err1;
e5009240
PNA		 5316
5317 if (attr) {
8cb08174
JB		 5318 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
5319 type->policy, NULL);
e5009240 5320 if (err < 0)
5b4c6e38 5321 goto err2;
e5009240
PNA		 5322 } else {
5323 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
5324 }
5325
dfc46034
PBG		 5326 if (type->select_ops) {
5327 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
5328 if (IS_ERR(ops)) {
5329 err = PTR_ERR(ops);
5b4c6e38 5330 goto err2;
dfc46034
PBG		 5331 }
5332 } else {
5333 ops = type->ops;
5334 }
5335
e5009240 5336 err = -ENOMEM;
dfc46034 5337 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5b4c6e38
GS		 5338 if (!obj)
5339 goto err2;
e5009240 5340
dfc46034 5341 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240 5342 if (err < 0)
5b4c6e38 5343 goto err3;
e5009240 5344
dfc46034
PBG		 5345 obj->ops = ops;
5346
5b4c6e38 5347 kfree(tb);
e5009240 5348 return obj;
5b4c6e38 5349err3:
e5009240 5350 kfree(obj);
5b4c6e38
GS		 5351err2:
5352 kfree(tb);
e5009240
PNA		 5353err1:
5354 return ERR_PTR(err);
5355}
5356
5357static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 5358 struct nft_object *obj, bool reset)
e5009240
PNA		 5359{
5360 struct nlattr *nest;
5361
ae0be8de 5362 nest = nla_nest_start_noflag(skb, attr);
e5009240
PNA		 5363 if (!nest)
5364 goto nla_put_failure;
dfc46034 5365 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 5366 goto nla_put_failure;
5367 nla_nest_end(skb, nest);
5368 return 0;
5369
5370nla_put_failure:
5371 return -1;
5372}
5373
5374static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5375{
5376 const struct nft_object_type *type;
5377
5378 list_for_each_entry(type, &nf_tables_objects, list) {
5379 if (objtype == type->type)
5380 return type;
5381 }
5382 return NULL;
5383}
5384
452238e8
FW		 5385static const struct nft_object_type *
5386nft_obj_type_get(struct net *net, u32 objtype)
e5009240
PNA		 5387{
5388 const struct nft_object_type *type;
5389
5390 type = __nft_obj_type_get(objtype);
5391 if (type != NULL && try_module_get(type->owner))
5392 return type;
5393
f102d66b 5394 lockdep_nfnl_nft_mutex_not_held();
e5009240
PNA		 5395#ifdef CONFIG_MODULES
5396 if (type == NULL) {
452238e8 5397 nft_request_module(net, "nft-obj-%u", objtype);
e5009240
PNA		 5398 if (__nft_obj_type_get(objtype))
5399 return ERR_PTR(-EAGAIN);
5400 }
5401#endif
5402 return ERR_PTR(-ENOENT);
5403}
5404
d62d0ba9
FFM		 5405static int nf_tables_updobj(const struct nft_ctx *ctx,
5406 const struct nft_object_type *type,
5407 const struct nlattr *attr,
5408 struct nft_object *obj)
5409{
5410 struct nft_object *newobj;
5411 struct nft_trans *trans;
5412 int err;
5413
5414 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
5415 sizeof(struct nft_trans_obj));
5416 if (!trans)
5417 return -ENOMEM;
5418
5419 newobj = nft_obj_init(ctx, type, attr);
5420 if (IS_ERR(newobj)) {
5421 err = PTR_ERR(newobj);
b74ae961 5422 goto err_free_trans;
d62d0ba9
FFM		 5423 }
5424
5425 nft_trans_obj(trans) = obj;
5426 nft_trans_obj_update(trans) = true;
5427 nft_trans_obj_newobj(trans) = newobj;
5428 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5429
5430 return 0;
b74ae961
DC		 5431
5432err_free_trans:
d62d0ba9 5433 kfree(trans);
d62d0ba9
FFM		 5434 return err;
5435}
5436
e5009240
PNA		 5437static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5438 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5439 const struct nlattr * const nla[],
5440 struct netlink_ext_ack *extack)
e5009240
PNA		 5441{
5442 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5443 const struct nft_object_type *type;
5444 u8 genmask = nft_genmask_next(net);
5445 int family = nfmsg->nfgen_family;
e5009240
PNA		 5446 struct nft_table *table;
5447 struct nft_object *obj;
5448 struct nft_ctx ctx;
5449 u32 objtype;
5450 int err;
5451
5452 if (!nla[NFTA_OBJ_TYPE] ||
5453 !nla[NFTA_OBJ_NAME] ||
5454 !nla[NFTA_OBJ_DATA])
5455 return -EINVAL;
5456
cac20fcd 5457 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5458 if (IS_ERR(table)) {
5459 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5460 return PTR_ERR(table);
36dd1bcc 5461 }
e5009240
PNA		 5462
5463 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5464 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
e5009240
PNA		 5465 if (IS_ERR(obj)) {
5466 err = PTR_ERR(obj);
36dd1bcc
PNA		 5467 if (err != -ENOENT) {
5468 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5469 return err;
36dd1bcc 5470 }
1a28ad74 5471 } else {
36dd1bcc
PNA		 5472 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5473 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5474 return -EEXIST;
36dd1bcc 5475 }
d62d0ba9
FFM		 5476 if (nlh->nlmsg_flags & NLM_F_REPLACE)
5477 return -EOPNOTSUPP;
5478
5479 type = nft_obj_type_get(net, objtype);
5480 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5481
5482 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
e5009240
PNA		 5483 }
5484
98319cb9 5485 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240 5486
452238e8 5487 type = nft_obj_type_get(net, objtype);
e5009240
PNA		 5488 if (IS_ERR(type))
5489 return PTR_ERR(type);
5490
84fba055 5491 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 5492 if (IS_ERR(obj)) {
5493 err = PTR_ERR(obj);
5494 goto err1;
5495 }
d152159b 5496 obj->key.table = table;
3ecbfd65
HS		 5497 obj->handle = nf_tables_alloc_handle(table);
5498
d152159b
FW		 5499 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5500 if (!obj->key.name) {
61509575
PS		 5501 err = -ENOMEM;
5502 goto err2;
5503 }
e5009240
PNA		 5504
5505 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5506 if (err < 0)
61509575 5507 goto err3;
e5009240 5508
4d44175a
FW		 5509 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
5510 nft_objname_ht_params);
5511 if (err < 0)
5512 goto err4;
5513
e5009240
PNA		 5514 list_add_tail_rcu(&obj->list, &table->objects);
5515 table->use++;
5516 return 0;
4d44175a
FW		 5517err4:
5518 /* queued in transaction log */
5519 INIT_LIST_HEAD(&obj->list);
5520 return err;
61509575 5521err3:
d152159b 5522 kfree(obj->key.name);
e5009240 5523err2:
dfc46034 5524 if (obj->ops->destroy)
00bfb320 5525 obj->ops->destroy(&ctx, obj);
e5009240
PNA		 5526 kfree(obj);
5527err1:
5528 module_put(type->owner);
5529 return err;
5530}
5531
5532static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5533 u32 portid, u32 seq, int event, u32 flags,
5534 int family, const struct nft_table *table,
43da04a5 5535 struct nft_object *obj, bool reset)
e5009240
PNA		 5536{
5537 struct nfgenmsg *nfmsg;
5538 struct nlmsghdr *nlh;
5539
dedb67c4 5540 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 5541 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5542 if (nlh == NULL)
5543 goto nla_put_failure;
5544
5545 nfmsg = nlmsg_data(nlh);
5546 nfmsg->nfgen_family = family;
5547 nfmsg->version = NFNETLINK_V0;
5548 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5549
5550 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
d152159b 5551 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
dfc46034 5552 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 5553 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
3ecbfd65
HS		 5554 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5555 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5556 NFTA_OBJ_PAD))
e5009240
PNA		 5557 goto nla_put_failure;
5558
5559 nlmsg_end(skb, nlh);
5560 return 0;
5561
5562nla_put_failure:
5563 nlmsg_trim(skb, nlh);
5564 return -1;
5565}
5566
a9fea2a3 5567struct nft_obj_filter {
e46abbcc 5568 char *table;
a9fea2a3
PNA		 5569 u32 type;
5570};
5571
e5009240
PNA		 5572static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
5573{
5574 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
e5009240 5575 const struct nft_table *table;
e5009240 5576 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 5577 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 5578 struct net *net = sock_net(skb->sk);
5579 int family = nfmsg->nfgen_family;
43da04a5
PNA		 5580 struct nft_object *obj;
5581 bool reset = false;
5582
5583 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5584 reset = true;
e5009240
PNA		 5585
5586 rcu_read_lock();
5587 cb->seq = net->nft.base_seq;
5588
36596dad 5589 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 5590 if (family != NFPROTO_UNSPEC && family != table->family)
e5009240
PNA		 5591 continue;
5592
36596dad
PNA		 5593 list_for_each_entry_rcu(obj, &table->objects, list) {
5594 if (!nft_is_active(net, obj))
5595 goto cont;
5596 if (idx < s_idx)
5597 goto cont;
5598 if (idx > s_idx)
5599 memset(&cb->args[1], 0,
5600 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 5601 if (filter && filter->table &&
36596dad
PNA		 5602 strcmp(filter->table, table->name))
5603 goto cont;
5604 if (filter &&
5605 filter->type != NFT_OBJECT_UNSPEC &&
5606 obj->ops->type->type != filter->type)
5607 goto cont;
a9fea2a3 5608
36596dad
PNA		 5609 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
5610 cb->nlh->nlmsg_seq,
5611 NFT_MSG_NEWOBJ,
5612 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 5613 table->family, table,
36596dad
PNA		 5614 obj, reset) < 0)
5615 goto done;
e5009240 5616
36596dad 5617 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
e5009240 5618cont:
36596dad 5619 idx++;
e5009240
PNA		 5620 }
5621 }
5622done:
5623 rcu_read_unlock();
5624
5625 cb->args[0] = idx;
5626 return skb->len;
5627}
5628
90fd131a 5629static int nf_tables_dump_obj_start(struct netlink_callback *cb)
a9fea2a3 5630{
90fd131a
FW		 5631 const struct nlattr * const *nla = cb->data;
5632 struct nft_obj_filter *filter = NULL;
e46abbcc 5633
90fd131a
FW		 5634 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
5635 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5636 if (!filter)
5637 return -ENOMEM;
5638
5639 if (nla[NFTA_OBJ_TABLE]) {
5640 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
5641 if (!filter->table) {
5642 kfree(filter);
5643 return -ENOMEM;
5644 }
5645 }
5646
5647 if (nla[NFTA_OBJ_TYPE])
5648 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
8bea728d 5649 }
a9fea2a3 5650
90fd131a 5651 cb->data = filter;
a9fea2a3
PNA		 5652 return 0;
5653}
5654
90fd131a 5655static int nf_tables_dump_obj_done(struct netlink_callback *cb)
a9fea2a3 5656{
90fd131a 5657 struct nft_obj_filter *filter = cb->data;
a9fea2a3 5658
90fd131a
FW		 5659 if (filter) {
5660 kfree(filter->table);
5661 kfree(filter);
e46abbcc 5662 }
a9fea2a3 5663
90fd131a 5664 return 0;
a9fea2a3
PNA		 5665}
5666
d9adf22a 5667/* called with rcu_read_lock held */
e5009240
PNA		 5668static int nf_tables_getobj(struct net *net, struct sock *nlsk,
5669 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 5670 const struct nlattr * const nla[],
5671 struct netlink_ext_ack *extack)
e5009240
PNA		 5672{
5673 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5674 u8 genmask = nft_genmask_cur(net);
5675 int family = nfmsg->nfgen_family;
e5009240
PNA		 5676 const struct nft_table *table;
5677 struct nft_object *obj;
5678 struct sk_buff *skb2;
43da04a5 5679 bool reset = false;
e5009240
PNA		 5680 u32 objtype;
5681 int err;
5682
5683 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5684 struct netlink_dump_control c = {
90fd131a 5685 .start = nf_tables_dump_obj_start,
e5009240 5686 .dump = nf_tables_dump_obj,
a9fea2a3 5687 .done = nf_tables_dump_obj_done,
d9adf22a 5688 .module = THIS_MODULE,
90fd131a 5689 .data = (void *)nla,
e5009240 5690 };
a9fea2a3 5691
d9adf22a 5692 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
e5009240
PNA		 5693 }
5694
5695 if (!nla[NFTA_OBJ_NAME] ||
5696 !nla[NFTA_OBJ_TYPE])
5697 return -EINVAL;
5698
cac20fcd 5699 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5700 if (IS_ERR(table)) {
5701 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5702 return PTR_ERR(table);
36dd1bcc 5703 }
e5009240
PNA		 5704
5705 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4d44175a 5706 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
36dd1bcc
PNA		 5707 if (IS_ERR(obj)) {
5708 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
e5009240 5709 return PTR_ERR(obj);
36dd1bcc 5710 }
e5009240 5711
d9adf22a 5712 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
e5009240
PNA		 5713 if (!skb2)
5714 return -ENOMEM;
5715
43da04a5
PNA		 5716 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5717 reset = true;
5718
e5009240
PNA		 5719 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5720 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 5721 family, table, obj, reset);
e5009240
PNA		 5722 if (err < 0)
5723 goto err;
5724
5725 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5726err:
5727 kfree_skb(skb2);
5728 return err;
e5009240
PNA		 5729}
5730
00bfb320 5731static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
e5009240 5732{
dfc46034 5733 if (obj->ops->destroy)
00bfb320 5734 obj->ops->destroy(ctx, obj);
e5009240 5735
dfc46034 5736 module_put(obj->ops->type->owner);
d152159b 5737 kfree(obj->key.name);
e5009240
PNA		 5738 kfree(obj);
5739}
5740
5741static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 5742 struct sk_buff *skb, const struct nlmsghdr *nlh,
5743 const struct nlattr * const nla[],
5744 struct netlink_ext_ack *extack)
e5009240
PNA		 5745{
5746 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5747 u8 genmask = nft_genmask_next(net);
5748 int family = nfmsg->nfgen_family;
36dd1bcc 5749 const struct nlattr *attr;
e5009240
PNA		 5750 struct nft_table *table;
5751 struct nft_object *obj;
5752 struct nft_ctx ctx;
5753 u32 objtype;
5754
5755 if (!nla[NFTA_OBJ_TYPE] ||
3ecbfd65 5756 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
e5009240
PNA		 5757 return -EINVAL;
5758
cac20fcd 5759 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
36dd1bcc
PNA		 5760 if (IS_ERR(table)) {
5761 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
e5009240 5762 return PTR_ERR(table);
36dd1bcc 5763 }
e5009240
PNA		 5764
5765 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
36dd1bcc
PNA		 5766 if (nla[NFTA_OBJ_HANDLE]) {
5767 attr = nla[NFTA_OBJ_HANDLE];
5768 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5769 } else {
5770 attr = nla[NFTA_OBJ_NAME];
4d44175a 5771 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
36dd1bcc
PNA		 5772 }
5773
5774 if (IS_ERR(obj)) {
5775 NL_SET_BAD_ATTR(extack, attr);
e5009240 5776 return PTR_ERR(obj);
36dd1bcc
PNA		 5777 }
5778 if (obj->use > 0) {
5779 NL_SET_BAD_ATTR(extack, attr);
e5009240 5780 return -EBUSY;
36dd1bcc 5781 }
e5009240 5782
98319cb9 5783 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
e5009240
PNA		 5784
5785 return nft_delobj(&ctx, obj);
5786}
5787
d152159b 5788void nft_obj_notify(struct net *net, const struct nft_table *table,
25e94a99
PNA		 5789 struct nft_object *obj, u32 portid, u32 seq, int event,
5790 int family, int report, gfp_t gfp)
e5009240
PNA		 5791{
5792 struct sk_buff *skb;
5793 int err;
5794
2599e989
PNA		 5795 if (!report &&
5796 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 5797 return;
e5009240 5798
2599e989 5799 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 5800 if (skb == NULL)
5801 goto err;
5802
2599e989
PNA		 5803 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5804 table, obj, false);
e5009240
PNA		 5805 if (err < 0) {
5806 kfree_skb(skb);
5807 goto err;
5808 }
5809
25e94a99
PNA		 5810 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5811 return;
e5009240 5812err:
25e94a99 5813 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 5814}
2599e989
PNA		 5815EXPORT_SYMBOL_GPL(nft_obj_notify);
5816
25e94a99
PNA		 5817static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5818 struct nft_object *obj, int event)
2599e989 5819{
25e94a99 5820 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
36596dad 5821 ctx->family, ctx->report, GFP_KERNEL);
2599e989 5822}
e5009240 5823
3b49e2e9
PNA		 5824/*
5825 * Flow tables
5826 */
5827void nft_register_flowtable_type(struct nf_flowtable_type *type)
5828{
5829 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5830 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5831 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5832}
5833EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5834
5835void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5836{
5837 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5838 list_del_rcu(&type->list);
5839 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5840}
5841EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5842
5843static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5844 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
5845 .len = NFT_NAME_MAXLEN - 1 },
5846 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
5847 .len = NFT_NAME_MAXLEN - 1 },
5848 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
3ecbfd65 5849 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
8bb69f3b 5850 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 },
3b49e2e9
PNA		 5851};
5852
cac20fcd
PNA		 5853struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5854 const struct nlattr *nla, u8 genmask)
3b49e2e9
PNA		 5855{
5856 struct nft_flowtable *flowtable;
5857
d9adf22a 5858 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
3b49e2e9
PNA		 5859 if (!nla_strcmp(nla, flowtable->name) &&
5860 nft_active_genmask(flowtable, genmask))
5861 return flowtable;
5862 }
5863 return ERR_PTR(-ENOENT);
5864}
cac20fcd 5865EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
3b49e2e9 5866
9b05b6e1
LGL		 5867void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
5868 struct nft_flowtable *flowtable,
5869 enum nft_trans_phase phase)
5870{
5871 switch (phase) {
5872 case NFT_TRANS_PREPARE:
5873 case NFT_TRANS_ABORT:
5874 case NFT_TRANS_RELEASE:
5875 flowtable->use--;
5876 /* fall through */
5877 default:
5878 return;
5879 }
5880}
5881EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
5882
ae0662f8 5883static struct nft_flowtable *
cac20fcd
PNA		 5884nft_flowtable_lookup_byhandle(const struct nft_table *table,
5885 const struct nlattr *nla, u8 genmask)
3ecbfd65
HS		 5886{
5887 struct nft_flowtable *flowtable;
5888
5889 list_for_each_entry(flowtable, &table->flowtables, list) {
5890 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5891 nft_active_genmask(flowtable, genmask))
5892 return flowtable;
5893 }
5894 return ERR_PTR(-ENOENT);
5895}
5896
3b49e2e9
PNA		 5897static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5898 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5899 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5900 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5901};
5902
5903static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5904 const struct nlattr *attr,
5905 struct nft_flowtable *flowtable)
5906{
3b49e2e9 5907 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
3f0465a9 5908 struct nft_hook *hook;
3b49e2e9 5909 int hooknum, priority;
3f0465a9 5910 int err;
3b49e2e9 5911
8cb08174
JB		 5912 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5913 nft_flowtable_hook_policy, NULL);
3b49e2e9
PNA		 5914 if (err < 0)
5915 return err;
5916
5917 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5918 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5919 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5920 return -EINVAL;
5921
5922 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
fe19c04c 5923 if (hooknum != NF_NETDEV_INGRESS)
3b49e2e9
PNA		 5924 return -EINVAL;
5925
5926 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5927
3f0465a9
PNA		 5928 err = nf_tables_parse_netdev_hooks(ctx->net,
5929 tb[NFTA_FLOWTABLE_HOOK_DEVS],
5930 &flowtable->hook_list);
3b49e2e9 5931 if (err < 0)
d92191aa 5932 return err;
3b49e2e9 5933
71a8a63b
PNA		 5934 flowtable->hooknum = hooknum;
5935 flowtable->data.priority = priority;
3b49e2e9 5936
3f0465a9
PNA		 5937 list_for_each_entry(hook, &flowtable->hook_list, list) {
5938 hook->ops.pf = NFPROTO_NETDEV;
5939 hook->ops.hooknum = hooknum;
5940 hook->ops.priority = priority;
5941 hook->ops.priv = &flowtable->data;
5942 hook->ops.hook = flowtable->data.type->hook;
3b49e2e9
PNA		 5943 }
5944
3b49e2e9
PNA		 5945 return err;
5946}
5947
98319cb9 5948static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
3b49e2e9
PNA		 5949{
5950 const struct nf_flowtable_type *type;
5951
5952 list_for_each_entry(type, &nf_tables_flowtables, list) {
98319cb9 5953 if (family == type->family)
3b49e2e9
PNA		 5954 return type;
5955 }
5956 return NULL;
5957}
5958
452238e8
FW		 5959static const struct nf_flowtable_type *
5960nft_flowtable_type_get(struct net *net, u8 family)
3b49e2e9
PNA		 5961{
5962 const struct nf_flowtable_type *type;
5963
98319cb9 5964 type = __nft_flowtable_type_get(family);
3b49e2e9
PNA		 5965 if (type != NULL && try_module_get(type->owner))
5966 return type;
5967
f102d66b 5968 lockdep_nfnl_nft_mutex_not_held();
3b49e2e9
PNA		 5969#ifdef CONFIG_MODULES
5970 if (type == NULL) {
452238e8 5971 nft_request_module(net, "nf-flowtable-%u", family);
98319cb9 5972 if (__nft_flowtable_type_get(family))
3b49e2e9
PNA		 5973 return ERR_PTR(-EAGAIN);
5974 }
5975#endif
5976 return ERR_PTR(-ENOENT);
5977}
5978
ff4bf2f4
PNA		 5979static void nft_unregister_flowtable_hook(struct net *net,
5980 struct nft_flowtable *flowtable,
5981 struct nft_hook *hook)
5982{
5983 nf_unregister_net_hook(net, &hook->ops);
5984 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
5985 FLOW_BLOCK_UNBIND);
5986}
5987
3b49e2e9
PNA		 5988static void nft_unregister_flowtable_net_hooks(struct net *net,
5989 struct nft_flowtable *flowtable)
5990{
3f0465a9 5991 struct nft_hook *hook;
3b49e2e9 5992
ff4bf2f4
PNA		 5993 list_for_each_entry(hook, &flowtable->hook_list, list)
5994 nft_unregister_flowtable_hook(net, flowtable, hook);
3f0465a9
PNA		 5995}
5996
5997static int nft_register_flowtable_net_hooks(struct net *net,
5998 struct nft_table *table,
5999 struct nft_flowtable *flowtable)
6000{
6001 struct nft_hook *hook, *hook2, *next;
6002 struct nft_flowtable *ft;
6003 int err, i = 0;
6004
6005 list_for_each_entry(hook, &flowtable->hook_list, list) {
6006 list_for_each_entry(ft, &table->flowtables, list) {
6007 list_for_each_entry(hook2, &ft->hook_list, list) {
6008 if (hook->ops.dev == hook2->ops.dev &&
6009 hook->ops.pf == hook2->ops.pf) {
6010 err = -EBUSY;
6011 goto err_unregister_net_hooks;
6012 }
6013 }
6014 }
3b49e2e9 6015
d7c03a9f 6016 err = flowtable->data.type->setup(&flowtable->data,
6017 hook->ops.dev,
6018 FLOW_BLOCK_BIND);
3f0465a9
PNA		 6019 if (err < 0)
6020 goto err_unregister_net_hooks;
6021
d7c03a9f 6022 err = nf_register_net_hook(net, &hook->ops);
6023 if (err < 0) {
6024 flowtable->data.type->setup(&flowtable->data,
6025 hook->ops.dev,
6026 FLOW_BLOCK_UNBIND);
6027 goto err_unregister_net_hooks;
6028 }
6029
3f0465a9 6030 i++;
3b49e2e9 6031 }
3f0465a9
PNA		 6032
6033 return 0;
6034
6035err_unregister_net_hooks:
6036 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
6037 if (i-- <= 0)
6038 break;
6039
ff4bf2f4 6040 nft_unregister_flowtable_hook(net, flowtable, hook);
3f0465a9
PNA		 6041 list_del_rcu(&hook->list);
6042 kfree_rcu(hook, rcu);
6043 }
6044
6045 return err;
3b49e2e9
PNA		 6046}
6047
6048static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
6049 struct sk_buff *skb,
6050 const struct nlmsghdr *nlh,
6051 const struct nlattr * const nla[],
6052 struct netlink_ext_ack *extack)
6053{
6054 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6055 const struct nf_flowtable_type *type;
6056 u8 genmask = nft_genmask_next(net);
6057 int family = nfmsg->nfgen_family;
3f0465a9
PNA		 6058 struct nft_flowtable *flowtable;
6059 struct nft_hook *hook, *next;
3b49e2e9
PNA		 6060 struct nft_table *table;
6061 struct nft_ctx ctx;
3f0465a9 6062 int err;
3b49e2e9
PNA		 6063
6064 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6065 !nla[NFTA_FLOWTABLE_NAME] ||
6066 !nla[NFTA_FLOWTABLE_HOOK])
6067 return -EINVAL;
6068
cac20fcd
PNA		 6069 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6070 genmask);
36dd1bcc
PNA		 6071 if (IS_ERR(table)) {
6072 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 6073 return PTR_ERR(table);
36dd1bcc 6074 }
3b49e2e9 6075
cac20fcd
PNA		 6076 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6077 genmask);
3b49e2e9
PNA		 6078 if (IS_ERR(flowtable)) {
6079 err = PTR_ERR(flowtable);
36dd1bcc
PNA		 6080 if (err != -ENOENT) {
6081 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 6082 return err;
36dd1bcc 6083 }
3b49e2e9 6084 } else {
36dd1bcc
PNA		 6085 if (nlh->nlmsg_flags & NLM_F_EXCL) {
6086 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
3b49e2e9 6087 return -EEXIST;
36dd1bcc 6088 }
3b49e2e9
PNA		 6089
6090 return 0;
6091 }
6092
98319cb9 6093 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 6094
6095 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
6096 if (!flowtable)
6097 return -ENOMEM;
6098
6099 flowtable->table = table;
3ecbfd65 6100 flowtable->handle = nf_tables_alloc_handle(table);
3f0465a9 6101 INIT_LIST_HEAD(&flowtable->hook_list);
3ecbfd65 6102
3b49e2e9
PNA		 6103 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
6104 if (!flowtable->name) {
6105 err = -ENOMEM;
6106 goto err1;
6107 }
6108
452238e8 6109 type = nft_flowtable_type_get(net, family);
3b49e2e9
PNA		 6110 if (IS_ERR(type)) {
6111 err = PTR_ERR(type);
6112 goto err2;
6113 }
6114
8bb69f3b
PNA		 6115 if (nla[NFTA_FLOWTABLE_FLAGS]) {
6116 flowtable->data.flags =
6117 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
6118 if (flowtable->data.flags & ~NF_FLOWTABLE_HW_OFFLOAD)
6119 goto err3;
6120 }
6121
6122 write_pnet(&flowtable->data.net, net);
3b49e2e9 6123 flowtable->data.type = type;
a268de77 6124 err = type->init(&flowtable->data);
3b49e2e9
PNA		 6125 if (err < 0)
6126 goto err3;
6127
6128 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
6129 flowtable);
6130 if (err < 0)
a268de77 6131 goto err4;
3b49e2e9 6132
3f0465a9
PNA		 6133 err = nft_register_flowtable_net_hooks(ctx.net, table, flowtable);
6134 if (err < 0)
6135 goto err4;
3b49e2e9
PNA		 6136
6137 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
6138 if (err < 0)
3f0465a9 6139 goto err5;
3b49e2e9
PNA		 6140
6141 list_add_tail_rcu(&flowtable->list, &table->flowtables);
6142 table->use++;
6143
6144 return 0;
a268de77 6145err5:
3f0465a9 6146 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
ff4bf2f4 6147 nft_unregister_flowtable_hook(net, flowtable, hook);
3f0465a9
PNA		 6148 list_del_rcu(&hook->list);
6149 kfree_rcu(hook, rcu);
6150 }
a268de77
FF		 6151err4:
6152 flowtable->data.type->free(&flowtable->data);
3b49e2e9
PNA		 6153err3:
6154 module_put(type->owner);
6155err2:
6156 kfree(flowtable->name);
6157err1:
6158 kfree(flowtable);
6159 return err;
6160}
6161
6162static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
6163 struct sk_buff *skb,
6164 const struct nlmsghdr *nlh,
6165 const struct nlattr * const nla[],
6166 struct netlink_ext_ack *extack)
6167{
6168 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6169 u8 genmask = nft_genmask_next(net);
6170 int family = nfmsg->nfgen_family;
6171 struct nft_flowtable *flowtable;
36dd1bcc 6172 const struct nlattr *attr;
3b49e2e9
PNA		 6173 struct nft_table *table;
6174 struct nft_ctx ctx;
6175
e603ea4b
PNA		 6176 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6177 (!nla[NFTA_FLOWTABLE_NAME] &&
6178 !nla[NFTA_FLOWTABLE_HANDLE]))
6179 return -EINVAL;
6180
cac20fcd
PNA		 6181 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6182 genmask);
36dd1bcc
PNA		 6183 if (IS_ERR(table)) {
6184 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
3b49e2e9 6185 return PTR_ERR(table);
36dd1bcc 6186 }
3b49e2e9 6187
36dd1bcc
PNA		 6188 if (nla[NFTA_FLOWTABLE_HANDLE]) {
6189 attr = nla[NFTA_FLOWTABLE_HANDLE];
6190 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
6191 } else {
6192 attr = nla[NFTA_FLOWTABLE_NAME];
6193 flowtable = nft_flowtable_lookup(table, attr, genmask);
6194 }
6195
6196 if (IS_ERR(flowtable)) {
6197 NL_SET_BAD_ATTR(extack, attr);
6198 return PTR_ERR(flowtable);
6199 }
6200 if (flowtable->use > 0) {
6201 NL_SET_BAD_ATTR(extack, attr);
3b49e2e9 6202 return -EBUSY;
36dd1bcc 6203 }
3b49e2e9 6204
98319cb9 6205 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3b49e2e9
PNA		 6206
6207 return nft_delflowtable(&ctx, flowtable);
6208}
6209
6210static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
6211 u32 portid, u32 seq, int event,
6212 u32 flags, int family,
6213 struct nft_flowtable *flowtable)
6214{
6215 struct nlattr *nest, *nest_devs;
6216 struct nfgenmsg *nfmsg;
3f0465a9 6217 struct nft_hook *hook;
3b49e2e9 6218 struct nlmsghdr *nlh;
3b49e2e9
PNA		 6219
6220 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6221 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
6222 if (nlh == NULL)
6223 goto nla_put_failure;
6224
6225 nfmsg = nlmsg_data(nlh);
6226 nfmsg->nfgen_family = family;
6227 nfmsg->version = NFNETLINK_V0;
6228 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
6229
6230 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
6231 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
3ecbfd65
HS		 6232 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
6233 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
8bb69f3b
PNA		 6234 NFTA_FLOWTABLE_PAD) ||
6235 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags)))
3b49e2e9
PNA		 6236 goto nla_put_failure;
6237
ae0be8de 6238 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
eb895086
KL		 6239 if (!nest)
6240 goto nla_put_failure;
3b49e2e9 6241 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
71a8a63b 6242 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority)))
3b49e2e9
PNA		 6243 goto nla_put_failure;
6244
ae0be8de 6245 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
3b49e2e9
PNA		 6246 if (!nest_devs)
6247 goto nla_put_failure;
6248
3f0465a9
PNA		 6249 list_for_each_entry_rcu(hook, &flowtable->hook_list, list) {
6250 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))
3b49e2e9
PNA		 6251 goto nla_put_failure;
6252 }
6253 nla_nest_end(skb, nest_devs);
6254 nla_nest_end(skb, nest);
6255
6256 nlmsg_end(skb, nlh);
6257 return 0;
6258
6259nla_put_failure:
6260 nlmsg_trim(skb, nlh);
6261 return -1;
6262}
6263
6264struct nft_flowtable_filter {
6265 char *table;
6266};
6267
6268static int nf_tables_dump_flowtable(struct sk_buff *skb,
6269 struct netlink_callback *cb)
6270{
6271 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6272 struct nft_flowtable_filter *filter = cb->data;
6273 unsigned int idx = 0, s_idx = cb->args[0];
6274 struct net *net = sock_net(skb->sk);
6275 int family = nfmsg->nfgen_family;
6276 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 6277 const struct nft_table *table;
6278
6279 rcu_read_lock();
6280 cb->seq = net->nft.base_seq;
6281
36596dad 6282 list_for_each_entry_rcu(table, &net->nft.tables, list) {
98319cb9 6283 if (family != NFPROTO_UNSPEC && family != table->family)
3b49e2e9
PNA		 6284 continue;
6285
36596dad
PNA		 6286 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6287 if (!nft_is_active(net, flowtable))
6288 goto cont;
6289 if (idx < s_idx)
6290 goto cont;
6291 if (idx > s_idx)
6292 memset(&cb->args[1], 0,
6293 sizeof(cb->args) - sizeof(cb->args[0]));
360cc79d 6294 if (filter && filter->table &&
36596dad
PNA		 6295 strcmp(filter->table, table->name))
6296 goto cont;
3b49e2e9 6297
36596dad
PNA		 6298 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
6299 cb->nlh->nlmsg_seq,
6300 NFT_MSG_NEWFLOWTABLE,
6301 NLM_F_MULTI | NLM_F_APPEND,
98319cb9 6302 table->family, flowtable) < 0)
36596dad 6303 goto done;
3b49e2e9 6304
36596dad 6305 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3b49e2e9 6306cont:
36596dad 6307 idx++;
3b49e2e9
PNA		 6308 }
6309 }
6310done:
6311 rcu_read_unlock();
6312
6313 cb->args[0] = idx;
6314 return skb->len;
6315}
6316
90fd131a 6317static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
3b49e2e9 6318{
90fd131a
FW		 6319 const struct nlattr * const *nla = cb->data;
6320 struct nft_flowtable_filter *filter = NULL;
3b49e2e9 6321
90fd131a
FW		 6322 if (nla[NFTA_FLOWTABLE_TABLE]) {
6323 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6324 if (!filter)
6325 return -ENOMEM;
3b49e2e9 6326
90fd131a
FW		 6327 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
6328 GFP_ATOMIC);
6329 if (!filter->table) {
6330 kfree(filter);
6331 return -ENOMEM;
6332 }
6333 }
3b49e2e9 6334
90fd131a 6335 cb->data = filter;
3b49e2e9
PNA		 6336 return 0;
6337}
6338
90fd131a 6339static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
3b49e2e9 6340{
90fd131a 6341 struct nft_flowtable_filter *filter = cb->data;
3b49e2e9 6342
3b49e2e9 6343 if (!filter)
90fd131a 6344 return 0;
3b49e2e9 6345
90fd131a
FW		 6346 kfree(filter->table);
6347 kfree(filter);
6348
6349 return 0;
3b49e2e9
PNA		 6350}
6351
d9adf22a 6352/* called with rcu_read_lock held */
3b49e2e9
PNA		 6353static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
6354 struct sk_buff *skb,
6355 const struct nlmsghdr *nlh,
6356 const struct nlattr * const nla[],
6357 struct netlink_ext_ack *extack)
6358{
6359 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6360 u8 genmask = nft_genmask_cur(net);
6361 int family = nfmsg->nfgen_family;
6362 struct nft_flowtable *flowtable;
3b49e2e9
PNA		 6363 const struct nft_table *table;
6364 struct sk_buff *skb2;
6365 int err;
6366
6367 if (nlh->nlmsg_flags & NLM_F_DUMP) {
6368 struct netlink_dump_control c = {
90fd131a 6369 .start = nf_tables_dump_flowtable_start,
3b49e2e9
PNA		 6370 .dump = nf_tables_dump_flowtable,
6371 .done = nf_tables_dump_flowtable_done,
d9adf22a 6372 .module = THIS_MODULE,
90fd131a 6373 .data = (void *)nla,
3b49e2e9
PNA		 6374 };
6375
d9adf22a 6376 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3b49e2e9
PNA		 6377 }
6378
6379 if (!nla[NFTA_FLOWTABLE_NAME])
6380 return -EINVAL;
6381
cac20fcd
PNA		 6382 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6383 genmask);
3b49e2e9
PNA		 6384 if (IS_ERR(table))
6385 return PTR_ERR(table);
6386
cac20fcd
PNA		 6387 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6388 genmask);
03a0120f 6389 if (IS_ERR(flowtable))
3b49e2e9
PNA		 6390 return PTR_ERR(flowtable);
6391
d9adf22a 6392 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3b49e2e9
PNA		 6393 if (!skb2)
6394 return -ENOMEM;
6395
6396 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
6397 nlh->nlmsg_seq,
6398 NFT_MSG_NEWFLOWTABLE, 0, family,
6399 flowtable);
6400 if (err < 0)
6401 goto err;
6402
6403 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6404err:
6405 kfree_skb(skb2);
6406 return err;
6407}
6408
6409static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
6410 struct nft_flowtable *flowtable,
6411 int event)
6412{
6413 struct sk_buff *skb;
6414 int err;
6415
6416 if (ctx->report &&
6417 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
6418 return;
6419
6420 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6421 if (skb == NULL)
6422 goto err;
6423
6424 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
6425 ctx->seq, event, 0,
36596dad 6426 ctx->family, flowtable);
3b49e2e9
PNA		 6427 if (err < 0) {
6428 kfree_skb(skb);
6429 goto err;
6430 }
6431
6432 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
6433 ctx->report, GFP_KERNEL);
6434 return;
6435err:
6436 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
6437}
6438
3b49e2e9
PNA		 6439static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
6440{
3f0465a9
PNA		 6441 struct nft_hook *hook, *next;
6442
6443 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
6444 list_del_rcu(&hook->list);
6445 kfree(hook);
6446 }
3b49e2e9 6447 kfree(flowtable->name);
b408c5b0 6448 flowtable->data.type->free(&flowtable->data);
3b49e2e9 6449 module_put(flowtable->data.type->owner);
a12486eb 6450 kfree(flowtable);
3b49e2e9
PNA		 6451}
6452
84d7fce6
PNA		 6453static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
6454 u32 portid, u32 seq)
6455{
6456 struct nlmsghdr *nlh;
6457 struct nfgenmsg *nfmsg;
784b4e61 6458 char buf[TASK_COMM_LEN];
dedb67c4 6459 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 6460
6461 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
6462 if (nlh == NULL)
6463 goto nla_put_failure;
6464
6465 nfmsg = nlmsg_data(nlh);
6466 nfmsg->nfgen_family = AF_UNSPEC;
6467 nfmsg->version = NFNETLINK_V0;
6468 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
6469
784b4e61
PS		 6470 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
6471 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
6472 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 6473 goto nla_put_failure;
6474
053c095a
JB		 6475 nlmsg_end(skb, nlh);
6476 return 0;
84d7fce6
PNA		 6477
6478nla_put_failure:
6479 nlmsg_trim(skb, nlh);
6480 return -EMSGSIZE;
6481}
6482
3b49e2e9
PNA		 6483static void nft_flowtable_event(unsigned long event, struct net_device *dev,
6484 struct nft_flowtable *flowtable)
6485{
3f0465a9 6486 struct nft_hook *hook;
3b49e2e9 6487
3f0465a9
PNA		 6488 list_for_each_entry(hook, &flowtable->hook_list, list) {
6489 if (hook->ops.dev != dev)
3b49e2e9
PNA		 6490 continue;
6491
ff4bf2f4 6492 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook);
3f0465a9
PNA		 6493 list_del_rcu(&hook->list);
6494 kfree_rcu(hook, rcu);
3b49e2e9
PNA		 6495 break;
6496 }
6497}
6498
6499static int nf_tables_flowtable_event(struct notifier_block *this,
6500 unsigned long event, void *ptr)
6501{
6502 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
6503 struct nft_flowtable *flowtable;
6504 struct nft_table *table;
0a2cf5ee 6505 struct net *net;
3b49e2e9
PNA		 6506
6507 if (event != NETDEV_UNREGISTER)
6508 return 0;
6509
6a48de01 6510 net = dev_net(dev);
9e619d87 6511 mutex_lock(&net->nft.commit_mutex);
0a2cf5ee 6512 list_for_each_entry(table, &net->nft.tables, list) {
36596dad
PNA		 6513 list_for_each_entry(flowtable, &table->flowtables, list) {
6514 nft_flowtable_event(event, dev, flowtable);
3b49e2e9
PNA		 6515 }
6516 }
9e619d87 6517 mutex_unlock(&net->nft.commit_mutex);
6a48de01 6518
3b49e2e9
PNA		 6519 return NOTIFY_DONE;
6520}
6521
6522static struct notifier_block nf_tables_flowtable_notifier = {
6523 .notifier_call = nf_tables_flowtable_event,
6524};
6525
25e94a99
PNA		 6526static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
6527 int event)
84d7fce6
PNA		 6528{
6529 struct nlmsghdr *nlh = nlmsg_hdr(skb);
6530 struct sk_buff *skb2;
6531 int err;
6532
6533 if (nlmsg_report(nlh) &&
6534 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 6535 return;
84d7fce6 6536
84d7fce6
PNA		 6537 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6538 if (skb2 == NULL)
6539 goto err;
6540
6541 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6542 nlh->nlmsg_seq);
6543 if (err < 0) {
6544 kfree_skb(skb2);
6545 goto err;
6546 }
6547
25e94a99
PNA		 6548 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6549 nlmsg_report(nlh), GFP_KERNEL);
6550 return;
84d7fce6 6551err:
25e94a99
PNA		 6552 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6553 -ENOBUFS);
84d7fce6
PNA		 6554}
6555
7b8002a1
PNA		 6556static int nf_tables_getgen(struct net *net, struct sock *nlsk,
6557 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 6558 const struct nlattr * const nla[],
6559 struct netlink_ext_ack *extack)
84d7fce6 6560{
84d7fce6
PNA		 6561 struct sk_buff *skb2;
6562 int err;
6563
d9adf22a 6564 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
84d7fce6
PNA		 6565 if (skb2 == NULL)
6566 return -ENOMEM;
6567
6568 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6569 nlh->nlmsg_seq);
6570 if (err < 0)
6571 goto err;
6572
6573 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6574err:
6575 kfree_skb(skb2);
6576 return err;
6577}
6578
96518518
PM		 6579static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
6580 [NFT_MSG_NEWTABLE] = {
55dd6f93 6581 .call_batch = nf_tables_newtable,
96518518
PM		 6582 .attr_count = NFTA_TABLE_MAX,
6583 .policy = nft_table_policy,
6584 },
6585 [NFT_MSG_GETTABLE] = {
d9adf22a 6586 .call_rcu = nf_tables_gettable,
96518518
PM		 6587 .attr_count = NFTA_TABLE_MAX,
6588 .policy = nft_table_policy,
6589 },
6590 [NFT_MSG_DELTABLE] = {
55dd6f93 6591 .call_batch = nf_tables_deltable,
96518518
PM		 6592 .attr_count = NFTA_TABLE_MAX,
6593 .policy = nft_table_policy,
6594 },
6595 [NFT_MSG_NEWCHAIN] = {
91c7b38d 6596 .call_batch = nf_tables_newchain,
96518518
PM		 6597 .attr_count = NFTA_CHAIN_MAX,
6598 .policy = nft_chain_policy,
6599 },
6600 [NFT_MSG_GETCHAIN] = {
d9adf22a 6601 .call_rcu = nf_tables_getchain,
96518518
PM		 6602 .attr_count = NFTA_CHAIN_MAX,
6603 .policy = nft_chain_policy,
6604 },
6605 [NFT_MSG_DELCHAIN] = {
91c7b38d 6606 .call_batch = nf_tables_delchain,
96518518
PM		 6607 .attr_count = NFTA_CHAIN_MAX,
6608 .policy = nft_chain_policy,
6609 },
6610 [NFT_MSG_NEWRULE] = {
0628b123 6611 .call_batch = nf_tables_newrule,
96518518
PM		 6612 .attr_count = NFTA_RULE_MAX,
6613 .policy = nft_rule_policy,
6614 },
6615 [NFT_MSG_GETRULE] = {
d9adf22a 6616 .call_rcu = nf_tables_getrule,
96518518
PM		 6617 .attr_count = NFTA_RULE_MAX,
6618 .policy = nft_rule_policy,
6619 },
6620 [NFT_MSG_DELRULE] = {
0628b123 6621 .call_batch = nf_tables_delrule,
96518518
PM		 6622 .attr_count = NFTA_RULE_MAX,
6623 .policy = nft_rule_policy,
6624 },
20a69341 6625 [NFT_MSG_NEWSET] = {
958bee14 6626 .call_batch = nf_tables_newset,
20a69341
PM		 6627 .attr_count = NFTA_SET_MAX,
6628 .policy = nft_set_policy,
6629 },
6630 [NFT_MSG_GETSET] = {
d9adf22a 6631 .call_rcu = nf_tables_getset,
20a69341
PM		 6632 .attr_count = NFTA_SET_MAX,
6633 .policy = nft_set_policy,
6634 },
6635 [NFT_MSG_DELSET] = {
958bee14 6636 .call_batch = nf_tables_delset,
20a69341
PM		 6637 .attr_count = NFTA_SET_MAX,
6638 .policy = nft_set_policy,
6639 },
6640 [NFT_MSG_NEWSETELEM] = {
958bee14 6641 .call_batch = nf_tables_newsetelem,
20a69341
PM		 6642 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6643 .policy = nft_set_elem_list_policy,
6644 },
6645 [NFT_MSG_GETSETELEM] = {
d9adf22a 6646 .call_rcu = nf_tables_getsetelem,
20a69341
PM		 6647 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6648 .policy = nft_set_elem_list_policy,
6649 },
6650 [NFT_MSG_DELSETELEM] = {
958bee14 6651 .call_batch = nf_tables_delsetelem,
20a69341
PM		 6652 .attr_count = NFTA_SET_ELEM_LIST_MAX,
6653 .policy = nft_set_elem_list_policy,
6654 },
84d7fce6 6655 [NFT_MSG_GETGEN] = {
d9adf22a 6656 .call_rcu = nf_tables_getgen,
84d7fce6 6657 },
e5009240
PNA		 6658 [NFT_MSG_NEWOBJ] = {
6659 .call_batch = nf_tables_newobj,
6660 .attr_count = NFTA_OBJ_MAX,
6661 .policy = nft_obj_policy,
6662 },
6663 [NFT_MSG_GETOBJ] = {
d9adf22a 6664 .call_rcu = nf_tables_getobj,
e5009240
PNA		 6665 .attr_count = NFTA_OBJ_MAX,
6666 .policy = nft_obj_policy,
6667 },
6668 [NFT_MSG_DELOBJ] = {
6669 .call_batch = nf_tables_delobj,
6670 .attr_count = NFTA_OBJ_MAX,
6671 .policy = nft_obj_policy,
6672 },
43da04a5 6673 [NFT_MSG_GETOBJ_RESET] = {
d9adf22a 6674 .call_rcu = nf_tables_getobj,
43da04a5
PNA		 6675 .attr_count = NFTA_OBJ_MAX,
6676 .policy = nft_obj_policy,
6677 },
3b49e2e9
PNA		 6678 [NFT_MSG_NEWFLOWTABLE] = {
6679 .call_batch = nf_tables_newflowtable,
6680 .attr_count = NFTA_FLOWTABLE_MAX,
6681 .policy = nft_flowtable_policy,
6682 },
6683 [NFT_MSG_GETFLOWTABLE] = {
d9adf22a 6684 .call_rcu = nf_tables_getflowtable,
3b49e2e9
PNA		 6685 .attr_count = NFTA_FLOWTABLE_MAX,
6686 .policy = nft_flowtable_policy,
6687 },
6688 [NFT_MSG_DELFLOWTABLE] = {
6689 .call_batch = nf_tables_delflowtable,
6690 .attr_count = NFTA_FLOWTABLE_MAX,
6691 .policy = nft_flowtable_policy,
6692 },
96518518
PM		 6693};
6694
a654de8f
PNA		 6695static int nf_tables_validate(struct net *net)
6696{
6697 struct nft_table *table;
6698
6699 switch (net->nft.validate_state) {
6700 case NFT_VALIDATE_SKIP:
6701 break;
6702 case NFT_VALIDATE_NEED:
6703 nft_validate_state_update(net, NFT_VALIDATE_DO);
6704 /* fall through */
6705 case NFT_VALIDATE_DO:
6706 list_for_each_entry(table, &net->nft.tables, list) {
6707 if (nft_table_validate(net, table) < 0)
6708 return -EAGAIN;
6709 }
6710 break;
6711 }
6712
6713 return 0;
6714}
6715
66293c46
FW		 6716/* a drop policy has to be deferred until all rules have been activated,
6717 * otherwise a large ruleset that contains a drop-policy base chain will
6718 * cause all packets to get dropped until the full transaction has been
6719 * processed.
6720 *
6721 * We defer the drop policy until the transaction has been finalized.
6722 */
6723static void nft_chain_commit_drop_policy(struct nft_trans *trans)
6724{
6725 struct nft_base_chain *basechain;
6726
6727 if (nft_trans_chain_policy(trans) != NF_DROP)
6728 return;
6729
6730 if (!nft_is_base_chain(trans->ctx.chain))
6731 return;
6732
6733 basechain = nft_base_chain(trans->ctx.chain);
6734 basechain->policy = NF_DROP;
6735}
6736
91c7b38d
PNA		 6737static void nft_chain_commit_update(struct nft_trans *trans)
6738{
6739 struct nft_base_chain *basechain;
6740
1b2470e5
FW		 6741 if (nft_trans_chain_name(trans)) {
6742 rhltable_remove(&trans->ctx.table->chains_ht,
6743 &trans->ctx.chain->rhlhead,
6744 nft_chain_ht_params);
d71efb59 6745 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
1b2470e5
FW		 6746 rhltable_insert_key(&trans->ctx.table->chains_ht,
6747 trans->ctx.chain->name,
6748 &trans->ctx.chain->rhlhead,
6749 nft_chain_ht_params);
6750 }
91c7b38d 6751
f323d954 6752 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 6753 return;
6754
53315ac6
FW		 6755 nft_chain_stats_replace(trans);
6756
91c7b38d 6757 basechain = nft_base_chain(trans->ctx.chain);
91c7b38d
PNA		 6758
6759 switch (nft_trans_chain_policy(trans)) {
6760 case NF_DROP:
6761 case NF_ACCEPT:
6762 basechain->policy = nft_trans_chain_policy(trans);
6763 break;
6764 }
6765}
6766
d62d0ba9
FFM		 6767static void nft_obj_commit_update(struct nft_trans *trans)
6768{
6769 struct nft_object *newobj;
6770 struct nft_object *obj;
6771
6772 obj = nft_trans_obj(trans);
6773 newobj = nft_trans_obj_newobj(trans);
6774
9fedd894
FFM		 6775 if (obj->ops->update)
6776 obj->ops->update(obj, newobj);
d62d0ba9
FFM		 6777
6778 kfree(newobj);
6779}
6780
2f99aa31 6781static void nft_commit_release(struct nft_trans *trans)
c7c32e72 6782{
c7c32e72
PNA		 6783 switch (trans->msg_type) {
6784 case NFT_MSG_DELTABLE:
6785 nf_tables_table_destroy(&trans->ctx);
6786 break;
9f8aac0b 6787 case NFT_MSG_NEWCHAIN:
53315ac6 6788 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b
FW		 6789 kfree(nft_trans_chain_name(trans));
6790 break;
c7c32e72 6791 case NFT_MSG_DELCHAIN:
43a605f2 6792 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 6793 break;
6794 case NFT_MSG_DELRULE:
6795 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6796 break;
6797 case NFT_MSG_DELSET:
6798 nft_set_destroy(nft_trans_set(trans));
6799 break;
61edafbb 6800 case NFT_MSG_DELSETELEM:
3453c927
PNA		 6801 nf_tables_set_elem_destroy(&trans->ctx,
6802 nft_trans_elem_set(trans),
59105446 6803 nft_trans_elem(trans).priv);
61edafbb 6804 break;
e5009240 6805 case NFT_MSG_DELOBJ:
00bfb320 6806 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 6807 break;
3b49e2e9
PNA		 6808 case NFT_MSG_DELFLOWTABLE:
6809 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6810 break;
c7c32e72 6811 }
0935d558
FW		 6812
6813 if (trans->put_net)
6814 put_net(trans->ctx.net);
6815
c7c32e72
PNA		 6816 kfree(trans);
6817}
6818
0935d558 6819static void nf_tables_trans_destroy_work(struct work_struct *w)
2f99aa31
FW		 6820{
6821 struct nft_trans *trans, *next;
0935d558
FW		 6822 LIST_HEAD(head);
6823
6824 spin_lock(&nf_tables_destroy_list_lock);
6825 list_splice_init(&nf_tables_destroy_list, &head);
6826 spin_unlock(&nf_tables_destroy_list_lock);
2f99aa31 6827
0935d558 6828 if (list_empty(&head))
2f99aa31
FW		 6829 return;
6830
6831 synchronize_rcu();
6832
0935d558 6833 list_for_each_entry_safe(trans, next, &head, list) {
2f99aa31
FW		 6834 list_del(&trans->list);
6835 nft_commit_release(trans);
6836 }
6837}
6838
0cbc06b3
FW		 6839static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6840{
6841 struct nft_rule *rule;
6842 unsigned int alloc = 0;
6843 int i;
6844
6845 /* already handled or inactive chain? */
6846 if (chain->rules_next || !nft_is_active_next(net, chain))
6847 return 0;
6848
6849 rule = list_entry(&chain->rules, struct nft_rule, list);
6850 i = 0;
6851
6852 list_for_each_entry_continue(rule, &chain->rules, list) {
6853 if (nft_is_active_next(net, rule))
6854 alloc++;
6855 }
6856
6857 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6858 if (!chain->rules_next)
6859 return -ENOMEM;
6860
6861 list_for_each_entry_continue(rule, &chain->rules, list) {
6862 if (nft_is_active_next(net, rule))
6863 chain->rules_next[i++] = rule;
6864 }
6865
6866 chain->rules_next[i] = NULL;
6867 return 0;
6868}
6869
6870static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6871{
6872 struct nft_trans *trans, *next;
6873
6874 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6875 struct nft_chain *chain = trans->ctx.chain;
6876
6877 if (trans->msg_type == NFT_MSG_NEWRULE ||
6878 trans->msg_type == NFT_MSG_DELRULE) {
6879 kvfree(chain->rules_next);
6880 chain->rules_next = NULL;
6881 }
6882 }
6883}
6884
6885static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6886{
6887 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6888
6889 kvfree(o->start);
6890}
6891
6892static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6893{
6894 struct nft_rule **r = rules;
6895 struct nft_rules_old *old;
6896
6897 while (*r)
6898 r++;
6899
6900 r++; /* rcu_head is after end marker */
6901 old = (void *) r;
6902 old->start = rules;
6903
6904 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6905}
6906
0fb39bbe 6907static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
0cbc06b3
FW		 6908{
6909 struct nft_rule **g0, **g1;
6910 bool next_genbit;
6911
6912 next_genbit = nft_gencursor_next(net);
6913
6914 g0 = rcu_dereference_protected(chain->rules_gen_0,
f102d66b 6915 lockdep_commit_lock_is_held(net));
0cbc06b3 6916 g1 = rcu_dereference_protected(chain->rules_gen_1,
f102d66b 6917 lockdep_commit_lock_is_held(net));
0cbc06b3
FW		 6918
6919 /* No changes to this chain? */
6920 if (chain->rules_next == NULL) {
6921 /* chain had no change in last or next generation */
6922 if (g0 == g1)
6923 return;
6924 /*
6925 * chain had no change in this generation; make sure next
6926 * one uses same rules as current generation.
6927 */
6928 if (next_genbit) {
6929 rcu_assign_pointer(chain->rules_gen_1, g0);
6930 nf_tables_commit_chain_free_rules_old(g1);
6931 } else {
6932 rcu_assign_pointer(chain->rules_gen_0, g1);
6933 nf_tables_commit_chain_free_rules_old(g0);
6934 }
6935
6936 return;
6937 }
6938
6939 if (next_genbit)
6940 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6941 else
6942 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6943
6944 chain->rules_next = NULL;
6945
6946 if (g0 == g1)
6947 return;
6948
6949 if (next_genbit)
6950 nf_tables_commit_chain_free_rules_old(g1);
6951 else
6952 nf_tables_commit_chain_free_rules_old(g0);
6953}
6954
d152159b
FW		 6955static void nft_obj_del(struct nft_object *obj)
6956{
4d44175a 6957 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
d152159b
FW		 6958 list_del_rcu(&obj->list);
6959}
6960
1b2470e5
FW		 6961static void nft_chain_del(struct nft_chain *chain)
6962{
6963 struct nft_table *table = chain->table;
6964
6965 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
6966 nft_chain_ht_params));
6967 list_del_rcu(&chain->list);
6968}
6969
0935d558
FW		 6970static void nf_tables_commit_release(struct net *net)
6971{
6972 struct nft_trans *trans;
6973
6974 /* all side effects have to be made visible.
6975 * For example, if a chain named 'foo' has been deleted, a
6976 * new transaction must not find it anymore.
6977 *
6978 * Memory reclaim happens asynchronously from work queue
6979 * to prevent expensive synchronize_rcu() in commit phase.
6980 */
6981 if (list_empty(&net->nft.commit_list)) {
6982 mutex_unlock(&net->nft.commit_mutex);
6983 return;
6984 }
6985
6986 trans = list_last_entry(&net->nft.commit_list,
6987 struct nft_trans, list);
6988 get_net(trans->ctx.net);
6989 WARN_ON_ONCE(trans->put_net);
6990
6991 trans->put_net = true;
6992 spin_lock(&nf_tables_destroy_list_lock);
6993 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
6994 spin_unlock(&nf_tables_destroy_list_lock);
6995
6996 mutex_unlock(&net->nft.commit_mutex);
6997
6998 schedule_work(&trans_destroy_work);
6999}
7000
5913beaf 7001static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 7002{
37082f93 7003 struct nft_trans *trans, *next;
a3716e70 7004 struct nft_trans_elem *te;
0cbc06b3
FW		 7005 struct nft_chain *chain;
7006 struct nft_table *table;
c9626a2c 7007 int err;
37082f93 7008
b8b27498
FW		 7009 if (list_empty(&net->nft.commit_list)) {
7010 mutex_unlock(&net->nft.commit_mutex);
7011 return 0;
7012 }
7013
a654de8f
PNA		 7014 /* 0. Validate ruleset, otherwise roll back for error reporting. */
7015 if (nf_tables_validate(net) < 0)
7016 return -EAGAIN;
7017
c9626a2c
PNA		 7018 err = nft_flow_rule_offload_commit(net);
7019 if (err < 0)
7020 return err;
7021
0cbc06b3
FW		 7022 /* 1. Allocate space for next generation rules_gen_X[] */
7023 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7024 int ret;
37082f93 7025
0cbc06b3
FW		 7026 if (trans->msg_type == NFT_MSG_NEWRULE ||
7027 trans->msg_type == NFT_MSG_DELRULE) {
7028 chain = trans->ctx.chain;
7029
7030 ret = nf_tables_commit_chain_prepare(net, chain);
7031 if (ret < 0) {
7032 nf_tables_commit_chain_prepare_cancel(net);
7033 return ret;
7034 }
7035 }
7036 }
37082f93 7037
0cbc06b3
FW		 7038 /* step 2. Make rules_gen_X visible to packet path */
7039 list_for_each_entry(table, &net->nft.tables, list) {
0fb39bbe
FW		 7040 list_for_each_entry(chain, &table->chains, list)
7041 nf_tables_commit_chain(net, chain);
0cbc06b3
FW		 7042 }
7043
7044 /*
7045 * Bump generation counter, invalidate any dump in progress.
7046 * Cannot fail after this point.
37082f93 7047 */
0cbc06b3
FW		 7048 while (++net->nft.base_seq == 0);
7049
7050 /* step 3. Start new generation, rules_gen_X now in use. */
7051 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 7052
7053 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 7054 switch (trans->msg_type) {
55dd6f93
PNA		 7055 case NFT_MSG_NEWTABLE:
7056 if (nft_trans_table_update(trans)) {
7057 if (!nft_trans_table_enable(trans)) {
664b0f8c 7058 nf_tables_table_disable(net,
55dd6f93
PNA		 7059 trans->ctx.table);
7060 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7061 }
7062 } else {
f2a6d766 7063 nft_clear(net, trans->ctx.table);
55dd6f93 7064 }
35151d84 7065 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 7066 nft_trans_destroy(trans);
7067 break;
7068 case NFT_MSG_DELTABLE:
f2a6d766 7069 list_del_rcu(&trans->ctx.table->list);
35151d84 7070 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 7071 break;
91c7b38d 7072 case NFT_MSG_NEWCHAIN:
9f8aac0b 7073 if (nft_trans_chain_update(trans)) {
91c7b38d 7074 nft_chain_commit_update(trans);
9f8aac0b
FW		 7075 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7076 /* trans destroyed after rcu grace period */
7077 } else {
66293c46 7078 nft_chain_commit_drop_policy(trans);
664b0f8c 7079 nft_clear(net, trans->ctx.chain);
9f8aac0b
FW		 7080 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7081 nft_trans_destroy(trans);
7082 }
91c7b38d
PNA		 7083 break;
7084 case NFT_MSG_DELCHAIN:
1b2470e5 7085 nft_chain_del(trans->ctx.chain);
35151d84 7086 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
c974a3a3
PNA		 7087 nf_tables_unregister_hook(trans->ctx.net,
7088 trans->ctx.table,
7089 trans->ctx.chain);
91c7b38d 7090 break;
b380e5c7 7091 case NFT_MSG_NEWRULE:
889f7ee7 7092 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 7093 nf_tables_rule_notify(&trans->ctx,
37082f93 7094 nft_trans_rule(trans),
35151d84 7095 NFT_MSG_NEWRULE);
37082f93 7096 nft_trans_destroy(trans);
b380e5c7
PNA		 7097 break;
7098 case NFT_MSG_DELRULE:
7099 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 7100 nf_tables_rule_notify(&trans->ctx,
7101 nft_trans_rule(trans),
7102 NFT_MSG_DELRULE);
f6ac8585
PNA		 7103 nft_rule_expr_deactivate(&trans->ctx,
7104 nft_trans_rule(trans),
7105 NFT_TRANS_COMMIT);
b380e5c7 7106 break;
958bee14 7107 case NFT_MSG_NEWSET:
37a9cc52 7108 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 7109 /* This avoids hitting -EBUSY when deleting the table
7110 * from the transaction.
7111 */
408070d6 7112 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
4fefee57
PNA		 7113 !list_empty(&nft_trans_set(trans)->bindings))
7114 trans->ctx.table->use--;
7115
958bee14 7116 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 7117 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 7118 nft_trans_destroy(trans);
7119 break;
7120 case NFT_MSG_DELSET:
37a9cc52 7121 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 7122 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 7123 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 7124 break;
60319eb1 7125 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 7126 te = (struct nft_trans_elem *)trans->data;
7127
42a55769 7128 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 7129 nf_tables_setelem_notify(&trans->ctx, te->set,
7130 &te->elem,
60319eb1
PNA		 7131 NFT_MSG_NEWSETELEM, 0);
7132 nft_trans_destroy(trans);
7133 break;
7134 case NFT_MSG_DELSETELEM:
a3716e70 7135 te = (struct nft_trans_elem *)trans->data;
fe2811eb 7136
a3716e70
PNA		 7137 nf_tables_setelem_notify(&trans->ctx, te->set,
7138 &te->elem,
60319eb1 7139 NFT_MSG_DELSETELEM, 0);
5cb82a38 7140 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 7141 atomic_dec(&te->set->nelems);
7142 te->set->ndeact--;
60319eb1 7143 break;
e5009240 7144 case NFT_MSG_NEWOBJ:
d62d0ba9
FFM		 7145 if (nft_trans_obj_update(trans)) {
7146 nft_obj_commit_update(trans);
7147 nf_tables_obj_notify(&trans->ctx,
7148 nft_trans_obj(trans),
7149 NFT_MSG_NEWOBJ);
7150 } else {
7151 nft_clear(net, nft_trans_obj(trans));
7152 nf_tables_obj_notify(&trans->ctx,
7153 nft_trans_obj(trans),
7154 NFT_MSG_NEWOBJ);
7155 nft_trans_destroy(trans);
7156 }
e5009240
PNA		 7157 break;
7158 case NFT_MSG_DELOBJ:
d152159b 7159 nft_obj_del(nft_trans_obj(trans));
e5009240
PNA		 7160 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
7161 NFT_MSG_DELOBJ);
7162 break;
3b49e2e9
PNA		 7163 case NFT_MSG_NEWFLOWTABLE:
7164 nft_clear(net, nft_trans_flowtable(trans));
7165 nf_tables_flowtable_notify(&trans->ctx,
7166 nft_trans_flowtable(trans),
7167 NFT_MSG_NEWFLOWTABLE);
7168 nft_trans_destroy(trans);
7169 break;
7170 case NFT_MSG_DELFLOWTABLE:
7171 list_del_rcu(&nft_trans_flowtable(trans)->list);
7172 nf_tables_flowtable_notify(&trans->ctx,
7173 nft_trans_flowtable(trans),
7174 NFT_MSG_DELFLOWTABLE);
7175 nft_unregister_flowtable_net_hooks(net,
7176 nft_trans_flowtable(trans));
7177 break;
37082f93 7178 }
37082f93
PNA		 7179 }
7180
84d7fce6 7181 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
0935d558 7182 nf_tables_commit_release(net);
37082f93
PNA		 7183
7184 return 0;
7185}
7186
b326dd37 7187static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 7188{
c7c32e72
PNA		 7189 switch (trans->msg_type) {
7190 case NFT_MSG_NEWTABLE:
7191 nf_tables_table_destroy(&trans->ctx);
7192 break;
7193 case NFT_MSG_NEWCHAIN:
43a605f2 7194 nf_tables_chain_destroy(&trans->ctx);
c7c32e72
PNA		 7195 break;
7196 case NFT_MSG_NEWRULE:
7197 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
7198 break;
7199 case NFT_MSG_NEWSET:
40ba1d9b 7200 nft_set_destroy(nft_trans_set(trans));
c7c32e72 7201 break;
61edafbb
PM		 7202 case NFT_MSG_NEWSETELEM:
7203 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 7204 nft_trans_elem(trans).priv, true);
61edafbb 7205 break;
e5009240 7206 case NFT_MSG_NEWOBJ:
00bfb320 7207 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
e5009240 7208 break;
3b49e2e9
PNA		 7209 case NFT_MSG_NEWFLOWTABLE:
7210 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
7211 break;
c7c32e72
PNA		 7212 }
7213 kfree(trans);
7214}
7215
71ad00c5 7216static int __nf_tables_abort(struct net *net)
37082f93 7217{
37082f93 7218 struct nft_trans *trans, *next;
02263db0 7219 struct nft_trans_elem *te;
37082f93 7220
a907e36d
XL		 7221 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
7222 list) {
b380e5c7 7223 switch (trans->msg_type) {
55dd6f93
PNA		 7224 case NFT_MSG_NEWTABLE:
7225 if (nft_trans_table_update(trans)) {
7226 if (nft_trans_table_enable(trans)) {
664b0f8c 7227 nf_tables_table_disable(net,
55dd6f93
PNA		 7228 trans->ctx.table);
7229 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7230 }
7231 nft_trans_destroy(trans);
7232 } else {
e688a7f8 7233 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 7234 }
7235 break;
7236 case NFT_MSG_DELTABLE:
f2a6d766 7237 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 7238 nft_trans_destroy(trans);
7239 break;
91c7b38d
PNA		 7240 case NFT_MSG_NEWCHAIN:
7241 if (nft_trans_chain_update(trans)) {
982f4051 7242 free_percpu(nft_trans_chain_stats(trans));
9f8aac0b 7243 kfree(nft_trans_chain_name(trans));
91c7b38d
PNA		 7244 nft_trans_destroy(trans);
7245 } else {
4fefee57 7246 trans->ctx.table->use--;
1b2470e5 7247 nft_chain_del(trans->ctx.chain);
c974a3a3
PNA		 7248 nf_tables_unregister_hook(trans->ctx.net,
7249 trans->ctx.table,
7250 trans->ctx.chain);
91c7b38d
PNA		 7251 }
7252 break;
7253 case NFT_MSG_DELCHAIN:
4fefee57 7254 trans->ctx.table->use++;
664b0f8c 7255 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 7256 nft_trans_destroy(trans);
7257 break;
b380e5c7 7258 case NFT_MSG_NEWRULE:
4fefee57 7259 trans->ctx.chain->use--;
b380e5c7 7260 list_del_rcu(&nft_trans_rule(trans)->list);
f6ac8585
PNA		 7261 nft_rule_expr_deactivate(&trans->ctx,
7262 nft_trans_rule(trans),
7263 NFT_TRANS_ABORT);
b380e5c7
PNA		 7264 break;
7265 case NFT_MSG_DELRULE:
4fefee57 7266 trans->ctx.chain->use++;
889f7ee7 7267 nft_clear(trans->ctx.net, nft_trans_rule(trans));
bb7b40ae 7268 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
37082f93 7269 nft_trans_destroy(trans);
b380e5c7 7270 break;
958bee14 7271 case NFT_MSG_NEWSET:
4fefee57 7272 trans->ctx.table->use--;
6a0a8d10 7273 if (nft_trans_set_bound(trans)) {
40ba1d9b
PNA		 7274 nft_trans_destroy(trans);
7275 break;
7276 }
7277 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 7278 break;
7279 case NFT_MSG_DELSET:
4fefee57 7280 trans->ctx.table->use++;
37a9cc52 7281 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 7282 nft_trans_destroy(trans);
7283 break;
60319eb1 7284 case NFT_MSG_NEWSETELEM:
6a0a8d10 7285 if (nft_trans_elem_set_bound(trans)) {
40ba1d9b
PNA		 7286 nft_trans_destroy(trans);
7287 break;
7288 }
02263db0 7289 te = (struct nft_trans_elem *)trans->data;
5cb82a38 7290 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 7291 atomic_dec(&te->set->nelems);
60319eb1
PNA		 7292 break;
7293 case NFT_MSG_DELSETELEM:
cc02e457
PM		 7294 te = (struct nft_trans_elem *)trans->data;
7295
59105446 7296 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 7297 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 7298 te->set->ndeact--;
cc02e457 7299
e5009240
PNA		 7300 nft_trans_destroy(trans);
7301 break;
7302 case NFT_MSG_NEWOBJ:
d62d0ba9
FFM		 7303 if (nft_trans_obj_update(trans)) {
7304 kfree(nft_trans_obj_newobj(trans));
7305 nft_trans_destroy(trans);
7306 } else {
7307 trans->ctx.table->use--;
7308 nft_obj_del(nft_trans_obj(trans));
7309 }
e5009240
PNA		 7310 break;
7311 case NFT_MSG_DELOBJ:
7312 trans->ctx.table->use++;
7313 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 7314 nft_trans_destroy(trans);
7315 break;
3b49e2e9
PNA		 7316 case NFT_MSG_NEWFLOWTABLE:
7317 trans->ctx.table->use--;
7318 list_del_rcu(&nft_trans_flowtable(trans)->list);
7319 nft_unregister_flowtable_net_hooks(net,
7320 nft_trans_flowtable(trans));
7321 break;
7322 case NFT_MSG_DELFLOWTABLE:
7323 trans->ctx.table->use++;
7324 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
7325 nft_trans_destroy(trans);
7326 break;
37082f93 7327 }
37082f93
PNA		 7328 }
7329
b326dd37
PNA		 7330 synchronize_rcu();
7331
a1cee076
PNA		 7332 list_for_each_entry_safe_reverse(trans, next,
7333 &net->nft.commit_list, list) {
c7c32e72 7334 list_del(&trans->list);
b326dd37 7335 nf_tables_abort_release(trans);
37082f93
PNA		 7336 }
7337
7338 return 0;
7339}
7340
a654de8f
PNA		 7341static void nf_tables_cleanup(struct net *net)
7342{
7343 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
7344}
7345
71ad00c5
FW		 7346static int nf_tables_abort(struct net *net, struct sk_buff *skb)
7347{
f102d66b
FW		 7348 int ret = __nf_tables_abort(net);
7349
7350 mutex_unlock(&net->nft.commit_mutex);
7351
7352 return ret;
71ad00c5
FW		 7353}
7354
74e8bcd2
PNA		 7355static bool nf_tables_valid_genid(struct net *net, u32 genid)
7356{
f102d66b
FW		 7357 bool genid_ok;
7358
7359 mutex_lock(&net->nft.commit_mutex);
7360
7361 genid_ok = genid == 0 || net->nft.base_seq == genid;
7362 if (!genid_ok)
7363 mutex_unlock(&net->nft.commit_mutex);
7364
7365 /* else, commit mutex has to be released by commit or abort function */
7366 return genid_ok;
74e8bcd2
PNA		 7367}
7368
96518518
PM		 7369static const struct nfnetlink_subsystem nf_tables_subsys = {
7370 .name = "nf_tables",
7371 .subsys_id = NFNL_SUBSYS_NFTABLES,
7372 .cb_count = NFT_MSG_MAX,
7373 .cb = nf_tables_cb,
0628b123
PNA		 7374 .commit = nf_tables_commit,
7375 .abort = nf_tables_abort,
a654de8f 7376 .cleanup = nf_tables_cleanup,
74e8bcd2 7377 .valid_genid = nf_tables_valid_genid,
be2ab5b4 7378 .owner = THIS_MODULE,
96518518
PM		 7379};
7380
7210e4e3 7381int nft_chain_validate_dependency(const struct nft_chain *chain,
32537e91 7382 enum nft_chain_types type)
7210e4e3
PNA		 7383{
7384 const struct nft_base_chain *basechain;
7385
f323d954 7386 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 7387 basechain = nft_base_chain(chain);
7388 if (basechain->type->type != type)
7389 return -EOPNOTSUPP;
7390 }
7391 return 0;
7392}
7393EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
7394
75e8d06d
PNA		 7395int nft_chain_validate_hooks(const struct nft_chain *chain,
7396 unsigned int hook_flags)
7397{
7398 struct nft_base_chain *basechain;
7399
f323d954 7400 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 7401 basechain = nft_base_chain(chain);
7402
c974a3a3 7403 if ((1 << basechain->ops.hooknum) & hook_flags)
75e8d06d
PNA		 7404 return 0;
7405
7406 return -EOPNOTSUPP;
7407 }
7408
7409 return 0;
7410}
7411EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
7412
20a69341
PM		 7413/*
7414 * Loop detection - walk through the ruleset beginning at the destination chain
7415 * of a new jump until either the source chain is reached (loop) or all
7416 * reachable chains have been traversed.
7417 *
7418 * The loop check is performed whenever a new jump verdict is added to an
7419 * expression or verdict map or a verdict map is bound to a new chain.
7420 */
7421
7422static int nf_tables_check_loops(const struct nft_ctx *ctx,
7423 const struct nft_chain *chain);
7424
7425static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 7426 struct nft_set *set,
20a69341 7427 const struct nft_set_iter *iter,
de70185d 7428 struct nft_set_elem *elem)
20a69341 7429{
fe2811eb
PM		 7430 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
7431 const struct nft_data *data;
7432
7433 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
7434 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 7435 return 0;
7436
fe2811eb 7437 data = nft_set_ext_data(ext);
1ca2e170 7438 switch (data->verdict.code) {
20a69341
PM		 7439 case NFT_JUMP:
7440 case NFT_GOTO:
1ca2e170 7441 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7442 default:
7443 return 0;
7444 }
7445}
7446
7447static int nf_tables_check_loops(const struct nft_ctx *ctx,
7448 const struct nft_chain *chain)
7449{
7450 const struct nft_rule *rule;
7451 const struct nft_expr *expr, *last;
de70185d 7452 struct nft_set *set;
20a69341
PM		 7453 struct nft_set_binding *binding;
7454 struct nft_set_iter iter;
20a69341
PM		 7455
7456 if (ctx->chain == chain)
7457 return -ELOOP;
7458
7459 list_for_each_entry(rule, &chain->rules, list) {
7460 nft_rule_for_each_expr(expr, last, rule) {
a654de8f
PNA		 7461 struct nft_immediate_expr *priv;
7462 const struct nft_data *data;
0ca743a5
PNA		 7463 int err;
7464
a654de8f 7465 if (strcmp(expr->ops->type->name, "immediate"))
20a69341
PM		 7466 continue;
7467
a654de8f
PNA		 7468 priv = nft_expr_priv(expr);
7469 if (priv->dreg != NFT_REG_VERDICT)
0ca743a5 7470 continue;
20a69341 7471
a654de8f 7472 data = &priv->data;
1ca2e170 7473 switch (data->verdict.code) {
20a69341
PM		 7474 case NFT_JUMP:
7475 case NFT_GOTO:
1ca2e170
PM		 7476 err = nf_tables_check_loops(ctx,
7477 data->verdict.chain);
20a69341
PM		 7478 if (err < 0)
7479 return err;
7480 default:
7481 break;
7482 }
7483 }
7484 }
7485
7486 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 7487 if (!nft_is_active_next(ctx->net, set))
7488 continue;
20a69341
PM		 7489 if (!(set->flags & NFT_SET_MAP) ||
7490 set->dtype != NFT_DATA_VERDICT)
7491 continue;
7492
7493 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 7494 if (!(binding->flags & NFT_SET_MAP) ||
7495 binding->chain != chain)
20a69341
PM		 7496 continue;
7497
8588ac09 7498 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 7499 iter.skip = 0;
7500 iter.count = 0;
7501 iter.err = 0;
7502 iter.fn = nf_tables_loop_check_setelem;
7503
7504 set->ops->walk(ctx, set, &iter);
7505 if (iter.err < 0)
7506 return iter.err;
7507 }
7508 }
7509
7510 return 0;
7511}
7512
36b701fa
LGL		 7513/**
7514 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
7515 *
7516 * @attr: netlink attribute to fetch value from
7517 * @max: maximum value to be stored in dest
7518 * @dest: pointer to the variable
7519 *
7520 * Parse, check and store a given u32 netlink attribute into variable.
7521 * This function returns -ERANGE if the value goes over maximum value.
7522 * Otherwise a 0 is returned and the attribute value is stored in the
7523 * destination variable.
7524 */
f1d505bb 7525int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 7526{
09525a09 7527 u32 val;
36b701fa
LGL		 7528
7529 val = ntohl(nla_get_be32(attr));
7530 if (val > max)
7531 return -ERANGE;
7532
7533 *dest = val;
7534 return 0;
7535}
7536EXPORT_SYMBOL_GPL(nft_parse_u32_check);
7537
49499c3e
PM		 7538/**
7539 * nft_parse_register - parse a register value from a netlink attribute
7540 *
7541 * @attr: netlink attribute
7542 *
7543 * Parse and translate a register value from a netlink attribute.
7544 * Registers used to be 128 bit wide, these register numbers will be
7545 * mapped to the corresponding 32 bit register numbers.
7546 */
b1c96ed3
PM		 7547unsigned int nft_parse_register(const struct nlattr *attr)
7548{
49499c3e
PM		 7549 unsigned int reg;
7550
7551 reg = ntohl(nla_get_be32(attr));
7552 switch (reg) {
7553 case NFT_REG_VERDICT...NFT_REG_4:
7554 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
7555 default:
7556 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
7557 }
b1c96ed3
PM		 7558}
7559EXPORT_SYMBOL_GPL(nft_parse_register);
7560
49499c3e
PM		 7561/**
7562 * nft_dump_register - dump a register value to a netlink attribute
7563 *
7564 * @skb: socket buffer
7565 * @attr: attribute number
7566 * @reg: register number
7567 *
7568 * Construct a netlink attribute containing the register number. For
7569 * compatibility reasons, register numbers being a multiple of 4 are
7570 * translated to the corresponding 128 bit register numbers.
7571 */
b1c96ed3
PM		 7572int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
7573{
49499c3e
PM		 7574 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
7575 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
7576 else
7577 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
7578
b1c96ed3
PM		 7579 return nla_put_be32(skb, attr, htonl(reg));
7580}
7581EXPORT_SYMBOL_GPL(nft_dump_register);
7582
96518518 7583/**
d07db988 7584 * nft_validate_register_load - validate a load from a register
96518518
PM		 7585 *
7586 * @reg: the register number
d07db988 7587 * @len: the length of the data
96518518
PM		 7588 *
7589 * Validate that the input register is one of the general purpose
d07db988 7590 * registers and that the length of the load is within the bounds.
96518518 7591 */
d07db988 7592int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 7593{
49499c3e 7594 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 7595 return -EINVAL;
d07db988
PM		 7596 if (len == 0)
7597 return -EINVAL;
49499c3e 7598 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 7599 return -ERANGE;
49499c3e 7600
96518518
PM		 7601 return 0;
7602}
d07db988 7603EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 7604
96518518 7605/**
1ec10212 7606 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 7607 *
7608 * @ctx: context of the expression performing the load
7609 * @reg: the destination register number
7610 * @data: the data to load
7611 * @type: the data type
45d9bcda 7612 * @len: the length of the data
96518518
PM		 7613 *
7614 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 7615 * the destination register and the length is within the bounds.
7616 * A value of NULL for the data means that its runtime gathered
58f40ab6 7617 * data.
96518518 7618 */
1ec10212
PM		 7619int nft_validate_register_store(const struct nft_ctx *ctx,
7620 enum nft_registers reg,
7621 const struct nft_data *data,
7622 enum nft_data_types type, unsigned int len)
96518518 7623{
20a69341
PM		 7624 int err;
7625
96518518
PM		 7626 switch (reg) {
7627 case NFT_REG_VERDICT:
58f40ab6 7628 if (type != NFT_DATA_VERDICT)
96518518 7629 return -EINVAL;
20a69341 7630
58f40ab6 7631 if (data != NULL &&
1ca2e170
PM		 7632 (data->verdict.code == NFT_GOTO ||
7633 data->verdict.code == NFT_JUMP)) {
7634 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 7635 if (err < 0)
7636 return err;
20a69341
PM		 7637 }
7638
96518518
PM		 7639 return 0;
7640 default:
49499c3e 7641 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 7642 return -EINVAL;
45d9bcda
PM		 7643 if (len == 0)
7644 return -EINVAL;
49499c3e
PM		 7645 if (reg * NFT_REG32_SIZE + len >
7646 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 7647 return -ERANGE;
27e6d201 7648
96518518
PM		 7649 if (data != NULL && type != NFT_DATA_VALUE)
7650 return -EINVAL;
7651 return 0;
7652 }
7653}
1ec10212 7654EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 7655
7656static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
7657 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
7658 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
7659 .len = NFT_CHAIN_MAXNAMELEN - 1 },
7660};
7661
7662static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
7663 struct nft_data_desc *desc, const struct nlattr *nla)
7664{
664b0f8c 7665 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 7666 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
7667 struct nft_chain *chain;
7668 int err;
7669
8cb08174
JB		 7670 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
7671 nft_verdict_policy, NULL);
96518518
PM		 7672 if (err < 0)
7673 return err;
7674
7675 if (!tb[NFTA_VERDICT_CODE])
7676 return -EINVAL;
1ca2e170 7677 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 7678
1ca2e170 7679 switch (data->verdict.code) {
e0abdadc 7680 default:
1ca2e170 7681 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 7682 case NF_ACCEPT:
7683 case NF_DROP:
7684 case NF_QUEUE:
7685 break;
7686 default:
7687 return -EINVAL;
7688 }
7689 /* fall through */
96518518
PM		 7690 case NFT_CONTINUE:
7691 case NFT_BREAK:
7692 case NFT_RETURN:
96518518
PM		 7693 break;
7694 case NFT_JUMP:
7695 case NFT_GOTO:
7696 if (!tb[NFTA_VERDICT_CHAIN])
7697 return -EINVAL;
f102d66b
FW		 7698 chain = nft_chain_lookup(ctx->net, ctx->table,
7699 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 7700 if (IS_ERR(chain))
7701 return PTR_ERR(chain);
f323d954 7702 if (nft_is_base_chain(chain))
96518518
PM		 7703 return -EOPNOTSUPP;
7704
96518518 7705 chain->use++;
1ca2e170 7706 data->verdict.chain = chain;
96518518 7707 break;
96518518
PM		 7708 }
7709
4c4ed074 7710 desc->len = sizeof(data->verdict);
96518518
PM		 7711 desc->type = NFT_DATA_VERDICT;
7712 return 0;
7713}
7714
7715static void nft_verdict_uninit(const struct nft_data *data)
7716{
1ca2e170 7717 switch (data->verdict.code) {
96518518
PM		 7718 case NFT_JUMP:
7719 case NFT_GOTO:
1ca2e170 7720 data->verdict.chain->use--;
96518518
PM		 7721 break;
7722 }
7723}
7724
33d5a7b1 7725int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 7726{
7727 struct nlattr *nest;
7728
ae0be8de 7729 nest = nla_nest_start_noflag(skb, type);
96518518
PM		 7730 if (!nest)
7731 goto nla_put_failure;
7732
33d5a7b1 7733 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 7734 goto nla_put_failure;
7735
33d5a7b1 7736 switch (v->code) {
96518518
PM		 7737 case NFT_JUMP:
7738 case NFT_GOTO:
1ca2e170 7739 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 7740 v->chain->name))
96518518
PM		 7741 goto nla_put_failure;
7742 }
7743 nla_nest_end(skb, nest);
7744 return 0;
7745
7746nla_put_failure:
7747 return -1;
7748}
7749
d0a11fc3
PM		 7750static int nft_value_init(const struct nft_ctx *ctx,
7751 struct nft_data *data, unsigned int size,
96518518
PM		 7752 struct nft_data_desc *desc, const struct nlattr *nla)
7753{
7754 unsigned int len;
7755
7756 len = nla_len(nla);
7757 if (len == 0)
7758 return -EINVAL;
d0a11fc3 7759 if (len > size)
96518518
PM		 7760 return -EOVERFLOW;
7761
d0a11fc3 7762 nla_memcpy(data->data, nla, len);
96518518
PM		 7763 desc->type = NFT_DATA_VALUE;
7764 desc->len = len;
7765 return 0;
7766}
7767
7768static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
7769 unsigned int len)
7770{
7771 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
7772}
7773
7774static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 7775 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 7776 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
7777};
7778
7779/**
7780 * nft_data_init - parse nf_tables data netlink attributes
7781 *
7782 * @ctx: context of the expression using the data
7783 * @data: destination struct nft_data
d0a11fc3 7784 * @size: maximum data length
96518518
PM		 7785 * @desc: data description
7786 * @nla: netlink attribute containing data
7787 *
7788 * Parse the netlink data attributes and initialize a struct nft_data.
7789 * The type and length of data are returned in the data description.
7790 *
7791 * The caller can indicate that it only wants to accept data of type
7792 * NFT_DATA_VALUE by passing NULL for the ctx argument.
7793 */
d0a11fc3
PM		 7794int nft_data_init(const struct nft_ctx *ctx,
7795 struct nft_data *data, unsigned int size,
96518518
PM		 7796 struct nft_data_desc *desc, const struct nlattr *nla)
7797{
7798 struct nlattr *tb[NFTA_DATA_MAX + 1];
7799 int err;
7800
8cb08174
JB		 7801 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
7802 nft_data_policy, NULL);
96518518
PM		 7803 if (err < 0)
7804 return err;
7805
7806 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 7807 return nft_value_init(ctx, data, size, desc,
7808 tb[NFTA_DATA_VALUE]);
96518518
PM		 7809 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
7810 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
7811 return -EINVAL;
7812}
7813EXPORT_SYMBOL_GPL(nft_data_init);
7814
7815/**
59105446 7816 * nft_data_release - release a nft_data item
96518518
PM		 7817 *
7818 * @data: struct nft_data to release
7819 * @type: type of data
7820 *
7821 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
7822 * all others need to be released by calling this function.
7823 */
59105446 7824void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 7825{
960bd2c2 7826 if (type < NFT_DATA_VERDICT)
96518518 7827 return;
960bd2c2 7828 switch (type) {
96518518
PM		 7829 case NFT_DATA_VERDICT:
7830 return nft_verdict_uninit(data);
7831 default:
7832 WARN_ON(1);
7833 }
7834}
59105446 7835EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 7836
7837int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
7838 enum nft_data_types type, unsigned int len)
7839{
7840 struct nlattr *nest;
7841 int err;
7842
ae0be8de 7843 nest = nla_nest_start_noflag(skb, attr);
96518518
PM		 7844 if (nest == NULL)
7845 return -1;
7846
7847 switch (type) {
7848 case NFT_DATA_VALUE:
7849 err = nft_value_dump(skb, data, len);
7850 break;
7851 case NFT_DATA_VERDICT:
33d5a7b1 7852 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 7853 break;
7854 default:
7855 err = -EINVAL;
7856 WARN_ON(1);
7857 }
7858
7859 nla_nest_end(skb, nest);
7860 return err;
7861}
7862EXPORT_SYMBOL_GPL(nft_data_dump);
7863
5ebe0b0e
PNA		 7864int __nft_release_basechain(struct nft_ctx *ctx)
7865{
7866 struct nft_rule *rule, *nr;
7867
fa5950e4
FW		 7868 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
7869 return 0;
5ebe0b0e 7870
c974a3a3 7871 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
5ebe0b0e
PNA		 7872 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
7873 list_del(&rule->list);
7874 ctx->chain->use--;
bb7b40ae 7875 nf_tables_rule_release(ctx, rule);
5ebe0b0e 7876 }
1b2470e5 7877 nft_chain_del(ctx->chain);
5ebe0b0e 7878 ctx->table->use--;
43a605f2 7879 nf_tables_chain_destroy(ctx);
5ebe0b0e
PNA		 7880
7881 return 0;
7882}
7883EXPORT_SYMBOL_GPL(__nft_release_basechain);
7884
98319cb9 7885static void __nft_release_tables(struct net *net)
df05ef87 7886{
3b49e2e9 7887 struct nft_flowtable *flowtable, *nf;
df05ef87
PNA		 7888 struct nft_table *table, *nt;
7889 struct nft_chain *chain, *nc;
e5009240 7890 struct nft_object *obj, *ne;
df05ef87
PNA		 7891 struct nft_rule *rule, *nr;
7892 struct nft_set *set, *ns;
7893 struct nft_ctx ctx = {
7894 .net = net,
43a605f2 7895 .family = NFPROTO_NETDEV,
df05ef87
PNA		 7896 };
7897
36596dad 7898 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
98319cb9 7899 ctx.family = table->family;
dd4cbef7 7900
df05ef87 7901 list_for_each_entry(chain, &table->chains, list)
c974a3a3 7902 nf_tables_unregister_hook(net, table, chain);
df05ef87
PNA		 7903 /* No packets are walking on these chains anymore. */
7904 ctx.table = table;
7905 list_for_each_entry(chain, &table->chains, list) {
7906 ctx.chain = chain;
7907 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7908 list_del(&rule->list);
7909 chain->use--;
bb7b40ae 7910 nf_tables_rule_release(&ctx, rule);
df05ef87
PNA		 7911 }
7912 }
3b49e2e9
PNA		 7913 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7914 list_del(&flowtable->list);
7915 table->use--;
7916 nf_tables_flowtable_destroy(flowtable);
7917 }
df05ef87
PNA		 7918 list_for_each_entry_safe(set, ns, &table->sets, list) {
7919 list_del(&set->list);
7920 table->use--;
7921 nft_set_destroy(set);
7922 }
e5009240 7923 list_for_each_entry_safe(obj, ne, &table->objects, list) {
d152159b 7924 nft_obj_del(obj);
e5009240 7925 table->use--;
00bfb320 7926 nft_obj_destroy(&ctx, obj);
e5009240 7927 }
df05ef87 7928 list_for_each_entry_safe(chain, nc, &table->chains, list) {
43a605f2 7929 ctx.chain = chain;
1b2470e5 7930 nft_chain_del(chain);
df05ef87 7931 table->use--;
43a605f2 7932 nf_tables_chain_destroy(&ctx);
df05ef87
PNA		 7933 }
7934 list_del(&table->list);
7935 nf_tables_table_destroy(&ctx);
7936 }
7937}
7938
dd4cbef7
PNA		 7939static int __net_init nf_tables_init_net(struct net *net)
7940{
7941 INIT_LIST_HEAD(&net->nft.tables);
7942 INIT_LIST_HEAD(&net->nft.commit_list);
f102d66b 7943 mutex_init(&net->nft.commit_mutex);
dd4cbef7 7944 net->nft.base_seq = 1;
a654de8f
PNA		 7945 net->nft.validate_state = NFT_VALIDATE_SKIP;
7946
dd4cbef7
PNA		 7947 return 0;
7948}
7949
7950static void __net_exit nf_tables_exit_net(struct net *net)
7951{
f102d66b 7952 mutex_lock(&net->nft.commit_mutex);
71ad00c5
FW		 7953 if (!list_empty(&net->nft.commit_list))
7954 __nf_tables_abort(net);
98319cb9 7955 __nft_release_tables(net);
f102d66b 7956 mutex_unlock(&net->nft.commit_mutex);
dd4cbef7 7957 WARN_ON_ONCE(!list_empty(&net->nft.tables));
dd4cbef7
PNA		 7958}
7959
99633ab2
PNA		 7960static struct pernet_operations nf_tables_net_ops = {
7961 .init = nf_tables_init_net,
613d0776 7962 .exit = nf_tables_exit_net,
99633ab2
PNA		 7963};
7964
96518518
PM		 7965static int __init nf_tables_module_init(void)
7966{
7967 int err;
7968
0935d558 7969 spin_lock_init(&nf_tables_destroy_list_lock);
d209df3e
FW		 7970 err = register_pernet_subsys(&nf_tables_net_ops);
7971 if (err < 0)
7972 return err;
7973
7974 err = nft_chain_filter_init();
7975 if (err < 0)
7976 goto err1;
02c7b25e 7977
96518518
PM		 7978 err = nf_tables_core_module_init();
7979 if (err < 0)
d209df3e 7980 goto err2;
96518518 7981
d209df3e 7982 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
96518518 7983 if (err < 0)
d209df3e 7984 goto err3;
96518518 7985
4d44175a
FW		 7986 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
7987 if (err < 0)
7988 goto err4;
7989
06d392cb 7990 err = nft_offload_init();
7991 if (err < 0)
7992 goto err5;
7993
d209df3e
FW		 7994 /* must be last */
7995 err = nfnetlink_subsys_register(&nf_tables_subsys);
7996 if (err < 0)
06d392cb 7997 goto err6;
3b49e2e9 7998
c1deb065 7999 nft_chain_route_init();
3474a2c6 8000
d209df3e 8001 return err;
06d392cb 8002err6:
8003 nft_offload_exit();
4d44175a
FW		 8004err5:
8005 rhltable_destroy(&nft_objname_ht);
d209df3e
FW		 8006err4:
8007 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
8008err3:
96518518 8009 nf_tables_core_module_exit();
d209df3e
FW		 8010err2:
8011 nft_chain_filter_fini();
8012err1:
8013 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 8014 return err;
8015}
8016
8017static void __exit nf_tables_module_exit(void)
8018{
8019 nfnetlink_subsys_unregister(&nf_tables_subsys);
06d392cb 8020 nft_offload_exit();
3b49e2e9 8021 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
0a2cf5ee 8022 nft_chain_filter_fini();
c1deb065 8023 nft_chain_route_fini();
71ad00c5 8024 unregister_pernet_subsys(&nf_tables_net_ops);
0935d558 8025 cancel_work_sync(&trans_destroy_work);
1b1bc49c 8026 rcu_barrier();
4d44175a 8027 rhltable_destroy(&nft_objname_ht);
96518518 8028 nf_tables_core_module_exit();
96518518
PM		 8029}
8030
8031module_init(nf_tables_module_init);
8032module_exit(nf_tables_module_exit);
8033
8034MODULE_LICENSE("GPL");
8035MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
8036MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Linux 6.x block layer and io_uring tree(s)