Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
0ca743a5 PNA |
2 | /* |
3 | * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org> | |
4 | * | |
0ca743a5 PNA |
5 | * This software has been sponsored by Sophos Astaro <http://www.sophos.com> |
6 | */ | |
7 | ||
8 | #include <linux/kernel.h> | |
9 | #include <linux/init.h> | |
10 | #include <linux/module.h> | |
11 | #include <linux/netlink.h> | |
12 | #include <linux/netfilter.h> | |
13 | #include <linux/netfilter/nfnetlink.h> | |
14 | #include <linux/netfilter/nf_tables.h> | |
15 | #include <linux/netfilter/nf_tables_compat.h> | |
16 | #include <linux/netfilter/x_tables.h> | |
17 | #include <linux/netfilter_ipv4/ip_tables.h> | |
18 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
5191f4d8 | 19 | #include <linux/netfilter_bridge/ebtables.h> |
5f158939 | 20 | #include <linux/netfilter_arp/arp_tables.h> |
0ca743a5 | 21 | #include <net/netfilter/nf_tables.h> |
4b512e1c | 22 | |
732a8049 FW |
23 | /* Used for matches where *info is larger than X byte */ |
24 | #define NFT_MATCH_LARGE_THRESH 192 | |
25 | ||
26 | struct nft_xt_match_priv { | |
27 | void *info; | |
28 | }; | |
29 | ||
e4844c9c FW |
30 | static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, |
31 | const char *tablename) | |
f3f5dded | 32 | { |
e4844c9c FW |
33 | enum nft_chain_types type = NFT_CHAIN_T_DEFAULT; |
34 | const struct nft_chain *chain = ctx->chain; | |
f3f5dded PNA |
35 | const struct nft_base_chain *basechain; |
36 | ||
f323d954 PNA |
37 | if (!tablename || |
38 | !nft_is_base_chain(chain)) | |
f3f5dded PNA |
39 | return 0; |
40 | ||
f3f5dded | 41 | basechain = nft_base_chain(chain); |
e4844c9c FW |
42 | if (strcmp(tablename, "nat") == 0) { |
43 | if (ctx->family != NFPROTO_BRIDGE) | |
44 | type = NFT_CHAIN_T_NAT; | |
45 | if (basechain->type->type != type) | |
46 | return -EINVAL; | |
47 | } | |
f3f5dded PNA |
48 | |
49 | return 0; | |
50 | } | |
51 | ||
0ca743a5 PNA |
52 | union nft_entry { |
53 | struct ipt_entry e4; | |
54 | struct ip6t_entry e6; | |
5191f4d8 | 55 | struct ebt_entry ebt; |
5f158939 | 56 | struct arpt_entry arp; |
0ca743a5 PNA |
57 | }; |
58 | ||
59 | static inline void | |
897389de FW |
60 | nft_compat_set_par(struct xt_action_param *par, |
61 | const struct nft_pktinfo *pkt, | |
62 | const void *xt, const void *xt_info) | |
0ca743a5 | 63 | { |
897389de FW |
64 | par->state = pkt->state; |
65 | par->thoff = nft_thoff(pkt); | |
66 | par->fragoff = pkt->fragoff; | |
0ca743a5 PNA |
67 | par->target = xt; |
68 | par->targinfo = xt_info; | |
69 | par->hotdrop = false; | |
70 | } | |
71 | ||
5191f4d8 | 72 | static void nft_target_eval_xt(const struct nft_expr *expr, |
a55e22e9 | 73 | struct nft_regs *regs, |
5191f4d8 | 74 | const struct nft_pktinfo *pkt) |
0ca743a5 PNA |
75 | { |
76 | void *info = nft_expr_priv(expr); | |
77 | struct xt_target *target = expr->ops->data; | |
78 | struct sk_buff *skb = pkt->skb; | |
897389de | 79 | struct xt_action_param xt; |
0ca743a5 PNA |
80 | int ret; |
81 | ||
897389de | 82 | nft_compat_set_par(&xt, pkt, target, info); |
0ca743a5 | 83 | |
897389de | 84 | ret = target->target(skb, &xt); |
0ca743a5 | 85 | |
897389de | 86 | if (xt.hotdrop) |
0ca743a5 PNA |
87 | ret = NF_DROP; |
88 | ||
5191f4d8 | 89 | switch (ret) { |
0ca743a5 | 90 | case XT_CONTINUE: |
a55e22e9 | 91 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 PNA |
92 | break; |
93 | default: | |
a55e22e9 | 94 | regs->verdict.code = ret; |
0ca743a5 PNA |
95 | break; |
96 | } | |
5191f4d8 AB |
97 | } |
98 | ||
99 | static void nft_target_eval_bridge(const struct nft_expr *expr, | |
a55e22e9 | 100 | struct nft_regs *regs, |
5191f4d8 AB |
101 | const struct nft_pktinfo *pkt) |
102 | { | |
103 | void *info = nft_expr_priv(expr); | |
104 | struct xt_target *target = expr->ops->data; | |
105 | struct sk_buff *skb = pkt->skb; | |
897389de | 106 | struct xt_action_param xt; |
5191f4d8 AB |
107 | int ret; |
108 | ||
897389de | 109 | nft_compat_set_par(&xt, pkt, target, info); |
5191f4d8 | 110 | |
897389de | 111 | ret = target->target(skb, &xt); |
5191f4d8 | 112 | |
897389de | 113 | if (xt.hotdrop) |
5191f4d8 AB |
114 | ret = NF_DROP; |
115 | ||
116 | switch (ret) { | |
117 | case EBT_ACCEPT: | |
a55e22e9 | 118 | regs->verdict.code = NF_ACCEPT; |
5191f4d8 AB |
119 | break; |
120 | case EBT_DROP: | |
a55e22e9 | 121 | regs->verdict.code = NF_DROP; |
5191f4d8 AB |
122 | break; |
123 | case EBT_CONTINUE: | |
a55e22e9 | 124 | regs->verdict.code = NFT_CONTINUE; |
5191f4d8 AB |
125 | break; |
126 | case EBT_RETURN: | |
a55e22e9 | 127 | regs->verdict.code = NFT_RETURN; |
5191f4d8 AB |
128 | break; |
129 | default: | |
a55e22e9 | 130 | regs->verdict.code = ret; |
5191f4d8 AB |
131 | break; |
132 | } | |
0ca743a5 PNA |
133 | } |
134 | ||
135 | static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { | |
136 | [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, | |
137 | [NFTA_TARGET_REV] = { .type = NLA_U32 }, | |
138 | [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, | |
139 | }; | |
140 | ||
141 | static void | |
142 | nft_target_set_tgchk_param(struct xt_tgchk_param *par, | |
143 | const struct nft_ctx *ctx, | |
144 | struct xt_target *target, void *info, | |
2156d321 | 145 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 146 | { |
2daf1b4d | 147 | par->net = ctx->net; |
0ca743a5 | 148 | par->table = ctx->table->name; |
36596dad | 149 | switch (ctx->family) { |
0ca743a5 PNA |
150 | case AF_INET: |
151 | entry->e4.ip.proto = proto; | |
152 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
153 | break; | |
154 | case AF_INET6: | |
749177cc PNA |
155 | if (proto) |
156 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
157 | ||
0ca743a5 PNA |
158 | entry->e6.ipv6.proto = proto; |
159 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
160 | break; | |
5191f4d8 | 161 | case NFPROTO_BRIDGE: |
2156d321 | 162 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
163 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
164 | break; | |
5f158939 AB |
165 | case NFPROTO_ARP: |
166 | break; | |
0ca743a5 PNA |
167 | } |
168 | par->entryinfo = entry; | |
169 | par->target = target; | |
170 | par->targinfo = info; | |
f323d954 | 171 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
172 | const struct nft_base_chain *basechain = |
173 | nft_base_chain(ctx->chain); | |
c974a3a3 | 174 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
175 | |
176 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
177 | } else { |
178 | par->hook_mask = 0; | |
0ca743a5 | 179 | } |
36596dad | 180 | par->family = ctx->family; |
55917a21 | 181 | par->nft_compat = true; |
0ca743a5 PNA |
182 | } |
183 | ||
184 | static void target_compat_from_user(struct xt_target *t, void *in, void *out) | |
185 | { | |
756c1b1a | 186 | int pad; |
0ca743a5 | 187 | |
756c1b1a PNA |
188 | memcpy(out, in, t->targetsize); |
189 | pad = XT_ALIGN(t->targetsize) - t->targetsize; | |
190 | if (pad > 0) | |
191 | memset(out + t->targetsize, 0, pad); | |
0ca743a5 PNA |
192 | } |
193 | ||
194 | static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = { | |
195 | [NFTA_RULE_COMPAT_PROTO] = { .type = NLA_U32 }, | |
196 | [NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 }, | |
197 | }; | |
198 | ||
2156d321 | 199 | static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) |
0ca743a5 PNA |
200 | { |
201 | struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; | |
202 | u32 flags; | |
203 | int err; | |
204 | ||
8cb08174 JB |
205 | err = nla_parse_nested_deprecated(tb, NFTA_RULE_COMPAT_MAX, attr, |
206 | nft_rule_compat_policy, NULL); | |
0ca743a5 PNA |
207 | if (err < 0) |
208 | return err; | |
209 | ||
210 | if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS]) | |
211 | return -EINVAL; | |
212 | ||
213 | flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS])); | |
214 | if (flags & ~NFT_RULE_COMPAT_F_MASK) | |
215 | return -EINVAL; | |
216 | if (flags & NFT_RULE_COMPAT_F_INV) | |
217 | *inv = true; | |
218 | ||
8691a9a3 PNA |
219 | *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); |
220 | return 0; | |
0ca743a5 PNA |
221 | } |
222 | ||
2f941622 FW |
223 | static void nft_compat_wait_for_destructors(void) |
224 | { | |
225 | /* xtables matches or targets can have side effects, e.g. | |
226 | * creation/destruction of /proc files. | |
227 | * The xt ->destroy functions are run asynchronously from | |
228 | * work queue. If we have pending invocations we thus | |
229 | * need to wait for those to finish. | |
230 | */ | |
231 | nf_tables_trans_destroy_flush_work(); | |
232 | } | |
233 | ||
0ca743a5 PNA |
234 | static int |
235 | nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
236 | const struct nlattr * const tb[]) | |
237 | { | |
238 | void *info = nft_expr_priv(expr); | |
239 | struct xt_target *target = expr->ops->data; | |
240 | struct xt_tgchk_param par; | |
241 | size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); | |
2156d321 | 242 | u16 proto = 0; |
0ca743a5 PNA |
243 | bool inv = false; |
244 | union nft_entry e = {}; | |
245 | int ret; | |
246 | ||
247 | target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info); | |
248 | ||
8691a9a3 PNA |
249 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
250 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
251 | if (ret < 0) | |
b8e9dc1c | 252 | return ret; |
8691a9a3 | 253 | } |
0ca743a5 PNA |
254 | |
255 | nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); | |
256 | ||
2f941622 | 257 | nft_compat_wait_for_destructors(); |
ffe8923f | 258 | |
0ca743a5 PNA |
259 | ret = xt_check_target(&par, size, proto, inv); |
260 | if (ret < 0) | |
b8e9dc1c | 261 | return ret; |
0ca743a5 PNA |
262 | |
263 | /* The standard target cannot be used */ | |
b8e9dc1c FW |
264 | if (!target->target) |
265 | return -EINVAL; | |
0ca743a5 PNA |
266 | |
267 | return 0; | |
0ca743a5 PNA |
268 | } |
269 | ||
ffe8923f FW |
270 | static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr) |
271 | { | |
ffe8923f FW |
272 | module_put(me); |
273 | kfree(expr->ops); | |
274 | } | |
275 | ||
0ca743a5 | 276 | static void |
62472bce | 277 | nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
0ca743a5 PNA |
278 | { |
279 | struct xt_target *target = expr->ops->data; | |
3d9b1421 | 280 | void *info = nft_expr_priv(expr); |
753c111f | 281 | struct module *me = target->me; |
3d9b1421 PNA |
282 | struct xt_tgdtor_param par; |
283 | ||
284 | par.net = ctx->net; | |
285 | par.target = target; | |
286 | par.targinfo = info; | |
36596dad | 287 | par.family = ctx->family; |
3d9b1421 PNA |
288 | if (par.target->destroy != NULL) |
289 | par.target->destroy(&par); | |
0ca743a5 | 290 | |
ffe8923f | 291 | __nft_mt_tg_destroy(me, expr); |
0ca743a5 PNA |
292 | } |
293 | ||
d701d811 PNA |
294 | static int nft_extension_dump_info(struct sk_buff *skb, int attr, |
295 | const void *info, | |
296 | unsigned int size, unsigned int user_size) | |
297 | { | |
298 | unsigned int info_size, aligned_size = XT_ALIGN(size); | |
299 | struct nlattr *nla; | |
300 | ||
301 | nla = nla_reserve(skb, attr, aligned_size); | |
302 | if (!nla) | |
303 | return -1; | |
304 | ||
305 | info_size = user_size ? : size; | |
306 | memcpy(nla_data(nla), info, info_size); | |
307 | memset(nla_data(nla) + info_size, 0, aligned_size - info_size); | |
308 | ||
309 | return 0; | |
310 | } | |
311 | ||
0ca743a5 PNA |
312 | static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr) |
313 | { | |
314 | const struct xt_target *target = expr->ops->data; | |
315 | void *info = nft_expr_priv(expr); | |
316 | ||
317 | if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) || | |
318 | nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) || | |
d701d811 PNA |
319 | nft_extension_dump_info(skb, NFTA_TARGET_INFO, info, |
320 | target->targetsize, target->usersize)) | |
0ca743a5 PNA |
321 | goto nla_put_failure; |
322 | ||
323 | return 0; | |
324 | ||
325 | nla_put_failure: | |
326 | return -1; | |
327 | } | |
328 | ||
329 | static int nft_target_validate(const struct nft_ctx *ctx, | |
330 | const struct nft_expr *expr, | |
331 | const struct nft_data **data) | |
332 | { | |
333 | struct xt_target *target = expr->ops->data; | |
334 | unsigned int hook_mask = 0; | |
f3f5dded | 335 | int ret; |
0ca743a5 | 336 | |
f323d954 | 337 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
338 | const struct nft_base_chain *basechain = |
339 | nft_base_chain(ctx->chain); | |
c974a3a3 | 340 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
341 | |
342 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 343 | if (target->hooks && !(hook_mask & target->hooks)) |
f3f5dded | 344 | return -EINVAL; |
0ca743a5 | 345 | |
e4844c9c | 346 | ret = nft_compat_chain_validate_dependency(ctx, target->table); |
f3f5dded PNA |
347 | if (ret < 0) |
348 | return ret; | |
0ca743a5 PNA |
349 | } |
350 | return 0; | |
351 | } | |
352 | ||
8bdf1647 FW |
353 | static void __nft_match_eval(const struct nft_expr *expr, |
354 | struct nft_regs *regs, | |
355 | const struct nft_pktinfo *pkt, | |
356 | void *info) | |
0ca743a5 | 357 | { |
0ca743a5 PNA |
358 | struct xt_match *match = expr->ops->data; |
359 | struct sk_buff *skb = pkt->skb; | |
897389de | 360 | struct xt_action_param xt; |
0ca743a5 PNA |
361 | bool ret; |
362 | ||
897389de | 363 | nft_compat_set_par(&xt, pkt, match, info); |
0ca743a5 | 364 | |
897389de | 365 | ret = match->match(skb, &xt); |
0ca743a5 | 366 | |
897389de | 367 | if (xt.hotdrop) { |
a55e22e9 | 368 | regs->verdict.code = NF_DROP; |
0ca743a5 PNA |
369 | return; |
370 | } | |
371 | ||
c1f86676 DM |
372 | switch (ret ? 1 : 0) { |
373 | case 1: | |
a55e22e9 | 374 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 | 375 | break; |
c1f86676 | 376 | case 0: |
a55e22e9 | 377 | regs->verdict.code = NFT_BREAK; |
0ca743a5 PNA |
378 | break; |
379 | } | |
380 | } | |
381 | ||
732a8049 FW |
382 | static void nft_match_large_eval(const struct nft_expr *expr, |
383 | struct nft_regs *regs, | |
384 | const struct nft_pktinfo *pkt) | |
385 | { | |
386 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
387 | ||
388 | __nft_match_eval(expr, regs, pkt, priv->info); | |
389 | } | |
390 | ||
8bdf1647 FW |
391 | static void nft_match_eval(const struct nft_expr *expr, |
392 | struct nft_regs *regs, | |
393 | const struct nft_pktinfo *pkt) | |
394 | { | |
395 | __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr)); | |
396 | } | |
397 | ||
0ca743a5 PNA |
398 | static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { |
399 | [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, | |
400 | [NFTA_MATCH_REV] = { .type = NLA_U32 }, | |
401 | [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, | |
402 | }; | |
403 | ||
404 | /* struct xt_mtchk_param and xt_tgchk_param look very similar */ | |
405 | static void | |
406 | nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, | |
407 | struct xt_match *match, void *info, | |
2156d321 | 408 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 409 | { |
2daf1b4d | 410 | par->net = ctx->net; |
0ca743a5 | 411 | par->table = ctx->table->name; |
36596dad | 412 | switch (ctx->family) { |
0ca743a5 PNA |
413 | case AF_INET: |
414 | entry->e4.ip.proto = proto; | |
415 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
416 | break; | |
417 | case AF_INET6: | |
749177cc PNA |
418 | if (proto) |
419 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
420 | ||
0ca743a5 PNA |
421 | entry->e6.ipv6.proto = proto; |
422 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
423 | break; | |
5191f4d8 | 424 | case NFPROTO_BRIDGE: |
2156d321 | 425 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
426 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
427 | break; | |
5f158939 AB |
428 | case NFPROTO_ARP: |
429 | break; | |
0ca743a5 PNA |
430 | } |
431 | par->entryinfo = entry; | |
432 | par->match = match; | |
433 | par->matchinfo = info; | |
f323d954 | 434 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
435 | const struct nft_base_chain *basechain = |
436 | nft_base_chain(ctx->chain); | |
c974a3a3 | 437 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
438 | |
439 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
440 | } else { |
441 | par->hook_mask = 0; | |
0ca743a5 | 442 | } |
36596dad | 443 | par->family = ctx->family; |
55917a21 | 444 | par->nft_compat = true; |
0ca743a5 PNA |
445 | } |
446 | ||
447 | static void match_compat_from_user(struct xt_match *m, void *in, void *out) | |
448 | { | |
756c1b1a PNA |
449 | int pad; |
450 | ||
451 | memcpy(out, in, m->matchsize); | |
452 | pad = XT_ALIGN(m->matchsize) - m->matchsize; | |
453 | if (pad > 0) | |
454 | memset(out + m->matchsize, 0, pad); | |
0ca743a5 PNA |
455 | } |
456 | ||
457 | static int | |
8bdf1647 FW |
458 | __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
459 | const struct nlattr * const tb[], | |
460 | void *info) | |
0ca743a5 | 461 | { |
0ca743a5 PNA |
462 | struct xt_match *match = expr->ops->data; |
463 | struct xt_mtchk_param par; | |
464 | size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); | |
2156d321 | 465 | u16 proto = 0; |
0ca743a5 PNA |
466 | bool inv = false; |
467 | union nft_entry e = {}; | |
468 | int ret; | |
469 | ||
470 | match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info); | |
471 | ||
8691a9a3 PNA |
472 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
473 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
474 | if (ret < 0) | |
b8e9dc1c | 475 | return ret; |
8691a9a3 | 476 | } |
0ca743a5 PNA |
477 | |
478 | nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); | |
479 | ||
2f941622 FW |
480 | nft_compat_wait_for_destructors(); |
481 | ||
b8e20400 | 482 | return xt_check_match(&par, size, proto, inv); |
0ca743a5 PNA |
483 | } |
484 | ||
8bdf1647 FW |
485 | static int |
486 | nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
487 | const struct nlattr * const tb[]) | |
488 | { | |
489 | return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr)); | |
490 | } | |
491 | ||
732a8049 FW |
492 | static int |
493 | nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
494 | const struct nlattr * const tb[]) | |
495 | { | |
496 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
497 | struct xt_match *m = expr->ops->data; | |
498 | int ret; | |
499 | ||
500 | priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); | |
501 | if (!priv->info) | |
502 | return -ENOMEM; | |
503 | ||
504 | ret = __nft_match_init(ctx, expr, tb, priv->info); | |
505 | if (ret) | |
506 | kfree(priv->info); | |
507 | return ret; | |
508 | } | |
509 | ||
0ca743a5 | 510 | static void |
8bdf1647 FW |
511 | __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, |
512 | void *info) | |
0ca743a5 PNA |
513 | { |
514 | struct xt_match *match = expr->ops->data; | |
29e38801 | 515 | struct module *me = match->me; |
3d9b1421 PNA |
516 | struct xt_mtdtor_param par; |
517 | ||
518 | par.net = ctx->net; | |
519 | par.match = match; | |
520 | par.matchinfo = info; | |
36596dad | 521 | par.family = ctx->family; |
3d9b1421 PNA |
522 | if (par.match->destroy != NULL) |
523 | par.match->destroy(&par); | |
0ca743a5 | 524 | |
ffe8923f | 525 | __nft_mt_tg_destroy(me, expr); |
0ca743a5 PNA |
526 | } |
527 | ||
8bdf1647 FW |
528 | static void |
529 | nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
530 | { | |
531 | __nft_match_destroy(ctx, expr, nft_expr_priv(expr)); | |
532 | } | |
533 | ||
732a8049 FW |
534 | static void |
535 | nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
536 | { | |
537 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
538 | ||
539 | __nft_match_destroy(ctx, expr, priv->info); | |
540 | kfree(priv->info); | |
541 | } | |
542 | ||
8bdf1647 FW |
543 | static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, |
544 | void *info) | |
0ca743a5 | 545 | { |
0ca743a5 PNA |
546 | struct xt_match *match = expr->ops->data; |
547 | ||
548 | if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) || | |
549 | nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) || | |
d701d811 PNA |
550 | nft_extension_dump_info(skb, NFTA_MATCH_INFO, info, |
551 | match->matchsize, match->usersize)) | |
0ca743a5 PNA |
552 | goto nla_put_failure; |
553 | ||
554 | return 0; | |
555 | ||
556 | nla_put_failure: | |
557 | return -1; | |
558 | } | |
559 | ||
8bdf1647 FW |
560 | static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr) |
561 | { | |
562 | return __nft_match_dump(skb, expr, nft_expr_priv(expr)); | |
563 | } | |
564 | ||
732a8049 FW |
565 | static int nft_match_large_dump(struct sk_buff *skb, const struct nft_expr *e) |
566 | { | |
567 | struct nft_xt_match_priv *priv = nft_expr_priv(e); | |
568 | ||
569 | return __nft_match_dump(skb, e, priv->info); | |
570 | } | |
571 | ||
0ca743a5 PNA |
572 | static int nft_match_validate(const struct nft_ctx *ctx, |
573 | const struct nft_expr *expr, | |
574 | const struct nft_data **data) | |
575 | { | |
576 | struct xt_match *match = expr->ops->data; | |
577 | unsigned int hook_mask = 0; | |
f3f5dded | 578 | int ret; |
0ca743a5 | 579 | |
f323d954 | 580 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
581 | const struct nft_base_chain *basechain = |
582 | nft_base_chain(ctx->chain); | |
c974a3a3 | 583 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
584 | |
585 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 586 | if (match->hooks && !(hook_mask & match->hooks)) |
f3f5dded | 587 | return -EINVAL; |
0ca743a5 | 588 | |
e4844c9c | 589 | ret = nft_compat_chain_validate_dependency(ctx, match->table); |
f3f5dded PNA |
590 | if (ret < 0) |
591 | return ret; | |
0ca743a5 PNA |
592 | } |
593 | return 0; | |
594 | } | |
595 | ||
596 | static int | |
597 | nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, | |
598 | int event, u16 family, const char *name, | |
599 | int rev, int target) | |
600 | { | |
601 | struct nlmsghdr *nlh; | |
0ca743a5 PNA |
602 | unsigned int flags = portid ? NLM_F_MULTI : 0; |
603 | ||
dedb67c4 | 604 | event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event); |
19c28b13 PNA |
605 | nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, |
606 | NFNETLINK_V0, 0); | |
607 | if (!nlh) | |
0ca743a5 PNA |
608 | goto nlmsg_failure; |
609 | ||
0ca743a5 PNA |
610 | if (nla_put_string(skb, NFTA_COMPAT_NAME, name) || |
611 | nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) || | |
612 | nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target))) | |
613 | goto nla_put_failure; | |
614 | ||
615 | nlmsg_end(skb, nlh); | |
616 | return skb->len; | |
617 | ||
618 | nlmsg_failure: | |
619 | nla_put_failure: | |
620 | nlmsg_cancel(skb, nlh); | |
621 | return -1; | |
622 | } | |
623 | ||
797d4980 PNA |
624 | static int nfnl_compat_get_rcu(struct sk_buff *skb, |
625 | const struct nfnl_info *info, | |
626 | const struct nlattr * const tb[]) | |
0ca743a5 | 627 | { |
ef4b65e5 | 628 | u8 family = info->nfmsg->nfgen_family; |
797d4980 | 629 | const char *name, *fmt; |
0ca743a5 | 630 | struct sk_buff *skb2; |
797d4980 PNA |
631 | int ret = 0, target; |
632 | u32 rev; | |
0ca743a5 PNA |
633 | |
634 | if (tb[NFTA_COMPAT_NAME] == NULL || | |
635 | tb[NFTA_COMPAT_REV] == NULL || | |
636 | tb[NFTA_COMPAT_TYPE] == NULL) | |
637 | return -EINVAL; | |
638 | ||
639 | name = nla_data(tb[NFTA_COMPAT_NAME]); | |
640 | rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV])); | |
641 | target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE])); | |
642 | ||
ef4b65e5 | 643 | switch(family) { |
0ca743a5 PNA |
644 | case AF_INET: |
645 | fmt = "ipt_%s"; | |
646 | break; | |
647 | case AF_INET6: | |
648 | fmt = "ip6t_%s"; | |
649 | break; | |
5191f4d8 AB |
650 | case NFPROTO_BRIDGE: |
651 | fmt = "ebt_%s"; | |
652 | break; | |
5f158939 AB |
653 | case NFPROTO_ARP: |
654 | fmt = "arpt_%s"; | |
655 | break; | |
0ca743a5 | 656 | default: |
ef4b65e5 | 657 | pr_err("nft_compat: unsupported protocol %d\n", family); |
0ca743a5 PNA |
658 | return -EINVAL; |
659 | } | |
660 | ||
eb1fb147 FW |
661 | if (!try_module_get(THIS_MODULE)) |
662 | return -EINVAL; | |
663 | ||
664 | rcu_read_unlock(); | |
ef4b65e5 PNA |
665 | try_then_request_module(xt_find_revision(family, name, rev, target, &ret), |
666 | fmt, name); | |
0ca743a5 | 667 | if (ret < 0) |
eb1fb147 | 668 | goto out_put; |
0ca743a5 PNA |
669 | |
670 | skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); | |
eb1fb147 FW |
671 | if (skb2 == NULL) { |
672 | ret = -ENOMEM; | |
673 | goto out_put; | |
674 | } | |
0ca743a5 PNA |
675 | |
676 | /* include the best revision for this extension in the message */ | |
677 | if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid, | |
797d4980 PNA |
678 | info->nlh->nlmsg_seq, |
679 | NFNL_MSG_TYPE(info->nlh->nlmsg_type), | |
0ca743a5 | 680 | NFNL_MSG_COMPAT_GET, |
ef4b65e5 | 681 | family, name, ret, target) <= 0) { |
0ca743a5 | 682 | kfree_skb(skb2); |
eb1fb147 | 683 | goto out_put; |
0ca743a5 PNA |
684 | } |
685 | ||
797d4980 PNA |
686 | ret = netlink_unicast(info->sk, skb2, NETLINK_CB(skb).portid, |
687 | MSG_DONTWAIT); | |
0ca743a5 PNA |
688 | if (ret > 0) |
689 | ret = 0; | |
eb1fb147 FW |
690 | out_put: |
691 | rcu_read_lock(); | |
692 | module_put(THIS_MODULE); | |
0ca743a5 PNA |
693 | return ret == -EAGAIN ? -ENOBUFS : ret; |
694 | } | |
695 | ||
696 | static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = { | |
697 | [NFTA_COMPAT_NAME] = { .type = NLA_NUL_STRING, | |
698 | .len = NFT_COMPAT_NAME_MAX-1 }, | |
699 | [NFTA_COMPAT_REV] = { .type = NLA_U32 }, | |
700 | [NFTA_COMPAT_TYPE] = { .type = NLA_U32 }, | |
701 | }; | |
702 | ||
703 | static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = { | |
50f2db9e PNA |
704 | [NFNL_MSG_COMPAT_GET] = { |
705 | .call = nfnl_compat_get_rcu, | |
706 | .type = NFNL_CB_RCU, | |
707 | .attr_count = NFTA_COMPAT_MAX, | |
708 | .policy = nfnl_compat_policy_get | |
709 | }, | |
0ca743a5 PNA |
710 | }; |
711 | ||
712 | static const struct nfnetlink_subsystem nfnl_compat_subsys = { | |
713 | .name = "nft-compat", | |
714 | .subsys_id = NFNL_SUBSYS_NFT_COMPAT, | |
715 | .cb_count = NFNL_MSG_COMPAT_MAX, | |
716 | .cb = nfnl_nft_compat_cb, | |
717 | }; | |
718 | ||
b8e20400 | 719 | static struct nft_expr_type nft_match_type; |
ba378ca9 | 720 | |
0ca743a5 PNA |
721 | static const struct nft_expr_ops * |
722 | nft_match_select_ops(const struct nft_ctx *ctx, | |
723 | const struct nlattr * const tb[]) | |
724 | { | |
b8e20400 | 725 | struct nft_expr_ops *ops; |
0ca743a5 | 726 | struct xt_match *match; |
732a8049 | 727 | unsigned int matchsize; |
0ca743a5 | 728 | char *mt_name; |
ba378ca9 | 729 | u32 rev, family; |
2bf4fade | 730 | int err; |
0ca743a5 PNA |
731 | |
732 | if (tb[NFTA_MATCH_NAME] == NULL || | |
733 | tb[NFTA_MATCH_REV] == NULL || | |
734 | tb[NFTA_MATCH_INFO] == NULL) | |
735 | return ERR_PTR(-EINVAL); | |
736 | ||
737 | mt_name = nla_data(tb[NFTA_MATCH_NAME]); | |
738 | rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); | |
36596dad | 739 | family = ctx->family; |
0ca743a5 | 740 | |
0ca743a5 PNA |
741 | match = xt_request_find_match(family, mt_name, rev); |
742 | if (IS_ERR(match)) | |
743 | return ERR_PTR(-ENOENT); | |
744 | ||
2bf4fade LZ |
745 | if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) { |
746 | err = -EINVAL; | |
747 | goto err; | |
748 | } | |
f0716cd6 | 749 | |
b8e20400 PNA |
750 | ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); |
751 | if (!ops) { | |
2bf4fade LZ |
752 | err = -ENOMEM; |
753 | goto err; | |
754 | } | |
0ca743a5 | 755 | |
b8e20400 PNA |
756 | ops->type = &nft_match_type; |
757 | ops->eval = nft_match_eval; | |
758 | ops->init = nft_match_init; | |
759 | ops->destroy = nft_match_destroy; | |
760 | ops->dump = nft_match_dump; | |
761 | ops->validate = nft_match_validate; | |
762 | ops->data = match; | |
0ca743a5 | 763 | |
732a8049 FW |
764 | matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); |
765 | if (matchsize > NFT_MATCH_LARGE_THRESH) { | |
766 | matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); | |
767 | ||
b8e20400 PNA |
768 | ops->eval = nft_match_large_eval; |
769 | ops->init = nft_match_large_init; | |
770 | ops->destroy = nft_match_large_destroy; | |
771 | ops->dump = nft_match_large_dump; | |
732a8049 FW |
772 | } |
773 | ||
b8e20400 | 774 | ops->size = matchsize; |
732a8049 | 775 | |
b8e20400 | 776 | return ops; |
2bf4fade LZ |
777 | err: |
778 | module_put(match->me); | |
779 | return ERR_PTR(err); | |
0ca743a5 PNA |
780 | } |
781 | ||
b8e20400 PNA |
782 | static void nft_match_release_ops(const struct nft_expr_ops *ops) |
783 | { | |
784 | struct xt_match *match = ops->data; | |
785 | ||
786 | module_put(match->me); | |
787 | kfree(ops); | |
788 | } | |
789 | ||
0ca743a5 PNA |
790 | static struct nft_expr_type nft_match_type __read_mostly = { |
791 | .name = "match", | |
792 | .select_ops = nft_match_select_ops, | |
b8e20400 | 793 | .release_ops = nft_match_release_ops, |
0ca743a5 PNA |
794 | .policy = nft_match_policy, |
795 | .maxattr = NFTA_MATCH_MAX, | |
796 | .owner = THIS_MODULE, | |
797 | }; | |
798 | ||
b8e20400 | 799 | static struct nft_expr_type nft_target_type; |
ba378ca9 | 800 | |
0ca743a5 PNA |
801 | static const struct nft_expr_ops * |
802 | nft_target_select_ops(const struct nft_ctx *ctx, | |
803 | const struct nlattr * const tb[]) | |
804 | { | |
b8e20400 | 805 | struct nft_expr_ops *ops; |
0ca743a5 PNA |
806 | struct xt_target *target; |
807 | char *tg_name; | |
ba378ca9 | 808 | u32 rev, family; |
2bf4fade | 809 | int err; |
0ca743a5 PNA |
810 | |
811 | if (tb[NFTA_TARGET_NAME] == NULL || | |
812 | tb[NFTA_TARGET_REV] == NULL || | |
813 | tb[NFTA_TARGET_INFO] == NULL) | |
814 | return ERR_PTR(-EINVAL); | |
815 | ||
816 | tg_name = nla_data(tb[NFTA_TARGET_NAME]); | |
817 | rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); | |
36596dad | 818 | family = ctx->family; |
0ca743a5 | 819 | |
21d5e078 FW |
820 | if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || |
821 | strcmp(tg_name, XT_STANDARD_TARGET) == 0 || | |
822 | strcmp(tg_name, "standard") == 0) | |
823 | return ERR_PTR(-EINVAL); | |
824 | ||
0ca743a5 PNA |
825 | target = xt_request_find_target(family, tg_name, rev); |
826 | if (IS_ERR(target)) | |
827 | return ERR_PTR(-ENOENT); | |
828 | ||
21d5e078 FW |
829 | if (!target->target) { |
830 | err = -EINVAL; | |
831 | goto err; | |
832 | } | |
833 | ||
2bf4fade LZ |
834 | if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) { |
835 | err = -EINVAL; | |
836 | goto err; | |
837 | } | |
f0716cd6 | 838 | |
b8e20400 PNA |
839 | ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); |
840 | if (!ops) { | |
2bf4fade LZ |
841 | err = -ENOMEM; |
842 | goto err; | |
843 | } | |
0ca743a5 | 844 | |
b8e20400 PNA |
845 | ops->type = &nft_target_type; |
846 | ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); | |
847 | ops->init = nft_target_init; | |
848 | ops->destroy = nft_target_destroy; | |
849 | ops->dump = nft_target_dump; | |
850 | ops->validate = nft_target_validate; | |
851 | ops->data = target; | |
0ca743a5 | 852 | |
5191f4d8 | 853 | if (family == NFPROTO_BRIDGE) |
b8e20400 | 854 | ops->eval = nft_target_eval_bridge; |
5191f4d8 | 855 | else |
b8e20400 | 856 | ops->eval = nft_target_eval_xt; |
0ca743a5 | 857 | |
b8e20400 | 858 | return ops; |
2bf4fade LZ |
859 | err: |
860 | module_put(target->me); | |
861 | return ERR_PTR(err); | |
0ca743a5 PNA |
862 | } |
863 | ||
b8e20400 PNA |
864 | static void nft_target_release_ops(const struct nft_expr_ops *ops) |
865 | { | |
866 | struct xt_target *target = ops->data; | |
867 | ||
868 | module_put(target->me); | |
869 | kfree(ops); | |
870 | } | |
871 | ||
0ca743a5 PNA |
872 | static struct nft_expr_type nft_target_type __read_mostly = { |
873 | .name = "target", | |
874 | .select_ops = nft_target_select_ops, | |
b8e20400 | 875 | .release_ops = nft_target_release_ops, |
0ca743a5 PNA |
876 | .policy = nft_target_policy, |
877 | .maxattr = NFTA_TARGET_MAX, | |
878 | .owner = THIS_MODULE, | |
879 | }; | |
880 | ||
881 | static int __init nft_compat_module_init(void) | |
882 | { | |
883 | int ret; | |
884 | ||
885 | ret = nft_register_expr(&nft_match_type); | |
886 | if (ret < 0) | |
b8e20400 | 887 | return ret; |
0ca743a5 PNA |
888 | |
889 | ret = nft_register_expr(&nft_target_type); | |
890 | if (ret < 0) | |
891 | goto err_match; | |
892 | ||
893 | ret = nfnetlink_subsys_register(&nfnl_compat_subsys); | |
894 | if (ret < 0) { | |
895 | pr_err("nft_compat: cannot register with nfnetlink.\n"); | |
896 | goto err_target; | |
897 | } | |
898 | ||
0ca743a5 | 899 | return ret; |
0ca743a5 PNA |
900 | err_target: |
901 | nft_unregister_expr(&nft_target_type); | |
902 | err_match: | |
903 | nft_unregister_expr(&nft_match_type); | |
904 | return ret; | |
905 | } | |
906 | ||
907 | static void __exit nft_compat_module_exit(void) | |
908 | { | |
909 | nfnetlink_subsys_unregister(&nfnl_compat_subsys); | |
910 | nft_unregister_expr(&nft_target_type); | |
911 | nft_unregister_expr(&nft_match_type); | |
0ca743a5 PNA |
912 | } |
913 | ||
914 | MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); | |
915 | ||
916 | module_init(nft_compat_module_init); | |
917 | module_exit(nft_compat_module_exit); | |
918 | ||
919 | MODULE_LICENSE("GPL"); | |
920 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); | |
921 | MODULE_ALIAS_NFT_EXPR("match"); | |
922 | MODULE_ALIAS_NFT_EXPR("target"); | |
4cacc395 | 923 | MODULE_DESCRIPTION("x_tables over nftables support"); |