Commit | Line | Data |
---|---|---|
0ca743a5 PNA |
1 | /* |
2 | * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | * | |
8 | * This software has been sponsored by Sophos Astaro <http://www.sophos.com> | |
9 | */ | |
10 | ||
11 | #include <linux/kernel.h> | |
12 | #include <linux/init.h> | |
13 | #include <linux/module.h> | |
14 | #include <linux/netlink.h> | |
15 | #include <linux/netfilter.h> | |
16 | #include <linux/netfilter/nfnetlink.h> | |
17 | #include <linux/netfilter/nf_tables.h> | |
18 | #include <linux/netfilter/nf_tables_compat.h> | |
19 | #include <linux/netfilter/x_tables.h> | |
20 | #include <linux/netfilter_ipv4/ip_tables.h> | |
21 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
5191f4d8 | 22 | #include <linux/netfilter_bridge/ebtables.h> |
5f158939 | 23 | #include <linux/netfilter_arp/arp_tables.h> |
0ca743a5 PNA |
24 | #include <net/netfilter/nf_tables.h> |
25 | ||
4b512e1c LZ |
26 | struct nft_xt { |
27 | struct list_head head; | |
28 | struct nft_expr_ops ops; | |
29 | unsigned int refcnt; | |
b8e9dc1c FW |
30 | |
31 | /* Unlike other expressions, ops doesn't have static storage duration. | |
32 | * nft core assumes they do. We use kfree_rcu so that nft core can | |
33 | * can check expr->ops->size even after nft_compat->destroy() frees | |
34 | * the nft_xt struct that holds the ops structure. | |
35 | */ | |
36 | struct rcu_head rcu_head; | |
4b512e1c LZ |
37 | }; |
38 | ||
732a8049 FW |
39 | /* Used for matches where *info is larger than X byte */ |
40 | #define NFT_MATCH_LARGE_THRESH 192 | |
41 | ||
42 | struct nft_xt_match_priv { | |
43 | void *info; | |
44 | }; | |
45 | ||
b8e9dc1c | 46 | static bool nft_xt_put(struct nft_xt *xt) |
4b512e1c LZ |
47 | { |
48 | if (--xt->refcnt == 0) { | |
49 | list_del(&xt->head); | |
b8e9dc1c FW |
50 | kfree_rcu(xt, rcu_head); |
51 | return true; | |
4b512e1c | 52 | } |
b8e9dc1c FW |
53 | |
54 | return false; | |
4b512e1c LZ |
55 | } |
56 | ||
f3f5dded PNA |
57 | static int nft_compat_chain_validate_dependency(const char *tablename, |
58 | const struct nft_chain *chain) | |
59 | { | |
f3f5dded PNA |
60 | const struct nft_base_chain *basechain; |
61 | ||
f323d954 PNA |
62 | if (!tablename || |
63 | !nft_is_base_chain(chain)) | |
f3f5dded PNA |
64 | return 0; |
65 | ||
f3f5dded | 66 | basechain = nft_base_chain(chain); |
c918687f PNA |
67 | if (strcmp(tablename, "nat") == 0 && |
68 | basechain->type->type != NFT_CHAIN_T_NAT) | |
f3f5dded PNA |
69 | return -EINVAL; |
70 | ||
71 | return 0; | |
72 | } | |
73 | ||
0ca743a5 PNA |
74 | union nft_entry { |
75 | struct ipt_entry e4; | |
76 | struct ip6t_entry e6; | |
5191f4d8 | 77 | struct ebt_entry ebt; |
5f158939 | 78 | struct arpt_entry arp; |
0ca743a5 PNA |
79 | }; |
80 | ||
81 | static inline void | |
82 | nft_compat_set_par(struct xt_action_param *par, void *xt, const void *xt_info) | |
83 | { | |
84 | par->target = xt; | |
85 | par->targinfo = xt_info; | |
86 | par->hotdrop = false; | |
87 | } | |
88 | ||
5191f4d8 | 89 | static void nft_target_eval_xt(const struct nft_expr *expr, |
a55e22e9 | 90 | struct nft_regs *regs, |
5191f4d8 | 91 | const struct nft_pktinfo *pkt) |
0ca743a5 PNA |
92 | { |
93 | void *info = nft_expr_priv(expr); | |
94 | struct xt_target *target = expr->ops->data; | |
95 | struct sk_buff *skb = pkt->skb; | |
96 | int ret; | |
97 | ||
98 | nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info); | |
99 | ||
100 | ret = target->target(skb, &pkt->xt); | |
101 | ||
102 | if (pkt->xt.hotdrop) | |
103 | ret = NF_DROP; | |
104 | ||
5191f4d8 | 105 | switch (ret) { |
0ca743a5 | 106 | case XT_CONTINUE: |
a55e22e9 | 107 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 PNA |
108 | break; |
109 | default: | |
a55e22e9 | 110 | regs->verdict.code = ret; |
0ca743a5 PNA |
111 | break; |
112 | } | |
5191f4d8 AB |
113 | } |
114 | ||
115 | static void nft_target_eval_bridge(const struct nft_expr *expr, | |
a55e22e9 | 116 | struct nft_regs *regs, |
5191f4d8 AB |
117 | const struct nft_pktinfo *pkt) |
118 | { | |
119 | void *info = nft_expr_priv(expr); | |
120 | struct xt_target *target = expr->ops->data; | |
121 | struct sk_buff *skb = pkt->skb; | |
122 | int ret; | |
123 | ||
124 | nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info); | |
125 | ||
126 | ret = target->target(skb, &pkt->xt); | |
127 | ||
128 | if (pkt->xt.hotdrop) | |
129 | ret = NF_DROP; | |
130 | ||
131 | switch (ret) { | |
132 | case EBT_ACCEPT: | |
a55e22e9 | 133 | regs->verdict.code = NF_ACCEPT; |
5191f4d8 AB |
134 | break; |
135 | case EBT_DROP: | |
a55e22e9 | 136 | regs->verdict.code = NF_DROP; |
5191f4d8 AB |
137 | break; |
138 | case EBT_CONTINUE: | |
a55e22e9 | 139 | regs->verdict.code = NFT_CONTINUE; |
5191f4d8 AB |
140 | break; |
141 | case EBT_RETURN: | |
a55e22e9 | 142 | regs->verdict.code = NFT_RETURN; |
5191f4d8 AB |
143 | break; |
144 | default: | |
a55e22e9 | 145 | regs->verdict.code = ret; |
5191f4d8 AB |
146 | break; |
147 | } | |
0ca743a5 PNA |
148 | } |
149 | ||
150 | static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { | |
151 | [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, | |
152 | [NFTA_TARGET_REV] = { .type = NLA_U32 }, | |
153 | [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, | |
154 | }; | |
155 | ||
156 | static void | |
157 | nft_target_set_tgchk_param(struct xt_tgchk_param *par, | |
158 | const struct nft_ctx *ctx, | |
159 | struct xt_target *target, void *info, | |
2156d321 | 160 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 161 | { |
2daf1b4d | 162 | par->net = ctx->net; |
0ca743a5 | 163 | par->table = ctx->table->name; |
36596dad | 164 | switch (ctx->family) { |
0ca743a5 PNA |
165 | case AF_INET: |
166 | entry->e4.ip.proto = proto; | |
167 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
168 | break; | |
169 | case AF_INET6: | |
749177cc PNA |
170 | if (proto) |
171 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
172 | ||
0ca743a5 PNA |
173 | entry->e6.ipv6.proto = proto; |
174 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
175 | break; | |
5191f4d8 | 176 | case NFPROTO_BRIDGE: |
2156d321 | 177 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
178 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
179 | break; | |
5f158939 AB |
180 | case NFPROTO_ARP: |
181 | break; | |
0ca743a5 PNA |
182 | } |
183 | par->entryinfo = entry; | |
184 | par->target = target; | |
185 | par->targinfo = info; | |
f323d954 | 186 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
187 | const struct nft_base_chain *basechain = |
188 | nft_base_chain(ctx->chain); | |
c974a3a3 | 189 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
190 | |
191 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
192 | } else { |
193 | par->hook_mask = 0; | |
0ca743a5 | 194 | } |
36596dad | 195 | par->family = ctx->family; |
55917a21 | 196 | par->nft_compat = true; |
0ca743a5 PNA |
197 | } |
198 | ||
199 | static void target_compat_from_user(struct xt_target *t, void *in, void *out) | |
200 | { | |
756c1b1a | 201 | int pad; |
0ca743a5 | 202 | |
756c1b1a PNA |
203 | memcpy(out, in, t->targetsize); |
204 | pad = XT_ALIGN(t->targetsize) - t->targetsize; | |
205 | if (pad > 0) | |
206 | memset(out + t->targetsize, 0, pad); | |
0ca743a5 PNA |
207 | } |
208 | ||
209 | static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = { | |
210 | [NFTA_RULE_COMPAT_PROTO] = { .type = NLA_U32 }, | |
211 | [NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 }, | |
212 | }; | |
213 | ||
2156d321 | 214 | static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) |
0ca743a5 PNA |
215 | { |
216 | struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; | |
217 | u32 flags; | |
218 | int err; | |
219 | ||
220 | err = nla_parse_nested(tb, NFTA_RULE_COMPAT_MAX, attr, | |
fceb6435 | 221 | nft_rule_compat_policy, NULL); |
0ca743a5 PNA |
222 | if (err < 0) |
223 | return err; | |
224 | ||
225 | if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS]) | |
226 | return -EINVAL; | |
227 | ||
228 | flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS])); | |
229 | if (flags & ~NFT_RULE_COMPAT_F_MASK) | |
230 | return -EINVAL; | |
231 | if (flags & NFT_RULE_COMPAT_F_INV) | |
232 | *inv = true; | |
233 | ||
8691a9a3 PNA |
234 | *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); |
235 | return 0; | |
0ca743a5 PNA |
236 | } |
237 | ||
238 | static int | |
239 | nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
240 | const struct nlattr * const tb[]) | |
241 | { | |
242 | void *info = nft_expr_priv(expr); | |
243 | struct xt_target *target = expr->ops->data; | |
244 | struct xt_tgchk_param par; | |
245 | size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); | |
b8e9dc1c | 246 | struct nft_xt *nft_xt; |
2156d321 | 247 | u16 proto = 0; |
0ca743a5 PNA |
248 | bool inv = false; |
249 | union nft_entry e = {}; | |
250 | int ret; | |
251 | ||
252 | target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info); | |
253 | ||
8691a9a3 PNA |
254 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
255 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
256 | if (ret < 0) | |
b8e9dc1c | 257 | return ret; |
8691a9a3 | 258 | } |
0ca743a5 PNA |
259 | |
260 | nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); | |
261 | ||
262 | ret = xt_check_target(&par, size, proto, inv); | |
263 | if (ret < 0) | |
b8e9dc1c | 264 | return ret; |
0ca743a5 PNA |
265 | |
266 | /* The standard target cannot be used */ | |
b8e9dc1c FW |
267 | if (!target->target) |
268 | return -EINVAL; | |
0ca743a5 | 269 | |
b8e9dc1c FW |
270 | nft_xt = container_of(expr->ops, struct nft_xt, ops); |
271 | nft_xt->refcnt++; | |
0ca743a5 | 272 | return 0; |
0ca743a5 PNA |
273 | } |
274 | ||
275 | static void | |
62472bce | 276 | nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
0ca743a5 PNA |
277 | { |
278 | struct xt_target *target = expr->ops->data; | |
3d9b1421 PNA |
279 | void *info = nft_expr_priv(expr); |
280 | struct xt_tgdtor_param par; | |
281 | ||
282 | par.net = ctx->net; | |
283 | par.target = target; | |
284 | par.targinfo = info; | |
36596dad | 285 | par.family = ctx->family; |
3d9b1421 PNA |
286 | if (par.target->destroy != NULL) |
287 | par.target->destroy(&par); | |
0ca743a5 | 288 | |
b8e9dc1c FW |
289 | if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) |
290 | module_put(target->me); | |
0ca743a5 PNA |
291 | } |
292 | ||
d701d811 PNA |
293 | static int nft_extension_dump_info(struct sk_buff *skb, int attr, |
294 | const void *info, | |
295 | unsigned int size, unsigned int user_size) | |
296 | { | |
297 | unsigned int info_size, aligned_size = XT_ALIGN(size); | |
298 | struct nlattr *nla; | |
299 | ||
300 | nla = nla_reserve(skb, attr, aligned_size); | |
301 | if (!nla) | |
302 | return -1; | |
303 | ||
304 | info_size = user_size ? : size; | |
305 | memcpy(nla_data(nla), info, info_size); | |
306 | memset(nla_data(nla) + info_size, 0, aligned_size - info_size); | |
307 | ||
308 | return 0; | |
309 | } | |
310 | ||
0ca743a5 PNA |
311 | static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr) |
312 | { | |
313 | const struct xt_target *target = expr->ops->data; | |
314 | void *info = nft_expr_priv(expr); | |
315 | ||
316 | if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) || | |
317 | nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) || | |
d701d811 PNA |
318 | nft_extension_dump_info(skb, NFTA_TARGET_INFO, info, |
319 | target->targetsize, target->usersize)) | |
0ca743a5 PNA |
320 | goto nla_put_failure; |
321 | ||
322 | return 0; | |
323 | ||
324 | nla_put_failure: | |
325 | return -1; | |
326 | } | |
327 | ||
328 | static int nft_target_validate(const struct nft_ctx *ctx, | |
329 | const struct nft_expr *expr, | |
330 | const struct nft_data **data) | |
331 | { | |
332 | struct xt_target *target = expr->ops->data; | |
333 | unsigned int hook_mask = 0; | |
f3f5dded | 334 | int ret; |
0ca743a5 | 335 | |
f323d954 | 336 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
337 | const struct nft_base_chain *basechain = |
338 | nft_base_chain(ctx->chain); | |
c974a3a3 | 339 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
340 | |
341 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 342 | if (target->hooks && !(hook_mask & target->hooks)) |
f3f5dded | 343 | return -EINVAL; |
0ca743a5 | 344 | |
f3f5dded PNA |
345 | ret = nft_compat_chain_validate_dependency(target->table, |
346 | ctx->chain); | |
347 | if (ret < 0) | |
348 | return ret; | |
0ca743a5 PNA |
349 | } |
350 | return 0; | |
351 | } | |
352 | ||
8bdf1647 FW |
353 | static void __nft_match_eval(const struct nft_expr *expr, |
354 | struct nft_regs *regs, | |
355 | const struct nft_pktinfo *pkt, | |
356 | void *info) | |
0ca743a5 | 357 | { |
0ca743a5 PNA |
358 | struct xt_match *match = expr->ops->data; |
359 | struct sk_buff *skb = pkt->skb; | |
360 | bool ret; | |
361 | ||
362 | nft_compat_set_par((struct xt_action_param *)&pkt->xt, match, info); | |
363 | ||
364 | ret = match->match(skb, (struct xt_action_param *)&pkt->xt); | |
365 | ||
366 | if (pkt->xt.hotdrop) { | |
a55e22e9 | 367 | regs->verdict.code = NF_DROP; |
0ca743a5 PNA |
368 | return; |
369 | } | |
370 | ||
c1f86676 DM |
371 | switch (ret ? 1 : 0) { |
372 | case 1: | |
a55e22e9 | 373 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 | 374 | break; |
c1f86676 | 375 | case 0: |
a55e22e9 | 376 | regs->verdict.code = NFT_BREAK; |
0ca743a5 PNA |
377 | break; |
378 | } | |
379 | } | |
380 | ||
732a8049 FW |
381 | static void nft_match_large_eval(const struct nft_expr *expr, |
382 | struct nft_regs *regs, | |
383 | const struct nft_pktinfo *pkt) | |
384 | { | |
385 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
386 | ||
387 | __nft_match_eval(expr, regs, pkt, priv->info); | |
388 | } | |
389 | ||
8bdf1647 FW |
390 | static void nft_match_eval(const struct nft_expr *expr, |
391 | struct nft_regs *regs, | |
392 | const struct nft_pktinfo *pkt) | |
393 | { | |
394 | __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr)); | |
395 | } | |
396 | ||
0ca743a5 PNA |
397 | static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { |
398 | [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, | |
399 | [NFTA_MATCH_REV] = { .type = NLA_U32 }, | |
400 | [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, | |
401 | }; | |
402 | ||
403 | /* struct xt_mtchk_param and xt_tgchk_param look very similar */ | |
404 | static void | |
405 | nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, | |
406 | struct xt_match *match, void *info, | |
2156d321 | 407 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 408 | { |
2daf1b4d | 409 | par->net = ctx->net; |
0ca743a5 | 410 | par->table = ctx->table->name; |
36596dad | 411 | switch (ctx->family) { |
0ca743a5 PNA |
412 | case AF_INET: |
413 | entry->e4.ip.proto = proto; | |
414 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
415 | break; | |
416 | case AF_INET6: | |
749177cc PNA |
417 | if (proto) |
418 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
419 | ||
0ca743a5 PNA |
420 | entry->e6.ipv6.proto = proto; |
421 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
422 | break; | |
5191f4d8 | 423 | case NFPROTO_BRIDGE: |
2156d321 | 424 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
425 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
426 | break; | |
5f158939 AB |
427 | case NFPROTO_ARP: |
428 | break; | |
0ca743a5 PNA |
429 | } |
430 | par->entryinfo = entry; | |
431 | par->match = match; | |
432 | par->matchinfo = info; | |
f323d954 | 433 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
434 | const struct nft_base_chain *basechain = |
435 | nft_base_chain(ctx->chain); | |
c974a3a3 | 436 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
437 | |
438 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
439 | } else { |
440 | par->hook_mask = 0; | |
0ca743a5 | 441 | } |
36596dad | 442 | par->family = ctx->family; |
55917a21 | 443 | par->nft_compat = true; |
0ca743a5 PNA |
444 | } |
445 | ||
446 | static void match_compat_from_user(struct xt_match *m, void *in, void *out) | |
447 | { | |
756c1b1a PNA |
448 | int pad; |
449 | ||
450 | memcpy(out, in, m->matchsize); | |
451 | pad = XT_ALIGN(m->matchsize) - m->matchsize; | |
452 | if (pad > 0) | |
453 | memset(out + m->matchsize, 0, pad); | |
0ca743a5 PNA |
454 | } |
455 | ||
456 | static int | |
8bdf1647 FW |
457 | __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
458 | const struct nlattr * const tb[], | |
459 | void *info) | |
0ca743a5 | 460 | { |
0ca743a5 PNA |
461 | struct xt_match *match = expr->ops->data; |
462 | struct xt_mtchk_param par; | |
463 | size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); | |
b8e9dc1c | 464 | struct nft_xt *nft_xt; |
2156d321 | 465 | u16 proto = 0; |
0ca743a5 PNA |
466 | bool inv = false; |
467 | union nft_entry e = {}; | |
468 | int ret; | |
469 | ||
470 | match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info); | |
471 | ||
8691a9a3 PNA |
472 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
473 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
474 | if (ret < 0) | |
b8e9dc1c | 475 | return ret; |
8691a9a3 | 476 | } |
0ca743a5 PNA |
477 | |
478 | nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); | |
479 | ||
480 | ret = xt_check_match(&par, size, proto, inv); | |
481 | if (ret < 0) | |
b8e9dc1c | 482 | return ret; |
0ca743a5 | 483 | |
b8e9dc1c FW |
484 | nft_xt = container_of(expr->ops, struct nft_xt, ops); |
485 | nft_xt->refcnt++; | |
0ca743a5 | 486 | return 0; |
0ca743a5 PNA |
487 | } |
488 | ||
8bdf1647 FW |
489 | static int |
490 | nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
491 | const struct nlattr * const tb[]) | |
492 | { | |
493 | return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr)); | |
494 | } | |
495 | ||
732a8049 FW |
496 | static int |
497 | nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
498 | const struct nlattr * const tb[]) | |
499 | { | |
500 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
501 | struct xt_match *m = expr->ops->data; | |
502 | int ret; | |
503 | ||
504 | priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); | |
505 | if (!priv->info) | |
506 | return -ENOMEM; | |
507 | ||
508 | ret = __nft_match_init(ctx, expr, tb, priv->info); | |
509 | if (ret) | |
510 | kfree(priv->info); | |
511 | return ret; | |
512 | } | |
513 | ||
0ca743a5 | 514 | static void |
8bdf1647 FW |
515 | __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, |
516 | void *info) | |
0ca743a5 PNA |
517 | { |
518 | struct xt_match *match = expr->ops->data; | |
3d9b1421 PNA |
519 | struct xt_mtdtor_param par; |
520 | ||
521 | par.net = ctx->net; | |
522 | par.match = match; | |
523 | par.matchinfo = info; | |
36596dad | 524 | par.family = ctx->family; |
3d9b1421 PNA |
525 | if (par.match->destroy != NULL) |
526 | par.match->destroy(&par); | |
0ca743a5 | 527 | |
b8e9dc1c FW |
528 | if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) |
529 | module_put(match->me); | |
0ca743a5 PNA |
530 | } |
531 | ||
8bdf1647 FW |
532 | static void |
533 | nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
534 | { | |
535 | __nft_match_destroy(ctx, expr, nft_expr_priv(expr)); | |
536 | } | |
537 | ||
732a8049 FW |
538 | static void |
539 | nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
540 | { | |
541 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
542 | ||
543 | __nft_match_destroy(ctx, expr, priv->info); | |
544 | kfree(priv->info); | |
545 | } | |
546 | ||
8bdf1647 FW |
547 | static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, |
548 | void *info) | |
0ca743a5 | 549 | { |
0ca743a5 PNA |
550 | struct xt_match *match = expr->ops->data; |
551 | ||
552 | if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) || | |
553 | nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) || | |
d701d811 PNA |
554 | nft_extension_dump_info(skb, NFTA_MATCH_INFO, info, |
555 | match->matchsize, match->usersize)) | |
0ca743a5 PNA |
556 | goto nla_put_failure; |
557 | ||
558 | return 0; | |
559 | ||
560 | nla_put_failure: | |
561 | return -1; | |
562 | } | |
563 | ||
8bdf1647 FW |
564 | static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr) |
565 | { | |
566 | return __nft_match_dump(skb, expr, nft_expr_priv(expr)); | |
567 | } | |
568 | ||
732a8049 FW |
569 | static int nft_match_large_dump(struct sk_buff *skb, const struct nft_expr *e) |
570 | { | |
571 | struct nft_xt_match_priv *priv = nft_expr_priv(e); | |
572 | ||
573 | return __nft_match_dump(skb, e, priv->info); | |
574 | } | |
575 | ||
0ca743a5 PNA |
576 | static int nft_match_validate(const struct nft_ctx *ctx, |
577 | const struct nft_expr *expr, | |
578 | const struct nft_data **data) | |
579 | { | |
580 | struct xt_match *match = expr->ops->data; | |
581 | unsigned int hook_mask = 0; | |
f3f5dded | 582 | int ret; |
0ca743a5 | 583 | |
f323d954 | 584 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
585 | const struct nft_base_chain *basechain = |
586 | nft_base_chain(ctx->chain); | |
c974a3a3 | 587 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
588 | |
589 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 590 | if (match->hooks && !(hook_mask & match->hooks)) |
f3f5dded | 591 | return -EINVAL; |
0ca743a5 | 592 | |
afefb6f9 | 593 | ret = nft_compat_chain_validate_dependency(match->table, |
f3f5dded PNA |
594 | ctx->chain); |
595 | if (ret < 0) | |
596 | return ret; | |
0ca743a5 PNA |
597 | } |
598 | return 0; | |
599 | } | |
600 | ||
601 | static int | |
602 | nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, | |
603 | int event, u16 family, const char *name, | |
604 | int rev, int target) | |
605 | { | |
606 | struct nlmsghdr *nlh; | |
607 | struct nfgenmsg *nfmsg; | |
608 | unsigned int flags = portid ? NLM_F_MULTI : 0; | |
609 | ||
dedb67c4 | 610 | event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event); |
0ca743a5 PNA |
611 | nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); |
612 | if (nlh == NULL) | |
613 | goto nlmsg_failure; | |
614 | ||
615 | nfmsg = nlmsg_data(nlh); | |
616 | nfmsg->nfgen_family = family; | |
617 | nfmsg->version = NFNETLINK_V0; | |
618 | nfmsg->res_id = 0; | |
619 | ||
620 | if (nla_put_string(skb, NFTA_COMPAT_NAME, name) || | |
621 | nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) || | |
622 | nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target))) | |
623 | goto nla_put_failure; | |
624 | ||
625 | nlmsg_end(skb, nlh); | |
626 | return skb->len; | |
627 | ||
628 | nlmsg_failure: | |
629 | nla_put_failure: | |
630 | nlmsg_cancel(skb, nlh); | |
631 | return -1; | |
632 | } | |
633 | ||
eb1fb147 FW |
634 | static int nfnl_compat_get_rcu(struct net *net, struct sock *nfnl, |
635 | struct sk_buff *skb, const struct nlmsghdr *nlh, | |
636 | const struct nlattr * const tb[], | |
637 | struct netlink_ext_ack *extack) | |
0ca743a5 PNA |
638 | { |
639 | int ret = 0, target; | |
640 | struct nfgenmsg *nfmsg; | |
641 | const char *fmt; | |
642 | const char *name; | |
643 | u32 rev; | |
644 | struct sk_buff *skb2; | |
645 | ||
646 | if (tb[NFTA_COMPAT_NAME] == NULL || | |
647 | tb[NFTA_COMPAT_REV] == NULL || | |
648 | tb[NFTA_COMPAT_TYPE] == NULL) | |
649 | return -EINVAL; | |
650 | ||
651 | name = nla_data(tb[NFTA_COMPAT_NAME]); | |
652 | rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV])); | |
653 | target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE])); | |
654 | ||
655 | nfmsg = nlmsg_data(nlh); | |
656 | ||
657 | switch(nfmsg->nfgen_family) { | |
658 | case AF_INET: | |
659 | fmt = "ipt_%s"; | |
660 | break; | |
661 | case AF_INET6: | |
662 | fmt = "ip6t_%s"; | |
663 | break; | |
5191f4d8 AB |
664 | case NFPROTO_BRIDGE: |
665 | fmt = "ebt_%s"; | |
666 | break; | |
5f158939 AB |
667 | case NFPROTO_ARP: |
668 | fmt = "arpt_%s"; | |
669 | break; | |
0ca743a5 PNA |
670 | default: |
671 | pr_err("nft_compat: unsupported protocol %d\n", | |
672 | nfmsg->nfgen_family); | |
673 | return -EINVAL; | |
674 | } | |
675 | ||
eb1fb147 FW |
676 | if (!try_module_get(THIS_MODULE)) |
677 | return -EINVAL; | |
678 | ||
679 | rcu_read_unlock(); | |
0ca743a5 PNA |
680 | try_then_request_module(xt_find_revision(nfmsg->nfgen_family, name, |
681 | rev, target, &ret), | |
682 | fmt, name); | |
0ca743a5 | 683 | if (ret < 0) |
eb1fb147 | 684 | goto out_put; |
0ca743a5 PNA |
685 | |
686 | skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); | |
eb1fb147 FW |
687 | if (skb2 == NULL) { |
688 | ret = -ENOMEM; | |
689 | goto out_put; | |
690 | } | |
0ca743a5 PNA |
691 | |
692 | /* include the best revision for this extension in the message */ | |
693 | if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid, | |
694 | nlh->nlmsg_seq, | |
695 | NFNL_MSG_TYPE(nlh->nlmsg_type), | |
696 | NFNL_MSG_COMPAT_GET, | |
697 | nfmsg->nfgen_family, | |
698 | name, ret, target) <= 0) { | |
699 | kfree_skb(skb2); | |
eb1fb147 | 700 | goto out_put; |
0ca743a5 PNA |
701 | } |
702 | ||
703 | ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid, | |
704 | MSG_DONTWAIT); | |
705 | if (ret > 0) | |
706 | ret = 0; | |
eb1fb147 FW |
707 | out_put: |
708 | rcu_read_lock(); | |
709 | module_put(THIS_MODULE); | |
0ca743a5 PNA |
710 | return ret == -EAGAIN ? -ENOBUFS : ret; |
711 | } | |
712 | ||
713 | static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = { | |
714 | [NFTA_COMPAT_NAME] = { .type = NLA_NUL_STRING, | |
715 | .len = NFT_COMPAT_NAME_MAX-1 }, | |
716 | [NFTA_COMPAT_REV] = { .type = NLA_U32 }, | |
717 | [NFTA_COMPAT_TYPE] = { .type = NLA_U32 }, | |
718 | }; | |
719 | ||
720 | static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = { | |
eb1fb147 | 721 | [NFNL_MSG_COMPAT_GET] = { .call_rcu = nfnl_compat_get_rcu, |
0ca743a5 PNA |
722 | .attr_count = NFTA_COMPAT_MAX, |
723 | .policy = nfnl_compat_policy_get }, | |
724 | }; | |
725 | ||
726 | static const struct nfnetlink_subsystem nfnl_compat_subsys = { | |
727 | .name = "nft-compat", | |
728 | .subsys_id = NFNL_SUBSYS_NFT_COMPAT, | |
729 | .cb_count = NFNL_MSG_COMPAT_MAX, | |
730 | .cb = nfnl_nft_compat_cb, | |
731 | }; | |
732 | ||
733 | static LIST_HEAD(nft_match_list); | |
734 | ||
0ca743a5 PNA |
735 | static struct nft_expr_type nft_match_type; |
736 | ||
ba378ca9 PNA |
737 | static bool nft_match_cmp(const struct xt_match *match, |
738 | const char *name, u32 rev, u32 family) | |
739 | { | |
740 | return strcmp(match->name, name) == 0 && match->revision == rev && | |
741 | (match->family == NFPROTO_UNSPEC || match->family == family); | |
742 | } | |
743 | ||
0ca743a5 PNA |
744 | static const struct nft_expr_ops * |
745 | nft_match_select_ops(const struct nft_ctx *ctx, | |
746 | const struct nlattr * const tb[]) | |
747 | { | |
748 | struct nft_xt *nft_match; | |
749 | struct xt_match *match; | |
732a8049 | 750 | unsigned int matchsize; |
0ca743a5 | 751 | char *mt_name; |
ba378ca9 | 752 | u32 rev, family; |
2bf4fade | 753 | int err; |
0ca743a5 PNA |
754 | |
755 | if (tb[NFTA_MATCH_NAME] == NULL || | |
756 | tb[NFTA_MATCH_REV] == NULL || | |
757 | tb[NFTA_MATCH_INFO] == NULL) | |
758 | return ERR_PTR(-EINVAL); | |
759 | ||
760 | mt_name = nla_data(tb[NFTA_MATCH_NAME]); | |
761 | rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); | |
36596dad | 762 | family = ctx->family; |
0ca743a5 PNA |
763 | |
764 | /* Re-use the existing match if it's already loaded. */ | |
765 | list_for_each_entry(nft_match, &nft_match_list, head) { | |
766 | struct xt_match *match = nft_match->ops.data; | |
767 | ||
b8e9dc1c | 768 | if (nft_match_cmp(match, mt_name, rev, family)) |
0ca743a5 PNA |
769 | return &nft_match->ops; |
770 | } | |
771 | ||
772 | match = xt_request_find_match(family, mt_name, rev); | |
773 | if (IS_ERR(match)) | |
774 | return ERR_PTR(-ENOENT); | |
775 | ||
2bf4fade LZ |
776 | if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) { |
777 | err = -EINVAL; | |
778 | goto err; | |
779 | } | |
f0716cd6 | 780 | |
0ca743a5 PNA |
781 | /* This is the first time we use this match, allocate operations */ |
782 | nft_match = kzalloc(sizeof(struct nft_xt), GFP_KERNEL); | |
2bf4fade LZ |
783 | if (nft_match == NULL) { |
784 | err = -ENOMEM; | |
785 | goto err; | |
786 | } | |
0ca743a5 | 787 | |
b8e9dc1c | 788 | nft_match->refcnt = 0; |
0ca743a5 | 789 | nft_match->ops.type = &nft_match_type; |
0ca743a5 PNA |
790 | nft_match->ops.eval = nft_match_eval; |
791 | nft_match->ops.init = nft_match_init; | |
792 | nft_match->ops.destroy = nft_match_destroy; | |
793 | nft_match->ops.dump = nft_match_dump; | |
794 | nft_match->ops.validate = nft_match_validate; | |
795 | nft_match->ops.data = match; | |
796 | ||
732a8049 FW |
797 | matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); |
798 | if (matchsize > NFT_MATCH_LARGE_THRESH) { | |
799 | matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); | |
800 | ||
801 | nft_match->ops.eval = nft_match_large_eval; | |
802 | nft_match->ops.init = nft_match_large_init; | |
803 | nft_match->ops.destroy = nft_match_large_destroy; | |
804 | nft_match->ops.dump = nft_match_large_dump; | |
805 | } | |
806 | ||
807 | nft_match->ops.size = matchsize; | |
808 | ||
0ca743a5 PNA |
809 | list_add(&nft_match->head, &nft_match_list); |
810 | ||
811 | return &nft_match->ops; | |
2bf4fade LZ |
812 | err: |
813 | module_put(match->me); | |
814 | return ERR_PTR(err); | |
0ca743a5 PNA |
815 | } |
816 | ||
0ca743a5 PNA |
817 | static struct nft_expr_type nft_match_type __read_mostly = { |
818 | .name = "match", | |
819 | .select_ops = nft_match_select_ops, | |
820 | .policy = nft_match_policy, | |
821 | .maxattr = NFTA_MATCH_MAX, | |
822 | .owner = THIS_MODULE, | |
823 | }; | |
824 | ||
825 | static LIST_HEAD(nft_target_list); | |
826 | ||
827 | static struct nft_expr_type nft_target_type; | |
828 | ||
ba378ca9 PNA |
829 | static bool nft_target_cmp(const struct xt_target *tg, |
830 | const char *name, u32 rev, u32 family) | |
831 | { | |
832 | return strcmp(tg->name, name) == 0 && tg->revision == rev && | |
833 | (tg->family == NFPROTO_UNSPEC || tg->family == family); | |
834 | } | |
835 | ||
0ca743a5 PNA |
836 | static const struct nft_expr_ops * |
837 | nft_target_select_ops(const struct nft_ctx *ctx, | |
838 | const struct nlattr * const tb[]) | |
839 | { | |
840 | struct nft_xt *nft_target; | |
841 | struct xt_target *target; | |
842 | char *tg_name; | |
ba378ca9 | 843 | u32 rev, family; |
2bf4fade | 844 | int err; |
0ca743a5 PNA |
845 | |
846 | if (tb[NFTA_TARGET_NAME] == NULL || | |
847 | tb[NFTA_TARGET_REV] == NULL || | |
848 | tb[NFTA_TARGET_INFO] == NULL) | |
849 | return ERR_PTR(-EINVAL); | |
850 | ||
851 | tg_name = nla_data(tb[NFTA_TARGET_NAME]); | |
852 | rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); | |
36596dad | 853 | family = ctx->family; |
0ca743a5 | 854 | |
21d5e078 FW |
855 | if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || |
856 | strcmp(tg_name, XT_STANDARD_TARGET) == 0 || | |
857 | strcmp(tg_name, "standard") == 0) | |
858 | return ERR_PTR(-EINVAL); | |
859 | ||
0ca743a5 | 860 | /* Re-use the existing target if it's already loaded. */ |
7965ee93 | 861 | list_for_each_entry(nft_target, &nft_target_list, head) { |
0ca743a5 PNA |
862 | struct xt_target *target = nft_target->ops.data; |
863 | ||
21d5e078 FW |
864 | if (!target->target) |
865 | continue; | |
866 | ||
b8e9dc1c | 867 | if (nft_target_cmp(target, tg_name, rev, family)) |
0ca743a5 PNA |
868 | return &nft_target->ops; |
869 | } | |
870 | ||
871 | target = xt_request_find_target(family, tg_name, rev); | |
872 | if (IS_ERR(target)) | |
873 | return ERR_PTR(-ENOENT); | |
874 | ||
21d5e078 FW |
875 | if (!target->target) { |
876 | err = -EINVAL; | |
877 | goto err; | |
878 | } | |
879 | ||
2bf4fade LZ |
880 | if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) { |
881 | err = -EINVAL; | |
882 | goto err; | |
883 | } | |
f0716cd6 | 884 | |
0ca743a5 PNA |
885 | /* This is the first time we use this target, allocate operations */ |
886 | nft_target = kzalloc(sizeof(struct nft_xt), GFP_KERNEL); | |
2bf4fade LZ |
887 | if (nft_target == NULL) { |
888 | err = -ENOMEM; | |
889 | goto err; | |
890 | } | |
0ca743a5 | 891 | |
b8e9dc1c | 892 | nft_target->refcnt = 0; |
0ca743a5 | 893 | nft_target->ops.type = &nft_target_type; |
756c1b1a | 894 | nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); |
0ca743a5 PNA |
895 | nft_target->ops.init = nft_target_init; |
896 | nft_target->ops.destroy = nft_target_destroy; | |
897 | nft_target->ops.dump = nft_target_dump; | |
898 | nft_target->ops.validate = nft_target_validate; | |
899 | nft_target->ops.data = target; | |
900 | ||
5191f4d8 AB |
901 | if (family == NFPROTO_BRIDGE) |
902 | nft_target->ops.eval = nft_target_eval_bridge; | |
903 | else | |
904 | nft_target->ops.eval = nft_target_eval_xt; | |
905 | ||
0ca743a5 PNA |
906 | list_add(&nft_target->head, &nft_target_list); |
907 | ||
908 | return &nft_target->ops; | |
2bf4fade LZ |
909 | err: |
910 | module_put(target->me); | |
911 | return ERR_PTR(err); | |
0ca743a5 PNA |
912 | } |
913 | ||
0ca743a5 PNA |
914 | static struct nft_expr_type nft_target_type __read_mostly = { |
915 | .name = "target", | |
916 | .select_ops = nft_target_select_ops, | |
917 | .policy = nft_target_policy, | |
918 | .maxattr = NFTA_TARGET_MAX, | |
919 | .owner = THIS_MODULE, | |
920 | }; | |
921 | ||
922 | static int __init nft_compat_module_init(void) | |
923 | { | |
924 | int ret; | |
925 | ||
926 | ret = nft_register_expr(&nft_match_type); | |
927 | if (ret < 0) | |
928 | return ret; | |
929 | ||
930 | ret = nft_register_expr(&nft_target_type); | |
931 | if (ret < 0) | |
932 | goto err_match; | |
933 | ||
934 | ret = nfnetlink_subsys_register(&nfnl_compat_subsys); | |
935 | if (ret < 0) { | |
936 | pr_err("nft_compat: cannot register with nfnetlink.\n"); | |
937 | goto err_target; | |
938 | } | |
939 | ||
0ca743a5 PNA |
940 | return ret; |
941 | ||
942 | err_target: | |
943 | nft_unregister_expr(&nft_target_type); | |
944 | err_match: | |
945 | nft_unregister_expr(&nft_match_type); | |
946 | return ret; | |
947 | } | |
948 | ||
949 | static void __exit nft_compat_module_exit(void) | |
950 | { | |
b8e9dc1c FW |
951 | struct nft_xt *xt, *next; |
952 | ||
953 | /* list should be empty here, it can be non-empty only in case there | |
954 | * was an error that caused nft_xt expr to not be initialized fully | |
955 | * and noone else requested the same expression later. | |
956 | * | |
957 | * In this case, the lists contain 0-refcount entries that still | |
958 | * hold module reference. | |
959 | */ | |
960 | list_for_each_entry_safe(xt, next, &nft_target_list, head) { | |
961 | struct xt_target *target = xt->ops.data; | |
962 | ||
963 | if (WARN_ON_ONCE(xt->refcnt)) | |
964 | continue; | |
965 | module_put(target->me); | |
966 | kfree(xt); | |
967 | } | |
968 | ||
969 | list_for_each_entry_safe(xt, next, &nft_match_list, head) { | |
970 | struct xt_match *match = xt->ops.data; | |
971 | ||
972 | if (WARN_ON_ONCE(xt->refcnt)) | |
973 | continue; | |
974 | module_put(match->me); | |
975 | kfree(xt); | |
976 | } | |
0ca743a5 PNA |
977 | nfnetlink_subsys_unregister(&nfnl_compat_subsys); |
978 | nft_unregister_expr(&nft_target_type); | |
979 | nft_unregister_expr(&nft_match_type); | |
0ca743a5 PNA |
980 | } |
981 | ||
982 | MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); | |
983 | ||
984 | module_init(nft_compat_module_init); | |
985 | module_exit(nft_compat_module_exit); | |
986 | ||
987 | MODULE_LICENSE("GPL"); | |
988 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); | |
989 | MODULE_ALIAS_NFT_EXPR("match"); | |
990 | MODULE_ALIAS_NFT_EXPR("target"); |