• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  *
8  * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
9  */
10 
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <linux/netfilter/nf_tables_compat.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22 #include <net/netfilter/nf_tables.h>
23 
nft_compat_chain_validate_dependency(const char * tablename,const struct nft_chain * chain)24 static int nft_compat_chain_validate_dependency(const char *tablename,
25 						const struct nft_chain *chain)
26 {
27 	const struct nft_base_chain *basechain;
28 
29 	if (!tablename || !(chain->flags & NFT_BASE_CHAIN))
30 		return 0;
31 
32 	basechain = nft_base_chain(chain);
33 	if (strcmp(tablename, "nat") == 0 &&
34 	    basechain->type->type != NFT_CHAIN_T_NAT)
35 		return -EINVAL;
36 
37 	return 0;
38 }
39 
40 union nft_entry {
41 	struct ipt_entry e4;
42 	struct ip6t_entry e6;
43 };
44 
45 static inline void
nft_compat_set_par(struct xt_action_param * par,void * xt,const void * xt_info)46 nft_compat_set_par(struct xt_action_param *par, void *xt, const void *xt_info)
47 {
48 	par->target	= xt;
49 	par->targinfo	= xt_info;
50 	par->hotdrop	= false;
51 }
52 
nft_target_eval(const struct nft_expr * expr,struct nft_data data[NFT_REG_MAX+1],const struct nft_pktinfo * pkt)53 static void nft_target_eval(const struct nft_expr *expr,
54 			    struct nft_data data[NFT_REG_MAX + 1],
55 			    const struct nft_pktinfo *pkt)
56 {
57 	void *info = nft_expr_priv(expr);
58 	struct xt_target *target = expr->ops->data;
59 	struct sk_buff *skb = pkt->skb;
60 	int ret;
61 
62 	nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info);
63 
64 	ret = target->target(skb, &pkt->xt);
65 
66 	if (pkt->xt.hotdrop)
67 		ret = NF_DROP;
68 
69 	switch(ret) {
70 	case XT_CONTINUE:
71 		data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
72 		break;
73 	default:
74 		data[NFT_REG_VERDICT].verdict = ret;
75 		break;
76 	}
77 	return;
78 }
79 
80 static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = {
81 	[NFTA_TARGET_NAME]	= { .type = NLA_NUL_STRING },
82 	[NFTA_TARGET_REV]	= { .type = NLA_U32 },
83 	[NFTA_TARGET_INFO]	= { .type = NLA_BINARY },
84 };
85 
86 static void
nft_target_set_tgchk_param(struct xt_tgchk_param * par,const struct nft_ctx * ctx,struct xt_target * target,void * info,union nft_entry * entry,u8 proto,bool inv)87 nft_target_set_tgchk_param(struct xt_tgchk_param *par,
88 			   const struct nft_ctx *ctx,
89 			   struct xt_target *target, void *info,
90 			   union nft_entry *entry, u8 proto, bool inv)
91 {
92 	par->net	= ctx->net;
93 	par->table	= ctx->table->name;
94 	switch (ctx->afi->family) {
95 	case AF_INET:
96 		entry->e4.ip.proto = proto;
97 		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
98 		break;
99 	case AF_INET6:
100 		if (proto)
101 			entry->e6.ipv6.flags |= IP6T_F_PROTO;
102 
103 		entry->e6.ipv6.proto = proto;
104 		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
105 		break;
106 	}
107 	par->entryinfo	= entry;
108 	par->target	= target;
109 	par->targinfo	= info;
110 	if (ctx->chain->flags & NFT_BASE_CHAIN) {
111 		const struct nft_base_chain *basechain =
112 						nft_base_chain(ctx->chain);
113 		const struct nf_hook_ops *ops = &basechain->ops[0];
114 
115 		par->hook_mask = 1 << ops->hooknum;
116 	} else {
117 		par->hook_mask = 0;
118 	}
119 	par->family	= ctx->afi->family;
120 }
121 
target_compat_from_user(struct xt_target * t,void * in,void * out)122 static void target_compat_from_user(struct xt_target *t, void *in, void *out)
123 {
124 	int pad;
125 
126 	memcpy(out, in, t->targetsize);
127 	pad = XT_ALIGN(t->targetsize) - t->targetsize;
128 	if (pad > 0)
129 		memset(out + t->targetsize, 0, pad);
130 }
131 
132 static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = {
133 	[NFTA_RULE_COMPAT_PROTO]	= { .type = NLA_U32 },
134 	[NFTA_RULE_COMPAT_FLAGS]	= { .type = NLA_U32 },
135 };
136 
nft_parse_compat(const struct nlattr * attr,u8 * proto,bool * inv)137 static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
138 {
139 	struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
140 	u32 flags;
141 	int err;
142 
143 	err = nla_parse_nested(tb, NFTA_RULE_COMPAT_MAX, attr,
144 			       nft_rule_compat_policy);
145 	if (err < 0)
146 		return err;
147 
148 	if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS])
149 		return -EINVAL;
150 
151 	flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS]));
152 	if (flags & ~NFT_RULE_COMPAT_F_MASK)
153 		return -EINVAL;
154 	if (flags & NFT_RULE_COMPAT_F_INV)
155 		*inv = true;
156 
157 	*proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
158 	return 0;
159 }
160 
161 static int
nft_target_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])162 nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
163 		const struct nlattr * const tb[])
164 {
165 	void *info = nft_expr_priv(expr);
166 	struct xt_target *target = expr->ops->data;
167 	struct xt_tgchk_param par;
168 	size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
169 	u8 proto = 0;
170 	bool inv = false;
171 	union nft_entry e = {};
172 	int ret;
173 
174 	ret = nft_compat_chain_validate_dependency(target->table, ctx->chain);
175 	if (ret < 0)
176 		goto err;
177 
178 	target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
179 
180 	if (ctx->nla[NFTA_RULE_COMPAT]) {
181 		ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
182 		if (ret < 0)
183 			goto err;
184 	}
185 
186 	nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
187 
188 	ret = xt_check_target(&par, size, proto, inv);
189 	if (ret < 0)
190 		goto err;
191 
192 	/* The standard target cannot be used */
193 	if (target->target == NULL) {
194 		ret = -EINVAL;
195 		goto err;
196 	}
197 
198 	return 0;
199 err:
200 	module_put(target->me);
201 	return ret;
202 }
203 
204 static void
nft_target_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)205 nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
206 {
207 	struct xt_target *target = expr->ops->data;
208 	void *info = nft_expr_priv(expr);
209 	struct xt_tgdtor_param par;
210 
211 	par.net = ctx->net;
212 	par.target = target;
213 	par.targinfo = info;
214 	par.family = ctx->afi->family;
215 	if (par.target->destroy != NULL)
216 		par.target->destroy(&par);
217 
218 	module_put(target->me);
219 }
220 
nft_target_dump(struct sk_buff * skb,const struct nft_expr * expr)221 static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)
222 {
223 	const struct xt_target *target = expr->ops->data;
224 	void *info = nft_expr_priv(expr);
225 
226 	if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) ||
227 	    nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) ||
228 	    nla_put(skb, NFTA_TARGET_INFO, XT_ALIGN(target->targetsize), info))
229 		goto nla_put_failure;
230 
231 	return 0;
232 
233 nla_put_failure:
234 	return -1;
235 }
236 
nft_target_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)237 static int nft_target_validate(const struct nft_ctx *ctx,
238 			       const struct nft_expr *expr,
239 			       const struct nft_data **data)
240 {
241 	struct xt_target *target = expr->ops->data;
242 	unsigned int hook_mask = 0;
243 	int ret;
244 
245 	if (ctx->chain->flags & NFT_BASE_CHAIN) {
246 		const struct nft_base_chain *basechain =
247 						nft_base_chain(ctx->chain);
248 		const struct nf_hook_ops *ops = &basechain->ops[0];
249 
250 		hook_mask = 1 << ops->hooknum;
251 		if (!(hook_mask & target->hooks))
252 			return -EINVAL;
253 
254 		ret = nft_compat_chain_validate_dependency(target->table,
255 							   ctx->chain);
256 		if (ret < 0)
257 			return ret;
258 	}
259 	return 0;
260 }
261 
nft_match_eval(const struct nft_expr * expr,struct nft_data data[NFT_REG_MAX+1],const struct nft_pktinfo * pkt)262 static void nft_match_eval(const struct nft_expr *expr,
263 			   struct nft_data data[NFT_REG_MAX + 1],
264 			   const struct nft_pktinfo *pkt)
265 {
266 	void *info = nft_expr_priv(expr);
267 	struct xt_match *match = expr->ops->data;
268 	struct sk_buff *skb = pkt->skb;
269 	bool ret;
270 
271 	nft_compat_set_par((struct xt_action_param *)&pkt->xt, match, info);
272 
273 	ret = match->match(skb, (struct xt_action_param *)&pkt->xt);
274 
275 	if (pkt->xt.hotdrop) {
276 		data[NFT_REG_VERDICT].verdict = NF_DROP;
277 		return;
278 	}
279 
280 	switch (ret ? 1 : 0) {
281 	case 1:
282 		data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
283 		break;
284 	case 0:
285 		data[NFT_REG_VERDICT].verdict = NFT_BREAK;
286 		break;
287 	}
288 }
289 
290 static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
291 	[NFTA_MATCH_NAME]	= { .type = NLA_NUL_STRING },
292 	[NFTA_MATCH_REV]	= { .type = NLA_U32 },
293 	[NFTA_MATCH_INFO]	= { .type = NLA_BINARY },
294 };
295 
296 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
297 static void
nft_match_set_mtchk_param(struct xt_mtchk_param * par,const struct nft_ctx * ctx,struct xt_match * match,void * info,union nft_entry * entry,u8 proto,bool inv)298 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
299 			  struct xt_match *match, void *info,
300 			  union nft_entry *entry, u8 proto, bool inv)
301 {
302 	par->net	= ctx->net;
303 	par->table	= ctx->table->name;
304 	switch (ctx->afi->family) {
305 	case AF_INET:
306 		entry->e4.ip.proto = proto;
307 		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
308 		break;
309 	case AF_INET6:
310 		if (proto)
311 			entry->e6.ipv6.flags |= IP6T_F_PROTO;
312 
313 		entry->e6.ipv6.proto = proto;
314 		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
315 		break;
316 	}
317 	par->entryinfo	= entry;
318 	par->match	= match;
319 	par->matchinfo	= info;
320 	if (ctx->chain->flags & NFT_BASE_CHAIN) {
321 		const struct nft_base_chain *basechain =
322 						nft_base_chain(ctx->chain);
323 		const struct nf_hook_ops *ops = &basechain->ops[0];
324 
325 		par->hook_mask = 1 << ops->hooknum;
326 	} else {
327 		par->hook_mask = 0;
328 	}
329 	par->family	= ctx->afi->family;
330 }
331 
match_compat_from_user(struct xt_match * m,void * in,void * out)332 static void match_compat_from_user(struct xt_match *m, void *in, void *out)
333 {
334 	int pad;
335 
336 	memcpy(out, in, m->matchsize);
337 	pad = XT_ALIGN(m->matchsize) - m->matchsize;
338 	if (pad > 0)
339 		memset(out + m->matchsize, 0, pad);
340 }
341 
342 static int
nft_match_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])343 nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
344 		const struct nlattr * const tb[])
345 {
346 	void *info = nft_expr_priv(expr);
347 	struct xt_match *match = expr->ops->data;
348 	struct xt_mtchk_param par;
349 	size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
350 	u8 proto = 0;
351 	bool inv = false;
352 	union nft_entry e = {};
353 	int ret;
354 
355 	ret = nft_compat_chain_validate_dependency(match->table, ctx->chain);
356 	if (ret < 0)
357 		goto err;
358 
359 	match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
360 
361 	if (ctx->nla[NFTA_RULE_COMPAT]) {
362 		ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
363 		if (ret < 0)
364 			goto err;
365 	}
366 
367 	nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
368 
369 	ret = xt_check_match(&par, size, proto, inv);
370 	if (ret < 0)
371 		goto err;
372 
373 	return 0;
374 err:
375 	module_put(match->me);
376 	return ret;
377 }
378 
379 static void
nft_match_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)380 nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
381 {
382 	struct xt_match *match = expr->ops->data;
383 	void *info = nft_expr_priv(expr);
384 	struct xt_mtdtor_param par;
385 
386 	par.net = ctx->net;
387 	par.match = match;
388 	par.matchinfo = info;
389 	par.family = ctx->afi->family;
390 	if (par.match->destroy != NULL)
391 		par.match->destroy(&par);
392 
393 	module_put(match->me);
394 }
395 
nft_match_dump(struct sk_buff * skb,const struct nft_expr * expr)396 static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr)
397 {
398 	void *info = nft_expr_priv(expr);
399 	struct xt_match *match = expr->ops->data;
400 
401 	if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) ||
402 	    nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) ||
403 	    nla_put(skb, NFTA_MATCH_INFO, XT_ALIGN(match->matchsize), info))
404 		goto nla_put_failure;
405 
406 	return 0;
407 
408 nla_put_failure:
409 	return -1;
410 }
411 
nft_match_validate(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nft_data ** data)412 static int nft_match_validate(const struct nft_ctx *ctx,
413 			      const struct nft_expr *expr,
414 			      const struct nft_data **data)
415 {
416 	struct xt_match *match = expr->ops->data;
417 	unsigned int hook_mask = 0;
418 	int ret;
419 
420 	if (ctx->chain->flags & NFT_BASE_CHAIN) {
421 		const struct nft_base_chain *basechain =
422 						nft_base_chain(ctx->chain);
423 		const struct nf_hook_ops *ops = &basechain->ops[0];
424 
425 		hook_mask = 1 << ops->hooknum;
426 		if (!(hook_mask & match->hooks))
427 			return -EINVAL;
428 
429 		ret = nft_compat_chain_validate_dependency(match->table,
430 							   ctx->chain);
431 		if (ret < 0)
432 			return ret;
433 	}
434 	return 0;
435 }
436 
437 static int
nfnl_compat_fill_info(struct sk_buff * skb,u32 portid,u32 seq,u32 type,int event,u16 family,const char * name,int rev,int target)438 nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
439 		      int event, u16 family, const char *name,
440 		      int rev, int target)
441 {
442 	struct nlmsghdr *nlh;
443 	struct nfgenmsg *nfmsg;
444 	unsigned int flags = portid ? NLM_F_MULTI : 0;
445 
446 	event |= NFNL_SUBSYS_NFT_COMPAT << 8;
447 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
448 	if (nlh == NULL)
449 		goto nlmsg_failure;
450 
451 	nfmsg = nlmsg_data(nlh);
452 	nfmsg->nfgen_family = family;
453 	nfmsg->version = NFNETLINK_V0;
454 	nfmsg->res_id = 0;
455 
456 	if (nla_put_string(skb, NFTA_COMPAT_NAME, name) ||
457 	    nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) ||
458 	    nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target)))
459 		goto nla_put_failure;
460 
461 	nlmsg_end(skb, nlh);
462 	return skb->len;
463 
464 nlmsg_failure:
465 nla_put_failure:
466 	nlmsg_cancel(skb, nlh);
467 	return -1;
468 }
469 
470 static int
nfnl_compat_get(struct sock * nfnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const tb[])471 nfnl_compat_get(struct sock *nfnl, struct sk_buff *skb,
472 		const struct nlmsghdr *nlh, const struct nlattr * const tb[])
473 {
474 	int ret = 0, target;
475 	struct nfgenmsg *nfmsg;
476 	const char *fmt;
477 	const char *name;
478 	u32 rev;
479 	struct sk_buff *skb2;
480 
481 	if (tb[NFTA_COMPAT_NAME] == NULL ||
482 	    tb[NFTA_COMPAT_REV] == NULL ||
483 	    tb[NFTA_COMPAT_TYPE] == NULL)
484 		return -EINVAL;
485 
486 	name = nla_data(tb[NFTA_COMPAT_NAME]);
487 	rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV]));
488 	target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE]));
489 
490 	nfmsg = nlmsg_data(nlh);
491 
492 	switch(nfmsg->nfgen_family) {
493 	case AF_INET:
494 		fmt = "ipt_%s";
495 		break;
496 	case AF_INET6:
497 		fmt = "ip6t_%s";
498 		break;
499 	default:
500 		pr_err("nft_compat: unsupported protocol %d\n",
501 			nfmsg->nfgen_family);
502 		return -EINVAL;
503 	}
504 
505 	try_then_request_module(xt_find_revision(nfmsg->nfgen_family, name,
506 						 rev, target, &ret),
507 						 fmt, name);
508 
509 	if (ret < 0)
510 		return ret;
511 
512 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
513 	if (skb2 == NULL)
514 		return -ENOMEM;
515 
516 	/* include the best revision for this extension in the message */
517 	if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid,
518 				  nlh->nlmsg_seq,
519 				  NFNL_MSG_TYPE(nlh->nlmsg_type),
520 				  NFNL_MSG_COMPAT_GET,
521 				  nfmsg->nfgen_family,
522 				  name, ret, target) <= 0) {
523 		kfree_skb(skb2);
524 		return -ENOSPC;
525 	}
526 
527 	ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
528 				MSG_DONTWAIT);
529 	if (ret > 0)
530 		ret = 0;
531 
532 	return ret == -EAGAIN ? -ENOBUFS : ret;
533 }
534 
535 static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = {
536 	[NFTA_COMPAT_NAME]	= { .type = NLA_NUL_STRING,
537 				    .len = NFT_COMPAT_NAME_MAX-1 },
538 	[NFTA_COMPAT_REV]	= { .type = NLA_U32 },
539 	[NFTA_COMPAT_TYPE]	= { .type = NLA_U32 },
540 };
541 
542 static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = {
543 	[NFNL_MSG_COMPAT_GET]		= { .call = nfnl_compat_get,
544 					    .attr_count = NFTA_COMPAT_MAX,
545 					    .policy = nfnl_compat_policy_get },
546 };
547 
548 static const struct nfnetlink_subsystem nfnl_compat_subsys = {
549 	.name		= "nft-compat",
550 	.subsys_id	= NFNL_SUBSYS_NFT_COMPAT,
551 	.cb_count	= NFNL_MSG_COMPAT_MAX,
552 	.cb		= nfnl_nft_compat_cb,
553 };
554 
555 static LIST_HEAD(nft_match_list);
556 
557 struct nft_xt {
558 	struct list_head	head;
559 	struct nft_expr_ops	ops;
560 };
561 
562 static struct nft_expr_type nft_match_type;
563 
nft_match_cmp(const struct xt_match * match,const char * name,u32 rev,u32 family)564 static bool nft_match_cmp(const struct xt_match *match,
565 			  const char *name, u32 rev, u32 family)
566 {
567 	return strcmp(match->name, name) == 0 && match->revision == rev &&
568 	       (match->family == NFPROTO_UNSPEC || match->family == family);
569 }
570 
571 static const struct nft_expr_ops *
nft_match_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])572 nft_match_select_ops(const struct nft_ctx *ctx,
573 		     const struct nlattr * const tb[])
574 {
575 	struct nft_xt *nft_match;
576 	struct xt_match *match;
577 	char *mt_name;
578 	u32 rev, family;
579 
580 	if (tb[NFTA_MATCH_NAME] == NULL ||
581 	    tb[NFTA_MATCH_REV] == NULL ||
582 	    tb[NFTA_MATCH_INFO] == NULL)
583 		return ERR_PTR(-EINVAL);
584 
585 	mt_name = nla_data(tb[NFTA_MATCH_NAME]);
586 	rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
587 	family = ctx->afi->family;
588 
589 	/* Re-use the existing match if it's already loaded. */
590 	list_for_each_entry(nft_match, &nft_match_list, head) {
591 		struct xt_match *match = nft_match->ops.data;
592 
593 		if (nft_match_cmp(match, mt_name, rev, family)) {
594 			if (!try_module_get(match->me))
595 				return ERR_PTR(-ENOENT);
596 
597 			return &nft_match->ops;
598 		}
599 	}
600 
601 	match = xt_request_find_match(family, mt_name, rev);
602 	if (IS_ERR(match))
603 		return ERR_PTR(-ENOENT);
604 
605 	/* This is the first time we use this match, allocate operations */
606 	nft_match = kzalloc(sizeof(struct nft_xt), GFP_KERNEL);
607 	if (nft_match == NULL)
608 		return ERR_PTR(-ENOMEM);
609 
610 	nft_match->ops.type = &nft_match_type;
611 	nft_match->ops.size = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
612 	nft_match->ops.eval = nft_match_eval;
613 	nft_match->ops.init = nft_match_init;
614 	nft_match->ops.destroy = nft_match_destroy;
615 	nft_match->ops.dump = nft_match_dump;
616 	nft_match->ops.validate = nft_match_validate;
617 	nft_match->ops.data = match;
618 
619 	list_add(&nft_match->head, &nft_match_list);
620 
621 	return &nft_match->ops;
622 }
623 
nft_match_release(void)624 static void nft_match_release(void)
625 {
626 	struct nft_xt *nft_match, *tmp;
627 
628 	list_for_each_entry_safe(nft_match, tmp, &nft_match_list, head)
629 		kfree(nft_match);
630 }
631 
632 static struct nft_expr_type nft_match_type __read_mostly = {
633 	.name		= "match",
634 	.select_ops	= nft_match_select_ops,
635 	.policy		= nft_match_policy,
636 	.maxattr	= NFTA_MATCH_MAX,
637 	.owner		= THIS_MODULE,
638 };
639 
640 static LIST_HEAD(nft_target_list);
641 
642 static struct nft_expr_type nft_target_type;
643 
nft_target_cmp(const struct xt_target * tg,const char * name,u32 rev,u32 family)644 static bool nft_target_cmp(const struct xt_target *tg,
645 			   const char *name, u32 rev, u32 family)
646 {
647 	return strcmp(tg->name, name) == 0 && tg->revision == rev &&
648 	       (tg->family == NFPROTO_UNSPEC || tg->family == family);
649 }
650 
651 static const struct nft_expr_ops *
nft_target_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])652 nft_target_select_ops(const struct nft_ctx *ctx,
653 		      const struct nlattr * const tb[])
654 {
655 	struct nft_xt *nft_target;
656 	struct xt_target *target;
657 	char *tg_name;
658 	u32 rev, family;
659 
660 	if (tb[NFTA_TARGET_NAME] == NULL ||
661 	    tb[NFTA_TARGET_REV] == NULL ||
662 	    tb[NFTA_TARGET_INFO] == NULL)
663 		return ERR_PTR(-EINVAL);
664 
665 	tg_name = nla_data(tb[NFTA_TARGET_NAME]);
666 	rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
667 	family = ctx->afi->family;
668 
669 	/* Re-use the existing target if it's already loaded. */
670 	list_for_each_entry(nft_target, &nft_target_list, head) {
671 		struct xt_target *target = nft_target->ops.data;
672 
673 		if (nft_target_cmp(target, tg_name, rev, family)) {
674 			if (!try_module_get(target->me))
675 				return ERR_PTR(-ENOENT);
676 
677 			return &nft_target->ops;
678 		}
679 	}
680 
681 	target = xt_request_find_target(family, tg_name, rev);
682 	if (IS_ERR(target))
683 		return ERR_PTR(-ENOENT);
684 
685 	/* This is the first time we use this target, allocate operations */
686 	nft_target = kzalloc(sizeof(struct nft_xt), GFP_KERNEL);
687 	if (nft_target == NULL)
688 		return ERR_PTR(-ENOMEM);
689 
690 	nft_target->ops.type = &nft_target_type;
691 	nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
692 	nft_target->ops.eval = nft_target_eval;
693 	nft_target->ops.init = nft_target_init;
694 	nft_target->ops.destroy = nft_target_destroy;
695 	nft_target->ops.dump = nft_target_dump;
696 	nft_target->ops.validate = nft_target_validate;
697 	nft_target->ops.data = target;
698 
699 	list_add(&nft_target->head, &nft_target_list);
700 
701 	return &nft_target->ops;
702 }
703 
nft_target_release(void)704 static void nft_target_release(void)
705 {
706 	struct nft_xt *nft_target, *tmp;
707 
708 	list_for_each_entry_safe(nft_target, tmp, &nft_target_list, head)
709 		kfree(nft_target);
710 }
711 
712 static struct nft_expr_type nft_target_type __read_mostly = {
713 	.name		= "target",
714 	.select_ops	= nft_target_select_ops,
715 	.policy		= nft_target_policy,
716 	.maxattr	= NFTA_TARGET_MAX,
717 	.owner		= THIS_MODULE,
718 };
719 
nft_compat_module_init(void)720 static int __init nft_compat_module_init(void)
721 {
722 	int ret;
723 
724 	ret = nft_register_expr(&nft_match_type);
725 	if (ret < 0)
726 		return ret;
727 
728 	ret = nft_register_expr(&nft_target_type);
729 	if (ret < 0)
730 		goto err_match;
731 
732 	ret = nfnetlink_subsys_register(&nfnl_compat_subsys);
733 	if (ret < 0) {
734 		pr_err("nft_compat: cannot register with nfnetlink.\n");
735 		goto err_target;
736 	}
737 
738 	pr_info("nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>\n");
739 
740 	return ret;
741 
742 err_target:
743 	nft_unregister_expr(&nft_target_type);
744 err_match:
745 	nft_unregister_expr(&nft_match_type);
746 	return ret;
747 }
748 
nft_compat_module_exit(void)749 static void __exit nft_compat_module_exit(void)
750 {
751 	nfnetlink_subsys_unregister(&nfnl_compat_subsys);
752 	nft_unregister_expr(&nft_target_type);
753 	nft_unregister_expr(&nft_match_type);
754 	nft_match_release();
755 	nft_target_release();
756 }
757 
758 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
759 
760 module_init(nft_compat_module_init);
761 module_exit(nft_compat_module_exit);
762 
763 MODULE_LICENSE("GPL");
764 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
765 MODULE_ALIAS_NFT_EXPR("match");
766 MODULE_ALIAS_NFT_EXPR("target");
767