projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_tables: add message type to transactions
[linux-block.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nfnetlink.h>
18#include <linux/netfilter/nf_tables.h>
19#include <net/netfilter/nf_tables_core.h>
20#include <net/netfilter/nf_tables.h>
99633ab2 21#include <net/net_namespace.h>
96518518
PM		 22#include <net/sock.h>
23
96518518
PM		 24static LIST_HEAD(nf_tables_expressions);
25
26/**
27 * nft_register_afinfo - register nf_tables address family info
28 *
29 * @afi: address family info to register
30 *
31 * Register the address family for use with nf_tables. Returns zero on
32 * success or a negative errno code otherwise.
33 */
99633ab2 34int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 35{
36 INIT_LIST_HEAD(&afi->tables);
37 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 38 list_add_tail(&afi->list, &net->nft.af_info);
96518518
PM		 39 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
40 return 0;
41}
42EXPORT_SYMBOL_GPL(nft_register_afinfo);
43
44/**
45 * nft_unregister_afinfo - unregister nf_tables address family info
46 *
47 * @afi: address family info to unregister
48 *
49 * Unregister the address family for use with nf_tables.
50 */
51void nft_unregister_afinfo(struct nft_af_info *afi)
52{
53 nfnl_lock(NFNL_SUBSYS_NFTABLES);
54 list_del(&afi->list);
55 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
56}
57EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
58
99633ab2 59static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
96518518
PM		 60{
61 struct nft_af_info *afi;
62
99633ab2 63 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 64 if (afi->family == family)
65 return afi;
66 }
67 return NULL;
68}
69
99633ab2
PNA		 70static struct nft_af_info *
71nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
96518518
PM		 72{
73 struct nft_af_info *afi;
74
99633ab2 75 afi = nft_afinfo_lookup(net, family);
96518518
PM		 76 if (afi != NULL)
77 return afi;
78#ifdef CONFIG_MODULES
79 if (autoload) {
80 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
81 request_module("nft-afinfo-%u", family);
82 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 83 afi = nft_afinfo_lookup(net, family);
96518518
PM		 84 if (afi != NULL)
85 return ERR_PTR(-EAGAIN);
86 }
87#endif
88 return ERR_PTR(-EAFNOSUPPORT);
89}
90
7c95f6d8
PNA		 91static void nft_ctx_init(struct nft_ctx *ctx,
92 const struct sk_buff *skb,
93 const struct nlmsghdr *nlh,
94 struct nft_af_info *afi,
95 struct nft_table *table,
96 struct nft_chain *chain,
97 const struct nlattr * const *nla)
98{
99 ctx->net = sock_net(skb->sk);
100 ctx->skb = skb;
101 ctx->nlh = nlh;
102 ctx->afi = afi;
103 ctx->table = table;
104 ctx->chain = chain;
105 ctx->nla = nla;
106}
107
b380e5c7
PNA		 108static struct nft_trans *nft_trans_alloc(struct nft_ctx *ctx, int msg_type,
109 u32 size)
1081d11b
PNA		 110{
111 struct nft_trans *trans;
112
113 trans = kzalloc(sizeof(struct nft_trans) + size, GFP_KERNEL);
114 if (trans == NULL)
115 return NULL;
116
b380e5c7 117 trans->msg_type = msg_type;
1081d11b
PNA		 118 trans->ctx = *ctx;
119
120 return trans;
121}
122
123static void nft_trans_destroy(struct nft_trans *trans)
124{
125 list_del(&trans->list);
126 kfree(trans);
127}
128
96518518
PM		 129/*
130 * Tables
131 */
132
133static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
134 const struct nlattr *nla)
135{
136 struct nft_table *table;
137
138 list_for_each_entry(table, &afi->tables, list) {
139 if (!nla_strcmp(nla, table->name))
140 return table;
141 }
142 return NULL;
143}
144
145static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
9370761c 146 const struct nlattr *nla)
96518518
PM		 147{
148 struct nft_table *table;
149
150 if (nla == NULL)
151 return ERR_PTR(-EINVAL);
152
153 table = nft_table_lookup(afi, nla);
154 if (table != NULL)
155 return table;
156
96518518
PM		 157 return ERR_PTR(-ENOENT);
158}
159
160static inline u64 nf_tables_alloc_handle(struct nft_table *table)
161{
162 return ++table->hgenerator;
163}
164
2a37d755 165static const struct nf_chain_type *chain_type[AF_MAX][NFT_CHAIN_T_MAX];
9370761c 166
2a37d755 167static const struct nf_chain_type *
baae3e62 168__nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
9370761c
PNA		 169{
170 int i;
171
baae3e62 172 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 173 if (chain_type[family][i] != NULL &&
174 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 175 return chain_type[family][i];
9370761c 176 }
baae3e62 177 return NULL;
9370761c
PNA		 178}
179
2a37d755 180static const struct nf_chain_type *
baae3e62
PM		 181nf_tables_chain_type_lookup(const struct nft_af_info *afi,
182 const struct nlattr *nla,
183 bool autoload)
9370761c 184{
2a37d755 185 const struct nf_chain_type *type;
9370761c
PNA		 186
187 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 188 if (type != NULL)
189 return type;
9370761c 190#ifdef CONFIG_MODULES
93b0806f 191 if (autoload) {
9370761c
PNA		 192 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
193 request_module("nft-chain-%u-%*.s", afi->family,
194 nla_len(nla)-1, (const char *)nla_data(nla));
195 nfnl_lock(NFNL_SUBSYS_NFTABLES);
196 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 197 if (type != NULL)
198 return ERR_PTR(-EAGAIN);
9370761c
PNA		 199 }
200#endif
93b0806f 201 return ERR_PTR(-ENOENT);
9370761c
PNA		 202}
203
96518518
PM		 204static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
205 [NFTA_TABLE_NAME] = { .type = NLA_STRING },
9ddf6323 206 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
96518518
PM		 207};
208
209static int nf_tables_fill_table_info(struct sk_buff *skb, u32 portid, u32 seq,
210 int event, u32 flags, int family,
211 const struct nft_table *table)
212{
213 struct nlmsghdr *nlh;
214 struct nfgenmsg *nfmsg;
215
216 event |= NFNL_SUBSYS_NFTABLES << 8;
217 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
218 if (nlh == NULL)
219 goto nla_put_failure;
220
221 nfmsg = nlmsg_data(nlh);
222 nfmsg->nfgen_family = family;
223 nfmsg->version = NFNETLINK_V0;
224 nfmsg->res_id = 0;
225
9ddf6323 226 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768
TB		 227 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
228 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
96518518
PM		 229 goto nla_put_failure;
230
231 return nlmsg_end(skb, nlh);
232
233nla_put_failure:
234 nlmsg_trim(skb, nlh);
235 return -1;
236}
237
238static int nf_tables_table_notify(const struct sk_buff *oskb,
239 const struct nlmsghdr *nlh,
240 const struct nft_table *table,
241 int event, int family)
242{
243 struct sk_buff *skb;
244 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
245 u32 seq = nlh ? nlh->nlmsg_seq : 0;
246 struct net *net = oskb ? sock_net(oskb->sk) : &init_net;
247 bool report;
248 int err;
249
250 report = nlh ? nlmsg_report(nlh) : false;
251 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
252 return 0;
253
254 err = -ENOBUFS;
255 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
256 if (skb == NULL)
257 goto err;
258
259 err = nf_tables_fill_table_info(skb, portid, seq, event, 0,
260 family, table);
261 if (err < 0) {
262 kfree_skb(skb);
263 goto err;
264 }
265
266 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
267 GFP_KERNEL);
268err:
269 if (err < 0)
270 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
271 return err;
272}
273
274static int nf_tables_dump_tables(struct sk_buff *skb,
275 struct netlink_callback *cb)
276{
277 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
278 const struct nft_af_info *afi;
279 const struct nft_table *table;
280 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 281 struct net *net = sock_net(skb->sk);
96518518
PM		 282 int family = nfmsg->nfgen_family;
283
99633ab2 284 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 285 if (family != NFPROTO_UNSPEC && family != afi->family)
286 continue;
287
288 list_for_each_entry(table, &afi->tables, list) {
289 if (idx < s_idx)
290 goto cont;
291 if (idx > s_idx)
292 memset(&cb->args[1], 0,
293 sizeof(cb->args) - sizeof(cb->args[0]));
294 if (nf_tables_fill_table_info(skb,
295 NETLINK_CB(cb->skb).portid,
296 cb->nlh->nlmsg_seq,
297 NFT_MSG_NEWTABLE,
298 NLM_F_MULTI,
299 afi->family, table) < 0)
300 goto done;
301cont:
302 idx++;
303 }
304 }
305done:
306 cb->args[0] = idx;
307 return skb->len;
308}
309
310static int nf_tables_gettable(struct sock *nlsk, struct sk_buff *skb,
311 const struct nlmsghdr *nlh,
312 const struct nlattr * const nla[])
313{
314 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
315 const struct nft_af_info *afi;
316 const struct nft_table *table;
317 struct sk_buff *skb2;
99633ab2 318 struct net *net = sock_net(skb->sk);
96518518
PM		 319 int family = nfmsg->nfgen_family;
320 int err;
321
322 if (nlh->nlmsg_flags & NLM_F_DUMP) {
323 struct netlink_dump_control c = {
324 .dump = nf_tables_dump_tables,
325 };
326 return netlink_dump_start(nlsk, skb, nlh, &c);
327 }
328
99633ab2 329 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 330 if (IS_ERR(afi))
331 return PTR_ERR(afi);
332
9370761c 333 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
96518518
PM		 334 if (IS_ERR(table))
335 return PTR_ERR(table);
336
337 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
338 if (!skb2)
339 return -ENOMEM;
340
341 err = nf_tables_fill_table_info(skb2, NETLINK_CB(skb).portid,
342 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
343 family, table);
344 if (err < 0)
345 goto err;
346
347 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
348
349err:
350 kfree_skb(skb2);
351 return err;
352}
353
115a60b1
PM		 354static int nf_tables_table_enable(const struct nft_af_info *afi,
355 struct nft_table *table)
9ddf6323
PNA		 356{
357 struct nft_chain *chain;
358 int err, i = 0;
359
360 list_for_each_entry(chain, &table->chains, list) {
d2012975
PNA		 361 if (!(chain->flags & NFT_BASE_CHAIN))
362 continue;
363
115a60b1 364 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
9ddf6323
PNA		 365 if (err < 0)
366 goto err;
367
368 i++;
369 }
370 return 0;
371err:
372 list_for_each_entry(chain, &table->chains, list) {
d2012975
PNA		 373 if (!(chain->flags & NFT_BASE_CHAIN))
374 continue;
375
9ddf6323
PNA		 376 if (i-- <= 0)
377 break;
378
115a60b1 379 nf_unregister_hooks(nft_base_chain(chain)->ops, afi->nops);
9ddf6323
PNA		 380 }
381 return err;
382}
383
115a60b1
PM		 384static int nf_tables_table_disable(const struct nft_af_info *afi,
385 struct nft_table *table)
9ddf6323
PNA		 386{
387 struct nft_chain *chain;
388
d2012975
PNA		 389 list_for_each_entry(chain, &table->chains, list) {
390 if (chain->flags & NFT_BASE_CHAIN)
115a60b1
PM		 391 nf_unregister_hooks(nft_base_chain(chain)->ops,
392 afi->nops);
d2012975 393 }
9ddf6323
PNA		 394
395 return 0;
396}
397
398static int nf_tables_updtable(struct sock *nlsk, struct sk_buff *skb,
399 const struct nlmsghdr *nlh,
400 const struct nlattr * const nla[],
401 struct nft_af_info *afi, struct nft_table *table)
402{
403 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
404 int family = nfmsg->nfgen_family, ret = 0;
405
406 if (nla[NFTA_TABLE_FLAGS]) {
c5c1f975 407 u32 flags;
9ddf6323
PNA		 408
409 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
410 if (flags & ~NFT_TABLE_F_DORMANT)
411 return -EINVAL;
412
413 if ((flags & NFT_TABLE_F_DORMANT) &&
414 !(table->flags & NFT_TABLE_F_DORMANT)) {
115a60b1 415 ret = nf_tables_table_disable(afi, table);
9ddf6323
PNA		 416 if (ret >= 0)
417 table->flags |= NFT_TABLE_F_DORMANT;
418 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
419 table->flags & NFT_TABLE_F_DORMANT) {
115a60b1 420 ret = nf_tables_table_enable(afi, table);
9ddf6323
PNA		 421 if (ret >= 0)
422 table->flags &= ~NFT_TABLE_F_DORMANT;
423 }
424 if (ret < 0)
425 goto err;
426 }
427
428 nf_tables_table_notify(skb, nlh, table, NFT_MSG_NEWTABLE, family);
429err:
430 return ret;
431}
432
96518518
PM		 433static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
434 const struct nlmsghdr *nlh,
435 const struct nlattr * const nla[])
436{
437 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
438 const struct nlattr *name;
439 struct nft_af_info *afi;
440 struct nft_table *table;
99633ab2 441 struct net *net = sock_net(skb->sk);
96518518 442 int family = nfmsg->nfgen_family;
c5c1f975 443 u32 flags = 0;
96518518 444
99633ab2 445 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 446 if (IS_ERR(afi))
447 return PTR_ERR(afi);
448
449 name = nla[NFTA_TABLE_NAME];
9370761c 450 table = nf_tables_table_lookup(afi, name);
96518518
PM		 451 if (IS_ERR(table)) {
452 if (PTR_ERR(table) != -ENOENT)
453 return PTR_ERR(table);
454 table = NULL;
455 }
456
457 if (table != NULL) {
458 if (nlh->nlmsg_flags & NLM_F_EXCL)
459 return -EEXIST;
460 if (nlh->nlmsg_flags & NLM_F_REPLACE)
461 return -EOPNOTSUPP;
9ddf6323 462 return nf_tables_updtable(nlsk, skb, nlh, nla, afi, table);
96518518
PM		 463 }
464
c5c1f975
PM		 465 if (nla[NFTA_TABLE_FLAGS]) {
466 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
467 if (flags & ~NFT_TABLE_F_DORMANT)
468 return -EINVAL;
469 }
470
7047f9d0
PM		 471 if (!try_module_get(afi->owner))
472 return -EAFNOSUPPORT;
473
96518518 474 table = kzalloc(sizeof(*table) + nla_len(name), GFP_KERNEL);
7047f9d0
PM		 475 if (table == NULL) {
476 module_put(afi->owner);
96518518 477 return -ENOMEM;
7047f9d0 478 }
96518518
PM		 479
480 nla_strlcpy(table->name, name, nla_len(name));
481 INIT_LIST_HEAD(&table->chains);
20a69341 482 INIT_LIST_HEAD(&table->sets);
c5c1f975 483 table->flags = flags;
9ddf6323 484
96518518
PM		 485 list_add_tail(&table->list, &afi->tables);
486 nf_tables_table_notify(skb, nlh, table, NFT_MSG_NEWTABLE, family);
487 return 0;
488}
489
490static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
491 const struct nlmsghdr *nlh,
492 const struct nlattr * const nla[])
493{
494 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
495 struct nft_af_info *afi;
496 struct nft_table *table;
99633ab2 497 struct net *net = sock_net(skb->sk);
96518518
PM		 498 int family = nfmsg->nfgen_family;
499
99633ab2 500 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 501 if (IS_ERR(afi))
502 return PTR_ERR(afi);
503
9370761c 504 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
96518518
PM		 505 if (IS_ERR(table))
506 return PTR_ERR(table);
507
44a6f0df 508 if (!list_empty(&table->chains) || !list_empty(&table->sets))
96518518
PM		 509 return -EBUSY;
510
511 list_del(&table->list);
512 nf_tables_table_notify(skb, nlh, table, NFT_MSG_DELTABLE, family);
513 kfree(table);
7047f9d0 514 module_put(afi->owner);
96518518
PM		 515 return 0;
516}
517
2a37d755 518int nft_register_chain_type(const struct nf_chain_type *ctype)
96518518 519{
9370761c 520 int err = 0;
96518518
PM		 521
522 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c
PNA		 523 if (chain_type[ctype->family][ctype->type] != NULL) {
524 err = -EBUSY;
525 goto out;
96518518 526 }
9370761c
PNA		 527 chain_type[ctype->family][ctype->type] = ctype;
528out:
96518518
PM		 529 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
530 return err;
531}
9370761c 532EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 533
2a37d755 534void nft_unregister_chain_type(const struct nf_chain_type *ctype)
96518518 535{
96518518 536 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 537 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 538 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
539}
9370761c 540EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 541
542/*
543 * Chains
544 */
545
546static struct nft_chain *
547nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle)
548{
549 struct nft_chain *chain;
550
551 list_for_each_entry(chain, &table->chains, list) {
552 if (chain->handle == handle)
553 return chain;
554 }
555
556 return ERR_PTR(-ENOENT);
557}
558
559static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
560 const struct nlattr *nla)
561{
562 struct nft_chain *chain;
563
564 if (nla == NULL)
565 return ERR_PTR(-EINVAL);
566
567 list_for_each_entry(chain, &table->chains, list) {
568 if (!nla_strcmp(nla, chain->name))
569 return chain;
570 }
571
572 return ERR_PTR(-ENOENT);
573}
574
575static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
576 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING },
577 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
578 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
579 .len = NFT_CHAIN_MAXNAMELEN - 1 },
580 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 581 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 582 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 583 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 584};
585
586static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
587 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
588 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
589};
590
0ca743a5
PNA		 591static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
592{
593 struct nft_stats *cpu_stats, total;
594 struct nlattr *nest;
595 int cpu;
596
597 memset(&total, 0, sizeof(total));
598 for_each_possible_cpu(cpu) {
599 cpu_stats = per_cpu_ptr(stats, cpu);
600 total.pkts += cpu_stats->pkts;
601 total.bytes += cpu_stats->bytes;
602 }
603 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
604 if (nest == NULL)
605 goto nla_put_failure;
606
607 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts)) ||
608 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes)))
609 goto nla_put_failure;
610
611 nla_nest_end(skb, nest);
612 return 0;
613
614nla_put_failure:
615 return -ENOSPC;
616}
617
96518518
PM		 618static int nf_tables_fill_chain_info(struct sk_buff *skb, u32 portid, u32 seq,
619 int event, u32 flags, int family,
620 const struct nft_table *table,
621 const struct nft_chain *chain)
622{
623 struct nlmsghdr *nlh;
624 struct nfgenmsg *nfmsg;
625
626 event |= NFNL_SUBSYS_NFTABLES << 8;
627 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
628 if (nlh == NULL)
629 goto nla_put_failure;
630
631 nfmsg = nlmsg_data(nlh);
632 nfmsg->nfgen_family = family;
633 nfmsg->version = NFNETLINK_V0;
634 nfmsg->res_id = 0;
635
636 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
637 goto nla_put_failure;
638 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle)))
639 goto nla_put_failure;
640 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
641 goto nla_put_failure;
642
643 if (chain->flags & NFT_BASE_CHAIN) {
0ca743a5 644 const struct nft_base_chain *basechain = nft_base_chain(chain);
115a60b1 645 const struct nf_hook_ops *ops = &basechain->ops[0];
0ca743a5
PNA		 646 struct nlattr *nest;
647
648 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 649 if (nest == NULL)
650 goto nla_put_failure;
651 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
652 goto nla_put_failure;
653 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
654 goto nla_put_failure;
655 nla_nest_end(skb, nest);
9370761c 656
0ca743a5
PNA		 657 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
658 htonl(basechain->policy)))
659 goto nla_put_failure;
660
baae3e62
PM		 661 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
662 goto nla_put_failure;
0ca743a5
PNA		 663
664 if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
665 goto nla_put_failure;
96518518
PM		 666 }
667
0ca743a5
PNA		 668 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
669 goto nla_put_failure;
670
96518518
PM		 671 return nlmsg_end(skb, nlh);
672
673nla_put_failure:
674 nlmsg_trim(skb, nlh);
675 return -1;
676}
677
678static int nf_tables_chain_notify(const struct sk_buff *oskb,
679 const struct nlmsghdr *nlh,
680 const struct nft_table *table,
681 const struct nft_chain *chain,
682 int event, int family)
683{
684 struct sk_buff *skb;
685 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
686 struct net *net = oskb ? sock_net(oskb->sk) : &init_net;
687 u32 seq = nlh ? nlh->nlmsg_seq : 0;
688 bool report;
689 int err;
690
691 report = nlh ? nlmsg_report(nlh) : false;
692 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
693 return 0;
694
695 err = -ENOBUFS;
696 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
697 if (skb == NULL)
698 goto err;
699
700 err = nf_tables_fill_chain_info(skb, portid, seq, event, 0, family,
701 table, chain);
702 if (err < 0) {
703 kfree_skb(skb);
704 goto err;
705 }
706
707 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
708 GFP_KERNEL);
709err:
710 if (err < 0)
711 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
712 return err;
713}
714
715static int nf_tables_dump_chains(struct sk_buff *skb,
716 struct netlink_callback *cb)
717{
718 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
719 const struct nft_af_info *afi;
720 const struct nft_table *table;
721 const struct nft_chain *chain;
722 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 723 struct net *net = sock_net(skb->sk);
96518518
PM		 724 int family = nfmsg->nfgen_family;
725
99633ab2 726 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 727 if (family != NFPROTO_UNSPEC && family != afi->family)
728 continue;
729
730 list_for_each_entry(table, &afi->tables, list) {
731 list_for_each_entry(chain, &table->chains, list) {
732 if (idx < s_idx)
733 goto cont;
734 if (idx > s_idx)
735 memset(&cb->args[1], 0,
736 sizeof(cb->args) - sizeof(cb->args[0]));
737 if (nf_tables_fill_chain_info(skb, NETLINK_CB(cb->skb).portid,
738 cb->nlh->nlmsg_seq,
739 NFT_MSG_NEWCHAIN,
740 NLM_F_MULTI,
741 afi->family, table, chain) < 0)
742 goto done;
743cont:
744 idx++;
745 }
746 }
747 }
748done:
749 cb->args[0] = idx;
750 return skb->len;
751}
752
753
754static int nf_tables_getchain(struct sock *nlsk, struct sk_buff *skb,
755 const struct nlmsghdr *nlh,
756 const struct nlattr * const nla[])
757{
758 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
759 const struct nft_af_info *afi;
760 const struct nft_table *table;
761 const struct nft_chain *chain;
762 struct sk_buff *skb2;
99633ab2 763 struct net *net = sock_net(skb->sk);
96518518
PM		 764 int family = nfmsg->nfgen_family;
765 int err;
766
767 if (nlh->nlmsg_flags & NLM_F_DUMP) {
768 struct netlink_dump_control c = {
769 .dump = nf_tables_dump_chains,
770 };
771 return netlink_dump_start(nlsk, skb, nlh, &c);
772 }
773
99633ab2 774 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 775 if (IS_ERR(afi))
776 return PTR_ERR(afi);
777
9370761c 778 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 779 if (IS_ERR(table))
780 return PTR_ERR(table);
781
782 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
783 if (IS_ERR(chain))
784 return PTR_ERR(chain);
785
786 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
787 if (!skb2)
788 return -ENOMEM;
789
790 err = nf_tables_fill_chain_info(skb2, NETLINK_CB(skb).portid,
791 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
792 family, table, chain);
793 if (err < 0)
794 goto err;
795
796 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
797
798err:
799 kfree_skb(skb2);
800 return err;
801}
802
0ca743a5
PNA		 803static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
804 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
805 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
806};
807
808static int
809nf_tables_counters(struct nft_base_chain *chain, const struct nlattr *attr)
810{
811 struct nlattr *tb[NFTA_COUNTER_MAX+1];
812 struct nft_stats __percpu *newstats;
813 struct nft_stats *stats;
814 int err;
815
816 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy);
817 if (err < 0)
818 return err;
819
820 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
821 return -EINVAL;
822
823 newstats = alloc_percpu(struct nft_stats);
824 if (newstats == NULL)
825 return -ENOMEM;
826
827 /* Restore old counters on this cpu, no problem. Per-cpu statistics
828 * are not exposed to userspace.
829 */
830 stats = this_cpu_ptr(newstats);
831 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
832 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
833
834 if (chain->stats) {
0ca743a5 835 struct nft_stats __percpu *oldstats =
67a8fc27 836 nft_dereference(chain->stats);
0ca743a5
PNA		 837
838 rcu_assign_pointer(chain->stats, newstats);
839 synchronize_rcu();
840 free_percpu(oldstats);
841 } else
842 rcu_assign_pointer(chain->stats, newstats);
843
844 return 0;
845}
846
96518518
PM		 847static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
848 const struct nlmsghdr *nlh,
849 const struct nlattr * const nla[])
850{
851 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
852 const struct nlattr * uninitialized_var(name);
7c95f6d8 853 struct nft_af_info *afi;
96518518
PM		 854 struct nft_table *table;
855 struct nft_chain *chain;
0ca743a5 856 struct nft_base_chain *basechain = NULL;
96518518 857 struct nlattr *ha[NFTA_HOOK_MAX + 1];
99633ab2 858 struct net *net = sock_net(skb->sk);
96518518 859 int family = nfmsg->nfgen_family;
57de2a0c 860 u8 policy = NF_ACCEPT;
96518518 861 u64 handle = 0;
115a60b1 862 unsigned int i;
96518518
PM		 863 int err;
864 bool create;
865
866 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
867
99633ab2 868 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 869 if (IS_ERR(afi))
870 return PTR_ERR(afi);
871
9370761c 872 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 873 if (IS_ERR(table))
874 return PTR_ERR(table);
875
96518518
PM		 876 chain = NULL;
877 name = nla[NFTA_CHAIN_NAME];
878
879 if (nla[NFTA_CHAIN_HANDLE]) {
880 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
881 chain = nf_tables_chain_lookup_byhandle(table, handle);
882 if (IS_ERR(chain))
883 return PTR_ERR(chain);
884 } else {
885 chain = nf_tables_chain_lookup(table, name);
886 if (IS_ERR(chain)) {
887 if (PTR_ERR(chain) != -ENOENT)
888 return PTR_ERR(chain);
889 chain = NULL;
890 }
891 }
892
57de2a0c
PM		 893 if (nla[NFTA_CHAIN_POLICY]) {
894 if ((chain != NULL &&
895 !(chain->flags & NFT_BASE_CHAIN)) ||
896 nla[NFTA_CHAIN_HOOK] == NULL)
897 return -EOPNOTSUPP;
898
8f46df18 899 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 900 switch (policy) {
901 case NF_DROP:
902 case NF_ACCEPT:
903 break;
904 default:
905 return -EINVAL;
906 }
907 }
908
96518518
PM		 909 if (chain != NULL) {
910 if (nlh->nlmsg_flags & NLM_F_EXCL)
911 return -EEXIST;
912 if (nlh->nlmsg_flags & NLM_F_REPLACE)
913 return -EOPNOTSUPP;
914
915 if (nla[NFTA_CHAIN_HANDLE] && name &&
916 !IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME])))
917 return -EEXIST;
918
0ca743a5
PNA		 919 if (nla[NFTA_CHAIN_COUNTERS]) {
920 if (!(chain->flags & NFT_BASE_CHAIN))
921 return -EOPNOTSUPP;
922
923 err = nf_tables_counters(nft_base_chain(chain),
924 nla[NFTA_CHAIN_COUNTERS]);
925 if (err < 0)
926 return err;
927 }
928
4401a862
PM		 929 if (nla[NFTA_CHAIN_POLICY])
930 nft_base_chain(chain)->policy = policy;
931
96518518
PM		 932 if (nla[NFTA_CHAIN_HANDLE] && name)
933 nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
934
935 goto notify;
936 }
937
75820676
PM		 938 if (table->use == UINT_MAX)
939 return -EOVERFLOW;
940
96518518 941 if (nla[NFTA_CHAIN_HOOK]) {
2a37d755 942 const struct nf_chain_type *type;
96518518 943 struct nf_hook_ops *ops;
9370761c 944 nf_hookfn *hookfn;
115a60b1 945 u32 hooknum, priority;
9370761c 946
baae3e62 947 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
9370761c
PNA		 948 if (nla[NFTA_CHAIN_TYPE]) {
949 type = nf_tables_chain_type_lookup(afi,
950 nla[NFTA_CHAIN_TYPE],
951 create);
93b0806f
PM		 952 if (IS_ERR(type))
953 return PTR_ERR(type);
9370761c 954 }
96518518
PM		 955
956 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
957 nft_hook_policy);
958 if (err < 0)
959 return err;
960 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
961 ha[NFTA_HOOK_PRIORITY] == NULL)
962 return -EINVAL;
9370761c
PNA		 963
964 hooknum = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
965 if (hooknum >= afi->nhooks)
96518518 966 return -EINVAL;
115a60b1 967 priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
96518518 968
baae3e62 969 if (!(type->hook_mask & (1 << hooknum)))
9370761c 970 return -EOPNOTSUPP;
fa2c1de0 971 if (!try_module_get(type->owner))
baae3e62 972 return -ENOENT;
fa2c1de0 973 hookfn = type->hooks[hooknum];
9370761c 974
96518518
PM		 975 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
976 if (basechain == NULL)
977 return -ENOMEM;
9370761c 978
4401a862
PM		 979 if (nla[NFTA_CHAIN_COUNTERS]) {
980 err = nf_tables_counters(basechain,
981 nla[NFTA_CHAIN_COUNTERS]);
982 if (err < 0) {
fa2c1de0 983 module_put(type->owner);
4401a862
PM		 984 kfree(basechain);
985 return err;
986 }
987 } else {
988 struct nft_stats __percpu *newstats;
989
990 newstats = alloc_percpu(struct nft_stats);
991 if (newstats == NULL) {
fa2c1de0 992 module_put(type->owner);
4401a862
PM		 993 kfree(basechain);
994 return -ENOMEM;
995 }
996 rcu_assign_pointer(basechain->stats, newstats);
997 }
998
9370761c 999 basechain->type = type;
96518518
PM		 1000 chain = &basechain->chain;
1001
115a60b1
PM		 1002 for (i = 0; i < afi->nops; i++) {
1003 ops = &basechain->ops[i];
1004 ops->pf = family;
1005 ops->owner = afi->owner;
1006 ops->hooknum = hooknum;
1007 ops->priority = priority;
1008 ops->priv = chain;
1009 ops->hook = afi->hooks[ops->hooknum];
1010 if (hookfn)
1011 ops->hook = hookfn;
1012 if (afi->hook_ops_init)
1013 afi->hook_ops_init(ops, i);
1014 }
96518518
PM		 1015
1016 chain->flags |= NFT_BASE_CHAIN;
57de2a0c 1017 basechain->policy = policy;
96518518
PM		 1018 } else {
1019 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1020 if (chain == NULL)
1021 return -ENOMEM;
1022 }
1023
1024 INIT_LIST_HEAD(&chain->rules);
1025 chain->handle = nf_tables_alloc_handle(table);
0628b123 1026 chain->net = net;
b5bc89bf 1027 chain->table = table;
96518518
PM		 1028 nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
1029
9ddf6323
PNA		 1030 if (!(table->flags & NFT_TABLE_F_DORMANT) &&
1031 chain->flags & NFT_BASE_CHAIN) {
115a60b1 1032 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
0ca743a5 1033 if (err < 0) {
fa2c1de0 1034 module_put(basechain->type->owner);
0ca743a5
PNA		 1035 free_percpu(basechain->stats);
1036 kfree(basechain);
1037 return err;
1038 }
1039 }
9ddf6323
PNA		 1040 list_add_tail(&chain->list, &table->chains);
1041 table->use++;
96518518
PM		 1042notify:
1043 nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_NEWCHAIN,
1044 family);
1045 return 0;
1046}
1047
0165d932 1048static void nf_tables_chain_destroy(struct nft_chain *chain)
96518518 1049{
96518518
PM		 1050 BUG_ON(chain->use > 0);
1051
0ca743a5 1052 if (chain->flags & NFT_BASE_CHAIN) {
fa2c1de0 1053 module_put(nft_base_chain(chain)->type->owner);
0ca743a5 1054 free_percpu(nft_base_chain(chain)->stats);
96518518 1055 kfree(nft_base_chain(chain));
0ca743a5 1056 } else
96518518
PM		 1057 kfree(chain);
1058}
1059
1060static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
1061 const struct nlmsghdr *nlh,
1062 const struct nlattr * const nla[])
1063{
1064 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1065 struct nft_af_info *afi;
96518518
PM		 1066 struct nft_table *table;
1067 struct nft_chain *chain;
99633ab2 1068 struct net *net = sock_net(skb->sk);
96518518
PM		 1069 int family = nfmsg->nfgen_family;
1070
99633ab2 1071 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1072 if (IS_ERR(afi))
1073 return PTR_ERR(afi);
1074
9370761c 1075 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 1076 if (IS_ERR(table))
1077 return PTR_ERR(table);
1078
1079 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
1080 if (IS_ERR(chain))
1081 return PTR_ERR(chain);
1082
3dd7279f 1083 if (!list_empty(&chain->rules) || chain->use > 0)
96518518
PM		 1084 return -EBUSY;
1085
1086 list_del(&chain->list);
1087 table->use--;
1088
9ddf6323
PNA		 1089 if (!(table->flags & NFT_TABLE_F_DORMANT) &&
1090 chain->flags & NFT_BASE_CHAIN)
115a60b1 1091 nf_unregister_hooks(nft_base_chain(chain)->ops, afi->nops);
96518518
PM		 1092
1093 nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_DELCHAIN,
1094 family);
1095
1096 /* Make sure all rule references are gone before this is released */
0165d932
PNA		 1097 synchronize_rcu();
1098
1099 nf_tables_chain_destroy(chain);
96518518
PM		 1100 return 0;
1101}
1102
96518518
PM		 1103/*
1104 * Expressions
1105 */
1106
1107/**
ef1f7df9
PM		 1108 * nft_register_expr - register nf_tables expr type
1109 * @ops: expr type
96518518 1110 *
ef1f7df9 1111 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1112 * success or a negative errno code otherwise.
1113 */
ef1f7df9 1114int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1115{
1116 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec
TB		 1117 if (type->family == NFPROTO_UNSPEC)
1118 list_add_tail(&type->list, &nf_tables_expressions);
1119 else
1120 list_add(&type->list, &nf_tables_expressions);
96518518
PM		 1121 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1122 return 0;
1123}
1124EXPORT_SYMBOL_GPL(nft_register_expr);
1125
1126/**
ef1f7df9
PM		 1127 * nft_unregister_expr - unregister nf_tables expr type
1128 * @ops: expr type
96518518 1129 *
ef1f7df9 1130 * Unregisters the expr typefor use with nf_tables.
96518518 1131 */
ef1f7df9 1132void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1133{
1134 nfnl_lock(NFNL_SUBSYS_NFTABLES);
ef1f7df9 1135 list_del(&type->list);
96518518
PM		 1136 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1137}
1138EXPORT_SYMBOL_GPL(nft_unregister_expr);
1139
64d46806
PM		 1140static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1141 struct nlattr *nla)
96518518 1142{
ef1f7df9 1143 const struct nft_expr_type *type;
96518518 1144
ef1f7df9 1145 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1146 if (!nla_strcmp(nla, type->name) &&
1147 (!type->family || type->family == family))
ef1f7df9 1148 return type;
96518518
PM		 1149 }
1150 return NULL;
1151}
1152
64d46806
PM		 1153static const struct nft_expr_type *nft_expr_type_get(u8 family,
1154 struct nlattr *nla)
96518518 1155{
ef1f7df9 1156 const struct nft_expr_type *type;
96518518
PM		 1157
1158 if (nla == NULL)
1159 return ERR_PTR(-EINVAL);
1160
64d46806 1161 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1162 if (type != NULL && try_module_get(type->owner))
1163 return type;
96518518
PM		 1164
1165#ifdef CONFIG_MODULES
ef1f7df9 1166 if (type == NULL) {
64d46806
PM		 1167 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1168 request_module("nft-expr-%u-%.*s", family,
1169 nla_len(nla), (char *)nla_data(nla));
1170 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1171 if (__nft_expr_type_get(family, nla))
1172 return ERR_PTR(-EAGAIN);
1173
96518518
PM		 1174 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1175 request_module("nft-expr-%.*s",
1176 nla_len(nla), (char *)nla_data(nla));
1177 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1178 if (__nft_expr_type_get(family, nla))
96518518
PM		 1179 return ERR_PTR(-EAGAIN);
1180 }
1181#endif
1182 return ERR_PTR(-ENOENT);
1183}
1184
1185static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1186 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1187 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1188};
1189
1190static int nf_tables_fill_expr_info(struct sk_buff *skb,
1191 const struct nft_expr *expr)
1192{
ef1f7df9 1193 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1194 goto nla_put_failure;
1195
1196 if (expr->ops->dump) {
1197 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1198 if (data == NULL)
1199 goto nla_put_failure;
1200 if (expr->ops->dump(skb, expr) < 0)
1201 goto nla_put_failure;
1202 nla_nest_end(skb, data);
1203 }
1204
1205 return skb->len;
1206
1207nla_put_failure:
1208 return -1;
1209};
1210
1211struct nft_expr_info {
1212 const struct nft_expr_ops *ops;
ef1f7df9 1213 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1214};
1215
0ca743a5
PNA		 1216static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1217 const struct nlattr *nla,
96518518
PM		 1218 struct nft_expr_info *info)
1219{
ef1f7df9 1220 const struct nft_expr_type *type;
96518518 1221 const struct nft_expr_ops *ops;
ef1f7df9 1222 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1223 int err;
1224
ef1f7df9 1225 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy);
96518518
PM		 1226 if (err < 0)
1227 return err;
1228
64d46806 1229 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1230 if (IS_ERR(type))
1231 return PTR_ERR(type);
1232
1233 if (tb[NFTA_EXPR_DATA]) {
1234 err = nla_parse_nested(info->tb, type->maxattr,
1235 tb[NFTA_EXPR_DATA], type->policy);
1236 if (err < 0)
1237 goto err1;
1238 } else
1239 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1240
1241 if (type->select_ops != NULL) {
0ca743a5
PNA		 1242 ops = type->select_ops(ctx,
1243 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1244 if (IS_ERR(ops)) {
1245 err = PTR_ERR(ops);
1246 goto err1;
1247 }
1248 } else
1249 ops = type->ops;
1250
96518518
PM		 1251 info->ops = ops;
1252 return 0;
ef1f7df9
PM		 1253
1254err1:
1255 module_put(type->owner);
1256 return err;
96518518
PM		 1257}
1258
1259static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1260 const struct nft_expr_info *info,
96518518
PM		 1261 struct nft_expr *expr)
1262{
1263 const struct nft_expr_ops *ops = info->ops;
1264 int err;
1265
1266 expr->ops = ops;
1267 if (ops->init) {
ef1f7df9 1268 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1269 if (err < 0)
1270 goto err1;
1271 }
1272
96518518
PM		 1273 return 0;
1274
1275err1:
1276 expr->ops = NULL;
1277 return err;
1278}
1279
62472bce
PM		 1280static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1281 struct nft_expr *expr)
96518518
PM		 1282{
1283 if (expr->ops->destroy)
62472bce 1284 expr->ops->destroy(ctx, expr);
ef1f7df9 1285 module_put(expr->ops->type->owner);
96518518
PM		 1286}
1287
1288/*
1289 * Rules
1290 */
1291
1292static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1293 u64 handle)
1294{
1295 struct nft_rule *rule;
1296
1297 // FIXME: this sucks
1298 list_for_each_entry(rule, &chain->rules, list) {
1299 if (handle == rule->handle)
1300 return rule;
1301 }
1302
1303 return ERR_PTR(-ENOENT);
1304}
1305
1306static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1307 const struct nlattr *nla)
1308{
1309 if (nla == NULL)
1310 return ERR_PTR(-EINVAL);
1311
1312 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1313}
1314
1315static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
1316 [NFTA_RULE_TABLE] = { .type = NLA_STRING },
1317 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1318 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1319 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1320 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1321 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1322 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1323 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1324 .len = NFT_USERDATA_MAXLEN },
96518518
PM		 1325};
1326
1327static int nf_tables_fill_rule_info(struct sk_buff *skb, u32 portid, u32 seq,
1328 int event, u32 flags, int family,
1329 const struct nft_table *table,
1330 const struct nft_chain *chain,
1331 const struct nft_rule *rule)
1332{
1333 struct nlmsghdr *nlh;
1334 struct nfgenmsg *nfmsg;
1335 const struct nft_expr *expr, *next;
1336 struct nlattr *list;
5e948466
EL		 1337 const struct nft_rule *prule;
1338 int type = event | NFNL_SUBSYS_NFTABLES << 8;
96518518 1339
5e948466 1340 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg),
96518518
PM		 1341 flags);
1342 if (nlh == NULL)
1343 goto nla_put_failure;
1344
1345 nfmsg = nlmsg_data(nlh);
1346 nfmsg->nfgen_family = family;
1347 nfmsg->version = NFNETLINK_V0;
1348 nfmsg->res_id = 0;
1349
1350 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1351 goto nla_put_failure;
1352 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1353 goto nla_put_failure;
1354 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle)))
1355 goto nla_put_failure;
1356
5e948466
EL		 1357 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
1358 prule = list_entry(rule->list.prev, struct nft_rule, list);
1359 if (nla_put_be64(skb, NFTA_RULE_POSITION,
1360 cpu_to_be64(prule->handle)))
1361 goto nla_put_failure;
1362 }
1363
96518518
PM		 1364 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1365 if (list == NULL)
1366 goto nla_put_failure;
1367 nft_rule_for_each_expr(expr, next, rule) {
1368 struct nlattr *elem = nla_nest_start(skb, NFTA_LIST_ELEM);
1369 if (elem == NULL)
1370 goto nla_put_failure;
1371 if (nf_tables_fill_expr_info(skb, expr) < 0)
1372 goto nla_put_failure;
1373 nla_nest_end(skb, elem);
1374 }
1375 nla_nest_end(skb, list);
1376
0768b3b3
PNA		 1377 if (rule->ulen &&
1378 nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
1379 goto nla_put_failure;
1380
96518518
PM		 1381 return nlmsg_end(skb, nlh);
1382
1383nla_put_failure:
1384 nlmsg_trim(skb, nlh);
1385 return -1;
1386}
1387
1388static int nf_tables_rule_notify(const struct sk_buff *oskb,
1389 const struct nlmsghdr *nlh,
1390 const struct nft_table *table,
1391 const struct nft_chain *chain,
1392 const struct nft_rule *rule,
1393 int event, u32 flags, int family)
1394{
1395 struct sk_buff *skb;
1396 u32 portid = NETLINK_CB(oskb).portid;
1397 struct net *net = oskb ? sock_net(oskb->sk) : &init_net;
1398 u32 seq = nlh->nlmsg_seq;
1399 bool report;
1400 int err;
1401
1402 report = nlmsg_report(nlh);
1403 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
1404 return 0;
1405
1406 err = -ENOBUFS;
1407 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1408 if (skb == NULL)
1409 goto err;
1410
1411 err = nf_tables_fill_rule_info(skb, portid, seq, event, flags,
1412 family, table, chain, rule);
1413 if (err < 0) {
1414 kfree_skb(skb);
1415 goto err;
1416 }
1417
1418 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
1419 GFP_KERNEL);
1420err:
1421 if (err < 0)
1422 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
1423 return err;
1424}
1425
0628b123
PNA		 1426static inline bool
1427nft_rule_is_active(struct net *net, const struct nft_rule *rule)
1428{
1429 return (rule->genmask & (1 << net->nft.gencursor)) == 0;
1430}
1431
1432static inline int gencursor_next(struct net *net)
1433{
1434 return net->nft.gencursor+1 == 1 ? 1 : 0;
1435}
1436
1437static inline int
1438nft_rule_is_active_next(struct net *net, const struct nft_rule *rule)
1439{
1440 return (rule->genmask & (1 << gencursor_next(net))) == 0;
1441}
1442
1443static inline void
1444nft_rule_activate_next(struct net *net, struct nft_rule *rule)
1445{
1446 /* Now inactive, will be active in the future */
1447 rule->genmask = (1 << net->nft.gencursor);
1448}
1449
1450static inline void
1451nft_rule_disactivate_next(struct net *net, struct nft_rule *rule)
1452{
1453 rule->genmask = (1 << gencursor_next(net));
1454}
1455
1456static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
1457{
1458 rule->genmask = 0;
1459}
1460
96518518
PM		 1461static int nf_tables_dump_rules(struct sk_buff *skb,
1462 struct netlink_callback *cb)
1463{
1464 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1465 const struct nft_af_info *afi;
1466 const struct nft_table *table;
1467 const struct nft_chain *chain;
1468 const struct nft_rule *rule;
1469 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1470 struct net *net = sock_net(skb->sk);
96518518 1471 int family = nfmsg->nfgen_family;
0628b123
PNA		 1472 u8 genctr = ACCESS_ONCE(net->nft.genctr);
1473 u8 gencursor = ACCESS_ONCE(net->nft.gencursor);
96518518 1474
99633ab2 1475 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 1476 if (family != NFPROTO_UNSPEC && family != afi->family)
1477 continue;
1478
1479 list_for_each_entry(table, &afi->tables, list) {
1480 list_for_each_entry(chain, &table->chains, list) {
1481 list_for_each_entry(rule, &chain->rules, list) {
0628b123
PNA		 1482 if (!nft_rule_is_active(net, rule))
1483 goto cont;
96518518
PM		 1484 if (idx < s_idx)
1485 goto cont;
1486 if (idx > s_idx)
1487 memset(&cb->args[1], 0,
1488 sizeof(cb->args) - sizeof(cb->args[0]));
1489 if (nf_tables_fill_rule_info(skb, NETLINK_CB(cb->skb).portid,
1490 cb->nlh->nlmsg_seq,
1491 NFT_MSG_NEWRULE,
1492 NLM_F_MULTI | NLM_F_APPEND,
1493 afi->family, table, chain, rule) < 0)
1494 goto done;
1495cont:
1496 idx++;
1497 }
1498 }
1499 }
1500 }
1501done:
0628b123
PNA		 1502 /* Invalidate this dump, a transition to the new generation happened */
1503 if (gencursor != net->nft.gencursor || genctr != net->nft.genctr)
1504 return -EBUSY;
1505
96518518
PM		 1506 cb->args[0] = idx;
1507 return skb->len;
1508}
1509
1510static int nf_tables_getrule(struct sock *nlsk, struct sk_buff *skb,
1511 const struct nlmsghdr *nlh,
1512 const struct nlattr * const nla[])
1513{
1514 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1515 const struct nft_af_info *afi;
1516 const struct nft_table *table;
1517 const struct nft_chain *chain;
1518 const struct nft_rule *rule;
1519 struct sk_buff *skb2;
99633ab2 1520 struct net *net = sock_net(skb->sk);
96518518
PM		 1521 int family = nfmsg->nfgen_family;
1522 int err;
1523
1524 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1525 struct netlink_dump_control c = {
1526 .dump = nf_tables_dump_rules,
1527 };
1528 return netlink_dump_start(nlsk, skb, nlh, &c);
1529 }
1530
99633ab2 1531 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1532 if (IS_ERR(afi))
1533 return PTR_ERR(afi);
1534
9370761c 1535 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1536 if (IS_ERR(table))
1537 return PTR_ERR(table);
1538
1539 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1540 if (IS_ERR(chain))
1541 return PTR_ERR(chain);
1542
1543 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
1544 if (IS_ERR(rule))
1545 return PTR_ERR(rule);
1546
1547 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1548 if (!skb2)
1549 return -ENOMEM;
1550
1551 err = nf_tables_fill_rule_info(skb2, NETLINK_CB(skb).portid,
1552 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
1553 family, table, chain, rule);
1554 if (err < 0)
1555 goto err;
1556
1557 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1558
1559err:
1560 kfree_skb(skb2);
1561 return err;
1562}
1563
62472bce
PM		 1564static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
1565 struct nft_rule *rule)
96518518 1566{
96518518
PM		 1567 struct nft_expr *expr;
1568
1569 /*
1570 * Careful: some expressions might not be initialized in case this
1571 * is called on error from nf_tables_newrule().
1572 */
1573 expr = nft_expr_first(rule);
1574 while (expr->ops && expr != nft_expr_last(rule)) {
62472bce 1575 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 1576 expr = nft_expr_next(expr);
1577 }
1578 kfree(rule);
1579}
1580
b380e5c7 1581static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
1081d11b 1582 struct nft_rule *rule)
0628b123 1583{
1081d11b 1584 struct nft_trans *trans;
0628b123 1585
b380e5c7 1586 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
1081d11b
PNA		 1587 if (trans == NULL)
1588 return NULL;
0628b123 1589
1081d11b
PNA		 1590 nft_trans_rule(trans) = rule;
1591 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0628b123 1592
1081d11b 1593 return trans;
0628b123
PNA		 1594}
1595
1081d11b
PNA		 1596#define NFT_RULE_MAXEXPRS 128
1597
1598static struct nft_expr_info *info;
1599
96518518
PM		 1600static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
1601 const struct nlmsghdr *nlh,
1602 const struct nlattr * const nla[])
1603{
1604 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1605 struct nft_af_info *afi;
99633ab2 1606 struct net *net = sock_net(skb->sk);
96518518
PM		 1607 struct nft_table *table;
1608 struct nft_chain *chain;
1609 struct nft_rule *rule, *old_rule = NULL;
1081d11b 1610 struct nft_trans *trans = NULL;
96518518
PM		 1611 struct nft_expr *expr;
1612 struct nft_ctx ctx;
1613 struct nlattr *tmp;
0768b3b3 1614 unsigned int size, i, n, ulen = 0;
96518518
PM		 1615 int err, rem;
1616 bool create;
5e948466 1617 u64 handle, pos_handle;
96518518
PM		 1618
1619 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1620
99633ab2 1621 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
96518518
PM		 1622 if (IS_ERR(afi))
1623 return PTR_ERR(afi);
1624
9370761c 1625 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1626 if (IS_ERR(table))
1627 return PTR_ERR(table);
1628
1629 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1630 if (IS_ERR(chain))
1631 return PTR_ERR(chain);
1632
1633 if (nla[NFTA_RULE_HANDLE]) {
1634 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
1635 rule = __nf_tables_rule_lookup(chain, handle);
1636 if (IS_ERR(rule))
1637 return PTR_ERR(rule);
1638
1639 if (nlh->nlmsg_flags & NLM_F_EXCL)
1640 return -EEXIST;
1641 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1642 old_rule = rule;
1643 else
1644 return -EOPNOTSUPP;
1645 } else {
1646 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
1647 return -EINVAL;
1648 handle = nf_tables_alloc_handle(table);
1649 }
1650
5e948466
EL		 1651 if (nla[NFTA_RULE_POSITION]) {
1652 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
1653 return -EOPNOTSUPP;
1654
1655 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
1656 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
1657 if (IS_ERR(old_rule))
1658 return PTR_ERR(old_rule);
1659 }
1660
0ca743a5
PNA		 1661 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1662
96518518
PM		 1663 n = 0;
1664 size = 0;
1665 if (nla[NFTA_RULE_EXPRESSIONS]) {
1666 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
1667 err = -EINVAL;
1668 if (nla_type(tmp) != NFTA_LIST_ELEM)
1669 goto err1;
1670 if (n == NFT_RULE_MAXEXPRS)
1671 goto err1;
0ca743a5 1672 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 1673 if (err < 0)
1674 goto err1;
1675 size += info[n].ops->size;
1676 n++;
1677 }
1678 }
1679
0768b3b3
PNA		 1680 if (nla[NFTA_RULE_USERDATA])
1681 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
1682
96518518 1683 err = -ENOMEM;
0768b3b3 1684 rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
96518518
PM		 1685 if (rule == NULL)
1686 goto err1;
1687
0628b123
PNA		 1688 nft_rule_activate_next(net, rule);
1689
96518518
PM		 1690 rule->handle = handle;
1691 rule->dlen = size;
0768b3b3
PNA		 1692 rule->ulen = ulen;
1693
1694 if (ulen)
1695 nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
96518518 1696
96518518
PM		 1697 expr = nft_expr_first(rule);
1698 for (i = 0; i < n; i++) {
1699 err = nf_tables_newexpr(&ctx, &info[i], expr);
1700 if (err < 0)
1701 goto err2;
ef1f7df9 1702 info[i].ops = NULL;
96518518
PM		 1703 expr = nft_expr_next(expr);
1704 }
1705
96518518 1706 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
0628b123 1707 if (nft_rule_is_active_next(net, old_rule)) {
b380e5c7
PNA		 1708 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE,
1709 old_rule);
1081d11b 1710 if (trans == NULL) {
0628b123
PNA		 1711 err = -ENOMEM;
1712 goto err2;
1713 }
1714 nft_rule_disactivate_next(net, old_rule);
1715 list_add_tail(&rule->list, &old_rule->list);
1716 } else {
1717 err = -ENOENT;
1718 goto err2;
1719 }
96518518 1720 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 1721 if (old_rule)
1722 list_add_rcu(&rule->list, &old_rule->list);
1723 else
1724 list_add_tail_rcu(&rule->list, &chain->rules);
1725 else {
1726 if (old_rule)
1727 list_add_tail_rcu(&rule->list, &old_rule->list);
1728 else
1729 list_add_rcu(&rule->list, &chain->rules);
1730 }
96518518 1731
b380e5c7 1732 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 1733 err = -ENOMEM;
1734 goto err3;
1735 }
96518518
PM		 1736 return 0;
1737
0628b123
PNA		 1738err3:
1739 list_del_rcu(&rule->list);
1081d11b
PNA		 1740 if (trans) {
1741 list_del_rcu(&nft_trans_rule(trans)->list);
1742 nft_rule_clear(net, nft_trans_rule(trans));
1743 nft_trans_destroy(trans);
0628b123 1744 }
96518518 1745err2:
62472bce 1746 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 1747err1:
1748 for (i = 0; i < n; i++) {
1749 if (info[i].ops != NULL)
ef1f7df9 1750 module_put(info[i].ops->type->owner);
96518518
PM		 1751 }
1752 return err;
1753}
1754
0628b123
PNA		 1755static int
1756nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
1757{
1758 /* You cannot delete the same rule twice */
1759 if (nft_rule_is_active_next(ctx->net, rule)) {
b380e5c7 1760 if (nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule) == NULL)
0628b123
PNA		 1761 return -ENOMEM;
1762 nft_rule_disactivate_next(ctx->net, rule);
1763 return 0;
1764 }
1765 return -ENOENT;
1766}
1767
cf9dc09d
PNA		 1768static int nf_table_delrule_by_chain(struct nft_ctx *ctx)
1769{
1770 struct nft_rule *rule;
1771 int err;
1772
1773 list_for_each_entry(rule, &ctx->chain->rules, list) {
1774 err = nf_tables_delrule_one(ctx, rule);
1775 if (err < 0)
1776 return err;
1777 }
1778 return 0;
1779}
1780
96518518
PM		 1781static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
1782 const struct nlmsghdr *nlh,
1783 const struct nlattr * const nla[])
1784{
1785 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1786 struct nft_af_info *afi;
99633ab2 1787 struct net *net = sock_net(skb->sk);
7c95f6d8 1788 struct nft_table *table;
cf9dc09d
PNA		 1789 struct nft_chain *chain = NULL;
1790 struct nft_rule *rule;
0628b123
PNA		 1791 int family = nfmsg->nfgen_family, err = 0;
1792 struct nft_ctx ctx;
96518518 1793
99633ab2 1794 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1795 if (IS_ERR(afi))
1796 return PTR_ERR(afi);
1797
9370761c 1798 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1799 if (IS_ERR(table))
1800 return PTR_ERR(table);
1801
cf9dc09d
PNA		 1802 if (nla[NFTA_RULE_CHAIN]) {
1803 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1804 if (IS_ERR(chain))
1805 return PTR_ERR(chain);
1806 }
96518518 1807
0628b123
PNA		 1808 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1809
cf9dc09d
PNA		 1810 if (chain) {
1811 if (nla[NFTA_RULE_HANDLE]) {
1812 rule = nf_tables_rule_lookup(chain,
1813 nla[NFTA_RULE_HANDLE]);
1814 if (IS_ERR(rule))
1815 return PTR_ERR(rule);
96518518 1816
0628b123 1817 err = nf_tables_delrule_one(&ctx, rule);
cf9dc09d
PNA		 1818 } else {
1819 err = nf_table_delrule_by_chain(&ctx);
1820 }
1821 } else {
1822 list_for_each_entry(chain, &table->chains, list) {
1823 ctx.chain = chain;
1824 err = nf_table_delrule_by_chain(&ctx);
0628b123
PNA		 1825 if (err < 0)
1826 break;
1827 }
1828 }
1829
1830 return err;
1831}
1832
20a69341
PM		 1833/*
1834 * Sets
1835 */
1836
1837static LIST_HEAD(nf_tables_set_ops);
1838
1839int nft_register_set(struct nft_set_ops *ops)
1840{
1841 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1842 list_add_tail(&ops->list, &nf_tables_set_ops);
1843 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1844 return 0;
1845}
1846EXPORT_SYMBOL_GPL(nft_register_set);
1847
1848void nft_unregister_set(struct nft_set_ops *ops)
1849{
1850 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1851 list_del(&ops->list);
1852 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1853}
1854EXPORT_SYMBOL_GPL(nft_unregister_set);
1855
c50b960c
PM		 1856/*
1857 * Select a set implementation based on the data characteristics and the
1858 * given policy. The total memory use might not be known if no size is
1859 * given, in that case the amount of memory per element is used.
1860 */
1861static const struct nft_set_ops *
1862nft_select_set_ops(const struct nlattr * const nla[],
1863 const struct nft_set_desc *desc,
1864 enum nft_set_policies policy)
20a69341 1865{
c50b960c
PM		 1866 const struct nft_set_ops *ops, *bops;
1867 struct nft_set_estimate est, best;
20a69341
PM		 1868 u32 features;
1869
1870#ifdef CONFIG_MODULES
1871 if (list_empty(&nf_tables_set_ops)) {
1872 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1873 request_module("nft-set");
1874 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1875 if (!list_empty(&nf_tables_set_ops))
1876 return ERR_PTR(-EAGAIN);
1877 }
1878#endif
1879 features = 0;
1880 if (nla[NFTA_SET_FLAGS] != NULL) {
1881 features = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
1882 features &= NFT_SET_INTERVAL | NFT_SET_MAP;
1883 }
1884
c50b960c
PM		 1885 bops = NULL;
1886 best.size = ~0;
1887 best.class = ~0;
1888
20a69341
PM		 1889 list_for_each_entry(ops, &nf_tables_set_ops, list) {
1890 if ((ops->features & features) != features)
1891 continue;
c50b960c
PM		 1892 if (!ops->estimate(desc, features, &est))
1893 continue;
1894
1895 switch (policy) {
1896 case NFT_SET_POL_PERFORMANCE:
1897 if (est.class < best.class)
1898 break;
1899 if (est.class == best.class && est.size < best.size)
1900 break;
1901 continue;
1902 case NFT_SET_POL_MEMORY:
1903 if (est.size < best.size)
1904 break;
1905 if (est.size == best.size && est.class < best.class)
1906 break;
1907 continue;
1908 default:
1909 break;
1910 }
1911
20a69341
PM		 1912 if (!try_module_get(ops->owner))
1913 continue;
c50b960c
PM		 1914 if (bops != NULL)
1915 module_put(bops->owner);
1916
1917 bops = ops;
1918 best = est;
20a69341
PM		 1919 }
1920
c50b960c
PM		 1921 if (bops != NULL)
1922 return bops;
1923
20a69341
PM		 1924 return ERR_PTR(-EOPNOTSUPP);
1925}
1926
1927static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
1928 [NFTA_SET_TABLE] = { .type = NLA_STRING },
1929 [NFTA_SET_NAME] = { .type = NLA_STRING },
1930 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
1931 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
1932 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
1933 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
1934 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 1935 [NFTA_SET_POLICY] = { .type = NLA_U32 },
1936 [NFTA_SET_DESC] = { .type = NLA_NESTED },
1937};
1938
1939static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
1940 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 1941};
1942
1943static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
1944 const struct sk_buff *skb,
1945 const struct nlmsghdr *nlh,
1946 const struct nlattr * const nla[])
1947{
99633ab2 1948 struct net *net = sock_net(skb->sk);
20a69341 1949 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 1950 struct nft_af_info *afi = NULL;
1951 struct nft_table *table = NULL;
20a69341 1952
c9c8e485
PNA		 1953 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
1954 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
1955 if (IS_ERR(afi))
1956 return PTR_ERR(afi);
1957 }
20a69341
PM		 1958
1959 if (nla[NFTA_SET_TABLE] != NULL) {
ec2c9935
PM		 1960 if (afi == NULL)
1961 return -EAFNOSUPPORT;
1962
9370761c 1963 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
20a69341
PM		 1964 if (IS_ERR(table))
1965 return PTR_ERR(table);
1966 }
1967
0ca743a5 1968 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 1969 return 0;
1970}
1971
1972struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
1973 const struct nlattr *nla)
1974{
1975 struct nft_set *set;
1976
1977 if (nla == NULL)
1978 return ERR_PTR(-EINVAL);
1979
1980 list_for_each_entry(set, &table->sets, list) {
1981 if (!nla_strcmp(nla, set->name))
1982 return set;
1983 }
1984 return ERR_PTR(-ENOENT);
1985}
1986
1987static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
1988 const char *name)
1989{
1990 const struct nft_set *i;
1991 const char *p;
1992 unsigned long *inuse;
60eb1894 1993 unsigned int n = 0, min = 0;
20a69341
PM		 1994
1995 p = strnchr(name, IFNAMSIZ, '%');
1996 if (p != NULL) {
1997 if (p[1] != 'd' || strchr(p + 2, '%'))
1998 return -EINVAL;
1999
2000 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2001 if (inuse == NULL)
2002 return -ENOMEM;
60eb1894 2003cont:
20a69341 2004 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2005 int tmp;
2006
2007 if (!sscanf(i->name, name, &tmp))
20a69341 2008 continue;
60eb1894 2009 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2010 continue;
14662917 2011
60eb1894 2012 set_bit(tmp - min, inuse);
20a69341
PM		 2013 }
2014
53b70287 2015 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2016 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2017 min += BITS_PER_BYTE * PAGE_SIZE;
2018 memset(inuse, 0, PAGE_SIZE);
2019 goto cont;
2020 }
20a69341
PM		 2021 free_page((unsigned long)inuse);
2022 }
2023
60eb1894 2024 snprintf(set->name, sizeof(set->name), name, min + n);
20a69341
PM		 2025 list_for_each_entry(i, &ctx->table->sets, list) {
2026 if (!strcmp(set->name, i->name))
2027 return -ENFILE;
2028 }
2029 return 0;
2030}
2031
2032static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2033 const struct nft_set *set, u16 event, u16 flags)
2034{
2035 struct nfgenmsg *nfmsg;
2036 struct nlmsghdr *nlh;
c50b960c 2037 struct nlattr *desc;
20a69341
PM		 2038 u32 portid = NETLINK_CB(ctx->skb).portid;
2039 u32 seq = ctx->nlh->nlmsg_seq;
2040
2041 event |= NFNL_SUBSYS_NFTABLES << 8;
2042 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2043 flags);
2044 if (nlh == NULL)
2045 goto nla_put_failure;
2046
2047 nfmsg = nlmsg_data(nlh);
2048 nfmsg->nfgen_family = ctx->afi->family;
2049 nfmsg->version = NFNETLINK_V0;
2050 nfmsg->res_id = 0;
2051
2052 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2053 goto nla_put_failure;
2054 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2055 goto nla_put_failure;
2056 if (set->flags != 0)
2057 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2058 goto nla_put_failure;
2059
2060 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2061 goto nla_put_failure;
2062 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2063 goto nla_put_failure;
2064 if (set->flags & NFT_SET_MAP) {
2065 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2066 goto nla_put_failure;
2067 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2068 goto nla_put_failure;
2069 }
2070
c50b960c
PM		 2071 desc = nla_nest_start(skb, NFTA_SET_DESC);
2072 if (desc == NULL)
2073 goto nla_put_failure;
2074 if (set->size &&
2075 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2076 goto nla_put_failure;
2077 nla_nest_end(skb, desc);
2078
20a69341
PM		 2079 return nlmsg_end(skb, nlh);
2080
2081nla_put_failure:
2082 nlmsg_trim(skb, nlh);
2083 return -1;
2084}
2085
2086static int nf_tables_set_notify(const struct nft_ctx *ctx,
2087 const struct nft_set *set,
2088 int event)
2089{
2090 struct sk_buff *skb;
2091 u32 portid = NETLINK_CB(ctx->skb).portid;
20a69341
PM		 2092 bool report;
2093 int err;
2094
2095 report = nlmsg_report(ctx->nlh);
99633ab2 2096 if (!report && !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
20a69341
PM		 2097 return 0;
2098
2099 err = -ENOBUFS;
2100 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2101 if (skb == NULL)
2102 goto err;
2103
2104 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2105 if (err < 0) {
2106 kfree_skb(skb);
2107 goto err;
2108 }
2109
99633ab2 2110 err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, report,
20a69341
PM		 2111 GFP_KERNEL);
2112err:
2113 if (err < 0)
99633ab2 2114 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err);
20a69341
PM		 2115 return err;
2116}
2117
2118static int nf_tables_dump_sets_table(struct nft_ctx *ctx, struct sk_buff *skb,
2119 struct netlink_callback *cb)
2120{
2121 const struct nft_set *set;
2122 unsigned int idx = 0, s_idx = cb->args[0];
2123
2124 if (cb->args[1])
2125 return skb->len;
2126
2127 list_for_each_entry(set, &ctx->table->sets, list) {
2128 if (idx < s_idx)
2129 goto cont;
2130 if (nf_tables_fill_set(skb, ctx, set, NFT_MSG_NEWSET,
2131 NLM_F_MULTI) < 0) {
2132 cb->args[0] = idx;
2133 goto done;
2134 }
2135cont:
2136 idx++;
2137 }
2138 cb->args[1] = 1;
2139done:
2140 return skb->len;
2141}
2142
c9c8e485
PNA		 2143static int nf_tables_dump_sets_family(struct nft_ctx *ctx, struct sk_buff *skb,
2144 struct netlink_callback *cb)
20a69341
PM		 2145{
2146 const struct nft_set *set;
e38195bf 2147 unsigned int idx, s_idx = cb->args[0];
20a69341
PM		 2148 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2149
2150 if (cb->args[1])
2151 return skb->len;
2152
2153 list_for_each_entry(table, &ctx->afi->tables, list) {
e38195bf
PNA		 2154 if (cur_table) {
2155 if (cur_table != table)
2156 continue;
20a69341 2157
e38195bf
PNA		 2158 cur_table = NULL;
2159 }
20a69341 2160 ctx->table = table;
e38195bf 2161 idx = 0;
20a69341
PM		 2162 list_for_each_entry(set, &ctx->table->sets, list) {
2163 if (idx < s_idx)
2164 goto cont;
2165 if (nf_tables_fill_set(skb, ctx, set, NFT_MSG_NEWSET,
2166 NLM_F_MULTI) < 0) {
2167 cb->args[0] = idx;
2168 cb->args[2] = (unsigned long) table;
2169 goto done;
2170 }
2171cont:
2172 idx++;
2173 }
2174 }
2175 cb->args[1] = 1;
2176done:
2177 return skb->len;
2178}
2179
c9c8e485
PNA		 2180static int nf_tables_dump_sets_all(struct nft_ctx *ctx, struct sk_buff *skb,
2181 struct netlink_callback *cb)
2182{
2183 const struct nft_set *set;
2184 unsigned int idx, s_idx = cb->args[0];
7c95f6d8 2185 struct nft_af_info *afi;
c9c8e485
PNA		 2186 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2187 struct net *net = sock_net(skb->sk);
2188 int cur_family = cb->args[3];
2189
2190 if (cb->args[1])
2191 return skb->len;
2192
2193 list_for_each_entry(afi, &net->nft.af_info, list) {
2194 if (cur_family) {
2195 if (afi->family != cur_family)
2196 continue;
2197
2198 cur_family = 0;
2199 }
2200
2201 list_for_each_entry(table, &afi->tables, list) {
2202 if (cur_table) {
2203 if (cur_table != table)
2204 continue;
2205
2206 cur_table = NULL;
2207 }
2208
2209 ctx->table = table;
2210 ctx->afi = afi;
2211 idx = 0;
2212 list_for_each_entry(set, &ctx->table->sets, list) {
2213 if (idx < s_idx)
2214 goto cont;
2215 if (nf_tables_fill_set(skb, ctx, set,
2216 NFT_MSG_NEWSET,
2217 NLM_F_MULTI) < 0) {
2218 cb->args[0] = idx;
2219 cb->args[2] = (unsigned long) table;
2220 cb->args[3] = afi->family;
2221 goto done;
2222 }
2223cont:
2224 idx++;
2225 }
2226 if (s_idx)
2227 s_idx = 0;
2228 }
2229 }
2230 cb->args[1] = 1;
2231done:
2232 return skb->len;
2233}
2234
20a69341
PM		 2235static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
2236{
2237 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2238 struct nlattr *nla[NFTA_SET_MAX + 1];
2239 struct nft_ctx ctx;
2240 int err, ret;
2241
2242 err = nlmsg_parse(cb->nlh, sizeof(*nfmsg), nla, NFTA_SET_MAX,
2243 nft_set_policy);
2244 if (err < 0)
2245 return err;
2246
2247 err = nft_ctx_init_from_setattr(&ctx, cb->skb, cb->nlh, (void *)nla);
2248 if (err < 0)
2249 return err;
2250
c9c8e485
PNA		 2251 if (ctx.table == NULL) {
2252 if (ctx.afi == NULL)
2253 ret = nf_tables_dump_sets_all(&ctx, skb, cb);
2254 else
2255 ret = nf_tables_dump_sets_family(&ctx, skb, cb);
2256 } else
20a69341
PM		 2257 ret = nf_tables_dump_sets_table(&ctx, skb, cb);
2258
2259 return ret;
2260}
2261
2262static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
2263 const struct nlmsghdr *nlh,
2264 const struct nlattr * const nla[])
2265{
2266 const struct nft_set *set;
2267 struct nft_ctx ctx;
2268 struct sk_buff *skb2;
c9c8e485 2269 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2270 int err;
2271
2272 /* Verify existance before starting dump */
2273 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2274 if (err < 0)
2275 return err;
2276
2277 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2278 struct netlink_dump_control c = {
2279 .dump = nf_tables_dump_sets,
2280 };
2281 return netlink_dump_start(nlsk, skb, nlh, &c);
2282 }
2283
c9c8e485
PNA		 2284 /* Only accept unspec with dump */
2285 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2286 return -EAFNOSUPPORT;
2287
20a69341
PM		 2288 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2289 if (IS_ERR(set))
2290 return PTR_ERR(set);
2291
2292 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2293 if (skb2 == NULL)
2294 return -ENOMEM;
2295
2296 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2297 if (err < 0)
2298 goto err;
2299
2300 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2301
2302err:
2303 kfree_skb(skb2);
2304 return err;
2305}
2306
c50b960c
PM		 2307static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2308 struct nft_set_desc *desc,
2309 const struct nlattr *nla)
2310{
2311 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2312 int err;
2313
2314 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla, nft_set_desc_policy);
2315 if (err < 0)
2316 return err;
2317
2318 if (da[NFTA_SET_DESC_SIZE] != NULL)
2319 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
2320
2321 return 0;
2322}
2323
20a69341
PM		 2324static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
2325 const struct nlmsghdr *nlh,
2326 const struct nlattr * const nla[])
2327{
2328 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2329 const struct nft_set_ops *ops;
7c95f6d8 2330 struct nft_af_info *afi;
99633ab2 2331 struct net *net = sock_net(skb->sk);
20a69341
PM		 2332 struct nft_table *table;
2333 struct nft_set *set;
2334 struct nft_ctx ctx;
2335 char name[IFNAMSIZ];
2336 unsigned int size;
2337 bool create;
c50b960c
PM		 2338 u32 ktype, dtype, flags, policy;
2339 struct nft_set_desc desc;
20a69341
PM		 2340 int err;
2341
2342 if (nla[NFTA_SET_TABLE] == NULL ||
2343 nla[NFTA_SET_NAME] == NULL ||
2344 nla[NFTA_SET_KEY_LEN] == NULL)
2345 return -EINVAL;
2346
c50b960c
PM		 2347 memset(&desc, 0, sizeof(desc));
2348
20a69341
PM		 2349 ktype = NFT_DATA_VALUE;
2350 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
2351 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
2352 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
2353 return -EINVAL;
2354 }
2355
c50b960c
PM		 2356 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
2357 if (desc.klen == 0 || desc.klen > FIELD_SIZEOF(struct nft_data, data))
20a69341
PM		 2358 return -EINVAL;
2359
2360 flags = 0;
2361 if (nla[NFTA_SET_FLAGS] != NULL) {
2362 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2363 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
2364 NFT_SET_INTERVAL | NFT_SET_MAP))
2365 return -EINVAL;
2366 }
2367
2368 dtype = 0;
20a69341
PM		 2369 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
2370 if (!(flags & NFT_SET_MAP))
2371 return -EINVAL;
2372
2373 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
2374 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
2375 dtype != NFT_DATA_VERDICT)
2376 return -EINVAL;
2377
2378 if (dtype != NFT_DATA_VERDICT) {
2379 if (nla[NFTA_SET_DATA_LEN] == NULL)
2380 return -EINVAL;
c50b960c
PM		 2381 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
2382 if (desc.dlen == 0 ||
2383 desc.dlen > FIELD_SIZEOF(struct nft_data, data))
20a69341
PM		 2384 return -EINVAL;
2385 } else
c50b960c 2386 desc.dlen = sizeof(struct nft_data);
20a69341
PM		 2387 } else if (flags & NFT_SET_MAP)
2388 return -EINVAL;
2389
c50b960c
PM		 2390 policy = NFT_SET_POL_PERFORMANCE;
2391 if (nla[NFTA_SET_POLICY] != NULL)
2392 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
2393
2394 if (nla[NFTA_SET_DESC] != NULL) {
2395 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
2396 if (err < 0)
2397 return err;
2398 }
2399
20a69341
PM		 2400 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2401
99633ab2 2402 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
20a69341
PM		 2403 if (IS_ERR(afi))
2404 return PTR_ERR(afi);
2405
9370761c 2406 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
20a69341
PM		 2407 if (IS_ERR(table))
2408 return PTR_ERR(table);
2409
0ca743a5 2410 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2411
2412 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME]);
2413 if (IS_ERR(set)) {
2414 if (PTR_ERR(set) != -ENOENT)
2415 return PTR_ERR(set);
2416 set = NULL;
2417 }
2418
2419 if (set != NULL) {
2420 if (nlh->nlmsg_flags & NLM_F_EXCL)
2421 return -EEXIST;
2422 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2423 return -EOPNOTSUPP;
2424 return 0;
2425 }
2426
2427 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2428 return -ENOENT;
2429
c50b960c 2430 ops = nft_select_set_ops(nla, &desc, policy);
20a69341
PM		 2431 if (IS_ERR(ops))
2432 return PTR_ERR(ops);
2433
2434 size = 0;
2435 if (ops->privsize != NULL)
2436 size = ops->privsize(nla);
2437
2438 err = -ENOMEM;
2439 set = kzalloc(sizeof(*set) + size, GFP_KERNEL);
2440 if (set == NULL)
2441 goto err1;
2442
2443 nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name));
2444 err = nf_tables_set_alloc_name(&ctx, set, name);
2445 if (err < 0)
2446 goto err2;
2447
2448 INIT_LIST_HEAD(&set->bindings);
2449 set->ops = ops;
2450 set->ktype = ktype;
c50b960c 2451 set->klen = desc.klen;
20a69341 2452 set->dtype = dtype;
c50b960c 2453 set->dlen = desc.dlen;
20a69341 2454 set->flags = flags;
c50b960c 2455 set->size = desc.size;
20a69341 2456
c50b960c 2457 err = ops->init(set, &desc, nla);
20a69341
PM		 2458 if (err < 0)
2459 goto err2;
2460
2461 list_add_tail(&set->list, &table->sets);
2462 nf_tables_set_notify(&ctx, set, NFT_MSG_NEWSET);
2463 return 0;
2464
2465err2:
2466 kfree(set);
2467err1:
2468 module_put(ops->owner);
2469 return err;
2470}
2471
2472static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
2473{
2474 list_del(&set->list);
ab9da5c1 2475 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET);
20a69341
PM		 2476
2477 set->ops->destroy(set);
2478 module_put(set->ops->owner);
2479 kfree(set);
2480}
2481
2482static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
2483 const struct nlmsghdr *nlh,
2484 const struct nlattr * const nla[])
2485{
c9c8e485 2486 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2487 struct nft_set *set;
2488 struct nft_ctx ctx;
2489 int err;
2490
ec2c9935
PM		 2491 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2492 return -EAFNOSUPPORT;
20a69341
PM		 2493 if (nla[NFTA_SET_TABLE] == NULL)
2494 return -EINVAL;
2495
2496 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2497 if (err < 0)
2498 return err;
2499
2500 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2501 if (IS_ERR(set))
2502 return PTR_ERR(set);
2503 if (!list_empty(&set->bindings))
2504 return -EBUSY;
2505
2506 nf_tables_set_destroy(&ctx, set);
2507 return 0;
2508}
2509
2510static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
2511 const struct nft_set *set,
2512 const struct nft_set_iter *iter,
2513 const struct nft_set_elem *elem)
2514{
2515 enum nft_registers dreg;
2516
2517 dreg = nft_type_to_reg(set->dtype);
2ee0d3c8
PNA		 2518 return nft_validate_data_load(ctx, dreg, &elem->data,
2519 set->dtype == NFT_DATA_VERDICT ?
2520 NFT_DATA_VERDICT : NFT_DATA_VALUE);
20a69341
PM		 2521}
2522
2523int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
2524 struct nft_set_binding *binding)
2525{
2526 struct nft_set_binding *i;
2527 struct nft_set_iter iter;
2528
2529 if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
2530 return -EBUSY;
2531
2532 if (set->flags & NFT_SET_MAP) {
2533 /* If the set is already bound to the same chain all
2534 * jumps are already validated for that chain.
2535 */
2536 list_for_each_entry(i, &set->bindings, list) {
2537 if (i->chain == binding->chain)
2538 goto bind;
2539 }
2540
2541 iter.skip = 0;
2542 iter.count = 0;
2543 iter.err = 0;
2544 iter.fn = nf_tables_bind_check_setelem;
2545
2546 set->ops->walk(ctx, set, &iter);
2547 if (iter.err < 0) {
2548 /* Destroy anonymous sets if binding fails */
2549 if (set->flags & NFT_SET_ANONYMOUS)
2550 nf_tables_set_destroy(ctx, set);
2551
2552 return iter.err;
2553 }
2554 }
2555bind:
2556 binding->chain = ctx->chain;
2557 list_add_tail(&binding->list, &set->bindings);
2558 return 0;
2559}
2560
2561void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
2562 struct nft_set_binding *binding)
2563{
2564 list_del(&binding->list);
2565
2566 if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
2567 nf_tables_set_destroy(ctx, set);
2568}
2569
2570/*
2571 * Set elements
2572 */
2573
2574static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
2575 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
2576 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
2577 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
2578};
2579
2580static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
2581 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING },
2582 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING },
2583 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
2584};
2585
2586static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx,
2587 const struct sk_buff *skb,
2588 const struct nlmsghdr *nlh,
2589 const struct nlattr * const nla[])
2590{
2591 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 2592 struct nft_af_info *afi;
2593 struct nft_table *table;
99633ab2 2594 struct net *net = sock_net(skb->sk);
20a69341 2595
99633ab2 2596 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
20a69341
PM		 2597 if (IS_ERR(afi))
2598 return PTR_ERR(afi);
2599
9370761c 2600 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341
PM		 2601 if (IS_ERR(table))
2602 return PTR_ERR(table);
2603
0ca743a5 2604 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2605 return 0;
2606}
2607
2608static int nf_tables_fill_setelem(struct sk_buff *skb,
2609 const struct nft_set *set,
2610 const struct nft_set_elem *elem)
2611{
2612 unsigned char *b = skb_tail_pointer(skb);
2613 struct nlattr *nest;
2614
2615 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
2616 if (nest == NULL)
2617 goto nla_put_failure;
2618
2619 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, &elem->key, NFT_DATA_VALUE,
2620 set->klen) < 0)
2621 goto nla_put_failure;
2622
2623 if (set->flags & NFT_SET_MAP &&
2624 !(elem->flags & NFT_SET_ELEM_INTERVAL_END) &&
2625 nft_data_dump(skb, NFTA_SET_ELEM_DATA, &elem->data,
2626 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
2627 set->dlen) < 0)
2628 goto nla_put_failure;
2629
2630 if (elem->flags != 0)
2631 if (nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, htonl(elem->flags)))
2632 goto nla_put_failure;
2633
2634 nla_nest_end(skb, nest);
2635 return 0;
2636
2637nla_put_failure:
2638 nlmsg_trim(skb, b);
2639 return -EMSGSIZE;
2640}
2641
2642struct nft_set_dump_args {
2643 const struct netlink_callback *cb;
2644 struct nft_set_iter iter;
2645 struct sk_buff *skb;
2646};
2647
2648static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
2649 const struct nft_set *set,
2650 const struct nft_set_iter *iter,
2651 const struct nft_set_elem *elem)
2652{
2653 struct nft_set_dump_args *args;
2654
2655 args = container_of(iter, struct nft_set_dump_args, iter);
2656 return nf_tables_fill_setelem(args->skb, set, elem);
2657}
2658
2659static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
2660{
2661 const struct nft_set *set;
2662 struct nft_set_dump_args args;
2663 struct nft_ctx ctx;
2664 struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
2665 struct nfgenmsg *nfmsg;
2666 struct nlmsghdr *nlh;
2667 struct nlattr *nest;
2668 u32 portid, seq;
2669 int event, err;
2670
720e0dfa
MN		 2671 err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
2672 NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy);
20a69341
PM		 2673 if (err < 0)
2674 return err;
2675
2676 err = nft_ctx_init_from_elemattr(&ctx, cb->skb, cb->nlh, (void *)nla);
2677 if (err < 0)
2678 return err;
2679
2680 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2681 if (IS_ERR(set))
2682 return PTR_ERR(set);
2683
2684 event = NFT_MSG_NEWSETELEM;
2685 event |= NFNL_SUBSYS_NFTABLES << 8;
2686 portid = NETLINK_CB(cb->skb).portid;
2687 seq = cb->nlh->nlmsg_seq;
2688
2689 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2690 NLM_F_MULTI);
2691 if (nlh == NULL)
2692 goto nla_put_failure;
2693
2694 nfmsg = nlmsg_data(nlh);
2695 nfmsg->nfgen_family = NFPROTO_UNSPEC;
2696 nfmsg->version = NFNETLINK_V0;
2697 nfmsg->res_id = 0;
2698
2699 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
2700 goto nla_put_failure;
2701 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
2702 goto nla_put_failure;
2703
2704 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
2705 if (nest == NULL)
2706 goto nla_put_failure;
2707
2708 args.cb = cb;
2709 args.skb = skb;
2710 args.iter.skip = cb->args[0];
2711 args.iter.count = 0;
2712 args.iter.err = 0;
2713 args.iter.fn = nf_tables_dump_setelem;
2714 set->ops->walk(&ctx, set, &args.iter);
2715
2716 nla_nest_end(skb, nest);
2717 nlmsg_end(skb, nlh);
2718
2719 if (args.iter.err && args.iter.err != -EMSGSIZE)
2720 return args.iter.err;
2721 if (args.iter.count == cb->args[0])
2722 return 0;
2723
2724 cb->args[0] = args.iter.count;
2725 return skb->len;
2726
2727nla_put_failure:
2728 return -ENOSPC;
2729}
2730
2731static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
2732 const struct nlmsghdr *nlh,
2733 const struct nlattr * const nla[])
2734{
2735 const struct nft_set *set;
2736 struct nft_ctx ctx;
2737 int err;
2738
2739 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla);
2740 if (err < 0)
2741 return err;
2742
2743 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2744 if (IS_ERR(set))
2745 return PTR_ERR(set);
2746
2747 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2748 struct netlink_dump_control c = {
2749 .dump = nf_tables_dump_set,
2750 };
2751 return netlink_dump_start(nlsk, skb, nlh, &c);
2752 }
2753 return -EOPNOTSUPP;
2754}
2755
d60ce62f
AB		 2756static int nf_tables_fill_setelem_info(struct sk_buff *skb,
2757 const struct nft_ctx *ctx, u32 seq,
2758 u32 portid, int event, u16 flags,
2759 const struct nft_set *set,
2760 const struct nft_set_elem *elem)
2761{
2762 struct nfgenmsg *nfmsg;
2763 struct nlmsghdr *nlh;
2764 struct nlattr *nest;
2765 int err;
2766
2767 event |= NFNL_SUBSYS_NFTABLES << 8;
2768 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2769 flags);
2770 if (nlh == NULL)
2771 goto nla_put_failure;
2772
2773 nfmsg = nlmsg_data(nlh);
2774 nfmsg->nfgen_family = ctx->afi->family;
2775 nfmsg->version = NFNETLINK_V0;
2776 nfmsg->res_id = 0;
2777
2778 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2779 goto nla_put_failure;
2780 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2781 goto nla_put_failure;
2782
2783 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
2784 if (nest == NULL)
2785 goto nla_put_failure;
2786
2787 err = nf_tables_fill_setelem(skb, set, elem);
2788 if (err < 0)
2789 goto nla_put_failure;
2790
2791 nla_nest_end(skb, nest);
2792
2793 return nlmsg_end(skb, nlh);
2794
2795nla_put_failure:
2796 nlmsg_trim(skb, nlh);
2797 return -1;
2798}
2799
2800static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
2801 const struct nft_set *set,
2802 const struct nft_set_elem *elem,
2803 int event, u16 flags)
2804{
2805 const struct sk_buff *oskb = ctx->skb;
2806 struct net *net = sock_net(oskb->sk);
2807 u32 portid = NETLINK_CB(oskb).portid;
2808 bool report = nlmsg_report(ctx->nlh);
2809 struct sk_buff *skb;
2810 int err;
2811
2812 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
2813 return 0;
2814
2815 err = -ENOBUFS;
2816 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2817 if (skb == NULL)
2818 goto err;
2819
2820 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
2821 set, elem);
2822 if (err < 0) {
2823 kfree_skb(skb);
2824 goto err;
2825 }
2826
2827 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
2828 GFP_KERNEL);
2829err:
2830 if (err < 0)
2831 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
2832 return err;
2833}
2834
20a69341
PM		 2835static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
2836 const struct nlattr *attr)
2837{
2838 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
2839 struct nft_data_desc d1, d2;
2840 struct nft_set_elem elem;
2841 struct nft_set_binding *binding;
2842 enum nft_registers dreg;
2843 int err;
2844
c50b960c
PM		 2845 if (set->size && set->nelems == set->size)
2846 return -ENFILE;
2847
20a69341
PM		 2848 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
2849 nft_set_elem_policy);
2850 if (err < 0)
2851 return err;
2852
2853 if (nla[NFTA_SET_ELEM_KEY] == NULL)
2854 return -EINVAL;
2855
2856 elem.flags = 0;
2857 if (nla[NFTA_SET_ELEM_FLAGS] != NULL) {
2858 elem.flags = ntohl(nla_get_be32(nla[NFTA_SET_ELEM_FLAGS]));
2859 if (elem.flags & ~NFT_SET_ELEM_INTERVAL_END)
2860 return -EINVAL;
2861 }
2862
2863 if (set->flags & NFT_SET_MAP) {
2864 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
2865 !(elem.flags & NFT_SET_ELEM_INTERVAL_END))
2866 return -EINVAL;
bd7fc645
PNA		 2867 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
2868 elem.flags & NFT_SET_ELEM_INTERVAL_END)
2869 return -EINVAL;
20a69341
PM		 2870 } else {
2871 if (nla[NFTA_SET_ELEM_DATA] != NULL)
2872 return -EINVAL;
2873 }
2874
2875 err = nft_data_init(ctx, &elem.key, &d1, nla[NFTA_SET_ELEM_KEY]);
2876 if (err < 0)
2877 goto err1;
2878 err = -EINVAL;
2879 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
2880 goto err2;
2881
2882 err = -EEXIST;
2883 if (set->ops->get(set, &elem) == 0)
2884 goto err2;
2885
2886 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
2887 err = nft_data_init(ctx, &elem.data, &d2, nla[NFTA_SET_ELEM_DATA]);
2888 if (err < 0)
2889 goto err2;
2890
2891 err = -EINVAL;
2892 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
2893 goto err3;
2894
2895 dreg = nft_type_to_reg(set->dtype);
2896 list_for_each_entry(binding, &set->bindings, list) {
2897 struct nft_ctx bind_ctx = {
2898 .afi = ctx->afi,
2899 .table = ctx->table,
7c95f6d8 2900 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 2901 };
2902
2903 err = nft_validate_data_load(&bind_ctx, dreg,
2904 &elem.data, d2.type);
2905 if (err < 0)
2906 goto err3;
2907 }
2908 }
2909
2910 err = set->ops->insert(set, &elem);
2911 if (err < 0)
2912 goto err3;
c50b960c 2913 set->nelems++;
20a69341 2914
d60ce62f 2915 nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_NEWSETELEM, 0);
20a69341
PM		 2916 return 0;
2917
2918err3:
2919 if (nla[NFTA_SET_ELEM_DATA] != NULL)
2920 nft_data_uninit(&elem.data, d2.type);
2921err2:
2922 nft_data_uninit(&elem.key, d1.type);
2923err1:
2924 return err;
2925}
2926
2927static int nf_tables_newsetelem(struct sock *nlsk, struct sk_buff *skb,
2928 const struct nlmsghdr *nlh,
2929 const struct nlattr * const nla[])
2930{
2931 const struct nlattr *attr;
2932 struct nft_set *set;
2933 struct nft_ctx ctx;
2934 int rem, err;
2935
2936 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla);
2937 if (err < 0)
2938 return err;
2939
2940 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2941 if (IS_ERR(set))
2942 return PTR_ERR(set);
2943 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
2944 return -EBUSY;
2945
2946 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
2947 err = nft_add_set_elem(&ctx, set, attr);
2948 if (err < 0)
2949 return err;
2950 }
2951 return 0;
2952}
2953
2954static int nft_del_setelem(const struct nft_ctx *ctx, struct nft_set *set,
2955 const struct nlattr *attr)
2956{
2957 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
2958 struct nft_data_desc desc;
2959 struct nft_set_elem elem;
2960 int err;
2961
2962 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
2963 nft_set_elem_policy);
2964 if (err < 0)
2965 goto err1;
2966
2967 err = -EINVAL;
2968 if (nla[NFTA_SET_ELEM_KEY] == NULL)
2969 goto err1;
2970
2971 err = nft_data_init(ctx, &elem.key, &desc, nla[NFTA_SET_ELEM_KEY]);
2972 if (err < 0)
2973 goto err1;
2974
2975 err = -EINVAL;
2976 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
2977 goto err2;
2978
2979 err = set->ops->get(set, &elem);
2980 if (err < 0)
2981 goto err2;
2982
2983 set->ops->remove(set, &elem);
c50b960c 2984 set->nelems--;
20a69341 2985
d60ce62f
AB		 2986 nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_DELSETELEM, 0);
2987
20a69341
PM		 2988 nft_data_uninit(&elem.key, NFT_DATA_VALUE);
2989 if (set->flags & NFT_SET_MAP)
2990 nft_data_uninit(&elem.data, set->dtype);
2991
2992err2:
2993 nft_data_uninit(&elem.key, desc.type);
2994err1:
2995 return err;
2996}
2997
2998static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb,
2999 const struct nlmsghdr *nlh,
3000 const struct nlattr * const nla[])
3001{
3002 const struct nlattr *attr;
3003 struct nft_set *set;
3004 struct nft_ctx ctx;
3005 int rem, err;
3006
3007 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla);
3008 if (err < 0)
3009 return err;
3010
3011 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
3012 if (IS_ERR(set))
3013 return PTR_ERR(set);
3014 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3015 return -EBUSY;
3016
3017 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3018 err = nft_del_setelem(&ctx, set, attr);
3019 if (err < 0)
3020 return err;
3021 }
3022 return 0;
3023}
3024
96518518
PM		 3025static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
3026 [NFT_MSG_NEWTABLE] = {
3027 .call = nf_tables_newtable,
3028 .attr_count = NFTA_TABLE_MAX,
3029 .policy = nft_table_policy,
3030 },
3031 [NFT_MSG_GETTABLE] = {
3032 .call = nf_tables_gettable,
3033 .attr_count = NFTA_TABLE_MAX,
3034 .policy = nft_table_policy,
3035 },
3036 [NFT_MSG_DELTABLE] = {
3037 .call = nf_tables_deltable,
3038 .attr_count = NFTA_TABLE_MAX,
3039 .policy = nft_table_policy,
3040 },
3041 [NFT_MSG_NEWCHAIN] = {
3042 .call = nf_tables_newchain,
3043 .attr_count = NFTA_CHAIN_MAX,
3044 .policy = nft_chain_policy,
3045 },
3046 [NFT_MSG_GETCHAIN] = {
3047 .call = nf_tables_getchain,
3048 .attr_count = NFTA_CHAIN_MAX,
3049 .policy = nft_chain_policy,
3050 },
3051 [NFT_MSG_DELCHAIN] = {
3052 .call = nf_tables_delchain,
3053 .attr_count = NFTA_CHAIN_MAX,
3054 .policy = nft_chain_policy,
3055 },
3056 [NFT_MSG_NEWRULE] = {
0628b123 3057 .call_batch = nf_tables_newrule,
96518518
PM		 3058 .attr_count = NFTA_RULE_MAX,
3059 .policy = nft_rule_policy,
3060 },
3061 [NFT_MSG_GETRULE] = {
3062 .call = nf_tables_getrule,
3063 .attr_count = NFTA_RULE_MAX,
3064 .policy = nft_rule_policy,
3065 },
3066 [NFT_MSG_DELRULE] = {
0628b123 3067 .call_batch = nf_tables_delrule,
96518518
PM		 3068 .attr_count = NFTA_RULE_MAX,
3069 .policy = nft_rule_policy,
3070 },
20a69341
PM		 3071 [NFT_MSG_NEWSET] = {
3072 .call = nf_tables_newset,
3073 .attr_count = NFTA_SET_MAX,
3074 .policy = nft_set_policy,
3075 },
3076 [NFT_MSG_GETSET] = {
3077 .call = nf_tables_getset,
3078 .attr_count = NFTA_SET_MAX,
3079 .policy = nft_set_policy,
3080 },
3081 [NFT_MSG_DELSET] = {
3082 .call = nf_tables_delset,
3083 .attr_count = NFTA_SET_MAX,
3084 .policy = nft_set_policy,
3085 },
3086 [NFT_MSG_NEWSETELEM] = {
3087 .call = nf_tables_newsetelem,
3088 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3089 .policy = nft_set_elem_list_policy,
3090 },
3091 [NFT_MSG_GETSETELEM] = {
3092 .call = nf_tables_getsetelem,
3093 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3094 .policy = nft_set_elem_list_policy,
3095 },
3096 [NFT_MSG_DELSETELEM] = {
3097 .call = nf_tables_delsetelem,
3098 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3099 .policy = nft_set_elem_list_policy,
3100 },
96518518
PM		 3101};
3102
37082f93
PNA		 3103static int nf_tables_commit(struct sk_buff *skb)
3104{
3105 struct net *net = sock_net(skb->sk);
3106 struct nft_trans *trans, *next;
3107
3108 /* Bump generation counter, invalidate any dump in progress */
3109 net->nft.genctr++;
3110
3111 /* A new generation has just started */
3112 net->nft.gencursor = gencursor_next(net);
3113
3114 /* Make sure all packets have left the previous generation before
3115 * purging old rules.
3116 */
3117 synchronize_rcu();
3118
3119 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3120 switch (trans->msg_type) {
3121 case NFT_MSG_NEWRULE:
3122 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
3123 nf_tables_rule_notify(trans->ctx.skb, trans->ctx.nlh,
37082f93
PNA		 3124 trans->ctx.table,
3125 trans->ctx.chain,
3126 nft_trans_rule(trans),
3127 NFT_MSG_NEWRULE, 0,
3128 trans->ctx.afi->family);
3129 nft_trans_destroy(trans);
b380e5c7
PNA		 3130 break;
3131 case NFT_MSG_DELRULE:
3132 list_del_rcu(&nft_trans_rule(trans)->list);
3133 nf_tables_rule_notify(trans->ctx.skb, trans->ctx.nlh,
3134 trans->ctx.table,
3135 trans->ctx.chain,
3136 nft_trans_rule(trans), NFT_MSG_DELRULE, 0,
3137 trans->ctx.afi->family);
3138 break;
37082f93 3139 }
37082f93
PNA		 3140 }
3141
3142 /* Make sure we don't see any packet traversing old rules */
3143 synchronize_rcu();
3144
3145 /* Now we can safely release unused old rules */
3146 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3147 switch (trans->msg_type) {
3148 case NFT_MSG_DELRULE:
3149 nf_tables_rule_destroy(&trans->ctx,
3150 nft_trans_rule(trans));
3151 nft_trans_destroy(trans);
3152 break;
3153 }
37082f93
PNA		 3154 }
3155
3156 return 0;
3157}
3158
3159static int nf_tables_abort(struct sk_buff *skb)
3160{
3161 struct net *net = sock_net(skb->sk);
3162 struct nft_trans *trans, *next;
3163
3164 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3165 switch (trans->msg_type) {
3166 case NFT_MSG_NEWRULE:
3167 list_del_rcu(&nft_trans_rule(trans)->list);
3168 break;
3169 case NFT_MSG_DELRULE:
3170 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 3171 nft_trans_destroy(trans);
b380e5c7 3172 break;
37082f93 3173 }
37082f93
PNA		 3174 }
3175
3176 /* Make sure we don't see any packet accessing aborted rules */
3177 synchronize_rcu();
3178
3179 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3180 switch (trans->msg_type) {
3181 case NFT_MSG_NEWRULE:
3182 nf_tables_rule_destroy(&trans->ctx,
3183 nft_trans_rule(trans));
3184 nft_trans_destroy(trans);
3185 break;
3186 }
37082f93
PNA		 3187 }
3188
3189 return 0;
3190}
3191
96518518
PM		 3192static const struct nfnetlink_subsystem nf_tables_subsys = {
3193 .name = "nf_tables",
3194 .subsys_id = NFNL_SUBSYS_NFTABLES,
3195 .cb_count = NFT_MSG_MAX,
3196 .cb = nf_tables_cb,
0628b123
PNA		 3197 .commit = nf_tables_commit,
3198 .abort = nf_tables_abort,
96518518
PM		 3199};
3200
20a69341
PM		 3201/*
3202 * Loop detection - walk through the ruleset beginning at the destination chain
3203 * of a new jump until either the source chain is reached (loop) or all
3204 * reachable chains have been traversed.
3205 *
3206 * The loop check is performed whenever a new jump verdict is added to an
3207 * expression or verdict map or a verdict map is bound to a new chain.
3208 */
3209
3210static int nf_tables_check_loops(const struct nft_ctx *ctx,
3211 const struct nft_chain *chain);
3212
3213static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
3214 const struct nft_set *set,
3215 const struct nft_set_iter *iter,
3216 const struct nft_set_elem *elem)
3217{
62f9c8b4
PNA		 3218 if (elem->flags & NFT_SET_ELEM_INTERVAL_END)
3219 return 0;
3220
20a69341
PM		 3221 switch (elem->data.verdict) {
3222 case NFT_JUMP:
3223 case NFT_GOTO:
3224 return nf_tables_check_loops(ctx, elem->data.chain);
3225 default:
3226 return 0;
3227 }
3228}
3229
3230static int nf_tables_check_loops(const struct nft_ctx *ctx,
3231 const struct nft_chain *chain)
3232{
3233 const struct nft_rule *rule;
3234 const struct nft_expr *expr, *last;
20a69341
PM		 3235 const struct nft_set *set;
3236 struct nft_set_binding *binding;
3237 struct nft_set_iter iter;
20a69341
PM		 3238
3239 if (ctx->chain == chain)
3240 return -ELOOP;
3241
3242 list_for_each_entry(rule, &chain->rules, list) {
3243 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 3244 const struct nft_data *data = NULL;
3245 int err;
3246
3247 if (!expr->ops->validate)
20a69341
PM		 3248 continue;
3249
0ca743a5
PNA		 3250 err = expr->ops->validate(ctx, expr, &data);
3251 if (err < 0)
3252 return err;
3253
20a69341 3254 if (data == NULL)
0ca743a5 3255 continue;
20a69341
PM		 3256
3257 switch (data->verdict) {
3258 case NFT_JUMP:
3259 case NFT_GOTO:
3260 err = nf_tables_check_loops(ctx, data->chain);
3261 if (err < 0)
3262 return err;
3263 default:
3264 break;
3265 }
3266 }
3267 }
3268
3269 list_for_each_entry(set, &ctx->table->sets, list) {
3270 if (!(set->flags & NFT_SET_MAP) ||
3271 set->dtype != NFT_DATA_VERDICT)
3272 continue;
3273
3274 list_for_each_entry(binding, &set->bindings, list) {
3275 if (binding->chain != chain)
3276 continue;
3277
3278 iter.skip = 0;
3279 iter.count = 0;
3280 iter.err = 0;
3281 iter.fn = nf_tables_loop_check_setelem;
3282
3283 set->ops->walk(ctx, set, &iter);
3284 if (iter.err < 0)
3285 return iter.err;
3286 }
3287 }
3288
3289 return 0;
3290}
3291
96518518
PM		 3292/**
3293 * nft_validate_input_register - validate an expressions' input register
3294 *
3295 * @reg: the register number
3296 *
3297 * Validate that the input register is one of the general purpose
3298 * registers.
3299 */
3300int nft_validate_input_register(enum nft_registers reg)
3301{
3302 if (reg <= NFT_REG_VERDICT)
3303 return -EINVAL;
3304 if (reg > NFT_REG_MAX)
3305 return -ERANGE;
3306 return 0;
3307}
3308EXPORT_SYMBOL_GPL(nft_validate_input_register);
3309
3310/**
3311 * nft_validate_output_register - validate an expressions' output register
3312 *
3313 * @reg: the register number
3314 *
3315 * Validate that the output register is one of the general purpose
3316 * registers or the verdict register.
3317 */
3318int nft_validate_output_register(enum nft_registers reg)
3319{
3320 if (reg < NFT_REG_VERDICT)
3321 return -EINVAL;
3322 if (reg > NFT_REG_MAX)
3323 return -ERANGE;
3324 return 0;
3325}
3326EXPORT_SYMBOL_GPL(nft_validate_output_register);
3327
3328/**
3329 * nft_validate_data_load - validate an expressions' data load
3330 *
3331 * @ctx: context of the expression performing the load
3332 * @reg: the destination register number
3333 * @data: the data to load
3334 * @type: the data type
3335 *
3336 * Validate that a data load uses the appropriate data type for
3337 * the destination register. A value of NULL for the data means
3338 * that its runtime gathered data, which is always of type
3339 * NFT_DATA_VALUE.
3340 */
3341int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
3342 const struct nft_data *data,
3343 enum nft_data_types type)
3344{
20a69341
PM		 3345 int err;
3346
96518518
PM		 3347 switch (reg) {
3348 case NFT_REG_VERDICT:
3349 if (data == NULL || type != NFT_DATA_VERDICT)
3350 return -EINVAL;
20a69341
PM		 3351
3352 if (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP) {
3353 err = nf_tables_check_loops(ctx, data->chain);
3354 if (err < 0)
3355 return err;
3356
3357 if (ctx->chain->level + 1 > data->chain->level) {
3358 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
3359 return -EMLINK;
3360 data->chain->level = ctx->chain->level + 1;
3361 }
3362 }
3363
96518518
PM		 3364 return 0;
3365 default:
3366 if (data != NULL && type != NFT_DATA_VALUE)
3367 return -EINVAL;
3368 return 0;
3369 }
3370}
3371EXPORT_SYMBOL_GPL(nft_validate_data_load);
3372
3373static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
3374 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
3375 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
3376 .len = NFT_CHAIN_MAXNAMELEN - 1 },
3377};
3378
3379static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
3380 struct nft_data_desc *desc, const struct nlattr *nla)
3381{
3382 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
3383 struct nft_chain *chain;
3384 int err;
3385
3386 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy);
3387 if (err < 0)
3388 return err;
3389
3390 if (!tb[NFTA_VERDICT_CODE])
3391 return -EINVAL;
3392 data->verdict = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
3393
3394 switch (data->verdict) {
e0abdadc
PM		 3395 default:
3396 switch (data->verdict & NF_VERDICT_MASK) {
3397 case NF_ACCEPT:
3398 case NF_DROP:
3399 case NF_QUEUE:
3400 break;
3401 default:
3402 return -EINVAL;
3403 }
3404 /* fall through */
96518518
PM		 3405 case NFT_CONTINUE:
3406 case NFT_BREAK:
3407 case NFT_RETURN:
3408 desc->len = sizeof(data->verdict);
3409 break;
3410 case NFT_JUMP:
3411 case NFT_GOTO:
3412 if (!tb[NFTA_VERDICT_CHAIN])
3413 return -EINVAL;
3414 chain = nf_tables_chain_lookup(ctx->table,
3415 tb[NFTA_VERDICT_CHAIN]);
3416 if (IS_ERR(chain))
3417 return PTR_ERR(chain);
3418 if (chain->flags & NFT_BASE_CHAIN)
3419 return -EOPNOTSUPP;
3420
96518518
PM		 3421 chain->use++;
3422 data->chain = chain;
3423 desc->len = sizeof(data);
3424 break;
96518518
PM		 3425 }
3426
3427 desc->type = NFT_DATA_VERDICT;
3428 return 0;
3429}
3430
3431static void nft_verdict_uninit(const struct nft_data *data)
3432{
3433 switch (data->verdict) {
3434 case NFT_JUMP:
3435 case NFT_GOTO:
3436 data->chain->use--;
3437 break;
3438 }
3439}
3440
3441static int nft_verdict_dump(struct sk_buff *skb, const struct nft_data *data)
3442{
3443 struct nlattr *nest;
3444
3445 nest = nla_nest_start(skb, NFTA_DATA_VERDICT);
3446 if (!nest)
3447 goto nla_put_failure;
3448
3449 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict)))
3450 goto nla_put_failure;
3451
3452 switch (data->verdict) {
3453 case NFT_JUMP:
3454 case NFT_GOTO:
3455 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, data->chain->name))
3456 goto nla_put_failure;
3457 }
3458 nla_nest_end(skb, nest);
3459 return 0;
3460
3461nla_put_failure:
3462 return -1;
3463}
3464
3465static int nft_value_init(const struct nft_ctx *ctx, struct nft_data *data,
3466 struct nft_data_desc *desc, const struct nlattr *nla)
3467{
3468 unsigned int len;
3469
3470 len = nla_len(nla);
3471 if (len == 0)
3472 return -EINVAL;
3473 if (len > sizeof(data->data))
3474 return -EOVERFLOW;
3475
3476 nla_memcpy(data->data, nla, sizeof(data->data));
3477 desc->type = NFT_DATA_VALUE;
3478 desc->len = len;
3479 return 0;
3480}
3481
3482static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
3483 unsigned int len)
3484{
3485 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
3486}
3487
3488static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
3489 [NFTA_DATA_VALUE] = { .type = NLA_BINARY,
3490 .len = FIELD_SIZEOF(struct nft_data, data) },
3491 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
3492};
3493
3494/**
3495 * nft_data_init - parse nf_tables data netlink attributes
3496 *
3497 * @ctx: context of the expression using the data
3498 * @data: destination struct nft_data
3499 * @desc: data description
3500 * @nla: netlink attribute containing data
3501 *
3502 * Parse the netlink data attributes and initialize a struct nft_data.
3503 * The type and length of data are returned in the data description.
3504 *
3505 * The caller can indicate that it only wants to accept data of type
3506 * NFT_DATA_VALUE by passing NULL for the ctx argument.
3507 */
3508int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
3509 struct nft_data_desc *desc, const struct nlattr *nla)
3510{
3511 struct nlattr *tb[NFTA_DATA_MAX + 1];
3512 int err;
3513
3514 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy);
3515 if (err < 0)
3516 return err;
3517
3518 if (tb[NFTA_DATA_VALUE])
3519 return nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]);
3520 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
3521 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
3522 return -EINVAL;
3523}
3524EXPORT_SYMBOL_GPL(nft_data_init);
3525
3526/**
3527 * nft_data_uninit - release a nft_data item
3528 *
3529 * @data: struct nft_data to release
3530 * @type: type of data
3531 *
3532 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
3533 * all others need to be released by calling this function.
3534 */
3535void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
3536{
3537 switch (type) {
3538 case NFT_DATA_VALUE:
3539 return;
3540 case NFT_DATA_VERDICT:
3541 return nft_verdict_uninit(data);
3542 default:
3543 WARN_ON(1);
3544 }
3545}
3546EXPORT_SYMBOL_GPL(nft_data_uninit);
3547
3548int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
3549 enum nft_data_types type, unsigned int len)
3550{
3551 struct nlattr *nest;
3552 int err;
3553
3554 nest = nla_nest_start(skb, attr);
3555 if (nest == NULL)
3556 return -1;
3557
3558 switch (type) {
3559 case NFT_DATA_VALUE:
3560 err = nft_value_dump(skb, data, len);
3561 break;
3562 case NFT_DATA_VERDICT:
3563 err = nft_verdict_dump(skb, data);
3564 break;
3565 default:
3566 err = -EINVAL;
3567 WARN_ON(1);
3568 }
3569
3570 nla_nest_end(skb, nest);
3571 return err;
3572}
3573EXPORT_SYMBOL_GPL(nft_data_dump);
3574
99633ab2
PNA		 3575static int nf_tables_init_net(struct net *net)
3576{
3577 INIT_LIST_HEAD(&net->nft.af_info);
0628b123 3578 INIT_LIST_HEAD(&net->nft.commit_list);
99633ab2
PNA		 3579 return 0;
3580}
3581
3582static struct pernet_operations nf_tables_net_ops = {
3583 .init = nf_tables_init_net,
3584};
3585
96518518
PM		 3586static int __init nf_tables_module_init(void)
3587{
3588 int err;
3589
3590 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
3591 GFP_KERNEL);
3592 if (info == NULL) {
3593 err = -ENOMEM;
3594 goto err1;
3595 }
3596
3597 err = nf_tables_core_module_init();
3598 if (err < 0)
3599 goto err2;
3600
3601 err = nfnetlink_subsys_register(&nf_tables_subsys);
3602 if (err < 0)
3603 goto err3;
3604
3605 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
99633ab2 3606 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 3607err3:
3608 nf_tables_core_module_exit();
3609err2:
3610 kfree(info);
3611err1:
3612 return err;
3613}
3614
3615static void __exit nf_tables_module_exit(void)
3616{
99633ab2 3617 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 3618 nfnetlink_subsys_unregister(&nf_tables_subsys);
3619 nf_tables_core_module_exit();
3620 kfree(info);
3621}
3622
3623module_init(nf_tables_module_init);
3624module_exit(nf_tables_module_exit);
3625
3626MODULE_LICENSE("GPL");
3627MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
3628MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Linux 6.x block layer and io_uring tree(s)