netfilter: nf_tables: add userdata attributes to nft_table

Enables storing userdata for nft_table. Field udata points to user data
and udlen store its length.

Adds new attribute flag NFTA_TABLE_USERDATA

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index bf9491b77d1689092ba02213f9a524fa10cb5ef5..97a7e147a59a90733c670f25f262edb8d4101d60 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1080,6 +1080,8 @@ struct nft_table {
                                        flags:8,
                                        genmask:2;
        char                            *name;
+       u16                             udlen;
+       u8                              *udata;
 };
 
 void nft_register_chain_type(const struct nft_chain_type *);

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 42f351c1f5c5333c43a4abde25cb8c43ba277a5f..aeb88cbd303eab6f020561331466ee039c889136 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -172,6 +172,7 @@ enum nft_table_flags {
  * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
  * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
  * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
+ * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
  */
 enum nft_table_attributes {
        NFTA_TABLE_UNSPEC,
@@ -180,6 +181,7 @@ enum nft_table_attributes {
        NFTA_TABLE_USE,
        NFTA_TABLE_HANDLE,
        NFTA_TABLE_PAD,
+       NFTA_TABLE_USERDATA,
        __NFTA_TABLE_MAX
 };
 #define NFTA_TABLE_MAX         (__NFTA_TABLE_MAX - 1)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index fd814e514f942d1e0edc46a4da9217c7692a29e1..6ccce2a2e715da3a4f3b2a63266d58900100d03d 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -650,6 +650,8 @@ static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
                                    .len = NFT_TABLE_MAXNAMELEN - 1 },
        [NFTA_TABLE_FLAGS]      = { .type = NLA_U32 },
        [NFTA_TABLE_HANDLE]     = { .type = NLA_U64 },
+       [NFTA_TABLE_USERDATA]   = { .type = NLA_BINARY,
+                                   .len = NFT_USERDATA_MAXLEN }
 };
 
 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
@@ -676,6 +678,11 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
                         NFTA_TABLE_PAD))
                goto nla_put_failure;
 
+       if (table->udata) {
+               if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata))
+                       goto nla_put_failure;
+       }
+
        nlmsg_end(skb, nlh);
        return 0;
 
@@ -977,8 +984,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
        int family = nfmsg->nfgen_family;
        const struct nlattr *attr;
        struct nft_table *table;
-       u32 flags = 0;
        struct nft_ctx ctx;
+       u32 flags = 0;
+       u16 udlen = 0;
        int err;
 
        lockdep_assert_held(&net->nft.commit_mutex);
@@ -1014,6 +1022,16 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
        if (table->name == NULL)
                goto err_strdup;
 
+       if (nla[NFTA_TABLE_USERDATA]) {
+               udlen = nla_len(nla[NFTA_TABLE_USERDATA]);
+               table->udata = kzalloc(udlen, GFP_KERNEL);
+               if (table->udata == NULL)
+                       goto err_table_udata;
+
+               nla_memcpy(table->udata, nla[NFTA_TABLE_USERDATA], udlen);
+               table->udlen = udlen;
+       }
+
        err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
        if (err)
                goto err_chain_ht;
@@ -1036,6 +1054,8 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 err_trans:
        rhltable_destroy(&table->chains_ht);
 err_chain_ht:
+       kfree(table->udata);
+err_table_udata:
        kfree(table->name);
 err_strdup:
        kfree(table);