1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
4 *
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8 #include <linux/module.h>
9 #include <linux/init.h>
10 #include <linux/list.h>
11 #include <linux/skbuff.h>
12 #include <linux/netlink.h>
13 #include <linux/vmalloc.h>
14 #include <linux/rhashtable.h>
15 #include <linux/audit.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nfnetlink.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_flow_table.h>
20 #include <net/netfilter/nf_tables_core.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_offload.h>
23 #include <net/net_namespace.h>
24 #include <net/sock.h>
25
26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
27
28 static LIST_HEAD(nf_tables_expressions);
29 static LIST_HEAD(nf_tables_objects);
30 static LIST_HEAD(nf_tables_flowtables);
31 static LIST_HEAD(nf_tables_destroy_list);
32 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
33 static u64 table_handle;
34
35 enum {
36 NFT_VALIDATE_SKIP = 0,
37 NFT_VALIDATE_NEED,
38 NFT_VALIDATE_DO,
39 };
40
41 static struct rhltable nft_objname_ht;
42
43 static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
44 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
45 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
46
47 static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
48 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
49 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
50
51 static const struct rhashtable_params nft_chain_ht_params = {
52 .head_offset = offsetof(struct nft_chain, rhlhead),
53 .key_offset = offsetof(struct nft_chain, name),
54 .hashfn = nft_chain_hash,
55 .obj_hashfn = nft_chain_hash_obj,
56 .obj_cmpfn = nft_chain_hash_cmp,
57 .automatic_shrinking = true,
58 };
59
60 static const struct rhashtable_params nft_objname_ht_params = {
61 .head_offset = offsetof(struct nft_object, rhlhead),
62 .key_offset = offsetof(struct nft_object, key),
63 .hashfn = nft_objname_hash,
64 .obj_hashfn = nft_objname_hash_obj,
65 .obj_cmpfn = nft_objname_hash_cmp,
66 .automatic_shrinking = true,
67 };
68
69 struct nft_audit_data {
70 struct nft_table *table;
71 int entries;
72 int op;
73 struct list_head list;
74 };
75
76 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types
77 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER,
78 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID,
79 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER,
80 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER,
81 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID,
82 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER,
83 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER,
84 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID,
85 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER,
86 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER,
87 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID,
88 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER,
89 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER,
90 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID,
91 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER,
92 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER,
93 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID,
94 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID,
95 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER,
96 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID,
97 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER,
98 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET,
99 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER,
100 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID,
101 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
102 };
103
nft_validate_state_update(struct net * net,u8 new_validate_state)104 static void nft_validate_state_update(struct net *net, u8 new_validate_state)
105 {
106 switch (net->nft.validate_state) {
107 case NFT_VALIDATE_SKIP:
108 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
109 break;
110 case NFT_VALIDATE_NEED:
111 break;
112 case NFT_VALIDATE_DO:
113 if (new_validate_state == NFT_VALIDATE_NEED)
114 return;
115 }
116
117 net->nft.validate_state = new_validate_state;
118 }
119 static void nf_tables_trans_destroy_work(struct work_struct *w);
120 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
121
nft_ctx_init(struct nft_ctx * ctx,struct net * net,const struct sk_buff * skb,const struct nlmsghdr * nlh,u8 family,struct nft_table * table,struct nft_chain * chain,const struct nlattr * const * nla)122 static void nft_ctx_init(struct nft_ctx *ctx,
123 struct net *net,
124 const struct sk_buff *skb,
125 const struct nlmsghdr *nlh,
126 u8 family,
127 struct nft_table *table,
128 struct nft_chain *chain,
129 const struct nlattr * const *nla)
130 {
131 ctx->net = net;
132 ctx->family = family;
133 ctx->level = 0;
134 ctx->table = table;
135 ctx->chain = chain;
136 ctx->nla = nla;
137 ctx->portid = NETLINK_CB(skb).portid;
138 ctx->report = nlmsg_report(nlh);
139 ctx->flags = nlh->nlmsg_flags;
140 ctx->seq = nlh->nlmsg_seq;
141 }
142
nft_trans_alloc_gfp(const struct nft_ctx * ctx,int msg_type,u32 size,gfp_t gfp)143 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
144 int msg_type, u32 size, gfp_t gfp)
145 {
146 struct nft_trans *trans;
147
148 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
149 if (trans == NULL)
150 return NULL;
151
152 INIT_LIST_HEAD(&trans->list);
153 trans->msg_type = msg_type;
154 trans->ctx = *ctx;
155
156 return trans;
157 }
158
nft_trans_alloc(const struct nft_ctx * ctx,int msg_type,u32 size)159 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
160 int msg_type, u32 size)
161 {
162 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
163 }
164
nft_trans_destroy(struct nft_trans * trans)165 static void nft_trans_destroy(struct nft_trans *trans)
166 {
167 list_del(&trans->list);
168 kfree(trans);
169 }
170
nft_set_trans_bind(const struct nft_ctx * ctx,struct nft_set * set)171 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
172 {
173 struct net *net = ctx->net;
174 struct nft_trans *trans;
175
176 if (!nft_set_is_anonymous(set))
177 return;
178
179 list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
180 switch (trans->msg_type) {
181 case NFT_MSG_NEWSET:
182 if (nft_trans_set(trans) == set)
183 nft_trans_set_bound(trans) = true;
184 break;
185 case NFT_MSG_NEWSETELEM:
186 if (nft_trans_elem_set(trans) == set)
187 nft_trans_elem_set_bound(trans) = true;
188 break;
189 }
190 }
191 }
192
nft_netdev_register_hooks(struct net * net,struct list_head * hook_list)193 static int nft_netdev_register_hooks(struct net *net,
194 struct list_head *hook_list)
195 {
196 struct nft_hook *hook;
197 int err, j;
198
199 j = 0;
200 list_for_each_entry(hook, hook_list, list) {
201 err = nf_register_net_hook(net, &hook->ops);
202 if (err < 0)
203 goto err_register;
204
205 j++;
206 }
207 return 0;
208
209 err_register:
210 list_for_each_entry(hook, hook_list, list) {
211 if (j-- <= 0)
212 break;
213
214 nf_unregister_net_hook(net, &hook->ops);
215 }
216 return err;
217 }
218
nft_netdev_unregister_hooks(struct net * net,struct list_head * hook_list)219 static void nft_netdev_unregister_hooks(struct net *net,
220 struct list_head *hook_list)
221 {
222 struct nft_hook *hook;
223
224 list_for_each_entry(hook, hook_list, list)
225 nf_unregister_net_hook(net, &hook->ops);
226 }
227
nf_tables_register_hook(struct net * net,const struct nft_table * table,struct nft_chain * chain)228 static int nf_tables_register_hook(struct net *net,
229 const struct nft_table *table,
230 struct nft_chain *chain)
231 {
232 struct nft_base_chain *basechain;
233 const struct nf_hook_ops *ops;
234
235 if (table->flags & NFT_TABLE_F_DORMANT ||
236 !nft_is_base_chain(chain))
237 return 0;
238
239 basechain = nft_base_chain(chain);
240 ops = &basechain->ops;
241
242 if (basechain->type->ops_register)
243 return basechain->type->ops_register(net, ops);
244
245 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
246 return nft_netdev_register_hooks(net, &basechain->hook_list);
247
248 return nf_register_net_hook(net, &basechain->ops);
249 }
250
nf_tables_unregister_hook(struct net * net,const struct nft_table * table,struct nft_chain * chain)251 static void nf_tables_unregister_hook(struct net *net,
252 const struct nft_table *table,
253 struct nft_chain *chain)
254 {
255 struct nft_base_chain *basechain;
256 const struct nf_hook_ops *ops;
257
258 if (table->flags & NFT_TABLE_F_DORMANT ||
259 !nft_is_base_chain(chain))
260 return;
261 basechain = nft_base_chain(chain);
262 ops = &basechain->ops;
263
264 if (basechain->type->ops_unregister)
265 return basechain->type->ops_unregister(net, ops);
266
267 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
268 nft_netdev_unregister_hooks(net, &basechain->hook_list);
269 else
270 nf_unregister_net_hook(net, &basechain->ops);
271 }
272
nft_trans_table_add(struct nft_ctx * ctx,int msg_type)273 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
274 {
275 struct nft_trans *trans;
276
277 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
278 if (trans == NULL)
279 return -ENOMEM;
280
281 if (msg_type == NFT_MSG_NEWTABLE)
282 nft_activate_next(ctx->net, ctx->table);
283
284 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
285 return 0;
286 }
287
nft_deltable(struct nft_ctx * ctx)288 static int nft_deltable(struct nft_ctx *ctx)
289 {
290 int err;
291
292 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
293 if (err < 0)
294 return err;
295
296 nft_deactivate_next(ctx->net, ctx->table);
297 return err;
298 }
299
nft_trans_chain_add(struct nft_ctx * ctx,int msg_type)300 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
301 {
302 struct nft_trans *trans;
303
304 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
305 if (trans == NULL)
306 return ERR_PTR(-ENOMEM);
307
308 if (msg_type == NFT_MSG_NEWCHAIN) {
309 nft_activate_next(ctx->net, ctx->chain);
310
311 if (ctx->nla[NFTA_CHAIN_ID]) {
312 nft_trans_chain_id(trans) =
313 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID]));
314 }
315 }
316
317 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
318 return trans;
319 }
320
nft_delchain(struct nft_ctx * ctx)321 static int nft_delchain(struct nft_ctx *ctx)
322 {
323 struct nft_trans *trans;
324
325 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
326 if (IS_ERR(trans))
327 return PTR_ERR(trans);
328
329 ctx->table->use--;
330 nft_deactivate_next(ctx->net, ctx->chain);
331
332 return 0;
333 }
334
nft_rule_expr_activate(const struct nft_ctx * ctx,struct nft_rule * rule)335 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
336 struct nft_rule *rule)
337 {
338 struct nft_expr *expr;
339
340 expr = nft_expr_first(rule);
341 while (nft_expr_more(rule, expr)) {
342 if (expr->ops->activate)
343 expr->ops->activate(ctx, expr);
344
345 expr = nft_expr_next(expr);
346 }
347 }
348
nft_rule_expr_deactivate(const struct nft_ctx * ctx,struct nft_rule * rule,enum nft_trans_phase phase)349 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
350 struct nft_rule *rule,
351 enum nft_trans_phase phase)
352 {
353 struct nft_expr *expr;
354
355 expr = nft_expr_first(rule);
356 while (nft_expr_more(rule, expr)) {
357 if (expr->ops->deactivate)
358 expr->ops->deactivate(ctx, expr, phase);
359
360 expr = nft_expr_next(expr);
361 }
362 }
363
364 static int
nf_tables_delrule_deactivate(struct nft_ctx * ctx,struct nft_rule * rule)365 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
366 {
367 /* You cannot delete the same rule twice */
368 if (nft_is_active_next(ctx->net, rule)) {
369 nft_deactivate_next(ctx->net, rule);
370 ctx->chain->use--;
371 return 0;
372 }
373 return -ENOENT;
374 }
375
nft_trans_rule_add(struct nft_ctx * ctx,int msg_type,struct nft_rule * rule)376 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
377 struct nft_rule *rule)
378 {
379 struct nft_trans *trans;
380
381 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
382 if (trans == NULL)
383 return NULL;
384
385 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
386 nft_trans_rule_id(trans) =
387 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
388 }
389 nft_trans_rule(trans) = rule;
390 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
391
392 return trans;
393 }
394
nft_delrule(struct nft_ctx * ctx,struct nft_rule * rule)395 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
396 {
397 struct nft_flow_rule *flow;
398 struct nft_trans *trans;
399 int err;
400
401 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
402 if (trans == NULL)
403 return -ENOMEM;
404
405 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
406 flow = nft_flow_rule_create(ctx->net, rule);
407 if (IS_ERR(flow)) {
408 nft_trans_destroy(trans);
409 return PTR_ERR(flow);
410 }
411
412 nft_trans_flow_rule(trans) = flow;
413 }
414
415 err = nf_tables_delrule_deactivate(ctx, rule);
416 if (err < 0) {
417 nft_trans_destroy(trans);
418 return err;
419 }
420 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
421
422 return 0;
423 }
424
nft_delrule_by_chain(struct nft_ctx * ctx)425 static int nft_delrule_by_chain(struct nft_ctx *ctx)
426 {
427 struct nft_rule *rule;
428 int err;
429
430 list_for_each_entry(rule, &ctx->chain->rules, list) {
431 if (!nft_is_active_next(ctx->net, rule))
432 continue;
433
434 err = nft_delrule(ctx, rule);
435 if (err < 0)
436 return err;
437 }
438 return 0;
439 }
440
nft_trans_set_add(const struct nft_ctx * ctx,int msg_type,struct nft_set * set)441 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
442 struct nft_set *set)
443 {
444 struct nft_trans *trans;
445
446 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
447 if (trans == NULL)
448 return -ENOMEM;
449
450 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
451 nft_trans_set_id(trans) =
452 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
453 nft_activate_next(ctx->net, set);
454 }
455 nft_trans_set(trans) = set;
456 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
457
458 return 0;
459 }
460
nft_delset(const struct nft_ctx * ctx,struct nft_set * set)461 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
462 {
463 int err;
464
465 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
466 if (err < 0)
467 return err;
468
469 nft_deactivate_next(ctx->net, set);
470 ctx->table->use--;
471
472 return err;
473 }
474
nft_trans_obj_add(struct nft_ctx * ctx,int msg_type,struct nft_object * obj)475 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
476 struct nft_object *obj)
477 {
478 struct nft_trans *trans;
479
480 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
481 if (trans == NULL)
482 return -ENOMEM;
483
484 if (msg_type == NFT_MSG_NEWOBJ)
485 nft_activate_next(ctx->net, obj);
486
487 nft_trans_obj(trans) = obj;
488 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
489
490 return 0;
491 }
492
nft_delobj(struct nft_ctx * ctx,struct nft_object * obj)493 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
494 {
495 int err;
496
497 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
498 if (err < 0)
499 return err;
500
501 nft_deactivate_next(ctx->net, obj);
502 ctx->table->use--;
503
504 return err;
505 }
506
nft_trans_flowtable_add(struct nft_ctx * ctx,int msg_type,struct nft_flowtable * flowtable)507 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
508 struct nft_flowtable *flowtable)
509 {
510 struct nft_trans *trans;
511
512 trans = nft_trans_alloc(ctx, msg_type,
513 sizeof(struct nft_trans_flowtable));
514 if (trans == NULL)
515 return -ENOMEM;
516
517 if (msg_type == NFT_MSG_NEWFLOWTABLE)
518 nft_activate_next(ctx->net, flowtable);
519
520 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
521 nft_trans_flowtable(trans) = flowtable;
522 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
523
524 return 0;
525 }
526
nft_delflowtable(struct nft_ctx * ctx,struct nft_flowtable * flowtable)527 static int nft_delflowtable(struct nft_ctx *ctx,
528 struct nft_flowtable *flowtable)
529 {
530 int err;
531
532 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
533 if (err < 0)
534 return err;
535
536 nft_deactivate_next(ctx->net, flowtable);
537 ctx->table->use--;
538
539 return err;
540 }
541
542 /*
543 * Tables
544 */
545
nft_table_lookup(const struct net * net,const struct nlattr * nla,u8 family,u8 genmask)546 static struct nft_table *nft_table_lookup(const struct net *net,
547 const struct nlattr *nla,
548 u8 family, u8 genmask)
549 {
550 struct nft_table *table;
551
552 if (nla == NULL)
553 return ERR_PTR(-EINVAL);
554
555 list_for_each_entry_rcu(table, &net->nft.tables, list,
556 lockdep_is_held(&net->nft.commit_mutex)) {
557 if (!nla_strcmp(nla, table->name) &&
558 table->family == family &&
559 nft_active_genmask(table, genmask))
560 return table;
561 }
562
563 return ERR_PTR(-ENOENT);
564 }
565
nft_table_lookup_byhandle(const struct net * net,const struct nlattr * nla,u8 genmask)566 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
567 const struct nlattr *nla,
568 u8 genmask)
569 {
570 struct nft_table *table;
571
572 list_for_each_entry(table, &net->nft.tables, list) {
573 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
574 nft_active_genmask(table, genmask))
575 return table;
576 }
577
578 return ERR_PTR(-ENOENT);
579 }
580
nf_tables_alloc_handle(struct nft_table * table)581 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
582 {
583 return ++table->hgenerator;
584 }
585
586 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
587
588 static const struct nft_chain_type *
__nft_chain_type_get(u8 family,enum nft_chain_types type)589 __nft_chain_type_get(u8 family, enum nft_chain_types type)
590 {
591 if (family >= NFPROTO_NUMPROTO ||
592 type >= NFT_CHAIN_T_MAX)
593 return NULL;
594
595 return chain_type[family][type];
596 }
597
598 static const struct nft_chain_type *
__nf_tables_chain_type_lookup(const struct nlattr * nla,u8 family)599 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
600 {
601 const struct nft_chain_type *type;
602 int i;
603
604 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
605 type = __nft_chain_type_get(family, i);
606 if (!type)
607 continue;
608 if (!nla_strcmp(nla, type->name))
609 return type;
610 }
611 return NULL;
612 }
613
614 struct nft_module_request {
615 struct list_head list;
616 char module[MODULE_NAME_LEN];
617 bool done;
618 };
619
620 #ifdef CONFIG_MODULES
nft_request_module(struct net * net,const char * fmt,...)621 static int nft_request_module(struct net *net, const char *fmt, ...)
622 {
623 char module_name[MODULE_NAME_LEN];
624 struct nft_module_request *req;
625 va_list args;
626 int ret;
627
628 va_start(args, fmt);
629 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
630 va_end(args);
631 if (ret >= MODULE_NAME_LEN)
632 return 0;
633
634 list_for_each_entry(req, &net->nft.module_list, list) {
635 if (!strcmp(req->module, module_name)) {
636 if (req->done)
637 return 0;
638
639 /* A request to load this module already exists. */
640 return -EAGAIN;
641 }
642 }
643
644 req = kmalloc(sizeof(*req), GFP_KERNEL);
645 if (!req)
646 return -ENOMEM;
647
648 req->done = false;
649 strlcpy(req->module, module_name, MODULE_NAME_LEN);
650 list_add_tail(&req->list, &net->nft.module_list);
651
652 return -EAGAIN;
653 }
654 #endif
655
lockdep_nfnl_nft_mutex_not_held(void)656 static void lockdep_nfnl_nft_mutex_not_held(void)
657 {
658 #ifdef CONFIG_PROVE_LOCKING
659 if (debug_locks)
660 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
661 #endif
662 }
663
664 static const struct nft_chain_type *
nf_tables_chain_type_lookup(struct net * net,const struct nlattr * nla,u8 family,bool autoload)665 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
666 u8 family, bool autoload)
667 {
668 const struct nft_chain_type *type;
669
670 type = __nf_tables_chain_type_lookup(nla, family);
671 if (type != NULL)
672 return type;
673
674 lockdep_nfnl_nft_mutex_not_held();
675 #ifdef CONFIG_MODULES
676 if (autoload) {
677 if (nft_request_module(net, "nft-chain-%u-%.*s", family,
678 nla_len(nla),
679 (const char *)nla_data(nla)) == -EAGAIN)
680 return ERR_PTR(-EAGAIN);
681 }
682 #endif
683 return ERR_PTR(-ENOENT);
684 }
685
nft_base_seq(const struct net * net)686 static __be16 nft_base_seq(const struct net *net)
687 {
688 return htons(net->nft.base_seq & 0xffff);
689 }
690
691 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
692 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
693 .len = NFT_TABLE_MAXNAMELEN - 1 },
694 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
695 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
696 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY,
697 .len = NFT_USERDATA_MAXLEN }
698 };
699
nf_tables_fill_table_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table)700 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
701 u32 portid, u32 seq, int event, u32 flags,
702 int family, const struct nft_table *table)
703 {
704 struct nlmsghdr *nlh;
705
706 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
707 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
708 NFNETLINK_V0, nft_base_seq(net));
709 if (!nlh)
710 goto nla_put_failure;
711
712 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
713 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
714 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
715 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
716 NFTA_TABLE_PAD))
717 goto nla_put_failure;
718
719 if (table->udata) {
720 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata))
721 goto nla_put_failure;
722 }
723
724 nlmsg_end(skb, nlh);
725 return 0;
726
727 nla_put_failure:
728 nlmsg_trim(skb, nlh);
729 return -1;
730 }
731
732 struct nftnl_skb_parms {
733 bool report;
734 };
735 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb))
736
nft_notify_enqueue(struct sk_buff * skb,bool report,struct list_head * notify_list)737 static void nft_notify_enqueue(struct sk_buff *skb, bool report,
738 struct list_head *notify_list)
739 {
740 NFT_CB(skb).report = report;
741 list_add_tail(&skb->list, notify_list);
742 }
743
nf_tables_table_notify(const struct nft_ctx * ctx,int event)744 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
745 {
746 struct sk_buff *skb;
747 int err;
748
749 if (!ctx->report &&
750 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
751 return;
752
753 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
754 if (skb == NULL)
755 goto err;
756
757 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
758 event, 0, ctx->family, ctx->table);
759 if (err < 0) {
760 kfree_skb(skb);
761 goto err;
762 }
763
764 nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
765 return;
766 err:
767 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
768 }
769
nf_tables_dump_tables(struct sk_buff * skb,struct netlink_callback * cb)770 static int nf_tables_dump_tables(struct sk_buff *skb,
771 struct netlink_callback *cb)
772 {
773 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
774 const struct nft_table *table;
775 unsigned int idx = 0, s_idx = cb->args[0];
776 struct net *net = sock_net(skb->sk);
777 int family = nfmsg->nfgen_family;
778
779 rcu_read_lock();
780 cb->seq = net->nft.base_seq;
781
782 list_for_each_entry_rcu(table, &net->nft.tables, list) {
783 if (family != NFPROTO_UNSPEC && family != table->family)
784 continue;
785
786 if (idx < s_idx)
787 goto cont;
788 if (idx > s_idx)
789 memset(&cb->args[1], 0,
790 sizeof(cb->args) - sizeof(cb->args[0]));
791 if (!nft_is_active(net, table))
792 continue;
793 if (nf_tables_fill_table_info(skb, net,
794 NETLINK_CB(cb->skb).portid,
795 cb->nlh->nlmsg_seq,
796 NFT_MSG_NEWTABLE, NLM_F_MULTI,
797 table->family, table) < 0)
798 goto done;
799
800 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
801 cont:
802 idx++;
803 }
804 done:
805 rcu_read_unlock();
806 cb->args[0] = idx;
807 return skb->len;
808 }
809
nft_netlink_dump_start_rcu(struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,struct netlink_dump_control * c)810 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
811 const struct nlmsghdr *nlh,
812 struct netlink_dump_control *c)
813 {
814 int err;
815
816 if (!try_module_get(THIS_MODULE))
817 return -EINVAL;
818
819 rcu_read_unlock();
820 err = netlink_dump_start(nlsk, skb, nlh, c);
821 rcu_read_lock();
822 module_put(THIS_MODULE);
823
824 return err;
825 }
826
827 /* called with rcu_read_lock held */
nf_tables_gettable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)828 static int nf_tables_gettable(struct net *net, struct sock *nlsk,
829 struct sk_buff *skb, const struct nlmsghdr *nlh,
830 const struct nlattr * const nla[],
831 struct netlink_ext_ack *extack)
832 {
833 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
834 u8 genmask = nft_genmask_cur(net);
835 const struct nft_table *table;
836 struct sk_buff *skb2;
837 int family = nfmsg->nfgen_family;
838 int err;
839
840 if (nlh->nlmsg_flags & NLM_F_DUMP) {
841 struct netlink_dump_control c = {
842 .dump = nf_tables_dump_tables,
843 .module = THIS_MODULE,
844 };
845
846 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
847 }
848
849 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
850 if (IS_ERR(table)) {
851 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
852 return PTR_ERR(table);
853 }
854
855 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
856 if (!skb2)
857 return -ENOMEM;
858
859 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
860 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
861 family, table);
862 if (err < 0)
863 goto err_fill_table_info;
864
865 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
866
867 err_fill_table_info:
868 kfree_skb(skb2);
869 return err;
870 }
871
nft_table_disable(struct net * net,struct nft_table * table,u32 cnt)872 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
873 {
874 struct nft_chain *chain;
875 u32 i = 0;
876
877 list_for_each_entry(chain, &table->chains, list) {
878 if (!nft_is_active_next(net, chain))
879 continue;
880 if (!nft_is_base_chain(chain))
881 continue;
882
883 if (cnt && i++ == cnt)
884 break;
885
886 nf_tables_unregister_hook(net, table, chain);
887 }
888 }
889
nf_tables_table_enable(struct net * net,struct nft_table * table)890 static int nf_tables_table_enable(struct net *net, struct nft_table *table)
891 {
892 struct nft_chain *chain;
893 int err, i = 0;
894
895 list_for_each_entry(chain, &table->chains, list) {
896 if (!nft_is_active_next(net, chain))
897 continue;
898 if (!nft_is_base_chain(chain))
899 continue;
900
901 err = nf_tables_register_hook(net, table, chain);
902 if (err < 0)
903 goto err_register_hooks;
904
905 i++;
906 }
907 return 0;
908
909 err_register_hooks:
910 if (i)
911 nft_table_disable(net, table, i);
912 return err;
913 }
914
nf_tables_table_disable(struct net * net,struct nft_table * table)915 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
916 {
917 nft_table_disable(net, table, 0);
918 }
919
nf_tables_updtable(struct nft_ctx * ctx)920 static int nf_tables_updtable(struct nft_ctx *ctx)
921 {
922 struct nft_trans *trans;
923 u32 flags;
924 int ret = 0;
925
926 if (!ctx->nla[NFTA_TABLE_FLAGS])
927 return 0;
928
929 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
930 if (flags & ~NFT_TABLE_F_DORMANT)
931 return -EINVAL;
932
933 if (flags == ctx->table->flags)
934 return 0;
935
936 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
937 sizeof(struct nft_trans_table));
938 if (trans == NULL)
939 return -ENOMEM;
940
941 if ((flags & NFT_TABLE_F_DORMANT) &&
942 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
943 nft_trans_table_enable(trans) = false;
944 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
945 ctx->table->flags & NFT_TABLE_F_DORMANT) {
946 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
947 ret = nf_tables_table_enable(ctx->net, ctx->table);
948 if (ret >= 0)
949 nft_trans_table_enable(trans) = true;
950 else
951 ctx->table->flags |= NFT_TABLE_F_DORMANT;
952 }
953 if (ret < 0)
954 goto err;
955
956 nft_trans_table_update(trans) = true;
957 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
958 return 0;
959 err:
960 nft_trans_destroy(trans);
961 return ret;
962 }
963
nft_chain_hash(const void * data,u32 len,u32 seed)964 static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
965 {
966 const char *name = data;
967
968 return jhash(name, strlen(name), seed);
969 }
970
nft_chain_hash_obj(const void * data,u32 len,u32 seed)971 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
972 {
973 const struct nft_chain *chain = data;
974
975 return nft_chain_hash(chain->name, 0, seed);
976 }
977
nft_chain_hash_cmp(struct rhashtable_compare_arg * arg,const void * ptr)978 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
979 const void *ptr)
980 {
981 const struct nft_chain *chain = ptr;
982 const char *name = arg->key;
983
984 return strcmp(chain->name, name);
985 }
986
nft_objname_hash(const void * data,u32 len,u32 seed)987 static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
988 {
989 const struct nft_object_hash_key *k = data;
990
991 seed ^= hash_ptr(k->table, 32);
992
993 return jhash(k->name, strlen(k->name), seed);
994 }
995
nft_objname_hash_obj(const void * data,u32 len,u32 seed)996 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
997 {
998 const struct nft_object *obj = data;
999
1000 return nft_objname_hash(&obj->key, 0, seed);
1001 }
1002
nft_objname_hash_cmp(struct rhashtable_compare_arg * arg,const void * ptr)1003 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
1004 const void *ptr)
1005 {
1006 const struct nft_object_hash_key *k = arg->key;
1007 const struct nft_object *obj = ptr;
1008
1009 if (obj->key.table != k->table)
1010 return -1;
1011
1012 return strcmp(obj->key.name, k->name);
1013 }
1014
nf_tables_newtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)1015 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
1016 struct sk_buff *skb, const struct nlmsghdr *nlh,
1017 const struct nlattr * const nla[],
1018 struct netlink_ext_ack *extack)
1019 {
1020 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1021 u8 genmask = nft_genmask_next(net);
1022 int family = nfmsg->nfgen_family;
1023 const struct nlattr *attr;
1024 struct nft_table *table;
1025 struct nft_ctx ctx;
1026 u32 flags = 0;
1027 int err;
1028
1029 lockdep_assert_held(&net->nft.commit_mutex);
1030 attr = nla[NFTA_TABLE_NAME];
1031 table = nft_table_lookup(net, attr, family, genmask);
1032 if (IS_ERR(table)) {
1033 if (PTR_ERR(table) != -ENOENT)
1034 return PTR_ERR(table);
1035 } else {
1036 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1037 NL_SET_BAD_ATTR(extack, attr);
1038 return -EEXIST;
1039 }
1040 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1041 return -EOPNOTSUPP;
1042
1043 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
1044 return nf_tables_updtable(&ctx);
1045 }
1046
1047 if (nla[NFTA_TABLE_FLAGS]) {
1048 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
1049 if (flags & ~NFT_TABLE_F_DORMANT)
1050 return -EINVAL;
1051 }
1052
1053 err = -ENOMEM;
1054 table = kzalloc(sizeof(*table), GFP_KERNEL);
1055 if (table == NULL)
1056 goto err_kzalloc;
1057
1058 table->name = nla_strdup(attr, GFP_KERNEL);
1059 if (table->name == NULL)
1060 goto err_strdup;
1061
1062 if (nla[NFTA_TABLE_USERDATA]) {
1063 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL);
1064 if (table->udata == NULL)
1065 goto err_table_udata;
1066
1067 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]);
1068 }
1069
1070 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
1071 if (err)
1072 goto err_chain_ht;
1073
1074 INIT_LIST_HEAD(&table->chains);
1075 INIT_LIST_HEAD(&table->sets);
1076 INIT_LIST_HEAD(&table->objects);
1077 INIT_LIST_HEAD(&table->flowtables);
1078 table->family = family;
1079 table->flags = flags;
1080 table->handle = ++table_handle;
1081
1082 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
1083 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
1084 if (err < 0)
1085 goto err_trans;
1086
1087 list_add_tail_rcu(&table->list, &net->nft.tables);
1088 return 0;
1089 err_trans:
1090 rhltable_destroy(&table->chains_ht);
1091 err_chain_ht:
1092 kfree(table->udata);
1093 err_table_udata:
1094 kfree(table->name);
1095 err_strdup:
1096 kfree(table);
1097 err_kzalloc:
1098 return err;
1099 }
1100
nft_flush_table(struct nft_ctx * ctx)1101 static int nft_flush_table(struct nft_ctx *ctx)
1102 {
1103 struct nft_flowtable *flowtable, *nft;
1104 struct nft_chain *chain, *nc;
1105 struct nft_object *obj, *ne;
1106 struct nft_set *set, *ns;
1107 int err;
1108
1109 list_for_each_entry(chain, &ctx->table->chains, list) {
1110 if (!nft_is_active_next(ctx->net, chain))
1111 continue;
1112
1113 if (nft_chain_is_bound(chain))
1114 continue;
1115
1116 ctx->chain = chain;
1117
1118 err = nft_delrule_by_chain(ctx);
1119 if (err < 0)
1120 goto out;
1121 }
1122
1123 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
1124 if (!nft_is_active_next(ctx->net, set))
1125 continue;
1126
1127 if (nft_set_is_anonymous(set) &&
1128 !list_empty(&set->bindings))
1129 continue;
1130
1131 err = nft_delset(ctx, set);
1132 if (err < 0)
1133 goto out;
1134 }
1135
1136 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
1137 if (!nft_is_active_next(ctx->net, flowtable))
1138 continue;
1139
1140 err = nft_delflowtable(ctx, flowtable);
1141 if (err < 0)
1142 goto out;
1143 }
1144
1145 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
1146 if (!nft_is_active_next(ctx->net, obj))
1147 continue;
1148
1149 err = nft_delobj(ctx, obj);
1150 if (err < 0)
1151 goto out;
1152 }
1153
1154 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
1155 if (!nft_is_active_next(ctx->net, chain))
1156 continue;
1157
1158 if (nft_chain_is_bound(chain))
1159 continue;
1160
1161 ctx->chain = chain;
1162
1163 err = nft_delchain(ctx);
1164 if (err < 0)
1165 goto out;
1166 }
1167
1168 err = nft_deltable(ctx);
1169 out:
1170 return err;
1171 }
1172
nft_flush(struct nft_ctx * ctx,int family)1173 static int nft_flush(struct nft_ctx *ctx, int family)
1174 {
1175 struct nft_table *table, *nt;
1176 const struct nlattr * const *nla = ctx->nla;
1177 int err = 0;
1178
1179 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
1180 if (family != AF_UNSPEC && table->family != family)
1181 continue;
1182
1183 ctx->family = table->family;
1184
1185 if (!nft_is_active_next(ctx->net, table))
1186 continue;
1187
1188 if (nla[NFTA_TABLE_NAME] &&
1189 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1190 continue;
1191
1192 ctx->table = table;
1193
1194 err = nft_flush_table(ctx);
1195 if (err < 0)
1196 goto out;
1197 }
1198 out:
1199 return err;
1200 }
1201
nf_tables_deltable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)1202 static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1203 struct sk_buff *skb, const struct nlmsghdr *nlh,
1204 const struct nlattr * const nla[],
1205 struct netlink_ext_ack *extack)
1206 {
1207 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1208 u8 genmask = nft_genmask_next(net);
1209 int family = nfmsg->nfgen_family;
1210 const struct nlattr *attr;
1211 struct nft_table *table;
1212 struct nft_ctx ctx;
1213
1214 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
1215 if (family == AF_UNSPEC ||
1216 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
1217 return nft_flush(&ctx, family);
1218
1219 if (nla[NFTA_TABLE_HANDLE]) {
1220 attr = nla[NFTA_TABLE_HANDLE];
1221 table = nft_table_lookup_byhandle(net, attr, genmask);
1222 } else {
1223 attr = nla[NFTA_TABLE_NAME];
1224 table = nft_table_lookup(net, attr, family, genmask);
1225 }
1226
1227 if (IS_ERR(table)) {
1228 NL_SET_BAD_ATTR(extack, attr);
1229 return PTR_ERR(table);
1230 }
1231
1232 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1233 table->use > 0)
1234 return -EBUSY;
1235
1236 ctx.family = family;
1237 ctx.table = table;
1238
1239 return nft_flush_table(&ctx);
1240 }
1241
nf_tables_table_destroy(struct nft_ctx * ctx)1242 static void nf_tables_table_destroy(struct nft_ctx *ctx)
1243 {
1244 if (WARN_ON(ctx->table->use > 0))
1245 return;
1246
1247 rhltable_destroy(&ctx->table->chains_ht);
1248 kfree(ctx->table->name);
1249 kfree(ctx->table->udata);
1250 kfree(ctx->table);
1251 }
1252
nft_register_chain_type(const struct nft_chain_type * ctype)1253 void nft_register_chain_type(const struct nft_chain_type *ctype)
1254 {
1255 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1256 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
1257 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1258 return;
1259 }
1260 chain_type[ctype->family][ctype->type] = ctype;
1261 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1262 }
1263 EXPORT_SYMBOL_GPL(nft_register_chain_type);
1264
nft_unregister_chain_type(const struct nft_chain_type * ctype)1265 void nft_unregister_chain_type(const struct nft_chain_type *ctype)
1266 {
1267 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1268 chain_type[ctype->family][ctype->type] = NULL;
1269 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1270 }
1271 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
1272
1273 /*
1274 * Chains
1275 */
1276
1277 static struct nft_chain *
nft_chain_lookup_byhandle(const struct nft_table * table,u64 handle,u8 genmask)1278 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
1279 {
1280 struct nft_chain *chain;
1281
1282 list_for_each_entry(chain, &table->chains, list) {
1283 if (chain->handle == handle &&
1284 nft_active_genmask(chain, genmask))
1285 return chain;
1286 }
1287
1288 return ERR_PTR(-ENOENT);
1289 }
1290
lockdep_commit_lock_is_held(const struct net * net)1291 static bool lockdep_commit_lock_is_held(const struct net *net)
1292 {
1293 #ifdef CONFIG_PROVE_LOCKING
1294 return lockdep_is_held(&net->nft.commit_mutex);
1295 #else
1296 return true;
1297 #endif
1298 }
1299
nft_chain_lookup(struct net * net,struct nft_table * table,const struct nlattr * nla,u8 genmask)1300 static struct nft_chain *nft_chain_lookup(struct net *net,
1301 struct nft_table *table,
1302 const struct nlattr *nla, u8 genmask)
1303 {
1304 char search[NFT_CHAIN_MAXNAMELEN + 1];
1305 struct rhlist_head *tmp, *list;
1306 struct nft_chain *chain;
1307
1308 if (nla == NULL)
1309 return ERR_PTR(-EINVAL);
1310
1311 nla_strlcpy(search, nla, sizeof(search));
1312
1313 WARN_ON(!rcu_read_lock_held() &&
1314 !lockdep_commit_lock_is_held(net));
1315
1316 chain = ERR_PTR(-ENOENT);
1317 rcu_read_lock();
1318 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1319 if (!list)
1320 goto out_unlock;
1321
1322 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1323 if (nft_active_genmask(chain, genmask))
1324 goto out_unlock;
1325 }
1326 chain = ERR_PTR(-ENOENT);
1327 out_unlock:
1328 rcu_read_unlock();
1329 return chain;
1330 }
1331
1332 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
1333 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1334 .len = NFT_TABLE_MAXNAMELEN - 1 },
1335 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1336 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1337 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1338 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
1339 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
1340 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING,
1341 .len = NFT_MODULE_AUTOLOAD_LIMIT },
1342 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
1343 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
1344 [NFTA_CHAIN_ID] = { .type = NLA_U32 },
1345 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY,
1346 .len = NFT_USERDATA_MAXLEN },
1347 };
1348
1349 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1350 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1351 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
1352 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1353 .len = IFNAMSIZ - 1 },
1354 };
1355
nft_dump_stats(struct sk_buff * skb,struct nft_stats __percpu * stats)1356 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1357 {
1358 struct nft_stats *cpu_stats, total;
1359 struct nlattr *nest;
1360 unsigned int seq;
1361 u64 pkts, bytes;
1362 int cpu;
1363
1364 if (!stats)
1365 return 0;
1366
1367 memset(&total, 0, sizeof(total));
1368 for_each_possible_cpu(cpu) {
1369 cpu_stats = per_cpu_ptr(stats, cpu);
1370 do {
1371 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1372 pkts = cpu_stats->pkts;
1373 bytes = cpu_stats->bytes;
1374 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1375 total.pkts += pkts;
1376 total.bytes += bytes;
1377 }
1378 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
1379 if (nest == NULL)
1380 goto nla_put_failure;
1381
1382 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1383 NFTA_COUNTER_PAD) ||
1384 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1385 NFTA_COUNTER_PAD))
1386 goto nla_put_failure;
1387
1388 nla_nest_end(skb, nest);
1389 return 0;
1390
1391 nla_put_failure:
1392 return -ENOSPC;
1393 }
1394
nft_dump_basechain_hook(struct sk_buff * skb,int family,const struct nft_base_chain * basechain)1395 static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
1396 const struct nft_base_chain *basechain)
1397 {
1398 const struct nf_hook_ops *ops = &basechain->ops;
1399 struct nft_hook *hook, *first = NULL;
1400 struct nlattr *nest, *nest_devs;
1401 int n = 0;
1402
1403 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1404 if (nest == NULL)
1405 goto nla_put_failure;
1406 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1407 goto nla_put_failure;
1408 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1409 goto nla_put_failure;
1410
1411 if (nft_base_chain_netdev(family, ops->hooknum)) {
1412 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
1413 list_for_each_entry(hook, &basechain->hook_list, list) {
1414 if (!first)
1415 first = hook;
1416
1417 if (nla_put_string(skb, NFTA_DEVICE_NAME,
1418 hook->ops.dev->name))
1419 goto nla_put_failure;
1420 n++;
1421 }
1422 nla_nest_end(skb, nest_devs);
1423
1424 if (n == 1 &&
1425 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name))
1426 goto nla_put_failure;
1427 }
1428 nla_nest_end(skb, nest);
1429
1430 return 0;
1431 nla_put_failure:
1432 return -1;
1433 }
1434
nf_tables_fill_chain_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table,const struct nft_chain * chain)1435 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1436 u32 portid, u32 seq, int event, u32 flags,
1437 int family, const struct nft_table *table,
1438 const struct nft_chain *chain)
1439 {
1440 struct nlmsghdr *nlh;
1441
1442 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1443 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
1444 NFNETLINK_V0, nft_base_seq(net));
1445 if (!nlh)
1446 goto nla_put_failure;
1447
1448 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1449 goto nla_put_failure;
1450 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1451 NFTA_CHAIN_PAD))
1452 goto nla_put_failure;
1453 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1454 goto nla_put_failure;
1455
1456 if (nft_is_base_chain(chain)) {
1457 const struct nft_base_chain *basechain = nft_base_chain(chain);
1458 struct nft_stats __percpu *stats;
1459
1460 if (nft_dump_basechain_hook(skb, family, basechain))
1461 goto nla_put_failure;
1462
1463 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1464 htonl(basechain->policy)))
1465 goto nla_put_failure;
1466
1467 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1468 goto nla_put_failure;
1469
1470 stats = rcu_dereference_check(basechain->stats,
1471 lockdep_commit_lock_is_held(net));
1472 if (nft_dump_stats(skb, stats))
1473 goto nla_put_failure;
1474 }
1475
1476 if (chain->flags &&
1477 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags)))
1478 goto nla_put_failure;
1479
1480 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1481 goto nla_put_failure;
1482
1483 if (chain->udata &&
1484 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata))
1485 goto nla_put_failure;
1486
1487 nlmsg_end(skb, nlh);
1488 return 0;
1489
1490 nla_put_failure:
1491 nlmsg_trim(skb, nlh);
1492 return -1;
1493 }
1494
nf_tables_chain_notify(const struct nft_ctx * ctx,int event)1495 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1496 {
1497 struct sk_buff *skb;
1498 int err;
1499
1500 if (!ctx->report &&
1501 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1502 return;
1503
1504 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1505 if (skb == NULL)
1506 goto err;
1507
1508 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1509 event, 0, ctx->family, ctx->table,
1510 ctx->chain);
1511 if (err < 0) {
1512 kfree_skb(skb);
1513 goto err;
1514 }
1515
1516 nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
1517 return;
1518 err:
1519 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1520 }
1521
nf_tables_dump_chains(struct sk_buff * skb,struct netlink_callback * cb)1522 static int nf_tables_dump_chains(struct sk_buff *skb,
1523 struct netlink_callback *cb)
1524 {
1525 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1526 const struct nft_table *table;
1527 const struct nft_chain *chain;
1528 unsigned int idx = 0, s_idx = cb->args[0];
1529 struct net *net = sock_net(skb->sk);
1530 int family = nfmsg->nfgen_family;
1531
1532 rcu_read_lock();
1533 cb->seq = net->nft.base_seq;
1534
1535 list_for_each_entry_rcu(table, &net->nft.tables, list) {
1536 if (family != NFPROTO_UNSPEC && family != table->family)
1537 continue;
1538
1539 list_for_each_entry_rcu(chain, &table->chains, list) {
1540 if (idx < s_idx)
1541 goto cont;
1542 if (idx > s_idx)
1543 memset(&cb->args[1], 0,
1544 sizeof(cb->args) - sizeof(cb->args[0]));
1545 if (!nft_is_active(net, chain))
1546 continue;
1547 if (nf_tables_fill_chain_info(skb, net,
1548 NETLINK_CB(cb->skb).portid,
1549 cb->nlh->nlmsg_seq,
1550 NFT_MSG_NEWCHAIN,
1551 NLM_F_MULTI,
1552 table->family, table,
1553 chain) < 0)
1554 goto done;
1555
1556 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1557 cont:
1558 idx++;
1559 }
1560 }
1561 done:
1562 rcu_read_unlock();
1563 cb->args[0] = idx;
1564 return skb->len;
1565 }
1566
1567 /* called with rcu_read_lock held */
nf_tables_getchain(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)1568 static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1569 struct sk_buff *skb, const struct nlmsghdr *nlh,
1570 const struct nlattr * const nla[],
1571 struct netlink_ext_ack *extack)
1572 {
1573 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1574 u8 genmask = nft_genmask_cur(net);
1575 const struct nft_chain *chain;
1576 struct nft_table *table;
1577 struct sk_buff *skb2;
1578 int family = nfmsg->nfgen_family;
1579 int err;
1580
1581 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1582 struct netlink_dump_control c = {
1583 .dump = nf_tables_dump_chains,
1584 .module = THIS_MODULE,
1585 };
1586
1587 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
1588 }
1589
1590 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1591 if (IS_ERR(table)) {
1592 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1593 return PTR_ERR(table);
1594 }
1595
1596 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
1597 if (IS_ERR(chain)) {
1598 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
1599 return PTR_ERR(chain);
1600 }
1601
1602 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1603 if (!skb2)
1604 return -ENOMEM;
1605
1606 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1607 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1608 family, table, chain);
1609 if (err < 0)
1610 goto err_fill_chain_info;
1611
1612 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
1613
1614 err_fill_chain_info:
1615 kfree_skb(skb2);
1616 return err;
1617 }
1618
1619 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1620 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1621 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1622 };
1623
nft_stats_alloc(const struct nlattr * attr)1624 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1625 {
1626 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1627 struct nft_stats __percpu *newstats;
1628 struct nft_stats *stats;
1629 int err;
1630
1631 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1632 nft_counter_policy, NULL);
1633 if (err < 0)
1634 return ERR_PTR(err);
1635
1636 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1637 return ERR_PTR(-EINVAL);
1638
1639 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1640 if (newstats == NULL)
1641 return ERR_PTR(-ENOMEM);
1642
1643 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1644 * are not exposed to userspace.
1645 */
1646 preempt_disable();
1647 stats = this_cpu_ptr(newstats);
1648 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1649 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1650 preempt_enable();
1651
1652 return newstats;
1653 }
1654
nft_chain_stats_replace(struct nft_trans * trans)1655 static void nft_chain_stats_replace(struct nft_trans *trans)
1656 {
1657 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
1658
1659 if (!nft_trans_chain_stats(trans))
1660 return;
1661
1662 nft_trans_chain_stats(trans) =
1663 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans),
1664 lockdep_commit_lock_is_held(trans->ctx.net));
1665
1666 if (!nft_trans_chain_stats(trans))
1667 static_branch_inc(&nft_counters_enabled);
1668 }
1669
nf_tables_chain_free_chain_rules(struct nft_chain * chain)1670 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1671 {
1672 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1673 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1674
1675 if (g0 != g1)
1676 kvfree(g1);
1677 kvfree(g0);
1678
1679 /* should be NULL either via abort or via successful commit */
1680 WARN_ON_ONCE(chain->rules_next);
1681 kvfree(chain->rules_next);
1682 }
1683
nf_tables_chain_destroy(struct nft_ctx * ctx)1684 void nf_tables_chain_destroy(struct nft_ctx *ctx)
1685 {
1686 struct nft_chain *chain = ctx->chain;
1687 struct nft_hook *hook, *next;
1688
1689 if (WARN_ON(chain->use > 0))
1690 return;
1691
1692 /* no concurrent access possible anymore */
1693 nf_tables_chain_free_chain_rules(chain);
1694
1695 if (nft_is_base_chain(chain)) {
1696 struct nft_base_chain *basechain = nft_base_chain(chain);
1697
1698 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
1699 list_for_each_entry_safe(hook, next,
1700 &basechain->hook_list, list) {
1701 list_del_rcu(&hook->list);
1702 kfree_rcu(hook, rcu);
1703 }
1704 }
1705 module_put(basechain->type->owner);
1706 if (rcu_access_pointer(basechain->stats)) {
1707 static_branch_dec(&nft_counters_enabled);
1708 free_percpu(rcu_dereference_raw(basechain->stats));
1709 }
1710 kfree(chain->name);
1711 kfree(chain->udata);
1712 kfree(basechain);
1713 } else {
1714 kfree(chain->name);
1715 kfree(chain->udata);
1716 kfree(chain);
1717 }
1718 }
1719
nft_netdev_hook_alloc(struct net * net,const struct nlattr * attr)1720 static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
1721 const struct nlattr *attr)
1722 {
1723 struct net_device *dev;
1724 char ifname[IFNAMSIZ];
1725 struct nft_hook *hook;
1726 int err;
1727
1728 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1729 if (!hook) {
1730 err = -ENOMEM;
1731 goto err_hook_alloc;
1732 }
1733
1734 nla_strlcpy(ifname, attr, IFNAMSIZ);
1735 /* nf_tables_netdev_event() is called under rtnl_mutex, this is
1736 * indirectly serializing all the other holders of the commit_mutex with
1737 * the rtnl_mutex.
1738 */
1739 dev = __dev_get_by_name(net, ifname);
1740 if (!dev) {
1741 err = -ENOENT;
1742 goto err_hook_dev;
1743 }
1744 hook->ops.dev = dev;
1745
1746 return hook;
1747
1748 err_hook_dev:
1749 kfree(hook);
1750 err_hook_alloc:
1751 return ERR_PTR(err);
1752 }
1753
nft_hook_list_find(struct list_head * hook_list,const struct nft_hook * this)1754 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,
1755 const struct nft_hook *this)
1756 {
1757 struct nft_hook *hook;
1758
1759 list_for_each_entry(hook, hook_list, list) {
1760 if (this->ops.dev == hook->ops.dev)
1761 return hook;
1762 }
1763
1764 return NULL;
1765 }
1766
nf_tables_parse_netdev_hooks(struct net * net,const struct nlattr * attr,struct list_head * hook_list)1767 static int nf_tables_parse_netdev_hooks(struct net *net,
1768 const struct nlattr *attr,
1769 struct list_head *hook_list)
1770 {
1771 struct nft_hook *hook, *next;
1772 const struct nlattr *tmp;
1773 int rem, n = 0, err;
1774
1775 nla_for_each_nested(tmp, attr, rem) {
1776 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
1777 err = -EINVAL;
1778 goto err_hook;
1779 }
1780
1781 hook = nft_netdev_hook_alloc(net, tmp);
1782 if (IS_ERR(hook)) {
1783 err = PTR_ERR(hook);
1784 goto err_hook;
1785 }
1786 if (nft_hook_list_find(hook_list, hook)) {
1787 kfree(hook);
1788 err = -EEXIST;
1789 goto err_hook;
1790 }
1791 list_add_tail(&hook->list, hook_list);
1792 n++;
1793
1794 if (n == NFT_NETDEVICE_MAX) {
1795 err = -EFBIG;
1796 goto err_hook;
1797 }
1798 }
1799
1800 return 0;
1801
1802 err_hook:
1803 list_for_each_entry_safe(hook, next, hook_list, list) {
1804 list_del(&hook->list);
1805 kfree(hook);
1806 }
1807 return err;
1808 }
1809
1810 struct nft_chain_hook {
1811 u32 num;
1812 s32 priority;
1813 const struct nft_chain_type *type;
1814 struct list_head list;
1815 };
1816
nft_chain_parse_netdev(struct net * net,struct nlattr * tb[],struct list_head * hook_list)1817 static int nft_chain_parse_netdev(struct net *net,
1818 struct nlattr *tb[],
1819 struct list_head *hook_list)
1820 {
1821 struct nft_hook *hook;
1822 int err;
1823
1824 if (tb[NFTA_HOOK_DEV]) {
1825 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
1826 if (IS_ERR(hook))
1827 return PTR_ERR(hook);
1828
1829 list_add_tail(&hook->list, hook_list);
1830 } else if (tb[NFTA_HOOK_DEVS]) {
1831 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
1832 hook_list);
1833 if (err < 0)
1834 return err;
1835
1836 if (list_empty(hook_list))
1837 return -EINVAL;
1838 } else {
1839 return -EINVAL;
1840 }
1841
1842 return 0;
1843 }
1844
nft_chain_parse_hook(struct net * net,const struct nlattr * const nla[],struct nft_chain_hook * hook,u8 family,bool autoload)1845 static int nft_chain_parse_hook(struct net *net,
1846 const struct nlattr * const nla[],
1847 struct nft_chain_hook *hook, u8 family,
1848 bool autoload)
1849 {
1850 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1851 const struct nft_chain_type *type;
1852 int err;
1853
1854 lockdep_assert_held(&net->nft.commit_mutex);
1855 lockdep_nfnl_nft_mutex_not_held();
1856
1857 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
1858 nla[NFTA_CHAIN_HOOK],
1859 nft_hook_policy, NULL);
1860 if (err < 0)
1861 return err;
1862
1863 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1864 ha[NFTA_HOOK_PRIORITY] == NULL)
1865 return -EINVAL;
1866
1867 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1868 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1869
1870 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
1871 if (!type)
1872 return -EOPNOTSUPP;
1873
1874 if (nla[NFTA_CHAIN_TYPE]) {
1875 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
1876 family, autoload);
1877 if (IS_ERR(type))
1878 return PTR_ERR(type);
1879 }
1880 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
1881 return -EOPNOTSUPP;
1882
1883 if (type->type == NFT_CHAIN_T_NAT &&
1884 hook->priority <= NF_IP_PRI_CONNTRACK)
1885 return -EOPNOTSUPP;
1886
1887 if (!try_module_get(type->owner))
1888 return -ENOENT;
1889
1890 hook->type = type;
1891
1892 INIT_LIST_HEAD(&hook->list);
1893 if (nft_base_chain_netdev(family, hook->num)) {
1894 err = nft_chain_parse_netdev(net, ha, &hook->list);
1895 if (err < 0) {
1896 module_put(type->owner);
1897 return err;
1898 }
1899 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) {
1900 module_put(type->owner);
1901 return -EOPNOTSUPP;
1902 }
1903
1904 return 0;
1905 }
1906
nft_chain_release_hook(struct nft_chain_hook * hook)1907 static void nft_chain_release_hook(struct nft_chain_hook *hook)
1908 {
1909 struct nft_hook *h, *next;
1910
1911 list_for_each_entry_safe(h, next, &hook->list, list) {
1912 list_del(&h->list);
1913 kfree(h);
1914 }
1915 module_put(hook->type->owner);
1916 }
1917
1918 struct nft_rules_old {
1919 struct rcu_head h;
1920 struct nft_rule **start;
1921 };
1922
nf_tables_chain_alloc_rules(const struct nft_chain * chain,unsigned int alloc)1923 static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1924 unsigned int alloc)
1925 {
1926 if (alloc > INT_MAX)
1927 return NULL;
1928
1929 alloc += 1; /* NULL, ends rules */
1930 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1931 return NULL;
1932
1933 alloc *= sizeof(struct nft_rule *);
1934 alloc += sizeof(struct nft_rules_old);
1935
1936 return kvmalloc(alloc, GFP_KERNEL);
1937 }
1938
nft_basechain_hook_init(struct nf_hook_ops * ops,u8 family,const struct nft_chain_hook * hook,struct nft_chain * chain)1939 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family,
1940 const struct nft_chain_hook *hook,
1941 struct nft_chain *chain)
1942 {
1943 ops->pf = family;
1944 ops->hooknum = hook->num;
1945 ops->priority = hook->priority;
1946 ops->priv = chain;
1947 ops->hook = hook->type->hooks[ops->hooknum];
1948 }
1949
nft_basechain_init(struct nft_base_chain * basechain,u8 family,struct nft_chain_hook * hook,u32 flags)1950 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
1951 struct nft_chain_hook *hook, u32 flags)
1952 {
1953 struct nft_chain *chain;
1954 struct nft_hook *h;
1955
1956 basechain->type = hook->type;
1957 INIT_LIST_HEAD(&basechain->hook_list);
1958 chain = &basechain->chain;
1959
1960 if (nft_base_chain_netdev(family, hook->num)) {
1961 list_splice_init(&hook->list, &basechain->hook_list);
1962 list_for_each_entry(h, &basechain->hook_list, list)
1963 nft_basechain_hook_init(&h->ops, family, hook, chain);
1964
1965 basechain->ops.hooknum = hook->num;
1966 basechain->ops.priority = hook->priority;
1967 } else {
1968 nft_basechain_hook_init(&basechain->ops, family, hook, chain);
1969 }
1970
1971 chain->flags |= NFT_CHAIN_BASE | flags;
1972 basechain->policy = NF_ACCEPT;
1973 if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
1974 !nft_chain_offload_support(basechain)) {
1975 list_splice_init(&basechain->hook_list, &hook->list);
1976 return -EOPNOTSUPP;
1977 }
1978
1979 flow_block_init(&basechain->flow_block);
1980
1981 return 0;
1982 }
1983
nft_chain_add(struct nft_table * table,struct nft_chain * chain)1984 static int nft_chain_add(struct nft_table *table, struct nft_chain *chain)
1985 {
1986 int err;
1987
1988 err = rhltable_insert_key(&table->chains_ht, chain->name,
1989 &chain->rhlhead, nft_chain_ht_params);
1990 if (err)
1991 return err;
1992
1993 list_add_tail_rcu(&chain->list, &table->chains);
1994
1995 return 0;
1996 }
1997
1998 static u64 chain_id;
1999
nf_tables_addchain(struct nft_ctx * ctx,u8 family,u8 genmask,u8 policy,u32 flags)2000 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
2001 u8 policy, u32 flags)
2002 {
2003 const struct nlattr * const *nla = ctx->nla;
2004 struct nft_table *table = ctx->table;
2005 struct nft_base_chain *basechain;
2006 struct net *net = ctx->net;
2007 char name[NFT_NAME_MAXLEN];
2008 struct nft_trans *trans;
2009 struct nft_chain *chain;
2010 struct nft_rule **rules;
2011 int err;
2012
2013 if (table->use == UINT_MAX)
2014 return -EOVERFLOW;
2015
2016 if (nla[NFTA_CHAIN_HOOK]) {
2017 struct nft_stats __percpu *stats = NULL;
2018 struct nft_chain_hook hook;
2019
2020 if (flags & NFT_CHAIN_BINDING)
2021 return -EOPNOTSUPP;
2022
2023 err = nft_chain_parse_hook(net, nla, &hook, family, true);
2024 if (err < 0)
2025 return err;
2026
2027 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
2028 if (basechain == NULL) {
2029 nft_chain_release_hook(&hook);
2030 return -ENOMEM;
2031 }
2032 chain = &basechain->chain;
2033
2034 if (nla[NFTA_CHAIN_COUNTERS]) {
2035 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2036 if (IS_ERR(stats)) {
2037 nft_chain_release_hook(&hook);
2038 kfree(basechain);
2039 return PTR_ERR(stats);
2040 }
2041 rcu_assign_pointer(basechain->stats, stats);
2042 }
2043
2044 err = nft_basechain_init(basechain, family, &hook, flags);
2045 if (err < 0) {
2046 nft_chain_release_hook(&hook);
2047 kfree(basechain);
2048 free_percpu(stats);
2049 return err;
2050 }
2051 if (stats)
2052 static_branch_inc(&nft_counters_enabled);
2053 } else {
2054 if (flags & NFT_CHAIN_BASE)
2055 return -EINVAL;
2056 if (flags & NFT_CHAIN_HW_OFFLOAD)
2057 return -EOPNOTSUPP;
2058
2059 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
2060 if (chain == NULL)
2061 return -ENOMEM;
2062
2063 chain->flags = flags;
2064 }
2065 ctx->chain = chain;
2066
2067 INIT_LIST_HEAD(&chain->rules);
2068 chain->handle = nf_tables_alloc_handle(table);
2069 chain->table = table;
2070
2071 if (nla[NFTA_CHAIN_NAME]) {
2072 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2073 } else {
2074 if (!(flags & NFT_CHAIN_BINDING)) {
2075 err = -EINVAL;
2076 goto err_destroy_chain;
2077 }
2078
2079 snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
2080 chain->name = kstrdup(name, GFP_KERNEL);
2081 }
2082
2083 if (!chain->name) {
2084 err = -ENOMEM;
2085 goto err_destroy_chain;
2086 }
2087
2088 if (nla[NFTA_CHAIN_USERDATA]) {
2089 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);
2090 if (chain->udata == NULL) {
2091 err = -ENOMEM;
2092 goto err_destroy_chain;
2093 }
2094 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]);
2095 }
2096
2097 rules = nf_tables_chain_alloc_rules(chain, 0);
2098 if (!rules) {
2099 err = -ENOMEM;
2100 goto err_destroy_chain;
2101 }
2102
2103 *rules = NULL;
2104 rcu_assign_pointer(chain->rules_gen_0, rules);
2105 rcu_assign_pointer(chain->rules_gen_1, rules);
2106
2107 err = nf_tables_register_hook(net, table, chain);
2108 if (err < 0)
2109 goto err_destroy_chain;
2110
2111 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
2112 if (IS_ERR(trans)) {
2113 err = PTR_ERR(trans);
2114 goto err_unregister_hook;
2115 }
2116
2117 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
2118 if (nft_is_base_chain(chain))
2119 nft_trans_chain_policy(trans) = policy;
2120
2121 err = nft_chain_add(table, chain);
2122 if (err < 0) {
2123 nft_trans_destroy(trans);
2124 goto err_unregister_hook;
2125 }
2126
2127 table->use++;
2128
2129 return 0;
2130 err_unregister_hook:
2131 nf_tables_unregister_hook(net, table, chain);
2132 err_destroy_chain:
2133 nf_tables_chain_destroy(ctx);
2134
2135 return err;
2136 }
2137
nft_hook_list_equal(struct list_head * hook_list1,struct list_head * hook_list2)2138 static bool nft_hook_list_equal(struct list_head *hook_list1,
2139 struct list_head *hook_list2)
2140 {
2141 struct nft_hook *hook;
2142 int n = 0, m = 0;
2143
2144 n = 0;
2145 list_for_each_entry(hook, hook_list2, list) {
2146 if (!nft_hook_list_find(hook_list1, hook))
2147 return false;
2148
2149 n++;
2150 }
2151 list_for_each_entry(hook, hook_list1, list)
2152 m++;
2153
2154 return n == m;
2155 }
2156
nf_tables_updchain(struct nft_ctx * ctx,u8 genmask,u8 policy,u32 flags,const struct nlattr * attr,struct netlink_ext_ack * extack)2157 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
2158 u32 flags, const struct nlattr *attr,
2159 struct netlink_ext_ack *extack)
2160 {
2161 const struct nlattr * const *nla = ctx->nla;
2162 struct nft_table *table = ctx->table;
2163 struct nft_chain *chain = ctx->chain;
2164 struct nft_base_chain *basechain;
2165 struct nft_stats *stats = NULL;
2166 struct nft_chain_hook hook;
2167 struct nf_hook_ops *ops;
2168 struct nft_trans *trans;
2169 int err;
2170
2171 if (chain->flags ^ flags)
2172 return -EOPNOTSUPP;
2173
2174 if (nla[NFTA_CHAIN_HOOK]) {
2175 if (!nft_is_base_chain(chain)) {
2176 NL_SET_BAD_ATTR(extack, attr);
2177 return -EEXIST;
2178 }
2179 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
2180 false);
2181 if (err < 0)
2182 return err;
2183
2184 basechain = nft_base_chain(chain);
2185 if (basechain->type != hook.type) {
2186 nft_chain_release_hook(&hook);
2187 NL_SET_BAD_ATTR(extack, attr);
2188 return -EEXIST;
2189 }
2190
2191 if (nft_base_chain_netdev(ctx->family, hook.num)) {
2192 if (!nft_hook_list_equal(&basechain->hook_list,
2193 &hook.list)) {
2194 nft_chain_release_hook(&hook);
2195 NL_SET_BAD_ATTR(extack, attr);
2196 return -EEXIST;
2197 }
2198 } else {
2199 ops = &basechain->ops;
2200 if (ops->hooknum != hook.num ||
2201 ops->priority != hook.priority) {
2202 nft_chain_release_hook(&hook);
2203 NL_SET_BAD_ATTR(extack, attr);
2204 return -EEXIST;
2205 }
2206 }
2207 nft_chain_release_hook(&hook);
2208 }
2209
2210 if (nla[NFTA_CHAIN_HANDLE] &&
2211 nla[NFTA_CHAIN_NAME]) {
2212 struct nft_chain *chain2;
2213
2214 chain2 = nft_chain_lookup(ctx->net, table,
2215 nla[NFTA_CHAIN_NAME], genmask);
2216 if (!IS_ERR(chain2)) {
2217 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2218 return -EEXIST;
2219 }
2220 }
2221
2222 if (nla[NFTA_CHAIN_COUNTERS]) {
2223 if (!nft_is_base_chain(chain))
2224 return -EOPNOTSUPP;
2225
2226 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2227 if (IS_ERR(stats))
2228 return PTR_ERR(stats);
2229 }
2230
2231 err = -ENOMEM;
2232 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
2233 sizeof(struct nft_trans_chain));
2234 if (trans == NULL)
2235 goto err;
2236
2237 nft_trans_chain_stats(trans) = stats;
2238 nft_trans_chain_update(trans) = true;
2239
2240 if (nla[NFTA_CHAIN_POLICY])
2241 nft_trans_chain_policy(trans) = policy;
2242 else
2243 nft_trans_chain_policy(trans) = -1;
2244
2245 if (nla[NFTA_CHAIN_HANDLE] &&
2246 nla[NFTA_CHAIN_NAME]) {
2247 struct nft_trans *tmp;
2248 char *name;
2249
2250 err = -ENOMEM;
2251 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2252 if (!name)
2253 goto err;
2254
2255 err = -EEXIST;
2256 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
2257 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
2258 tmp->ctx.table == table &&
2259 nft_trans_chain_update(tmp) &&
2260 nft_trans_chain_name(tmp) &&
2261 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
2262 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2263 kfree(name);
2264 goto err;
2265 }
2266 }
2267
2268 nft_trans_chain_name(trans) = name;
2269 }
2270 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
2271
2272 return 0;
2273 err:
2274 free_percpu(stats);
2275 kfree(trans);
2276 return err;
2277 }
2278
nft_chain_lookup_byid(const struct net * net,const struct nft_table * table,const struct nlattr * nla)2279 static struct nft_chain *nft_chain_lookup_byid(const struct net *net,
2280 const struct nft_table *table,
2281 const struct nlattr *nla)
2282 {
2283 u32 id = ntohl(nla_get_be32(nla));
2284 struct nft_trans *trans;
2285
2286 list_for_each_entry(trans, &net->nft.commit_list, list) {
2287 struct nft_chain *chain = trans->ctx.chain;
2288
2289 if (trans->msg_type == NFT_MSG_NEWCHAIN &&
2290 chain->table == table &&
2291 id == nft_trans_chain_id(trans))
2292 return chain;
2293 }
2294 return ERR_PTR(-ENOENT);
2295 }
2296
nf_tables_newchain(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)2297 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
2298 struct sk_buff *skb, const struct nlmsghdr *nlh,
2299 const struct nlattr * const nla[],
2300 struct netlink_ext_ack *extack)
2301 {
2302 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2303 u8 genmask = nft_genmask_next(net);
2304 int family = nfmsg->nfgen_family;
2305 struct nft_chain *chain = NULL;
2306 const struct nlattr *attr;
2307 struct nft_table *table;
2308 u8 policy = NF_ACCEPT;
2309 struct nft_ctx ctx;
2310 u64 handle = 0;
2311 u32 flags = 0;
2312
2313 lockdep_assert_held(&net->nft.commit_mutex);
2314
2315 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
2316 if (IS_ERR(table)) {
2317 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2318 return PTR_ERR(table);
2319 }
2320
2321 chain = NULL;
2322 attr = nla[NFTA_CHAIN_NAME];
2323
2324 if (nla[NFTA_CHAIN_HANDLE]) {
2325 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
2326 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2327 if (IS_ERR(chain)) {
2328 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
2329 return PTR_ERR(chain);
2330 }
2331 attr = nla[NFTA_CHAIN_HANDLE];
2332 } else if (nla[NFTA_CHAIN_NAME]) {
2333 chain = nft_chain_lookup(net, table, attr, genmask);
2334 if (IS_ERR(chain)) {
2335 if (PTR_ERR(chain) != -ENOENT) {
2336 NL_SET_BAD_ATTR(extack, attr);
2337 return PTR_ERR(chain);
2338 }
2339 chain = NULL;
2340 }
2341 } else if (!nla[NFTA_CHAIN_ID]) {
2342 return -EINVAL;
2343 }
2344
2345 if (nla[NFTA_CHAIN_POLICY]) {
2346 if (chain != NULL &&
2347 !nft_is_base_chain(chain)) {
2348 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2349 return -EOPNOTSUPP;
2350 }
2351
2352 if (chain == NULL &&
2353 nla[NFTA_CHAIN_HOOK] == NULL) {
2354 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2355 return -EOPNOTSUPP;
2356 }
2357
2358 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
2359 switch (policy) {
2360 case NF_DROP:
2361 case NF_ACCEPT:
2362 break;
2363 default:
2364 return -EINVAL;
2365 }
2366 }
2367
2368 if (nla[NFTA_CHAIN_FLAGS])
2369 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
2370 else if (chain)
2371 flags = chain->flags;
2372
2373 if (flags & ~NFT_CHAIN_FLAGS)
2374 return -EOPNOTSUPP;
2375
2376 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2377
2378 if (chain != NULL) {
2379 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2380 NL_SET_BAD_ATTR(extack, attr);
2381 return -EEXIST;
2382 }
2383 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2384 return -EOPNOTSUPP;
2385
2386 flags |= chain->flags & NFT_CHAIN_BASE;
2387 return nf_tables_updchain(&ctx, genmask, policy, flags, attr,
2388 extack);
2389 }
2390
2391 return nf_tables_addchain(&ctx, family, genmask, policy, flags);
2392 }
2393
nf_tables_delchain(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)2394 static int nf_tables_delchain(struct net *net, struct sock *nlsk,
2395 struct sk_buff *skb, const struct nlmsghdr *nlh,
2396 const struct nlattr * const nla[],
2397 struct netlink_ext_ack *extack)
2398 {
2399 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2400 u8 genmask = nft_genmask_next(net);
2401 int family = nfmsg->nfgen_family;
2402 const struct nlattr *attr;
2403 struct nft_table *table;
2404 struct nft_chain *chain;
2405 struct nft_rule *rule;
2406 struct nft_ctx ctx;
2407 u64 handle;
2408 u32 use;
2409 int err;
2410
2411 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
2412 if (IS_ERR(table)) {
2413 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2414 return PTR_ERR(table);
2415 }
2416
2417 if (nla[NFTA_CHAIN_HANDLE]) {
2418 attr = nla[NFTA_CHAIN_HANDLE];
2419 handle = be64_to_cpu(nla_get_be64(attr));
2420 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2421 } else {
2422 attr = nla[NFTA_CHAIN_NAME];
2423 chain = nft_chain_lookup(net, table, attr, genmask);
2424 }
2425 if (IS_ERR(chain)) {
2426 NL_SET_BAD_ATTR(extack, attr);
2427 return PTR_ERR(chain);
2428 }
2429
2430 if (nlh->nlmsg_flags & NLM_F_NONREC &&
2431 chain->use > 0)
2432 return -EBUSY;
2433
2434 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2435
2436 use = chain->use;
2437 list_for_each_entry(rule, &chain->rules, list) {
2438 if (!nft_is_active_next(net, rule))
2439 continue;
2440 use--;
2441
2442 err = nft_delrule(&ctx, rule);
2443 if (err < 0)
2444 return err;
2445 }
2446
2447 /* There are rules and elements that are still holding references to us,
2448 * we cannot do a recursive removal in this case.
2449 */
2450 if (use > 0) {
2451 NL_SET_BAD_ATTR(extack, attr);
2452 return -EBUSY;
2453 }
2454
2455 return nft_delchain(&ctx);
2456 }
2457
2458 /*
2459 * Expressions
2460 */
2461
2462 /**
2463 * nft_register_expr - register nf_tables expr type
2464 * @type: expr type
2465 *
2466 * Registers the expr type for use with nf_tables. Returns zero on
2467 * success or a negative errno code otherwise.
2468 */
nft_register_expr(struct nft_expr_type * type)2469 int nft_register_expr(struct nft_expr_type *type)
2470 {
2471 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2472 if (type->family == NFPROTO_UNSPEC)
2473 list_add_tail_rcu(&type->list, &nf_tables_expressions);
2474 else
2475 list_add_rcu(&type->list, &nf_tables_expressions);
2476 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2477 return 0;
2478 }
2479 EXPORT_SYMBOL_GPL(nft_register_expr);
2480
2481 /**
2482 * nft_unregister_expr - unregister nf_tables expr type
2483 * @type: expr type
2484 *
2485 * Unregisters the expr typefor use with nf_tables.
2486 */
nft_unregister_expr(struct nft_expr_type * type)2487 void nft_unregister_expr(struct nft_expr_type *type)
2488 {
2489 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2490 list_del_rcu(&type->list);
2491 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2492 }
2493 EXPORT_SYMBOL_GPL(nft_unregister_expr);
2494
__nft_expr_type_get(u8 family,struct nlattr * nla)2495 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2496 struct nlattr *nla)
2497 {
2498 const struct nft_expr_type *type, *candidate = NULL;
2499
2500 list_for_each_entry(type, &nf_tables_expressions, list) {
2501 if (!nla_strcmp(nla, type->name)) {
2502 if (!type->family && !candidate)
2503 candidate = type;
2504 else if (type->family == family)
2505 candidate = type;
2506 }
2507 }
2508 return candidate;
2509 }
2510
2511 #ifdef CONFIG_MODULES
nft_expr_type_request_module(struct net * net,u8 family,struct nlattr * nla)2512 static int nft_expr_type_request_module(struct net *net, u8 family,
2513 struct nlattr *nla)
2514 {
2515 if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2516 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
2517 return -EAGAIN;
2518
2519 return 0;
2520 }
2521 #endif
2522
nft_expr_type_get(struct net * net,u8 family,struct nlattr * nla)2523 static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2524 u8 family,
2525 struct nlattr *nla)
2526 {
2527 const struct nft_expr_type *type;
2528
2529 if (nla == NULL)
2530 return ERR_PTR(-EINVAL);
2531
2532 type = __nft_expr_type_get(family, nla);
2533 if (type != NULL && try_module_get(type->owner))
2534 return type;
2535
2536 lockdep_nfnl_nft_mutex_not_held();
2537 #ifdef CONFIG_MODULES
2538 if (type == NULL) {
2539 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
2540 return ERR_PTR(-EAGAIN);
2541
2542 if (nft_request_module(net, "nft-expr-%.*s",
2543 nla_len(nla),
2544 (char *)nla_data(nla)) == -EAGAIN)
2545 return ERR_PTR(-EAGAIN);
2546 }
2547 #endif
2548 return ERR_PTR(-ENOENT);
2549 }
2550
2551 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2552 [NFTA_EXPR_NAME] = { .type = NLA_STRING,
2553 .len = NFT_MODULE_AUTOLOAD_LIMIT },
2554 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2555 };
2556
nf_tables_fill_expr_info(struct sk_buff * skb,const struct nft_expr * expr)2557 static int nf_tables_fill_expr_info(struct sk_buff *skb,
2558 const struct nft_expr *expr)
2559 {
2560 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
2561 goto nla_put_failure;
2562
2563 if (expr->ops->dump) {
2564 struct nlattr *data = nla_nest_start_noflag(skb,
2565 NFTA_EXPR_DATA);
2566 if (data == NULL)
2567 goto nla_put_failure;
2568 if (expr->ops->dump(skb, expr) < 0)
2569 goto nla_put_failure;
2570 nla_nest_end(skb, data);
2571 }
2572
2573 return skb->len;
2574
2575 nla_put_failure:
2576 return -1;
2577 };
2578
nft_expr_dump(struct sk_buff * skb,unsigned int attr,const struct nft_expr * expr)2579 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2580 const struct nft_expr *expr)
2581 {
2582 struct nlattr *nest;
2583
2584 nest = nla_nest_start_noflag(skb, attr);
2585 if (!nest)
2586 goto nla_put_failure;
2587 if (nf_tables_fill_expr_info(skb, expr) < 0)
2588 goto nla_put_failure;
2589 nla_nest_end(skb, nest);
2590 return 0;
2591
2592 nla_put_failure:
2593 return -1;
2594 }
2595
2596 struct nft_expr_info {
2597 const struct nft_expr_ops *ops;
2598 const struct nlattr *attr;
2599 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
2600 };
2601
nf_tables_expr_parse(const struct nft_ctx * ctx,const struct nlattr * nla,struct nft_expr_info * info)2602 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2603 const struct nlattr *nla,
2604 struct nft_expr_info *info)
2605 {
2606 const struct nft_expr_type *type;
2607 const struct nft_expr_ops *ops;
2608 struct nlattr *tb[NFTA_EXPR_MAX + 1];
2609 int err;
2610
2611 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2612 nft_expr_policy, NULL);
2613 if (err < 0)
2614 return err;
2615
2616 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
2617 if (IS_ERR(type))
2618 return PTR_ERR(type);
2619
2620 if (tb[NFTA_EXPR_DATA]) {
2621 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2622 tb[NFTA_EXPR_DATA],
2623 type->policy, NULL);
2624 if (err < 0)
2625 goto err1;
2626 } else
2627 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2628
2629 if (type->select_ops != NULL) {
2630 ops = type->select_ops(ctx,
2631 (const struct nlattr * const *)info->tb);
2632 if (IS_ERR(ops)) {
2633 err = PTR_ERR(ops);
2634 #ifdef CONFIG_MODULES
2635 if (err == -EAGAIN)
2636 if (nft_expr_type_request_module(ctx->net,
2637 ctx->family,
2638 tb[NFTA_EXPR_NAME]) != -EAGAIN)
2639 err = -ENOENT;
2640 #endif
2641 goto err1;
2642 }
2643 } else
2644 ops = type->ops;
2645
2646 info->attr = nla;
2647 info->ops = ops;
2648
2649 return 0;
2650
2651 err1:
2652 module_put(type->owner);
2653 return err;
2654 }
2655
nf_tables_newexpr(const struct nft_ctx * ctx,const struct nft_expr_info * info,struct nft_expr * expr)2656 static int nf_tables_newexpr(const struct nft_ctx *ctx,
2657 const struct nft_expr_info *info,
2658 struct nft_expr *expr)
2659 {
2660 const struct nft_expr_ops *ops = info->ops;
2661 int err;
2662
2663 expr->ops = ops;
2664 if (ops->init) {
2665 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
2666 if (err < 0)
2667 goto err1;
2668 }
2669
2670 return 0;
2671 err1:
2672 expr->ops = NULL;
2673 return err;
2674 }
2675
nf_tables_expr_destroy(const struct nft_ctx * ctx,struct nft_expr * expr)2676 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2677 struct nft_expr *expr)
2678 {
2679 const struct nft_expr_type *type = expr->ops->type;
2680
2681 if (expr->ops->destroy)
2682 expr->ops->destroy(ctx, expr);
2683 module_put(type->owner);
2684 }
2685
nft_expr_init(const struct nft_ctx * ctx,const struct nlattr * nla)2686 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2687 const struct nlattr *nla)
2688 {
2689 struct nft_expr_info info;
2690 struct nft_expr *expr;
2691 struct module *owner;
2692 int err;
2693
2694 err = nf_tables_expr_parse(ctx, nla, &info);
2695 if (err < 0)
2696 goto err_expr_parse;
2697
2698 err = -EOPNOTSUPP;
2699 if (!(info.ops->type->flags & NFT_EXPR_STATEFUL))
2700 goto err_expr_stateful;
2701
2702 err = -ENOMEM;
2703 expr = kzalloc(info.ops->size, GFP_KERNEL);
2704 if (expr == NULL)
2705 goto err_expr_stateful;
2706
2707 err = nf_tables_newexpr(ctx, &info, expr);
2708 if (err < 0)
2709 goto err_expr_new;
2710
2711 return expr;
2712 err_expr_new:
2713 kfree(expr);
2714 err_expr_stateful:
2715 owner = info.ops->type->owner;
2716 if (info.ops->type->release_ops)
2717 info.ops->type->release_ops(info.ops);
2718
2719 module_put(owner);
2720 err_expr_parse:
2721 return ERR_PTR(err);
2722 }
2723
nft_expr_clone(struct nft_expr * dst,struct nft_expr * src)2724 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
2725 {
2726 int err;
2727
2728 if (src->ops->clone) {
2729 dst->ops = src->ops;
2730 err = src->ops->clone(dst, src);
2731 if (err < 0)
2732 return err;
2733 } else {
2734 memcpy(dst, src, src->ops->size);
2735 }
2736
2737 __module_get(src->ops->type->owner);
2738
2739 return 0;
2740 }
2741
nft_expr_destroy(const struct nft_ctx * ctx,struct nft_expr * expr)2742 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2743 {
2744 nf_tables_expr_destroy(ctx, expr);
2745 kfree(expr);
2746 }
2747
2748 /*
2749 * Rules
2750 */
2751
__nft_rule_lookup(const struct nft_chain * chain,u64 handle)2752 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2753 u64 handle)
2754 {
2755 struct nft_rule *rule;
2756
2757 // FIXME: this sucks
2758 list_for_each_entry_rcu(rule, &chain->rules, list) {
2759 if (handle == rule->handle)
2760 return rule;
2761 }
2762
2763 return ERR_PTR(-ENOENT);
2764 }
2765
nft_rule_lookup(const struct nft_chain * chain,const struct nlattr * nla)2766 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2767 const struct nlattr *nla)
2768 {
2769 if (nla == NULL)
2770 return ERR_PTR(-EINVAL);
2771
2772 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
2773 }
2774
2775 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
2776 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2777 .len = NFT_TABLE_MAXNAMELEN - 1 },
2778 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2779 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2780 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2781 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
2782 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
2783 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
2784 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2785 .len = NFT_USERDATA_MAXLEN },
2786 [NFTA_RULE_ID] = { .type = NLA_U32 },
2787 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
2788 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 },
2789 };
2790
nf_tables_fill_rule_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table,const struct nft_chain * chain,const struct nft_rule * rule,const struct nft_rule * prule)2791 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2792 u32 portid, u32 seq, int event,
2793 u32 flags, int family,
2794 const struct nft_table *table,
2795 const struct nft_chain *chain,
2796 const struct nft_rule *rule,
2797 const struct nft_rule *prule)
2798 {
2799 struct nlmsghdr *nlh;
2800 const struct nft_expr *expr, *next;
2801 struct nlattr *list;
2802 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2803
2804 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0,
2805 nft_base_seq(net));
2806 if (!nlh)
2807 goto nla_put_failure;
2808
2809 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2810 goto nla_put_failure;
2811 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2812 goto nla_put_failure;
2813 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2814 NFTA_RULE_PAD))
2815 goto nla_put_failure;
2816
2817 if (event != NFT_MSG_DELRULE && prule) {
2818 if (nla_put_be64(skb, NFTA_RULE_POSITION,
2819 cpu_to_be64(prule->handle),
2820 NFTA_RULE_PAD))
2821 goto nla_put_failure;
2822 }
2823
2824 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
2825 if (list == NULL)
2826 goto nla_put_failure;
2827 nft_rule_for_each_expr(expr, next, rule) {
2828 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
2829 goto nla_put_failure;
2830 }
2831 nla_nest_end(skb, list);
2832
2833 if (rule->udata) {
2834 struct nft_userdata *udata = nft_userdata(rule);
2835 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2836 udata->data) < 0)
2837 goto nla_put_failure;
2838 }
2839
2840 nlmsg_end(skb, nlh);
2841 return 0;
2842
2843 nla_put_failure:
2844 nlmsg_trim(skb, nlh);
2845 return -1;
2846 }
2847
nf_tables_rule_notify(const struct nft_ctx * ctx,const struct nft_rule * rule,int event)2848 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2849 const struct nft_rule *rule, int event)
2850 {
2851 struct sk_buff *skb;
2852 int err;
2853
2854 if (!ctx->report &&
2855 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2856 return;
2857
2858 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2859 if (skb == NULL)
2860 goto err;
2861
2862 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2863 event, 0, ctx->family, ctx->table,
2864 ctx->chain, rule, NULL);
2865 if (err < 0) {
2866 kfree_skb(skb);
2867 goto err;
2868 }
2869
2870 nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
2871 return;
2872 err:
2873 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2874 }
2875
2876 struct nft_rule_dump_ctx {
2877 char *table;
2878 char *chain;
2879 };
2880
__nf_tables_dump_rules(struct sk_buff * skb,unsigned int * idx,struct netlink_callback * cb,const struct nft_table * table,const struct nft_chain * chain)2881 static int __nf_tables_dump_rules(struct sk_buff *skb,
2882 unsigned int *idx,
2883 struct netlink_callback *cb,
2884 const struct nft_table *table,
2885 const struct nft_chain *chain)
2886 {
2887 struct net *net = sock_net(skb->sk);
2888 const struct nft_rule *rule, *prule;
2889 unsigned int s_idx = cb->args[0];
2890
2891 prule = NULL;
2892 list_for_each_entry_rcu(rule, &chain->rules, list) {
2893 if (!nft_is_active(net, rule))
2894 goto cont_skip;
2895 if (*idx < s_idx)
2896 goto cont;
2897 if (*idx > s_idx) {
2898 memset(&cb->args[1], 0,
2899 sizeof(cb->args) - sizeof(cb->args[0]));
2900 }
2901 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2902 cb->nlh->nlmsg_seq,
2903 NFT_MSG_NEWRULE,
2904 NLM_F_MULTI | NLM_F_APPEND,
2905 table->family,
2906 table, chain, rule, prule) < 0)
2907 return 1;
2908
2909 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2910 cont:
2911 prule = rule;
2912 cont_skip:
2913 (*idx)++;
2914 }
2915 return 0;
2916 }
2917
nf_tables_dump_rules(struct sk_buff * skb,struct netlink_callback * cb)2918 static int nf_tables_dump_rules(struct sk_buff *skb,
2919 struct netlink_callback *cb)
2920 {
2921 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2922 const struct nft_rule_dump_ctx *ctx = cb->data;
2923 struct nft_table *table;
2924 const struct nft_chain *chain;
2925 unsigned int idx = 0;
2926 struct net *net = sock_net(skb->sk);
2927 int family = nfmsg->nfgen_family;
2928
2929 rcu_read_lock();
2930 cb->seq = net->nft.base_seq;
2931
2932 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2933 if (family != NFPROTO_UNSPEC && family != table->family)
2934 continue;
2935
2936 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
2937 continue;
2938
2939 if (ctx && ctx->table && ctx->chain) {
2940 struct rhlist_head *list, *tmp;
2941
2942 list = rhltable_lookup(&table->chains_ht, ctx->chain,
2943 nft_chain_ht_params);
2944 if (!list)
2945 goto done;
2946
2947 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2948 if (!nft_is_active(net, chain))
2949 continue;
2950 __nf_tables_dump_rules(skb, &idx,
2951 cb, table, chain);
2952 break;
2953 }
2954 goto done;
2955 }
2956
2957 list_for_each_entry_rcu(chain, &table->chains, list) {
2958 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2959 goto done;
2960 }
2961
2962 if (ctx && ctx->table)
2963 break;
2964 }
2965 done:
2966 rcu_read_unlock();
2967
2968 cb->args[0] = idx;
2969 return skb->len;
2970 }
2971
nf_tables_dump_rules_start(struct netlink_callback * cb)2972 static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2973 {
2974 const struct nlattr * const *nla = cb->data;
2975 struct nft_rule_dump_ctx *ctx = NULL;
2976
2977 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2978 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2979 if (!ctx)
2980 return -ENOMEM;
2981
2982 if (nla[NFTA_RULE_TABLE]) {
2983 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2984 GFP_ATOMIC);
2985 if (!ctx->table) {
2986 kfree(ctx);
2987 return -ENOMEM;
2988 }
2989 }
2990 if (nla[NFTA_RULE_CHAIN]) {
2991 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2992 GFP_ATOMIC);
2993 if (!ctx->chain) {
2994 kfree(ctx->table);
2995 kfree(ctx);
2996 return -ENOMEM;
2997 }
2998 }
2999 }
3000
3001 cb->data = ctx;
3002 return 0;
3003 }
3004
nf_tables_dump_rules_done(struct netlink_callback * cb)3005 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
3006 {
3007 struct nft_rule_dump_ctx *ctx = cb->data;
3008
3009 if (ctx) {
3010 kfree(ctx->table);
3011 kfree(ctx->chain);
3012 kfree(ctx);
3013 }
3014 return 0;
3015 }
3016
3017 /* called with rcu_read_lock held */
nf_tables_getrule(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)3018 static int nf_tables_getrule(struct net *net, struct sock *nlsk,
3019 struct sk_buff *skb, const struct nlmsghdr *nlh,
3020 const struct nlattr * const nla[],
3021 struct netlink_ext_ack *extack)
3022 {
3023 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3024 u8 genmask = nft_genmask_cur(net);
3025 const struct nft_chain *chain;
3026 const struct nft_rule *rule;
3027 struct nft_table *table;
3028 struct sk_buff *skb2;
3029 int family = nfmsg->nfgen_family;
3030 int err;
3031
3032 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3033 struct netlink_dump_control c = {
3034 .start= nf_tables_dump_rules_start,
3035 .dump = nf_tables_dump_rules,
3036 .done = nf_tables_dump_rules_done,
3037 .module = THIS_MODULE,
3038 .data = (void *)nla,
3039 };
3040
3041 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3042 }
3043
3044 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3045 if (IS_ERR(table)) {
3046 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3047 return PTR_ERR(table);
3048 }
3049
3050 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
3051 if (IS_ERR(chain)) {
3052 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3053 return PTR_ERR(chain);
3054 }
3055
3056 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3057 if (IS_ERR(rule)) {
3058 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3059 return PTR_ERR(rule);
3060 }
3061
3062 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3063 if (!skb2)
3064 return -ENOMEM;
3065
3066 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
3067 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
3068 family, table, chain, rule, NULL);
3069 if (err < 0)
3070 goto err_fill_rule_info;
3071
3072 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
3073
3074 err_fill_rule_info:
3075 kfree_skb(skb2);
3076 return err;
3077 }
3078
nf_tables_rule_destroy(const struct nft_ctx * ctx,struct nft_rule * rule)3079 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
3080 struct nft_rule *rule)
3081 {
3082 struct nft_expr *expr, *next;
3083
3084 /*
3085 * Careful: some expressions might not be initialized in case this
3086 * is called on error from nf_tables_newrule().
3087 */
3088 expr = nft_expr_first(rule);
3089 while (nft_expr_more(rule, expr)) {
3090 next = nft_expr_next(expr);
3091 nf_tables_expr_destroy(ctx, expr);
3092 expr = next;
3093 }
3094 kfree(rule);
3095 }
3096
nf_tables_rule_release(const struct nft_ctx * ctx,struct nft_rule * rule)3097 void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)
3098 {
3099 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
3100 nf_tables_rule_destroy(ctx, rule);
3101 }
3102
nft_chain_validate(const struct nft_ctx * ctx,const struct nft_chain * chain)3103 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
3104 {
3105 struct nft_expr *expr, *last;
3106 const struct nft_data *data;
3107 struct nft_rule *rule;
3108 int err;
3109
3110 if (ctx->level == NFT_JUMP_STACK_SIZE)
3111 return -EMLINK;
3112
3113 list_for_each_entry(rule, &chain->rules, list) {
3114 if (!nft_is_active_next(ctx->net, rule))
3115 continue;
3116
3117 nft_rule_for_each_expr(expr, last, rule) {
3118 if (!expr->ops->validate)
3119 continue;
3120
3121 err = expr->ops->validate(ctx, expr, &data);
3122 if (err < 0)
3123 return err;
3124 }
3125 }
3126
3127 return 0;
3128 }
3129 EXPORT_SYMBOL_GPL(nft_chain_validate);
3130
nft_table_validate(struct net * net,const struct nft_table * table)3131 static int nft_table_validate(struct net *net, const struct nft_table *table)
3132 {
3133 struct nft_chain *chain;
3134 struct nft_ctx ctx = {
3135 .net = net,
3136 .family = table->family,
3137 };
3138 int err;
3139
3140 list_for_each_entry(chain, &table->chains, list) {
3141 if (!nft_is_base_chain(chain))
3142 continue;
3143
3144 ctx.chain = chain;
3145 err = nft_chain_validate(&ctx, chain);
3146 if (err < 0)
3147 return err;
3148 }
3149
3150 return 0;
3151 }
3152
3153 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3154 const struct nft_chain *chain,
3155 const struct nlattr *nla);
3156
3157 #define NFT_RULE_MAXEXPRS 128
3158
nf_tables_newrule(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)3159 static int nf_tables_newrule(struct net *net, struct sock *nlsk,
3160 struct sk_buff *skb, const struct nlmsghdr *nlh,
3161 const struct nlattr * const nla[],
3162 struct netlink_ext_ack *extack)
3163 {
3164 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3165 u8 genmask = nft_genmask_next(net);
3166 struct nft_expr_info *info = NULL;
3167 int family = nfmsg->nfgen_family;
3168 struct nft_flow_rule *flow;
3169 struct nft_table *table;
3170 struct nft_chain *chain;
3171 struct nft_rule *rule, *old_rule = NULL;
3172 struct nft_userdata *udata;
3173 struct nft_trans *trans = NULL;
3174 struct nft_expr *expr;
3175 struct nft_ctx ctx;
3176 struct nlattr *tmp;
3177 unsigned int size, i, n, ulen = 0, usize = 0;
3178 int err, rem;
3179 u64 handle, pos_handle;
3180
3181 lockdep_assert_held(&net->nft.commit_mutex);
3182
3183 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3184 if (IS_ERR(table)) {
3185 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3186 return PTR_ERR(table);
3187 }
3188
3189 if (nla[NFTA_RULE_CHAIN]) {
3190 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3191 genmask);
3192 if (IS_ERR(chain)) {
3193 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3194 return PTR_ERR(chain);
3195 }
3196 if (nft_chain_is_bound(chain))
3197 return -EOPNOTSUPP;
3198
3199 } else if (nla[NFTA_RULE_CHAIN_ID]) {
3200 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID]);
3201 if (IS_ERR(chain)) {
3202 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);
3203 return PTR_ERR(chain);
3204 }
3205 } else {
3206 return -EINVAL;
3207 }
3208
3209 if (nla[NFTA_RULE_HANDLE]) {
3210 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
3211 rule = __nft_rule_lookup(chain, handle);
3212 if (IS_ERR(rule)) {
3213 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3214 return PTR_ERR(rule);
3215 }
3216
3217 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3218 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3219 return -EEXIST;
3220 }
3221 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3222 old_rule = rule;
3223 else
3224 return -EOPNOTSUPP;
3225 } else {
3226 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
3227 nlh->nlmsg_flags & NLM_F_REPLACE)
3228 return -EINVAL;
3229 handle = nf_tables_alloc_handle(table);
3230
3231 if (chain->use == UINT_MAX)
3232 return -EOVERFLOW;
3233
3234 if (nla[NFTA_RULE_POSITION]) {
3235 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
3236 old_rule = __nft_rule_lookup(chain, pos_handle);
3237 if (IS_ERR(old_rule)) {
3238 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
3239 return PTR_ERR(old_rule);
3240 }
3241 } else if (nla[NFTA_RULE_POSITION_ID]) {
3242 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]);
3243 if (IS_ERR(old_rule)) {
3244 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
3245 return PTR_ERR(old_rule);
3246 }
3247 }
3248 }
3249
3250 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
3251
3252 n = 0;
3253 size = 0;
3254 if (nla[NFTA_RULE_EXPRESSIONS]) {
3255 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
3256 sizeof(struct nft_expr_info),
3257 GFP_KERNEL);
3258 if (!info)
3259 return -ENOMEM;
3260
3261 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
3262 err = -EINVAL;
3263 if (nla_type(tmp) != NFTA_LIST_ELEM)
3264 goto err1;
3265 if (n == NFT_RULE_MAXEXPRS)
3266 goto err1;
3267 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
3268 if (err < 0) {
3269 NL_SET_BAD_ATTR(extack, tmp);
3270 goto err1;
3271 }
3272 size += info[n].ops->size;
3273 n++;
3274 }
3275 }
3276 /* Check for overflow of dlen field */
3277 err = -EFBIG;
3278 if (size >= 1 << 12)
3279 goto err1;
3280
3281 if (nla[NFTA_RULE_USERDATA]) {
3282 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
3283 if (ulen > 0)
3284 usize = sizeof(struct nft_userdata) + ulen;
3285 }
3286
3287 err = -ENOMEM;
3288 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
3289 if (rule == NULL)
3290 goto err1;
3291
3292 nft_activate_next(net, rule);
3293
3294 rule->handle = handle;
3295 rule->dlen = size;
3296 rule->udata = ulen ? 1 : 0;
3297
3298 if (ulen) {
3299 udata = nft_userdata(rule);
3300 udata->len = ulen - 1;
3301 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
3302 }
3303
3304 expr = nft_expr_first(rule);
3305 for (i = 0; i < n; i++) {
3306 err = nf_tables_newexpr(&ctx, &info[i], expr);
3307 if (err < 0) {
3308 NL_SET_BAD_ATTR(extack, info[i].attr);
3309 goto err2;
3310 }
3311
3312 if (info[i].ops->validate)
3313 nft_validate_state_update(net, NFT_VALIDATE_NEED);
3314
3315 info[i].ops = NULL;
3316 expr = nft_expr_next(expr);
3317 }
3318
3319 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
3320 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3321 if (trans == NULL) {
3322 err = -ENOMEM;
3323 goto err2;
3324 }
3325 err = nft_delrule(&ctx, old_rule);
3326 if (err < 0) {
3327 nft_trans_destroy(trans);
3328 goto err2;
3329 }
3330
3331 list_add_tail_rcu(&rule->list, &old_rule->list);
3332 } else {
3333 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3334 if (!trans) {
3335 err = -ENOMEM;
3336 goto err2;
3337 }
3338
3339 if (nlh->nlmsg_flags & NLM_F_APPEND) {
3340 if (old_rule)
3341 list_add_rcu(&rule->list, &old_rule->list);
3342 else
3343 list_add_tail_rcu(&rule->list, &chain->rules);
3344 } else {
3345 if (old_rule)
3346 list_add_tail_rcu(&rule->list, &old_rule->list);
3347 else
3348 list_add_rcu(&rule->list, &chain->rules);
3349 }
3350 }
3351 kvfree(info);
3352 chain->use++;
3353
3354 if (net->nft.validate_state == NFT_VALIDATE_DO)
3355 return nft_table_validate(net, table);
3356
3357 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
3358 flow = nft_flow_rule_create(net, rule);
3359 if (IS_ERR(flow))
3360 return PTR_ERR(flow);
3361
3362 nft_trans_flow_rule(trans) = flow;
3363 }
3364
3365 return 0;
3366 err2:
3367 nf_tables_rule_release(&ctx, rule);
3368 err1:
3369 for (i = 0; i < n; i++) {
3370 if (info[i].ops) {
3371 module_put(info[i].ops->type->owner);
3372 if (info[i].ops->type->release_ops)
3373 info[i].ops->type->release_ops(info[i].ops);
3374 }
3375 }
3376 kvfree(info);
3377 return err;
3378 }
3379
nft_rule_lookup_byid(const struct net * net,const struct nft_chain * chain,const struct nlattr * nla)3380 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3381 const struct nft_chain *chain,
3382 const struct nlattr *nla)
3383 {
3384 u32 id = ntohl(nla_get_be32(nla));
3385 struct nft_trans *trans;
3386
3387 list_for_each_entry(trans, &net->nft.commit_list, list) {
3388 struct nft_rule *rule = nft_trans_rule(trans);
3389
3390 if (trans->msg_type == NFT_MSG_NEWRULE &&
3391 trans->ctx.chain == chain &&
3392 id == nft_trans_rule_id(trans))
3393 return rule;
3394 }
3395 return ERR_PTR(-ENOENT);
3396 }
3397
nf_tables_delrule(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)3398 static int nf_tables_delrule(struct net *net, struct sock *nlsk,
3399 struct sk_buff *skb, const struct nlmsghdr *nlh,
3400 const struct nlattr * const nla[],
3401 struct netlink_ext_ack *extack)
3402 {
3403 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3404 u8 genmask = nft_genmask_next(net);
3405 struct nft_table *table;
3406 struct nft_chain *chain = NULL;
3407 struct nft_rule *rule;
3408 int family = nfmsg->nfgen_family, err = 0;
3409 struct nft_ctx ctx;
3410
3411 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3412 if (IS_ERR(table)) {
3413 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3414 return PTR_ERR(table);
3415 }
3416
3417 if (nla[NFTA_RULE_CHAIN]) {
3418 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3419 genmask);
3420 if (IS_ERR(chain)) {
3421 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3422 return PTR_ERR(chain);
3423 }
3424 if (nft_chain_is_bound(chain))
3425 return -EOPNOTSUPP;
3426 }
3427
3428 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
3429
3430 if (chain) {
3431 if (nla[NFTA_RULE_HANDLE]) {
3432 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3433 if (IS_ERR(rule)) {
3434 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3435 return PTR_ERR(rule);
3436 }
3437
3438 err = nft_delrule(&ctx, rule);
3439 } else if (nla[NFTA_RULE_ID]) {
3440 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]);
3441 if (IS_ERR(rule)) {
3442 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
3443 return PTR_ERR(rule);
3444 }
3445
3446 err = nft_delrule(&ctx, rule);
3447 } else {
3448 err = nft_delrule_by_chain(&ctx);
3449 }
3450 } else {
3451 list_for_each_entry(chain, &table->chains, list) {
3452 if (!nft_is_active_next(net, chain))
3453 continue;
3454
3455 ctx.chain = chain;
3456 err = nft_delrule_by_chain(&ctx);
3457 if (err < 0)
3458 break;
3459 }
3460 }
3461
3462 return err;
3463 }
3464
3465 /*
3466 * Sets
3467 */
3468 static const struct nft_set_type *nft_set_types[] = {
3469 &nft_set_hash_fast_type,
3470 &nft_set_hash_type,
3471 &nft_set_rhash_type,
3472 &nft_set_bitmap_type,
3473 &nft_set_rbtree_type,
3474 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
3475 &nft_set_pipapo_avx2_type,
3476 #endif
3477 &nft_set_pipapo_type,
3478 };
3479
3480 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
3481 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3482 NFT_SET_EVAL)
3483
nft_set_ops_candidate(const struct nft_set_type * type,u32 flags)3484 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
3485 {
3486 return (flags & type->features) == (flags & NFT_SET_FEATURES);
3487 }
3488
3489 /*
3490 * Select a set implementation based on the data characteristics and the
3491 * given policy. The total memory use might not be known if no size is
3492 * given, in that case the amount of memory per element is used.
3493 */
3494 static const struct nft_set_ops *
nft_select_set_ops(const struct nft_ctx * ctx,const struct nlattr * const nla[],const struct nft_set_desc * desc,enum nft_set_policies policy)3495 nft_select_set_ops(const struct nft_ctx *ctx,
3496 const struct nlattr * const nla[],
3497 const struct nft_set_desc *desc,
3498 enum nft_set_policies policy)
3499 {
3500 const struct nft_set_ops *ops, *bops;
3501 struct nft_set_estimate est, best;
3502 const struct nft_set_type *type;
3503 u32 flags = 0;
3504 int i;
3505
3506 lockdep_assert_held(&ctx->net->nft.commit_mutex);
3507 lockdep_nfnl_nft_mutex_not_held();
3508
3509 if (nla[NFTA_SET_FLAGS] != NULL)
3510 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3511
3512 bops = NULL;
3513 best.size = ~0;
3514 best.lookup = ~0;
3515 best.space = ~0;
3516
3517 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) {
3518 type = nft_set_types[i];
3519 ops = &type->ops;
3520
3521 if (!nft_set_ops_candidate(type, flags))
3522 continue;
3523 if (!ops->estimate(desc, flags, &est))
3524 continue;
3525
3526 switch (policy) {
3527 case NFT_SET_POL_PERFORMANCE:
3528 if (est.lookup < best.lookup)
3529 break;
3530 if (est.lookup == best.lookup &&
3531 est.space < best.space)
3532 break;
3533 continue;
3534 case NFT_SET_POL_MEMORY:
3535 if (!desc->size) {
3536 if (est.space < best.space)
3537 break;
3538 if (est.space == best.space &&
3539 est.lookup < best.lookup)
3540 break;
3541 } else if (est.size < best.size || !bops) {
3542 break;
3543 }
3544 continue;
3545 default:
3546 break;
3547 }
3548
3549 bops = ops;
3550 best = est;
3551 }
3552
3553 if (bops != NULL)
3554 return bops;
3555
3556 return ERR_PTR(-EOPNOTSUPP);
3557 }
3558
3559 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
3560 [NFTA_SET_TABLE] = { .type = NLA_STRING,
3561 .len = NFT_TABLE_MAXNAMELEN - 1 },
3562 [NFTA_SET_NAME] = { .type = NLA_STRING,
3563 .len = NFT_SET_MAXNAMELEN - 1 },
3564 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
3565 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
3566 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
3567 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
3568 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
3569 [NFTA_SET_POLICY] = { .type = NLA_U32 },
3570 [NFTA_SET_DESC] = { .type = NLA_NESTED },
3571 [NFTA_SET_ID] = { .type = NLA_U32 },
3572 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
3573 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
3574 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
3575 .len = NFT_USERDATA_MAXLEN },
3576 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3577 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
3578 [NFTA_SET_EXPR] = { .type = NLA_NESTED },
3579 };
3580
3581 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3582 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
3583 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED },
3584 };
3585
nft_ctx_init_from_setattr(struct nft_ctx * ctx,struct net * net,const struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack,u8 genmask)3586 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
3587 const struct sk_buff *skb,
3588 const struct nlmsghdr *nlh,
3589 const struct nlattr * const nla[],
3590 struct netlink_ext_ack *extack,
3591 u8 genmask)
3592 {
3593 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3594 int family = nfmsg->nfgen_family;
3595 struct nft_table *table = NULL;
3596
3597 if (nla[NFTA_SET_TABLE] != NULL) {
3598 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3599 genmask);
3600 if (IS_ERR(table)) {
3601 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
3602 return PTR_ERR(table);
3603 }
3604 }
3605
3606 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
3607 return 0;
3608 }
3609
nft_set_lookup(const struct nft_table * table,const struct nlattr * nla,u8 genmask)3610 static struct nft_set *nft_set_lookup(const struct nft_table *table,
3611 const struct nlattr *nla, u8 genmask)
3612 {
3613 struct nft_set *set;
3614
3615 if (nla == NULL)
3616 return ERR_PTR(-EINVAL);
3617
3618 list_for_each_entry_rcu(set, &table->sets, list) {
3619 if (!nla_strcmp(nla, set->name) &&
3620 nft_active_genmask(set, genmask))
3621 return set;
3622 }
3623 return ERR_PTR(-ENOENT);
3624 }
3625
nft_set_lookup_byhandle(const struct nft_table * table,const struct nlattr * nla,u8 genmask)3626 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3627 const struct nlattr *nla,
3628 u8 genmask)
3629 {
3630 struct nft_set *set;
3631
3632 list_for_each_entry(set, &table->sets, list) {
3633 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3634 nft_active_genmask(set, genmask))
3635 return set;
3636 }
3637 return ERR_PTR(-ENOENT);
3638 }
3639
nft_set_lookup_byid(const struct net * net,const struct nft_table * table,const struct nlattr * nla,u8 genmask)3640 static struct nft_set *nft_set_lookup_byid(const struct net *net,
3641 const struct nft_table *table,
3642 const struct nlattr *nla, u8 genmask)
3643 {
3644 struct nft_trans *trans;
3645 u32 id = ntohl(nla_get_be32(nla));
3646
3647 list_for_each_entry(trans, &net->nft.commit_list, list) {
3648 if (trans->msg_type == NFT_MSG_NEWSET) {
3649 struct nft_set *set = nft_trans_set(trans);
3650
3651 if (id == nft_trans_set_id(trans) &&
3652 set->table == table &&
3653 nft_active_genmask(set, genmask))
3654 return set;
3655 }
3656 }
3657 return ERR_PTR(-ENOENT);
3658 }
3659
nft_set_lookup_global(const struct net * net,const struct nft_table * table,const struct nlattr * nla_set_name,const struct nlattr * nla_set_id,u8 genmask)3660 struct nft_set *nft_set_lookup_global(const struct net *net,
3661 const struct nft_table *table,
3662 const struct nlattr *nla_set_name,
3663 const struct nlattr *nla_set_id,
3664 u8 genmask)
3665 {
3666 struct nft_set *set;
3667
3668 set = nft_set_lookup(table, nla_set_name, genmask);
3669 if (IS_ERR(set)) {
3670 if (!nla_set_id)
3671 return set;
3672
3673 set = nft_set_lookup_byid(net, table, nla_set_id, genmask);
3674 }
3675 return set;
3676 }
3677 EXPORT_SYMBOL_GPL(nft_set_lookup_global);
3678
nf_tables_set_alloc_name(struct nft_ctx * ctx,struct nft_set * set,const char * name)3679 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3680 const char *name)
3681 {
3682 const struct nft_set *i;
3683 const char *p;
3684 unsigned long *inuse;
3685 unsigned int n = 0, min = 0;
3686
3687 p = strchr(name, '%');
3688 if (p != NULL) {
3689 if (p[1] != 'd' || strchr(p + 2, '%'))
3690 return -EINVAL;
3691
3692 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3693 if (inuse == NULL)
3694 return -ENOMEM;
3695 cont:
3696 list_for_each_entry(i, &ctx->table->sets, list) {
3697 int tmp;
3698
3699 if (!nft_is_active_next(ctx->net, i))
3700 continue;
3701 if (!sscanf(i->name, name, &tmp))
3702 continue;
3703 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
3704 continue;
3705
3706 set_bit(tmp - min, inuse);
3707 }
3708
3709 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
3710 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3711 min += BITS_PER_BYTE * PAGE_SIZE;
3712 memset(inuse, 0, PAGE_SIZE);
3713 goto cont;
3714 }
3715 free_page((unsigned long)inuse);
3716 }
3717
3718 set->name = kasprintf(GFP_KERNEL, name, min + n);
3719 if (!set->name)
3720 return -ENOMEM;
3721
3722 list_for_each_entry(i, &ctx->table->sets, list) {
3723 if (!nft_is_active_next(ctx->net, i))
3724 continue;
3725 if (!strcmp(set->name, i->name)) {
3726 kfree(set->name);
3727 set->name = NULL;
3728 return -ENFILE;
3729 }
3730 }
3731 return 0;
3732 }
3733
nf_msecs_to_jiffies64(const struct nlattr * nla,u64 * result)3734 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3735 {
3736 u64 ms = be64_to_cpu(nla_get_be64(nla));
3737 u64 max = (u64)(~((u64)0));
3738
3739 max = div_u64(max, NSEC_PER_MSEC);
3740 if (ms >= max)
3741 return -ERANGE;
3742
3743 ms *= NSEC_PER_MSEC;
3744 *result = nsecs_to_jiffies64(ms);
3745 return 0;
3746 }
3747
nf_jiffies64_to_msecs(u64 input)3748 __be64 nf_jiffies64_to_msecs(u64 input)
3749 {
3750 return cpu_to_be64(jiffies64_to_msecs(input));
3751 }
3752
nf_tables_fill_set_concat(struct sk_buff * skb,const struct nft_set * set)3753 static int nf_tables_fill_set_concat(struct sk_buff *skb,
3754 const struct nft_set *set)
3755 {
3756 struct nlattr *concat, *field;
3757 int i;
3758
3759 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT);
3760 if (!concat)
3761 return -ENOMEM;
3762
3763 for (i = 0; i < set->field_count; i++) {
3764 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
3765 if (!field)
3766 return -ENOMEM;
3767
3768 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN,
3769 htonl(set->field_len[i])))
3770 return -ENOMEM;
3771
3772 nla_nest_end(skb, field);
3773 }
3774
3775 nla_nest_end(skb, concat);
3776
3777 return 0;
3778 }
3779
nf_tables_fill_set(struct sk_buff * skb,const struct nft_ctx * ctx,const struct nft_set * set,u16 event,u16 flags)3780 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3781 const struct nft_set *set, u16 event, u16 flags)
3782 {
3783 struct nlmsghdr *nlh;
3784 u32 portid = ctx->portid;
3785 struct nlattr *nest;
3786 u32 seq = ctx->seq;
3787
3788 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3789 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
3790 NFNETLINK_V0, nft_base_seq(ctx->net));
3791 if (!nlh)
3792 goto nla_put_failure;
3793
3794 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3795 goto nla_put_failure;
3796 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3797 goto nla_put_failure;
3798 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3799 NFTA_SET_PAD))
3800 goto nla_put_failure;
3801 if (set->flags != 0)
3802 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3803 goto nla_put_failure;
3804
3805 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3806 goto nla_put_failure;
3807 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3808 goto nla_put_failure;
3809 if (set->flags & NFT_SET_MAP) {
3810 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3811 goto nla_put_failure;
3812 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3813 goto nla_put_failure;
3814 }
3815 if (set->flags & NFT_SET_OBJECT &&
3816 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3817 goto nla_put_failure;
3818
3819 if (set->timeout &&
3820 nla_put_be64(skb, NFTA_SET_TIMEOUT,
3821 nf_jiffies64_to_msecs(set->timeout),
3822 NFTA_SET_PAD))
3823 goto nla_put_failure;
3824 if (set->gc_int &&
3825 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3826 goto nla_put_failure;
3827
3828 if (set->policy != NFT_SET_POL_PERFORMANCE) {
3829 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3830 goto nla_put_failure;
3831 }
3832
3833 if (set->udata &&
3834 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3835 goto nla_put_failure;
3836
3837 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC);
3838 if (!nest)
3839 goto nla_put_failure;
3840 if (set->size &&
3841 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3842 goto nla_put_failure;
3843
3844 if (set->field_count > 1 &&
3845 nf_tables_fill_set_concat(skb, set))
3846 goto nla_put_failure;
3847
3848 nla_nest_end(skb, nest);
3849
3850 if (set->expr) {
3851 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR);
3852 if (nf_tables_fill_expr_info(skb, set->expr) < 0)
3853 goto nla_put_failure;
3854
3855 nla_nest_end(skb, nest);
3856 }
3857
3858 nlmsg_end(skb, nlh);
3859 return 0;
3860
3861 nla_put_failure:
3862 nlmsg_trim(skb, nlh);
3863 return -1;
3864 }
3865
nf_tables_set_notify(const struct nft_ctx * ctx,const struct nft_set * set,int event,gfp_t gfp_flags)3866 static void nf_tables_set_notify(const struct nft_ctx *ctx,
3867 const struct nft_set *set, int event,
3868 gfp_t gfp_flags)
3869 {
3870 struct sk_buff *skb;
3871 u32 portid = ctx->portid;
3872 int err;
3873
3874 if (!ctx->report &&
3875 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
3876 return;
3877
3878 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
3879 if (skb == NULL)
3880 goto err;
3881
3882 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3883 if (err < 0) {
3884 kfree_skb(skb);
3885 goto err;
3886 }
3887
3888 nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
3889 return;
3890 err:
3891 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3892 }
3893
nf_tables_dump_sets(struct sk_buff * skb,struct netlink_callback * cb)3894 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
3895 {
3896 const struct nft_set *set;
3897 unsigned int idx, s_idx = cb->args[0];
3898 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3899 struct net *net = sock_net(skb->sk);
3900 struct nft_ctx *ctx = cb->data, ctx_set;
3901
3902 if (cb->args[1])
3903 return skb->len;
3904
3905 rcu_read_lock();
3906 cb->seq = net->nft.base_seq;
3907
3908 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3909 if (ctx->family != NFPROTO_UNSPEC &&
3910 ctx->family != table->family)
3911 continue;
3912
3913 if (ctx->table && ctx->table != table)
3914 continue;
3915
3916 if (cur_table) {
3917 if (cur_table != table)
3918 continue;
3919
3920 cur_table = NULL;
3921 }
3922 idx = 0;
3923 list_for_each_entry_rcu(set, &table->sets, list) {
3924 if (idx < s_idx)
3925 goto cont;
3926 if (!nft_is_active(net, set))
3927 goto cont;
3928
3929 ctx_set = *ctx;
3930 ctx_set.table = table;
3931 ctx_set.family = table->family;
3932
3933 if (nf_tables_fill_set(skb, &ctx_set, set,
3934 NFT_MSG_NEWSET,
3935 NLM_F_MULTI) < 0) {
3936 cb->args[0] = idx;
3937 cb->args[2] = (unsigned long) table;
3938 goto done;
3939 }
3940 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3941 cont:
3942 idx++;
3943 }
3944 if (s_idx)
3945 s_idx = 0;
3946 }
3947 cb->args[1] = 1;
3948 done:
3949 rcu_read_unlock();
3950 return skb->len;
3951 }
3952
nf_tables_dump_sets_start(struct netlink_callback * cb)3953 static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3954 {
3955 struct nft_ctx *ctx_dump = NULL;
3956
3957 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3958 if (ctx_dump == NULL)
3959 return -ENOMEM;
3960
3961 cb->data = ctx_dump;
3962 return 0;
3963 }
3964
nf_tables_dump_sets_done(struct netlink_callback * cb)3965 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
3966 {
3967 kfree(cb->data);
3968 return 0;
3969 }
3970
3971 /* called with rcu_read_lock held */
nf_tables_getset(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)3972 static int nf_tables_getset(struct net *net, struct sock *nlsk,
3973 struct sk_buff *skb, const struct nlmsghdr *nlh,
3974 const struct nlattr * const nla[],
3975 struct netlink_ext_ack *extack)
3976 {
3977 u8 genmask = nft_genmask_cur(net);
3978 const struct nft_set *set;
3979 struct nft_ctx ctx;
3980 struct sk_buff *skb2;
3981 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3982 int err;
3983
3984 /* Verify existence before starting dump */
3985 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3986 genmask);
3987 if (err < 0)
3988 return err;
3989
3990 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3991 struct netlink_dump_control c = {
3992 .start = nf_tables_dump_sets_start,
3993 .dump = nf_tables_dump_sets,
3994 .done = nf_tables_dump_sets_done,
3995 .data = &ctx,
3996 .module = THIS_MODULE,
3997 };
3998
3999 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4000 }
4001
4002 /* Only accept unspec with dump */
4003 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4004 return -EAFNOSUPPORT;
4005 if (!nla[NFTA_SET_TABLE])
4006 return -EINVAL;
4007
4008 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
4009 if (IS_ERR(set))
4010 return PTR_ERR(set);
4011
4012 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
4013 if (skb2 == NULL)
4014 return -ENOMEM;
4015
4016 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
4017 if (err < 0)
4018 goto err_fill_set_info;
4019
4020 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
4021
4022 err_fill_set_info:
4023 kfree_skb(skb2);
4024 return err;
4025 }
4026
4027 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = {
4028 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 },
4029 };
4030
nft_set_desc_concat_parse(const struct nlattr * attr,struct nft_set_desc * desc)4031 static int nft_set_desc_concat_parse(const struct nlattr *attr,
4032 struct nft_set_desc *desc)
4033 {
4034 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1];
4035 u32 len;
4036 int err;
4037
4038 if (desc->field_count >= ARRAY_SIZE(desc->field_len))
4039 return -E2BIG;
4040
4041 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr,
4042 nft_concat_policy, NULL);
4043 if (err < 0)
4044 return err;
4045
4046 if (!tb[NFTA_SET_FIELD_LEN])
4047 return -EINVAL;
4048
4049 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN]));
4050 if (!len || len > U8_MAX)
4051 return -EINVAL;
4052
4053 desc->field_len[desc->field_count++] = len;
4054
4055 return 0;
4056 }
4057
nft_set_desc_concat(struct nft_set_desc * desc,const struct nlattr * nla)4058 static int nft_set_desc_concat(struct nft_set_desc *desc,
4059 const struct nlattr *nla)
4060 {
4061 struct nlattr *attr;
4062 u32 num_regs = 0;
4063 int rem, err, i;
4064
4065 nla_for_each_nested(attr, nla, rem) {
4066 if (nla_type(attr) != NFTA_LIST_ELEM)
4067 return -EINVAL;
4068
4069 err = nft_set_desc_concat_parse(attr, desc);
4070 if (err < 0)
4071 return err;
4072 }
4073
4074 for (i = 0; i < desc->field_count; i++)
4075 num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32));
4076
4077 if (num_regs > NFT_REG32_COUNT)
4078 return -E2BIG;
4079
4080 return 0;
4081 }
4082
nf_tables_set_desc_parse(struct nft_set_desc * desc,const struct nlattr * nla)4083 static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
4084 const struct nlattr *nla)
4085 {
4086 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
4087 int err;
4088
4089 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
4090 nft_set_desc_policy, NULL);
4091 if (err < 0)
4092 return err;
4093
4094 if (da[NFTA_SET_DESC_SIZE] != NULL)
4095 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
4096 if (da[NFTA_SET_DESC_CONCAT])
4097 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]);
4098
4099 return err;
4100 }
4101
nf_tables_newset(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)4102 static int nf_tables_newset(struct net *net, struct sock *nlsk,
4103 struct sk_buff *skb, const struct nlmsghdr *nlh,
4104 const struct nlattr * const nla[],
4105 struct netlink_ext_ack *extack)
4106 {
4107 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4108 u8 genmask = nft_genmask_next(net);
4109 int family = nfmsg->nfgen_family;
4110 const struct nft_set_ops *ops;
4111 struct nft_expr *expr = NULL;
4112 struct nft_table *table;
4113 struct nft_set *set;
4114 struct nft_ctx ctx;
4115 size_t alloc_size;
4116 char *name;
4117 u64 size;
4118 u64 timeout;
4119 u32 ktype, dtype, flags, policy, gc_int, objtype;
4120 struct nft_set_desc desc;
4121 unsigned char *udata;
4122 u16 udlen;
4123 int err;
4124 int i;
4125
4126 if (nla[NFTA_SET_TABLE] == NULL ||
4127 nla[NFTA_SET_NAME] == NULL ||
4128 nla[NFTA_SET_KEY_LEN] == NULL ||
4129 nla[NFTA_SET_ID] == NULL)
4130 return -EINVAL;
4131
4132 memset(&desc, 0, sizeof(desc));
4133
4134 ktype = NFT_DATA_VALUE;
4135 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
4136 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
4137 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
4138 return -EINVAL;
4139 }
4140
4141 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
4142 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
4143 return -EINVAL;
4144
4145 flags = 0;
4146 if (nla[NFTA_SET_FLAGS] != NULL) {
4147 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
4148 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
4149 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
4150 NFT_SET_MAP | NFT_SET_EVAL |
4151 NFT_SET_OBJECT | NFT_SET_CONCAT))
4152 return -EOPNOTSUPP;
4153 /* Only one of these operations is supported */
4154 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
4155 (NFT_SET_MAP | NFT_SET_OBJECT))
4156 return -EOPNOTSUPP;
4157 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
4158 (NFT_SET_EVAL | NFT_SET_OBJECT))
4159 return -EOPNOTSUPP;
4160 }
4161
4162 dtype = 0;
4163 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
4164 if (!(flags & NFT_SET_MAP))
4165 return -EINVAL;
4166
4167 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
4168 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
4169 dtype != NFT_DATA_VERDICT)
4170 return -EINVAL;
4171
4172 if (dtype != NFT_DATA_VERDICT) {
4173 if (nla[NFTA_SET_DATA_LEN] == NULL)
4174 return -EINVAL;
4175 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
4176 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
4177 return -EINVAL;
4178 } else
4179 desc.dlen = sizeof(struct nft_verdict);
4180 } else if (flags & NFT_SET_MAP)
4181 return -EINVAL;
4182
4183 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
4184 if (!(flags & NFT_SET_OBJECT))
4185 return -EINVAL;
4186
4187 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
4188 if (objtype == NFT_OBJECT_UNSPEC ||
4189 objtype > NFT_OBJECT_MAX)
4190 return -EOPNOTSUPP;
4191 } else if (flags & NFT_SET_OBJECT)
4192 return -EINVAL;
4193 else
4194 objtype = NFT_OBJECT_UNSPEC;
4195
4196 timeout = 0;
4197 if (nla[NFTA_SET_TIMEOUT] != NULL) {
4198 if (!(flags & NFT_SET_TIMEOUT))
4199 return -EINVAL;
4200
4201 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
4202 if (err)
4203 return err;
4204 }
4205 gc_int = 0;
4206 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
4207 if (!(flags & NFT_SET_TIMEOUT))
4208 return -EINVAL;
4209 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
4210 }
4211
4212 policy = NFT_SET_POL_PERFORMANCE;
4213 if (nla[NFTA_SET_POLICY] != NULL)
4214 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
4215
4216 if (nla[NFTA_SET_DESC] != NULL) {
4217 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
4218 if (err < 0)
4219 return err;
4220
4221 if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT))
4222 return -EINVAL;
4223 } else if (flags & NFT_SET_CONCAT) {
4224 return -EINVAL;
4225 }
4226
4227 if (nla[NFTA_SET_EXPR])
4228 desc.expr = true;
4229
4230 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
4231 if (IS_ERR(table)) {
4232 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
4233 return PTR_ERR(table);
4234 }
4235
4236 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
4237
4238 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
4239 if (IS_ERR(set)) {
4240 if (PTR_ERR(set) != -ENOENT) {
4241 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4242 return PTR_ERR(set);
4243 }
4244 } else {
4245 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4246 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4247 return -EEXIST;
4248 }
4249 if (nlh->nlmsg_flags & NLM_F_REPLACE)
4250 return -EOPNOTSUPP;
4251
4252 return 0;
4253 }
4254
4255 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
4256 return -ENOENT;
4257
4258 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
4259 if (IS_ERR(ops))
4260 return PTR_ERR(ops);
4261
4262 udlen = 0;
4263 if (nla[NFTA_SET_USERDATA])
4264 udlen = nla_len(nla[NFTA_SET_USERDATA]);
4265
4266 size = 0;
4267 if (ops->privsize != NULL)
4268 size = ops->privsize(nla, &desc);
4269 alloc_size = sizeof(*set) + size + udlen;
4270 if (alloc_size < size || alloc_size > INT_MAX)
4271 return -ENOMEM;
4272 set = kvzalloc(alloc_size, GFP_KERNEL);
4273 if (!set)
4274 return -ENOMEM;
4275
4276 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
4277 if (!name) {
4278 err = -ENOMEM;
4279 goto err_set_name;
4280 }
4281
4282 err = nf_tables_set_alloc_name(&ctx, set, name);
4283 kfree(name);
4284 if (err < 0)
4285 goto err_set_name;
4286
4287 udata = NULL;
4288 if (udlen) {
4289 udata = set->data + size;
4290 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
4291 }
4292
4293 INIT_LIST_HEAD(&set->bindings);
4294 set->table = table;
4295 write_pnet(&set->net, net);
4296 set->ops = ops;
4297 set->ktype = ktype;
4298 set->klen = desc.klen;
4299 set->dtype = dtype;
4300 set->objtype = objtype;
4301 set->dlen = desc.dlen;
4302 set->flags = flags;
4303 set->size = desc.size;
4304 set->policy = policy;
4305 set->udlen = udlen;
4306 set->udata = udata;
4307 set->timeout = timeout;
4308 set->gc_int = gc_int;
4309
4310 set->field_count = desc.field_count;
4311 for (i = 0; i < desc.field_count; i++)
4312 set->field_len[i] = desc.field_len[i];
4313
4314 err = ops->init(set, &desc, nla);
4315 if (err < 0)
4316 goto err_set_init;
4317
4318 if (nla[NFTA_SET_EXPR]) {
4319 expr = nft_set_elem_expr_alloc(&ctx, set, nla[NFTA_SET_EXPR]);
4320 if (IS_ERR(expr)) {
4321 err = PTR_ERR(expr);
4322 goto err_set_expr_alloc;
4323 }
4324
4325 set->expr = expr;
4326 }
4327
4328 set->handle = nf_tables_alloc_handle(table);
4329
4330 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
4331 if (err < 0)
4332 goto err_set_expr_alloc;
4333
4334 list_add_tail_rcu(&set->list, &table->sets);
4335 table->use++;
4336 return 0;
4337
4338 err_set_expr_alloc:
4339 if (set->expr)
4340 nft_expr_destroy(&ctx, set->expr);
4341
4342 ops->destroy(set);
4343 err_set_init:
4344 kfree(set->name);
4345 err_set_name:
4346 kvfree(set);
4347 return err;
4348 }
4349
nft_set_destroy(const struct nft_ctx * ctx,struct nft_set * set)4350 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
4351 {
4352 if (WARN_ON(set->use > 0))
4353 return;
4354
4355 if (set->expr)
4356 nft_expr_destroy(ctx, set->expr);
4357
4358 set->ops->destroy(set);
4359 kfree(set->name);
4360 kvfree(set);
4361 }
4362
nf_tables_delset(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)4363 static int nf_tables_delset(struct net *net, struct sock *nlsk,
4364 struct sk_buff *skb, const struct nlmsghdr *nlh,
4365 const struct nlattr * const nla[],
4366 struct netlink_ext_ack *extack)
4367 {
4368 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4369 u8 genmask = nft_genmask_next(net);
4370 const struct nlattr *attr;
4371 struct nft_set *set;
4372 struct nft_ctx ctx;
4373 int err;
4374
4375 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4376 return -EAFNOSUPPORT;
4377 if (nla[NFTA_SET_TABLE] == NULL)
4378 return -EINVAL;
4379
4380 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
4381 genmask);
4382 if (err < 0)
4383 return err;
4384
4385 if (nla[NFTA_SET_HANDLE]) {
4386 attr = nla[NFTA_SET_HANDLE];
4387 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
4388 } else {
4389 attr = nla[NFTA_SET_NAME];
4390 set = nft_set_lookup(ctx.table, attr, genmask);
4391 }
4392
4393 if (IS_ERR(set)) {
4394 NL_SET_BAD_ATTR(extack, attr);
4395 return PTR_ERR(set);
4396 }
4397 if (set->use ||
4398 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
4399 NL_SET_BAD_ATTR(extack, attr);
4400 return -EBUSY;
4401 }
4402
4403 return nft_delset(&ctx, set);
4404 }
4405
4406 static int nft_validate_register_store(const struct nft_ctx *ctx,
4407 enum nft_registers reg,
4408 const struct nft_data *data,
4409 enum nft_data_types type,
4410 unsigned int len);
4411
nf_tables_bind_check_setelem(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)4412 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
4413 struct nft_set *set,
4414 const struct nft_set_iter *iter,
4415 struct nft_set_elem *elem)
4416 {
4417 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4418 enum nft_registers dreg;
4419
4420 dreg = nft_type_to_reg(set->dtype);
4421 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
4422 set->dtype == NFT_DATA_VERDICT ?
4423 NFT_DATA_VERDICT : NFT_DATA_VALUE,
4424 set->dlen);
4425 }
4426
nf_tables_bind_set(const struct nft_ctx * ctx,struct nft_set * set,struct nft_set_binding * binding)4427 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
4428 struct nft_set_binding *binding)
4429 {
4430 struct nft_set_binding *i;
4431 struct nft_set_iter iter;
4432
4433 if (set->use == UINT_MAX)
4434 return -EOVERFLOW;
4435
4436 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
4437 return -EBUSY;
4438
4439 if (binding->flags & NFT_SET_MAP) {
4440 /* If the set is already bound to the same chain all
4441 * jumps are already validated for that chain.
4442 */
4443 list_for_each_entry(i, &set->bindings, list) {
4444 if (i->flags & NFT_SET_MAP &&
4445 i->chain == binding->chain)
4446 goto bind;
4447 }
4448
4449 iter.genmask = nft_genmask_next(ctx->net);
4450 iter.skip = 0;
4451 iter.count = 0;
4452 iter.err = 0;
4453 iter.fn = nf_tables_bind_check_setelem;
4454
4455 set->ops->walk(ctx, set, &iter);
4456 if (iter.err < 0)
4457 return iter.err;
4458 }
4459 bind:
4460 binding->chain = ctx->chain;
4461 list_add_tail_rcu(&binding->list, &set->bindings);
4462 nft_set_trans_bind(ctx, set);
4463 set->use++;
4464
4465 return 0;
4466 }
4467 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
4468
nf_tables_unbind_set(const struct nft_ctx * ctx,struct nft_set * set,struct nft_set_binding * binding,bool event)4469 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
4470 struct nft_set_binding *binding, bool event)
4471 {
4472 list_del_rcu(&binding->list);
4473
4474 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
4475 list_del_rcu(&set->list);
4476 if (event)
4477 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
4478 GFP_KERNEL);
4479 }
4480 }
4481
nf_tables_deactivate_set(const struct nft_ctx * ctx,struct nft_set * set,struct nft_set_binding * binding,enum nft_trans_phase phase)4482 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
4483 struct nft_set_binding *binding,
4484 enum nft_trans_phase phase)
4485 {
4486 switch (phase) {
4487 case NFT_TRANS_PREPARE:
4488 set->use--;
4489 return;
4490 case NFT_TRANS_ABORT:
4491 case NFT_TRANS_RELEASE:
4492 set->use--;
4493 fallthrough;
4494 default:
4495 nf_tables_unbind_set(ctx, set, binding,
4496 phase == NFT_TRANS_COMMIT);
4497 }
4498 }
4499 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
4500
nf_tables_destroy_set(const struct nft_ctx * ctx,struct nft_set * set)4501 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
4502 {
4503 if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
4504 nft_set_destroy(ctx, set);
4505 }
4506 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
4507
4508 const struct nft_set_ext_type nft_set_ext_types[] = {
4509 [NFT_SET_EXT_KEY] = {
4510 .align = __alignof__(u32),
4511 },
4512 [NFT_SET_EXT_DATA] = {
4513 .align = __alignof__(u32),
4514 },
4515 [NFT_SET_EXT_EXPR] = {
4516 .align = __alignof__(struct nft_expr),
4517 },
4518 [NFT_SET_EXT_OBJREF] = {
4519 .len = sizeof(struct nft_object *),
4520 .align = __alignof__(struct nft_object *),
4521 },
4522 [NFT_SET_EXT_FLAGS] = {
4523 .len = sizeof(u8),
4524 .align = __alignof__(u8),
4525 },
4526 [NFT_SET_EXT_TIMEOUT] = {
4527 .len = sizeof(u64),
4528 .align = __alignof__(u64),
4529 },
4530 [NFT_SET_EXT_EXPIRATION] = {
4531 .len = sizeof(u64),
4532 .align = __alignof__(u64),
4533 },
4534 [NFT_SET_EXT_USERDATA] = {
4535 .len = sizeof(struct nft_userdata),
4536 .align = __alignof__(struct nft_userdata),
4537 },
4538 [NFT_SET_EXT_KEY_END] = {
4539 .align = __alignof__(u32),
4540 },
4541 };
4542
4543 /*
4544 * Set elements
4545 */
4546
4547 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
4548 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
4549 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
4550 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
4551 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
4552 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 },
4553 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
4554 .len = NFT_USERDATA_MAXLEN },
4555 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
4556 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING,
4557 .len = NFT_OBJ_MAXNAMELEN - 1 },
4558 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED },
4559 };
4560
4561 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
4562 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
4563 .len = NFT_TABLE_MAXNAMELEN - 1 },
4564 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
4565 .len = NFT_SET_MAXNAMELEN - 1 },
4566 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
4567 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
4568 };
4569
nft_ctx_init_from_elemattr(struct nft_ctx * ctx,struct net * net,const struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack,u8 genmask)4570 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
4571 const struct sk_buff *skb,
4572 const struct nlmsghdr *nlh,
4573 const struct nlattr * const nla[],
4574 struct netlink_ext_ack *extack,
4575 u8 genmask)
4576 {
4577 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4578 int family = nfmsg->nfgen_family;
4579 struct nft_table *table;
4580
4581 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
4582 genmask);
4583 if (IS_ERR(table)) {
4584 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
4585 return PTR_ERR(table);
4586 }
4587
4588 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
4589 return 0;
4590 }
4591
nf_tables_fill_setelem(struct sk_buff * skb,const struct nft_set * set,const struct nft_set_elem * elem)4592 static int nf_tables_fill_setelem(struct sk_buff *skb,
4593 const struct nft_set *set,
4594 const struct nft_set_elem *elem)
4595 {
4596 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4597 unsigned char *b = skb_tail_pointer(skb);
4598 struct nlattr *nest;
4599
4600 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
4601 if (nest == NULL)
4602 goto nla_put_failure;
4603
4604 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4605 NFT_DATA_VALUE, set->klen) < 0)
4606 goto nla_put_failure;
4607
4608 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) &&
4609 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext),
4610 NFT_DATA_VALUE, set->klen) < 0)
4611 goto nla_put_failure;
4612
4613 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4614 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
4615 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4616 set->dlen) < 0)
4617 goto nla_put_failure;
4618
4619 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
4620 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
4621 goto nla_put_failure;
4622
4623 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4624 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
4625 (*nft_set_ext_obj(ext))->key.name) < 0)
4626 goto nla_put_failure;
4627
4628 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4629 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4630 htonl(*nft_set_ext_flags(ext))))
4631 goto nla_put_failure;
4632
4633 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4634 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
4635 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
4636 NFTA_SET_ELEM_PAD))
4637 goto nla_put_failure;
4638
4639 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4640 u64 expires, now = get_jiffies_64();
4641
4642 expires = *nft_set_ext_expiration(ext);
4643 if (time_before64(now, expires))
4644 expires -= now;
4645 else
4646 expires = 0;
4647
4648 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
4649 nf_jiffies64_to_msecs(expires),
4650 NFTA_SET_ELEM_PAD))
4651 goto nla_put_failure;
4652 }
4653
4654 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4655 struct nft_userdata *udata;
4656
4657 udata = nft_set_ext_userdata(ext);
4658 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4659 udata->len + 1, udata->data))
4660 goto nla_put_failure;
4661 }
4662
4663 nla_nest_end(skb, nest);
4664 return 0;
4665
4666 nla_put_failure:
4667 nlmsg_trim(skb, b);
4668 return -EMSGSIZE;
4669 }
4670
4671 struct nft_set_dump_args {
4672 const struct netlink_callback *cb;
4673 struct nft_set_iter iter;
4674 struct sk_buff *skb;
4675 };
4676
nf_tables_dump_setelem(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)4677 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
4678 struct nft_set *set,
4679 const struct nft_set_iter *iter,
4680 struct nft_set_elem *elem)
4681 {
4682 struct nft_set_dump_args *args;
4683
4684 args = container_of(iter, struct nft_set_dump_args, iter);
4685 return nf_tables_fill_setelem(args->skb, set, elem);
4686 }
4687
4688 struct nft_set_dump_ctx {
4689 const struct nft_set *set;
4690 struct nft_ctx ctx;
4691 };
4692
nf_tables_dump_set(struct sk_buff * skb,struct netlink_callback * cb)4693 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4694 {
4695 struct nft_set_dump_ctx *dump_ctx = cb->data;
4696 struct net *net = sock_net(skb->sk);
4697 struct nft_table *table;
4698 struct nft_set *set;
4699 struct nft_set_dump_args args;
4700 bool set_found = false;
4701 struct nlmsghdr *nlh;
4702 struct nlattr *nest;
4703 u32 portid, seq;
4704 int event;
4705
4706 rcu_read_lock();
4707 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4708 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
4709 dump_ctx->ctx.family != table->family)
4710 continue;
4711
4712 if (table != dump_ctx->ctx.table)
4713 continue;
4714
4715 list_for_each_entry_rcu(set, &table->sets, list) {
4716 if (set == dump_ctx->set) {
4717 set_found = true;
4718 break;
4719 }
4720 }
4721 break;
4722 }
4723
4724 if (!set_found) {
4725 rcu_read_unlock();
4726 return -ENOENT;
4727 }
4728
4729 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
4730 portid = NETLINK_CB(cb->skb).portid;
4731 seq = cb->nlh->nlmsg_seq;
4732
4733 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI,
4734 table->family, NFNETLINK_V0, nft_base_seq(net));
4735 if (!nlh)
4736 goto nla_put_failure;
4737
4738 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
4739 goto nla_put_failure;
4740 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4741 goto nla_put_failure;
4742
4743 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4744 if (nest == NULL)
4745 goto nla_put_failure;
4746
4747 args.cb = cb;
4748 args.skb = skb;
4749 args.iter.genmask = nft_genmask_cur(net);
4750 args.iter.skip = cb->args[0];
4751 args.iter.count = 0;
4752 args.iter.err = 0;
4753 args.iter.fn = nf_tables_dump_setelem;
4754 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4755 rcu_read_unlock();
4756
4757 nla_nest_end(skb, nest);
4758 nlmsg_end(skb, nlh);
4759
4760 if (args.iter.err && args.iter.err != -EMSGSIZE)
4761 return args.iter.err;
4762 if (args.iter.count == cb->args[0])
4763 return 0;
4764
4765 cb->args[0] = args.iter.count;
4766 return skb->len;
4767
4768 nla_put_failure:
4769 rcu_read_unlock();
4770 return -ENOSPC;
4771 }
4772
nf_tables_dump_set_start(struct netlink_callback * cb)4773 static int nf_tables_dump_set_start(struct netlink_callback *cb)
4774 {
4775 struct nft_set_dump_ctx *dump_ctx = cb->data;
4776
4777 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4778
4779 return cb->data ? 0 : -ENOMEM;
4780 }
4781
nf_tables_dump_set_done(struct netlink_callback * cb)4782 static int nf_tables_dump_set_done(struct netlink_callback *cb)
4783 {
4784 kfree(cb->data);
4785 return 0;
4786 }
4787
nf_tables_fill_setelem_info(struct sk_buff * skb,const struct nft_ctx * ctx,u32 seq,u32 portid,int event,u16 flags,const struct nft_set * set,const struct nft_set_elem * elem)4788 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4789 const struct nft_ctx *ctx, u32 seq,
4790 u32 portid, int event, u16 flags,
4791 const struct nft_set *set,
4792 const struct nft_set_elem *elem)
4793 {
4794 struct nlmsghdr *nlh;
4795 struct nlattr *nest;
4796 int err;
4797
4798 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4799 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
4800 NFNETLINK_V0, nft_base_seq(ctx->net));
4801 if (!nlh)
4802 goto nla_put_failure;
4803
4804 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4805 goto nla_put_failure;
4806 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4807 goto nla_put_failure;
4808
4809 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4810 if (nest == NULL)
4811 goto nla_put_failure;
4812
4813 err = nf_tables_fill_setelem(skb, set, elem);
4814 if (err < 0)
4815 goto nla_put_failure;
4816
4817 nla_nest_end(skb, nest);
4818
4819 nlmsg_end(skb, nlh);
4820 return 0;
4821
4822 nla_put_failure:
4823 nlmsg_trim(skb, nlh);
4824 return -1;
4825 }
4826
nft_setelem_parse_flags(const struct nft_set * set,const struct nlattr * attr,u32 * flags)4827 static int nft_setelem_parse_flags(const struct nft_set *set,
4828 const struct nlattr *attr, u32 *flags)
4829 {
4830 if (attr == NULL)
4831 return 0;
4832
4833 *flags = ntohl(nla_get_be32(attr));
4834 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4835 return -EINVAL;
4836 if (!(set->flags & NFT_SET_INTERVAL) &&
4837 *flags & NFT_SET_ELEM_INTERVAL_END)
4838 return -EINVAL;
4839
4840 return 0;
4841 }
4842
nft_setelem_parse_key(struct nft_ctx * ctx,struct nft_set * set,struct nft_data * key,struct nlattr * attr)4843 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
4844 struct nft_data *key, struct nlattr *attr)
4845 {
4846 struct nft_data_desc desc = {
4847 .type = NFT_DATA_VALUE,
4848 .size = NFT_DATA_VALUE_MAXLEN,
4849 .len = set->klen,
4850 };
4851
4852 return nft_data_init(ctx, key, &desc, attr);
4853 }
4854
nft_setelem_parse_data(struct nft_ctx * ctx,struct nft_set * set,struct nft_data_desc * desc,struct nft_data * data,struct nlattr * attr)4855 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
4856 struct nft_data_desc *desc,
4857 struct nft_data *data,
4858 struct nlattr *attr)
4859 {
4860 u32 dtype;
4861
4862 if (set->dtype == NFT_DATA_VERDICT)
4863 dtype = NFT_DATA_VERDICT;
4864 else
4865 dtype = NFT_DATA_VALUE;
4866
4867 desc->type = dtype;
4868 desc->size = NFT_DATA_VALUE_MAXLEN;
4869 desc->len = set->dlen;
4870 desc->flags = NFT_DATA_DESC_SETELEM;
4871
4872 return nft_data_init(ctx, data, desc, attr);
4873 }
4874
nft_get_set_elem(struct nft_ctx * ctx,struct nft_set * set,const struct nlattr * attr)4875 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4876 const struct nlattr *attr)
4877 {
4878 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4879 struct nft_set_elem elem;
4880 struct sk_buff *skb;
4881 uint32_t flags = 0;
4882 void *priv;
4883 int err;
4884
4885 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4886 nft_set_elem_policy, NULL);
4887 if (err < 0)
4888 return err;
4889
4890 if (!nla[NFTA_SET_ELEM_KEY])
4891 return -EINVAL;
4892
4893 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4894 if (err < 0)
4895 return err;
4896
4897 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
4898 nla[NFTA_SET_ELEM_KEY]);
4899 if (err < 0)
4900 return err;
4901
4902 if (nla[NFTA_SET_ELEM_KEY_END]) {
4903 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
4904 nla[NFTA_SET_ELEM_KEY_END]);
4905 if (err < 0)
4906 return err;
4907 }
4908
4909 priv = set->ops->get(ctx->net, set, &elem, flags);
4910 if (IS_ERR(priv))
4911 return PTR_ERR(priv);
4912
4913 elem.priv = priv;
4914
4915 err = -ENOMEM;
4916 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
4917 if (skb == NULL)
4918 return err;
4919
4920 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4921 NFT_MSG_NEWSETELEM, 0, set, &elem);
4922 if (err < 0)
4923 goto err_fill_setelem;
4924
4925 return nfnetlink_unicast(skb, ctx->net, ctx->portid);
4926
4927 err_fill_setelem:
4928 kfree_skb(skb);
4929 return err;
4930 }
4931
4932 /* called with rcu_read_lock held */
nf_tables_getsetelem(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)4933 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4934 struct sk_buff *skb, const struct nlmsghdr *nlh,
4935 const struct nlattr * const nla[],
4936 struct netlink_ext_ack *extack)
4937 {
4938 u8 genmask = nft_genmask_cur(net);
4939 struct nft_set *set;
4940 struct nlattr *attr;
4941 struct nft_ctx ctx;
4942 int rem, err = 0;
4943
4944 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4945 genmask);
4946 if (err < 0)
4947 return err;
4948
4949 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
4950 if (IS_ERR(set))
4951 return PTR_ERR(set);
4952
4953 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4954 struct netlink_dump_control c = {
4955 .start = nf_tables_dump_set_start,
4956 .dump = nf_tables_dump_set,
4957 .done = nf_tables_dump_set_done,
4958 .module = THIS_MODULE,
4959 };
4960 struct nft_set_dump_ctx dump_ctx = {
4961 .set = set,
4962 .ctx = ctx,
4963 };
4964
4965 c.data = &dump_ctx;
4966 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4967 }
4968
4969 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4970 return -EINVAL;
4971
4972 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4973 err = nft_get_set_elem(&ctx, set, attr);
4974 if (err < 0)
4975 break;
4976 }
4977
4978 return err;
4979 }
4980
nf_tables_setelem_notify(const struct nft_ctx * ctx,const struct nft_set * set,const struct nft_set_elem * elem,int event,u16 flags)4981 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4982 const struct nft_set *set,
4983 const struct nft_set_elem *elem,
4984 int event, u16 flags)
4985 {
4986 struct net *net = ctx->net;
4987 u32 portid = ctx->portid;
4988 struct sk_buff *skb;
4989 int err;
4990
4991 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
4992 return;
4993
4994 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4995 if (skb == NULL)
4996 goto err;
4997
4998 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4999 set, elem);
5000 if (err < 0) {
5001 kfree_skb(skb);
5002 goto err;
5003 }
5004
5005 nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
5006 return;
5007 err:
5008 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
5009 }
5010
nft_trans_elem_alloc(struct nft_ctx * ctx,int msg_type,struct nft_set * set)5011 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
5012 int msg_type,
5013 struct nft_set *set)
5014 {
5015 struct nft_trans *trans;
5016
5017 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
5018 if (trans == NULL)
5019 return NULL;
5020
5021 nft_trans_elem_set(trans) = set;
5022 return trans;
5023 }
5024
nft_set_elem_expr_alloc(const struct nft_ctx * ctx,const struct nft_set * set,const struct nlattr * attr)5025 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
5026 const struct nft_set *set,
5027 const struct nlattr *attr)
5028 {
5029 struct nft_expr *expr;
5030 int err;
5031
5032 expr = nft_expr_init(ctx, attr);
5033 if (IS_ERR(expr))
5034 return expr;
5035
5036 err = -EOPNOTSUPP;
5037 if (expr->ops->type->flags & NFT_EXPR_GC) {
5038 if (set->flags & NFT_SET_TIMEOUT)
5039 goto err_set_elem_expr;
5040 if (!set->ops->gc_init)
5041 goto err_set_elem_expr;
5042 set->ops->gc_init(set);
5043 }
5044
5045 return expr;
5046
5047 err_set_elem_expr:
5048 nft_expr_destroy(ctx, expr);
5049 return ERR_PTR(err);
5050 }
5051
nft_set_elem_init(const struct nft_set * set,const struct nft_set_ext_tmpl * tmpl,const u32 * key,const u32 * key_end,const u32 * data,u64 timeout,u64 expiration,gfp_t gfp)5052 void *nft_set_elem_init(const struct nft_set *set,
5053 const struct nft_set_ext_tmpl *tmpl,
5054 const u32 *key, const u32 *key_end,
5055 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp)
5056 {
5057 struct nft_set_ext *ext;
5058 void *elem;
5059
5060 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
5061 if (elem == NULL)
5062 return NULL;
5063
5064 ext = nft_set_elem_ext(set, elem);
5065 nft_set_ext_init(ext, tmpl);
5066
5067 memcpy(nft_set_ext_key(ext), key, set->klen);
5068 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
5069 memcpy(nft_set_ext_key_end(ext), key_end, set->klen);
5070 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5071 memcpy(nft_set_ext_data(ext), data, set->dlen);
5072 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
5073 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
5074 if (expiration == 0)
5075 *nft_set_ext_expiration(ext) += timeout;
5076 }
5077 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
5078 *nft_set_ext_timeout(ext) = timeout;
5079
5080 return elem;
5081 }
5082
nft_set_elem_expr_destroy(const struct nft_ctx * ctx,struct nft_expr * expr)5083 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
5084 struct nft_expr *expr)
5085 {
5086 if (expr->ops->destroy_clone) {
5087 expr->ops->destroy_clone(ctx, expr);
5088 module_put(expr->ops->type->owner);
5089 } else {
5090 nf_tables_expr_destroy(ctx, expr);
5091 }
5092 }
5093
nft_set_elem_destroy(const struct nft_set * set,void * elem,bool destroy_expr)5094 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
5095 bool destroy_expr)
5096 {
5097 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5098 struct nft_ctx ctx = {
5099 .net = read_pnet(&set->net),
5100 .family = set->table->family,
5101 };
5102
5103 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
5104 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5105 nft_data_release(nft_set_ext_data(ext), set->dtype);
5106 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
5107 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext));
5108
5109 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5110 (*nft_set_ext_obj(ext))->use--;
5111 kfree(elem);
5112 }
5113 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
5114
5115 /* Only called from commit path, nft_set_elem_deactivate() already deals with
5116 * the refcounting from the preparation phase.
5117 */
nf_tables_set_elem_destroy(const struct nft_ctx * ctx,const struct nft_set * set,void * elem)5118 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
5119 const struct nft_set *set, void *elem)
5120 {
5121 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5122
5123 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
5124 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));
5125
5126 kfree(elem);
5127 }
5128
nft_set_elem_expr_setup(struct nft_ctx * ctx,const struct nft_set_ext * ext,struct nft_expr * expr)5129 static int nft_set_elem_expr_setup(struct nft_ctx *ctx,
5130 const struct nft_set_ext *ext,
5131 struct nft_expr *expr)
5132 {
5133 struct nft_expr *elem_expr = nft_set_ext_expr(ext);
5134 int err;
5135
5136 if (expr == NULL)
5137 return 0;
5138
5139 err = nft_expr_clone(elem_expr, expr);
5140 if (err < 0)
5141 return -ENOMEM;
5142
5143 nft_expr_destroy(ctx, expr);
5144 return 0;
5145 }
5146
nft_add_set_elem(struct nft_ctx * ctx,struct nft_set * set,const struct nlattr * attr,u32 nlmsg_flags)5147 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
5148 const struct nlattr *attr, u32 nlmsg_flags)
5149 {
5150 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5151 u8 genmask = nft_genmask_next(ctx->net);
5152 struct nft_set_ext_tmpl tmpl;
5153 struct nft_set_ext *ext, *ext2;
5154 struct nft_set_elem elem;
5155 struct nft_set_binding *binding;
5156 struct nft_object *obj = NULL;
5157 struct nft_expr *expr = NULL;
5158 struct nft_userdata *udata;
5159 struct nft_data_desc desc;
5160 enum nft_registers dreg;
5161 struct nft_trans *trans;
5162 u32 flags = 0;
5163 u64 timeout;
5164 u64 expiration;
5165 u8 ulen;
5166 int err;
5167
5168 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5169 nft_set_elem_policy, NULL);
5170 if (err < 0)
5171 return err;
5172
5173 if (nla[NFTA_SET_ELEM_KEY] == NULL)
5174 return -EINVAL;
5175
5176 nft_set_ext_prepare(&tmpl);
5177
5178 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5179 if (err < 0)
5180 return err;
5181 if (flags != 0)
5182 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5183
5184 if (set->flags & NFT_SET_MAP) {
5185 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
5186 !(flags & NFT_SET_ELEM_INTERVAL_END))
5187 return -EINVAL;
5188 } else {
5189 if (nla[NFTA_SET_ELEM_DATA] != NULL)
5190 return -EINVAL;
5191 }
5192
5193 if (set->flags & NFT_SET_OBJECT) {
5194 if (!nla[NFTA_SET_ELEM_OBJREF] &&
5195 !(flags & NFT_SET_ELEM_INTERVAL_END))
5196 return -EINVAL;
5197 } else {
5198 if (nla[NFTA_SET_ELEM_OBJREF])
5199 return -EINVAL;
5200 }
5201
5202 if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
5203 (nla[NFTA_SET_ELEM_DATA] ||
5204 nla[NFTA_SET_ELEM_OBJREF] ||
5205 nla[NFTA_SET_ELEM_TIMEOUT] ||
5206 nla[NFTA_SET_ELEM_EXPIRATION] ||
5207 nla[NFTA_SET_ELEM_USERDATA] ||
5208 nla[NFTA_SET_ELEM_EXPR]))
5209 return -EINVAL;
5210
5211 timeout = 0;
5212 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
5213 if (!(set->flags & NFT_SET_TIMEOUT))
5214 return -EINVAL;
5215 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
5216 &timeout);
5217 if (err)
5218 return err;
5219 } else if (set->flags & NFT_SET_TIMEOUT) {
5220 timeout = set->timeout;
5221 }
5222
5223 expiration = 0;
5224 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
5225 if (!(set->flags & NFT_SET_TIMEOUT))
5226 return -EINVAL;
5227 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
5228 &expiration);
5229 if (err)
5230 return err;
5231 }
5232
5233 if (nla[NFTA_SET_ELEM_EXPR] != NULL) {
5234 expr = nft_set_elem_expr_alloc(ctx, set,
5235 nla[NFTA_SET_ELEM_EXPR]);
5236 if (IS_ERR(expr))
5237 return PTR_ERR(expr);
5238
5239 err = -EOPNOTSUPP;
5240 if (set->expr && set->expr->ops != expr->ops)
5241 goto err_set_elem_expr;
5242 } else if (set->expr) {
5243 expr = kzalloc(set->expr->ops->size, GFP_KERNEL);
5244 if (!expr)
5245 return -ENOMEM;
5246
5247 err = nft_expr_clone(expr, set->expr);
5248 if (err < 0)
5249 goto err_set_elem_expr;
5250 }
5251
5252 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5253 nla[NFTA_SET_ELEM_KEY]);
5254 if (err < 0)
5255 goto err_set_elem_expr;
5256
5257 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
5258
5259 if (nla[NFTA_SET_ELEM_KEY_END]) {
5260 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5261 nla[NFTA_SET_ELEM_KEY_END]);
5262 if (err < 0)
5263 goto err_parse_key;
5264
5265 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5266 }
5267
5268 if (timeout > 0) {
5269 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
5270 if (timeout != set->timeout)
5271 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
5272 }
5273
5274 if (expr)
5275 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPR,
5276 expr->ops->size);
5277
5278 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
5279 obj = nft_obj_lookup(ctx->net, ctx->table,
5280 nla[NFTA_SET_ELEM_OBJREF],
5281 set->objtype, genmask);
5282 if (IS_ERR(obj)) {
5283 err = PTR_ERR(obj);
5284 goto err_parse_key_end;
5285 }
5286 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
5287 }
5288
5289 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
5290 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
5291 nla[NFTA_SET_ELEM_DATA]);
5292 if (err < 0)
5293 goto err_parse_key_end;
5294
5295 dreg = nft_type_to_reg(set->dtype);
5296 list_for_each_entry(binding, &set->bindings, list) {
5297 struct nft_ctx bind_ctx = {
5298 .net = ctx->net,
5299 .family = ctx->family,
5300 .table = ctx->table,
5301 .chain = (struct nft_chain *)binding->chain,
5302 };
5303
5304 if (!(binding->flags & NFT_SET_MAP))
5305 continue;
5306
5307 err = nft_validate_register_store(&bind_ctx, dreg,
5308 &elem.data.val,
5309 desc.type, desc.len);
5310 if (err < 0)
5311 goto err_parse_data;
5312
5313 if (desc.type == NFT_DATA_VERDICT &&
5314 (elem.data.val.verdict.code == NFT_GOTO ||
5315 elem.data.val.verdict.code == NFT_JUMP))
5316 nft_validate_state_update(ctx->net,
5317 NFT_VALIDATE_NEED);
5318 }
5319
5320 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len);
5321 }
5322
5323 /* The full maximum length of userdata can exceed the maximum
5324 * offset value (U8_MAX) for following extensions, therefor it
5325 * must be the last extension added.
5326 */
5327 ulen = 0;
5328 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
5329 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
5330 if (ulen > 0)
5331 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
5332 ulen);
5333 }
5334
5335 err = -ENOMEM;
5336 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5337 elem.key_end.val.data, elem.data.val.data,
5338 timeout, expiration, GFP_KERNEL);
5339 if (elem.priv == NULL)
5340 goto err_parse_data;
5341
5342 ext = nft_set_elem_ext(set, elem.priv);
5343 if (flags)
5344 *nft_set_ext_flags(ext) = flags;
5345 if (ulen > 0) {
5346 udata = nft_set_ext_userdata(ext);
5347 udata->len = ulen - 1;
5348 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
5349 }
5350 if (obj) {
5351 *nft_set_ext_obj(ext) = obj;
5352 obj->use++;
5353 }
5354
5355 err = nft_set_elem_expr_setup(ctx, ext, expr);
5356 if (err < 0)
5357 goto err_elem_expr;
5358 expr = NULL;
5359
5360 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
5361 if (trans == NULL) {
5362 err = -ENOMEM;
5363 goto err_elem_expr;
5364 }
5365
5366 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
5367 err = set->ops->insert(ctx->net, set, &elem, &ext2);
5368 if (err) {
5369 if (err == -EEXIST) {
5370 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
5371 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
5372 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
5373 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
5374 goto err_element_clash;
5375 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
5376 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
5377 memcmp(nft_set_ext_data(ext),
5378 nft_set_ext_data(ext2), set->dlen) != 0) ||
5379 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
5380 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
5381 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
5382 goto err_element_clash;
5383 else if (!(nlmsg_flags & NLM_F_EXCL))
5384 err = 0;
5385 } else if (err == -ENOTEMPTY) {
5386 /* ENOTEMPTY reports overlapping between this element
5387 * and an existing one.
5388 */
5389 err = -EEXIST;
5390 }
5391 goto err_element_clash;
5392 }
5393
5394 if (set->size &&
5395 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
5396 err = -ENFILE;
5397 goto err_set_full;
5398 }
5399
5400 nft_trans_elem(trans) = elem;
5401 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5402 return 0;
5403
5404 err_set_full:
5405 set->ops->remove(ctx->net, set, &elem);
5406 err_element_clash:
5407 kfree(trans);
5408 err_elem_expr:
5409 if (obj)
5410 obj->use--;
5411
5412 nf_tables_set_elem_destroy(ctx, set, elem.priv);
5413 err_parse_data:
5414 if (nla[NFTA_SET_ELEM_DATA] != NULL)
5415 nft_data_release(&elem.data.val, desc.type);
5416 err_parse_key_end:
5417 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
5418 err_parse_key:
5419 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
5420 err_set_elem_expr:
5421 if (expr != NULL)
5422 nft_expr_destroy(ctx, expr);
5423
5424 return err;
5425 }
5426
nf_tables_newsetelem(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)5427 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
5428 struct sk_buff *skb, const struct nlmsghdr *nlh,
5429 const struct nlattr * const nla[],
5430 struct netlink_ext_ack *extack)
5431 {
5432 u8 genmask = nft_genmask_next(net);
5433 const struct nlattr *attr;
5434 struct nft_set *set;
5435 struct nft_ctx ctx;
5436 int rem, err;
5437
5438 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
5439 return -EINVAL;
5440
5441 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5442 genmask);
5443 if (err < 0)
5444 return err;
5445
5446 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
5447 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
5448 if (IS_ERR(set))
5449 return PTR_ERR(set);
5450
5451 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5452 return -EBUSY;
5453
5454 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5455 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
5456 if (err < 0)
5457 return err;
5458 }
5459
5460 if (net->nft.validate_state == NFT_VALIDATE_DO)
5461 return nft_table_validate(net, ctx.table);
5462
5463 return 0;
5464 }
5465
5466 /**
5467 * nft_data_hold - hold a nft_data item
5468 *
5469 * @data: struct nft_data to release
5470 * @type: type of data
5471 *
5472 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5473 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
5474 * NFT_GOTO verdicts. This function must be called on active data objects
5475 * from the second phase of the commit protocol.
5476 */
nft_data_hold(const struct nft_data * data,enum nft_data_types type)5477 void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
5478 {
5479 struct nft_chain *chain;
5480 struct nft_rule *rule;
5481
5482 if (type == NFT_DATA_VERDICT) {
5483 switch (data->verdict.code) {
5484 case NFT_JUMP:
5485 case NFT_GOTO:
5486 chain = data->verdict.chain;
5487 chain->use++;
5488
5489 if (!nft_chain_is_bound(chain))
5490 break;
5491
5492 chain->table->use++;
5493 list_for_each_entry(rule, &chain->rules, list)
5494 chain->use++;
5495
5496 nft_chain_add(chain->table, chain);
5497 break;
5498 }
5499 }
5500 }
5501
nft_set_elem_activate(const struct net * net,const struct nft_set * set,struct nft_set_elem * elem)5502 static void nft_set_elem_activate(const struct net *net,
5503 const struct nft_set *set,
5504 struct nft_set_elem *elem)
5505 {
5506 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5507
5508 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5509 nft_data_hold(nft_set_ext_data(ext), set->dtype);
5510 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5511 (*nft_set_ext_obj(ext))->use++;
5512 }
5513
nft_set_elem_deactivate(const struct net * net,const struct nft_set * set,struct nft_set_elem * elem)5514 static void nft_set_elem_deactivate(const struct net *net,
5515 const struct nft_set *set,
5516 struct nft_set_elem *elem)
5517 {
5518 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5519
5520 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5521 nft_data_release(nft_set_ext_data(ext), set->dtype);
5522 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5523 (*nft_set_ext_obj(ext))->use--;
5524 }
5525
nft_del_setelem(struct nft_ctx * ctx,struct nft_set * set,const struct nlattr * attr)5526 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
5527 const struct nlattr *attr)
5528 {
5529 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5530 struct nft_set_ext_tmpl tmpl;
5531 struct nft_set_elem elem;
5532 struct nft_set_ext *ext;
5533 struct nft_trans *trans;
5534 u32 flags = 0;
5535 void *priv;
5536 int err;
5537
5538 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5539 nft_set_elem_policy, NULL);
5540 if (err < 0)
5541 return err;
5542
5543 if (nla[NFTA_SET_ELEM_KEY] == NULL)
5544 return -EINVAL;
5545
5546 nft_set_ext_prepare(&tmpl);
5547
5548 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5549 if (err < 0)
5550 return err;
5551 if (flags != 0)
5552 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5553
5554 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5555 nla[NFTA_SET_ELEM_KEY]);
5556 if (err < 0)
5557 return err;
5558
5559 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
5560
5561 if (nla[NFTA_SET_ELEM_KEY_END]) {
5562 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5563 nla[NFTA_SET_ELEM_KEY_END]);
5564 if (err < 0)
5565 return err;
5566
5567 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5568 }
5569
5570 err = -ENOMEM;
5571 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5572 elem.key_end.val.data, NULL, 0, 0,
5573 GFP_KERNEL);
5574 if (elem.priv == NULL)
5575 goto fail_elem;
5576
5577 ext = nft_set_elem_ext(set, elem.priv);
5578 if (flags)
5579 *nft_set_ext_flags(ext) = flags;
5580
5581 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
5582 if (trans == NULL)
5583 goto fail_trans;
5584
5585 priv = set->ops->deactivate(ctx->net, set, &elem);
5586 if (priv == NULL) {
5587 err = -ENOENT;
5588 goto fail_ops;
5589 }
5590 kfree(elem.priv);
5591 elem.priv = priv;
5592
5593 nft_set_elem_deactivate(ctx->net, set, &elem);
5594
5595 nft_trans_elem(trans) = elem;
5596 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5597 return 0;
5598
5599 fail_ops:
5600 kfree(trans);
5601 fail_trans:
5602 kfree(elem.priv);
5603 fail_elem:
5604 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
5605 return err;
5606 }
5607
nft_flush_set(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)5608 static int nft_flush_set(const struct nft_ctx *ctx,
5609 struct nft_set *set,
5610 const struct nft_set_iter *iter,
5611 struct nft_set_elem *elem)
5612 {
5613 struct nft_trans *trans;
5614 int err;
5615
5616 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
5617 sizeof(struct nft_trans_elem), GFP_ATOMIC);
5618 if (!trans)
5619 return -ENOMEM;
5620
5621 if (!set->ops->flush(ctx->net, set, elem->priv)) {
5622 err = -ENOENT;
5623 goto err1;
5624 }
5625 set->ndeact++;
5626
5627 nft_set_elem_deactivate(ctx->net, set, elem);
5628 nft_trans_elem_set(trans) = set;
5629 nft_trans_elem(trans) = *elem;
5630 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5631
5632 return 0;
5633 err1:
5634 kfree(trans);
5635 return err;
5636 }
5637
nf_tables_delsetelem(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)5638 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
5639 struct sk_buff *skb, const struct nlmsghdr *nlh,
5640 const struct nlattr * const nla[],
5641 struct netlink_ext_ack *extack)
5642 {
5643 u8 genmask = nft_genmask_next(net);
5644 const struct nlattr *attr;
5645 struct nft_set *set;
5646 struct nft_ctx ctx;
5647 int rem, err = 0;
5648
5649 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5650 genmask);
5651 if (err < 0)
5652 return err;
5653
5654 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
5655 if (IS_ERR(set))
5656 return PTR_ERR(set);
5657 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5658 return -EBUSY;
5659
5660 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
5661 struct nft_set_iter iter = {
5662 .genmask = genmask,
5663 .fn = nft_flush_set,
5664 };
5665 set->ops->walk(&ctx, set, &iter);
5666
5667 return iter.err;
5668 }
5669
5670 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5671 err = nft_del_setelem(&ctx, set, attr);
5672 if (err < 0)
5673 break;
5674
5675 set->ndeact++;
5676 }
5677 return err;
5678 }
5679
nft_set_gc_batch_release(struct rcu_head * rcu)5680 void nft_set_gc_batch_release(struct rcu_head *rcu)
5681 {
5682 struct nft_set_gc_batch *gcb;
5683 unsigned int i;
5684
5685 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
5686 for (i = 0; i < gcb->head.cnt; i++)
5687 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
5688 kfree(gcb);
5689 }
5690
nft_set_gc_batch_alloc(const struct nft_set * set,gfp_t gfp)5691 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
5692 gfp_t gfp)
5693 {
5694 struct nft_set_gc_batch *gcb;
5695
5696 gcb = kzalloc(sizeof(*gcb), gfp);
5697 if (gcb == NULL)
5698 return gcb;
5699 gcb->head.set = set;
5700 return gcb;
5701 }
5702
5703 /*
5704 * Stateful objects
5705 */
5706
5707 /**
5708 * nft_register_obj- register nf_tables stateful object type
5709 * @obj_type: object type
5710 *
5711 * Registers the object type for use with nf_tables. Returns zero on
5712 * success or a negative errno code otherwise.
5713 */
nft_register_obj(struct nft_object_type * obj_type)5714 int nft_register_obj(struct nft_object_type *obj_type)
5715 {
5716 if (obj_type->type == NFT_OBJECT_UNSPEC)
5717 return -EINVAL;
5718
5719 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5720 list_add_rcu(&obj_type->list, &nf_tables_objects);
5721 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5722 return 0;
5723 }
5724 EXPORT_SYMBOL_GPL(nft_register_obj);
5725
5726 /**
5727 * nft_unregister_obj - unregister nf_tables object type
5728 * @obj_type: object type
5729 *
5730 * Unregisters the object type for use with nf_tables.
5731 */
nft_unregister_obj(struct nft_object_type * obj_type)5732 void nft_unregister_obj(struct nft_object_type *obj_type)
5733 {
5734 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5735 list_del_rcu(&obj_type->list);
5736 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5737 }
5738 EXPORT_SYMBOL_GPL(nft_unregister_obj);
5739
nft_obj_lookup(const struct net * net,const struct nft_table * table,const struct nlattr * nla,u32 objtype,u8 genmask)5740 struct nft_object *nft_obj_lookup(const struct net *net,
5741 const struct nft_table *table,
5742 const struct nlattr *nla, u32 objtype,
5743 u8 genmask)
5744 {
5745 struct nft_object_hash_key k = { .table = table };
5746 char search[NFT_OBJ_MAXNAMELEN];
5747 struct rhlist_head *tmp, *list;
5748 struct nft_object *obj;
5749
5750 nla_strlcpy(search, nla, sizeof(search));
5751 k.name = search;
5752
5753 WARN_ON_ONCE(!rcu_read_lock_held() &&
5754 !lockdep_commit_lock_is_held(net));
5755
5756 rcu_read_lock();
5757 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
5758 if (!list)
5759 goto out;
5760
5761 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
5762 if (objtype == obj->ops->type->type &&
5763 nft_active_genmask(obj, genmask)) {
5764 rcu_read_unlock();
5765 return obj;
5766 }
5767 }
5768 out:
5769 rcu_read_unlock();
5770 return ERR_PTR(-ENOENT);
5771 }
5772 EXPORT_SYMBOL_GPL(nft_obj_lookup);
5773
nft_obj_lookup_byhandle(const struct nft_table * table,const struct nlattr * nla,u32 objtype,u8 genmask)5774 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
5775 const struct nlattr *nla,
5776 u32 objtype, u8 genmask)
5777 {
5778 struct nft_object *obj;
5779
5780 list_for_each_entry(obj, &table->objects, list) {
5781 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
5782 objtype == obj->ops->type->type &&
5783 nft_active_genmask(obj, genmask))
5784 return obj;
5785 }
5786 return ERR_PTR(-ENOENT);
5787 }
5788
5789 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
5790 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
5791 .len = NFT_TABLE_MAXNAMELEN - 1 },
5792 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
5793 .len = NFT_OBJ_MAXNAMELEN - 1 },
5794 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
5795 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
5796 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
5797 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY,
5798 .len = NFT_USERDATA_MAXLEN },
5799 };
5800
nft_obj_init(const struct nft_ctx * ctx,const struct nft_object_type * type,const struct nlattr * attr)5801 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
5802 const struct nft_object_type *type,
5803 const struct nlattr *attr)
5804 {
5805 struct nlattr **tb;
5806 const struct nft_object_ops *ops;
5807 struct nft_object *obj;
5808 int err = -ENOMEM;
5809
5810 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
5811 if (!tb)
5812 goto err1;
5813
5814 if (attr) {
5815 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
5816 type->policy, NULL);
5817 if (err < 0)
5818 goto err2;
5819 } else {
5820 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
5821 }
5822
5823 if (type->select_ops) {
5824 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
5825 if (IS_ERR(ops)) {
5826 err = PTR_ERR(ops);
5827 goto err2;
5828 }
5829 } else {
5830 ops = type->ops;
5831 }
5832
5833 err = -ENOMEM;
5834 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5835 if (!obj)
5836 goto err2;
5837
5838 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
5839 if (err < 0)
5840 goto err3;
5841
5842 obj->ops = ops;
5843
5844 kfree(tb);
5845 return obj;
5846 err3:
5847 kfree(obj);
5848 err2:
5849 kfree(tb);
5850 err1:
5851 return ERR_PTR(err);
5852 }
5853
nft_object_dump(struct sk_buff * skb,unsigned int attr,struct nft_object * obj,bool reset)5854 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
5855 struct nft_object *obj, bool reset)
5856 {
5857 struct nlattr *nest;
5858
5859 nest = nla_nest_start_noflag(skb, attr);
5860 if (!nest)
5861 goto nla_put_failure;
5862 if (obj->ops->dump(skb, obj, reset) < 0)
5863 goto nla_put_failure;
5864 nla_nest_end(skb, nest);
5865 return 0;
5866
5867 nla_put_failure:
5868 return -1;
5869 }
5870
__nft_obj_type_get(u32 objtype)5871 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5872 {
5873 const struct nft_object_type *type;
5874
5875 list_for_each_entry(type, &nf_tables_objects, list) {
5876 if (objtype == type->type)
5877 return type;
5878 }
5879 return NULL;
5880 }
5881
5882 static const struct nft_object_type *
nft_obj_type_get(struct net * net,u32 objtype)5883 nft_obj_type_get(struct net *net, u32 objtype)
5884 {
5885 const struct nft_object_type *type;
5886
5887 type = __nft_obj_type_get(objtype);
5888 if (type != NULL && try_module_get(type->owner))
5889 return type;
5890
5891 lockdep_nfnl_nft_mutex_not_held();
5892 #ifdef CONFIG_MODULES
5893 if (type == NULL) {
5894 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
5895 return ERR_PTR(-EAGAIN);
5896 }
5897 #endif
5898 return ERR_PTR(-ENOENT);
5899 }
5900
nf_tables_updobj(const struct nft_ctx * ctx,const struct nft_object_type * type,const struct nlattr * attr,struct nft_object * obj)5901 static int nf_tables_updobj(const struct nft_ctx *ctx,
5902 const struct nft_object_type *type,
5903 const struct nlattr *attr,
5904 struct nft_object *obj)
5905 {
5906 struct nft_object *newobj;
5907 struct nft_trans *trans;
5908 int err = -ENOMEM;
5909
5910 if (!try_module_get(type->owner))
5911 return -ENOENT;
5912
5913 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
5914 sizeof(struct nft_trans_obj));
5915 if (!trans)
5916 goto err_trans;
5917
5918 newobj = nft_obj_init(ctx, type, attr);
5919 if (IS_ERR(newobj)) {
5920 err = PTR_ERR(newobj);
5921 goto err_free_trans;
5922 }
5923
5924 nft_trans_obj(trans) = obj;
5925 nft_trans_obj_update(trans) = true;
5926 nft_trans_obj_newobj(trans) = newobj;
5927 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5928
5929 return 0;
5930
5931 err_free_trans:
5932 kfree(trans);
5933 err_trans:
5934 module_put(type->owner);
5935 return err;
5936 }
5937
nf_tables_newobj(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)5938 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5939 struct sk_buff *skb, const struct nlmsghdr *nlh,
5940 const struct nlattr * const nla[],
5941 struct netlink_ext_ack *extack)
5942 {
5943 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5944 const struct nft_object_type *type;
5945 u8 genmask = nft_genmask_next(net);
5946 int family = nfmsg->nfgen_family;
5947 struct nft_table *table;
5948 struct nft_object *obj;
5949 struct nft_ctx ctx;
5950 u32 objtype;
5951 int err;
5952
5953 if (!nla[NFTA_OBJ_TYPE] ||
5954 !nla[NFTA_OBJ_NAME] ||
5955 !nla[NFTA_OBJ_DATA])
5956 return -EINVAL;
5957
5958 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
5959 if (IS_ERR(table)) {
5960 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
5961 return PTR_ERR(table);
5962 }
5963
5964 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5965 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
5966 if (IS_ERR(obj)) {
5967 err = PTR_ERR(obj);
5968 if (err != -ENOENT) {
5969 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
5970 return err;
5971 }
5972 } else {
5973 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5974 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
5975 return -EEXIST;
5976 }
5977 if (nlh->nlmsg_flags & NLM_F_REPLACE)
5978 return -EOPNOTSUPP;
5979
5980 type = __nft_obj_type_get(objtype);
5981 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5982
5983 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
5984 }
5985
5986 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5987
5988 type = nft_obj_type_get(net, objtype);
5989 if (IS_ERR(type))
5990 return PTR_ERR(type);
5991
5992 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
5993 if (IS_ERR(obj)) {
5994 err = PTR_ERR(obj);
5995 goto err_init;
5996 }
5997 obj->key.table = table;
5998 obj->handle = nf_tables_alloc_handle(table);
5999
6000 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
6001 if (!obj->key.name) {
6002 err = -ENOMEM;
6003 goto err_strdup;
6004 }
6005
6006 if (nla[NFTA_OBJ_USERDATA]) {
6007 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL);
6008 if (obj->udata == NULL)
6009 goto err_userdata;
6010
6011 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]);
6012 }
6013
6014 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
6015 if (err < 0)
6016 goto err_trans;
6017
6018 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
6019 nft_objname_ht_params);
6020 if (err < 0)
6021 goto err_obj_ht;
6022
6023 list_add_tail_rcu(&obj->list, &table->objects);
6024 table->use++;
6025 return 0;
6026 err_obj_ht:
6027 /* queued in transaction log */
6028 INIT_LIST_HEAD(&obj->list);
6029 return err;
6030 err_trans:
6031 kfree(obj->udata);
6032 err_userdata:
6033 kfree(obj->key.name);
6034 err_strdup:
6035 if (obj->ops->destroy)
6036 obj->ops->destroy(&ctx, obj);
6037 kfree(obj);
6038 err_init:
6039 module_put(type->owner);
6040 return err;
6041 }
6042
nf_tables_fill_obj_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table,struct nft_object * obj,bool reset)6043 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
6044 u32 portid, u32 seq, int event, u32 flags,
6045 int family, const struct nft_table *table,
6046 struct nft_object *obj, bool reset)
6047 {
6048 struct nlmsghdr *nlh;
6049
6050 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6051 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
6052 NFNETLINK_V0, nft_base_seq(net));
6053 if (!nlh)
6054 goto nla_put_failure;
6055
6056 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
6057 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
6058 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
6059 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
6060 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
6061 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
6062 NFTA_OBJ_PAD))
6063 goto nla_put_failure;
6064
6065 if (obj->udata &&
6066 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata))
6067 goto nla_put_failure;
6068
6069 nlmsg_end(skb, nlh);
6070 return 0;
6071
6072 nla_put_failure:
6073 nlmsg_trim(skb, nlh);
6074 return -1;
6075 }
6076
6077 struct nft_obj_filter {
6078 char *table;
6079 u32 type;
6080 };
6081
nf_tables_dump_obj(struct sk_buff * skb,struct netlink_callback * cb)6082 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
6083 {
6084 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6085 const struct nft_table *table;
6086 unsigned int idx = 0, s_idx = cb->args[0];
6087 struct nft_obj_filter *filter = cb->data;
6088 struct net *net = sock_net(skb->sk);
6089 int family = nfmsg->nfgen_family;
6090 struct nft_object *obj;
6091 bool reset = false;
6092
6093 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6094 reset = true;
6095
6096 rcu_read_lock();
6097 cb->seq = net->nft.base_seq;
6098
6099 list_for_each_entry_rcu(table, &net->nft.tables, list) {
6100 if (family != NFPROTO_UNSPEC && family != table->family)
6101 continue;
6102
6103 list_for_each_entry_rcu(obj, &table->objects, list) {
6104 if (!nft_is_active(net, obj))
6105 goto cont;
6106 if (idx < s_idx)
6107 goto cont;
6108 if (idx > s_idx)
6109 memset(&cb->args[1], 0,
6110 sizeof(cb->args) - sizeof(cb->args[0]));
6111 if (filter && filter->table &&
6112 strcmp(filter->table, table->name))
6113 goto cont;
6114 if (filter &&
6115 filter->type != NFT_OBJECT_UNSPEC &&
6116 obj->ops->type->type != filter->type)
6117 goto cont;
6118 if (reset) {
6119 char *buf = kasprintf(GFP_ATOMIC,
6120 "%s:%u",
6121 table->name,
6122 net->nft.base_seq);
6123
6124 audit_log_nfcfg(buf,
6125 family,
6126 obj->handle,
6127 AUDIT_NFT_OP_OBJ_RESET,
6128 GFP_ATOMIC);
6129 kfree(buf);
6130 }
6131
6132 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
6133 cb->nlh->nlmsg_seq,
6134 NFT_MSG_NEWOBJ,
6135 NLM_F_MULTI | NLM_F_APPEND,
6136 table->family, table,
6137 obj, reset) < 0)
6138 goto done;
6139
6140 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
6141 cont:
6142 idx++;
6143 }
6144 }
6145 done:
6146 rcu_read_unlock();
6147
6148 cb->args[0] = idx;
6149 return skb->len;
6150 }
6151
nf_tables_dump_obj_start(struct netlink_callback * cb)6152 static int nf_tables_dump_obj_start(struct netlink_callback *cb)
6153 {
6154 const struct nlattr * const *nla = cb->data;
6155 struct nft_obj_filter *filter = NULL;
6156
6157 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
6158 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6159 if (!filter)
6160 return -ENOMEM;
6161
6162 if (nla[NFTA_OBJ_TABLE]) {
6163 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
6164 if (!filter->table) {
6165 kfree(filter);
6166 return -ENOMEM;
6167 }
6168 }
6169
6170 if (nla[NFTA_OBJ_TYPE])
6171 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6172 }
6173
6174 cb->data = filter;
6175 return 0;
6176 }
6177
nf_tables_dump_obj_done(struct netlink_callback * cb)6178 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
6179 {
6180 struct nft_obj_filter *filter = cb->data;
6181
6182 if (filter) {
6183 kfree(filter->table);
6184 kfree(filter);
6185 }
6186
6187 return 0;
6188 }
6189
6190 /* called with rcu_read_lock held */
nf_tables_getobj(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)6191 static int nf_tables_getobj(struct net *net, struct sock *nlsk,
6192 struct sk_buff *skb, const struct nlmsghdr *nlh,
6193 const struct nlattr * const nla[],
6194 struct netlink_ext_ack *extack)
6195 {
6196 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6197 u8 genmask = nft_genmask_cur(net);
6198 int family = nfmsg->nfgen_family;
6199 const struct nft_table *table;
6200 struct nft_object *obj;
6201 struct sk_buff *skb2;
6202 bool reset = false;
6203 u32 objtype;
6204 int err;
6205
6206 if (nlh->nlmsg_flags & NLM_F_DUMP) {
6207 struct netlink_dump_control c = {
6208 .start = nf_tables_dump_obj_start,
6209 .dump = nf_tables_dump_obj,
6210 .done = nf_tables_dump_obj_done,
6211 .module = THIS_MODULE,
6212 .data = (void *)nla,
6213 };
6214
6215 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
6216 }
6217
6218 if (!nla[NFTA_OBJ_NAME] ||
6219 !nla[NFTA_OBJ_TYPE])
6220 return -EINVAL;
6221
6222 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
6223 if (IS_ERR(table)) {
6224 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6225 return PTR_ERR(table);
6226 }
6227
6228 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6229 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
6230 if (IS_ERR(obj)) {
6231 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6232 return PTR_ERR(obj);
6233 }
6234
6235 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
6236 if (!skb2)
6237 return -ENOMEM;
6238
6239 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6240 reset = true;
6241
6242 if (reset) {
6243 char *buf = kasprintf(GFP_ATOMIC, "%s:%u",
6244 table->name, net->nft.base_seq);
6245
6246 audit_log_nfcfg(buf,
6247 family,
6248 obj->handle,
6249 AUDIT_NFT_OP_OBJ_RESET,
6250 GFP_ATOMIC);
6251 kfree(buf);
6252 }
6253
6254 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
6255 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
6256 family, table, obj, reset);
6257 if (err < 0)
6258 goto err_fill_obj_info;
6259
6260 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
6261
6262 err_fill_obj_info:
6263 kfree_skb(skb2);
6264 return err;
6265 }
6266
nft_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)6267 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
6268 {
6269 if (obj->ops->destroy)
6270 obj->ops->destroy(ctx, obj);
6271
6272 module_put(obj->ops->type->owner);
6273 kfree(obj->key.name);
6274 kfree(obj->udata);
6275 kfree(obj);
6276 }
6277
nf_tables_delobj(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)6278 static int nf_tables_delobj(struct net *net, struct sock *nlsk,
6279 struct sk_buff *skb, const struct nlmsghdr *nlh,
6280 const struct nlattr * const nla[],
6281 struct netlink_ext_ack *extack)
6282 {
6283 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6284 u8 genmask = nft_genmask_next(net);
6285 int family = nfmsg->nfgen_family;
6286 const struct nlattr *attr;
6287 struct nft_table *table;
6288 struct nft_object *obj;
6289 struct nft_ctx ctx;
6290 u32 objtype;
6291
6292 if (!nla[NFTA_OBJ_TYPE] ||
6293 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
6294 return -EINVAL;
6295
6296 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
6297 if (IS_ERR(table)) {
6298 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6299 return PTR_ERR(table);
6300 }
6301
6302 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6303 if (nla[NFTA_OBJ_HANDLE]) {
6304 attr = nla[NFTA_OBJ_HANDLE];
6305 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
6306 } else {
6307 attr = nla[NFTA_OBJ_NAME];
6308 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
6309 }
6310
6311 if (IS_ERR(obj)) {
6312 NL_SET_BAD_ATTR(extack, attr);
6313 return PTR_ERR(obj);
6314 }
6315 if (obj->use > 0) {
6316 NL_SET_BAD_ATTR(extack, attr);
6317 return -EBUSY;
6318 }
6319
6320 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6321
6322 return nft_delobj(&ctx, obj);
6323 }
6324
nft_obj_notify(struct net * net,const struct nft_table * table,struct nft_object * obj,u32 portid,u32 seq,int event,int family,int report,gfp_t gfp)6325 void nft_obj_notify(struct net *net, const struct nft_table *table,
6326 struct nft_object *obj, u32 portid, u32 seq, int event,
6327 int family, int report, gfp_t gfp)
6328 {
6329 struct sk_buff *skb;
6330 int err;
6331 char *buf = kasprintf(gfp, "%s:%u",
6332 table->name, net->nft.base_seq);
6333
6334 audit_log_nfcfg(buf,
6335 family,
6336 obj->handle,
6337 event == NFT_MSG_NEWOBJ ?
6338 AUDIT_NFT_OP_OBJ_REGISTER :
6339 AUDIT_NFT_OP_OBJ_UNREGISTER,
6340 gfp);
6341 kfree(buf);
6342
6343 if (!report &&
6344 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
6345 return;
6346
6347 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
6348 if (skb == NULL)
6349 goto err;
6350
6351 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
6352 table, obj, false);
6353 if (err < 0) {
6354 kfree_skb(skb);
6355 goto err;
6356 }
6357
6358 nft_notify_enqueue(skb, report, &net->nft.notify_list);
6359 return;
6360 err:
6361 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
6362 }
6363 EXPORT_SYMBOL_GPL(nft_obj_notify);
6364
nf_tables_obj_notify(const struct nft_ctx * ctx,struct nft_object * obj,int event)6365 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
6366 struct nft_object *obj, int event)
6367 {
6368 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
6369 ctx->family, ctx->report, GFP_KERNEL);
6370 }
6371
6372 /*
6373 * Flow tables
6374 */
nft_register_flowtable_type(struct nf_flowtable_type * type)6375 void nft_register_flowtable_type(struct nf_flowtable_type *type)
6376 {
6377 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6378 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
6379 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6380 }
6381 EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
6382
nft_unregister_flowtable_type(struct nf_flowtable_type * type)6383 void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
6384 {
6385 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6386 list_del_rcu(&type->list);
6387 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6388 }
6389 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
6390
6391 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
6392 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
6393 .len = NFT_NAME_MAXLEN - 1 },
6394 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
6395 .len = NFT_NAME_MAXLEN - 1 },
6396 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
6397 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
6398 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 },
6399 };
6400
nft_flowtable_lookup(const struct nft_table * table,const struct nlattr * nla,u8 genmask)6401 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
6402 const struct nlattr *nla, u8 genmask)
6403 {
6404 struct nft_flowtable *flowtable;
6405
6406 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6407 if (!nla_strcmp(nla, flowtable->name) &&
6408 nft_active_genmask(flowtable, genmask))
6409 return flowtable;
6410 }
6411 return ERR_PTR(-ENOENT);
6412 }
6413 EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
6414
nf_tables_deactivate_flowtable(const struct nft_ctx * ctx,struct nft_flowtable * flowtable,enum nft_trans_phase phase)6415 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
6416 struct nft_flowtable *flowtable,
6417 enum nft_trans_phase phase)
6418 {
6419 switch (phase) {
6420 case NFT_TRANS_PREPARE:
6421 case NFT_TRANS_ABORT:
6422 case NFT_TRANS_RELEASE:
6423 flowtable->use--;
6424 fallthrough;
6425 default:
6426 return;
6427 }
6428 }
6429 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
6430
6431 static struct nft_flowtable *
nft_flowtable_lookup_byhandle(const struct nft_table * table,const struct nlattr * nla,u8 genmask)6432 nft_flowtable_lookup_byhandle(const struct nft_table *table,
6433 const struct nlattr *nla, u8 genmask)
6434 {
6435 struct nft_flowtable *flowtable;
6436
6437 list_for_each_entry(flowtable, &table->flowtables, list) {
6438 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
6439 nft_active_genmask(flowtable, genmask))
6440 return flowtable;
6441 }
6442 return ERR_PTR(-ENOENT);
6443 }
6444
6445 struct nft_flowtable_hook {
6446 u32 num;
6447 int priority;
6448 struct list_head list;
6449 };
6450
6451 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
6452 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
6453 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
6454 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
6455 };
6456
nft_flowtable_parse_hook(const struct nft_ctx * ctx,const struct nlattr * attr,struct nft_flowtable_hook * flowtable_hook,struct nft_flowtable * flowtable,bool add)6457 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
6458 const struct nlattr *attr,
6459 struct nft_flowtable_hook *flowtable_hook,
6460 struct nft_flowtable *flowtable, bool add)
6461 {
6462 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
6463 struct nft_hook *hook;
6464 int hooknum, priority;
6465 int err;
6466
6467 INIT_LIST_HEAD(&flowtable_hook->list);
6468
6469 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
6470 nft_flowtable_hook_policy, NULL);
6471 if (err < 0)
6472 return err;
6473
6474 if (add) {
6475 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
6476 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY])
6477 return -EINVAL;
6478
6479 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6480 if (hooknum != NF_NETDEV_INGRESS)
6481 return -EOPNOTSUPP;
6482
6483 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6484
6485 flowtable_hook->priority = priority;
6486 flowtable_hook->num = hooknum;
6487 } else {
6488 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) {
6489 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6490 if (hooknum != flowtable->hooknum)
6491 return -EOPNOTSUPP;
6492 }
6493
6494 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
6495 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6496 if (priority != flowtable->data.priority)
6497 return -EOPNOTSUPP;
6498 }
6499
6500 flowtable_hook->priority = flowtable->data.priority;
6501 flowtable_hook->num = flowtable->hooknum;
6502 }
6503
6504 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
6505 err = nf_tables_parse_netdev_hooks(ctx->net,
6506 tb[NFTA_FLOWTABLE_HOOK_DEVS],
6507 &flowtable_hook->list);
6508 if (err < 0)
6509 return err;
6510 }
6511
6512 list_for_each_entry(hook, &flowtable_hook->list, list) {
6513 hook->ops.pf = NFPROTO_NETDEV;
6514 hook->ops.hooknum = flowtable_hook->num;
6515 hook->ops.priority = flowtable_hook->priority;
6516 hook->ops.priv = &flowtable->data;
6517 hook->ops.hook = flowtable->data.type->hook;
6518 }
6519
6520 return err;
6521 }
6522
__nft_flowtable_type_get(u8 family)6523 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
6524 {
6525 const struct nf_flowtable_type *type;
6526
6527 list_for_each_entry(type, &nf_tables_flowtables, list) {
6528 if (family == type->family)
6529 return type;
6530 }
6531 return NULL;
6532 }
6533
6534 static const struct nf_flowtable_type *
nft_flowtable_type_get(struct net * net,u8 family)6535 nft_flowtable_type_get(struct net *net, u8 family)
6536 {
6537 const struct nf_flowtable_type *type;
6538
6539 type = __nft_flowtable_type_get(family);
6540 if (type != NULL && try_module_get(type->owner))
6541 return type;
6542
6543 lockdep_nfnl_nft_mutex_not_held();
6544 #ifdef CONFIG_MODULES
6545 if (type == NULL) {
6546 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
6547 return ERR_PTR(-EAGAIN);
6548 }
6549 #endif
6550 return ERR_PTR(-ENOENT);
6551 }
6552
6553 /* Only called from error and netdev event paths. */
nft_unregister_flowtable_hook(struct net * net,struct nft_flowtable * flowtable,struct nft_hook * hook)6554 static void nft_unregister_flowtable_hook(struct net *net,
6555 struct nft_flowtable *flowtable,
6556 struct nft_hook *hook)
6557 {
6558 nf_unregister_net_hook(net, &hook->ops);
6559 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
6560 FLOW_BLOCK_UNBIND);
6561 }
6562
nft_unregister_flowtable_net_hooks(struct net * net,struct list_head * hook_list)6563 static void nft_unregister_flowtable_net_hooks(struct net *net,
6564 struct list_head *hook_list)
6565 {
6566 struct nft_hook *hook;
6567
6568 list_for_each_entry(hook, hook_list, list)
6569 nf_unregister_net_hook(net, &hook->ops);
6570 }
6571
nft_register_flowtable_net_hooks(struct net * net,struct nft_table * table,struct list_head * hook_list,struct nft_flowtable * flowtable)6572 static int nft_register_flowtable_net_hooks(struct net *net,
6573 struct nft_table *table,
6574 struct list_head *hook_list,
6575 struct nft_flowtable *flowtable)
6576 {
6577 struct nft_hook *hook, *hook2, *next;
6578 struct nft_flowtable *ft;
6579 int err, i = 0;
6580
6581 list_for_each_entry(hook, hook_list, list) {
6582 list_for_each_entry(ft, &table->flowtables, list) {
6583 if (!nft_is_active_next(net, ft))
6584 continue;
6585
6586 list_for_each_entry(hook2, &ft->hook_list, list) {
6587 if (hook->ops.dev == hook2->ops.dev &&
6588 hook->ops.pf == hook2->ops.pf) {
6589 err = -EEXIST;
6590 goto err_unregister_net_hooks;
6591 }
6592 }
6593 }
6594
6595 err = flowtable->data.type->setup(&flowtable->data,
6596 hook->ops.dev,
6597 FLOW_BLOCK_BIND);
6598 if (err < 0)
6599 goto err_unregister_net_hooks;
6600
6601 err = nf_register_net_hook(net, &hook->ops);
6602 if (err < 0) {
6603 flowtable->data.type->setup(&flowtable->data,
6604 hook->ops.dev,
6605 FLOW_BLOCK_UNBIND);
6606 goto err_unregister_net_hooks;
6607 }
6608
6609 i++;
6610 }
6611
6612 return 0;
6613
6614 err_unregister_net_hooks:
6615 list_for_each_entry_safe(hook, next, hook_list, list) {
6616 if (i-- <= 0)
6617 break;
6618
6619 nft_unregister_flowtable_hook(net, flowtable, hook);
6620 list_del_rcu(&hook->list);
6621 kfree_rcu(hook, rcu);
6622 }
6623
6624 return err;
6625 }
6626
nft_flowtable_hooks_destroy(struct list_head * hook_list)6627 static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
6628 {
6629 struct nft_hook *hook, *next;
6630
6631 list_for_each_entry_safe(hook, next, hook_list, list) {
6632 list_del_rcu(&hook->list);
6633 kfree_rcu(hook, rcu);
6634 }
6635 }
6636
nft_flowtable_update(struct nft_ctx * ctx,const struct nlmsghdr * nlh,struct nft_flowtable * flowtable)6637 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
6638 struct nft_flowtable *flowtable)
6639 {
6640 const struct nlattr * const *nla = ctx->nla;
6641 struct nft_flowtable_hook flowtable_hook;
6642 struct nft_hook *hook, *next;
6643 struct nft_trans *trans;
6644 bool unregister = false;
6645 u32 flags;
6646 int err;
6647
6648 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
6649 &flowtable_hook, flowtable, false);
6650 if (err < 0)
6651 return err;
6652
6653 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
6654 if (nft_hook_list_find(&flowtable->hook_list, hook)) {
6655 list_del(&hook->list);
6656 kfree(hook);
6657 }
6658 }
6659
6660 if (nla[NFTA_FLOWTABLE_FLAGS]) {
6661 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
6662 if (flags & ~NFT_FLOWTABLE_MASK) {
6663 err = -EOPNOTSUPP;
6664 goto err_flowtable_update_hook;
6665 }
6666 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^
6667 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) {
6668 err = -EOPNOTSUPP;
6669 goto err_flowtable_update_hook;
6670 }
6671 } else {
6672 flags = flowtable->data.flags;
6673 }
6674
6675 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table,
6676 &flowtable_hook.list, flowtable);
6677 if (err < 0)
6678 goto err_flowtable_update_hook;
6679
6680 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE,
6681 sizeof(struct nft_trans_flowtable));
6682 if (!trans) {
6683 unregister = true;
6684 err = -ENOMEM;
6685 goto err_flowtable_update_hook;
6686 }
6687
6688 nft_trans_flowtable_flags(trans) = flags;
6689 nft_trans_flowtable(trans) = flowtable;
6690 nft_trans_flowtable_update(trans) = true;
6691 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
6692 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans));
6693
6694 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
6695
6696 return 0;
6697
6698 err_flowtable_update_hook:
6699 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
6700 if (unregister)
6701 nft_unregister_flowtable_hook(ctx->net, flowtable, hook);
6702 list_del_rcu(&hook->list);
6703 kfree_rcu(hook, rcu);
6704 }
6705
6706 return err;
6707
6708 }
6709
nf_tables_newflowtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)6710 static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
6711 struct sk_buff *skb,
6712 const struct nlmsghdr *nlh,
6713 const struct nlattr * const nla[],
6714 struct netlink_ext_ack *extack)
6715 {
6716 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6717 struct nft_flowtable_hook flowtable_hook;
6718 const struct nf_flowtable_type *type;
6719 u8 genmask = nft_genmask_next(net);
6720 int family = nfmsg->nfgen_family;
6721 struct nft_flowtable *flowtable;
6722 struct nft_hook *hook, *next;
6723 struct nft_table *table;
6724 struct nft_ctx ctx;
6725 int err;
6726
6727 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6728 !nla[NFTA_FLOWTABLE_NAME] ||
6729 !nla[NFTA_FLOWTABLE_HOOK])
6730 return -EINVAL;
6731
6732 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6733 genmask);
6734 if (IS_ERR(table)) {
6735 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
6736 return PTR_ERR(table);
6737 }
6738
6739 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6740 genmask);
6741 if (IS_ERR(flowtable)) {
6742 err = PTR_ERR(flowtable);
6743 if (err != -ENOENT) {
6744 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
6745 return err;
6746 }
6747 } else {
6748 if (nlh->nlmsg_flags & NLM_F_EXCL) {
6749 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
6750 return -EEXIST;
6751 }
6752
6753 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6754
6755 return nft_flowtable_update(&ctx, nlh, flowtable);
6756 }
6757
6758 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6759
6760 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
6761 if (!flowtable)
6762 return -ENOMEM;
6763
6764 flowtable->table = table;
6765 flowtable->handle = nf_tables_alloc_handle(table);
6766 INIT_LIST_HEAD(&flowtable->hook_list);
6767
6768 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
6769 if (!flowtable->name) {
6770 err = -ENOMEM;
6771 goto err1;
6772 }
6773
6774 type = nft_flowtable_type_get(net, family);
6775 if (IS_ERR(type)) {
6776 err = PTR_ERR(type);
6777 goto err2;
6778 }
6779
6780 if (nla[NFTA_FLOWTABLE_FLAGS]) {
6781 flowtable->data.flags =
6782 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
6783 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) {
6784 err = -EOPNOTSUPP;
6785 goto err3;
6786 }
6787 }
6788
6789 write_pnet(&flowtable->data.net, net);
6790 flowtable->data.type = type;
6791 err = type->init(&flowtable->data);
6792 if (err < 0)
6793 goto err3;
6794
6795 err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
6796 &flowtable_hook, flowtable, true);
6797 if (err < 0)
6798 goto err4;
6799
6800 list_splice(&flowtable_hook.list, &flowtable->hook_list);
6801 flowtable->data.priority = flowtable_hook.priority;
6802 flowtable->hooknum = flowtable_hook.num;
6803
6804 err = nft_register_flowtable_net_hooks(ctx.net, table,
6805 &flowtable->hook_list,
6806 flowtable);
6807 if (err < 0) {
6808 nft_flowtable_hooks_destroy(&flowtable->hook_list);
6809 goto err4;
6810 }
6811
6812 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
6813 if (err < 0)
6814 goto err5;
6815
6816 list_add_tail_rcu(&flowtable->list, &table->flowtables);
6817 table->use++;
6818
6819 return 0;
6820 err5:
6821 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
6822 nft_unregister_flowtable_hook(net, flowtable, hook);
6823 list_del_rcu(&hook->list);
6824 kfree_rcu(hook, rcu);
6825 }
6826 err4:
6827 flowtable->data.type->free(&flowtable->data);
6828 err3:
6829 module_put(type->owner);
6830 err2:
6831 kfree(flowtable->name);
6832 err1:
6833 kfree(flowtable);
6834 return err;
6835 }
6836
nft_flowtable_hook_release(struct nft_flowtable_hook * flowtable_hook)6837 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook)
6838 {
6839 struct nft_hook *this, *next;
6840
6841 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) {
6842 list_del(&this->list);
6843 kfree(this);
6844 }
6845 }
6846
nft_delflowtable_hook(struct nft_ctx * ctx,struct nft_flowtable * flowtable)6847 static int nft_delflowtable_hook(struct nft_ctx *ctx,
6848 struct nft_flowtable *flowtable)
6849 {
6850 const struct nlattr * const *nla = ctx->nla;
6851 struct nft_flowtable_hook flowtable_hook;
6852 LIST_HEAD(flowtable_del_list);
6853 struct nft_hook *this, *hook;
6854 struct nft_trans *trans;
6855 int err;
6856
6857 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
6858 &flowtable_hook, flowtable, false);
6859 if (err < 0)
6860 return err;
6861
6862 list_for_each_entry(this, &flowtable_hook.list, list) {
6863 hook = nft_hook_list_find(&flowtable->hook_list, this);
6864 if (!hook) {
6865 err = -ENOENT;
6866 goto err_flowtable_del_hook;
6867 }
6868 list_move(&hook->list, &flowtable_del_list);
6869 }
6870
6871 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
6872 sizeof(struct nft_trans_flowtable));
6873 if (!trans) {
6874 err = -ENOMEM;
6875 goto err_flowtable_del_hook;
6876 }
6877
6878 nft_trans_flowtable(trans) = flowtable;
6879 nft_trans_flowtable_update(trans) = true;
6880 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
6881 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans));
6882 nft_flowtable_hook_release(&flowtable_hook);
6883
6884 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
6885
6886 return 0;
6887
6888 err_flowtable_del_hook:
6889 list_splice(&flowtable_del_list, &flowtable->hook_list);
6890 nft_flowtable_hook_release(&flowtable_hook);
6891
6892 return err;
6893 }
6894
nf_tables_delflowtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)6895 static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
6896 struct sk_buff *skb,
6897 const struct nlmsghdr *nlh,
6898 const struct nlattr * const nla[],
6899 struct netlink_ext_ack *extack)
6900 {
6901 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6902 u8 genmask = nft_genmask_next(net);
6903 int family = nfmsg->nfgen_family;
6904 struct nft_flowtable *flowtable;
6905 const struct nlattr *attr;
6906 struct nft_table *table;
6907 struct nft_ctx ctx;
6908
6909 if (!nla[NFTA_FLOWTABLE_TABLE] ||
6910 (!nla[NFTA_FLOWTABLE_NAME] &&
6911 !nla[NFTA_FLOWTABLE_HANDLE]))
6912 return -EINVAL;
6913
6914 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6915 genmask);
6916 if (IS_ERR(table)) {
6917 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
6918 return PTR_ERR(table);
6919 }
6920
6921 if (nla[NFTA_FLOWTABLE_HANDLE]) {
6922 attr = nla[NFTA_FLOWTABLE_HANDLE];
6923 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
6924 } else {
6925 attr = nla[NFTA_FLOWTABLE_NAME];
6926 flowtable = nft_flowtable_lookup(table, attr, genmask);
6927 }
6928
6929 if (IS_ERR(flowtable)) {
6930 NL_SET_BAD_ATTR(extack, attr);
6931 return PTR_ERR(flowtable);
6932 }
6933
6934 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6935
6936 if (nla[NFTA_FLOWTABLE_HOOK])
6937 return nft_delflowtable_hook(&ctx, flowtable);
6938
6939 if (flowtable->use > 0) {
6940 NL_SET_BAD_ATTR(extack, attr);
6941 return -EBUSY;
6942 }
6943
6944 return nft_delflowtable(&ctx, flowtable);
6945 }
6946
nf_tables_fill_flowtable_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,struct nft_flowtable * flowtable,struct list_head * hook_list)6947 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
6948 u32 portid, u32 seq, int event,
6949 u32 flags, int family,
6950 struct nft_flowtable *flowtable,
6951 struct list_head *hook_list)
6952 {
6953 struct nlattr *nest, *nest_devs;
6954 struct nft_hook *hook;
6955 struct nlmsghdr *nlh;
6956
6957 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6958 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
6959 NFNETLINK_V0, nft_base_seq(net));
6960 if (!nlh)
6961 goto nla_put_failure;
6962
6963 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
6964 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
6965 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
6966 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
6967 NFTA_FLOWTABLE_PAD) ||
6968 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags)))
6969 goto nla_put_failure;
6970
6971 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
6972 if (!nest)
6973 goto nla_put_failure;
6974 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
6975 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority)))
6976 goto nla_put_failure;
6977
6978 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
6979 if (!nest_devs)
6980 goto nla_put_failure;
6981
6982 list_for_each_entry_rcu(hook, hook_list, list) {
6983 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))
6984 goto nla_put_failure;
6985 }
6986 nla_nest_end(skb, nest_devs);
6987 nla_nest_end(skb, nest);
6988
6989 nlmsg_end(skb, nlh);
6990 return 0;
6991
6992 nla_put_failure:
6993 nlmsg_trim(skb, nlh);
6994 return -1;
6995 }
6996
6997 struct nft_flowtable_filter {
6998 char *table;
6999 };
7000
nf_tables_dump_flowtable(struct sk_buff * skb,struct netlink_callback * cb)7001 static int nf_tables_dump_flowtable(struct sk_buff *skb,
7002 struct netlink_callback *cb)
7003 {
7004 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
7005 struct nft_flowtable_filter *filter = cb->data;
7006 unsigned int idx = 0, s_idx = cb->args[0];
7007 struct net *net = sock_net(skb->sk);
7008 int family = nfmsg->nfgen_family;
7009 struct nft_flowtable *flowtable;
7010 const struct nft_table *table;
7011
7012 rcu_read_lock();
7013 cb->seq = net->nft.base_seq;
7014
7015 list_for_each_entry_rcu(table, &net->nft.tables, list) {
7016 if (family != NFPROTO_UNSPEC && family != table->family)
7017 continue;
7018
7019 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
7020 if (!nft_is_active(net, flowtable))
7021 goto cont;
7022 if (idx < s_idx)
7023 goto cont;
7024 if (idx > s_idx)
7025 memset(&cb->args[1], 0,
7026 sizeof(cb->args) - sizeof(cb->args[0]));
7027 if (filter && filter->table &&
7028 strcmp(filter->table, table->name))
7029 goto cont;
7030
7031 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
7032 cb->nlh->nlmsg_seq,
7033 NFT_MSG_NEWFLOWTABLE,
7034 NLM_F_MULTI | NLM_F_APPEND,
7035 table->family,
7036 flowtable,
7037 &flowtable->hook_list) < 0)
7038 goto done;
7039
7040 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
7041 cont:
7042 idx++;
7043 }
7044 }
7045 done:
7046 rcu_read_unlock();
7047
7048 cb->args[0] = idx;
7049 return skb->len;
7050 }
7051
nf_tables_dump_flowtable_start(struct netlink_callback * cb)7052 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
7053 {
7054 const struct nlattr * const *nla = cb->data;
7055 struct nft_flowtable_filter *filter = NULL;
7056
7057 if (nla[NFTA_FLOWTABLE_TABLE]) {
7058 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
7059 if (!filter)
7060 return -ENOMEM;
7061
7062 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
7063 GFP_ATOMIC);
7064 if (!filter->table) {
7065 kfree(filter);
7066 return -ENOMEM;
7067 }
7068 }
7069
7070 cb->data = filter;
7071 return 0;
7072 }
7073
nf_tables_dump_flowtable_done(struct netlink_callback * cb)7074 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
7075 {
7076 struct nft_flowtable_filter *filter = cb->data;
7077
7078 if (!filter)
7079 return 0;
7080
7081 kfree(filter->table);
7082 kfree(filter);
7083
7084 return 0;
7085 }
7086
7087 /* called with rcu_read_lock held */
nf_tables_getflowtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)7088 static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
7089 struct sk_buff *skb,
7090 const struct nlmsghdr *nlh,
7091 const struct nlattr * const nla[],
7092 struct netlink_ext_ack *extack)
7093 {
7094 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7095 u8 genmask = nft_genmask_cur(net);
7096 int family = nfmsg->nfgen_family;
7097 struct nft_flowtable *flowtable;
7098 const struct nft_table *table;
7099 struct sk_buff *skb2;
7100 int err;
7101
7102 if (nlh->nlmsg_flags & NLM_F_DUMP) {
7103 struct netlink_dump_control c = {
7104 .start = nf_tables_dump_flowtable_start,
7105 .dump = nf_tables_dump_flowtable,
7106 .done = nf_tables_dump_flowtable_done,
7107 .module = THIS_MODULE,
7108 .data = (void *)nla,
7109 };
7110
7111 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
7112 }
7113
7114 if (!nla[NFTA_FLOWTABLE_NAME])
7115 return -EINVAL;
7116
7117 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7118 genmask);
7119 if (IS_ERR(table))
7120 return PTR_ERR(table);
7121
7122 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
7123 genmask);
7124 if (IS_ERR(flowtable))
7125 return PTR_ERR(flowtable);
7126
7127 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7128 if (!skb2)
7129 return -ENOMEM;
7130
7131 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
7132 nlh->nlmsg_seq,
7133 NFT_MSG_NEWFLOWTABLE, 0, family,
7134 flowtable, &flowtable->hook_list);
7135 if (err < 0)
7136 goto err_fill_flowtable_info;
7137
7138 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7139
7140 err_fill_flowtable_info:
7141 kfree_skb(skb2);
7142 return err;
7143 }
7144
nf_tables_flowtable_notify(struct nft_ctx * ctx,struct nft_flowtable * flowtable,struct list_head * hook_list,int event)7145 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
7146 struct nft_flowtable *flowtable,
7147 struct list_head *hook_list,
7148 int event)
7149 {
7150 struct sk_buff *skb;
7151 int err;
7152
7153 if (!ctx->report &&
7154 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
7155 return;
7156
7157 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7158 if (skb == NULL)
7159 goto err;
7160
7161 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
7162 ctx->seq, event, 0,
7163 ctx->family, flowtable, hook_list);
7164 if (err < 0) {
7165 kfree_skb(skb);
7166 goto err;
7167 }
7168
7169 nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
7170 return;
7171 err:
7172 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
7173 }
7174
nf_tables_flowtable_destroy(struct nft_flowtable * flowtable)7175 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
7176 {
7177 struct nft_hook *hook, *next;
7178
7179 flowtable->data.type->free(&flowtable->data);
7180 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7181 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
7182 FLOW_BLOCK_UNBIND);
7183 list_del_rcu(&hook->list);
7184 kfree(hook);
7185 }
7186 kfree(flowtable->name);
7187 module_put(flowtable->data.type->owner);
7188 kfree(flowtable);
7189 }
7190
nf_tables_fill_gen_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq)7191 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
7192 u32 portid, u32 seq)
7193 {
7194 struct nlmsghdr *nlh;
7195 char buf[TASK_COMM_LEN];
7196 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
7197
7198 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC,
7199 NFNETLINK_V0, nft_base_seq(net));
7200 if (!nlh)
7201 goto nla_put_failure;
7202
7203 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
7204 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
7205 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
7206 goto nla_put_failure;
7207
7208 nlmsg_end(skb, nlh);
7209 return 0;
7210
7211 nla_put_failure:
7212 nlmsg_trim(skb, nlh);
7213 return -EMSGSIZE;
7214 }
7215
nft_flowtable_event(unsigned long event,struct net_device * dev,struct nft_flowtable * flowtable)7216 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
7217 struct nft_flowtable *flowtable)
7218 {
7219 struct nft_hook *hook;
7220
7221 list_for_each_entry(hook, &flowtable->hook_list, list) {
7222 if (hook->ops.dev != dev)
7223 continue;
7224
7225 /* flow_offload_netdev_event() cleans up entries for us. */
7226 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook);
7227 list_del_rcu(&hook->list);
7228 kfree_rcu(hook, rcu);
7229 break;
7230 }
7231 }
7232
nf_tables_flowtable_event(struct notifier_block * this,unsigned long event,void * ptr)7233 static int nf_tables_flowtable_event(struct notifier_block *this,
7234 unsigned long event, void *ptr)
7235 {
7236 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
7237 struct nft_flowtable *flowtable;
7238 struct nft_table *table;
7239 struct net *net;
7240
7241 if (event != NETDEV_UNREGISTER)
7242 return 0;
7243
7244 net = dev_net(dev);
7245 mutex_lock(&net->nft.commit_mutex);
7246 list_for_each_entry(table, &net->nft.tables, list) {
7247 list_for_each_entry(flowtable, &table->flowtables, list) {
7248 nft_flowtable_event(event, dev, flowtable);
7249 }
7250 }
7251 mutex_unlock(&net->nft.commit_mutex);
7252
7253 return NOTIFY_DONE;
7254 }
7255
7256 static struct notifier_block nf_tables_flowtable_notifier = {
7257 .notifier_call = nf_tables_flowtable_event,
7258 };
7259
nf_tables_gen_notify(struct net * net,struct sk_buff * skb,int event)7260 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
7261 int event)
7262 {
7263 struct nlmsghdr *nlh = nlmsg_hdr(skb);
7264 struct sk_buff *skb2;
7265 int err;
7266
7267 if (!nlmsg_report(nlh) &&
7268 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
7269 return;
7270
7271 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7272 if (skb2 == NULL)
7273 goto err;
7274
7275 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7276 nlh->nlmsg_seq);
7277 if (err < 0) {
7278 kfree_skb(skb2);
7279 goto err;
7280 }
7281
7282 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7283 nlmsg_report(nlh), GFP_KERNEL);
7284 return;
7285 err:
7286 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7287 -ENOBUFS);
7288 }
7289
nf_tables_getgen(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)7290 static int nf_tables_getgen(struct net *net, struct sock *nlsk,
7291 struct sk_buff *skb, const struct nlmsghdr *nlh,
7292 const struct nlattr * const nla[],
7293 struct netlink_ext_ack *extack)
7294 {
7295 struct sk_buff *skb2;
7296 int err;
7297
7298 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7299 if (skb2 == NULL)
7300 return -ENOMEM;
7301
7302 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7303 nlh->nlmsg_seq);
7304 if (err < 0)
7305 goto err_fill_gen_info;
7306
7307 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7308
7309 err_fill_gen_info:
7310 kfree_skb(skb2);
7311 return err;
7312 }
7313
7314 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
7315 [NFT_MSG_NEWTABLE] = {
7316 .call_batch = nf_tables_newtable,
7317 .attr_count = NFTA_TABLE_MAX,
7318 .policy = nft_table_policy,
7319 },
7320 [NFT_MSG_GETTABLE] = {
7321 .call_rcu = nf_tables_gettable,
7322 .attr_count = NFTA_TABLE_MAX,
7323 .policy = nft_table_policy,
7324 },
7325 [NFT_MSG_DELTABLE] = {
7326 .call_batch = nf_tables_deltable,
7327 .attr_count = NFTA_TABLE_MAX,
7328 .policy = nft_table_policy,
7329 },
7330 [NFT_MSG_NEWCHAIN] = {
7331 .call_batch = nf_tables_newchain,
7332 .attr_count = NFTA_CHAIN_MAX,
7333 .policy = nft_chain_policy,
7334 },
7335 [NFT_MSG_GETCHAIN] = {
7336 .call_rcu = nf_tables_getchain,
7337 .attr_count = NFTA_CHAIN_MAX,
7338 .policy = nft_chain_policy,
7339 },
7340 [NFT_MSG_DELCHAIN] = {
7341 .call_batch = nf_tables_delchain,
7342 .attr_count = NFTA_CHAIN_MAX,
7343 .policy = nft_chain_policy,
7344 },
7345 [NFT_MSG_NEWRULE] = {
7346 .call_batch = nf_tables_newrule,
7347 .attr_count = NFTA_RULE_MAX,
7348 .policy = nft_rule_policy,
7349 },
7350 [NFT_MSG_GETRULE] = {
7351 .call_rcu = nf_tables_getrule,
7352 .attr_count = NFTA_RULE_MAX,
7353 .policy = nft_rule_policy,
7354 },
7355 [NFT_MSG_DELRULE] = {
7356 .call_batch = nf_tables_delrule,
7357 .attr_count = NFTA_RULE_MAX,
7358 .policy = nft_rule_policy,
7359 },
7360 [NFT_MSG_NEWSET] = {
7361 .call_batch = nf_tables_newset,
7362 .attr_count = NFTA_SET_MAX,
7363 .policy = nft_set_policy,
7364 },
7365 [NFT_MSG_GETSET] = {
7366 .call_rcu = nf_tables_getset,
7367 .attr_count = NFTA_SET_MAX,
7368 .policy = nft_set_policy,
7369 },
7370 [NFT_MSG_DELSET] = {
7371 .call_batch = nf_tables_delset,
7372 .attr_count = NFTA_SET_MAX,
7373 .policy = nft_set_policy,
7374 },
7375 [NFT_MSG_NEWSETELEM] = {
7376 .call_batch = nf_tables_newsetelem,
7377 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7378 .policy = nft_set_elem_list_policy,
7379 },
7380 [NFT_MSG_GETSETELEM] = {
7381 .call_rcu = nf_tables_getsetelem,
7382 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7383 .policy = nft_set_elem_list_policy,
7384 },
7385 [NFT_MSG_DELSETELEM] = {
7386 .call_batch = nf_tables_delsetelem,
7387 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7388 .policy = nft_set_elem_list_policy,
7389 },
7390 [NFT_MSG_GETGEN] = {
7391 .call_rcu = nf_tables_getgen,
7392 },
7393 [NFT_MSG_NEWOBJ] = {
7394 .call_batch = nf_tables_newobj,
7395 .attr_count = NFTA_OBJ_MAX,
7396 .policy = nft_obj_policy,
7397 },
7398 [NFT_MSG_GETOBJ] = {
7399 .call_rcu = nf_tables_getobj,
7400 .attr_count = NFTA_OBJ_MAX,
7401 .policy = nft_obj_policy,
7402 },
7403 [NFT_MSG_DELOBJ] = {
7404 .call_batch = nf_tables_delobj,
7405 .attr_count = NFTA_OBJ_MAX,
7406 .policy = nft_obj_policy,
7407 },
7408 [NFT_MSG_GETOBJ_RESET] = {
7409 .call_rcu = nf_tables_getobj,
7410 .attr_count = NFTA_OBJ_MAX,
7411 .policy = nft_obj_policy,
7412 },
7413 [NFT_MSG_NEWFLOWTABLE] = {
7414 .call_batch = nf_tables_newflowtable,
7415 .attr_count = NFTA_FLOWTABLE_MAX,
7416 .policy = nft_flowtable_policy,
7417 },
7418 [NFT_MSG_GETFLOWTABLE] = {
7419 .call_rcu = nf_tables_getflowtable,
7420 .attr_count = NFTA_FLOWTABLE_MAX,
7421 .policy = nft_flowtable_policy,
7422 },
7423 [NFT_MSG_DELFLOWTABLE] = {
7424 .call_batch = nf_tables_delflowtable,
7425 .attr_count = NFTA_FLOWTABLE_MAX,
7426 .policy = nft_flowtable_policy,
7427 },
7428 };
7429
nf_tables_validate(struct net * net)7430 static int nf_tables_validate(struct net *net)
7431 {
7432 struct nft_table *table;
7433
7434 switch (net->nft.validate_state) {
7435 case NFT_VALIDATE_SKIP:
7436 break;
7437 case NFT_VALIDATE_NEED:
7438 nft_validate_state_update(net, NFT_VALIDATE_DO);
7439 fallthrough;
7440 case NFT_VALIDATE_DO:
7441 list_for_each_entry(table, &net->nft.tables, list) {
7442 if (nft_table_validate(net, table) < 0)
7443 return -EAGAIN;
7444 }
7445 break;
7446 }
7447
7448 return 0;
7449 }
7450
7451 /* a drop policy has to be deferred until all rules have been activated,
7452 * otherwise a large ruleset that contains a drop-policy base chain will
7453 * cause all packets to get dropped until the full transaction has been
7454 * processed.
7455 *
7456 * We defer the drop policy until the transaction has been finalized.
7457 */
nft_chain_commit_drop_policy(struct nft_trans * trans)7458 static void nft_chain_commit_drop_policy(struct nft_trans *trans)
7459 {
7460 struct nft_base_chain *basechain;
7461
7462 if (nft_trans_chain_policy(trans) != NF_DROP)
7463 return;
7464
7465 if (!nft_is_base_chain(trans->ctx.chain))
7466 return;
7467
7468 basechain = nft_base_chain(trans->ctx.chain);
7469 basechain->policy = NF_DROP;
7470 }
7471
nft_chain_commit_update(struct nft_trans * trans)7472 static void nft_chain_commit_update(struct nft_trans *trans)
7473 {
7474 struct nft_base_chain *basechain;
7475
7476 if (nft_trans_chain_name(trans)) {
7477 rhltable_remove(&trans->ctx.table->chains_ht,
7478 &trans->ctx.chain->rhlhead,
7479 nft_chain_ht_params);
7480 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
7481 rhltable_insert_key(&trans->ctx.table->chains_ht,
7482 trans->ctx.chain->name,
7483 &trans->ctx.chain->rhlhead,
7484 nft_chain_ht_params);
7485 }
7486
7487 if (!nft_is_base_chain(trans->ctx.chain))
7488 return;
7489
7490 nft_chain_stats_replace(trans);
7491
7492 basechain = nft_base_chain(trans->ctx.chain);
7493
7494 switch (nft_trans_chain_policy(trans)) {
7495 case NF_DROP:
7496 case NF_ACCEPT:
7497 basechain->policy = nft_trans_chain_policy(trans);
7498 break;
7499 }
7500 }
7501
nft_obj_commit_update(struct nft_trans * trans)7502 static void nft_obj_commit_update(struct nft_trans *trans)
7503 {
7504 struct nft_object *newobj;
7505 struct nft_object *obj;
7506
7507 obj = nft_trans_obj(trans);
7508 newobj = nft_trans_obj_newobj(trans);
7509
7510 if (obj->ops->update)
7511 obj->ops->update(obj, newobj);
7512
7513 nft_obj_destroy(&trans->ctx, newobj);
7514 }
7515
nft_commit_release(struct nft_trans * trans)7516 static void nft_commit_release(struct nft_trans *trans)
7517 {
7518 switch (trans->msg_type) {
7519 case NFT_MSG_DELTABLE:
7520 nf_tables_table_destroy(&trans->ctx);
7521 break;
7522 case NFT_MSG_NEWCHAIN:
7523 free_percpu(nft_trans_chain_stats(trans));
7524 kfree(nft_trans_chain_name(trans));
7525 break;
7526 case NFT_MSG_DELCHAIN:
7527 nf_tables_chain_destroy(&trans->ctx);
7528 break;
7529 case NFT_MSG_DELRULE:
7530 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
7531 break;
7532 case NFT_MSG_DELSET:
7533 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
7534 break;
7535 case NFT_MSG_DELSETELEM:
7536 nf_tables_set_elem_destroy(&trans->ctx,
7537 nft_trans_elem_set(trans),
7538 nft_trans_elem(trans).priv);
7539 break;
7540 case NFT_MSG_DELOBJ:
7541 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
7542 break;
7543 case NFT_MSG_DELFLOWTABLE:
7544 if (nft_trans_flowtable_update(trans))
7545 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
7546 else
7547 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
7548 break;
7549 }
7550
7551 if (trans->put_net)
7552 put_net(trans->ctx.net);
7553
7554 kfree(trans);
7555 }
7556
nf_tables_trans_destroy_work(struct work_struct * w)7557 static void nf_tables_trans_destroy_work(struct work_struct *w)
7558 {
7559 struct nft_trans *trans, *next;
7560 LIST_HEAD(head);
7561
7562 spin_lock(&nf_tables_destroy_list_lock);
7563 list_splice_init(&nf_tables_destroy_list, &head);
7564 spin_unlock(&nf_tables_destroy_list_lock);
7565
7566 if (list_empty(&head))
7567 return;
7568
7569 synchronize_rcu();
7570
7571 list_for_each_entry_safe(trans, next, &head, list) {
7572 list_del(&trans->list);
7573 nft_commit_release(trans);
7574 }
7575 }
7576
nf_tables_trans_destroy_flush_work(void)7577 void nf_tables_trans_destroy_flush_work(void)
7578 {
7579 flush_work(&trans_destroy_work);
7580 }
7581 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
7582
nf_tables_commit_chain_prepare(struct net * net,struct nft_chain * chain)7583 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
7584 {
7585 struct nft_rule *rule;
7586 unsigned int alloc = 0;
7587 int i;
7588
7589 /* already handled or inactive chain? */
7590 if (chain->rules_next || !nft_is_active_next(net, chain))
7591 return 0;
7592
7593 rule = list_entry(&chain->rules, struct nft_rule, list);
7594 i = 0;
7595
7596 list_for_each_entry_continue(rule, &chain->rules, list) {
7597 if (nft_is_active_next(net, rule))
7598 alloc++;
7599 }
7600
7601 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
7602 if (!chain->rules_next)
7603 return -ENOMEM;
7604
7605 list_for_each_entry_continue(rule, &chain->rules, list) {
7606 if (nft_is_active_next(net, rule))
7607 chain->rules_next[i++] = rule;
7608 }
7609
7610 chain->rules_next[i] = NULL;
7611 return 0;
7612 }
7613
nf_tables_commit_chain_prepare_cancel(struct net * net)7614 static void nf_tables_commit_chain_prepare_cancel(struct net *net)
7615 {
7616 struct nft_trans *trans, *next;
7617
7618 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7619 struct nft_chain *chain = trans->ctx.chain;
7620
7621 if (trans->msg_type == NFT_MSG_NEWRULE ||
7622 trans->msg_type == NFT_MSG_DELRULE) {
7623 kvfree(chain->rules_next);
7624 chain->rules_next = NULL;
7625 }
7626 }
7627 }
7628
__nf_tables_commit_chain_free_rules_old(struct rcu_head * h)7629 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
7630 {
7631 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
7632
7633 kvfree(o->start);
7634 }
7635
nf_tables_commit_chain_free_rules_old(struct nft_rule ** rules)7636 static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
7637 {
7638 struct nft_rule **r = rules;
7639 struct nft_rules_old *old;
7640
7641 while (*r)
7642 r++;
7643
7644 r++; /* rcu_head is after end marker */
7645 old = (void *) r;
7646 old->start = rules;
7647
7648 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
7649 }
7650
nf_tables_commit_chain(struct net * net,struct nft_chain * chain)7651 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
7652 {
7653 struct nft_rule **g0, **g1;
7654 bool next_genbit;
7655
7656 next_genbit = nft_gencursor_next(net);
7657
7658 g0 = rcu_dereference_protected(chain->rules_gen_0,
7659 lockdep_commit_lock_is_held(net));
7660 g1 = rcu_dereference_protected(chain->rules_gen_1,
7661 lockdep_commit_lock_is_held(net));
7662
7663 /* No changes to this chain? */
7664 if (chain->rules_next == NULL) {
7665 /* chain had no change in last or next generation */
7666 if (g0 == g1)
7667 return;
7668 /*
7669 * chain had no change in this generation; make sure next
7670 * one uses same rules as current generation.
7671 */
7672 if (next_genbit) {
7673 rcu_assign_pointer(chain->rules_gen_1, g0);
7674 nf_tables_commit_chain_free_rules_old(g1);
7675 } else {
7676 rcu_assign_pointer(chain->rules_gen_0, g1);
7677 nf_tables_commit_chain_free_rules_old(g0);
7678 }
7679
7680 return;
7681 }
7682
7683 if (next_genbit)
7684 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
7685 else
7686 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
7687
7688 chain->rules_next = NULL;
7689
7690 if (g0 == g1)
7691 return;
7692
7693 if (next_genbit)
7694 nf_tables_commit_chain_free_rules_old(g1);
7695 else
7696 nf_tables_commit_chain_free_rules_old(g0);
7697 }
7698
nft_obj_del(struct nft_object * obj)7699 static void nft_obj_del(struct nft_object *obj)
7700 {
7701 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
7702 list_del_rcu(&obj->list);
7703 }
7704
nft_chain_del(struct nft_chain * chain)7705 void nft_chain_del(struct nft_chain *chain)
7706 {
7707 struct nft_table *table = chain->table;
7708
7709 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
7710 nft_chain_ht_params));
7711 list_del_rcu(&chain->list);
7712 }
7713
nf_tables_module_autoload_cleanup(struct net * net)7714 static void nf_tables_module_autoload_cleanup(struct net *net)
7715 {
7716 struct nft_module_request *req, *next;
7717
7718 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
7719 list_for_each_entry_safe(req, next, &net->nft.module_list, list) {
7720 WARN_ON_ONCE(!req->done);
7721 list_del(&req->list);
7722 kfree(req);
7723 }
7724 }
7725
nf_tables_commit_release(struct net * net)7726 static void nf_tables_commit_release(struct net *net)
7727 {
7728 struct nft_trans *trans;
7729
7730 /* all side effects have to be made visible.
7731 * For example, if a chain named 'foo' has been deleted, a
7732 * new transaction must not find it anymore.
7733 *
7734 * Memory reclaim happens asynchronously from work queue
7735 * to prevent expensive synchronize_rcu() in commit phase.
7736 */
7737 if (list_empty(&net->nft.commit_list)) {
7738 nf_tables_module_autoload_cleanup(net);
7739 mutex_unlock(&net->nft.commit_mutex);
7740 return;
7741 }
7742
7743 trans = list_last_entry(&net->nft.commit_list,
7744 struct nft_trans, list);
7745 get_net(trans->ctx.net);
7746 WARN_ON_ONCE(trans->put_net);
7747
7748 trans->put_net = true;
7749 spin_lock(&nf_tables_destroy_list_lock);
7750 list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
7751 spin_unlock(&nf_tables_destroy_list_lock);
7752
7753 nf_tables_module_autoload_cleanup(net);
7754 schedule_work(&trans_destroy_work);
7755
7756 mutex_unlock(&net->nft.commit_mutex);
7757 }
7758
nft_commit_notify(struct net * net,u32 portid)7759 static void nft_commit_notify(struct net *net, u32 portid)
7760 {
7761 struct sk_buff *batch_skb = NULL, *nskb, *skb;
7762 unsigned char *data;
7763 int len;
7764
7765 list_for_each_entry_safe(skb, nskb, &net->nft.notify_list, list) {
7766 if (!batch_skb) {
7767 new_batch:
7768 batch_skb = skb;
7769 len = NLMSG_GOODSIZE - skb->len;
7770 list_del(&skb->list);
7771 continue;
7772 }
7773 len -= skb->len;
7774 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) {
7775 data = skb_put(batch_skb, skb->len);
7776 memcpy(data, skb->data, skb->len);
7777 list_del(&skb->list);
7778 kfree_skb(skb);
7779 continue;
7780 }
7781 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
7782 NFT_CB(batch_skb).report, GFP_KERNEL);
7783 goto new_batch;
7784 }
7785
7786 if (batch_skb) {
7787 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
7788 NFT_CB(batch_skb).report, GFP_KERNEL);
7789 }
7790
7791 WARN_ON_ONCE(!list_empty(&net->nft.notify_list));
7792 }
7793
nf_tables_commit_audit_alloc(struct list_head * adl,struct nft_table * table)7794 static int nf_tables_commit_audit_alloc(struct list_head *adl,
7795 struct nft_table *table)
7796 {
7797 struct nft_audit_data *adp;
7798
7799 list_for_each_entry(adp, adl, list) {
7800 if (adp->table == table)
7801 return 0;
7802 }
7803 adp = kzalloc(sizeof(*adp), GFP_KERNEL);
7804 if (!adp)
7805 return -ENOMEM;
7806 adp->table = table;
7807 list_add(&adp->list, adl);
7808 return 0;
7809 }
7810
nf_tables_commit_audit_free(struct list_head * adl)7811 static void nf_tables_commit_audit_free(struct list_head *adl)
7812 {
7813 struct nft_audit_data *adp, *adn;
7814
7815 list_for_each_entry_safe(adp, adn, adl, list) {
7816 list_del(&adp->list);
7817 kfree(adp);
7818 }
7819 }
7820
nf_tables_commit_audit_collect(struct list_head * adl,struct nft_table * table,u32 op)7821 static void nf_tables_commit_audit_collect(struct list_head *adl,
7822 struct nft_table *table, u32 op)
7823 {
7824 struct nft_audit_data *adp;
7825
7826 list_for_each_entry(adp, adl, list) {
7827 if (adp->table == table)
7828 goto found;
7829 }
7830 WARN_ONCE(1, "table=%s not expected in commit list", table->name);
7831 return;
7832 found:
7833 adp->entries++;
7834 if (!adp->op || adp->op > op)
7835 adp->op = op;
7836 }
7837
7838 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22)
7839
nf_tables_commit_audit_log(struct list_head * adl,u32 generation)7840 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation)
7841 {
7842 struct nft_audit_data *adp, *adn;
7843 char aubuf[AUNFTABLENAMELEN];
7844
7845 list_for_each_entry_safe(adp, adn, adl, list) {
7846 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name,
7847 generation);
7848 audit_log_nfcfg(aubuf, adp->table->family, adp->entries,
7849 nft2audit_op[adp->op], GFP_KERNEL);
7850 list_del(&adp->list);
7851 kfree(adp);
7852 }
7853 }
7854
nf_tables_commit(struct net * net,struct sk_buff * skb)7855 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
7856 {
7857 struct nft_trans *trans, *next;
7858 struct nft_trans_elem *te;
7859 struct nft_chain *chain;
7860 struct nft_table *table;
7861 LIST_HEAD(adl);
7862 int err;
7863
7864 if (list_empty(&net->nft.commit_list)) {
7865 mutex_unlock(&net->nft.commit_mutex);
7866 return 0;
7867 }
7868
7869 /* 0. Validate ruleset, otherwise roll back for error reporting. */
7870 if (nf_tables_validate(net) < 0)
7871 return -EAGAIN;
7872
7873 err = nft_flow_rule_offload_commit(net);
7874 if (err < 0)
7875 return err;
7876
7877 /* 1. Allocate space for next generation rules_gen_X[] */
7878 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7879 int ret;
7880
7881 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table);
7882 if (ret) {
7883 nf_tables_commit_chain_prepare_cancel(net);
7884 nf_tables_commit_audit_free(&adl);
7885 return ret;
7886 }
7887 if (trans->msg_type == NFT_MSG_NEWRULE ||
7888 trans->msg_type == NFT_MSG_DELRULE) {
7889 chain = trans->ctx.chain;
7890
7891 ret = nf_tables_commit_chain_prepare(net, chain);
7892 if (ret < 0) {
7893 nf_tables_commit_chain_prepare_cancel(net);
7894 nf_tables_commit_audit_free(&adl);
7895 return ret;
7896 }
7897 }
7898 }
7899
7900 /* step 2. Make rules_gen_X visible to packet path */
7901 list_for_each_entry(table, &net->nft.tables, list) {
7902 list_for_each_entry(chain, &table->chains, list)
7903 nf_tables_commit_chain(net, chain);
7904 }
7905
7906 /*
7907 * Bump generation counter, invalidate any dump in progress.
7908 * Cannot fail after this point.
7909 */
7910 while (++net->nft.base_seq == 0);
7911
7912 /* step 3. Start new generation, rules_gen_X now in use. */
7913 net->nft.gencursor = nft_gencursor_next(net);
7914
7915 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7916 nf_tables_commit_audit_collect(&adl, trans->ctx.table,
7917 trans->msg_type);
7918 switch (trans->msg_type) {
7919 case NFT_MSG_NEWTABLE:
7920 if (nft_trans_table_update(trans)) {
7921 if (!nft_trans_table_enable(trans)) {
7922 nf_tables_table_disable(net,
7923 trans->ctx.table);
7924 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7925 }
7926 } else {
7927 nft_clear(net, trans->ctx.table);
7928 }
7929 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
7930 nft_trans_destroy(trans);
7931 break;
7932 case NFT_MSG_DELTABLE:
7933 list_del_rcu(&trans->ctx.table->list);
7934 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
7935 break;
7936 case NFT_MSG_NEWCHAIN:
7937 if (nft_trans_chain_update(trans)) {
7938 nft_chain_commit_update(trans);
7939 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7940 /* trans destroyed after rcu grace period */
7941 } else {
7942 nft_chain_commit_drop_policy(trans);
7943 nft_clear(net, trans->ctx.chain);
7944 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7945 nft_trans_destroy(trans);
7946 }
7947 break;
7948 case NFT_MSG_DELCHAIN:
7949 nft_chain_del(trans->ctx.chain);
7950 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
7951 nf_tables_unregister_hook(trans->ctx.net,
7952 trans->ctx.table,
7953 trans->ctx.chain);
7954 break;
7955 case NFT_MSG_NEWRULE:
7956 nft_clear(trans->ctx.net, nft_trans_rule(trans));
7957 nf_tables_rule_notify(&trans->ctx,
7958 nft_trans_rule(trans),
7959 NFT_MSG_NEWRULE);
7960 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
7961 nft_flow_rule_destroy(nft_trans_flow_rule(trans));
7962
7963 nft_trans_destroy(trans);
7964 break;
7965 case NFT_MSG_DELRULE:
7966 list_del_rcu(&nft_trans_rule(trans)->list);
7967 nf_tables_rule_notify(&trans->ctx,
7968 nft_trans_rule(trans),
7969 NFT_MSG_DELRULE);
7970 nft_rule_expr_deactivate(&trans->ctx,
7971 nft_trans_rule(trans),
7972 NFT_TRANS_COMMIT);
7973
7974 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
7975 nft_flow_rule_destroy(nft_trans_flow_rule(trans));
7976 break;
7977 case NFT_MSG_NEWSET:
7978 nft_clear(net, nft_trans_set(trans));
7979 /* This avoids hitting -EBUSY when deleting the table
7980 * from the transaction.
7981 */
7982 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
7983 !list_empty(&nft_trans_set(trans)->bindings))
7984 trans->ctx.table->use--;
7985
7986 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
7987 NFT_MSG_NEWSET, GFP_KERNEL);
7988 nft_trans_destroy(trans);
7989 break;
7990 case NFT_MSG_DELSET:
7991 list_del_rcu(&nft_trans_set(trans)->list);
7992 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
7993 NFT_MSG_DELSET, GFP_KERNEL);
7994 break;
7995 case NFT_MSG_NEWSETELEM:
7996 te = (struct nft_trans_elem *)trans->data;
7997
7998 te->set->ops->activate(net, te->set, &te->elem);
7999 nf_tables_setelem_notify(&trans->ctx, te->set,
8000 &te->elem,
8001 NFT_MSG_NEWSETELEM, 0);
8002 nft_trans_destroy(trans);
8003 break;
8004 case NFT_MSG_DELSETELEM:
8005 te = (struct nft_trans_elem *)trans->data;
8006
8007 nf_tables_setelem_notify(&trans->ctx, te->set,
8008 &te->elem,
8009 NFT_MSG_DELSETELEM, 0);
8010 te->set->ops->remove(net, te->set, &te->elem);
8011 atomic_dec(&te->set->nelems);
8012 te->set->ndeact--;
8013 break;
8014 case NFT_MSG_NEWOBJ:
8015 if (nft_trans_obj_update(trans)) {
8016 nft_obj_commit_update(trans);
8017 nf_tables_obj_notify(&trans->ctx,
8018 nft_trans_obj(trans),
8019 NFT_MSG_NEWOBJ);
8020 } else {
8021 nft_clear(net, nft_trans_obj(trans));
8022 nf_tables_obj_notify(&trans->ctx,
8023 nft_trans_obj(trans),
8024 NFT_MSG_NEWOBJ);
8025 nft_trans_destroy(trans);
8026 }
8027 break;
8028 case NFT_MSG_DELOBJ:
8029 nft_obj_del(nft_trans_obj(trans));
8030 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
8031 NFT_MSG_DELOBJ);
8032 break;
8033 case NFT_MSG_NEWFLOWTABLE:
8034 if (nft_trans_flowtable_update(trans)) {
8035 nft_trans_flowtable(trans)->data.flags =
8036 nft_trans_flowtable_flags(trans);
8037 nf_tables_flowtable_notify(&trans->ctx,
8038 nft_trans_flowtable(trans),
8039 &nft_trans_flowtable_hooks(trans),
8040 NFT_MSG_NEWFLOWTABLE);
8041 list_splice(&nft_trans_flowtable_hooks(trans),
8042 &nft_trans_flowtable(trans)->hook_list);
8043 } else {
8044 nft_clear(net, nft_trans_flowtable(trans));
8045 nf_tables_flowtable_notify(&trans->ctx,
8046 nft_trans_flowtable(trans),
8047 &nft_trans_flowtable(trans)->hook_list,
8048 NFT_MSG_NEWFLOWTABLE);
8049 }
8050 nft_trans_destroy(trans);
8051 break;
8052 case NFT_MSG_DELFLOWTABLE:
8053 if (nft_trans_flowtable_update(trans)) {
8054 nf_tables_flowtable_notify(&trans->ctx,
8055 nft_trans_flowtable(trans),
8056 &nft_trans_flowtable_hooks(trans),
8057 NFT_MSG_DELFLOWTABLE);
8058 nft_unregister_flowtable_net_hooks(net,
8059 &nft_trans_flowtable_hooks(trans));
8060 } else {
8061 list_del_rcu(&nft_trans_flowtable(trans)->list);
8062 nf_tables_flowtable_notify(&trans->ctx,
8063 nft_trans_flowtable(trans),
8064 &nft_trans_flowtable(trans)->hook_list,
8065 NFT_MSG_DELFLOWTABLE);
8066 nft_unregister_flowtable_net_hooks(net,
8067 &nft_trans_flowtable(trans)->hook_list);
8068 }
8069 break;
8070 }
8071 }
8072
8073 nft_commit_notify(net, NETLINK_CB(skb).portid);
8074 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
8075 nf_tables_commit_audit_log(&adl, net->nft.base_seq);
8076 nf_tables_commit_release(net);
8077
8078 return 0;
8079 }
8080
nf_tables_module_autoload(struct net * net)8081 static void nf_tables_module_autoload(struct net *net)
8082 {
8083 struct nft_module_request *req, *next;
8084 LIST_HEAD(module_list);
8085
8086 list_splice_init(&net->nft.module_list, &module_list);
8087 mutex_unlock(&net->nft.commit_mutex);
8088 list_for_each_entry_safe(req, next, &module_list, list) {
8089 request_module("%s", req->module);
8090 req->done = true;
8091 }
8092 mutex_lock(&net->nft.commit_mutex);
8093 list_splice(&module_list, &net->nft.module_list);
8094 }
8095
nf_tables_abort_release(struct nft_trans * trans)8096 static void nf_tables_abort_release(struct nft_trans *trans)
8097 {
8098 switch (trans->msg_type) {
8099 case NFT_MSG_NEWTABLE:
8100 nf_tables_table_destroy(&trans->ctx);
8101 break;
8102 case NFT_MSG_NEWCHAIN:
8103 nf_tables_chain_destroy(&trans->ctx);
8104 break;
8105 case NFT_MSG_NEWRULE:
8106 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
8107 break;
8108 case NFT_MSG_NEWSET:
8109 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
8110 break;
8111 case NFT_MSG_NEWSETELEM:
8112 nft_set_elem_destroy(nft_trans_elem_set(trans),
8113 nft_trans_elem(trans).priv, true);
8114 break;
8115 case NFT_MSG_NEWOBJ:
8116 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
8117 break;
8118 case NFT_MSG_NEWFLOWTABLE:
8119 if (nft_trans_flowtable_update(trans))
8120 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
8121 else
8122 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
8123 break;
8124 }
8125 kfree(trans);
8126 }
8127
__nf_tables_abort(struct net * net,enum nfnl_abort_action action)8128 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
8129 {
8130 struct nft_trans *trans, *next;
8131 struct nft_trans_elem *te;
8132
8133 if (action == NFNL_ABORT_VALIDATE &&
8134 nf_tables_validate(net) < 0)
8135 return -EAGAIN;
8136
8137 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
8138 list) {
8139 switch (trans->msg_type) {
8140 case NFT_MSG_NEWTABLE:
8141 if (nft_trans_table_update(trans)) {
8142 if (nft_trans_table_enable(trans)) {
8143 nf_tables_table_disable(net,
8144 trans->ctx.table);
8145 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
8146 }
8147 nft_trans_destroy(trans);
8148 } else {
8149 list_del_rcu(&trans->ctx.table->list);
8150 }
8151 break;
8152 case NFT_MSG_DELTABLE:
8153 nft_clear(trans->ctx.net, trans->ctx.table);
8154 nft_trans_destroy(trans);
8155 break;
8156 case NFT_MSG_NEWCHAIN:
8157 if (nft_trans_chain_update(trans)) {
8158 free_percpu(nft_trans_chain_stats(trans));
8159 kfree(nft_trans_chain_name(trans));
8160 nft_trans_destroy(trans);
8161 } else {
8162 if (nft_chain_is_bound(trans->ctx.chain)) {
8163 nft_trans_destroy(trans);
8164 break;
8165 }
8166 trans->ctx.table->use--;
8167 nft_chain_del(trans->ctx.chain);
8168 nf_tables_unregister_hook(trans->ctx.net,
8169 trans->ctx.table,
8170 trans->ctx.chain);
8171 }
8172 break;
8173 case NFT_MSG_DELCHAIN:
8174 trans->ctx.table->use++;
8175 nft_clear(trans->ctx.net, trans->ctx.chain);
8176 nft_trans_destroy(trans);
8177 break;
8178 case NFT_MSG_NEWRULE:
8179 trans->ctx.chain->use--;
8180 list_del_rcu(&nft_trans_rule(trans)->list);
8181 nft_rule_expr_deactivate(&trans->ctx,
8182 nft_trans_rule(trans),
8183 NFT_TRANS_ABORT);
8184 break;
8185 case NFT_MSG_DELRULE:
8186 trans->ctx.chain->use++;
8187 nft_clear(trans->ctx.net, nft_trans_rule(trans));
8188 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
8189 nft_trans_destroy(trans);
8190 break;
8191 case NFT_MSG_NEWSET:
8192 trans->ctx.table->use--;
8193 if (nft_trans_set_bound(trans)) {
8194 nft_trans_destroy(trans);
8195 break;
8196 }
8197 list_del_rcu(&nft_trans_set(trans)->list);
8198 break;
8199 case NFT_MSG_DELSET:
8200 trans->ctx.table->use++;
8201 nft_clear(trans->ctx.net, nft_trans_set(trans));
8202 nft_trans_destroy(trans);
8203 break;
8204 case NFT_MSG_NEWSETELEM:
8205 if (nft_trans_elem_set_bound(trans)) {
8206 nft_trans_destroy(trans);
8207 break;
8208 }
8209 te = (struct nft_trans_elem *)trans->data;
8210 te->set->ops->remove(net, te->set, &te->elem);
8211 atomic_dec(&te->set->nelems);
8212 break;
8213 case NFT_MSG_DELSETELEM:
8214 te = (struct nft_trans_elem *)trans->data;
8215
8216 nft_set_elem_activate(net, te->set, &te->elem);
8217 te->set->ops->activate(net, te->set, &te->elem);
8218 te->set->ndeact--;
8219
8220 nft_trans_destroy(trans);
8221 break;
8222 case NFT_MSG_NEWOBJ:
8223 if (nft_trans_obj_update(trans)) {
8224 nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans));
8225 nft_trans_destroy(trans);
8226 } else {
8227 trans->ctx.table->use--;
8228 nft_obj_del(nft_trans_obj(trans));
8229 }
8230 break;
8231 case NFT_MSG_DELOBJ:
8232 trans->ctx.table->use++;
8233 nft_clear(trans->ctx.net, nft_trans_obj(trans));
8234 nft_trans_destroy(trans);
8235 break;
8236 case NFT_MSG_NEWFLOWTABLE:
8237 if (nft_trans_flowtable_update(trans)) {
8238 nft_unregister_flowtable_net_hooks(net,
8239 &nft_trans_flowtable_hooks(trans));
8240 } else {
8241 trans->ctx.table->use--;
8242 list_del_rcu(&nft_trans_flowtable(trans)->list);
8243 nft_unregister_flowtable_net_hooks(net,
8244 &nft_trans_flowtable(trans)->hook_list);
8245 }
8246 break;
8247 case NFT_MSG_DELFLOWTABLE:
8248 if (nft_trans_flowtable_update(trans)) {
8249 list_splice(&nft_trans_flowtable_hooks(trans),
8250 &nft_trans_flowtable(trans)->hook_list);
8251 } else {
8252 trans->ctx.table->use++;
8253 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
8254 }
8255 nft_trans_destroy(trans);
8256 break;
8257 }
8258 }
8259
8260 synchronize_rcu();
8261
8262 list_for_each_entry_safe_reverse(trans, next,
8263 &net->nft.commit_list, list) {
8264 list_del(&trans->list);
8265 nf_tables_abort_release(trans);
8266 }
8267
8268 if (action == NFNL_ABORT_AUTOLOAD)
8269 nf_tables_module_autoload(net);
8270 else
8271 nf_tables_module_autoload_cleanup(net);
8272
8273 return 0;
8274 }
8275
nf_tables_cleanup(struct net * net)8276 static void nf_tables_cleanup(struct net *net)
8277 {
8278 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
8279 }
8280
nf_tables_abort(struct net * net,struct sk_buff * skb,enum nfnl_abort_action action)8281 static int nf_tables_abort(struct net *net, struct sk_buff *skb,
8282 enum nfnl_abort_action action)
8283 {
8284 int ret = __nf_tables_abort(net, action);
8285
8286 mutex_unlock(&net->nft.commit_mutex);
8287
8288 return ret;
8289 }
8290
nf_tables_valid_genid(struct net * net,u32 genid)8291 static bool nf_tables_valid_genid(struct net *net, u32 genid)
8292 {
8293 bool genid_ok;
8294
8295 mutex_lock(&net->nft.commit_mutex);
8296
8297 genid_ok = genid == 0 || net->nft.base_seq == genid;
8298 if (!genid_ok)
8299 mutex_unlock(&net->nft.commit_mutex);
8300
8301 /* else, commit mutex has to be released by commit or abort function */
8302 return genid_ok;
8303 }
8304
8305 static const struct nfnetlink_subsystem nf_tables_subsys = {
8306 .name = "nf_tables",
8307 .subsys_id = NFNL_SUBSYS_NFTABLES,
8308 .cb_count = NFT_MSG_MAX,
8309 .cb = nf_tables_cb,
8310 .commit = nf_tables_commit,
8311 .abort = nf_tables_abort,
8312 .cleanup = nf_tables_cleanup,
8313 .valid_genid = nf_tables_valid_genid,
8314 .owner = THIS_MODULE,
8315 };
8316
nft_chain_validate_dependency(const struct nft_chain * chain,enum nft_chain_types type)8317 int nft_chain_validate_dependency(const struct nft_chain *chain,
8318 enum nft_chain_types type)
8319 {
8320 const struct nft_base_chain *basechain;
8321
8322 if (nft_is_base_chain(chain)) {
8323 basechain = nft_base_chain(chain);
8324 if (basechain->type->type != type)
8325 return -EOPNOTSUPP;
8326 }
8327 return 0;
8328 }
8329 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
8330
nft_chain_validate_hooks(const struct nft_chain * chain,unsigned int hook_flags)8331 int nft_chain_validate_hooks(const struct nft_chain *chain,
8332 unsigned int hook_flags)
8333 {
8334 struct nft_base_chain *basechain;
8335
8336 if (nft_is_base_chain(chain)) {
8337 basechain = nft_base_chain(chain);
8338
8339 if ((1 << basechain->ops.hooknum) & hook_flags)
8340 return 0;
8341
8342 return -EOPNOTSUPP;
8343 }
8344
8345 return 0;
8346 }
8347 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
8348
8349 /*
8350 * Loop detection - walk through the ruleset beginning at the destination chain
8351 * of a new jump until either the source chain is reached (loop) or all
8352 * reachable chains have been traversed.
8353 *
8354 * The loop check is performed whenever a new jump verdict is added to an
8355 * expression or verdict map or a verdict map is bound to a new chain.
8356 */
8357
8358 static int nf_tables_check_loops(const struct nft_ctx *ctx,
8359 const struct nft_chain *chain);
8360
nf_tables_loop_check_setelem(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)8361 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
8362 struct nft_set *set,
8363 const struct nft_set_iter *iter,
8364 struct nft_set_elem *elem)
8365 {
8366 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
8367 const struct nft_data *data;
8368
8369 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
8370 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
8371 return 0;
8372
8373 data = nft_set_ext_data(ext);
8374 switch (data->verdict.code) {
8375 case NFT_JUMP:
8376 case NFT_GOTO:
8377 return nf_tables_check_loops(ctx, data->verdict.chain);
8378 default:
8379 return 0;
8380 }
8381 }
8382
nf_tables_check_loops(const struct nft_ctx * ctx,const struct nft_chain * chain)8383 static int nf_tables_check_loops(const struct nft_ctx *ctx,
8384 const struct nft_chain *chain)
8385 {
8386 const struct nft_rule *rule;
8387 const struct nft_expr *expr, *last;
8388 struct nft_set *set;
8389 struct nft_set_binding *binding;
8390 struct nft_set_iter iter;
8391
8392 if (ctx->chain == chain)
8393 return -ELOOP;
8394
8395 list_for_each_entry(rule, &chain->rules, list) {
8396 nft_rule_for_each_expr(expr, last, rule) {
8397 struct nft_immediate_expr *priv;
8398 const struct nft_data *data;
8399 int err;
8400
8401 if (strcmp(expr->ops->type->name, "immediate"))
8402 continue;
8403
8404 priv = nft_expr_priv(expr);
8405 if (priv->dreg != NFT_REG_VERDICT)
8406 continue;
8407
8408 data = &priv->data;
8409 switch (data->verdict.code) {
8410 case NFT_JUMP:
8411 case NFT_GOTO:
8412 err = nf_tables_check_loops(ctx,
8413 data->verdict.chain);
8414 if (err < 0)
8415 return err;
8416 break;
8417 default:
8418 break;
8419 }
8420 }
8421 }
8422
8423 list_for_each_entry(set, &ctx->table->sets, list) {
8424 if (!nft_is_active_next(ctx->net, set))
8425 continue;
8426 if (!(set->flags & NFT_SET_MAP) ||
8427 set->dtype != NFT_DATA_VERDICT)
8428 continue;
8429
8430 list_for_each_entry(binding, &set->bindings, list) {
8431 if (!(binding->flags & NFT_SET_MAP) ||
8432 binding->chain != chain)
8433 continue;
8434
8435 iter.genmask = nft_genmask_next(ctx->net);
8436 iter.skip = 0;
8437 iter.count = 0;
8438 iter.err = 0;
8439 iter.fn = nf_tables_loop_check_setelem;
8440
8441 set->ops->walk(ctx, set, &iter);
8442 if (iter.err < 0)
8443 return iter.err;
8444 }
8445 }
8446
8447 return 0;
8448 }
8449
8450 /**
8451 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
8452 *
8453 * @attr: netlink attribute to fetch value from
8454 * @max: maximum value to be stored in dest
8455 * @dest: pointer to the variable
8456 *
8457 * Parse, check and store a given u32 netlink attribute into variable.
8458 * This function returns -ERANGE if the value goes over maximum value.
8459 * Otherwise a 0 is returned and the attribute value is stored in the
8460 * destination variable.
8461 */
nft_parse_u32_check(const struct nlattr * attr,int max,u32 * dest)8462 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
8463 {
8464 u32 val;
8465
8466 val = ntohl(nla_get_be32(attr));
8467 if (val > max)
8468 return -ERANGE;
8469
8470 *dest = val;
8471 return 0;
8472 }
8473 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
8474
8475 /**
8476 * nft_parse_register - parse a register value from a netlink attribute
8477 *
8478 * @attr: netlink attribute
8479 *
8480 * Parse and translate a register value from a netlink attribute.
8481 * Registers used to be 128 bit wide, these register numbers will be
8482 * mapped to the corresponding 32 bit register numbers.
8483 */
nft_parse_register(const struct nlattr * attr)8484 unsigned int nft_parse_register(const struct nlattr *attr)
8485 {
8486 unsigned int reg;
8487
8488 reg = ntohl(nla_get_be32(attr));
8489 switch (reg) {
8490 case NFT_REG_VERDICT...NFT_REG_4:
8491 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
8492 default:
8493 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
8494 }
8495 }
8496 EXPORT_SYMBOL_GPL(nft_parse_register);
8497
8498 /**
8499 * nft_dump_register - dump a register value to a netlink attribute
8500 *
8501 * @skb: socket buffer
8502 * @attr: attribute number
8503 * @reg: register number
8504 *
8505 * Construct a netlink attribute containing the register number. For
8506 * compatibility reasons, register numbers being a multiple of 4 are
8507 * translated to the corresponding 128 bit register numbers.
8508 */
nft_dump_register(struct sk_buff * skb,unsigned int attr,unsigned int reg)8509 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
8510 {
8511 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
8512 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
8513 else
8514 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
8515
8516 return nla_put_be32(skb, attr, htonl(reg));
8517 }
8518 EXPORT_SYMBOL_GPL(nft_dump_register);
8519
8520 /**
8521 * nft_validate_register_load - validate a load from a register
8522 *
8523 * @reg: the register number
8524 * @len: the length of the data
8525 *
8526 * Validate that the input register is one of the general purpose
8527 * registers and that the length of the load is within the bounds.
8528 */
nft_validate_register_load(enum nft_registers reg,unsigned int len)8529 static int nft_validate_register_load(enum nft_registers reg, unsigned int len)
8530 {
8531 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
8532 return -EINVAL;
8533 if (len == 0)
8534 return -EINVAL;
8535 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data))
8536 return -ERANGE;
8537
8538 return 0;
8539 }
8540
nft_parse_register_load(const struct nlattr * attr,u8 * sreg,u32 len)8541 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len)
8542 {
8543 u32 reg;
8544 int err;
8545
8546 reg = nft_parse_register(attr);
8547 err = nft_validate_register_load(reg, len);
8548 if (err < 0)
8549 return err;
8550
8551 *sreg = reg;
8552 return 0;
8553 }
8554 EXPORT_SYMBOL_GPL(nft_parse_register_load);
8555
8556 /**
8557 * nft_validate_register_store - validate an expressions' register store
8558 *
8559 * @ctx: context of the expression performing the load
8560 * @reg: the destination register number
8561 * @data: the data to load
8562 * @type: the data type
8563 * @len: the length of the data
8564 *
8565 * Validate that a data load uses the appropriate data type for
8566 * the destination register and the length is within the bounds.
8567 * A value of NULL for the data means that its runtime gathered
8568 * data.
8569 */
nft_validate_register_store(const struct nft_ctx * ctx,enum nft_registers reg,const struct nft_data * data,enum nft_data_types type,unsigned int len)8570 static int nft_validate_register_store(const struct nft_ctx *ctx,
8571 enum nft_registers reg,
8572 const struct nft_data *data,
8573 enum nft_data_types type,
8574 unsigned int len)
8575 {
8576 int err;
8577
8578 switch (reg) {
8579 case NFT_REG_VERDICT:
8580 if (type != NFT_DATA_VERDICT)
8581 return -EINVAL;
8582
8583 if (data != NULL &&
8584 (data->verdict.code == NFT_GOTO ||
8585 data->verdict.code == NFT_JUMP)) {
8586 err = nf_tables_check_loops(ctx, data->verdict.chain);
8587 if (err < 0)
8588 return err;
8589 }
8590
8591 return 0;
8592 default:
8593 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
8594 return -EINVAL;
8595 if (len == 0)
8596 return -EINVAL;
8597 if (reg * NFT_REG32_SIZE + len >
8598 sizeof_field(struct nft_regs, data))
8599 return -ERANGE;
8600
8601 if (data != NULL && type != NFT_DATA_VALUE)
8602 return -EINVAL;
8603 return 0;
8604 }
8605 }
8606
nft_parse_register_store(const struct nft_ctx * ctx,const struct nlattr * attr,u8 * dreg,const struct nft_data * data,enum nft_data_types type,unsigned int len)8607 int nft_parse_register_store(const struct nft_ctx *ctx,
8608 const struct nlattr *attr, u8 *dreg,
8609 const struct nft_data *data,
8610 enum nft_data_types type, unsigned int len)
8611 {
8612 int err;
8613 u32 reg;
8614
8615 reg = nft_parse_register(attr);
8616 err = nft_validate_register_store(ctx, reg, data, type, len);
8617 if (err < 0)
8618 return err;
8619
8620 *dreg = reg;
8621 return 0;
8622 }
8623 EXPORT_SYMBOL_GPL(nft_parse_register_store);
8624
8625 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
8626 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
8627 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
8628 .len = NFT_CHAIN_MAXNAMELEN - 1 },
8629 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 },
8630 };
8631
nft_verdict_init(const struct nft_ctx * ctx,struct nft_data * data,struct nft_data_desc * desc,const struct nlattr * nla)8632 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
8633 struct nft_data_desc *desc, const struct nlattr *nla)
8634 {
8635 u8 genmask = nft_genmask_next(ctx->net);
8636 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
8637 struct nft_chain *chain;
8638 int err;
8639
8640 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
8641 nft_verdict_policy, NULL);
8642 if (err < 0)
8643 return err;
8644
8645 if (!tb[NFTA_VERDICT_CODE])
8646 return -EINVAL;
8647 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
8648
8649 switch (data->verdict.code) {
8650 default:
8651 switch (data->verdict.code & NF_VERDICT_MASK) {
8652 case NF_ACCEPT:
8653 case NF_DROP:
8654 case NF_QUEUE:
8655 break;
8656 default:
8657 return -EINVAL;
8658 }
8659 fallthrough;
8660 case NFT_CONTINUE:
8661 case NFT_BREAK:
8662 case NFT_RETURN:
8663 break;
8664 case NFT_JUMP:
8665 case NFT_GOTO:
8666 if (tb[NFTA_VERDICT_CHAIN]) {
8667 chain = nft_chain_lookup(ctx->net, ctx->table,
8668 tb[NFTA_VERDICT_CHAIN],
8669 genmask);
8670 } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
8671 chain = nft_chain_lookup_byid(ctx->net, ctx->table,
8672 tb[NFTA_VERDICT_CHAIN_ID]);
8673 if (IS_ERR(chain))
8674 return PTR_ERR(chain);
8675 } else {
8676 return -EINVAL;
8677 }
8678
8679 if (IS_ERR(chain))
8680 return PTR_ERR(chain);
8681 if (nft_is_base_chain(chain))
8682 return -EOPNOTSUPP;
8683 if (nft_chain_is_bound(chain))
8684 return -EINVAL;
8685 if (desc->flags & NFT_DATA_DESC_SETELEM &&
8686 chain->flags & NFT_CHAIN_BINDING)
8687 return -EINVAL;
8688
8689 chain->use++;
8690 data->verdict.chain = chain;
8691 break;
8692 }
8693
8694 desc->len = sizeof(data->verdict);
8695
8696 return 0;
8697 }
8698
nft_verdict_uninit(const struct nft_data * data)8699 static void nft_verdict_uninit(const struct nft_data *data)
8700 {
8701 struct nft_chain *chain;
8702 struct nft_rule *rule;
8703
8704 switch (data->verdict.code) {
8705 case NFT_JUMP:
8706 case NFT_GOTO:
8707 chain = data->verdict.chain;
8708 chain->use--;
8709
8710 if (!nft_chain_is_bound(chain))
8711 break;
8712
8713 chain->table->use--;
8714 list_for_each_entry(rule, &chain->rules, list)
8715 chain->use--;
8716
8717 nft_chain_del(chain);
8718 break;
8719 }
8720 }
8721
nft_verdict_dump(struct sk_buff * skb,int type,const struct nft_verdict * v)8722 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
8723 {
8724 struct nlattr *nest;
8725
8726 nest = nla_nest_start_noflag(skb, type);
8727 if (!nest)
8728 goto nla_put_failure;
8729
8730 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
8731 goto nla_put_failure;
8732
8733 switch (v->code) {
8734 case NFT_JUMP:
8735 case NFT_GOTO:
8736 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
8737 v->chain->name))
8738 goto nla_put_failure;
8739 }
8740 nla_nest_end(skb, nest);
8741 return 0;
8742
8743 nla_put_failure:
8744 return -1;
8745 }
8746
nft_value_init(const struct nft_ctx * ctx,struct nft_data * data,struct nft_data_desc * desc,const struct nlattr * nla)8747 static int nft_value_init(const struct nft_ctx *ctx,
8748 struct nft_data *data, struct nft_data_desc *desc,
8749 const struct nlattr *nla)
8750 {
8751 unsigned int len;
8752
8753 len = nla_len(nla);
8754 if (len == 0)
8755 return -EINVAL;
8756 if (len > desc->size)
8757 return -EOVERFLOW;
8758 if (desc->len) {
8759 if (len != desc->len)
8760 return -EINVAL;
8761 } else {
8762 desc->len = len;
8763 }
8764
8765 nla_memcpy(data->data, nla, len);
8766
8767 return 0;
8768 }
8769
nft_value_dump(struct sk_buff * skb,const struct nft_data * data,unsigned int len)8770 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
8771 unsigned int len)
8772 {
8773 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
8774 }
8775
8776 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
8777 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
8778 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
8779 };
8780
8781 /**
8782 * nft_data_init - parse nf_tables data netlink attributes
8783 *
8784 * @ctx: context of the expression using the data
8785 * @data: destination struct nft_data
8786 * @desc: data description
8787 * @nla: netlink attribute containing data
8788 *
8789 * Parse the netlink data attributes and initialize a struct nft_data.
8790 * The type and length of data are returned in the data description.
8791 *
8792 * The caller can indicate that it only wants to accept data of type
8793 * NFT_DATA_VALUE by passing NULL for the ctx argument.
8794 */
nft_data_init(const struct nft_ctx * ctx,struct nft_data * data,struct nft_data_desc * desc,const struct nlattr * nla)8795 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
8796 struct nft_data_desc *desc, const struct nlattr *nla)
8797 {
8798 struct nlattr *tb[NFTA_DATA_MAX + 1];
8799 int err;
8800
8801 if (WARN_ON_ONCE(!desc->size))
8802 return -EINVAL;
8803
8804 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
8805 nft_data_policy, NULL);
8806 if (err < 0)
8807 return err;
8808
8809 if (tb[NFTA_DATA_VALUE]) {
8810 if (desc->type != NFT_DATA_VALUE)
8811 return -EINVAL;
8812
8813 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]);
8814 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) {
8815 if (desc->type != NFT_DATA_VERDICT)
8816 return -EINVAL;
8817
8818 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
8819 } else {
8820 err = -EINVAL;
8821 }
8822
8823 return err;
8824 }
8825 EXPORT_SYMBOL_GPL(nft_data_init);
8826
8827 /**
8828 * nft_data_release - release a nft_data item
8829 *
8830 * @data: struct nft_data to release
8831 * @type: type of data
8832 *
8833 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
8834 * all others need to be released by calling this function.
8835 */
nft_data_release(const struct nft_data * data,enum nft_data_types type)8836 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
8837 {
8838 if (type < NFT_DATA_VERDICT)
8839 return;
8840 switch (type) {
8841 case NFT_DATA_VERDICT:
8842 return nft_verdict_uninit(data);
8843 default:
8844 WARN_ON(1);
8845 }
8846 }
8847 EXPORT_SYMBOL_GPL(nft_data_release);
8848
nft_data_dump(struct sk_buff * skb,int attr,const struct nft_data * data,enum nft_data_types type,unsigned int len)8849 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
8850 enum nft_data_types type, unsigned int len)
8851 {
8852 struct nlattr *nest;
8853 int err;
8854
8855 nest = nla_nest_start_noflag(skb, attr);
8856 if (nest == NULL)
8857 return -1;
8858
8859 switch (type) {
8860 case NFT_DATA_VALUE:
8861 err = nft_value_dump(skb, data, len);
8862 break;
8863 case NFT_DATA_VERDICT:
8864 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
8865 break;
8866 default:
8867 err = -EINVAL;
8868 WARN_ON(1);
8869 }
8870
8871 nla_nest_end(skb, nest);
8872 return err;
8873 }
8874 EXPORT_SYMBOL_GPL(nft_data_dump);
8875
__nft_release_basechain(struct nft_ctx * ctx)8876 int __nft_release_basechain(struct nft_ctx *ctx)
8877 {
8878 struct nft_rule *rule, *nr;
8879
8880 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
8881 return 0;
8882
8883 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
8884 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
8885 list_del(&rule->list);
8886 ctx->chain->use--;
8887 nf_tables_rule_release(ctx, rule);
8888 }
8889 nft_chain_del(ctx->chain);
8890 ctx->table->use--;
8891 nf_tables_chain_destroy(ctx);
8892
8893 return 0;
8894 }
8895 EXPORT_SYMBOL_GPL(__nft_release_basechain);
8896
__nft_release_hooks(struct net * net)8897 static void __nft_release_hooks(struct net *net)
8898 {
8899 struct nft_table *table;
8900 struct nft_chain *chain;
8901
8902 list_for_each_entry(table, &net->nft.tables, list) {
8903 list_for_each_entry(chain, &table->chains, list)
8904 nf_tables_unregister_hook(net, table, chain);
8905 }
8906 }
8907
__nft_release_tables(struct net * net)8908 static void __nft_release_tables(struct net *net)
8909 {
8910 struct nft_flowtable *flowtable, *nf;
8911 struct nft_table *table, *nt;
8912 struct nft_chain *chain, *nc;
8913 struct nft_object *obj, *ne;
8914 struct nft_rule *rule, *nr;
8915 struct nft_set *set, *ns;
8916 struct nft_ctx ctx = {
8917 .net = net,
8918 .family = NFPROTO_NETDEV,
8919 };
8920
8921 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
8922 ctx.family = table->family;
8923 ctx.table = table;
8924 list_for_each_entry(chain, &table->chains, list) {
8925 ctx.chain = chain;
8926 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
8927 list_del(&rule->list);
8928 chain->use--;
8929 nf_tables_rule_release(&ctx, rule);
8930 }
8931 }
8932 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
8933 list_del(&flowtable->list);
8934 table->use--;
8935 nf_tables_flowtable_destroy(flowtable);
8936 }
8937 list_for_each_entry_safe(set, ns, &table->sets, list) {
8938 list_del(&set->list);
8939 table->use--;
8940 nft_set_destroy(&ctx, set);
8941 }
8942 list_for_each_entry_safe(obj, ne, &table->objects, list) {
8943 nft_obj_del(obj);
8944 table->use--;
8945 nft_obj_destroy(&ctx, obj);
8946 }
8947 list_for_each_entry_safe(chain, nc, &table->chains, list) {
8948 ctx.chain = chain;
8949 nft_chain_del(chain);
8950 table->use--;
8951 nf_tables_chain_destroy(&ctx);
8952 }
8953 list_del(&table->list);
8954 nf_tables_table_destroy(&ctx);
8955 }
8956 }
8957
nf_tables_init_net(struct net * net)8958 static int __net_init nf_tables_init_net(struct net *net)
8959 {
8960 INIT_LIST_HEAD(&net->nft.tables);
8961 INIT_LIST_HEAD(&net->nft.commit_list);
8962 INIT_LIST_HEAD(&net->nft.module_list);
8963 INIT_LIST_HEAD(&net->nft.notify_list);
8964 mutex_init(&net->nft.commit_mutex);
8965 net->nft.base_seq = 1;
8966 net->nft.validate_state = NFT_VALIDATE_SKIP;
8967
8968 return 0;
8969 }
8970
nf_tables_pre_exit_net(struct net * net)8971 static void __net_exit nf_tables_pre_exit_net(struct net *net)
8972 {
8973 __nft_release_hooks(net);
8974 }
8975
nf_tables_exit_net(struct net * net)8976 static void __net_exit nf_tables_exit_net(struct net *net)
8977 {
8978 mutex_lock(&net->nft.commit_mutex);
8979 if (!list_empty(&net->nft.commit_list))
8980 __nf_tables_abort(net, NFNL_ABORT_NONE);
8981 __nft_release_tables(net);
8982 mutex_unlock(&net->nft.commit_mutex);
8983 WARN_ON_ONCE(!list_empty(&net->nft.tables));
8984 WARN_ON_ONCE(!list_empty(&net->nft.module_list));
8985 WARN_ON_ONCE(!list_empty(&net->nft.notify_list));
8986 }
8987
8988 static struct pernet_operations nf_tables_net_ops = {
8989 .init = nf_tables_init_net,
8990 .pre_exit = nf_tables_pre_exit_net,
8991 .exit = nf_tables_exit_net,
8992 };
8993
nf_tables_module_init(void)8994 static int __init nf_tables_module_init(void)
8995 {
8996 int err;
8997
8998 spin_lock_init(&nf_tables_destroy_list_lock);
8999 err = register_pernet_subsys(&nf_tables_net_ops);
9000 if (err < 0)
9001 return err;
9002
9003 err = nft_chain_filter_init();
9004 if (err < 0)
9005 goto err1;
9006
9007 err = nf_tables_core_module_init();
9008 if (err < 0)
9009 goto err2;
9010
9011 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
9012 if (err < 0)
9013 goto err3;
9014
9015 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
9016 if (err < 0)
9017 goto err4;
9018
9019 err = nft_offload_init();
9020 if (err < 0)
9021 goto err5;
9022
9023 /* must be last */
9024 err = nfnetlink_subsys_register(&nf_tables_subsys);
9025 if (err < 0)
9026 goto err6;
9027
9028 nft_chain_route_init();
9029
9030 return err;
9031 err6:
9032 nft_offload_exit();
9033 err5:
9034 rhltable_destroy(&nft_objname_ht);
9035 err4:
9036 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
9037 err3:
9038 nf_tables_core_module_exit();
9039 err2:
9040 nft_chain_filter_fini();
9041 err1:
9042 unregister_pernet_subsys(&nf_tables_net_ops);
9043 return err;
9044 }
9045
nf_tables_module_exit(void)9046 static void __exit nf_tables_module_exit(void)
9047 {
9048 nfnetlink_subsys_unregister(&nf_tables_subsys);
9049 nft_offload_exit();
9050 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
9051 nft_chain_filter_fini();
9052 nft_chain_route_fini();
9053 unregister_pernet_subsys(&nf_tables_net_ops);
9054 cancel_work_sync(&trans_destroy_work);
9055 rcu_barrier();
9056 rhltable_destroy(&nft_objname_ht);
9057 nf_tables_core_module_exit();
9058 }
9059
9060 module_init(nf_tables_module_init);
9061 module_exit(nf_tables_module_exit);
9062
9063 MODULE_LICENSE("GPL");
9064 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
9065 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
9066