1 /* 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * Development of this code funded by Astaro AG (http://www.astaro.com/) 9 */ 10 11 #include <linux/module.h> 12 #include <linux/init.h> 13 #include <linux/list.h> 14 #include <linux/skbuff.h> 15 #include <linux/netlink.h> 16 #include <linux/vmalloc.h> 17 #include <linux/netfilter.h> 18 #include <linux/netfilter/nfnetlink.h> 19 #include <linux/netfilter/nf_tables.h> 20 #include <net/netfilter/nf_flow_table.h> 21 #include <net/netfilter/nf_tables_core.h> 22 #include <net/netfilter/nf_tables.h> 23 #include <net/net_namespace.h> 24 #include <net/sock.h> 25 26 static LIST_HEAD(nf_tables_expressions); 27 static LIST_HEAD(nf_tables_objects); 28 static LIST_HEAD(nf_tables_flowtables); 29 static u64 table_handle; 30 31 static void nft_ctx_init(struct nft_ctx *ctx, 32 struct net *net, 33 const struct sk_buff *skb, 34 const struct nlmsghdr *nlh, 35 u8 family, 36 struct nft_table *table, 37 struct nft_chain *chain, 38 const struct nlattr * const *nla) 39 { 40 ctx->net = net; 41 ctx->family = family; 42 ctx->table = table; 43 ctx->chain = chain; 44 ctx->nla = nla; 45 ctx->portid = NETLINK_CB(skb).portid; 46 ctx->report = nlmsg_report(nlh); 47 ctx->seq = nlh->nlmsg_seq; 48 } 49 50 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, 51 int msg_type, u32 size, gfp_t gfp) 52 { 53 struct nft_trans *trans; 54 55 trans = kzalloc(sizeof(struct nft_trans) + size, gfp); 56 if (trans == NULL) 57 return NULL; 58 59 trans->msg_type = msg_type; 60 trans->ctx = *ctx; 61 62 return trans; 63 } 64 65 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, 66 int msg_type, u32 size) 67 { 68 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL); 69 } 70 71 static void nft_trans_destroy(struct nft_trans *trans) 72 { 73 list_del(&trans->list); 74 kfree(trans); 75 } 76 77 /* removal requests are queued in the commit_list, but not acted upon 78 * until after all new rules are in place. 79 * 80 * Therefore, nf_register_net_hook(net, &nat_hook) runs before pending 81 * nf_unregister_net_hook(). 82 * 83 * nf_register_net_hook thus fails if a nat hook is already in place 84 * even if the conflicting hook is about to be removed. 85 * 86 * If collision is detected, search commit_log for DELCHAIN matching 87 * the new nat hooknum; if we find one collision is temporary: 88 * 89 * Either transaction is aborted (new/colliding hook is removed), or 90 * transaction is committed (old hook is removed). 91 */ 92 static bool nf_tables_allow_nat_conflict(const struct net *net, 93 const struct nf_hook_ops *ops) 94 { 95 const struct nft_trans *trans; 96 bool ret = false; 97 98 if (!ops->nat_hook) 99 return false; 100 101 list_for_each_entry(trans, &net->nft.commit_list, list) { 102 const struct nf_hook_ops *pending_ops; 103 const struct nft_chain *pending; 104 105 if (trans->msg_type != NFT_MSG_NEWCHAIN && 106 trans->msg_type != NFT_MSG_DELCHAIN) 107 continue; 108 109 pending = trans->ctx.chain; 110 if (!nft_is_base_chain(pending)) 111 continue; 112 113 pending_ops = &nft_base_chain(pending)->ops; 114 if (pending_ops->nat_hook && 115 pending_ops->pf == ops->pf && 116 pending_ops->hooknum == ops->hooknum) { 117 /* other hook registration already pending? */ 118 if (trans->msg_type == NFT_MSG_NEWCHAIN) 119 return false; 120 121 ret = true; 122 } 123 } 124 125 return ret; 126 } 127 128 static int nf_tables_register_hook(struct net *net, 129 const struct nft_table *table, 130 struct nft_chain *chain) 131 { 132 struct nf_hook_ops *ops; 133 int ret; 134 135 if (table->flags & NFT_TABLE_F_DORMANT || 136 !nft_is_base_chain(chain)) 137 return 0; 138 139 ops = &nft_base_chain(chain)->ops; 140 ret = nf_register_net_hook(net, ops); 141 if (ret == -EBUSY && nf_tables_allow_nat_conflict(net, ops)) { 142 ops->nat_hook = false; 143 ret = nf_register_net_hook(net, ops); 144 ops->nat_hook = true; 145 } 146 147 return ret; 148 } 149 150 static void nf_tables_unregister_hook(struct net *net, 151 const struct nft_table *table, 152 struct nft_chain *chain) 153 { 154 if (table->flags & NFT_TABLE_F_DORMANT || 155 !nft_is_base_chain(chain)) 156 return; 157 158 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops); 159 } 160 161 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 162 { 163 struct nft_trans *trans; 164 165 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 166 if (trans == NULL) 167 return -ENOMEM; 168 169 if (msg_type == NFT_MSG_NEWTABLE) 170 nft_activate_next(ctx->net, ctx->table); 171 172 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 173 return 0; 174 } 175 176 static int nft_deltable(struct nft_ctx *ctx) 177 { 178 int err; 179 180 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 181 if (err < 0) 182 return err; 183 184 nft_deactivate_next(ctx->net, ctx->table); 185 return err; 186 } 187 188 static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 189 { 190 struct nft_trans *trans; 191 192 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 193 if (trans == NULL) 194 return -ENOMEM; 195 196 if (msg_type == NFT_MSG_NEWCHAIN) 197 nft_activate_next(ctx->net, ctx->chain); 198 199 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 200 return 0; 201 } 202 203 static int nft_delchain(struct nft_ctx *ctx) 204 { 205 int err; 206 207 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 208 if (err < 0) 209 return err; 210 211 ctx->table->use--; 212 nft_deactivate_next(ctx->net, ctx->chain); 213 214 return err; 215 } 216 217 static int 218 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 219 { 220 /* You cannot delete the same rule twice */ 221 if (nft_is_active_next(ctx->net, rule)) { 222 nft_deactivate_next(ctx->net, rule); 223 ctx->chain->use--; 224 return 0; 225 } 226 return -ENOENT; 227 } 228 229 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 230 struct nft_rule *rule) 231 { 232 struct nft_trans *trans; 233 234 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 235 if (trans == NULL) 236 return NULL; 237 238 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) { 239 nft_trans_rule_id(trans) = 240 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); 241 } 242 nft_trans_rule(trans) = rule; 243 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 244 245 return trans; 246 } 247 248 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 249 { 250 struct nft_trans *trans; 251 int err; 252 253 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 254 if (trans == NULL) 255 return -ENOMEM; 256 257 err = nf_tables_delrule_deactivate(ctx, rule); 258 if (err < 0) { 259 nft_trans_destroy(trans); 260 return err; 261 } 262 263 return 0; 264 } 265 266 static int nft_delrule_by_chain(struct nft_ctx *ctx) 267 { 268 struct nft_rule *rule; 269 int err; 270 271 list_for_each_entry(rule, &ctx->chain->rules, list) { 272 err = nft_delrule(ctx, rule); 273 if (err < 0) 274 return err; 275 } 276 return 0; 277 } 278 279 static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type, 280 struct nft_set *set) 281 { 282 struct nft_trans *trans; 283 284 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 285 if (trans == NULL) 286 return -ENOMEM; 287 288 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) { 289 nft_trans_set_id(trans) = 290 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 291 nft_activate_next(ctx->net, set); 292 } 293 nft_trans_set(trans) = set; 294 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 295 296 return 0; 297 } 298 299 static int nft_delset(struct nft_ctx *ctx, struct nft_set *set) 300 { 301 int err; 302 303 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 304 if (err < 0) 305 return err; 306 307 nft_deactivate_next(ctx->net, set); 308 ctx->table->use--; 309 310 return err; 311 } 312 313 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, 314 struct nft_object *obj) 315 { 316 struct nft_trans *trans; 317 318 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj)); 319 if (trans == NULL) 320 return -ENOMEM; 321 322 if (msg_type == NFT_MSG_NEWOBJ) 323 nft_activate_next(ctx->net, obj); 324 325 nft_trans_obj(trans) = obj; 326 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 327 328 return 0; 329 } 330 331 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj) 332 { 333 int err; 334 335 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj); 336 if (err < 0) 337 return err; 338 339 nft_deactivate_next(ctx->net, obj); 340 ctx->table->use--; 341 342 return err; 343 } 344 345 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, 346 struct nft_flowtable *flowtable) 347 { 348 struct nft_trans *trans; 349 350 trans = nft_trans_alloc(ctx, msg_type, 351 sizeof(struct nft_trans_flowtable)); 352 if (trans == NULL) 353 return -ENOMEM; 354 355 if (msg_type == NFT_MSG_NEWFLOWTABLE) 356 nft_activate_next(ctx->net, flowtable); 357 358 nft_trans_flowtable(trans) = flowtable; 359 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 360 361 return 0; 362 } 363 364 static int nft_delflowtable(struct nft_ctx *ctx, 365 struct nft_flowtable *flowtable) 366 { 367 int err; 368 369 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); 370 if (err < 0) 371 return err; 372 373 nft_deactivate_next(ctx->net, flowtable); 374 ctx->table->use--; 375 376 return err; 377 } 378 379 /* 380 * Tables 381 */ 382 383 static struct nft_table *nft_table_lookup(const struct net *net, 384 const struct nlattr *nla, 385 u8 family, u8 genmask) 386 { 387 struct nft_table *table; 388 389 list_for_each_entry(table, &net->nft.tables, list) { 390 if (!nla_strcmp(nla, table->name) && 391 table->family == family && 392 nft_active_genmask(table, genmask)) 393 return table; 394 } 395 return NULL; 396 } 397 398 static struct nft_table *nft_table_lookup_byhandle(const struct net *net, 399 const struct nlattr *nla, 400 u8 genmask) 401 { 402 struct nft_table *table; 403 404 list_for_each_entry(table, &net->nft.tables, list) { 405 if (be64_to_cpu(nla_get_be64(nla)) == table->handle && 406 nft_active_genmask(table, genmask)) 407 return table; 408 } 409 return NULL; 410 } 411 412 static struct nft_table *nf_tables_table_lookup(const struct net *net, 413 const struct nlattr *nla, 414 u8 family, u8 genmask) 415 { 416 struct nft_table *table; 417 418 if (nla == NULL) 419 return ERR_PTR(-EINVAL); 420 421 table = nft_table_lookup(net, nla, family, genmask); 422 if (table != NULL) 423 return table; 424 425 return ERR_PTR(-ENOENT); 426 } 427 428 static struct nft_table *nf_tables_table_lookup_byhandle(const struct net *net, 429 const struct nlattr *nla, 430 u8 genmask) 431 { 432 struct nft_table *table; 433 434 if (nla == NULL) 435 return ERR_PTR(-EINVAL); 436 437 table = nft_table_lookup_byhandle(net, nla, genmask); 438 if (table != NULL) 439 return table; 440 441 return ERR_PTR(-ENOENT); 442 } 443 444 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 445 { 446 return ++table->hgenerator; 447 } 448 449 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; 450 451 static const struct nft_chain_type * 452 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) 453 { 454 int i; 455 456 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 457 if (chain_type[family][i] != NULL && 458 !nla_strcmp(nla, chain_type[family][i]->name)) 459 return chain_type[family][i]; 460 } 461 return NULL; 462 } 463 464 static const struct nft_chain_type * 465 nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload) 466 { 467 const struct nft_chain_type *type; 468 469 type = __nf_tables_chain_type_lookup(nla, family); 470 if (type != NULL) 471 return type; 472 #ifdef CONFIG_MODULES 473 if (autoload) { 474 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 475 request_module("nft-chain-%u-%.*s", family, 476 nla_len(nla), (const char *)nla_data(nla)); 477 nfnl_lock(NFNL_SUBSYS_NFTABLES); 478 type = __nf_tables_chain_type_lookup(nla, family); 479 if (type != NULL) 480 return ERR_PTR(-EAGAIN); 481 } 482 #endif 483 return ERR_PTR(-ENOENT); 484 } 485 486 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 487 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 488 .len = NFT_TABLE_MAXNAMELEN - 1 }, 489 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 490 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, 491 }; 492 493 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 494 u32 portid, u32 seq, int event, u32 flags, 495 int family, const struct nft_table *table) 496 { 497 struct nlmsghdr *nlh; 498 struct nfgenmsg *nfmsg; 499 500 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 501 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); 502 if (nlh == NULL) 503 goto nla_put_failure; 504 505 nfmsg = nlmsg_data(nlh); 506 nfmsg->nfgen_family = family; 507 nfmsg->version = NFNETLINK_V0; 508 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 509 510 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 511 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) || 512 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || 513 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), 514 NFTA_TABLE_PAD)) 515 goto nla_put_failure; 516 517 nlmsg_end(skb, nlh); 518 return 0; 519 520 nla_put_failure: 521 nlmsg_trim(skb, nlh); 522 return -1; 523 } 524 525 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) 526 { 527 struct sk_buff *skb; 528 int err; 529 530 if (!ctx->report && 531 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 532 return; 533 534 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 535 if (skb == NULL) 536 goto err; 537 538 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 539 event, 0, ctx->family, ctx->table); 540 if (err < 0) { 541 kfree_skb(skb); 542 goto err; 543 } 544 545 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, 546 ctx->report, GFP_KERNEL); 547 return; 548 err: 549 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 550 } 551 552 static int nf_tables_dump_tables(struct sk_buff *skb, 553 struct netlink_callback *cb) 554 { 555 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 556 const struct nft_table *table; 557 unsigned int idx = 0, s_idx = cb->args[0]; 558 struct net *net = sock_net(skb->sk); 559 int family = nfmsg->nfgen_family; 560 561 rcu_read_lock(); 562 cb->seq = net->nft.base_seq; 563 564 list_for_each_entry_rcu(table, &net->nft.tables, list) { 565 if (family != NFPROTO_UNSPEC && family != table->family) 566 continue; 567 568 if (idx < s_idx) 569 goto cont; 570 if (idx > s_idx) 571 memset(&cb->args[1], 0, 572 sizeof(cb->args) - sizeof(cb->args[0])); 573 if (!nft_is_active(net, table)) 574 continue; 575 if (nf_tables_fill_table_info(skb, net, 576 NETLINK_CB(cb->skb).portid, 577 cb->nlh->nlmsg_seq, 578 NFT_MSG_NEWTABLE, NLM_F_MULTI, 579 table->family, table) < 0) 580 goto done; 581 582 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 583 cont: 584 idx++; 585 } 586 done: 587 rcu_read_unlock(); 588 cb->args[0] = idx; 589 return skb->len; 590 } 591 592 static int nf_tables_gettable(struct net *net, struct sock *nlsk, 593 struct sk_buff *skb, const struct nlmsghdr *nlh, 594 const struct nlattr * const nla[], 595 struct netlink_ext_ack *extack) 596 { 597 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 598 u8 genmask = nft_genmask_cur(net); 599 const struct nft_table *table; 600 struct sk_buff *skb2; 601 int family = nfmsg->nfgen_family; 602 int err; 603 604 if (nlh->nlmsg_flags & NLM_F_DUMP) { 605 struct netlink_dump_control c = { 606 .dump = nf_tables_dump_tables, 607 }; 608 return netlink_dump_start(nlsk, skb, nlh, &c); 609 } 610 611 table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family, 612 genmask); 613 if (IS_ERR(table)) 614 return PTR_ERR(table); 615 616 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 617 if (!skb2) 618 return -ENOMEM; 619 620 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 621 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0, 622 family, table); 623 if (err < 0) 624 goto err; 625 626 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 627 628 err: 629 kfree_skb(skb2); 630 return err; 631 } 632 633 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) 634 { 635 struct nft_chain *chain; 636 u32 i = 0; 637 638 list_for_each_entry(chain, &table->chains, list) { 639 if (!nft_is_active_next(net, chain)) 640 continue; 641 if (!nft_is_base_chain(chain)) 642 continue; 643 644 if (cnt && i++ == cnt) 645 break; 646 647 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops); 648 } 649 } 650 651 static int nf_tables_table_enable(struct net *net, struct nft_table *table) 652 { 653 struct nft_chain *chain; 654 int err, i = 0; 655 656 list_for_each_entry(chain, &table->chains, list) { 657 if (!nft_is_active_next(net, chain)) 658 continue; 659 if (!nft_is_base_chain(chain)) 660 continue; 661 662 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops); 663 if (err < 0) 664 goto err; 665 666 i++; 667 } 668 return 0; 669 err: 670 if (i) 671 nft_table_disable(net, table, i); 672 return err; 673 } 674 675 static void nf_tables_table_disable(struct net *net, struct nft_table *table) 676 { 677 nft_table_disable(net, table, 0); 678 } 679 680 static int nf_tables_updtable(struct nft_ctx *ctx) 681 { 682 struct nft_trans *trans; 683 u32 flags; 684 int ret = 0; 685 686 if (!ctx->nla[NFTA_TABLE_FLAGS]) 687 return 0; 688 689 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 690 if (flags & ~NFT_TABLE_F_DORMANT) 691 return -EINVAL; 692 693 if (flags == ctx->table->flags) 694 return 0; 695 696 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 697 sizeof(struct nft_trans_table)); 698 if (trans == NULL) 699 return -ENOMEM; 700 701 if ((flags & NFT_TABLE_F_DORMANT) && 702 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 703 nft_trans_table_enable(trans) = false; 704 } else if (!(flags & NFT_TABLE_F_DORMANT) && 705 ctx->table->flags & NFT_TABLE_F_DORMANT) { 706 ret = nf_tables_table_enable(ctx->net, ctx->table); 707 if (ret >= 0) { 708 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 709 nft_trans_table_enable(trans) = true; 710 } 711 } 712 if (ret < 0) 713 goto err; 714 715 nft_trans_table_update(trans) = true; 716 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 717 return 0; 718 err: 719 nft_trans_destroy(trans); 720 return ret; 721 } 722 723 static int nf_tables_newtable(struct net *net, struct sock *nlsk, 724 struct sk_buff *skb, const struct nlmsghdr *nlh, 725 const struct nlattr * const nla[], 726 struct netlink_ext_ack *extack) 727 { 728 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 729 u8 genmask = nft_genmask_next(net); 730 const struct nlattr *name; 731 struct nft_table *table; 732 int family = nfmsg->nfgen_family; 733 u32 flags = 0; 734 struct nft_ctx ctx; 735 int err; 736 737 name = nla[NFTA_TABLE_NAME]; 738 table = nf_tables_table_lookup(net, name, family, genmask); 739 if (IS_ERR(table)) { 740 if (PTR_ERR(table) != -ENOENT) 741 return PTR_ERR(table); 742 } else { 743 if (nlh->nlmsg_flags & NLM_F_EXCL) 744 return -EEXIST; 745 if (nlh->nlmsg_flags & NLM_F_REPLACE) 746 return -EOPNOTSUPP; 747 748 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); 749 return nf_tables_updtable(&ctx); 750 } 751 752 if (nla[NFTA_TABLE_FLAGS]) { 753 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 754 if (flags & ~NFT_TABLE_F_DORMANT) 755 return -EINVAL; 756 } 757 758 err = -ENOMEM; 759 table = kzalloc(sizeof(*table), GFP_KERNEL); 760 if (table == NULL) 761 goto err_kzalloc; 762 763 table->name = nla_strdup(name, GFP_KERNEL); 764 if (table->name == NULL) 765 goto err_strdup; 766 767 INIT_LIST_HEAD(&table->chains); 768 INIT_LIST_HEAD(&table->sets); 769 INIT_LIST_HEAD(&table->objects); 770 INIT_LIST_HEAD(&table->flowtables); 771 table->family = family; 772 table->flags = flags; 773 table->handle = ++table_handle; 774 775 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); 776 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 777 if (err < 0) 778 goto err_trans; 779 780 list_add_tail_rcu(&table->list, &net->nft.tables); 781 return 0; 782 err_trans: 783 kfree(table->name); 784 err_strdup: 785 kfree(table); 786 err_kzalloc: 787 return err; 788 } 789 790 static int nft_flush_table(struct nft_ctx *ctx) 791 { 792 struct nft_flowtable *flowtable, *nft; 793 struct nft_chain *chain, *nc; 794 struct nft_object *obj, *ne; 795 struct nft_set *set, *ns; 796 int err; 797 798 list_for_each_entry(chain, &ctx->table->chains, list) { 799 if (!nft_is_active_next(ctx->net, chain)) 800 continue; 801 802 ctx->chain = chain; 803 804 err = nft_delrule_by_chain(ctx); 805 if (err < 0) 806 goto out; 807 } 808 809 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 810 if (!nft_is_active_next(ctx->net, set)) 811 continue; 812 813 if (nft_set_is_anonymous(set) && 814 !list_empty(&set->bindings)) 815 continue; 816 817 err = nft_delset(ctx, set); 818 if (err < 0) 819 goto out; 820 } 821 822 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { 823 err = nft_delflowtable(ctx, flowtable); 824 if (err < 0) 825 goto out; 826 } 827 828 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { 829 err = nft_delobj(ctx, obj); 830 if (err < 0) 831 goto out; 832 } 833 834 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 835 if (!nft_is_active_next(ctx->net, chain)) 836 continue; 837 838 ctx->chain = chain; 839 840 err = nft_delchain(ctx); 841 if (err < 0) 842 goto out; 843 } 844 845 err = nft_deltable(ctx); 846 out: 847 return err; 848 } 849 850 static int nft_flush(struct nft_ctx *ctx, int family) 851 { 852 struct nft_table *table, *nt; 853 const struct nlattr * const *nla = ctx->nla; 854 int err = 0; 855 856 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) { 857 if (family != AF_UNSPEC && table->family != family) 858 continue; 859 860 ctx->family = table->family; 861 862 if (!nft_is_active_next(ctx->net, table)) 863 continue; 864 865 if (nla[NFTA_TABLE_NAME] && 866 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 867 continue; 868 869 ctx->table = table; 870 871 err = nft_flush_table(ctx); 872 if (err < 0) 873 goto out; 874 } 875 out: 876 return err; 877 } 878 879 static int nf_tables_deltable(struct net *net, struct sock *nlsk, 880 struct sk_buff *skb, const struct nlmsghdr *nlh, 881 const struct nlattr * const nla[], 882 struct netlink_ext_ack *extack) 883 { 884 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 885 u8 genmask = nft_genmask_next(net); 886 struct nft_table *table; 887 int family = nfmsg->nfgen_family; 888 struct nft_ctx ctx; 889 890 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla); 891 if (family == AF_UNSPEC || 892 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) 893 return nft_flush(&ctx, family); 894 895 if (nla[NFTA_TABLE_HANDLE]) 896 table = nf_tables_table_lookup_byhandle(net, 897 nla[NFTA_TABLE_HANDLE], 898 genmask); 899 else 900 table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], 901 family, genmask); 902 903 if (IS_ERR(table)) 904 return PTR_ERR(table); 905 906 if (nlh->nlmsg_flags & NLM_F_NONREC && 907 table->use > 0) 908 return -EBUSY; 909 910 ctx.family = family; 911 ctx.table = table; 912 913 return nft_flush_table(&ctx); 914 } 915 916 static void nf_tables_table_destroy(struct nft_ctx *ctx) 917 { 918 BUG_ON(ctx->table->use > 0); 919 920 kfree(ctx->table->name); 921 kfree(ctx->table); 922 } 923 924 void nft_register_chain_type(const struct nft_chain_type *ctype) 925 { 926 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO)) 927 return; 928 929 nfnl_lock(NFNL_SUBSYS_NFTABLES); 930 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) { 931 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 932 return; 933 } 934 chain_type[ctype->family][ctype->type] = ctype; 935 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 936 } 937 EXPORT_SYMBOL_GPL(nft_register_chain_type); 938 939 void nft_unregister_chain_type(const struct nft_chain_type *ctype) 940 { 941 nfnl_lock(NFNL_SUBSYS_NFTABLES); 942 chain_type[ctype->family][ctype->type] = NULL; 943 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 944 } 945 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 946 947 /* 948 * Chains 949 */ 950 951 static struct nft_chain * 952 nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle, 953 u8 genmask) 954 { 955 struct nft_chain *chain; 956 957 list_for_each_entry(chain, &table->chains, list) { 958 if (chain->handle == handle && 959 nft_active_genmask(chain, genmask)) 960 return chain; 961 } 962 963 return ERR_PTR(-ENOENT); 964 } 965 966 static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table, 967 const struct nlattr *nla, 968 u8 genmask) 969 { 970 struct nft_chain *chain; 971 972 if (nla == NULL) 973 return ERR_PTR(-EINVAL); 974 975 list_for_each_entry(chain, &table->chains, list) { 976 if (!nla_strcmp(nla, chain->name) && 977 nft_active_genmask(chain, genmask)) 978 return chain; 979 } 980 981 return ERR_PTR(-ENOENT); 982 } 983 984 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 985 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING, 986 .len = NFT_TABLE_MAXNAMELEN - 1 }, 987 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 988 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 989 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 990 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 991 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 992 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING }, 993 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 994 }; 995 996 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 997 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 998 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 999 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 1000 .len = IFNAMSIZ - 1 }, 1001 }; 1002 1003 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 1004 { 1005 struct nft_stats *cpu_stats, total; 1006 struct nlattr *nest; 1007 unsigned int seq; 1008 u64 pkts, bytes; 1009 int cpu; 1010 1011 memset(&total, 0, sizeof(total)); 1012 for_each_possible_cpu(cpu) { 1013 cpu_stats = per_cpu_ptr(stats, cpu); 1014 do { 1015 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp); 1016 pkts = cpu_stats->pkts; 1017 bytes = cpu_stats->bytes; 1018 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq)); 1019 total.pkts += pkts; 1020 total.bytes += bytes; 1021 } 1022 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS); 1023 if (nest == NULL) 1024 goto nla_put_failure; 1025 1026 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts), 1027 NFTA_COUNTER_PAD) || 1028 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 1029 NFTA_COUNTER_PAD)) 1030 goto nla_put_failure; 1031 1032 nla_nest_end(skb, nest); 1033 return 0; 1034 1035 nla_put_failure: 1036 return -ENOSPC; 1037 } 1038 1039 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 1040 u32 portid, u32 seq, int event, u32 flags, 1041 int family, const struct nft_table *table, 1042 const struct nft_chain *chain) 1043 { 1044 struct nlmsghdr *nlh; 1045 struct nfgenmsg *nfmsg; 1046 1047 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 1048 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); 1049 if (nlh == NULL) 1050 goto nla_put_failure; 1051 1052 nfmsg = nlmsg_data(nlh); 1053 nfmsg->nfgen_family = family; 1054 nfmsg->version = NFNETLINK_V0; 1055 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 1056 1057 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name)) 1058 goto nla_put_failure; 1059 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), 1060 NFTA_CHAIN_PAD)) 1061 goto nla_put_failure; 1062 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name)) 1063 goto nla_put_failure; 1064 1065 if (nft_is_base_chain(chain)) { 1066 const struct nft_base_chain *basechain = nft_base_chain(chain); 1067 const struct nf_hook_ops *ops = &basechain->ops; 1068 struct nlattr *nest; 1069 1070 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK); 1071 if (nest == NULL) 1072 goto nla_put_failure; 1073 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 1074 goto nla_put_failure; 1075 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 1076 goto nla_put_failure; 1077 if (basechain->dev_name[0] && 1078 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name)) 1079 goto nla_put_failure; 1080 nla_nest_end(skb, nest); 1081 1082 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 1083 htonl(basechain->policy))) 1084 goto nla_put_failure; 1085 1086 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 1087 goto nla_put_failure; 1088 1089 if (basechain->stats && nft_dump_stats(skb, basechain->stats)) 1090 goto nla_put_failure; 1091 } 1092 1093 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 1094 goto nla_put_failure; 1095 1096 nlmsg_end(skb, nlh); 1097 return 0; 1098 1099 nla_put_failure: 1100 nlmsg_trim(skb, nlh); 1101 return -1; 1102 } 1103 1104 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event) 1105 { 1106 struct sk_buff *skb; 1107 int err; 1108 1109 if (!ctx->report && 1110 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1111 return; 1112 1113 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1114 if (skb == NULL) 1115 goto err; 1116 1117 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 1118 event, 0, ctx->family, ctx->table, 1119 ctx->chain); 1120 if (err < 0) { 1121 kfree_skb(skb); 1122 goto err; 1123 } 1124 1125 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, 1126 ctx->report, GFP_KERNEL); 1127 return; 1128 err: 1129 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1130 } 1131 1132 static int nf_tables_dump_chains(struct sk_buff *skb, 1133 struct netlink_callback *cb) 1134 { 1135 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1136 const struct nft_table *table; 1137 const struct nft_chain *chain; 1138 unsigned int idx = 0, s_idx = cb->args[0]; 1139 struct net *net = sock_net(skb->sk); 1140 int family = nfmsg->nfgen_family; 1141 1142 rcu_read_lock(); 1143 cb->seq = net->nft.base_seq; 1144 1145 list_for_each_entry_rcu(table, &net->nft.tables, list) { 1146 if (family != NFPROTO_UNSPEC && family != table->family) 1147 continue; 1148 1149 list_for_each_entry_rcu(chain, &table->chains, list) { 1150 if (idx < s_idx) 1151 goto cont; 1152 if (idx > s_idx) 1153 memset(&cb->args[1], 0, 1154 sizeof(cb->args) - sizeof(cb->args[0])); 1155 if (!nft_is_active(net, chain)) 1156 continue; 1157 if (nf_tables_fill_chain_info(skb, net, 1158 NETLINK_CB(cb->skb).portid, 1159 cb->nlh->nlmsg_seq, 1160 NFT_MSG_NEWCHAIN, 1161 NLM_F_MULTI, 1162 table->family, table, 1163 chain) < 0) 1164 goto done; 1165 1166 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1167 cont: 1168 idx++; 1169 } 1170 } 1171 done: 1172 rcu_read_unlock(); 1173 cb->args[0] = idx; 1174 return skb->len; 1175 } 1176 1177 static int nf_tables_getchain(struct net *net, struct sock *nlsk, 1178 struct sk_buff *skb, const struct nlmsghdr *nlh, 1179 const struct nlattr * const nla[], 1180 struct netlink_ext_ack *extack) 1181 { 1182 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 1183 u8 genmask = nft_genmask_cur(net); 1184 const struct nft_table *table; 1185 const struct nft_chain *chain; 1186 struct sk_buff *skb2; 1187 int family = nfmsg->nfgen_family; 1188 int err; 1189 1190 if (nlh->nlmsg_flags & NLM_F_DUMP) { 1191 struct netlink_dump_control c = { 1192 .dump = nf_tables_dump_chains, 1193 }; 1194 return netlink_dump_start(nlsk, skb, nlh, &c); 1195 } 1196 1197 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, 1198 genmask); 1199 if (IS_ERR(table)) 1200 return PTR_ERR(table); 1201 1202 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask); 1203 if (IS_ERR(chain)) 1204 return PTR_ERR(chain); 1205 1206 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 1207 if (!skb2) 1208 return -ENOMEM; 1209 1210 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 1211 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0, 1212 family, table, chain); 1213 if (err < 0) 1214 goto err; 1215 1216 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 1217 1218 err: 1219 kfree_skb(skb2); 1220 return err; 1221 } 1222 1223 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 1224 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 1225 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 1226 }; 1227 1228 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 1229 { 1230 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 1231 struct nft_stats __percpu *newstats; 1232 struct nft_stats *stats; 1233 int err; 1234 1235 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy, 1236 NULL); 1237 if (err < 0) 1238 return ERR_PTR(err); 1239 1240 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 1241 return ERR_PTR(-EINVAL); 1242 1243 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 1244 if (newstats == NULL) 1245 return ERR_PTR(-ENOMEM); 1246 1247 /* Restore old counters on this cpu, no problem. Per-cpu statistics 1248 * are not exposed to userspace. 1249 */ 1250 preempt_disable(); 1251 stats = this_cpu_ptr(newstats); 1252 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 1253 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 1254 preempt_enable(); 1255 1256 return newstats; 1257 } 1258 1259 static void nft_chain_stats_replace(struct nft_base_chain *chain, 1260 struct nft_stats __percpu *newstats) 1261 { 1262 struct nft_stats __percpu *oldstats; 1263 1264 if (newstats == NULL) 1265 return; 1266 1267 if (chain->stats) { 1268 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES); 1269 rcu_assign_pointer(chain->stats, newstats); 1270 synchronize_rcu(); 1271 free_percpu(oldstats); 1272 } else 1273 rcu_assign_pointer(chain->stats, newstats); 1274 } 1275 1276 static void nf_tables_chain_destroy(struct nft_ctx *ctx) 1277 { 1278 struct nft_chain *chain = ctx->chain; 1279 1280 BUG_ON(chain->use > 0); 1281 1282 if (nft_is_base_chain(chain)) { 1283 struct nft_base_chain *basechain = nft_base_chain(chain); 1284 1285 if (basechain->type->free) 1286 basechain->type->free(ctx); 1287 module_put(basechain->type->owner); 1288 free_percpu(basechain->stats); 1289 if (basechain->stats) 1290 static_branch_dec(&nft_counters_enabled); 1291 kfree(chain->name); 1292 kfree(basechain); 1293 } else { 1294 kfree(chain->name); 1295 kfree(chain); 1296 } 1297 } 1298 1299 struct nft_chain_hook { 1300 u32 num; 1301 s32 priority; 1302 const struct nft_chain_type *type; 1303 struct net_device *dev; 1304 }; 1305 1306 static int nft_chain_parse_hook(struct net *net, 1307 const struct nlattr * const nla[], 1308 struct nft_chain_hook *hook, u8 family, 1309 bool create) 1310 { 1311 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 1312 const struct nft_chain_type *type; 1313 struct net_device *dev; 1314 int err; 1315 1316 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK], 1317 nft_hook_policy, NULL); 1318 if (err < 0) 1319 return err; 1320 1321 if (ha[NFTA_HOOK_HOOKNUM] == NULL || 1322 ha[NFTA_HOOK_PRIORITY] == NULL) 1323 return -EINVAL; 1324 1325 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 1326 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 1327 1328 type = chain_type[family][NFT_CHAIN_T_DEFAULT]; 1329 if (nla[NFTA_CHAIN_TYPE]) { 1330 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE], 1331 family, create); 1332 if (IS_ERR(type)) 1333 return PTR_ERR(type); 1334 } 1335 if (!(type->hook_mask & (1 << hook->num))) 1336 return -EOPNOTSUPP; 1337 1338 if (type->type == NFT_CHAIN_T_NAT && 1339 hook->priority <= NF_IP_PRI_CONNTRACK) 1340 return -EOPNOTSUPP; 1341 1342 if (!try_module_get(type->owner)) 1343 return -ENOENT; 1344 1345 hook->type = type; 1346 1347 hook->dev = NULL; 1348 if (family == NFPROTO_NETDEV) { 1349 char ifname[IFNAMSIZ]; 1350 1351 if (!ha[NFTA_HOOK_DEV]) { 1352 module_put(type->owner); 1353 return -EOPNOTSUPP; 1354 } 1355 1356 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ); 1357 dev = __dev_get_by_name(net, ifname); 1358 if (!dev) { 1359 module_put(type->owner); 1360 return -ENOENT; 1361 } 1362 hook->dev = dev; 1363 } else if (ha[NFTA_HOOK_DEV]) { 1364 module_put(type->owner); 1365 return -EOPNOTSUPP; 1366 } 1367 1368 return 0; 1369 } 1370 1371 static void nft_chain_release_hook(struct nft_chain_hook *hook) 1372 { 1373 module_put(hook->type->owner); 1374 } 1375 1376 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 1377 u8 policy, bool create) 1378 { 1379 const struct nlattr * const *nla = ctx->nla; 1380 struct nft_table *table = ctx->table; 1381 struct nft_base_chain *basechain; 1382 struct nft_stats __percpu *stats; 1383 struct net *net = ctx->net; 1384 struct nft_chain *chain; 1385 int err; 1386 1387 if (table->use == UINT_MAX) 1388 return -EOVERFLOW; 1389 1390 if (nla[NFTA_CHAIN_HOOK]) { 1391 struct nft_chain_hook hook; 1392 struct nf_hook_ops *ops; 1393 1394 err = nft_chain_parse_hook(net, nla, &hook, family, create); 1395 if (err < 0) 1396 return err; 1397 1398 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL); 1399 if (basechain == NULL) { 1400 nft_chain_release_hook(&hook); 1401 return -ENOMEM; 1402 } 1403 1404 if (hook.dev != NULL) 1405 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ); 1406 1407 if (nla[NFTA_CHAIN_COUNTERS]) { 1408 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 1409 if (IS_ERR(stats)) { 1410 nft_chain_release_hook(&hook); 1411 kfree(basechain); 1412 return PTR_ERR(stats); 1413 } 1414 basechain->stats = stats; 1415 static_branch_inc(&nft_counters_enabled); 1416 } 1417 1418 basechain->type = hook.type; 1419 if (basechain->type->init) 1420 basechain->type->init(ctx); 1421 1422 chain = &basechain->chain; 1423 1424 ops = &basechain->ops; 1425 ops->pf = family; 1426 ops->hooknum = hook.num; 1427 ops->priority = hook.priority; 1428 ops->priv = chain; 1429 ops->hook = hook.type->hooks[ops->hooknum]; 1430 ops->dev = hook.dev; 1431 1432 if (basechain->type->type == NFT_CHAIN_T_NAT) 1433 ops->nat_hook = true; 1434 1435 chain->flags |= NFT_BASE_CHAIN; 1436 basechain->policy = policy; 1437 } else { 1438 chain = kzalloc(sizeof(*chain), GFP_KERNEL); 1439 if (chain == NULL) 1440 return -ENOMEM; 1441 } 1442 ctx->chain = chain; 1443 1444 INIT_LIST_HEAD(&chain->rules); 1445 chain->handle = nf_tables_alloc_handle(table); 1446 chain->table = table; 1447 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL); 1448 if (!chain->name) { 1449 err = -ENOMEM; 1450 goto err1; 1451 } 1452 1453 err = nf_tables_register_hook(net, table, chain); 1454 if (err < 0) 1455 goto err1; 1456 1457 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN); 1458 if (err < 0) 1459 goto err2; 1460 1461 table->use++; 1462 list_add_tail_rcu(&chain->list, &table->chains); 1463 1464 return 0; 1465 err2: 1466 nf_tables_unregister_hook(net, table, chain); 1467 err1: 1468 nf_tables_chain_destroy(ctx); 1469 1470 return err; 1471 } 1472 1473 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 1474 bool create) 1475 { 1476 const struct nlattr * const *nla = ctx->nla; 1477 struct nft_table *table = ctx->table; 1478 struct nft_chain *chain = ctx->chain; 1479 struct nft_base_chain *basechain; 1480 struct nft_stats *stats = NULL; 1481 struct nft_chain_hook hook; 1482 const struct nlattr *name; 1483 struct nf_hook_ops *ops; 1484 struct nft_trans *trans; 1485 int err; 1486 1487 if (nla[NFTA_CHAIN_HOOK]) { 1488 if (!nft_is_base_chain(chain)) 1489 return -EBUSY; 1490 1491 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family, 1492 create); 1493 if (err < 0) 1494 return err; 1495 1496 basechain = nft_base_chain(chain); 1497 if (basechain->type != hook.type) { 1498 nft_chain_release_hook(&hook); 1499 return -EBUSY; 1500 } 1501 1502 ops = &basechain->ops; 1503 if (ops->hooknum != hook.num || 1504 ops->priority != hook.priority || 1505 ops->dev != hook.dev) { 1506 nft_chain_release_hook(&hook); 1507 return -EBUSY; 1508 } 1509 nft_chain_release_hook(&hook); 1510 } 1511 1512 if (nla[NFTA_CHAIN_HANDLE] && 1513 nla[NFTA_CHAIN_NAME]) { 1514 struct nft_chain *chain2; 1515 1516 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], 1517 genmask); 1518 if (!IS_ERR(chain2)) 1519 return -EEXIST; 1520 } 1521 1522 if (nla[NFTA_CHAIN_COUNTERS]) { 1523 if (!nft_is_base_chain(chain)) 1524 return -EOPNOTSUPP; 1525 1526 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 1527 if (IS_ERR(stats)) 1528 return PTR_ERR(stats); 1529 } 1530 1531 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, 1532 sizeof(struct nft_trans_chain)); 1533 if (trans == NULL) { 1534 free_percpu(stats); 1535 return -ENOMEM; 1536 } 1537 1538 nft_trans_chain_stats(trans) = stats; 1539 nft_trans_chain_update(trans) = true; 1540 1541 if (nla[NFTA_CHAIN_POLICY]) 1542 nft_trans_chain_policy(trans) = policy; 1543 else 1544 nft_trans_chain_policy(trans) = -1; 1545 1546 name = nla[NFTA_CHAIN_NAME]; 1547 if (nla[NFTA_CHAIN_HANDLE] && name) { 1548 nft_trans_chain_name(trans) = 1549 nla_strdup(name, GFP_KERNEL); 1550 if (!nft_trans_chain_name(trans)) { 1551 kfree(trans); 1552 free_percpu(stats); 1553 return -ENOMEM; 1554 } 1555 } 1556 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 1557 1558 return 0; 1559 } 1560 1561 static int nf_tables_newchain(struct net *net, struct sock *nlsk, 1562 struct sk_buff *skb, const struct nlmsghdr *nlh, 1563 const struct nlattr * const nla[], 1564 struct netlink_ext_ack *extack) 1565 { 1566 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 1567 const struct nlattr * uninitialized_var(name); 1568 u8 genmask = nft_genmask_next(net); 1569 int family = nfmsg->nfgen_family; 1570 struct nft_table *table; 1571 struct nft_chain *chain; 1572 u8 policy = NF_ACCEPT; 1573 struct nft_ctx ctx; 1574 u64 handle = 0; 1575 bool create; 1576 1577 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; 1578 1579 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, 1580 genmask); 1581 if (IS_ERR(table)) 1582 return PTR_ERR(table); 1583 1584 chain = NULL; 1585 name = nla[NFTA_CHAIN_NAME]; 1586 1587 if (nla[NFTA_CHAIN_HANDLE]) { 1588 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 1589 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask); 1590 if (IS_ERR(chain)) 1591 return PTR_ERR(chain); 1592 } else { 1593 chain = nf_tables_chain_lookup(table, name, genmask); 1594 if (IS_ERR(chain)) { 1595 if (PTR_ERR(chain) != -ENOENT) 1596 return PTR_ERR(chain); 1597 chain = NULL; 1598 } 1599 } 1600 1601 if (nla[NFTA_CHAIN_POLICY]) { 1602 if (chain != NULL && 1603 !nft_is_base_chain(chain)) 1604 return -EOPNOTSUPP; 1605 1606 if (chain == NULL && 1607 nla[NFTA_CHAIN_HOOK] == NULL) 1608 return -EOPNOTSUPP; 1609 1610 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 1611 switch (policy) { 1612 case NF_DROP: 1613 case NF_ACCEPT: 1614 break; 1615 default: 1616 return -EINVAL; 1617 } 1618 } 1619 1620 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); 1621 1622 if (chain != NULL) { 1623 if (nlh->nlmsg_flags & NLM_F_EXCL) 1624 return -EEXIST; 1625 if (nlh->nlmsg_flags & NLM_F_REPLACE) 1626 return -EOPNOTSUPP; 1627 1628 return nf_tables_updchain(&ctx, genmask, policy, create); 1629 } 1630 1631 return nf_tables_addchain(&ctx, family, genmask, policy, create); 1632 } 1633 1634 static int nf_tables_delchain(struct net *net, struct sock *nlsk, 1635 struct sk_buff *skb, const struct nlmsghdr *nlh, 1636 const struct nlattr * const nla[], 1637 struct netlink_ext_ack *extack) 1638 { 1639 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 1640 u8 genmask = nft_genmask_next(net); 1641 struct nft_table *table; 1642 struct nft_chain *chain; 1643 struct nft_rule *rule; 1644 int family = nfmsg->nfgen_family; 1645 struct nft_ctx ctx; 1646 u64 handle; 1647 u32 use; 1648 int err; 1649 1650 table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, 1651 genmask); 1652 if (IS_ERR(table)) 1653 return PTR_ERR(table); 1654 1655 if (nla[NFTA_CHAIN_HANDLE]) { 1656 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 1657 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask); 1658 } else { 1659 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask); 1660 } 1661 if (IS_ERR(chain)) 1662 return PTR_ERR(chain); 1663 1664 if (nlh->nlmsg_flags & NLM_F_NONREC && 1665 chain->use > 0) 1666 return -EBUSY; 1667 1668 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); 1669 1670 use = chain->use; 1671 list_for_each_entry(rule, &chain->rules, list) { 1672 if (!nft_is_active_next(net, rule)) 1673 continue; 1674 use--; 1675 1676 err = nft_delrule(&ctx, rule); 1677 if (err < 0) 1678 return err; 1679 } 1680 1681 /* There are rules and elements that are still holding references to us, 1682 * we cannot do a recursive removal in this case. 1683 */ 1684 if (use > 0) 1685 return -EBUSY; 1686 1687 return nft_delchain(&ctx); 1688 } 1689 1690 /* 1691 * Expressions 1692 */ 1693 1694 /** 1695 * nft_register_expr - register nf_tables expr type 1696 * @ops: expr type 1697 * 1698 * Registers the expr type for use with nf_tables. Returns zero on 1699 * success or a negative errno code otherwise. 1700 */ 1701 int nft_register_expr(struct nft_expr_type *type) 1702 { 1703 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1704 if (type->family == NFPROTO_UNSPEC) 1705 list_add_tail_rcu(&type->list, &nf_tables_expressions); 1706 else 1707 list_add_rcu(&type->list, &nf_tables_expressions); 1708 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1709 return 0; 1710 } 1711 EXPORT_SYMBOL_GPL(nft_register_expr); 1712 1713 /** 1714 * nft_unregister_expr - unregister nf_tables expr type 1715 * @ops: expr type 1716 * 1717 * Unregisters the expr typefor use with nf_tables. 1718 */ 1719 void nft_unregister_expr(struct nft_expr_type *type) 1720 { 1721 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1722 list_del_rcu(&type->list); 1723 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1724 } 1725 EXPORT_SYMBOL_GPL(nft_unregister_expr); 1726 1727 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 1728 struct nlattr *nla) 1729 { 1730 const struct nft_expr_type *type; 1731 1732 list_for_each_entry(type, &nf_tables_expressions, list) { 1733 if (!nla_strcmp(nla, type->name) && 1734 (!type->family || type->family == family)) 1735 return type; 1736 } 1737 return NULL; 1738 } 1739 1740 static const struct nft_expr_type *nft_expr_type_get(u8 family, 1741 struct nlattr *nla) 1742 { 1743 const struct nft_expr_type *type; 1744 1745 if (nla == NULL) 1746 return ERR_PTR(-EINVAL); 1747 1748 type = __nft_expr_type_get(family, nla); 1749 if (type != NULL && try_module_get(type->owner)) 1750 return type; 1751 1752 #ifdef CONFIG_MODULES 1753 if (type == NULL) { 1754 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1755 request_module("nft-expr-%u-%.*s", family, 1756 nla_len(nla), (char *)nla_data(nla)); 1757 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1758 if (__nft_expr_type_get(family, nla)) 1759 return ERR_PTR(-EAGAIN); 1760 1761 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1762 request_module("nft-expr-%.*s", 1763 nla_len(nla), (char *)nla_data(nla)); 1764 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1765 if (__nft_expr_type_get(family, nla)) 1766 return ERR_PTR(-EAGAIN); 1767 } 1768 #endif 1769 return ERR_PTR(-ENOENT); 1770 } 1771 1772 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 1773 [NFTA_EXPR_NAME] = { .type = NLA_STRING }, 1774 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 1775 }; 1776 1777 static int nf_tables_fill_expr_info(struct sk_buff *skb, 1778 const struct nft_expr *expr) 1779 { 1780 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 1781 goto nla_put_failure; 1782 1783 if (expr->ops->dump) { 1784 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA); 1785 if (data == NULL) 1786 goto nla_put_failure; 1787 if (expr->ops->dump(skb, expr) < 0) 1788 goto nla_put_failure; 1789 nla_nest_end(skb, data); 1790 } 1791 1792 return skb->len; 1793 1794 nla_put_failure: 1795 return -1; 1796 }; 1797 1798 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 1799 const struct nft_expr *expr) 1800 { 1801 struct nlattr *nest; 1802 1803 nest = nla_nest_start(skb, attr); 1804 if (!nest) 1805 goto nla_put_failure; 1806 if (nf_tables_fill_expr_info(skb, expr) < 0) 1807 goto nla_put_failure; 1808 nla_nest_end(skb, nest); 1809 return 0; 1810 1811 nla_put_failure: 1812 return -1; 1813 } 1814 1815 struct nft_expr_info { 1816 const struct nft_expr_ops *ops; 1817 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 1818 }; 1819 1820 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 1821 const struct nlattr *nla, 1822 struct nft_expr_info *info) 1823 { 1824 const struct nft_expr_type *type; 1825 const struct nft_expr_ops *ops; 1826 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 1827 int err; 1828 1829 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL); 1830 if (err < 0) 1831 return err; 1832 1833 type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); 1834 if (IS_ERR(type)) 1835 return PTR_ERR(type); 1836 1837 if (tb[NFTA_EXPR_DATA]) { 1838 err = nla_parse_nested(info->tb, type->maxattr, 1839 tb[NFTA_EXPR_DATA], type->policy, NULL); 1840 if (err < 0) 1841 goto err1; 1842 } else 1843 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 1844 1845 if (type->select_ops != NULL) { 1846 ops = type->select_ops(ctx, 1847 (const struct nlattr * const *)info->tb); 1848 if (IS_ERR(ops)) { 1849 err = PTR_ERR(ops); 1850 goto err1; 1851 } 1852 } else 1853 ops = type->ops; 1854 1855 info->ops = ops; 1856 return 0; 1857 1858 err1: 1859 module_put(type->owner); 1860 return err; 1861 } 1862 1863 static int nf_tables_newexpr(const struct nft_ctx *ctx, 1864 const struct nft_expr_info *info, 1865 struct nft_expr *expr) 1866 { 1867 const struct nft_expr_ops *ops = info->ops; 1868 int err; 1869 1870 expr->ops = ops; 1871 if (ops->init) { 1872 err = ops->init(ctx, expr, (const struct nlattr **)info->tb); 1873 if (err < 0) 1874 goto err1; 1875 } 1876 1877 if (ops->validate) { 1878 const struct nft_data *data = NULL; 1879 1880 err = ops->validate(ctx, expr, &data); 1881 if (err < 0) 1882 goto err2; 1883 } 1884 1885 return 0; 1886 1887 err2: 1888 if (ops->destroy) 1889 ops->destroy(ctx, expr); 1890 err1: 1891 expr->ops = NULL; 1892 return err; 1893 } 1894 1895 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 1896 struct nft_expr *expr) 1897 { 1898 if (expr->ops->destroy) 1899 expr->ops->destroy(ctx, expr); 1900 module_put(expr->ops->type->owner); 1901 } 1902 1903 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 1904 const struct nlattr *nla) 1905 { 1906 struct nft_expr_info info; 1907 struct nft_expr *expr; 1908 int err; 1909 1910 err = nf_tables_expr_parse(ctx, nla, &info); 1911 if (err < 0) 1912 goto err1; 1913 1914 err = -ENOMEM; 1915 expr = kzalloc(info.ops->size, GFP_KERNEL); 1916 if (expr == NULL) 1917 goto err2; 1918 1919 err = nf_tables_newexpr(ctx, &info, expr); 1920 if (err < 0) 1921 goto err3; 1922 1923 return expr; 1924 err3: 1925 kfree(expr); 1926 err2: 1927 module_put(info.ops->type->owner); 1928 err1: 1929 return ERR_PTR(err); 1930 } 1931 1932 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 1933 { 1934 nf_tables_expr_destroy(ctx, expr); 1935 kfree(expr); 1936 } 1937 1938 /* 1939 * Rules 1940 */ 1941 1942 static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain, 1943 u64 handle) 1944 { 1945 struct nft_rule *rule; 1946 1947 // FIXME: this sucks 1948 list_for_each_entry(rule, &chain->rules, list) { 1949 if (handle == rule->handle) 1950 return rule; 1951 } 1952 1953 return ERR_PTR(-ENOENT); 1954 } 1955 1956 static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain, 1957 const struct nlattr *nla) 1958 { 1959 if (nla == NULL) 1960 return ERR_PTR(-EINVAL); 1961 1962 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla))); 1963 } 1964 1965 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 1966 [NFTA_RULE_TABLE] = { .type = NLA_STRING, 1967 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1968 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 1969 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1970 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 1971 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED }, 1972 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 1973 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 1974 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 1975 .len = NFT_USERDATA_MAXLEN }, 1976 [NFTA_RULE_ID] = { .type = NLA_U32 }, 1977 }; 1978 1979 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 1980 u32 portid, u32 seq, int event, 1981 u32 flags, int family, 1982 const struct nft_table *table, 1983 const struct nft_chain *chain, 1984 const struct nft_rule *rule) 1985 { 1986 struct nlmsghdr *nlh; 1987 struct nfgenmsg *nfmsg; 1988 const struct nft_expr *expr, *next; 1989 struct nlattr *list; 1990 const struct nft_rule *prule; 1991 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 1992 1993 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags); 1994 if (nlh == NULL) 1995 goto nla_put_failure; 1996 1997 nfmsg = nlmsg_data(nlh); 1998 nfmsg->nfgen_family = family; 1999 nfmsg->version = NFNETLINK_V0; 2000 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 2001 2002 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 2003 goto nla_put_failure; 2004 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 2005 goto nla_put_failure; 2006 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle), 2007 NFTA_RULE_PAD)) 2008 goto nla_put_failure; 2009 2010 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) { 2011 prule = list_prev_entry(rule, list); 2012 if (nla_put_be64(skb, NFTA_RULE_POSITION, 2013 cpu_to_be64(prule->handle), 2014 NFTA_RULE_PAD)) 2015 goto nla_put_failure; 2016 } 2017 2018 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS); 2019 if (list == NULL) 2020 goto nla_put_failure; 2021 nft_rule_for_each_expr(expr, next, rule) { 2022 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0) 2023 goto nla_put_failure; 2024 } 2025 nla_nest_end(skb, list); 2026 2027 if (rule->udata) { 2028 struct nft_userdata *udata = nft_userdata(rule); 2029 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 2030 udata->data) < 0) 2031 goto nla_put_failure; 2032 } 2033 2034 nlmsg_end(skb, nlh); 2035 return 0; 2036 2037 nla_put_failure: 2038 nlmsg_trim(skb, nlh); 2039 return -1; 2040 } 2041 2042 static void nf_tables_rule_notify(const struct nft_ctx *ctx, 2043 const struct nft_rule *rule, int event) 2044 { 2045 struct sk_buff *skb; 2046 int err; 2047 2048 if (!ctx->report && 2049 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 2050 return; 2051 2052 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 2053 if (skb == NULL) 2054 goto err; 2055 2056 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 2057 event, 0, ctx->family, ctx->table, 2058 ctx->chain, rule); 2059 if (err < 0) { 2060 kfree_skb(skb); 2061 goto err; 2062 } 2063 2064 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, 2065 ctx->report, GFP_KERNEL); 2066 return; 2067 err: 2068 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 2069 } 2070 2071 struct nft_rule_dump_ctx { 2072 char *table; 2073 char *chain; 2074 }; 2075 2076 static int nf_tables_dump_rules(struct sk_buff *skb, 2077 struct netlink_callback *cb) 2078 { 2079 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 2080 const struct nft_rule_dump_ctx *ctx = cb->data; 2081 const struct nft_table *table; 2082 const struct nft_chain *chain; 2083 const struct nft_rule *rule; 2084 unsigned int idx = 0, s_idx = cb->args[0]; 2085 struct net *net = sock_net(skb->sk); 2086 int family = nfmsg->nfgen_family; 2087 2088 rcu_read_lock(); 2089 cb->seq = net->nft.base_seq; 2090 2091 list_for_each_entry_rcu(table, &net->nft.tables, list) { 2092 if (family != NFPROTO_UNSPEC && family != table->family) 2093 continue; 2094 2095 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0) 2096 continue; 2097 2098 list_for_each_entry_rcu(chain, &table->chains, list) { 2099 if (ctx && ctx->chain && 2100 strcmp(ctx->chain, chain->name) != 0) 2101 continue; 2102 2103 list_for_each_entry_rcu(rule, &chain->rules, list) { 2104 if (!nft_is_active(net, rule)) 2105 goto cont; 2106 if (idx < s_idx) 2107 goto cont; 2108 if (idx > s_idx) 2109 memset(&cb->args[1], 0, 2110 sizeof(cb->args) - sizeof(cb->args[0])); 2111 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 2112 cb->nlh->nlmsg_seq, 2113 NFT_MSG_NEWRULE, 2114 NLM_F_MULTI | NLM_F_APPEND, 2115 table->family, 2116 table, chain, rule) < 0) 2117 goto done; 2118 2119 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 2120 cont: 2121 idx++; 2122 } 2123 } 2124 } 2125 done: 2126 rcu_read_unlock(); 2127 2128 cb->args[0] = idx; 2129 return skb->len; 2130 } 2131 2132 static int nf_tables_dump_rules_done(struct netlink_callback *cb) 2133 { 2134 struct nft_rule_dump_ctx *ctx = cb->data; 2135 2136 if (ctx) { 2137 kfree(ctx->table); 2138 kfree(ctx->chain); 2139 kfree(ctx); 2140 } 2141 return 0; 2142 } 2143 2144 static int nf_tables_getrule(struct net *net, struct sock *nlsk, 2145 struct sk_buff *skb, const struct nlmsghdr *nlh, 2146 const struct nlattr * const nla[], 2147 struct netlink_ext_ack *extack) 2148 { 2149 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2150 u8 genmask = nft_genmask_cur(net); 2151 const struct nft_table *table; 2152 const struct nft_chain *chain; 2153 const struct nft_rule *rule; 2154 struct sk_buff *skb2; 2155 int family = nfmsg->nfgen_family; 2156 int err; 2157 2158 if (nlh->nlmsg_flags & NLM_F_DUMP) { 2159 struct netlink_dump_control c = { 2160 .dump = nf_tables_dump_rules, 2161 .done = nf_tables_dump_rules_done, 2162 }; 2163 2164 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) { 2165 struct nft_rule_dump_ctx *ctx; 2166 2167 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 2168 if (!ctx) 2169 return -ENOMEM; 2170 2171 if (nla[NFTA_RULE_TABLE]) { 2172 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE], 2173 GFP_KERNEL); 2174 if (!ctx->table) { 2175 kfree(ctx); 2176 return -ENOMEM; 2177 } 2178 } 2179 if (nla[NFTA_RULE_CHAIN]) { 2180 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN], 2181 GFP_KERNEL); 2182 if (!ctx->chain) { 2183 kfree(ctx->table); 2184 kfree(ctx); 2185 return -ENOMEM; 2186 } 2187 } 2188 c.data = ctx; 2189 } 2190 2191 return netlink_dump_start(nlsk, skb, nlh, &c); 2192 } 2193 2194 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family, 2195 genmask); 2196 if (IS_ERR(table)) 2197 return PTR_ERR(table); 2198 2199 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask); 2200 if (IS_ERR(chain)) 2201 return PTR_ERR(chain); 2202 2203 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 2204 if (IS_ERR(rule)) 2205 return PTR_ERR(rule); 2206 2207 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 2208 if (!skb2) 2209 return -ENOMEM; 2210 2211 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid, 2212 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 2213 family, table, chain, rule); 2214 if (err < 0) 2215 goto err; 2216 2217 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 2218 2219 err: 2220 kfree_skb(skb2); 2221 return err; 2222 } 2223 2224 static void nf_tables_rule_destroy(const struct nft_ctx *ctx, 2225 struct nft_rule *rule) 2226 { 2227 struct nft_expr *expr; 2228 2229 /* 2230 * Careful: some expressions might not be initialized in case this 2231 * is called on error from nf_tables_newrule(). 2232 */ 2233 expr = nft_expr_first(rule); 2234 while (expr != nft_expr_last(rule) && expr->ops) { 2235 nf_tables_expr_destroy(ctx, expr); 2236 expr = nft_expr_next(expr); 2237 } 2238 kfree(rule); 2239 } 2240 2241 #define NFT_RULE_MAXEXPRS 128 2242 2243 static struct nft_expr_info *info; 2244 2245 static int nf_tables_newrule(struct net *net, struct sock *nlsk, 2246 struct sk_buff *skb, const struct nlmsghdr *nlh, 2247 const struct nlattr * const nla[], 2248 struct netlink_ext_ack *extack) 2249 { 2250 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2251 u8 genmask = nft_genmask_next(net); 2252 int family = nfmsg->nfgen_family; 2253 struct nft_table *table; 2254 struct nft_chain *chain; 2255 struct nft_rule *rule, *old_rule = NULL; 2256 struct nft_userdata *udata; 2257 struct nft_trans *trans = NULL; 2258 struct nft_expr *expr; 2259 struct nft_ctx ctx; 2260 struct nlattr *tmp; 2261 unsigned int size, i, n, ulen = 0, usize = 0; 2262 int err, rem; 2263 bool create; 2264 u64 handle, pos_handle; 2265 2266 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; 2267 2268 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family, 2269 genmask); 2270 if (IS_ERR(table)) 2271 return PTR_ERR(table); 2272 2273 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask); 2274 if (IS_ERR(chain)) 2275 return PTR_ERR(chain); 2276 2277 if (nla[NFTA_RULE_HANDLE]) { 2278 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 2279 rule = __nf_tables_rule_lookup(chain, handle); 2280 if (IS_ERR(rule)) 2281 return PTR_ERR(rule); 2282 2283 if (nlh->nlmsg_flags & NLM_F_EXCL) 2284 return -EEXIST; 2285 if (nlh->nlmsg_flags & NLM_F_REPLACE) 2286 old_rule = rule; 2287 else 2288 return -EOPNOTSUPP; 2289 } else { 2290 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE) 2291 return -EINVAL; 2292 handle = nf_tables_alloc_handle(table); 2293 2294 if (chain->use == UINT_MAX) 2295 return -EOVERFLOW; 2296 } 2297 2298 if (nla[NFTA_RULE_POSITION]) { 2299 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) 2300 return -EOPNOTSUPP; 2301 2302 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 2303 old_rule = __nf_tables_rule_lookup(chain, pos_handle); 2304 if (IS_ERR(old_rule)) 2305 return PTR_ERR(old_rule); 2306 } 2307 2308 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); 2309 2310 n = 0; 2311 size = 0; 2312 if (nla[NFTA_RULE_EXPRESSIONS]) { 2313 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 2314 err = -EINVAL; 2315 if (nla_type(tmp) != NFTA_LIST_ELEM) 2316 goto err1; 2317 if (n == NFT_RULE_MAXEXPRS) 2318 goto err1; 2319 err = nf_tables_expr_parse(&ctx, tmp, &info[n]); 2320 if (err < 0) 2321 goto err1; 2322 size += info[n].ops->size; 2323 n++; 2324 } 2325 } 2326 /* Check for overflow of dlen field */ 2327 err = -EFBIG; 2328 if (size >= 1 << 12) 2329 goto err1; 2330 2331 if (nla[NFTA_RULE_USERDATA]) { 2332 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 2333 if (ulen > 0) 2334 usize = sizeof(struct nft_userdata) + ulen; 2335 } 2336 2337 err = -ENOMEM; 2338 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL); 2339 if (rule == NULL) 2340 goto err1; 2341 2342 nft_activate_next(net, rule); 2343 2344 rule->handle = handle; 2345 rule->dlen = size; 2346 rule->udata = ulen ? 1 : 0; 2347 2348 if (ulen) { 2349 udata = nft_userdata(rule); 2350 udata->len = ulen - 1; 2351 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 2352 } 2353 2354 expr = nft_expr_first(rule); 2355 for (i = 0; i < n; i++) { 2356 err = nf_tables_newexpr(&ctx, &info[i], expr); 2357 if (err < 0) 2358 goto err2; 2359 info[i].ops = NULL; 2360 expr = nft_expr_next(expr); 2361 } 2362 2363 if (nlh->nlmsg_flags & NLM_F_REPLACE) { 2364 if (!nft_is_active_next(net, old_rule)) { 2365 err = -ENOENT; 2366 goto err2; 2367 } 2368 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE, 2369 old_rule); 2370 if (trans == NULL) { 2371 err = -ENOMEM; 2372 goto err2; 2373 } 2374 nft_deactivate_next(net, old_rule); 2375 chain->use--; 2376 2377 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) { 2378 err = -ENOMEM; 2379 goto err2; 2380 } 2381 2382 list_add_tail_rcu(&rule->list, &old_rule->list); 2383 } else { 2384 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) { 2385 err = -ENOMEM; 2386 goto err2; 2387 } 2388 2389 if (nlh->nlmsg_flags & NLM_F_APPEND) { 2390 if (old_rule) 2391 list_add_rcu(&rule->list, &old_rule->list); 2392 else 2393 list_add_tail_rcu(&rule->list, &chain->rules); 2394 } else { 2395 if (old_rule) 2396 list_add_tail_rcu(&rule->list, &old_rule->list); 2397 else 2398 list_add_rcu(&rule->list, &chain->rules); 2399 } 2400 } 2401 chain->use++; 2402 return 0; 2403 2404 err2: 2405 nf_tables_rule_destroy(&ctx, rule); 2406 err1: 2407 for (i = 0; i < n; i++) { 2408 if (info[i].ops != NULL) 2409 module_put(info[i].ops->type->owner); 2410 } 2411 return err; 2412 } 2413 2414 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 2415 const struct nlattr *nla) 2416 { 2417 u32 id = ntohl(nla_get_be32(nla)); 2418 struct nft_trans *trans; 2419 2420 list_for_each_entry(trans, &net->nft.commit_list, list) { 2421 struct nft_rule *rule = nft_trans_rule(trans); 2422 2423 if (trans->msg_type == NFT_MSG_NEWRULE && 2424 id == nft_trans_rule_id(trans)) 2425 return rule; 2426 } 2427 return ERR_PTR(-ENOENT); 2428 } 2429 2430 static int nf_tables_delrule(struct net *net, struct sock *nlsk, 2431 struct sk_buff *skb, const struct nlmsghdr *nlh, 2432 const struct nlattr * const nla[], 2433 struct netlink_ext_ack *extack) 2434 { 2435 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2436 u8 genmask = nft_genmask_next(net); 2437 struct nft_table *table; 2438 struct nft_chain *chain = NULL; 2439 struct nft_rule *rule; 2440 int family = nfmsg->nfgen_family, err = 0; 2441 struct nft_ctx ctx; 2442 2443 table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family, 2444 genmask); 2445 if (IS_ERR(table)) 2446 return PTR_ERR(table); 2447 2448 if (nla[NFTA_RULE_CHAIN]) { 2449 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], 2450 genmask); 2451 if (IS_ERR(chain)) 2452 return PTR_ERR(chain); 2453 } 2454 2455 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla); 2456 2457 if (chain) { 2458 if (nla[NFTA_RULE_HANDLE]) { 2459 rule = nf_tables_rule_lookup(chain, 2460 nla[NFTA_RULE_HANDLE]); 2461 if (IS_ERR(rule)) 2462 return PTR_ERR(rule); 2463 2464 err = nft_delrule(&ctx, rule); 2465 } else if (nla[NFTA_RULE_ID]) { 2466 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]); 2467 if (IS_ERR(rule)) 2468 return PTR_ERR(rule); 2469 2470 err = nft_delrule(&ctx, rule); 2471 } else { 2472 err = nft_delrule_by_chain(&ctx); 2473 } 2474 } else { 2475 list_for_each_entry(chain, &table->chains, list) { 2476 if (!nft_is_active_next(net, chain)) 2477 continue; 2478 2479 ctx.chain = chain; 2480 err = nft_delrule_by_chain(&ctx); 2481 if (err < 0) 2482 break; 2483 } 2484 } 2485 2486 return err; 2487 } 2488 2489 /* 2490 * Sets 2491 */ 2492 2493 static LIST_HEAD(nf_tables_set_types); 2494 2495 int nft_register_set(struct nft_set_type *type) 2496 { 2497 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2498 list_add_tail_rcu(&type->list, &nf_tables_set_types); 2499 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2500 return 0; 2501 } 2502 EXPORT_SYMBOL_GPL(nft_register_set); 2503 2504 void nft_unregister_set(struct nft_set_type *type) 2505 { 2506 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2507 list_del_rcu(&type->list); 2508 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2509 } 2510 EXPORT_SYMBOL_GPL(nft_unregister_set); 2511 2512 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ 2513 NFT_SET_TIMEOUT | NFT_SET_OBJECT) 2514 2515 static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags) 2516 { 2517 if ((flags & NFT_SET_EVAL) && !ops->update) 2518 return false; 2519 2520 return (flags & ops->features) == (flags & NFT_SET_FEATURES); 2521 } 2522 2523 /* 2524 * Select a set implementation based on the data characteristics and the 2525 * given policy. The total memory use might not be known if no size is 2526 * given, in that case the amount of memory per element is used. 2527 */ 2528 static const struct nft_set_ops * 2529 nft_select_set_ops(const struct nft_ctx *ctx, 2530 const struct nlattr * const nla[], 2531 const struct nft_set_desc *desc, 2532 enum nft_set_policies policy) 2533 { 2534 const struct nft_set_ops *ops, *bops; 2535 struct nft_set_estimate est, best; 2536 const struct nft_set_type *type; 2537 u32 flags = 0; 2538 2539 #ifdef CONFIG_MODULES 2540 if (list_empty(&nf_tables_set_types)) { 2541 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2542 request_module("nft-set"); 2543 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2544 if (!list_empty(&nf_tables_set_types)) 2545 return ERR_PTR(-EAGAIN); 2546 } 2547 #endif 2548 if (nla[NFTA_SET_FLAGS] != NULL) 2549 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 2550 2551 bops = NULL; 2552 best.size = ~0; 2553 best.lookup = ~0; 2554 best.space = ~0; 2555 2556 list_for_each_entry(type, &nf_tables_set_types, list) { 2557 if (!type->select_ops) 2558 ops = type->ops; 2559 else 2560 ops = type->select_ops(ctx, desc, flags); 2561 if (!ops) 2562 continue; 2563 2564 if (!nft_set_ops_candidate(ops, flags)) 2565 continue; 2566 if (!ops->estimate(desc, flags, &est)) 2567 continue; 2568 2569 switch (policy) { 2570 case NFT_SET_POL_PERFORMANCE: 2571 if (est.lookup < best.lookup) 2572 break; 2573 if (est.lookup == best.lookup && 2574 est.space < best.space) 2575 break; 2576 continue; 2577 case NFT_SET_POL_MEMORY: 2578 if (!desc->size) { 2579 if (est.space < best.space) 2580 break; 2581 if (est.space == best.space && 2582 est.lookup < best.lookup) 2583 break; 2584 } else if (est.size < best.size || !bops) { 2585 break; 2586 } 2587 continue; 2588 default: 2589 break; 2590 } 2591 2592 if (!try_module_get(type->owner)) 2593 continue; 2594 if (bops != NULL) 2595 module_put(bops->type->owner); 2596 2597 bops = ops; 2598 best = est; 2599 } 2600 2601 if (bops != NULL) 2602 return bops; 2603 2604 return ERR_PTR(-EOPNOTSUPP); 2605 } 2606 2607 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 2608 [NFTA_SET_TABLE] = { .type = NLA_STRING, 2609 .len = NFT_TABLE_MAXNAMELEN - 1 }, 2610 [NFTA_SET_NAME] = { .type = NLA_STRING, 2611 .len = NFT_SET_MAXNAMELEN - 1 }, 2612 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 2613 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 2614 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 2615 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 2616 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 2617 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 2618 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 2619 [NFTA_SET_ID] = { .type = NLA_U32 }, 2620 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 2621 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 2622 [NFTA_SET_USERDATA] = { .type = NLA_BINARY, 2623 .len = NFT_USERDATA_MAXLEN }, 2624 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, 2625 [NFTA_SET_HANDLE] = { .type = NLA_U64 }, 2626 }; 2627 2628 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 2629 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 2630 }; 2631 2632 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net, 2633 const struct sk_buff *skb, 2634 const struct nlmsghdr *nlh, 2635 const struct nlattr * const nla[], 2636 u8 genmask) 2637 { 2638 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2639 int family = nfmsg->nfgen_family; 2640 struct nft_table *table = NULL; 2641 2642 if (nla[NFTA_SET_TABLE] != NULL) { 2643 table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], 2644 family, genmask); 2645 if (IS_ERR(table)) 2646 return PTR_ERR(table); 2647 } 2648 2649 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla); 2650 return 0; 2651 } 2652 2653 static struct nft_set *nf_tables_set_lookup(const struct nft_table *table, 2654 const struct nlattr *nla, u8 genmask) 2655 { 2656 struct nft_set *set; 2657 2658 if (nla == NULL) 2659 return ERR_PTR(-EINVAL); 2660 2661 list_for_each_entry(set, &table->sets, list) { 2662 if (!nla_strcmp(nla, set->name) && 2663 nft_active_genmask(set, genmask)) 2664 return set; 2665 } 2666 return ERR_PTR(-ENOENT); 2667 } 2668 2669 static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *table, 2670 const struct nlattr *nla, u8 genmask) 2671 { 2672 struct nft_set *set; 2673 2674 if (nla == NULL) 2675 return ERR_PTR(-EINVAL); 2676 2677 list_for_each_entry(set, &table->sets, list) { 2678 if (be64_to_cpu(nla_get_be64(nla)) == set->handle && 2679 nft_active_genmask(set, genmask)) 2680 return set; 2681 } 2682 return ERR_PTR(-ENOENT); 2683 } 2684 2685 static struct nft_set *nf_tables_set_lookup_byid(const struct net *net, 2686 const struct nlattr *nla, 2687 u8 genmask) 2688 { 2689 struct nft_trans *trans; 2690 u32 id = ntohl(nla_get_be32(nla)); 2691 2692 list_for_each_entry(trans, &net->nft.commit_list, list) { 2693 struct nft_set *set = nft_trans_set(trans); 2694 2695 if (trans->msg_type == NFT_MSG_NEWSET && 2696 id == nft_trans_set_id(trans) && 2697 nft_active_genmask(set, genmask)) 2698 return set; 2699 } 2700 return ERR_PTR(-ENOENT); 2701 } 2702 2703 struct nft_set *nft_set_lookup_global(const struct net *net, 2704 const struct nft_table *table, 2705 const struct nlattr *nla_set_name, 2706 const struct nlattr *nla_set_id, 2707 u8 genmask) 2708 { 2709 struct nft_set *set; 2710 2711 set = nf_tables_set_lookup(table, nla_set_name, genmask); 2712 if (IS_ERR(set)) { 2713 if (!nla_set_id) 2714 return set; 2715 2716 set = nf_tables_set_lookup_byid(net, nla_set_id, genmask); 2717 } 2718 return set; 2719 } 2720 EXPORT_SYMBOL_GPL(nft_set_lookup_global); 2721 2722 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 2723 const char *name) 2724 { 2725 const struct nft_set *i; 2726 const char *p; 2727 unsigned long *inuse; 2728 unsigned int n = 0, min = 0; 2729 2730 p = strchr(name, '%'); 2731 if (p != NULL) { 2732 if (p[1] != 'd' || strchr(p + 2, '%')) 2733 return -EINVAL; 2734 2735 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 2736 if (inuse == NULL) 2737 return -ENOMEM; 2738 cont: 2739 list_for_each_entry(i, &ctx->table->sets, list) { 2740 int tmp; 2741 2742 if (!nft_is_active_next(ctx->net, set)) 2743 continue; 2744 if (!sscanf(i->name, name, &tmp)) 2745 continue; 2746 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 2747 continue; 2748 2749 set_bit(tmp - min, inuse); 2750 } 2751 2752 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 2753 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 2754 min += BITS_PER_BYTE * PAGE_SIZE; 2755 memset(inuse, 0, PAGE_SIZE); 2756 goto cont; 2757 } 2758 free_page((unsigned long)inuse); 2759 } 2760 2761 set->name = kasprintf(GFP_KERNEL, name, min + n); 2762 if (!set->name) 2763 return -ENOMEM; 2764 2765 list_for_each_entry(i, &ctx->table->sets, list) { 2766 if (!nft_is_active_next(ctx->net, i)) 2767 continue; 2768 if (!strcmp(set->name, i->name)) { 2769 kfree(set->name); 2770 return -ENFILE; 2771 } 2772 } 2773 return 0; 2774 } 2775 2776 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 2777 const struct nft_set *set, u16 event, u16 flags) 2778 { 2779 struct nfgenmsg *nfmsg; 2780 struct nlmsghdr *nlh; 2781 struct nlattr *desc; 2782 u32 portid = ctx->portid; 2783 u32 seq = ctx->seq; 2784 2785 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 2786 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 2787 flags); 2788 if (nlh == NULL) 2789 goto nla_put_failure; 2790 2791 nfmsg = nlmsg_data(nlh); 2792 nfmsg->nfgen_family = ctx->family; 2793 nfmsg->version = NFNETLINK_V0; 2794 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); 2795 2796 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 2797 goto nla_put_failure; 2798 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 2799 goto nla_put_failure; 2800 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), 2801 NFTA_SET_PAD)) 2802 goto nla_put_failure; 2803 if (set->flags != 0) 2804 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 2805 goto nla_put_failure; 2806 2807 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 2808 goto nla_put_failure; 2809 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 2810 goto nla_put_failure; 2811 if (set->flags & NFT_SET_MAP) { 2812 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 2813 goto nla_put_failure; 2814 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 2815 goto nla_put_failure; 2816 } 2817 if (set->flags & NFT_SET_OBJECT && 2818 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype))) 2819 goto nla_put_failure; 2820 2821 if (set->timeout && 2822 nla_put_be64(skb, NFTA_SET_TIMEOUT, 2823 cpu_to_be64(jiffies_to_msecs(set->timeout)), 2824 NFTA_SET_PAD)) 2825 goto nla_put_failure; 2826 if (set->gc_int && 2827 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int))) 2828 goto nla_put_failure; 2829 2830 if (set->policy != NFT_SET_POL_PERFORMANCE) { 2831 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 2832 goto nla_put_failure; 2833 } 2834 2835 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) 2836 goto nla_put_failure; 2837 2838 desc = nla_nest_start(skb, NFTA_SET_DESC); 2839 if (desc == NULL) 2840 goto nla_put_failure; 2841 if (set->size && 2842 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) 2843 goto nla_put_failure; 2844 nla_nest_end(skb, desc); 2845 2846 nlmsg_end(skb, nlh); 2847 return 0; 2848 2849 nla_put_failure: 2850 nlmsg_trim(skb, nlh); 2851 return -1; 2852 } 2853 2854 static void nf_tables_set_notify(const struct nft_ctx *ctx, 2855 const struct nft_set *set, int event, 2856 gfp_t gfp_flags) 2857 { 2858 struct sk_buff *skb; 2859 u32 portid = ctx->portid; 2860 int err; 2861 2862 if (!ctx->report && 2863 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 2864 return; 2865 2866 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 2867 if (skb == NULL) 2868 goto err; 2869 2870 err = nf_tables_fill_set(skb, ctx, set, event, 0); 2871 if (err < 0) { 2872 kfree_skb(skb); 2873 goto err; 2874 } 2875 2876 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report, 2877 gfp_flags); 2878 return; 2879 err: 2880 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 2881 } 2882 2883 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 2884 { 2885 const struct nft_set *set; 2886 unsigned int idx, s_idx = cb->args[0]; 2887 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 2888 struct net *net = sock_net(skb->sk); 2889 struct nft_ctx *ctx = cb->data, ctx_set; 2890 2891 if (cb->args[1]) 2892 return skb->len; 2893 2894 rcu_read_lock(); 2895 cb->seq = net->nft.base_seq; 2896 2897 list_for_each_entry_rcu(table, &net->nft.tables, list) { 2898 if (ctx->family != NFPROTO_UNSPEC && 2899 ctx->family != table->family) 2900 continue; 2901 2902 if (ctx->table && ctx->table != table) 2903 continue; 2904 2905 if (cur_table) { 2906 if (cur_table != table) 2907 continue; 2908 2909 cur_table = NULL; 2910 } 2911 idx = 0; 2912 list_for_each_entry_rcu(set, &table->sets, list) { 2913 if (idx < s_idx) 2914 goto cont; 2915 if (!nft_is_active(net, set)) 2916 goto cont; 2917 2918 ctx_set = *ctx; 2919 ctx_set.table = table; 2920 ctx_set.family = table->family; 2921 2922 if (nf_tables_fill_set(skb, &ctx_set, set, 2923 NFT_MSG_NEWSET, 2924 NLM_F_MULTI) < 0) { 2925 cb->args[0] = idx; 2926 cb->args[2] = (unsigned long) table; 2927 goto done; 2928 } 2929 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 2930 cont: 2931 idx++; 2932 } 2933 if (s_idx) 2934 s_idx = 0; 2935 } 2936 cb->args[1] = 1; 2937 done: 2938 rcu_read_unlock(); 2939 return skb->len; 2940 } 2941 2942 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 2943 { 2944 kfree(cb->data); 2945 return 0; 2946 } 2947 2948 static int nf_tables_getset(struct net *net, struct sock *nlsk, 2949 struct sk_buff *skb, const struct nlmsghdr *nlh, 2950 const struct nlattr * const nla[], 2951 struct netlink_ext_ack *extack) 2952 { 2953 u8 genmask = nft_genmask_cur(net); 2954 const struct nft_set *set; 2955 struct nft_ctx ctx; 2956 struct sk_buff *skb2; 2957 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 2958 int err; 2959 2960 /* Verify existence before starting dump */ 2961 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask); 2962 if (err < 0) 2963 return err; 2964 2965 if (nlh->nlmsg_flags & NLM_F_DUMP) { 2966 struct netlink_dump_control c = { 2967 .dump = nf_tables_dump_sets, 2968 .done = nf_tables_dump_sets_done, 2969 }; 2970 struct nft_ctx *ctx_dump; 2971 2972 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL); 2973 if (ctx_dump == NULL) 2974 return -ENOMEM; 2975 2976 *ctx_dump = ctx; 2977 c.data = ctx_dump; 2978 2979 return netlink_dump_start(nlsk, skb, nlh, &c); 2980 } 2981 2982 /* Only accept unspec with dump */ 2983 if (nfmsg->nfgen_family == NFPROTO_UNSPEC) 2984 return -EAFNOSUPPORT; 2985 if (!nla[NFTA_SET_TABLE]) 2986 return -EINVAL; 2987 2988 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask); 2989 if (IS_ERR(set)) 2990 return PTR_ERR(set); 2991 2992 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 2993 if (skb2 == NULL) 2994 return -ENOMEM; 2995 2996 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 2997 if (err < 0) 2998 goto err; 2999 3000 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 3001 3002 err: 3003 kfree_skb(skb2); 3004 return err; 3005 } 3006 3007 static int nf_tables_set_desc_parse(const struct nft_ctx *ctx, 3008 struct nft_set_desc *desc, 3009 const struct nlattr *nla) 3010 { 3011 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 3012 int err; 3013 3014 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla, 3015 nft_set_desc_policy, NULL); 3016 if (err < 0) 3017 return err; 3018 3019 if (da[NFTA_SET_DESC_SIZE] != NULL) 3020 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 3021 3022 return 0; 3023 } 3024 3025 static int nf_tables_newset(struct net *net, struct sock *nlsk, 3026 struct sk_buff *skb, const struct nlmsghdr *nlh, 3027 const struct nlattr * const nla[], 3028 struct netlink_ext_ack *extack) 3029 { 3030 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 3031 u8 genmask = nft_genmask_next(net); 3032 int family = nfmsg->nfgen_family; 3033 const struct nft_set_ops *ops; 3034 struct nft_table *table; 3035 struct nft_set *set; 3036 struct nft_ctx ctx; 3037 char *name; 3038 unsigned int size; 3039 bool create; 3040 u64 timeout; 3041 u32 ktype, dtype, flags, policy, gc_int, objtype; 3042 struct nft_set_desc desc; 3043 unsigned char *udata; 3044 u16 udlen; 3045 int err; 3046 3047 if (nla[NFTA_SET_TABLE] == NULL || 3048 nla[NFTA_SET_NAME] == NULL || 3049 nla[NFTA_SET_KEY_LEN] == NULL || 3050 nla[NFTA_SET_ID] == NULL) 3051 return -EINVAL; 3052 3053 memset(&desc, 0, sizeof(desc)); 3054 3055 ktype = NFT_DATA_VALUE; 3056 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 3057 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 3058 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 3059 return -EINVAL; 3060 } 3061 3062 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 3063 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 3064 return -EINVAL; 3065 3066 flags = 0; 3067 if (nla[NFTA_SET_FLAGS] != NULL) { 3068 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 3069 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 3070 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 3071 NFT_SET_MAP | NFT_SET_EVAL | 3072 NFT_SET_OBJECT)) 3073 return -EINVAL; 3074 /* Only one of these operations is supported */ 3075 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) == 3076 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) 3077 return -EOPNOTSUPP; 3078 } 3079 3080 dtype = 0; 3081 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 3082 if (!(flags & NFT_SET_MAP)) 3083 return -EINVAL; 3084 3085 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 3086 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 3087 dtype != NFT_DATA_VERDICT) 3088 return -EINVAL; 3089 3090 if (dtype != NFT_DATA_VERDICT) { 3091 if (nla[NFTA_SET_DATA_LEN] == NULL) 3092 return -EINVAL; 3093 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 3094 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 3095 return -EINVAL; 3096 } else 3097 desc.dlen = sizeof(struct nft_verdict); 3098 } else if (flags & NFT_SET_MAP) 3099 return -EINVAL; 3100 3101 if (nla[NFTA_SET_OBJ_TYPE] != NULL) { 3102 if (!(flags & NFT_SET_OBJECT)) 3103 return -EINVAL; 3104 3105 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE])); 3106 if (objtype == NFT_OBJECT_UNSPEC || 3107 objtype > NFT_OBJECT_MAX) 3108 return -EINVAL; 3109 } else if (flags & NFT_SET_OBJECT) 3110 return -EINVAL; 3111 else 3112 objtype = NFT_OBJECT_UNSPEC; 3113 3114 timeout = 0; 3115 if (nla[NFTA_SET_TIMEOUT] != NULL) { 3116 if (!(flags & NFT_SET_TIMEOUT)) 3117 return -EINVAL; 3118 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64( 3119 nla[NFTA_SET_TIMEOUT]))); 3120 } 3121 gc_int = 0; 3122 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 3123 if (!(flags & NFT_SET_TIMEOUT)) 3124 return -EINVAL; 3125 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 3126 } 3127 3128 policy = NFT_SET_POL_PERFORMANCE; 3129 if (nla[NFTA_SET_POLICY] != NULL) 3130 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 3131 3132 if (nla[NFTA_SET_DESC] != NULL) { 3133 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]); 3134 if (err < 0) 3135 return err; 3136 } 3137 3138 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false; 3139 3140 table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], family, 3141 genmask); 3142 if (IS_ERR(table)) 3143 return PTR_ERR(table); 3144 3145 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); 3146 3147 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask); 3148 if (IS_ERR(set)) { 3149 if (PTR_ERR(set) != -ENOENT) 3150 return PTR_ERR(set); 3151 } else { 3152 if (nlh->nlmsg_flags & NLM_F_EXCL) 3153 return -EEXIST; 3154 if (nlh->nlmsg_flags & NLM_F_REPLACE) 3155 return -EOPNOTSUPP; 3156 return 0; 3157 } 3158 3159 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) 3160 return -ENOENT; 3161 3162 ops = nft_select_set_ops(&ctx, nla, &desc, policy); 3163 if (IS_ERR(ops)) 3164 return PTR_ERR(ops); 3165 3166 udlen = 0; 3167 if (nla[NFTA_SET_USERDATA]) 3168 udlen = nla_len(nla[NFTA_SET_USERDATA]); 3169 3170 size = 0; 3171 if (ops->privsize != NULL) 3172 size = ops->privsize(nla, &desc); 3173 3174 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL); 3175 if (!set) { 3176 err = -ENOMEM; 3177 goto err1; 3178 } 3179 3180 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL); 3181 if (!name) { 3182 err = -ENOMEM; 3183 goto err2; 3184 } 3185 3186 err = nf_tables_set_alloc_name(&ctx, set, name); 3187 kfree(name); 3188 if (err < 0) 3189 goto err2; 3190 3191 udata = NULL; 3192 if (udlen) { 3193 udata = set->data + size; 3194 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen); 3195 } 3196 3197 INIT_LIST_HEAD(&set->bindings); 3198 set->ops = ops; 3199 set->ktype = ktype; 3200 set->klen = desc.klen; 3201 set->dtype = dtype; 3202 set->objtype = objtype; 3203 set->dlen = desc.dlen; 3204 set->flags = flags; 3205 set->size = desc.size; 3206 set->policy = policy; 3207 set->udlen = udlen; 3208 set->udata = udata; 3209 set->timeout = timeout; 3210 set->gc_int = gc_int; 3211 set->handle = nf_tables_alloc_handle(table); 3212 3213 err = ops->init(set, &desc, nla); 3214 if (err < 0) 3215 goto err3; 3216 3217 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 3218 if (err < 0) 3219 goto err4; 3220 3221 list_add_tail_rcu(&set->list, &table->sets); 3222 table->use++; 3223 return 0; 3224 3225 err4: 3226 ops->destroy(set); 3227 err3: 3228 kfree(set->name); 3229 err2: 3230 kvfree(set); 3231 err1: 3232 module_put(ops->type->owner); 3233 return err; 3234 } 3235 3236 static void nft_set_destroy(struct nft_set *set) 3237 { 3238 set->ops->destroy(set); 3239 module_put(set->ops->type->owner); 3240 kfree(set->name); 3241 kvfree(set); 3242 } 3243 3244 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 3245 { 3246 list_del_rcu(&set->list); 3247 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC); 3248 nft_set_destroy(set); 3249 } 3250 3251 static int nf_tables_delset(struct net *net, struct sock *nlsk, 3252 struct sk_buff *skb, const struct nlmsghdr *nlh, 3253 const struct nlattr * const nla[], 3254 struct netlink_ext_ack *extack) 3255 { 3256 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 3257 u8 genmask = nft_genmask_next(net); 3258 struct nft_set *set; 3259 struct nft_ctx ctx; 3260 int err; 3261 3262 if (nfmsg->nfgen_family == NFPROTO_UNSPEC) 3263 return -EAFNOSUPPORT; 3264 if (nla[NFTA_SET_TABLE] == NULL) 3265 return -EINVAL; 3266 3267 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask); 3268 if (err < 0) 3269 return err; 3270 3271 if (nla[NFTA_SET_HANDLE]) 3272 set = nf_tables_set_lookup_byhandle(ctx.table, nla[NFTA_SET_HANDLE], genmask); 3273 else 3274 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask); 3275 if (IS_ERR(set)) 3276 return PTR_ERR(set); 3277 3278 if (!list_empty(&set->bindings) || 3279 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) 3280 return -EBUSY; 3281 3282 return nft_delset(&ctx, set); 3283 } 3284 3285 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 3286 struct nft_set *set, 3287 const struct nft_set_iter *iter, 3288 struct nft_set_elem *elem) 3289 { 3290 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 3291 enum nft_registers dreg; 3292 3293 dreg = nft_type_to_reg(set->dtype); 3294 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 3295 set->dtype == NFT_DATA_VERDICT ? 3296 NFT_DATA_VERDICT : NFT_DATA_VALUE, 3297 set->dlen); 3298 } 3299 3300 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 3301 struct nft_set_binding *binding) 3302 { 3303 struct nft_set_binding *i; 3304 struct nft_set_iter iter; 3305 3306 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set)) 3307 return -EBUSY; 3308 3309 if (binding->flags & NFT_SET_MAP) { 3310 /* If the set is already bound to the same chain all 3311 * jumps are already validated for that chain. 3312 */ 3313 list_for_each_entry(i, &set->bindings, list) { 3314 if (i->flags & NFT_SET_MAP && 3315 i->chain == binding->chain) 3316 goto bind; 3317 } 3318 3319 iter.genmask = nft_genmask_next(ctx->net); 3320 iter.skip = 0; 3321 iter.count = 0; 3322 iter.err = 0; 3323 iter.fn = nf_tables_bind_check_setelem; 3324 3325 set->ops->walk(ctx, set, &iter); 3326 if (iter.err < 0) 3327 return iter.err; 3328 } 3329 bind: 3330 binding->chain = ctx->chain; 3331 list_add_tail_rcu(&binding->list, &set->bindings); 3332 return 0; 3333 } 3334 EXPORT_SYMBOL_GPL(nf_tables_bind_set); 3335 3336 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 3337 struct nft_set_binding *binding) 3338 { 3339 list_del_rcu(&binding->list); 3340 3341 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) && 3342 nft_is_active(ctx->net, set)) 3343 nf_tables_set_destroy(ctx, set); 3344 } 3345 EXPORT_SYMBOL_GPL(nf_tables_unbind_set); 3346 3347 const struct nft_set_ext_type nft_set_ext_types[] = { 3348 [NFT_SET_EXT_KEY] = { 3349 .align = __alignof__(u32), 3350 }, 3351 [NFT_SET_EXT_DATA] = { 3352 .align = __alignof__(u32), 3353 }, 3354 [NFT_SET_EXT_EXPR] = { 3355 .align = __alignof__(struct nft_expr), 3356 }, 3357 [NFT_SET_EXT_OBJREF] = { 3358 .len = sizeof(struct nft_object *), 3359 .align = __alignof__(struct nft_object *), 3360 }, 3361 [NFT_SET_EXT_FLAGS] = { 3362 .len = sizeof(u8), 3363 .align = __alignof__(u8), 3364 }, 3365 [NFT_SET_EXT_TIMEOUT] = { 3366 .len = sizeof(u64), 3367 .align = __alignof__(u64), 3368 }, 3369 [NFT_SET_EXT_EXPIRATION] = { 3370 .len = sizeof(unsigned long), 3371 .align = __alignof__(unsigned long), 3372 }, 3373 [NFT_SET_EXT_USERDATA] = { 3374 .len = sizeof(struct nft_userdata), 3375 .align = __alignof__(struct nft_userdata), 3376 }, 3377 }; 3378 EXPORT_SYMBOL_GPL(nft_set_ext_types); 3379 3380 /* 3381 * Set elements 3382 */ 3383 3384 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 3385 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 3386 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 3387 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 3388 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 3389 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 3390 .len = NFT_USERDATA_MAXLEN }, 3391 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, 3392 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING }, 3393 }; 3394 3395 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 3396 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING, 3397 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3398 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING, 3399 .len = NFT_SET_MAXNAMELEN - 1 }, 3400 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED }, 3401 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 3402 }; 3403 3404 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net, 3405 const struct sk_buff *skb, 3406 const struct nlmsghdr *nlh, 3407 const struct nlattr * const nla[], 3408 u8 genmask) 3409 { 3410 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 3411 int family = nfmsg->nfgen_family; 3412 struct nft_table *table; 3413 3414 table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], 3415 family, genmask); 3416 if (IS_ERR(table)) 3417 return PTR_ERR(table); 3418 3419 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla); 3420 return 0; 3421 } 3422 3423 static int nf_tables_fill_setelem(struct sk_buff *skb, 3424 const struct nft_set *set, 3425 const struct nft_set_elem *elem) 3426 { 3427 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 3428 unsigned char *b = skb_tail_pointer(skb); 3429 struct nlattr *nest; 3430 3431 nest = nla_nest_start(skb, NFTA_LIST_ELEM); 3432 if (nest == NULL) 3433 goto nla_put_failure; 3434 3435 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 3436 NFT_DATA_VALUE, set->klen) < 0) 3437 goto nla_put_failure; 3438 3439 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 3440 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 3441 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, 3442 set->dlen) < 0) 3443 goto nla_put_failure; 3444 3445 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) && 3446 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0) 3447 goto nla_put_failure; 3448 3449 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 3450 nla_put_string(skb, NFTA_SET_ELEM_OBJREF, 3451 (*nft_set_ext_obj(ext))->name) < 0) 3452 goto nla_put_failure; 3453 3454 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 3455 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 3456 htonl(*nft_set_ext_flags(ext)))) 3457 goto nla_put_failure; 3458 3459 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) && 3460 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, 3461 cpu_to_be64(jiffies_to_msecs( 3462 *nft_set_ext_timeout(ext))), 3463 NFTA_SET_ELEM_PAD)) 3464 goto nla_put_failure; 3465 3466 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 3467 unsigned long expires, now = jiffies; 3468 3469 expires = *nft_set_ext_expiration(ext); 3470 if (time_before(now, expires)) 3471 expires -= now; 3472 else 3473 expires = 0; 3474 3475 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 3476 cpu_to_be64(jiffies_to_msecs(expires)), 3477 NFTA_SET_ELEM_PAD)) 3478 goto nla_put_failure; 3479 } 3480 3481 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 3482 struct nft_userdata *udata; 3483 3484 udata = nft_set_ext_userdata(ext); 3485 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 3486 udata->len + 1, udata->data)) 3487 goto nla_put_failure; 3488 } 3489 3490 nla_nest_end(skb, nest); 3491 return 0; 3492 3493 nla_put_failure: 3494 nlmsg_trim(skb, b); 3495 return -EMSGSIZE; 3496 } 3497 3498 struct nft_set_dump_args { 3499 const struct netlink_callback *cb; 3500 struct nft_set_iter iter; 3501 struct sk_buff *skb; 3502 }; 3503 3504 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 3505 struct nft_set *set, 3506 const struct nft_set_iter *iter, 3507 struct nft_set_elem *elem) 3508 { 3509 struct nft_set_dump_args *args; 3510 3511 args = container_of(iter, struct nft_set_dump_args, iter); 3512 return nf_tables_fill_setelem(args->skb, set, elem); 3513 } 3514 3515 struct nft_set_dump_ctx { 3516 const struct nft_set *set; 3517 struct nft_ctx ctx; 3518 }; 3519 3520 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 3521 { 3522 struct nft_set_dump_ctx *dump_ctx = cb->data; 3523 struct net *net = sock_net(skb->sk); 3524 struct nft_table *table; 3525 struct nft_set *set; 3526 struct nft_set_dump_args args; 3527 bool set_found = false; 3528 struct nfgenmsg *nfmsg; 3529 struct nlmsghdr *nlh; 3530 struct nlattr *nest; 3531 u32 portid, seq; 3532 int event; 3533 3534 rcu_read_lock(); 3535 list_for_each_entry_rcu(table, &net->nft.tables, list) { 3536 if (dump_ctx->ctx.family != NFPROTO_UNSPEC && 3537 dump_ctx->ctx.family != table->family) 3538 continue; 3539 3540 if (table != dump_ctx->ctx.table) 3541 continue; 3542 3543 list_for_each_entry_rcu(set, &table->sets, list) { 3544 if (set == dump_ctx->set) { 3545 set_found = true; 3546 break; 3547 } 3548 } 3549 break; 3550 } 3551 3552 if (!set_found) { 3553 rcu_read_unlock(); 3554 return -ENOENT; 3555 } 3556 3557 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM); 3558 portid = NETLINK_CB(cb->skb).portid; 3559 seq = cb->nlh->nlmsg_seq; 3560 3561 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 3562 NLM_F_MULTI); 3563 if (nlh == NULL) 3564 goto nla_put_failure; 3565 3566 nfmsg = nlmsg_data(nlh); 3567 nfmsg->nfgen_family = table->family; 3568 nfmsg->version = NFNETLINK_V0; 3569 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 3570 3571 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) 3572 goto nla_put_failure; 3573 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 3574 goto nla_put_failure; 3575 3576 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 3577 if (nest == NULL) 3578 goto nla_put_failure; 3579 3580 args.cb = cb; 3581 args.skb = skb; 3582 args.iter.genmask = nft_genmask_cur(net); 3583 args.iter.skip = cb->args[0]; 3584 args.iter.count = 0; 3585 args.iter.err = 0; 3586 args.iter.fn = nf_tables_dump_setelem; 3587 set->ops->walk(&dump_ctx->ctx, set, &args.iter); 3588 rcu_read_unlock(); 3589 3590 nla_nest_end(skb, nest); 3591 nlmsg_end(skb, nlh); 3592 3593 if (args.iter.err && args.iter.err != -EMSGSIZE) 3594 return args.iter.err; 3595 if (args.iter.count == cb->args[0]) 3596 return 0; 3597 3598 cb->args[0] = args.iter.count; 3599 return skb->len; 3600 3601 nla_put_failure: 3602 rcu_read_unlock(); 3603 return -ENOSPC; 3604 } 3605 3606 static int nf_tables_dump_set_done(struct netlink_callback *cb) 3607 { 3608 kfree(cb->data); 3609 return 0; 3610 } 3611 3612 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 3613 const struct nft_ctx *ctx, u32 seq, 3614 u32 portid, int event, u16 flags, 3615 const struct nft_set *set, 3616 const struct nft_set_elem *elem) 3617 { 3618 struct nfgenmsg *nfmsg; 3619 struct nlmsghdr *nlh; 3620 struct nlattr *nest; 3621 int err; 3622 3623 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 3624 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 3625 flags); 3626 if (nlh == NULL) 3627 goto nla_put_failure; 3628 3629 nfmsg = nlmsg_data(nlh); 3630 nfmsg->nfgen_family = ctx->family; 3631 nfmsg->version = NFNETLINK_V0; 3632 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); 3633 3634 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 3635 goto nla_put_failure; 3636 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 3637 goto nla_put_failure; 3638 3639 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 3640 if (nest == NULL) 3641 goto nla_put_failure; 3642 3643 err = nf_tables_fill_setelem(skb, set, elem); 3644 if (err < 0) 3645 goto nla_put_failure; 3646 3647 nla_nest_end(skb, nest); 3648 3649 nlmsg_end(skb, nlh); 3650 return 0; 3651 3652 nla_put_failure: 3653 nlmsg_trim(skb, nlh); 3654 return -1; 3655 } 3656 3657 static int nft_setelem_parse_flags(const struct nft_set *set, 3658 const struct nlattr *attr, u32 *flags) 3659 { 3660 if (attr == NULL) 3661 return 0; 3662 3663 *flags = ntohl(nla_get_be32(attr)); 3664 if (*flags & ~NFT_SET_ELEM_INTERVAL_END) 3665 return -EINVAL; 3666 if (!(set->flags & NFT_SET_INTERVAL) && 3667 *flags & NFT_SET_ELEM_INTERVAL_END) 3668 return -EINVAL; 3669 3670 return 0; 3671 } 3672 3673 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, 3674 const struct nlattr *attr) 3675 { 3676 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 3677 const struct nft_set_ext *ext; 3678 struct nft_data_desc desc; 3679 struct nft_set_elem elem; 3680 struct sk_buff *skb; 3681 uint32_t flags = 0; 3682 void *priv; 3683 int err; 3684 3685 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr, 3686 nft_set_elem_policy, NULL); 3687 if (err < 0) 3688 return err; 3689 3690 if (!nla[NFTA_SET_ELEM_KEY]) 3691 return -EINVAL; 3692 3693 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 3694 if (err < 0) 3695 return err; 3696 3697 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc, 3698 nla[NFTA_SET_ELEM_KEY]); 3699 if (err < 0) 3700 return err; 3701 3702 err = -EINVAL; 3703 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) 3704 return err; 3705 3706 priv = set->ops->get(ctx->net, set, &elem, flags); 3707 if (IS_ERR(priv)) 3708 return PTR_ERR(priv); 3709 3710 elem.priv = priv; 3711 ext = nft_set_elem_ext(set, &elem); 3712 3713 err = -ENOMEM; 3714 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3715 if (skb == NULL) 3716 goto err1; 3717 3718 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, 3719 NFT_MSG_NEWSETELEM, 0, set, &elem); 3720 if (err < 0) 3721 goto err2; 3722 3723 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT); 3724 /* This avoids a loop in nfnetlink. */ 3725 if (err < 0) 3726 goto err1; 3727 3728 return 0; 3729 err2: 3730 kfree_skb(skb); 3731 err1: 3732 /* this avoids a loop in nfnetlink. */ 3733 return err == -EAGAIN ? -ENOBUFS : err; 3734 } 3735 3736 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk, 3737 struct sk_buff *skb, const struct nlmsghdr *nlh, 3738 const struct nlattr * const nla[], 3739 struct netlink_ext_ack *extack) 3740 { 3741 u8 genmask = nft_genmask_cur(net); 3742 struct nft_set *set; 3743 struct nlattr *attr; 3744 struct nft_ctx ctx; 3745 int rem, err = 0; 3746 3747 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask); 3748 if (err < 0) 3749 return err; 3750 3751 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], 3752 genmask); 3753 if (IS_ERR(set)) 3754 return PTR_ERR(set); 3755 3756 if (nlh->nlmsg_flags & NLM_F_DUMP) { 3757 struct netlink_dump_control c = { 3758 .dump = nf_tables_dump_set, 3759 .done = nf_tables_dump_set_done, 3760 }; 3761 struct nft_set_dump_ctx *dump_ctx; 3762 3763 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL); 3764 if (!dump_ctx) 3765 return -ENOMEM; 3766 3767 dump_ctx->set = set; 3768 dump_ctx->ctx = ctx; 3769 3770 c.data = dump_ctx; 3771 return netlink_dump_start(nlsk, skb, nlh, &c); 3772 } 3773 3774 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 3775 return -EINVAL; 3776 3777 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 3778 err = nft_get_set_elem(&ctx, set, attr); 3779 if (err < 0) 3780 break; 3781 } 3782 3783 return err; 3784 } 3785 3786 static void nf_tables_setelem_notify(const struct nft_ctx *ctx, 3787 const struct nft_set *set, 3788 const struct nft_set_elem *elem, 3789 int event, u16 flags) 3790 { 3791 struct net *net = ctx->net; 3792 u32 portid = ctx->portid; 3793 struct sk_buff *skb; 3794 int err; 3795 3796 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 3797 return; 3798 3799 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3800 if (skb == NULL) 3801 goto err; 3802 3803 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 3804 set, elem); 3805 if (err < 0) { 3806 kfree_skb(skb); 3807 goto err; 3808 } 3809 3810 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report, 3811 GFP_KERNEL); 3812 return; 3813 err: 3814 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 3815 } 3816 3817 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx, 3818 int msg_type, 3819 struct nft_set *set) 3820 { 3821 struct nft_trans *trans; 3822 3823 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem)); 3824 if (trans == NULL) 3825 return NULL; 3826 3827 nft_trans_elem_set(trans) = set; 3828 return trans; 3829 } 3830 3831 void *nft_set_elem_init(const struct nft_set *set, 3832 const struct nft_set_ext_tmpl *tmpl, 3833 const u32 *key, const u32 *data, 3834 u64 timeout, gfp_t gfp) 3835 { 3836 struct nft_set_ext *ext; 3837 void *elem; 3838 3839 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 3840 if (elem == NULL) 3841 return NULL; 3842 3843 ext = nft_set_elem_ext(set, elem); 3844 nft_set_ext_init(ext, tmpl); 3845 3846 memcpy(nft_set_ext_key(ext), key, set->klen); 3847 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 3848 memcpy(nft_set_ext_data(ext), data, set->dlen); 3849 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) 3850 *nft_set_ext_expiration(ext) = 3851 jiffies + timeout; 3852 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) 3853 *nft_set_ext_timeout(ext) = timeout; 3854 3855 return elem; 3856 } 3857 3858 void nft_set_elem_destroy(const struct nft_set *set, void *elem, 3859 bool destroy_expr) 3860 { 3861 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 3862 3863 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE); 3864 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 3865 nft_data_release(nft_set_ext_data(ext), set->dtype); 3866 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) 3867 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext)); 3868 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 3869 (*nft_set_ext_obj(ext))->use--; 3870 kfree(elem); 3871 } 3872 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 3873 3874 /* Only called from commit path, nft_set_elem_deactivate() already deals with 3875 * the refcounting from the preparation phase. 3876 */ 3877 static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem) 3878 { 3879 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 3880 3881 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) 3882 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext)); 3883 kfree(elem); 3884 } 3885 3886 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 3887 const struct nlattr *attr, u32 nlmsg_flags) 3888 { 3889 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 3890 u8 genmask = nft_genmask_next(ctx->net); 3891 struct nft_data_desc d1, d2; 3892 struct nft_set_ext_tmpl tmpl; 3893 struct nft_set_ext *ext, *ext2; 3894 struct nft_set_elem elem; 3895 struct nft_set_binding *binding; 3896 struct nft_object *obj = NULL; 3897 struct nft_userdata *udata; 3898 struct nft_data data; 3899 enum nft_registers dreg; 3900 struct nft_trans *trans; 3901 u32 flags = 0; 3902 u64 timeout; 3903 u8 ulen; 3904 int err; 3905 3906 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr, 3907 nft_set_elem_policy, NULL); 3908 if (err < 0) 3909 return err; 3910 3911 if (nla[NFTA_SET_ELEM_KEY] == NULL) 3912 return -EINVAL; 3913 3914 nft_set_ext_prepare(&tmpl); 3915 3916 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 3917 if (err < 0) 3918 return err; 3919 if (flags != 0) 3920 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 3921 3922 if (set->flags & NFT_SET_MAP) { 3923 if (nla[NFTA_SET_ELEM_DATA] == NULL && 3924 !(flags & NFT_SET_ELEM_INTERVAL_END)) 3925 return -EINVAL; 3926 if (nla[NFTA_SET_ELEM_DATA] != NULL && 3927 flags & NFT_SET_ELEM_INTERVAL_END) 3928 return -EINVAL; 3929 } else { 3930 if (nla[NFTA_SET_ELEM_DATA] != NULL) 3931 return -EINVAL; 3932 } 3933 3934 timeout = 0; 3935 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 3936 if (!(set->flags & NFT_SET_TIMEOUT)) 3937 return -EINVAL; 3938 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64( 3939 nla[NFTA_SET_ELEM_TIMEOUT]))); 3940 } else if (set->flags & NFT_SET_TIMEOUT) { 3941 timeout = set->timeout; 3942 } 3943 3944 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1, 3945 nla[NFTA_SET_ELEM_KEY]); 3946 if (err < 0) 3947 goto err1; 3948 err = -EINVAL; 3949 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen) 3950 goto err2; 3951 3952 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len); 3953 if (timeout > 0) { 3954 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); 3955 if (timeout != set->timeout) 3956 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 3957 } 3958 3959 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { 3960 if (!(set->flags & NFT_SET_OBJECT)) { 3961 err = -EINVAL; 3962 goto err2; 3963 } 3964 obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF], 3965 set->objtype, genmask); 3966 if (IS_ERR(obj)) { 3967 err = PTR_ERR(obj); 3968 goto err2; 3969 } 3970 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); 3971 } 3972 3973 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 3974 err = nft_data_init(ctx, &data, sizeof(data), &d2, 3975 nla[NFTA_SET_ELEM_DATA]); 3976 if (err < 0) 3977 goto err2; 3978 3979 err = -EINVAL; 3980 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen) 3981 goto err3; 3982 3983 dreg = nft_type_to_reg(set->dtype); 3984 list_for_each_entry(binding, &set->bindings, list) { 3985 struct nft_ctx bind_ctx = { 3986 .net = ctx->net, 3987 .family = ctx->family, 3988 .table = ctx->table, 3989 .chain = (struct nft_chain *)binding->chain, 3990 }; 3991 3992 if (!(binding->flags & NFT_SET_MAP)) 3993 continue; 3994 3995 err = nft_validate_register_store(&bind_ctx, dreg, 3996 &data, 3997 d2.type, d2.len); 3998 if (err < 0) 3999 goto err3; 4000 } 4001 4002 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len); 4003 } 4004 4005 /* The full maximum length of userdata can exceed the maximum 4006 * offset value (U8_MAX) for following extensions, therefor it 4007 * must be the last extension added. 4008 */ 4009 ulen = 0; 4010 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 4011 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 4012 if (ulen > 0) 4013 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 4014 ulen); 4015 } 4016 4017 err = -ENOMEM; 4018 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data, 4019 timeout, GFP_KERNEL); 4020 if (elem.priv == NULL) 4021 goto err3; 4022 4023 ext = nft_set_elem_ext(set, elem.priv); 4024 if (flags) 4025 *nft_set_ext_flags(ext) = flags; 4026 if (ulen > 0) { 4027 udata = nft_set_ext_userdata(ext); 4028 udata->len = ulen - 1; 4029 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 4030 } 4031 if (obj) { 4032 *nft_set_ext_obj(ext) = obj; 4033 obj->use++; 4034 } 4035 4036 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 4037 if (trans == NULL) 4038 goto err4; 4039 4040 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK; 4041 err = set->ops->insert(ctx->net, set, &elem, &ext2); 4042 if (err) { 4043 if (err == -EEXIST) { 4044 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ 4045 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || 4046 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ 4047 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) 4048 return -EBUSY; 4049 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 4050 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && 4051 memcmp(nft_set_ext_data(ext), 4052 nft_set_ext_data(ext2), set->dlen) != 0) || 4053 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 4054 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) && 4055 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) 4056 err = -EBUSY; 4057 else if (!(nlmsg_flags & NLM_F_EXCL)) 4058 err = 0; 4059 } 4060 goto err5; 4061 } 4062 4063 if (set->size && 4064 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) { 4065 err = -ENFILE; 4066 goto err6; 4067 } 4068 4069 nft_trans_elem(trans) = elem; 4070 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 4071 return 0; 4072 4073 err6: 4074 set->ops->remove(ctx->net, set, &elem); 4075 err5: 4076 kfree(trans); 4077 err4: 4078 kfree(elem.priv); 4079 err3: 4080 if (nla[NFTA_SET_ELEM_DATA] != NULL) 4081 nft_data_release(&data, d2.type); 4082 err2: 4083 nft_data_release(&elem.key.val, d1.type); 4084 err1: 4085 return err; 4086 } 4087 4088 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk, 4089 struct sk_buff *skb, const struct nlmsghdr *nlh, 4090 const struct nlattr * const nla[], 4091 struct netlink_ext_ack *extack) 4092 { 4093 u8 genmask = nft_genmask_next(net); 4094 const struct nlattr *attr; 4095 struct nft_set *set; 4096 struct nft_ctx ctx; 4097 int rem, err = 0; 4098 4099 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 4100 return -EINVAL; 4101 4102 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask); 4103 if (err < 0) 4104 return err; 4105 4106 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET], 4107 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask); 4108 if (IS_ERR(set)) 4109 return PTR_ERR(set); 4110 4111 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 4112 return -EBUSY; 4113 4114 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 4115 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags); 4116 if (err < 0) 4117 break; 4118 } 4119 return err; 4120 } 4121 4122 /** 4123 * nft_data_hold - hold a nft_data item 4124 * 4125 * @data: struct nft_data to release 4126 * @type: type of data 4127 * 4128 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded, 4129 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and 4130 * NFT_GOTO verdicts. This function must be called on active data objects 4131 * from the second phase of the commit protocol. 4132 */ 4133 static void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 4134 { 4135 if (type == NFT_DATA_VERDICT) { 4136 switch (data->verdict.code) { 4137 case NFT_JUMP: 4138 case NFT_GOTO: 4139 data->verdict.chain->use++; 4140 break; 4141 } 4142 } 4143 } 4144 4145 static void nft_set_elem_activate(const struct net *net, 4146 const struct nft_set *set, 4147 struct nft_set_elem *elem) 4148 { 4149 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 4150 4151 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 4152 nft_data_hold(nft_set_ext_data(ext), set->dtype); 4153 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 4154 (*nft_set_ext_obj(ext))->use++; 4155 } 4156 4157 static void nft_set_elem_deactivate(const struct net *net, 4158 const struct nft_set *set, 4159 struct nft_set_elem *elem) 4160 { 4161 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 4162 4163 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 4164 nft_data_release(nft_set_ext_data(ext), set->dtype); 4165 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 4166 (*nft_set_ext_obj(ext))->use--; 4167 } 4168 4169 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 4170 const struct nlattr *attr) 4171 { 4172 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 4173 struct nft_set_ext_tmpl tmpl; 4174 struct nft_data_desc desc; 4175 struct nft_set_elem elem; 4176 struct nft_set_ext *ext; 4177 struct nft_trans *trans; 4178 u32 flags = 0; 4179 void *priv; 4180 int err; 4181 4182 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr, 4183 nft_set_elem_policy, NULL); 4184 if (err < 0) 4185 goto err1; 4186 4187 err = -EINVAL; 4188 if (nla[NFTA_SET_ELEM_KEY] == NULL) 4189 goto err1; 4190 4191 nft_set_ext_prepare(&tmpl); 4192 4193 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 4194 if (err < 0) 4195 return err; 4196 if (flags != 0) 4197 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 4198 4199 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc, 4200 nla[NFTA_SET_ELEM_KEY]); 4201 if (err < 0) 4202 goto err1; 4203 4204 err = -EINVAL; 4205 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) 4206 goto err2; 4207 4208 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len); 4209 4210 err = -ENOMEM; 4211 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0, 4212 GFP_KERNEL); 4213 if (elem.priv == NULL) 4214 goto err2; 4215 4216 ext = nft_set_elem_ext(set, elem.priv); 4217 if (flags) 4218 *nft_set_ext_flags(ext) = flags; 4219 4220 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 4221 if (trans == NULL) { 4222 err = -ENOMEM; 4223 goto err3; 4224 } 4225 4226 priv = set->ops->deactivate(ctx->net, set, &elem); 4227 if (priv == NULL) { 4228 err = -ENOENT; 4229 goto err4; 4230 } 4231 kfree(elem.priv); 4232 elem.priv = priv; 4233 4234 nft_set_elem_deactivate(ctx->net, set, &elem); 4235 4236 nft_trans_elem(trans) = elem; 4237 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 4238 return 0; 4239 4240 err4: 4241 kfree(trans); 4242 err3: 4243 kfree(elem.priv); 4244 err2: 4245 nft_data_release(&elem.key.val, desc.type); 4246 err1: 4247 return err; 4248 } 4249 4250 static int nft_flush_set(const struct nft_ctx *ctx, 4251 struct nft_set *set, 4252 const struct nft_set_iter *iter, 4253 struct nft_set_elem *elem) 4254 { 4255 struct nft_trans *trans; 4256 int err; 4257 4258 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 4259 sizeof(struct nft_trans_elem), GFP_ATOMIC); 4260 if (!trans) 4261 return -ENOMEM; 4262 4263 if (!set->ops->flush(ctx->net, set, elem->priv)) { 4264 err = -ENOENT; 4265 goto err1; 4266 } 4267 set->ndeact++; 4268 4269 nft_trans_elem_set(trans) = set; 4270 nft_trans_elem(trans) = *elem; 4271 list_add_tail(&trans->list, &ctx->net->nft.commit_list); 4272 4273 return 0; 4274 err1: 4275 kfree(trans); 4276 return err; 4277 } 4278 4279 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk, 4280 struct sk_buff *skb, const struct nlmsghdr *nlh, 4281 const struct nlattr * const nla[], 4282 struct netlink_ext_ack *extack) 4283 { 4284 u8 genmask = nft_genmask_next(net); 4285 const struct nlattr *attr; 4286 struct nft_set *set; 4287 struct nft_ctx ctx; 4288 int rem, err = 0; 4289 4290 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask); 4291 if (err < 0) 4292 return err; 4293 4294 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], 4295 genmask); 4296 if (IS_ERR(set)) 4297 return PTR_ERR(set); 4298 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 4299 return -EBUSY; 4300 4301 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) { 4302 struct nft_set_iter iter = { 4303 .genmask = genmask, 4304 .fn = nft_flush_set, 4305 }; 4306 set->ops->walk(&ctx, set, &iter); 4307 4308 return iter.err; 4309 } 4310 4311 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 4312 err = nft_del_setelem(&ctx, set, attr); 4313 if (err < 0) 4314 break; 4315 4316 set->ndeact++; 4317 } 4318 return err; 4319 } 4320 4321 void nft_set_gc_batch_release(struct rcu_head *rcu) 4322 { 4323 struct nft_set_gc_batch *gcb; 4324 unsigned int i; 4325 4326 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu); 4327 for (i = 0; i < gcb->head.cnt; i++) 4328 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true); 4329 kfree(gcb); 4330 } 4331 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release); 4332 4333 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set, 4334 gfp_t gfp) 4335 { 4336 struct nft_set_gc_batch *gcb; 4337 4338 gcb = kzalloc(sizeof(*gcb), gfp); 4339 if (gcb == NULL) 4340 return gcb; 4341 gcb->head.set = set; 4342 return gcb; 4343 } 4344 EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc); 4345 4346 /* 4347 * Stateful objects 4348 */ 4349 4350 /** 4351 * nft_register_obj- register nf_tables stateful object type 4352 * @obj: object type 4353 * 4354 * Registers the object type for use with nf_tables. Returns zero on 4355 * success or a negative errno code otherwise. 4356 */ 4357 int nft_register_obj(struct nft_object_type *obj_type) 4358 { 4359 if (obj_type->type == NFT_OBJECT_UNSPEC) 4360 return -EINVAL; 4361 4362 nfnl_lock(NFNL_SUBSYS_NFTABLES); 4363 list_add_rcu(&obj_type->list, &nf_tables_objects); 4364 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 4365 return 0; 4366 } 4367 EXPORT_SYMBOL_GPL(nft_register_obj); 4368 4369 /** 4370 * nft_unregister_obj - unregister nf_tables object type 4371 * @obj: object type 4372 * 4373 * Unregisters the object type for use with nf_tables. 4374 */ 4375 void nft_unregister_obj(struct nft_object_type *obj_type) 4376 { 4377 nfnl_lock(NFNL_SUBSYS_NFTABLES); 4378 list_del_rcu(&obj_type->list); 4379 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 4380 } 4381 EXPORT_SYMBOL_GPL(nft_unregister_obj); 4382 4383 struct nft_object *nf_tables_obj_lookup(const struct nft_table *table, 4384 const struct nlattr *nla, 4385 u32 objtype, u8 genmask) 4386 { 4387 struct nft_object *obj; 4388 4389 list_for_each_entry(obj, &table->objects, list) { 4390 if (!nla_strcmp(nla, obj->name) && 4391 objtype == obj->ops->type->type && 4392 nft_active_genmask(obj, genmask)) 4393 return obj; 4394 } 4395 return ERR_PTR(-ENOENT); 4396 } 4397 EXPORT_SYMBOL_GPL(nf_tables_obj_lookup); 4398 4399 static struct nft_object *nf_tables_obj_lookup_byhandle(const struct nft_table *table, 4400 const struct nlattr *nla, 4401 u32 objtype, u8 genmask) 4402 { 4403 struct nft_object *obj; 4404 4405 list_for_each_entry(obj, &table->objects, list) { 4406 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && 4407 objtype == obj->ops->type->type && 4408 nft_active_genmask(obj, genmask)) 4409 return obj; 4410 } 4411 return ERR_PTR(-ENOENT); 4412 } 4413 4414 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 4415 [NFTA_OBJ_TABLE] = { .type = NLA_STRING, 4416 .len = NFT_TABLE_MAXNAMELEN - 1 }, 4417 [NFTA_OBJ_NAME] = { .type = NLA_STRING, 4418 .len = NFT_OBJ_MAXNAMELEN - 1 }, 4419 [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, 4420 [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, 4421 [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, 4422 }; 4423 4424 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 4425 const struct nft_object_type *type, 4426 const struct nlattr *attr) 4427 { 4428 struct nlattr **tb; 4429 const struct nft_object_ops *ops; 4430 struct nft_object *obj; 4431 int err = -ENOMEM; 4432 4433 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL); 4434 if (!tb) 4435 goto err1; 4436 4437 if (attr) { 4438 err = nla_parse_nested(tb, type->maxattr, attr, type->policy, 4439 NULL); 4440 if (err < 0) 4441 goto err2; 4442 } else { 4443 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); 4444 } 4445 4446 if (type->select_ops) { 4447 ops = type->select_ops(ctx, (const struct nlattr * const *)tb); 4448 if (IS_ERR(ops)) { 4449 err = PTR_ERR(ops); 4450 goto err2; 4451 } 4452 } else { 4453 ops = type->ops; 4454 } 4455 4456 err = -ENOMEM; 4457 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL); 4458 if (!obj) 4459 goto err2; 4460 4461 err = ops->init(ctx, (const struct nlattr * const *)tb, obj); 4462 if (err < 0) 4463 goto err3; 4464 4465 obj->ops = ops; 4466 4467 kfree(tb); 4468 return obj; 4469 err3: 4470 kfree(obj); 4471 err2: 4472 kfree(tb); 4473 err1: 4474 return ERR_PTR(err); 4475 } 4476 4477 static int nft_object_dump(struct sk_buff *skb, unsigned int attr, 4478 struct nft_object *obj, bool reset) 4479 { 4480 struct nlattr *nest; 4481 4482 nest = nla_nest_start(skb, attr); 4483 if (!nest) 4484 goto nla_put_failure; 4485 if (obj->ops->dump(skb, obj, reset) < 0) 4486 goto nla_put_failure; 4487 nla_nest_end(skb, nest); 4488 return 0; 4489 4490 nla_put_failure: 4491 return -1; 4492 } 4493 4494 static const struct nft_object_type *__nft_obj_type_get(u32 objtype) 4495 { 4496 const struct nft_object_type *type; 4497 4498 list_for_each_entry(type, &nf_tables_objects, list) { 4499 if (objtype == type->type) 4500 return type; 4501 } 4502 return NULL; 4503 } 4504 4505 static const struct nft_object_type *nft_obj_type_get(u32 objtype) 4506 { 4507 const struct nft_object_type *type; 4508 4509 type = __nft_obj_type_get(objtype); 4510 if (type != NULL && try_module_get(type->owner)) 4511 return type; 4512 4513 #ifdef CONFIG_MODULES 4514 if (type == NULL) { 4515 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 4516 request_module("nft-obj-%u", objtype); 4517 nfnl_lock(NFNL_SUBSYS_NFTABLES); 4518 if (__nft_obj_type_get(objtype)) 4519 return ERR_PTR(-EAGAIN); 4520 } 4521 #endif 4522 return ERR_PTR(-ENOENT); 4523 } 4524 4525 static int nf_tables_newobj(struct net *net, struct sock *nlsk, 4526 struct sk_buff *skb, const struct nlmsghdr *nlh, 4527 const struct nlattr * const nla[], 4528 struct netlink_ext_ack *extack) 4529 { 4530 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 4531 const struct nft_object_type *type; 4532 u8 genmask = nft_genmask_next(net); 4533 int family = nfmsg->nfgen_family; 4534 struct nft_table *table; 4535 struct nft_object *obj; 4536 struct nft_ctx ctx; 4537 u32 objtype; 4538 int err; 4539 4540 if (!nla[NFTA_OBJ_TYPE] || 4541 !nla[NFTA_OBJ_NAME] || 4542 !nla[NFTA_OBJ_DATA]) 4543 return -EINVAL; 4544 4545 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family, 4546 genmask); 4547 if (IS_ERR(table)) 4548 return PTR_ERR(table); 4549 4550 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 4551 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask); 4552 if (IS_ERR(obj)) { 4553 err = PTR_ERR(obj); 4554 if (err != -ENOENT) 4555 return err; 4556 4557 } else { 4558 if (nlh->nlmsg_flags & NLM_F_EXCL) 4559 return -EEXIST; 4560 4561 return 0; 4562 } 4563 4564 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); 4565 4566 type = nft_obj_type_get(objtype); 4567 if (IS_ERR(type)) 4568 return PTR_ERR(type); 4569 4570 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]); 4571 if (IS_ERR(obj)) { 4572 err = PTR_ERR(obj); 4573 goto err1; 4574 } 4575 obj->table = table; 4576 obj->handle = nf_tables_alloc_handle(table); 4577 4578 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL); 4579 if (!obj->name) { 4580 err = -ENOMEM; 4581 goto err2; 4582 } 4583 4584 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj); 4585 if (err < 0) 4586 goto err3; 4587 4588 list_add_tail_rcu(&obj->list, &table->objects); 4589 table->use++; 4590 return 0; 4591 err3: 4592 kfree(obj->name); 4593 err2: 4594 if (obj->ops->destroy) 4595 obj->ops->destroy(obj); 4596 kfree(obj); 4597 err1: 4598 module_put(type->owner); 4599 return err; 4600 } 4601 4602 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 4603 u32 portid, u32 seq, int event, u32 flags, 4604 int family, const struct nft_table *table, 4605 struct nft_object *obj, bool reset) 4606 { 4607 struct nfgenmsg *nfmsg; 4608 struct nlmsghdr *nlh; 4609 4610 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 4611 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); 4612 if (nlh == NULL) 4613 goto nla_put_failure; 4614 4615 nfmsg = nlmsg_data(nlh); 4616 nfmsg->nfgen_family = family; 4617 nfmsg->version = NFNETLINK_V0; 4618 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 4619 4620 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || 4621 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) || 4622 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || 4623 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || 4624 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) || 4625 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), 4626 NFTA_OBJ_PAD)) 4627 goto nla_put_failure; 4628 4629 nlmsg_end(skb, nlh); 4630 return 0; 4631 4632 nla_put_failure: 4633 nlmsg_trim(skb, nlh); 4634 return -1; 4635 } 4636 4637 struct nft_obj_filter { 4638 char *table; 4639 u32 type; 4640 }; 4641 4642 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) 4643 { 4644 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 4645 const struct nft_table *table; 4646 unsigned int idx = 0, s_idx = cb->args[0]; 4647 struct nft_obj_filter *filter = cb->data; 4648 struct net *net = sock_net(skb->sk); 4649 int family = nfmsg->nfgen_family; 4650 struct nft_object *obj; 4651 bool reset = false; 4652 4653 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 4654 reset = true; 4655 4656 rcu_read_lock(); 4657 cb->seq = net->nft.base_seq; 4658 4659 list_for_each_entry_rcu(table, &net->nft.tables, list) { 4660 if (family != NFPROTO_UNSPEC && family != table->family) 4661 continue; 4662 4663 list_for_each_entry_rcu(obj, &table->objects, list) { 4664 if (!nft_is_active(net, obj)) 4665 goto cont; 4666 if (idx < s_idx) 4667 goto cont; 4668 if (idx > s_idx) 4669 memset(&cb->args[1], 0, 4670 sizeof(cb->args) - sizeof(cb->args[0])); 4671 if (filter && filter->table[0] && 4672 strcmp(filter->table, table->name)) 4673 goto cont; 4674 if (filter && 4675 filter->type != NFT_OBJECT_UNSPEC && 4676 obj->ops->type->type != filter->type) 4677 goto cont; 4678 4679 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, 4680 cb->nlh->nlmsg_seq, 4681 NFT_MSG_NEWOBJ, 4682 NLM_F_MULTI | NLM_F_APPEND, 4683 table->family, table, 4684 obj, reset) < 0) 4685 goto done; 4686 4687 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 4688 cont: 4689 idx++; 4690 } 4691 } 4692 done: 4693 rcu_read_unlock(); 4694 4695 cb->args[0] = idx; 4696 return skb->len; 4697 } 4698 4699 static int nf_tables_dump_obj_done(struct netlink_callback *cb) 4700 { 4701 struct nft_obj_filter *filter = cb->data; 4702 4703 if (filter) { 4704 kfree(filter->table); 4705 kfree(filter); 4706 } 4707 4708 return 0; 4709 } 4710 4711 static struct nft_obj_filter * 4712 nft_obj_filter_alloc(const struct nlattr * const nla[]) 4713 { 4714 struct nft_obj_filter *filter; 4715 4716 filter = kzalloc(sizeof(*filter), GFP_KERNEL); 4717 if (!filter) 4718 return ERR_PTR(-ENOMEM); 4719 4720 if (nla[NFTA_OBJ_TABLE]) { 4721 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL); 4722 if (!filter->table) { 4723 kfree(filter); 4724 return ERR_PTR(-ENOMEM); 4725 } 4726 } 4727 if (nla[NFTA_OBJ_TYPE]) 4728 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 4729 4730 return filter; 4731 } 4732 4733 static int nf_tables_getobj(struct net *net, struct sock *nlsk, 4734 struct sk_buff *skb, const struct nlmsghdr *nlh, 4735 const struct nlattr * const nla[], 4736 struct netlink_ext_ack *extack) 4737 { 4738 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 4739 u8 genmask = nft_genmask_cur(net); 4740 int family = nfmsg->nfgen_family; 4741 const struct nft_table *table; 4742 struct nft_object *obj; 4743 struct sk_buff *skb2; 4744 bool reset = false; 4745 u32 objtype; 4746 int err; 4747 4748 if (nlh->nlmsg_flags & NLM_F_DUMP) { 4749 struct netlink_dump_control c = { 4750 .dump = nf_tables_dump_obj, 4751 .done = nf_tables_dump_obj_done, 4752 }; 4753 4754 if (nla[NFTA_OBJ_TABLE] || 4755 nla[NFTA_OBJ_TYPE]) { 4756 struct nft_obj_filter *filter; 4757 4758 filter = nft_obj_filter_alloc(nla); 4759 if (IS_ERR(filter)) 4760 return -ENOMEM; 4761 4762 c.data = filter; 4763 } 4764 return netlink_dump_start(nlsk, skb, nlh, &c); 4765 } 4766 4767 if (!nla[NFTA_OBJ_NAME] || 4768 !nla[NFTA_OBJ_TYPE]) 4769 return -EINVAL; 4770 4771 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family, 4772 genmask); 4773 if (IS_ERR(table)) 4774 return PTR_ERR(table); 4775 4776 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 4777 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask); 4778 if (IS_ERR(obj)) 4779 return PTR_ERR(obj); 4780 4781 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 4782 if (!skb2) 4783 return -ENOMEM; 4784 4785 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 4786 reset = true; 4787 4788 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid, 4789 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 4790 family, table, obj, reset); 4791 if (err < 0) 4792 goto err; 4793 4794 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 4795 err: 4796 kfree_skb(skb2); 4797 return err; 4798 } 4799 4800 static void nft_obj_destroy(struct nft_object *obj) 4801 { 4802 if (obj->ops->destroy) 4803 obj->ops->destroy(obj); 4804 4805 module_put(obj->ops->type->owner); 4806 kfree(obj->name); 4807 kfree(obj); 4808 } 4809 4810 static int nf_tables_delobj(struct net *net, struct sock *nlsk, 4811 struct sk_buff *skb, const struct nlmsghdr *nlh, 4812 const struct nlattr * const nla[], 4813 struct netlink_ext_ack *extack) 4814 { 4815 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 4816 u8 genmask = nft_genmask_next(net); 4817 int family = nfmsg->nfgen_family; 4818 struct nft_table *table; 4819 struct nft_object *obj; 4820 struct nft_ctx ctx; 4821 u32 objtype; 4822 4823 if (!nla[NFTA_OBJ_TYPE] || 4824 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) 4825 return -EINVAL; 4826 4827 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family, 4828 genmask); 4829 if (IS_ERR(table)) 4830 return PTR_ERR(table); 4831 4832 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 4833 if (nla[NFTA_OBJ_HANDLE]) 4834 obj = nf_tables_obj_lookup_byhandle(table, nla[NFTA_OBJ_HANDLE], 4835 objtype, genmask); 4836 else 4837 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], 4838 objtype, genmask); 4839 if (IS_ERR(obj)) 4840 return PTR_ERR(obj); 4841 if (obj->use > 0) 4842 return -EBUSY; 4843 4844 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); 4845 4846 return nft_delobj(&ctx, obj); 4847 } 4848 4849 void nft_obj_notify(struct net *net, struct nft_table *table, 4850 struct nft_object *obj, u32 portid, u32 seq, int event, 4851 int family, int report, gfp_t gfp) 4852 { 4853 struct sk_buff *skb; 4854 int err; 4855 4856 if (!report && 4857 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 4858 return; 4859 4860 skb = nlmsg_new(NLMSG_GOODSIZE, gfp); 4861 if (skb == NULL) 4862 goto err; 4863 4864 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family, 4865 table, obj, false); 4866 if (err < 0) { 4867 kfree_skb(skb); 4868 goto err; 4869 } 4870 4871 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp); 4872 return; 4873 err: 4874 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 4875 } 4876 EXPORT_SYMBOL_GPL(nft_obj_notify); 4877 4878 static void nf_tables_obj_notify(const struct nft_ctx *ctx, 4879 struct nft_object *obj, int event) 4880 { 4881 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, 4882 ctx->family, ctx->report, GFP_KERNEL); 4883 } 4884 4885 /* 4886 * Flow tables 4887 */ 4888 void nft_register_flowtable_type(struct nf_flowtable_type *type) 4889 { 4890 nfnl_lock(NFNL_SUBSYS_NFTABLES); 4891 list_add_tail_rcu(&type->list, &nf_tables_flowtables); 4892 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 4893 } 4894 EXPORT_SYMBOL_GPL(nft_register_flowtable_type); 4895 4896 void nft_unregister_flowtable_type(struct nf_flowtable_type *type) 4897 { 4898 nfnl_lock(NFNL_SUBSYS_NFTABLES); 4899 list_del_rcu(&type->list); 4900 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 4901 } 4902 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); 4903 4904 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 4905 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, 4906 .len = NFT_NAME_MAXLEN - 1 }, 4907 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, 4908 .len = NFT_NAME_MAXLEN - 1 }, 4909 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, 4910 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, 4911 }; 4912 4913 struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table, 4914 const struct nlattr *nla, 4915 u8 genmask) 4916 { 4917 struct nft_flowtable *flowtable; 4918 4919 list_for_each_entry(flowtable, &table->flowtables, list) { 4920 if (!nla_strcmp(nla, flowtable->name) && 4921 nft_active_genmask(flowtable, genmask)) 4922 return flowtable; 4923 } 4924 return ERR_PTR(-ENOENT); 4925 } 4926 EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup); 4927 4928 static struct nft_flowtable * 4929 nf_tables_flowtable_lookup_byhandle(const struct nft_table *table, 4930 const struct nlattr *nla, u8 genmask) 4931 { 4932 struct nft_flowtable *flowtable; 4933 4934 list_for_each_entry(flowtable, &table->flowtables, list) { 4935 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && 4936 nft_active_genmask(flowtable, genmask)) 4937 return flowtable; 4938 } 4939 return ERR_PTR(-ENOENT); 4940 } 4941 4942 static int nf_tables_parse_devices(const struct nft_ctx *ctx, 4943 const struct nlattr *attr, 4944 struct net_device *dev_array[], int *len) 4945 { 4946 const struct nlattr *tmp; 4947 struct net_device *dev; 4948 char ifname[IFNAMSIZ]; 4949 int rem, n = 0, err; 4950 4951 nla_for_each_nested(tmp, attr, rem) { 4952 if (nla_type(tmp) != NFTA_DEVICE_NAME) { 4953 err = -EINVAL; 4954 goto err1; 4955 } 4956 4957 nla_strlcpy(ifname, tmp, IFNAMSIZ); 4958 dev = __dev_get_by_name(ctx->net, ifname); 4959 if (!dev) { 4960 err = -ENOENT; 4961 goto err1; 4962 } 4963 4964 dev_array[n++] = dev; 4965 if (n == NFT_FLOWTABLE_DEVICE_MAX) { 4966 err = -EFBIG; 4967 goto err1; 4968 } 4969 } 4970 if (!len) 4971 return -EINVAL; 4972 4973 err = 0; 4974 err1: 4975 *len = n; 4976 return err; 4977 } 4978 4979 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { 4980 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, 4981 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, 4982 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, 4983 }; 4984 4985 static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx, 4986 const struct nlattr *attr, 4987 struct nft_flowtable *flowtable) 4988 { 4989 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX]; 4990 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; 4991 struct nf_hook_ops *ops; 4992 int hooknum, priority; 4993 int err, n = 0, i; 4994 4995 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr, 4996 nft_flowtable_hook_policy, NULL); 4997 if (err < 0) 4998 return err; 4999 5000 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || 5001 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] || 5002 !tb[NFTA_FLOWTABLE_HOOK_DEVS]) 5003 return -EINVAL; 5004 5005 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 5006 if (hooknum != NF_NETDEV_INGRESS) 5007 return -EINVAL; 5008 5009 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 5010 5011 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS], 5012 dev_array, &n); 5013 if (err < 0) 5014 return err; 5015 5016 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL); 5017 if (!ops) 5018 return -ENOMEM; 5019 5020 flowtable->hooknum = hooknum; 5021 flowtable->priority = priority; 5022 flowtable->ops = ops; 5023 flowtable->ops_len = n; 5024 5025 for (i = 0; i < n; i++) { 5026 flowtable->ops[i].pf = NFPROTO_NETDEV; 5027 flowtable->ops[i].hooknum = hooknum; 5028 flowtable->ops[i].priority = priority; 5029 flowtable->ops[i].priv = &flowtable->data.rhashtable; 5030 flowtable->ops[i].hook = flowtable->data.type->hook; 5031 flowtable->ops[i].dev = dev_array[i]; 5032 flowtable->dev_name[i] = kstrdup(dev_array[i]->name, 5033 GFP_KERNEL); 5034 } 5035 5036 return err; 5037 } 5038 5039 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) 5040 { 5041 const struct nf_flowtable_type *type; 5042 5043 list_for_each_entry(type, &nf_tables_flowtables, list) { 5044 if (family == type->family) 5045 return type; 5046 } 5047 return NULL; 5048 } 5049 5050 static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family) 5051 { 5052 const struct nf_flowtable_type *type; 5053 5054 type = __nft_flowtable_type_get(family); 5055 if (type != NULL && try_module_get(type->owner)) 5056 return type; 5057 5058 #ifdef CONFIG_MODULES 5059 if (type == NULL) { 5060 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 5061 request_module("nf-flowtable-%u", family); 5062 nfnl_lock(NFNL_SUBSYS_NFTABLES); 5063 if (__nft_flowtable_type_get(family)) 5064 return ERR_PTR(-EAGAIN); 5065 } 5066 #endif 5067 return ERR_PTR(-ENOENT); 5068 } 5069 5070 void nft_flow_table_iterate(struct net *net, 5071 void (*iter)(struct nf_flowtable *flowtable, void *data), 5072 void *data) 5073 { 5074 struct nft_flowtable *flowtable; 5075 const struct nft_table *table; 5076 5077 nfnl_lock(NFNL_SUBSYS_NFTABLES); 5078 list_for_each_entry(table, &net->nft.tables, list) { 5079 list_for_each_entry(flowtable, &table->flowtables, list) { 5080 iter(&flowtable->data, data); 5081 } 5082 } 5083 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 5084 } 5085 EXPORT_SYMBOL_GPL(nft_flow_table_iterate); 5086 5087 static void nft_unregister_flowtable_net_hooks(struct net *net, 5088 struct nft_flowtable *flowtable) 5089 { 5090 int i; 5091 5092 for (i = 0; i < flowtable->ops_len; i++) { 5093 if (!flowtable->ops[i].dev) 5094 continue; 5095 5096 nf_unregister_net_hook(net, &flowtable->ops[i]); 5097 } 5098 } 5099 5100 static int nf_tables_newflowtable(struct net *net, struct sock *nlsk, 5101 struct sk_buff *skb, 5102 const struct nlmsghdr *nlh, 5103 const struct nlattr * const nla[], 5104 struct netlink_ext_ack *extack) 5105 { 5106 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 5107 const struct nf_flowtable_type *type; 5108 struct nft_flowtable *flowtable, *ft; 5109 u8 genmask = nft_genmask_next(net); 5110 int family = nfmsg->nfgen_family; 5111 struct nft_table *table; 5112 struct nft_ctx ctx; 5113 int err, i, k; 5114 5115 if (!nla[NFTA_FLOWTABLE_TABLE] || 5116 !nla[NFTA_FLOWTABLE_NAME] || 5117 !nla[NFTA_FLOWTABLE_HOOK]) 5118 return -EINVAL; 5119 5120 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], 5121 family, genmask); 5122 if (IS_ERR(table)) 5123 return PTR_ERR(table); 5124 5125 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 5126 genmask); 5127 if (IS_ERR(flowtable)) { 5128 err = PTR_ERR(flowtable); 5129 if (err != -ENOENT) 5130 return err; 5131 } else { 5132 if (nlh->nlmsg_flags & NLM_F_EXCL) 5133 return -EEXIST; 5134 5135 return 0; 5136 } 5137 5138 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); 5139 5140 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL); 5141 if (!flowtable) 5142 return -ENOMEM; 5143 5144 flowtable->table = table; 5145 flowtable->handle = nf_tables_alloc_handle(table); 5146 5147 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL); 5148 if (!flowtable->name) { 5149 err = -ENOMEM; 5150 goto err1; 5151 } 5152 5153 type = nft_flowtable_type_get(family); 5154 if (IS_ERR(type)) { 5155 err = PTR_ERR(type); 5156 goto err2; 5157 } 5158 5159 flowtable->data.type = type; 5160 err = rhashtable_init(&flowtable->data.rhashtable, type->params); 5161 if (err < 0) 5162 goto err3; 5163 5164 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK], 5165 flowtable); 5166 if (err < 0) 5167 goto err3; 5168 5169 for (i = 0; i < flowtable->ops_len; i++) { 5170 if (!flowtable->ops[i].dev) 5171 continue; 5172 5173 list_for_each_entry(ft, &table->flowtables, list) { 5174 for (k = 0; k < ft->ops_len; k++) { 5175 if (!ft->ops[k].dev) 5176 continue; 5177 5178 if (flowtable->ops[i].dev == ft->ops[k].dev && 5179 flowtable->ops[i].pf == ft->ops[k].pf) { 5180 err = -EBUSY; 5181 goto err4; 5182 } 5183 } 5184 } 5185 5186 err = nf_register_net_hook(net, &flowtable->ops[i]); 5187 if (err < 0) 5188 goto err4; 5189 } 5190 5191 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); 5192 if (err < 0) 5193 goto err5; 5194 5195 INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc); 5196 queue_delayed_work(system_power_efficient_wq, 5197 &flowtable->data.gc_work, HZ); 5198 5199 list_add_tail_rcu(&flowtable->list, &table->flowtables); 5200 table->use++; 5201 5202 return 0; 5203 err5: 5204 i = flowtable->ops_len; 5205 err4: 5206 for (k = i - 1; k >= 0; k--) { 5207 kfree(flowtable->dev_name[k]); 5208 nf_unregister_net_hook(net, &flowtable->ops[k]); 5209 } 5210 5211 kfree(flowtable->ops); 5212 err3: 5213 module_put(type->owner); 5214 err2: 5215 kfree(flowtable->name); 5216 err1: 5217 kfree(flowtable); 5218 return err; 5219 } 5220 5221 static int nf_tables_delflowtable(struct net *net, struct sock *nlsk, 5222 struct sk_buff *skb, 5223 const struct nlmsghdr *nlh, 5224 const struct nlattr * const nla[], 5225 struct netlink_ext_ack *extack) 5226 { 5227 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 5228 u8 genmask = nft_genmask_next(net); 5229 int family = nfmsg->nfgen_family; 5230 struct nft_flowtable *flowtable; 5231 struct nft_table *table; 5232 struct nft_ctx ctx; 5233 5234 if (!nla[NFTA_FLOWTABLE_TABLE] || 5235 (!nla[NFTA_FLOWTABLE_NAME] && 5236 !nla[NFTA_FLOWTABLE_HANDLE])) 5237 return -EINVAL; 5238 5239 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], 5240 family, genmask); 5241 if (IS_ERR(table)) 5242 return PTR_ERR(table); 5243 5244 if (nla[NFTA_FLOWTABLE_HANDLE]) 5245 flowtable = nf_tables_flowtable_lookup_byhandle(table, 5246 nla[NFTA_FLOWTABLE_HANDLE], 5247 genmask); 5248 else 5249 flowtable = nf_tables_flowtable_lookup(table, 5250 nla[NFTA_FLOWTABLE_NAME], 5251 genmask); 5252 if (IS_ERR(flowtable)) 5253 return PTR_ERR(flowtable); 5254 if (flowtable->use > 0) 5255 return -EBUSY; 5256 5257 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla); 5258 5259 return nft_delflowtable(&ctx, flowtable); 5260 } 5261 5262 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 5263 u32 portid, u32 seq, int event, 5264 u32 flags, int family, 5265 struct nft_flowtable *flowtable) 5266 { 5267 struct nlattr *nest, *nest_devs; 5268 struct nfgenmsg *nfmsg; 5269 struct nlmsghdr *nlh; 5270 int i; 5271 5272 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 5273 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); 5274 if (nlh == NULL) 5275 goto nla_put_failure; 5276 5277 nfmsg = nlmsg_data(nlh); 5278 nfmsg->nfgen_family = family; 5279 nfmsg->version = NFNETLINK_V0; 5280 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 5281 5282 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || 5283 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || 5284 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || 5285 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), 5286 NFTA_FLOWTABLE_PAD)) 5287 goto nla_put_failure; 5288 5289 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK); 5290 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || 5291 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority))) 5292 goto nla_put_failure; 5293 5294 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS); 5295 if (!nest_devs) 5296 goto nla_put_failure; 5297 5298 for (i = 0; i < flowtable->ops_len; i++) { 5299 if (flowtable->dev_name[i][0] && 5300 nla_put_string(skb, NFTA_DEVICE_NAME, 5301 flowtable->dev_name[i])) 5302 goto nla_put_failure; 5303 } 5304 nla_nest_end(skb, nest_devs); 5305 nla_nest_end(skb, nest); 5306 5307 nlmsg_end(skb, nlh); 5308 return 0; 5309 5310 nla_put_failure: 5311 nlmsg_trim(skb, nlh); 5312 return -1; 5313 } 5314 5315 struct nft_flowtable_filter { 5316 char *table; 5317 }; 5318 5319 static int nf_tables_dump_flowtable(struct sk_buff *skb, 5320 struct netlink_callback *cb) 5321 { 5322 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 5323 struct nft_flowtable_filter *filter = cb->data; 5324 unsigned int idx = 0, s_idx = cb->args[0]; 5325 struct net *net = sock_net(skb->sk); 5326 int family = nfmsg->nfgen_family; 5327 struct nft_flowtable *flowtable; 5328 const struct nft_table *table; 5329 5330 rcu_read_lock(); 5331 cb->seq = net->nft.base_seq; 5332 5333 list_for_each_entry_rcu(table, &net->nft.tables, list) { 5334 if (family != NFPROTO_UNSPEC && family != table->family) 5335 continue; 5336 5337 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 5338 if (!nft_is_active(net, flowtable)) 5339 goto cont; 5340 if (idx < s_idx) 5341 goto cont; 5342 if (idx > s_idx) 5343 memset(&cb->args[1], 0, 5344 sizeof(cb->args) - sizeof(cb->args[0])); 5345 if (filter && filter->table[0] && 5346 strcmp(filter->table, table->name)) 5347 goto cont; 5348 5349 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, 5350 cb->nlh->nlmsg_seq, 5351 NFT_MSG_NEWFLOWTABLE, 5352 NLM_F_MULTI | NLM_F_APPEND, 5353 table->family, flowtable) < 0) 5354 goto done; 5355 5356 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 5357 cont: 5358 idx++; 5359 } 5360 } 5361 done: 5362 rcu_read_unlock(); 5363 5364 cb->args[0] = idx; 5365 return skb->len; 5366 } 5367 5368 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) 5369 { 5370 struct nft_flowtable_filter *filter = cb->data; 5371 5372 if (!filter) 5373 return 0; 5374 5375 kfree(filter->table); 5376 kfree(filter); 5377 5378 return 0; 5379 } 5380 5381 static struct nft_flowtable_filter * 5382 nft_flowtable_filter_alloc(const struct nlattr * const nla[]) 5383 { 5384 struct nft_flowtable_filter *filter; 5385 5386 filter = kzalloc(sizeof(*filter), GFP_KERNEL); 5387 if (!filter) 5388 return ERR_PTR(-ENOMEM); 5389 5390 if (nla[NFTA_FLOWTABLE_TABLE]) { 5391 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], 5392 GFP_KERNEL); 5393 if (!filter->table) { 5394 kfree(filter); 5395 return ERR_PTR(-ENOMEM); 5396 } 5397 } 5398 return filter; 5399 } 5400 5401 static int nf_tables_getflowtable(struct net *net, struct sock *nlsk, 5402 struct sk_buff *skb, 5403 const struct nlmsghdr *nlh, 5404 const struct nlattr * const nla[], 5405 struct netlink_ext_ack *extack) 5406 { 5407 const struct nfgenmsg *nfmsg = nlmsg_data(nlh); 5408 u8 genmask = nft_genmask_cur(net); 5409 int family = nfmsg->nfgen_family; 5410 struct nft_flowtable *flowtable; 5411 const struct nft_table *table; 5412 struct sk_buff *skb2; 5413 int err; 5414 5415 if (nlh->nlmsg_flags & NLM_F_DUMP) { 5416 struct netlink_dump_control c = { 5417 .dump = nf_tables_dump_flowtable, 5418 .done = nf_tables_dump_flowtable_done, 5419 }; 5420 5421 if (nla[NFTA_FLOWTABLE_TABLE]) { 5422 struct nft_flowtable_filter *filter; 5423 5424 filter = nft_flowtable_filter_alloc(nla); 5425 if (IS_ERR(filter)) 5426 return -ENOMEM; 5427 5428 c.data = filter; 5429 } 5430 return netlink_dump_start(nlsk, skb, nlh, &c); 5431 } 5432 5433 if (!nla[NFTA_FLOWTABLE_NAME]) 5434 return -EINVAL; 5435 5436 table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], 5437 family, genmask); 5438 if (IS_ERR(table)) 5439 return PTR_ERR(table); 5440 5441 flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 5442 genmask); 5443 if (IS_ERR(flowtable)) 5444 return PTR_ERR(flowtable); 5445 5446 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 5447 if (!skb2) 5448 return -ENOMEM; 5449 5450 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, 5451 nlh->nlmsg_seq, 5452 NFT_MSG_NEWFLOWTABLE, 0, family, 5453 flowtable); 5454 if (err < 0) 5455 goto err; 5456 5457 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 5458 err: 5459 kfree_skb(skb2); 5460 return err; 5461 } 5462 5463 static void nf_tables_flowtable_notify(struct nft_ctx *ctx, 5464 struct nft_flowtable *flowtable, 5465 int event) 5466 { 5467 struct sk_buff *skb; 5468 int err; 5469 5470 if (ctx->report && 5471 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 5472 return; 5473 5474 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 5475 if (skb == NULL) 5476 goto err; 5477 5478 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, 5479 ctx->seq, event, 0, 5480 ctx->family, flowtable); 5481 if (err < 0) { 5482 kfree_skb(skb); 5483 goto err; 5484 } 5485 5486 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES, 5487 ctx->report, GFP_KERNEL); 5488 return; 5489 err: 5490 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 5491 } 5492 5493 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 5494 { 5495 cancel_delayed_work_sync(&flowtable->data.gc_work); 5496 kfree(flowtable->ops); 5497 kfree(flowtable->name); 5498 flowtable->data.type->free(&flowtable->data); 5499 rhashtable_destroy(&flowtable->data.rhashtable); 5500 module_put(flowtable->data.type->owner); 5501 } 5502 5503 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 5504 u32 portid, u32 seq) 5505 { 5506 struct nlmsghdr *nlh; 5507 struct nfgenmsg *nfmsg; 5508 char buf[TASK_COMM_LEN]; 5509 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); 5510 5511 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0); 5512 if (nlh == NULL) 5513 goto nla_put_failure; 5514 5515 nfmsg = nlmsg_data(nlh); 5516 nfmsg->nfgen_family = AF_UNSPEC; 5517 nfmsg->version = NFNETLINK_V0; 5518 nfmsg->res_id = htons(net->nft.base_seq & 0xffff); 5519 5520 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) || 5521 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || 5522 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) 5523 goto nla_put_failure; 5524 5525 nlmsg_end(skb, nlh); 5526 return 0; 5527 5528 nla_put_failure: 5529 nlmsg_trim(skb, nlh); 5530 return -EMSGSIZE; 5531 } 5532 5533 static void nft_flowtable_event(unsigned long event, struct net_device *dev, 5534 struct nft_flowtable *flowtable) 5535 { 5536 int i; 5537 5538 for (i = 0; i < flowtable->ops_len; i++) { 5539 if (flowtable->ops[i].dev != dev) 5540 continue; 5541 5542 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]); 5543 flowtable->dev_name[i][0] = '\0'; 5544 flowtable->ops[i].dev = NULL; 5545 break; 5546 } 5547 } 5548 5549 static int nf_tables_flowtable_event(struct notifier_block *this, 5550 unsigned long event, void *ptr) 5551 { 5552 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 5553 struct nft_flowtable *flowtable; 5554 struct nft_table *table; 5555 5556 if (event != NETDEV_UNREGISTER) 5557 return 0; 5558 5559 nfnl_lock(NFNL_SUBSYS_NFTABLES); 5560 list_for_each_entry(table, &dev_net(dev)->nft.tables, list) { 5561 list_for_each_entry(flowtable, &table->flowtables, list) { 5562 nft_flowtable_event(event, dev, flowtable); 5563 } 5564 } 5565 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 5566 5567 return NOTIFY_DONE; 5568 } 5569 5570 static struct notifier_block nf_tables_flowtable_notifier = { 5571 .notifier_call = nf_tables_flowtable_event, 5572 }; 5573 5574 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, 5575 int event) 5576 { 5577 struct nlmsghdr *nlh = nlmsg_hdr(skb); 5578 struct sk_buff *skb2; 5579 int err; 5580 5581 if (nlmsg_report(nlh) && 5582 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 5583 return; 5584 5585 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 5586 if (skb2 == NULL) 5587 goto err; 5588 5589 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 5590 nlh->nlmsg_seq); 5591 if (err < 0) { 5592 kfree_skb(skb2); 5593 goto err; 5594 } 5595 5596 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 5597 nlmsg_report(nlh), GFP_KERNEL); 5598 return; 5599 err: 5600 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 5601 -ENOBUFS); 5602 } 5603 5604 static int nf_tables_getgen(struct net *net, struct sock *nlsk, 5605 struct sk_buff *skb, const struct nlmsghdr *nlh, 5606 const struct nlattr * const nla[], 5607 struct netlink_ext_ack *extack) 5608 { 5609 struct sk_buff *skb2; 5610 int err; 5611 5612 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); 5613 if (skb2 == NULL) 5614 return -ENOMEM; 5615 5616 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 5617 nlh->nlmsg_seq); 5618 if (err < 0) 5619 goto err; 5620 5621 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); 5622 err: 5623 kfree_skb(skb2); 5624 return err; 5625 } 5626 5627 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 5628 [NFT_MSG_NEWTABLE] = { 5629 .call_batch = nf_tables_newtable, 5630 .attr_count = NFTA_TABLE_MAX, 5631 .policy = nft_table_policy, 5632 }, 5633 [NFT_MSG_GETTABLE] = { 5634 .call = nf_tables_gettable, 5635 .attr_count = NFTA_TABLE_MAX, 5636 .policy = nft_table_policy, 5637 }, 5638 [NFT_MSG_DELTABLE] = { 5639 .call_batch = nf_tables_deltable, 5640 .attr_count = NFTA_TABLE_MAX, 5641 .policy = nft_table_policy, 5642 }, 5643 [NFT_MSG_NEWCHAIN] = { 5644 .call_batch = nf_tables_newchain, 5645 .attr_count = NFTA_CHAIN_MAX, 5646 .policy = nft_chain_policy, 5647 }, 5648 [NFT_MSG_GETCHAIN] = { 5649 .call = nf_tables_getchain, 5650 .attr_count = NFTA_CHAIN_MAX, 5651 .policy = nft_chain_policy, 5652 }, 5653 [NFT_MSG_DELCHAIN] = { 5654 .call_batch = nf_tables_delchain, 5655 .attr_count = NFTA_CHAIN_MAX, 5656 .policy = nft_chain_policy, 5657 }, 5658 [NFT_MSG_NEWRULE] = { 5659 .call_batch = nf_tables_newrule, 5660 .attr_count = NFTA_RULE_MAX, 5661 .policy = nft_rule_policy, 5662 }, 5663 [NFT_MSG_GETRULE] = { 5664 .call = nf_tables_getrule, 5665 .attr_count = NFTA_RULE_MAX, 5666 .policy = nft_rule_policy, 5667 }, 5668 [NFT_MSG_DELRULE] = { 5669 .call_batch = nf_tables_delrule, 5670 .attr_count = NFTA_RULE_MAX, 5671 .policy = nft_rule_policy, 5672 }, 5673 [NFT_MSG_NEWSET] = { 5674 .call_batch = nf_tables_newset, 5675 .attr_count = NFTA_SET_MAX, 5676 .policy = nft_set_policy, 5677 }, 5678 [NFT_MSG_GETSET] = { 5679 .call = nf_tables_getset, 5680 .attr_count = NFTA_SET_MAX, 5681 .policy = nft_set_policy, 5682 }, 5683 [NFT_MSG_DELSET] = { 5684 .call_batch = nf_tables_delset, 5685 .attr_count = NFTA_SET_MAX, 5686 .policy = nft_set_policy, 5687 }, 5688 [NFT_MSG_NEWSETELEM] = { 5689 .call_batch = nf_tables_newsetelem, 5690 .attr_count = NFTA_SET_ELEM_LIST_MAX, 5691 .policy = nft_set_elem_list_policy, 5692 }, 5693 [NFT_MSG_GETSETELEM] = { 5694 .call = nf_tables_getsetelem, 5695 .attr_count = NFTA_SET_ELEM_LIST_MAX, 5696 .policy = nft_set_elem_list_policy, 5697 }, 5698 [NFT_MSG_DELSETELEM] = { 5699 .call_batch = nf_tables_delsetelem, 5700 .attr_count = NFTA_SET_ELEM_LIST_MAX, 5701 .policy = nft_set_elem_list_policy, 5702 }, 5703 [NFT_MSG_GETGEN] = { 5704 .call = nf_tables_getgen, 5705 }, 5706 [NFT_MSG_NEWOBJ] = { 5707 .call_batch = nf_tables_newobj, 5708 .attr_count = NFTA_OBJ_MAX, 5709 .policy = nft_obj_policy, 5710 }, 5711 [NFT_MSG_GETOBJ] = { 5712 .call = nf_tables_getobj, 5713 .attr_count = NFTA_OBJ_MAX, 5714 .policy = nft_obj_policy, 5715 }, 5716 [NFT_MSG_DELOBJ] = { 5717 .call_batch = nf_tables_delobj, 5718 .attr_count = NFTA_OBJ_MAX, 5719 .policy = nft_obj_policy, 5720 }, 5721 [NFT_MSG_GETOBJ_RESET] = { 5722 .call = nf_tables_getobj, 5723 .attr_count = NFTA_OBJ_MAX, 5724 .policy = nft_obj_policy, 5725 }, 5726 [NFT_MSG_NEWFLOWTABLE] = { 5727 .call_batch = nf_tables_newflowtable, 5728 .attr_count = NFTA_FLOWTABLE_MAX, 5729 .policy = nft_flowtable_policy, 5730 }, 5731 [NFT_MSG_GETFLOWTABLE] = { 5732 .call = nf_tables_getflowtable, 5733 .attr_count = NFTA_FLOWTABLE_MAX, 5734 .policy = nft_flowtable_policy, 5735 }, 5736 [NFT_MSG_DELFLOWTABLE] = { 5737 .call_batch = nf_tables_delflowtable, 5738 .attr_count = NFTA_FLOWTABLE_MAX, 5739 .policy = nft_flowtable_policy, 5740 }, 5741 }; 5742 5743 static void nft_chain_commit_update(struct nft_trans *trans) 5744 { 5745 struct nft_base_chain *basechain; 5746 5747 if (nft_trans_chain_name(trans)) 5748 swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); 5749 5750 if (!nft_is_base_chain(trans->ctx.chain)) 5751 return; 5752 5753 basechain = nft_base_chain(trans->ctx.chain); 5754 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans)); 5755 5756 switch (nft_trans_chain_policy(trans)) { 5757 case NF_DROP: 5758 case NF_ACCEPT: 5759 basechain->policy = nft_trans_chain_policy(trans); 5760 break; 5761 } 5762 } 5763 5764 static void nf_tables_commit_release(struct nft_trans *trans) 5765 { 5766 switch (trans->msg_type) { 5767 case NFT_MSG_DELTABLE: 5768 nf_tables_table_destroy(&trans->ctx); 5769 break; 5770 case NFT_MSG_DELCHAIN: 5771 nf_tables_chain_destroy(&trans->ctx); 5772 break; 5773 case NFT_MSG_DELRULE: 5774 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 5775 break; 5776 case NFT_MSG_DELSET: 5777 nft_set_destroy(nft_trans_set(trans)); 5778 break; 5779 case NFT_MSG_DELSETELEM: 5780 nf_tables_set_elem_destroy(nft_trans_elem_set(trans), 5781 nft_trans_elem(trans).priv); 5782 break; 5783 case NFT_MSG_DELOBJ: 5784 nft_obj_destroy(nft_trans_obj(trans)); 5785 break; 5786 case NFT_MSG_DELFLOWTABLE: 5787 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 5788 break; 5789 } 5790 kfree(trans); 5791 } 5792 5793 static int nf_tables_commit(struct net *net, struct sk_buff *skb) 5794 { 5795 struct nft_trans *trans, *next; 5796 struct nft_trans_elem *te; 5797 5798 /* Bump generation counter, invalidate any dump in progress */ 5799 while (++net->nft.base_seq == 0); 5800 5801 /* A new generation has just started */ 5802 net->nft.gencursor = nft_gencursor_next(net); 5803 5804 /* Make sure all packets have left the previous generation before 5805 * purging old rules. 5806 */ 5807 synchronize_rcu(); 5808 5809 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { 5810 switch (trans->msg_type) { 5811 case NFT_MSG_NEWTABLE: 5812 if (nft_trans_table_update(trans)) { 5813 if (!nft_trans_table_enable(trans)) { 5814 nf_tables_table_disable(net, 5815 trans->ctx.table); 5816 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 5817 } 5818 } else { 5819 nft_clear(net, trans->ctx.table); 5820 } 5821 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE); 5822 nft_trans_destroy(trans); 5823 break; 5824 case NFT_MSG_DELTABLE: 5825 list_del_rcu(&trans->ctx.table->list); 5826 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE); 5827 break; 5828 case NFT_MSG_NEWCHAIN: 5829 if (nft_trans_chain_update(trans)) 5830 nft_chain_commit_update(trans); 5831 else 5832 nft_clear(net, trans->ctx.chain); 5833 5834 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN); 5835 nft_trans_destroy(trans); 5836 break; 5837 case NFT_MSG_DELCHAIN: 5838 list_del_rcu(&trans->ctx.chain->list); 5839 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN); 5840 nf_tables_unregister_hook(trans->ctx.net, 5841 trans->ctx.table, 5842 trans->ctx.chain); 5843 break; 5844 case NFT_MSG_NEWRULE: 5845 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 5846 nf_tables_rule_notify(&trans->ctx, 5847 nft_trans_rule(trans), 5848 NFT_MSG_NEWRULE); 5849 nft_trans_destroy(trans); 5850 break; 5851 case NFT_MSG_DELRULE: 5852 list_del_rcu(&nft_trans_rule(trans)->list); 5853 nf_tables_rule_notify(&trans->ctx, 5854 nft_trans_rule(trans), 5855 NFT_MSG_DELRULE); 5856 break; 5857 case NFT_MSG_NEWSET: 5858 nft_clear(net, nft_trans_set(trans)); 5859 /* This avoids hitting -EBUSY when deleting the table 5860 * from the transaction. 5861 */ 5862 if (nft_set_is_anonymous(nft_trans_set(trans)) && 5863 !list_empty(&nft_trans_set(trans)->bindings)) 5864 trans->ctx.table->use--; 5865 5866 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 5867 NFT_MSG_NEWSET, GFP_KERNEL); 5868 nft_trans_destroy(trans); 5869 break; 5870 case NFT_MSG_DELSET: 5871 list_del_rcu(&nft_trans_set(trans)->list); 5872 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 5873 NFT_MSG_DELSET, GFP_KERNEL); 5874 break; 5875 case NFT_MSG_NEWSETELEM: 5876 te = (struct nft_trans_elem *)trans->data; 5877 5878 te->set->ops->activate(net, te->set, &te->elem); 5879 nf_tables_setelem_notify(&trans->ctx, te->set, 5880 &te->elem, 5881 NFT_MSG_NEWSETELEM, 0); 5882 nft_trans_destroy(trans); 5883 break; 5884 case NFT_MSG_DELSETELEM: 5885 te = (struct nft_trans_elem *)trans->data; 5886 5887 nf_tables_setelem_notify(&trans->ctx, te->set, 5888 &te->elem, 5889 NFT_MSG_DELSETELEM, 0); 5890 te->set->ops->remove(net, te->set, &te->elem); 5891 atomic_dec(&te->set->nelems); 5892 te->set->ndeact--; 5893 break; 5894 case NFT_MSG_NEWOBJ: 5895 nft_clear(net, nft_trans_obj(trans)); 5896 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans), 5897 NFT_MSG_NEWOBJ); 5898 nft_trans_destroy(trans); 5899 break; 5900 case NFT_MSG_DELOBJ: 5901 list_del_rcu(&nft_trans_obj(trans)->list); 5902 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans), 5903 NFT_MSG_DELOBJ); 5904 break; 5905 case NFT_MSG_NEWFLOWTABLE: 5906 nft_clear(net, nft_trans_flowtable(trans)); 5907 nf_tables_flowtable_notify(&trans->ctx, 5908 nft_trans_flowtable(trans), 5909 NFT_MSG_NEWFLOWTABLE); 5910 nft_trans_destroy(trans); 5911 break; 5912 case NFT_MSG_DELFLOWTABLE: 5913 list_del_rcu(&nft_trans_flowtable(trans)->list); 5914 nf_tables_flowtable_notify(&trans->ctx, 5915 nft_trans_flowtable(trans), 5916 NFT_MSG_DELFLOWTABLE); 5917 nft_unregister_flowtable_net_hooks(net, 5918 nft_trans_flowtable(trans)); 5919 break; 5920 } 5921 } 5922 5923 synchronize_rcu(); 5924 5925 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { 5926 list_del(&trans->list); 5927 nf_tables_commit_release(trans); 5928 } 5929 5930 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 5931 5932 return 0; 5933 } 5934 5935 static void nf_tables_abort_release(struct nft_trans *trans) 5936 { 5937 switch (trans->msg_type) { 5938 case NFT_MSG_NEWTABLE: 5939 nf_tables_table_destroy(&trans->ctx); 5940 break; 5941 case NFT_MSG_NEWCHAIN: 5942 nf_tables_chain_destroy(&trans->ctx); 5943 break; 5944 case NFT_MSG_NEWRULE: 5945 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 5946 break; 5947 case NFT_MSG_NEWSET: 5948 nft_set_destroy(nft_trans_set(trans)); 5949 break; 5950 case NFT_MSG_NEWSETELEM: 5951 nft_set_elem_destroy(nft_trans_elem_set(trans), 5952 nft_trans_elem(trans).priv, true); 5953 break; 5954 case NFT_MSG_NEWOBJ: 5955 nft_obj_destroy(nft_trans_obj(trans)); 5956 break; 5957 case NFT_MSG_NEWFLOWTABLE: 5958 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 5959 break; 5960 } 5961 kfree(trans); 5962 } 5963 5964 static int nf_tables_abort(struct net *net, struct sk_buff *skb) 5965 { 5966 struct nft_trans *trans, *next; 5967 struct nft_trans_elem *te; 5968 5969 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list, 5970 list) { 5971 switch (trans->msg_type) { 5972 case NFT_MSG_NEWTABLE: 5973 if (nft_trans_table_update(trans)) { 5974 if (nft_trans_table_enable(trans)) { 5975 nf_tables_table_disable(net, 5976 trans->ctx.table); 5977 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 5978 } 5979 nft_trans_destroy(trans); 5980 } else { 5981 list_del_rcu(&trans->ctx.table->list); 5982 } 5983 break; 5984 case NFT_MSG_DELTABLE: 5985 nft_clear(trans->ctx.net, trans->ctx.table); 5986 nft_trans_destroy(trans); 5987 break; 5988 case NFT_MSG_NEWCHAIN: 5989 if (nft_trans_chain_update(trans)) { 5990 free_percpu(nft_trans_chain_stats(trans)); 5991 5992 nft_trans_destroy(trans); 5993 } else { 5994 trans->ctx.table->use--; 5995 list_del_rcu(&trans->ctx.chain->list); 5996 nf_tables_unregister_hook(trans->ctx.net, 5997 trans->ctx.table, 5998 trans->ctx.chain); 5999 } 6000 break; 6001 case NFT_MSG_DELCHAIN: 6002 trans->ctx.table->use++; 6003 nft_clear(trans->ctx.net, trans->ctx.chain); 6004 nft_trans_destroy(trans); 6005 break; 6006 case NFT_MSG_NEWRULE: 6007 trans->ctx.chain->use--; 6008 list_del_rcu(&nft_trans_rule(trans)->list); 6009 break; 6010 case NFT_MSG_DELRULE: 6011 trans->ctx.chain->use++; 6012 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 6013 nft_trans_destroy(trans); 6014 break; 6015 case NFT_MSG_NEWSET: 6016 trans->ctx.table->use--; 6017 list_del_rcu(&nft_trans_set(trans)->list); 6018 break; 6019 case NFT_MSG_DELSET: 6020 trans->ctx.table->use++; 6021 nft_clear(trans->ctx.net, nft_trans_set(trans)); 6022 nft_trans_destroy(trans); 6023 break; 6024 case NFT_MSG_NEWSETELEM: 6025 te = (struct nft_trans_elem *)trans->data; 6026 6027 te->set->ops->remove(net, te->set, &te->elem); 6028 atomic_dec(&te->set->nelems); 6029 break; 6030 case NFT_MSG_DELSETELEM: 6031 te = (struct nft_trans_elem *)trans->data; 6032 6033 nft_set_elem_activate(net, te->set, &te->elem); 6034 te->set->ops->activate(net, te->set, &te->elem); 6035 te->set->ndeact--; 6036 6037 nft_trans_destroy(trans); 6038 break; 6039 case NFT_MSG_NEWOBJ: 6040 trans->ctx.table->use--; 6041 list_del_rcu(&nft_trans_obj(trans)->list); 6042 break; 6043 case NFT_MSG_DELOBJ: 6044 trans->ctx.table->use++; 6045 nft_clear(trans->ctx.net, nft_trans_obj(trans)); 6046 nft_trans_destroy(trans); 6047 break; 6048 case NFT_MSG_NEWFLOWTABLE: 6049 trans->ctx.table->use--; 6050 list_del_rcu(&nft_trans_flowtable(trans)->list); 6051 nft_unregister_flowtable_net_hooks(net, 6052 nft_trans_flowtable(trans)); 6053 break; 6054 case NFT_MSG_DELFLOWTABLE: 6055 trans->ctx.table->use++; 6056 nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); 6057 nft_trans_destroy(trans); 6058 break; 6059 } 6060 } 6061 6062 synchronize_rcu(); 6063 6064 list_for_each_entry_safe_reverse(trans, next, 6065 &net->nft.commit_list, list) { 6066 list_del(&trans->list); 6067 nf_tables_abort_release(trans); 6068 } 6069 6070 return 0; 6071 } 6072 6073 static bool nf_tables_valid_genid(struct net *net, u32 genid) 6074 { 6075 return net->nft.base_seq == genid; 6076 } 6077 6078 static const struct nfnetlink_subsystem nf_tables_subsys = { 6079 .name = "nf_tables", 6080 .subsys_id = NFNL_SUBSYS_NFTABLES, 6081 .cb_count = NFT_MSG_MAX, 6082 .cb = nf_tables_cb, 6083 .commit = nf_tables_commit, 6084 .abort = nf_tables_abort, 6085 .valid_genid = nf_tables_valid_genid, 6086 }; 6087 6088 int nft_chain_validate_dependency(const struct nft_chain *chain, 6089 enum nft_chain_types type) 6090 { 6091 const struct nft_base_chain *basechain; 6092 6093 if (nft_is_base_chain(chain)) { 6094 basechain = nft_base_chain(chain); 6095 if (basechain->type->type != type) 6096 return -EOPNOTSUPP; 6097 } 6098 return 0; 6099 } 6100 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 6101 6102 int nft_chain_validate_hooks(const struct nft_chain *chain, 6103 unsigned int hook_flags) 6104 { 6105 struct nft_base_chain *basechain; 6106 6107 if (nft_is_base_chain(chain)) { 6108 basechain = nft_base_chain(chain); 6109 6110 if ((1 << basechain->ops.hooknum) & hook_flags) 6111 return 0; 6112 6113 return -EOPNOTSUPP; 6114 } 6115 6116 return 0; 6117 } 6118 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 6119 6120 /* 6121 * Loop detection - walk through the ruleset beginning at the destination chain 6122 * of a new jump until either the source chain is reached (loop) or all 6123 * reachable chains have been traversed. 6124 * 6125 * The loop check is performed whenever a new jump verdict is added to an 6126 * expression or verdict map or a verdict map is bound to a new chain. 6127 */ 6128 6129 static int nf_tables_check_loops(const struct nft_ctx *ctx, 6130 const struct nft_chain *chain); 6131 6132 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, 6133 struct nft_set *set, 6134 const struct nft_set_iter *iter, 6135 struct nft_set_elem *elem) 6136 { 6137 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6138 const struct nft_data *data; 6139 6140 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 6141 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 6142 return 0; 6143 6144 data = nft_set_ext_data(ext); 6145 switch (data->verdict.code) { 6146 case NFT_JUMP: 6147 case NFT_GOTO: 6148 return nf_tables_check_loops(ctx, data->verdict.chain); 6149 default: 6150 return 0; 6151 } 6152 } 6153 6154 static int nf_tables_check_loops(const struct nft_ctx *ctx, 6155 const struct nft_chain *chain) 6156 { 6157 const struct nft_rule *rule; 6158 const struct nft_expr *expr, *last; 6159 struct nft_set *set; 6160 struct nft_set_binding *binding; 6161 struct nft_set_iter iter; 6162 6163 if (ctx->chain == chain) 6164 return -ELOOP; 6165 6166 list_for_each_entry(rule, &chain->rules, list) { 6167 nft_rule_for_each_expr(expr, last, rule) { 6168 const struct nft_data *data = NULL; 6169 int err; 6170 6171 if (!expr->ops->validate) 6172 continue; 6173 6174 err = expr->ops->validate(ctx, expr, &data); 6175 if (err < 0) 6176 return err; 6177 6178 if (data == NULL) 6179 continue; 6180 6181 switch (data->verdict.code) { 6182 case NFT_JUMP: 6183 case NFT_GOTO: 6184 err = nf_tables_check_loops(ctx, 6185 data->verdict.chain); 6186 if (err < 0) 6187 return err; 6188 default: 6189 break; 6190 } 6191 } 6192 } 6193 6194 list_for_each_entry(set, &ctx->table->sets, list) { 6195 if (!nft_is_active_next(ctx->net, set)) 6196 continue; 6197 if (!(set->flags & NFT_SET_MAP) || 6198 set->dtype != NFT_DATA_VERDICT) 6199 continue; 6200 6201 list_for_each_entry(binding, &set->bindings, list) { 6202 if (!(binding->flags & NFT_SET_MAP) || 6203 binding->chain != chain) 6204 continue; 6205 6206 iter.genmask = nft_genmask_next(ctx->net); 6207 iter.skip = 0; 6208 iter.count = 0; 6209 iter.err = 0; 6210 iter.fn = nf_tables_loop_check_setelem; 6211 6212 set->ops->walk(ctx, set, &iter); 6213 if (iter.err < 0) 6214 return iter.err; 6215 } 6216 } 6217 6218 return 0; 6219 } 6220 6221 /** 6222 * nft_parse_u32_check - fetch u32 attribute and check for maximum value 6223 * 6224 * @attr: netlink attribute to fetch value from 6225 * @max: maximum value to be stored in dest 6226 * @dest: pointer to the variable 6227 * 6228 * Parse, check and store a given u32 netlink attribute into variable. 6229 * This function returns -ERANGE if the value goes over maximum value. 6230 * Otherwise a 0 is returned and the attribute value is stored in the 6231 * destination variable. 6232 */ 6233 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 6234 { 6235 u32 val; 6236 6237 val = ntohl(nla_get_be32(attr)); 6238 if (val > max) 6239 return -ERANGE; 6240 6241 *dest = val; 6242 return 0; 6243 } 6244 EXPORT_SYMBOL_GPL(nft_parse_u32_check); 6245 6246 /** 6247 * nft_parse_register - parse a register value from a netlink attribute 6248 * 6249 * @attr: netlink attribute 6250 * 6251 * Parse and translate a register value from a netlink attribute. 6252 * Registers used to be 128 bit wide, these register numbers will be 6253 * mapped to the corresponding 32 bit register numbers. 6254 */ 6255 unsigned int nft_parse_register(const struct nlattr *attr) 6256 { 6257 unsigned int reg; 6258 6259 reg = ntohl(nla_get_be32(attr)); 6260 switch (reg) { 6261 case NFT_REG_VERDICT...NFT_REG_4: 6262 return reg * NFT_REG_SIZE / NFT_REG32_SIZE; 6263 default: 6264 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 6265 } 6266 } 6267 EXPORT_SYMBOL_GPL(nft_parse_register); 6268 6269 /** 6270 * nft_dump_register - dump a register value to a netlink attribute 6271 * 6272 * @skb: socket buffer 6273 * @attr: attribute number 6274 * @reg: register number 6275 * 6276 * Construct a netlink attribute containing the register number. For 6277 * compatibility reasons, register numbers being a multiple of 4 are 6278 * translated to the corresponding 128 bit register numbers. 6279 */ 6280 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 6281 { 6282 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 6283 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 6284 else 6285 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 6286 6287 return nla_put_be32(skb, attr, htonl(reg)); 6288 } 6289 EXPORT_SYMBOL_GPL(nft_dump_register); 6290 6291 /** 6292 * nft_validate_register_load - validate a load from a register 6293 * 6294 * @reg: the register number 6295 * @len: the length of the data 6296 * 6297 * Validate that the input register is one of the general purpose 6298 * registers and that the length of the load is within the bounds. 6299 */ 6300 int nft_validate_register_load(enum nft_registers reg, unsigned int len) 6301 { 6302 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 6303 return -EINVAL; 6304 if (len == 0) 6305 return -EINVAL; 6306 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data)) 6307 return -ERANGE; 6308 6309 return 0; 6310 } 6311 EXPORT_SYMBOL_GPL(nft_validate_register_load); 6312 6313 /** 6314 * nft_validate_register_store - validate an expressions' register store 6315 * 6316 * @ctx: context of the expression performing the load 6317 * @reg: the destination register number 6318 * @data: the data to load 6319 * @type: the data type 6320 * @len: the length of the data 6321 * 6322 * Validate that a data load uses the appropriate data type for 6323 * the destination register and the length is within the bounds. 6324 * A value of NULL for the data means that its runtime gathered 6325 * data. 6326 */ 6327 int nft_validate_register_store(const struct nft_ctx *ctx, 6328 enum nft_registers reg, 6329 const struct nft_data *data, 6330 enum nft_data_types type, unsigned int len) 6331 { 6332 int err; 6333 6334 switch (reg) { 6335 case NFT_REG_VERDICT: 6336 if (type != NFT_DATA_VERDICT) 6337 return -EINVAL; 6338 6339 if (data != NULL && 6340 (data->verdict.code == NFT_GOTO || 6341 data->verdict.code == NFT_JUMP)) { 6342 err = nf_tables_check_loops(ctx, data->verdict.chain); 6343 if (err < 0) 6344 return err; 6345 6346 if (ctx->chain->level + 1 > 6347 data->verdict.chain->level) { 6348 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE) 6349 return -EMLINK; 6350 data->verdict.chain->level = ctx->chain->level + 1; 6351 } 6352 } 6353 6354 return 0; 6355 default: 6356 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 6357 return -EINVAL; 6358 if (len == 0) 6359 return -EINVAL; 6360 if (reg * NFT_REG32_SIZE + len > 6361 FIELD_SIZEOF(struct nft_regs, data)) 6362 return -ERANGE; 6363 6364 if (data != NULL && type != NFT_DATA_VALUE) 6365 return -EINVAL; 6366 return 0; 6367 } 6368 } 6369 EXPORT_SYMBOL_GPL(nft_validate_register_store); 6370 6371 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 6372 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 6373 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 6374 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 6375 }; 6376 6377 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 6378 struct nft_data_desc *desc, const struct nlattr *nla) 6379 { 6380 u8 genmask = nft_genmask_next(ctx->net); 6381 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 6382 struct nft_chain *chain; 6383 int err; 6384 6385 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy, 6386 NULL); 6387 if (err < 0) 6388 return err; 6389 6390 if (!tb[NFTA_VERDICT_CODE]) 6391 return -EINVAL; 6392 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 6393 6394 switch (data->verdict.code) { 6395 default: 6396 switch (data->verdict.code & NF_VERDICT_MASK) { 6397 case NF_ACCEPT: 6398 case NF_DROP: 6399 case NF_QUEUE: 6400 break; 6401 default: 6402 return -EINVAL; 6403 } 6404 /* fall through */ 6405 case NFT_CONTINUE: 6406 case NFT_BREAK: 6407 case NFT_RETURN: 6408 break; 6409 case NFT_JUMP: 6410 case NFT_GOTO: 6411 if (!tb[NFTA_VERDICT_CHAIN]) 6412 return -EINVAL; 6413 chain = nf_tables_chain_lookup(ctx->table, 6414 tb[NFTA_VERDICT_CHAIN], genmask); 6415 if (IS_ERR(chain)) 6416 return PTR_ERR(chain); 6417 if (nft_is_base_chain(chain)) 6418 return -EOPNOTSUPP; 6419 6420 chain->use++; 6421 data->verdict.chain = chain; 6422 break; 6423 } 6424 6425 desc->len = sizeof(data->verdict); 6426 desc->type = NFT_DATA_VERDICT; 6427 return 0; 6428 } 6429 6430 static void nft_verdict_uninit(const struct nft_data *data) 6431 { 6432 switch (data->verdict.code) { 6433 case NFT_JUMP: 6434 case NFT_GOTO: 6435 data->verdict.chain->use--; 6436 break; 6437 } 6438 } 6439 6440 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v) 6441 { 6442 struct nlattr *nest; 6443 6444 nest = nla_nest_start(skb, type); 6445 if (!nest) 6446 goto nla_put_failure; 6447 6448 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code))) 6449 goto nla_put_failure; 6450 6451 switch (v->code) { 6452 case NFT_JUMP: 6453 case NFT_GOTO: 6454 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 6455 v->chain->name)) 6456 goto nla_put_failure; 6457 } 6458 nla_nest_end(skb, nest); 6459 return 0; 6460 6461 nla_put_failure: 6462 return -1; 6463 } 6464 6465 static int nft_value_init(const struct nft_ctx *ctx, 6466 struct nft_data *data, unsigned int size, 6467 struct nft_data_desc *desc, const struct nlattr *nla) 6468 { 6469 unsigned int len; 6470 6471 len = nla_len(nla); 6472 if (len == 0) 6473 return -EINVAL; 6474 if (len > size) 6475 return -EOVERFLOW; 6476 6477 nla_memcpy(data->data, nla, len); 6478 desc->type = NFT_DATA_VALUE; 6479 desc->len = len; 6480 return 0; 6481 } 6482 6483 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 6484 unsigned int len) 6485 { 6486 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 6487 } 6488 6489 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 6490 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 6491 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 6492 }; 6493 6494 /** 6495 * nft_data_init - parse nf_tables data netlink attributes 6496 * 6497 * @ctx: context of the expression using the data 6498 * @data: destination struct nft_data 6499 * @size: maximum data length 6500 * @desc: data description 6501 * @nla: netlink attribute containing data 6502 * 6503 * Parse the netlink data attributes and initialize a struct nft_data. 6504 * The type and length of data are returned in the data description. 6505 * 6506 * The caller can indicate that it only wants to accept data of type 6507 * NFT_DATA_VALUE by passing NULL for the ctx argument. 6508 */ 6509 int nft_data_init(const struct nft_ctx *ctx, 6510 struct nft_data *data, unsigned int size, 6511 struct nft_data_desc *desc, const struct nlattr *nla) 6512 { 6513 struct nlattr *tb[NFTA_DATA_MAX + 1]; 6514 int err; 6515 6516 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL); 6517 if (err < 0) 6518 return err; 6519 6520 if (tb[NFTA_DATA_VALUE]) 6521 return nft_value_init(ctx, data, size, desc, 6522 tb[NFTA_DATA_VALUE]); 6523 if (tb[NFTA_DATA_VERDICT] && ctx != NULL) 6524 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 6525 return -EINVAL; 6526 } 6527 EXPORT_SYMBOL_GPL(nft_data_init); 6528 6529 /** 6530 * nft_data_release - release a nft_data item 6531 * 6532 * @data: struct nft_data to release 6533 * @type: type of data 6534 * 6535 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 6536 * all others need to be released by calling this function. 6537 */ 6538 void nft_data_release(const struct nft_data *data, enum nft_data_types type) 6539 { 6540 if (type < NFT_DATA_VERDICT) 6541 return; 6542 switch (type) { 6543 case NFT_DATA_VERDICT: 6544 return nft_verdict_uninit(data); 6545 default: 6546 WARN_ON(1); 6547 } 6548 } 6549 EXPORT_SYMBOL_GPL(nft_data_release); 6550 6551 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 6552 enum nft_data_types type, unsigned int len) 6553 { 6554 struct nlattr *nest; 6555 int err; 6556 6557 nest = nla_nest_start(skb, attr); 6558 if (nest == NULL) 6559 return -1; 6560 6561 switch (type) { 6562 case NFT_DATA_VALUE: 6563 err = nft_value_dump(skb, data, len); 6564 break; 6565 case NFT_DATA_VERDICT: 6566 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict); 6567 break; 6568 default: 6569 err = -EINVAL; 6570 WARN_ON(1); 6571 } 6572 6573 nla_nest_end(skb, nest); 6574 return err; 6575 } 6576 EXPORT_SYMBOL_GPL(nft_data_dump); 6577 6578 int __nft_release_basechain(struct nft_ctx *ctx) 6579 { 6580 struct nft_rule *rule, *nr; 6581 6582 BUG_ON(!nft_is_base_chain(ctx->chain)); 6583 6584 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); 6585 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { 6586 list_del(&rule->list); 6587 ctx->chain->use--; 6588 nf_tables_rule_destroy(ctx, rule); 6589 } 6590 list_del(&ctx->chain->list); 6591 ctx->table->use--; 6592 nf_tables_chain_destroy(ctx); 6593 6594 return 0; 6595 } 6596 EXPORT_SYMBOL_GPL(__nft_release_basechain); 6597 6598 static void __nft_release_tables(struct net *net) 6599 { 6600 struct nft_flowtable *flowtable, *nf; 6601 struct nft_table *table, *nt; 6602 struct nft_chain *chain, *nc; 6603 struct nft_object *obj, *ne; 6604 struct nft_rule *rule, *nr; 6605 struct nft_set *set, *ns; 6606 struct nft_ctx ctx = { 6607 .net = net, 6608 .family = NFPROTO_NETDEV, 6609 }; 6610 6611 list_for_each_entry_safe(table, nt, &net->nft.tables, list) { 6612 ctx.family = table->family; 6613 6614 list_for_each_entry(chain, &table->chains, list) 6615 nf_tables_unregister_hook(net, table, chain); 6616 list_for_each_entry(flowtable, &table->flowtables, list) 6617 nf_unregister_net_hooks(net, flowtable->ops, 6618 flowtable->ops_len); 6619 /* No packets are walking on these chains anymore. */ 6620 ctx.table = table; 6621 list_for_each_entry(chain, &table->chains, list) { 6622 ctx.chain = chain; 6623 list_for_each_entry_safe(rule, nr, &chain->rules, list) { 6624 list_del(&rule->list); 6625 chain->use--; 6626 nf_tables_rule_destroy(&ctx, rule); 6627 } 6628 } 6629 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 6630 list_del(&flowtable->list); 6631 table->use--; 6632 nf_tables_flowtable_destroy(flowtable); 6633 } 6634 list_for_each_entry_safe(set, ns, &table->sets, list) { 6635 list_del(&set->list); 6636 table->use--; 6637 nft_set_destroy(set); 6638 } 6639 list_for_each_entry_safe(obj, ne, &table->objects, list) { 6640 list_del(&obj->list); 6641 table->use--; 6642 nft_obj_destroy(obj); 6643 } 6644 list_for_each_entry_safe(chain, nc, &table->chains, list) { 6645 ctx.chain = chain; 6646 list_del(&chain->list); 6647 table->use--; 6648 nf_tables_chain_destroy(&ctx); 6649 } 6650 list_del(&table->list); 6651 nf_tables_table_destroy(&ctx); 6652 } 6653 } 6654 6655 static int __net_init nf_tables_init_net(struct net *net) 6656 { 6657 INIT_LIST_HEAD(&net->nft.tables); 6658 INIT_LIST_HEAD(&net->nft.commit_list); 6659 net->nft.base_seq = 1; 6660 return 0; 6661 } 6662 6663 static void __net_exit nf_tables_exit_net(struct net *net) 6664 { 6665 __nft_release_tables(net); 6666 WARN_ON_ONCE(!list_empty(&net->nft.tables)); 6667 WARN_ON_ONCE(!list_empty(&net->nft.commit_list)); 6668 } 6669 6670 static struct pernet_operations nf_tables_net_ops = { 6671 .init = nf_tables_init_net, 6672 .exit = nf_tables_exit_net, 6673 }; 6674 6675 static int __init nf_tables_module_init(void) 6676 { 6677 int err; 6678 6679 nft_chain_filter_init(); 6680 6681 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS, 6682 GFP_KERNEL); 6683 if (info == NULL) { 6684 err = -ENOMEM; 6685 goto err1; 6686 } 6687 6688 err = nf_tables_core_module_init(); 6689 if (err < 0) 6690 goto err2; 6691 6692 err = nfnetlink_subsys_register(&nf_tables_subsys); 6693 if (err < 0) 6694 goto err3; 6695 6696 register_netdevice_notifier(&nf_tables_flowtable_notifier); 6697 6698 return register_pernet_subsys(&nf_tables_net_ops); 6699 err3: 6700 nf_tables_core_module_exit(); 6701 err2: 6702 kfree(info); 6703 err1: 6704 return err; 6705 } 6706 6707 static void __exit nf_tables_module_exit(void) 6708 { 6709 unregister_pernet_subsys(&nf_tables_net_ops); 6710 nfnetlink_subsys_unregister(&nf_tables_subsys); 6711 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 6712 rcu_barrier(); 6713 nf_tables_core_module_exit(); 6714 kfree(info); 6715 nft_chain_filter_fini(); 6716 } 6717 6718 module_init(nf_tables_module_init); 6719 module_exit(nf_tables_module_exit); 6720 6721 MODULE_LICENSE("GPL"); 6722 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 6723 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 6724