1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
4 *
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
6 */
7
8 #include <linux/module.h>
9 #include <linux/init.h>
10 #include <linux/list.h>
11 #include <linux/skbuff.h>
12 #include <linux/netlink.h>
13 #include <linux/vmalloc.h>
14 #include <linux/rhashtable.h>
15 #include <linux/audit.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nfnetlink.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_flow_table.h>
20 #include <net/netfilter/nf_tables_core.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_offload.h>
23 #include <net/net_namespace.h>
24 #include <net/netns/generic.h>
25 #include <net/sock.h>
26
27 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
28 #define NFT_SET_MAX_ANONLEN 16
29
30 unsigned int nf_tables_net_id __read_mostly;
31
32 static LIST_HEAD(nf_tables_expressions);
33 static LIST_HEAD(nf_tables_objects);
34 static LIST_HEAD(nf_tables_flowtables);
35 static LIST_HEAD(nf_tables_destroy_list);
36 static LIST_HEAD(nf_tables_gc_list);
37 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
38 static DEFINE_SPINLOCK(nf_tables_gc_list_lock);
39 static u64 table_handle;
40
41 enum {
42 NFT_VALIDATE_SKIP = 0,
43 NFT_VALIDATE_NEED,
44 NFT_VALIDATE_DO,
45 };
46
47 static struct rhltable nft_objname_ht;
48
49 static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
50 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
51 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
52
53 static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
54 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
55 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
56
57 static const struct rhashtable_params nft_chain_ht_params = {
58 .head_offset = offsetof(struct nft_chain, rhlhead),
59 .key_offset = offsetof(struct nft_chain, name),
60 .hashfn = nft_chain_hash,
61 .obj_hashfn = nft_chain_hash_obj,
62 .obj_cmpfn = nft_chain_hash_cmp,
63 .automatic_shrinking = true,
64 };
65
66 static const struct rhashtable_params nft_objname_ht_params = {
67 .head_offset = offsetof(struct nft_object, rhlhead),
68 .key_offset = offsetof(struct nft_object, key),
69 .hashfn = nft_objname_hash,
70 .obj_hashfn = nft_objname_hash_obj,
71 .obj_cmpfn = nft_objname_hash_cmp,
72 .automatic_shrinking = true,
73 };
74
75 struct nft_audit_data {
76 struct nft_table *table;
77 int entries;
78 int op;
79 struct list_head list;
80 };
81
82 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types
83 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER,
84 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID,
85 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER,
86 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER,
87 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID,
88 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER,
89 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER,
90 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID,
91 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER,
92 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER,
93 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID,
94 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER,
95 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER,
96 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID,
97 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER,
98 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER,
99 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID,
100 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID,
101 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER,
102 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID,
103 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER,
104 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET,
105 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER,
106 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID,
107 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
108 };
109
nft_validate_state_update(struct net * net,u8 new_validate_state)110 static void nft_validate_state_update(struct net *net, u8 new_validate_state)
111 {
112 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
113
114 switch (nft_net->validate_state) {
115 case NFT_VALIDATE_SKIP:
116 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
117 break;
118 case NFT_VALIDATE_NEED:
119 break;
120 case NFT_VALIDATE_DO:
121 if (new_validate_state == NFT_VALIDATE_NEED)
122 return;
123 }
124
125 nft_net->validate_state = new_validate_state;
126 }
127 static void nf_tables_trans_destroy_work(struct work_struct *w);
128 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
129
130 static void nft_trans_gc_work(struct work_struct *work);
131 static DECLARE_WORK(trans_gc_work, nft_trans_gc_work);
132
nft_ctx_init(struct nft_ctx * ctx,struct net * net,const struct sk_buff * skb,const struct nlmsghdr * nlh,u8 family,struct nft_table * table,struct nft_chain * chain,const struct nlattr * const * nla)133 static void nft_ctx_init(struct nft_ctx *ctx,
134 struct net *net,
135 const struct sk_buff *skb,
136 const struct nlmsghdr *nlh,
137 u8 family,
138 struct nft_table *table,
139 struct nft_chain *chain,
140 const struct nlattr * const *nla)
141 {
142 ctx->net = net;
143 ctx->family = family;
144 ctx->level = 0;
145 ctx->table = table;
146 ctx->chain = chain;
147 ctx->nla = nla;
148 ctx->portid = NETLINK_CB(skb).portid;
149 ctx->report = nlmsg_report(nlh);
150 ctx->flags = nlh->nlmsg_flags;
151 ctx->seq = nlh->nlmsg_seq;
152 }
153
nft_trans_alloc_gfp(const struct nft_ctx * ctx,int msg_type,u32 size,gfp_t gfp)154 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
155 int msg_type, u32 size, gfp_t gfp)
156 {
157 struct nft_trans *trans;
158
159 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
160 if (trans == NULL)
161 return NULL;
162
163 INIT_LIST_HEAD(&trans->list);
164 INIT_LIST_HEAD(&trans->binding_list);
165 trans->msg_type = msg_type;
166 trans->ctx = *ctx;
167
168 return trans;
169 }
170
nft_trans_alloc(const struct nft_ctx * ctx,int msg_type,u32 size)171 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
172 int msg_type, u32 size)
173 {
174 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
175 }
176
nft_trans_list_del(struct nft_trans * trans)177 static void nft_trans_list_del(struct nft_trans *trans)
178 {
179 list_del(&trans->list);
180 list_del(&trans->binding_list);
181 }
182
nft_trans_destroy(struct nft_trans * trans)183 static void nft_trans_destroy(struct nft_trans *trans)
184 {
185 nft_trans_list_del(trans);
186 kfree(trans);
187 }
188
__nft_set_trans_bind(const struct nft_ctx * ctx,struct nft_set * set,bool bind)189 static void __nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set,
190 bool bind)
191 {
192 struct nftables_pernet *nft_net;
193 struct net *net = ctx->net;
194 struct nft_trans *trans;
195
196 if (!nft_set_is_anonymous(set))
197 return;
198
199 nft_net = net_generic(net, nf_tables_net_id);
200 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) {
201 switch (trans->msg_type) {
202 case NFT_MSG_NEWSET:
203 if (nft_trans_set(trans) == set)
204 nft_trans_set_bound(trans) = bind;
205 break;
206 case NFT_MSG_NEWSETELEM:
207 if (nft_trans_elem_set(trans) == set)
208 nft_trans_elem_set_bound(trans) = bind;
209 break;
210 }
211 }
212 }
213
nft_set_trans_bind(const struct nft_ctx * ctx,struct nft_set * set)214 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
215 {
216 return __nft_set_trans_bind(ctx, set, true);
217 }
218
nft_set_trans_unbind(const struct nft_ctx * ctx,struct nft_set * set)219 static void nft_set_trans_unbind(const struct nft_ctx *ctx, struct nft_set *set)
220 {
221 return __nft_set_trans_bind(ctx, set, false);
222 }
223
__nft_chain_trans_bind(const struct nft_ctx * ctx,struct nft_chain * chain,bool bind)224 static void __nft_chain_trans_bind(const struct nft_ctx *ctx,
225 struct nft_chain *chain, bool bind)
226 {
227 struct nftables_pernet *nft_net;
228 struct net *net = ctx->net;
229 struct nft_trans *trans;
230
231 if (!nft_chain_binding(chain))
232 return;
233
234 nft_net = net_generic(net, nf_tables_net_id);
235 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) {
236 switch (trans->msg_type) {
237 case NFT_MSG_NEWCHAIN:
238 if (nft_trans_chain(trans) == chain)
239 nft_trans_chain_bound(trans) = bind;
240 break;
241 case NFT_MSG_NEWRULE:
242 if (trans->ctx.chain == chain)
243 nft_trans_rule_bound(trans) = bind;
244 break;
245 }
246 }
247 }
248
nft_chain_trans_bind(const struct nft_ctx * ctx,struct nft_chain * chain)249 static void nft_chain_trans_bind(const struct nft_ctx *ctx,
250 struct nft_chain *chain)
251 {
252 __nft_chain_trans_bind(ctx, chain, true);
253 }
254
nf_tables_bind_chain(const struct nft_ctx * ctx,struct nft_chain * chain)255 int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain)
256 {
257 if (!nft_chain_binding(chain))
258 return 0;
259
260 if (nft_chain_binding(ctx->chain))
261 return -EOPNOTSUPP;
262
263 if (chain->bound)
264 return -EBUSY;
265
266 if (!nft_use_inc(&chain->use))
267 return -EMFILE;
268
269 chain->bound = true;
270 nft_chain_trans_bind(ctx, chain);
271
272 return 0;
273 }
274
nf_tables_unbind_chain(const struct nft_ctx * ctx,struct nft_chain * chain)275 void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain)
276 {
277 __nft_chain_trans_bind(ctx, chain, false);
278 }
279
nft_netdev_register_hooks(struct net * net,struct list_head * hook_list)280 static int nft_netdev_register_hooks(struct net *net,
281 struct list_head *hook_list)
282 {
283 struct nft_hook *hook;
284 int err, j;
285
286 j = 0;
287 list_for_each_entry(hook, hook_list, list) {
288 err = nf_register_net_hook(net, &hook->ops);
289 if (err < 0)
290 goto err_register;
291
292 j++;
293 }
294 return 0;
295
296 err_register:
297 list_for_each_entry(hook, hook_list, list) {
298 if (j-- <= 0)
299 break;
300
301 nf_unregister_net_hook(net, &hook->ops);
302 }
303 return err;
304 }
305
nft_netdev_unregister_hooks(struct net * net,struct list_head * hook_list,bool release_netdev)306 static void nft_netdev_unregister_hooks(struct net *net,
307 struct list_head *hook_list,
308 bool release_netdev)
309 {
310 struct nft_hook *hook, *next;
311
312 list_for_each_entry_safe(hook, next, hook_list, list) {
313 nf_unregister_net_hook(net, &hook->ops);
314 if (release_netdev) {
315 list_del(&hook->list);
316 kfree_rcu(hook, rcu);
317 }
318 }
319 }
320
nf_tables_register_hook(struct net * net,const struct nft_table * table,struct nft_chain * chain)321 static int nf_tables_register_hook(struct net *net,
322 const struct nft_table *table,
323 struct nft_chain *chain)
324 {
325 struct nft_base_chain *basechain;
326 const struct nf_hook_ops *ops;
327
328 if (table->flags & NFT_TABLE_F_DORMANT ||
329 !nft_is_base_chain(chain))
330 return 0;
331
332 basechain = nft_base_chain(chain);
333 ops = &basechain->ops;
334
335 if (basechain->type->ops_register)
336 return basechain->type->ops_register(net, ops);
337
338 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
339 return nft_netdev_register_hooks(net, &basechain->hook_list);
340
341 return nf_register_net_hook(net, &basechain->ops);
342 }
343
__nf_tables_unregister_hook(struct net * net,const struct nft_table * table,struct nft_chain * chain,bool release_netdev)344 static void __nf_tables_unregister_hook(struct net *net,
345 const struct nft_table *table,
346 struct nft_chain *chain,
347 bool release_netdev)
348 {
349 struct nft_base_chain *basechain;
350 const struct nf_hook_ops *ops;
351
352 if (table->flags & NFT_TABLE_F_DORMANT ||
353 !nft_is_base_chain(chain))
354 return;
355 basechain = nft_base_chain(chain);
356 ops = &basechain->ops;
357
358 if (basechain->type->ops_unregister)
359 return basechain->type->ops_unregister(net, ops);
360
361 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
362 nft_netdev_unregister_hooks(net, &basechain->hook_list,
363 release_netdev);
364 else
365 nf_unregister_net_hook(net, &basechain->ops);
366 }
367
nf_tables_unregister_hook(struct net * net,const struct nft_table * table,struct nft_chain * chain)368 static void nf_tables_unregister_hook(struct net *net,
369 const struct nft_table *table,
370 struct nft_chain *chain)
371 {
372 return __nf_tables_unregister_hook(net, table, chain, false);
373 }
374
nft_trans_commit_list_add_tail(struct net * net,struct nft_trans * trans)375 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans)
376 {
377 struct nftables_pernet *nft_net;
378
379 nft_net = net_generic(net, nf_tables_net_id);
380
381 switch (trans->msg_type) {
382 case NFT_MSG_NEWSET:
383 if (nft_set_is_anonymous(nft_trans_set(trans)))
384 list_add_tail(&trans->binding_list, &nft_net->binding_list);
385 break;
386 case NFT_MSG_NEWCHAIN:
387 if (!nft_trans_chain_update(trans) &&
388 nft_chain_binding(nft_trans_chain(trans)))
389 list_add_tail(&trans->binding_list, &nft_net->binding_list);
390 break;
391 }
392
393 list_add_tail(&trans->list, &nft_net->commit_list);
394 }
395
nft_trans_table_add(struct nft_ctx * ctx,int msg_type)396 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
397 {
398 struct nft_trans *trans;
399
400 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
401 if (trans == NULL)
402 return -ENOMEM;
403
404 if (msg_type == NFT_MSG_NEWTABLE)
405 nft_activate_next(ctx->net, ctx->table);
406
407 nft_trans_commit_list_add_tail(ctx->net, trans);
408 return 0;
409 }
410
nft_deltable(struct nft_ctx * ctx)411 static int nft_deltable(struct nft_ctx *ctx)
412 {
413 int err;
414
415 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
416 if (err < 0)
417 return err;
418
419 nft_deactivate_next(ctx->net, ctx->table);
420 return err;
421 }
422
nft_trans_chain_add(struct nft_ctx * ctx,int msg_type)423 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
424 {
425 struct nft_trans *trans;
426
427 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
428 if (trans == NULL)
429 return ERR_PTR(-ENOMEM);
430
431 if (msg_type == NFT_MSG_NEWCHAIN) {
432 nft_activate_next(ctx->net, ctx->chain);
433
434 if (ctx->nla[NFTA_CHAIN_ID]) {
435 nft_trans_chain_id(trans) =
436 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID]));
437 }
438 }
439 nft_trans_chain(trans) = ctx->chain;
440 nft_trans_commit_list_add_tail(ctx->net, trans);
441
442 return trans;
443 }
444
nft_delchain(struct nft_ctx * ctx)445 static int nft_delchain(struct nft_ctx *ctx)
446 {
447 struct nft_trans *trans;
448
449 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
450 if (IS_ERR(trans))
451 return PTR_ERR(trans);
452
453 nft_use_dec(&ctx->table->use);
454 nft_deactivate_next(ctx->net, ctx->chain);
455
456 return 0;
457 }
458
nft_rule_expr_activate(const struct nft_ctx * ctx,struct nft_rule * rule)459 void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule)
460 {
461 struct nft_expr *expr;
462
463 expr = nft_expr_first(rule);
464 while (nft_expr_more(rule, expr)) {
465 if (expr->ops->activate)
466 expr->ops->activate(ctx, expr);
467
468 expr = nft_expr_next(expr);
469 }
470 }
471
nft_rule_expr_deactivate(const struct nft_ctx * ctx,struct nft_rule * rule,enum nft_trans_phase phase)472 void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule,
473 enum nft_trans_phase phase)
474 {
475 struct nft_expr *expr;
476
477 expr = nft_expr_first(rule);
478 while (nft_expr_more(rule, expr)) {
479 if (expr->ops->deactivate)
480 expr->ops->deactivate(ctx, expr, phase);
481
482 expr = nft_expr_next(expr);
483 }
484 }
485
486 static int
nf_tables_delrule_deactivate(struct nft_ctx * ctx,struct nft_rule * rule)487 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
488 {
489 /* You cannot delete the same rule twice */
490 if (nft_is_active_next(ctx->net, rule)) {
491 nft_deactivate_next(ctx->net, rule);
492 nft_use_dec(&ctx->chain->use);
493 return 0;
494 }
495 return -ENOENT;
496 }
497
nft_trans_rule_add(struct nft_ctx * ctx,int msg_type,struct nft_rule * rule)498 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
499 struct nft_rule *rule)
500 {
501 struct nft_trans *trans;
502
503 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
504 if (trans == NULL)
505 return NULL;
506
507 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
508 nft_trans_rule_id(trans) =
509 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
510 }
511 nft_trans_rule(trans) = rule;
512 nft_trans_commit_list_add_tail(ctx->net, trans);
513
514 return trans;
515 }
516
nft_delrule(struct nft_ctx * ctx,struct nft_rule * rule)517 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
518 {
519 struct nft_flow_rule *flow;
520 struct nft_trans *trans;
521 int err;
522
523 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
524 if (trans == NULL)
525 return -ENOMEM;
526
527 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
528 flow = nft_flow_rule_create(ctx->net, rule);
529 if (IS_ERR(flow)) {
530 nft_trans_destroy(trans);
531 return PTR_ERR(flow);
532 }
533
534 nft_trans_flow_rule(trans) = flow;
535 }
536
537 err = nf_tables_delrule_deactivate(ctx, rule);
538 if (err < 0) {
539 nft_trans_destroy(trans);
540 return err;
541 }
542 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
543
544 return 0;
545 }
546
nft_delrule_by_chain(struct nft_ctx * ctx)547 static int nft_delrule_by_chain(struct nft_ctx *ctx)
548 {
549 struct nft_rule *rule;
550 int err;
551
552 list_for_each_entry(rule, &ctx->chain->rules, list) {
553 if (!nft_is_active_next(ctx->net, rule))
554 continue;
555
556 err = nft_delrule(ctx, rule);
557 if (err < 0)
558 return err;
559 }
560 return 0;
561 }
562
nft_trans_set_add(const struct nft_ctx * ctx,int msg_type,struct nft_set * set)563 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
564 struct nft_set *set)
565 {
566 struct nft_trans *trans;
567
568 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
569 if (trans == NULL)
570 return -ENOMEM;
571
572 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
573 nft_trans_set_id(trans) =
574 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
575 nft_activate_next(ctx->net, set);
576 }
577 nft_trans_set(trans) = set;
578 nft_trans_commit_list_add_tail(ctx->net, trans);
579
580 return 0;
581 }
582
nft_mapelem_deactivate(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)583 static int nft_mapelem_deactivate(const struct nft_ctx *ctx,
584 struct nft_set *set,
585 const struct nft_set_iter *iter,
586 struct nft_set_elem *elem)
587 {
588 nft_setelem_data_deactivate(ctx->net, set, elem);
589
590 return 0;
591 }
592
nft_map_deactivate(const struct nft_ctx * ctx,struct nft_set * set)593 static void nft_map_deactivate(const struct nft_ctx *ctx, struct nft_set *set)
594 {
595 struct nft_set_iter iter = {
596 .genmask = nft_genmask_next(ctx->net),
597 .fn = nft_mapelem_deactivate,
598 };
599
600 set->ops->walk(ctx, set, &iter);
601 WARN_ON_ONCE(iter.err);
602 }
603
nft_delset(const struct nft_ctx * ctx,struct nft_set * set)604 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
605 {
606 int err;
607
608 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
609 if (err < 0)
610 return err;
611
612 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
613 nft_map_deactivate(ctx, set);
614
615 nft_deactivate_next(ctx->net, set);
616 nft_use_dec(&ctx->table->use);
617
618 return err;
619 }
620
nft_trans_obj_add(struct nft_ctx * ctx,int msg_type,struct nft_object * obj)621 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
622 struct nft_object *obj)
623 {
624 struct nft_trans *trans;
625
626 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
627 if (trans == NULL)
628 return -ENOMEM;
629
630 if (msg_type == NFT_MSG_NEWOBJ)
631 nft_activate_next(ctx->net, obj);
632
633 nft_trans_obj(trans) = obj;
634 nft_trans_commit_list_add_tail(ctx->net, trans);
635
636 return 0;
637 }
638
nft_delobj(struct nft_ctx * ctx,struct nft_object * obj)639 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
640 {
641 int err;
642
643 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
644 if (err < 0)
645 return err;
646
647 nft_deactivate_next(ctx->net, obj);
648 nft_use_dec(&ctx->table->use);
649
650 return err;
651 }
652
nft_trans_flowtable_add(struct nft_ctx * ctx,int msg_type,struct nft_flowtable * flowtable)653 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
654 struct nft_flowtable *flowtable)
655 {
656 struct nft_trans *trans;
657
658 trans = nft_trans_alloc(ctx, msg_type,
659 sizeof(struct nft_trans_flowtable));
660 if (trans == NULL)
661 return -ENOMEM;
662
663 if (msg_type == NFT_MSG_NEWFLOWTABLE)
664 nft_activate_next(ctx->net, flowtable);
665
666 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
667 nft_trans_flowtable(trans) = flowtable;
668 nft_trans_commit_list_add_tail(ctx->net, trans);
669
670 return 0;
671 }
672
nft_delflowtable(struct nft_ctx * ctx,struct nft_flowtable * flowtable)673 static int nft_delflowtable(struct nft_ctx *ctx,
674 struct nft_flowtable *flowtable)
675 {
676 int err;
677
678 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
679 if (err < 0)
680 return err;
681
682 nft_deactivate_next(ctx->net, flowtable);
683 nft_use_dec(&ctx->table->use);
684
685 return err;
686 }
687
688 /*
689 * Tables
690 */
691
nft_table_lookup(const struct net * net,const struct nlattr * nla,u8 family,u8 genmask)692 static struct nft_table *nft_table_lookup(const struct net *net,
693 const struct nlattr *nla,
694 u8 family, u8 genmask)
695 {
696 struct nftables_pernet *nft_net;
697 struct nft_table *table;
698
699 if (nla == NULL)
700 return ERR_PTR(-EINVAL);
701
702 nft_net = net_generic(net, nf_tables_net_id);
703 list_for_each_entry_rcu(table, &nft_net->tables, list,
704 lockdep_is_held(&nft_net->commit_mutex)) {
705 if (!nla_strcmp(nla, table->name) &&
706 table->family == family &&
707 nft_active_genmask(table, genmask))
708 return table;
709 }
710
711 return ERR_PTR(-ENOENT);
712 }
713
nft_table_lookup_byhandle(const struct net * net,const struct nlattr * nla,u8 genmask)714 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
715 const struct nlattr *nla,
716 u8 genmask)
717 {
718 struct nftables_pernet *nft_net;
719 struct nft_table *table;
720
721 nft_net = net_generic(net, nf_tables_net_id);
722 list_for_each_entry(table, &nft_net->tables, list) {
723 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
724 nft_active_genmask(table, genmask))
725 return table;
726 }
727
728 return ERR_PTR(-ENOENT);
729 }
730
nf_tables_alloc_handle(struct nft_table * table)731 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
732 {
733 return ++table->hgenerator;
734 }
735
736 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
737
738 static const struct nft_chain_type *
__nft_chain_type_get(u8 family,enum nft_chain_types type)739 __nft_chain_type_get(u8 family, enum nft_chain_types type)
740 {
741 if (family >= NFPROTO_NUMPROTO ||
742 type >= NFT_CHAIN_T_MAX)
743 return NULL;
744
745 return chain_type[family][type];
746 }
747
748 static const struct nft_chain_type *
__nf_tables_chain_type_lookup(const struct nlattr * nla,u8 family)749 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
750 {
751 const struct nft_chain_type *type;
752 int i;
753
754 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
755 type = __nft_chain_type_get(family, i);
756 if (!type)
757 continue;
758 if (!nla_strcmp(nla, type->name))
759 return type;
760 }
761 return NULL;
762 }
763
764 struct nft_module_request {
765 struct list_head list;
766 char module[MODULE_NAME_LEN];
767 bool done;
768 };
769
770 #ifdef CONFIG_MODULES
nft_request_module(struct net * net,const char * fmt,...)771 static int nft_request_module(struct net *net, const char *fmt, ...)
772 {
773 char module_name[MODULE_NAME_LEN];
774 struct nftables_pernet *nft_net;
775 struct nft_module_request *req;
776 va_list args;
777 int ret;
778
779 va_start(args, fmt);
780 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
781 va_end(args);
782 if (ret >= MODULE_NAME_LEN)
783 return 0;
784
785 nft_net = net_generic(net, nf_tables_net_id);
786 list_for_each_entry(req, &nft_net->module_list, list) {
787 if (!strcmp(req->module, module_name)) {
788 if (req->done)
789 return 0;
790
791 /* A request to load this module already exists. */
792 return -EAGAIN;
793 }
794 }
795
796 req = kmalloc(sizeof(*req), GFP_KERNEL);
797 if (!req)
798 return -ENOMEM;
799
800 req->done = false;
801 strlcpy(req->module, module_name, MODULE_NAME_LEN);
802 list_add_tail(&req->list, &nft_net->module_list);
803
804 return -EAGAIN;
805 }
806 #endif
807
lockdep_nfnl_nft_mutex_not_held(void)808 static void lockdep_nfnl_nft_mutex_not_held(void)
809 {
810 #ifdef CONFIG_PROVE_LOCKING
811 if (debug_locks)
812 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
813 #endif
814 }
815
816 static const struct nft_chain_type *
nf_tables_chain_type_lookup(struct net * net,const struct nlattr * nla,u8 family,bool autoload)817 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
818 u8 family, bool autoload)
819 {
820 const struct nft_chain_type *type;
821
822 type = __nf_tables_chain_type_lookup(nla, family);
823 if (type != NULL)
824 return type;
825
826 lockdep_nfnl_nft_mutex_not_held();
827 #ifdef CONFIG_MODULES
828 if (autoload) {
829 if (nft_request_module(net, "nft-chain-%u-%.*s", family,
830 nla_len(nla),
831 (const char *)nla_data(nla)) == -EAGAIN)
832 return ERR_PTR(-EAGAIN);
833 }
834 #endif
835 return ERR_PTR(-ENOENT);
836 }
837
nft_base_seq(const struct net * net)838 static __be16 nft_base_seq(const struct net *net)
839 {
840 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
841
842 return htons(nft_net->base_seq & 0xffff);
843 }
844
845 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
846 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
847 .len = NFT_TABLE_MAXNAMELEN - 1 },
848 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
849 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
850 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY,
851 .len = NFT_USERDATA_MAXLEN }
852 };
853
nf_tables_fill_table_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table)854 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
855 u32 portid, u32 seq, int event, u32 flags,
856 int family, const struct nft_table *table)
857 {
858 struct nlmsghdr *nlh;
859
860 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
861 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
862 NFNETLINK_V0, nft_base_seq(net));
863 if (!nlh)
864 goto nla_put_failure;
865
866 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
867 nla_put_be32(skb, NFTA_TABLE_FLAGS,
868 htonl(table->flags & NFT_TABLE_F_MASK)) ||
869 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
870 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
871 NFTA_TABLE_PAD))
872 goto nla_put_failure;
873
874 if (table->udata) {
875 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata))
876 goto nla_put_failure;
877 }
878
879 nlmsg_end(skb, nlh);
880 return 0;
881
882 nla_put_failure:
883 nlmsg_trim(skb, nlh);
884 return -1;
885 }
886
887 struct nftnl_skb_parms {
888 bool report;
889 };
890 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb))
891
nft_notify_enqueue(struct sk_buff * skb,bool report,struct list_head * notify_list)892 static void nft_notify_enqueue(struct sk_buff *skb, bool report,
893 struct list_head *notify_list)
894 {
895 NFT_CB(skb).report = report;
896 list_add_tail(&skb->list, notify_list);
897 }
898
nf_tables_table_notify(const struct nft_ctx * ctx,int event)899 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
900 {
901 struct nftables_pernet *nft_net;
902 struct sk_buff *skb;
903 int err;
904
905 if (!ctx->report &&
906 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
907 return;
908
909 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
910 if (skb == NULL)
911 goto err;
912
913 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
914 event, 0, ctx->family, ctx->table);
915 if (err < 0) {
916 kfree_skb(skb);
917 goto err;
918 }
919
920 nft_net = net_generic(ctx->net, nf_tables_net_id);
921 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
922 return;
923 err:
924 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
925 }
926
nf_tables_dump_tables(struct sk_buff * skb,struct netlink_callback * cb)927 static int nf_tables_dump_tables(struct sk_buff *skb,
928 struct netlink_callback *cb)
929 {
930 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
931 struct nftables_pernet *nft_net;
932 const struct nft_table *table;
933 unsigned int idx = 0, s_idx = cb->args[0];
934 struct net *net = sock_net(skb->sk);
935 int family = nfmsg->nfgen_family;
936
937 rcu_read_lock();
938 nft_net = net_generic(net, nf_tables_net_id);
939 cb->seq = nft_net->base_seq;
940
941 list_for_each_entry_rcu(table, &nft_net->tables, list) {
942 if (family != NFPROTO_UNSPEC && family != table->family)
943 continue;
944
945 if (idx < s_idx)
946 goto cont;
947 if (idx > s_idx)
948 memset(&cb->args[1], 0,
949 sizeof(cb->args) - sizeof(cb->args[0]));
950 if (!nft_is_active(net, table))
951 continue;
952 if (nf_tables_fill_table_info(skb, net,
953 NETLINK_CB(cb->skb).portid,
954 cb->nlh->nlmsg_seq,
955 NFT_MSG_NEWTABLE, NLM_F_MULTI,
956 table->family, table) < 0)
957 goto done;
958
959 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
960 cont:
961 idx++;
962 }
963 done:
964 rcu_read_unlock();
965 cb->args[0] = idx;
966 return skb->len;
967 }
968
nft_netlink_dump_start_rcu(struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,struct netlink_dump_control * c)969 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
970 const struct nlmsghdr *nlh,
971 struct netlink_dump_control *c)
972 {
973 int err;
974
975 if (!try_module_get(THIS_MODULE))
976 return -EINVAL;
977
978 rcu_read_unlock();
979 err = netlink_dump_start(nlsk, skb, nlh, c);
980 rcu_read_lock();
981 module_put(THIS_MODULE);
982
983 return err;
984 }
985
986 /* called with rcu_read_lock held */
nf_tables_gettable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)987 static int nf_tables_gettable(struct net *net, struct sock *nlsk,
988 struct sk_buff *skb, const struct nlmsghdr *nlh,
989 const struct nlattr * const nla[],
990 struct netlink_ext_ack *extack)
991 {
992 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
993 u8 genmask = nft_genmask_cur(net);
994 const struct nft_table *table;
995 struct sk_buff *skb2;
996 int family = nfmsg->nfgen_family;
997 int err;
998
999 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1000 struct netlink_dump_control c = {
1001 .dump = nf_tables_dump_tables,
1002 .module = THIS_MODULE,
1003 };
1004
1005 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
1006 }
1007
1008 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
1009 if (IS_ERR(table)) {
1010 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
1011 return PTR_ERR(table);
1012 }
1013
1014 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1015 if (!skb2)
1016 return -ENOMEM;
1017
1018 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
1019 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
1020 family, table);
1021 if (err < 0)
1022 goto err_fill_table_info;
1023
1024 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
1025
1026 err_fill_table_info:
1027 kfree_skb(skb2);
1028 return err;
1029 }
1030
nft_table_disable(struct net * net,struct nft_table * table,u32 cnt)1031 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
1032 {
1033 struct nft_chain *chain;
1034 u32 i = 0;
1035
1036 list_for_each_entry(chain, &table->chains, list) {
1037 if (!nft_is_active_next(net, chain))
1038 continue;
1039 if (!nft_is_base_chain(chain))
1040 continue;
1041
1042 if (cnt && i++ == cnt)
1043 break;
1044
1045 nf_tables_unregister_hook(net, table, chain);
1046 }
1047 }
1048
nf_tables_table_enable(struct net * net,struct nft_table * table)1049 static int nf_tables_table_enable(struct net *net, struct nft_table *table)
1050 {
1051 struct nft_chain *chain;
1052 int err, i = 0;
1053
1054 list_for_each_entry(chain, &table->chains, list) {
1055 if (!nft_is_active_next(net, chain))
1056 continue;
1057 if (!nft_is_base_chain(chain))
1058 continue;
1059
1060 err = nf_tables_register_hook(net, table, chain);
1061 if (err < 0)
1062 goto err_register_hooks;
1063
1064 i++;
1065 }
1066 return 0;
1067
1068 err_register_hooks:
1069 if (i)
1070 nft_table_disable(net, table, i);
1071 return err;
1072 }
1073
nf_tables_table_disable(struct net * net,struct nft_table * table)1074 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
1075 {
1076 table->flags &= ~NFT_TABLE_F_DORMANT;
1077 nft_table_disable(net, table, 0);
1078 table->flags |= NFT_TABLE_F_DORMANT;
1079 }
1080
1081 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1)
1082 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0)
1083 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1)
1084 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \
1085 __NFT_TABLE_F_WAS_AWAKEN)
1086
nf_tables_updtable(struct nft_ctx * ctx)1087 static int nf_tables_updtable(struct nft_ctx *ctx)
1088 {
1089 struct nft_trans *trans;
1090 u32 flags;
1091 int ret;
1092
1093 if (!ctx->nla[NFTA_TABLE_FLAGS])
1094 return 0;
1095
1096 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
1097 if (flags & ~NFT_TABLE_F_DORMANT)
1098 return -EINVAL;
1099
1100 if (flags == ctx->table->flags)
1101 return 0;
1102
1103 /* No dormant off/on/off/on games in single transaction */
1104 if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
1105 return -EINVAL;
1106
1107 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
1108 sizeof(struct nft_trans_table));
1109 if (trans == NULL)
1110 return -ENOMEM;
1111
1112 if ((flags & NFT_TABLE_F_DORMANT) &&
1113 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
1114 ctx->table->flags |= NFT_TABLE_F_DORMANT;
1115 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE))
1116 ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN;
1117 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
1118 ctx->table->flags & NFT_TABLE_F_DORMANT) {
1119 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
1120 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) {
1121 ret = nf_tables_table_enable(ctx->net, ctx->table);
1122 if (ret < 0)
1123 goto err_register_hooks;
1124
1125 ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT;
1126 }
1127 }
1128
1129 nft_trans_table_update(trans) = true;
1130 nft_trans_commit_list_add_tail(ctx->net, trans);
1131
1132 return 0;
1133
1134 err_register_hooks:
1135 ctx->table->flags |= NFT_TABLE_F_DORMANT;
1136 nft_trans_destroy(trans);
1137 return ret;
1138 }
1139
nft_chain_hash(const void * data,u32 len,u32 seed)1140 static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
1141 {
1142 const char *name = data;
1143
1144 return jhash(name, strlen(name), seed);
1145 }
1146
nft_chain_hash_obj(const void * data,u32 len,u32 seed)1147 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
1148 {
1149 const struct nft_chain *chain = data;
1150
1151 return nft_chain_hash(chain->name, 0, seed);
1152 }
1153
nft_chain_hash_cmp(struct rhashtable_compare_arg * arg,const void * ptr)1154 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
1155 const void *ptr)
1156 {
1157 const struct nft_chain *chain = ptr;
1158 const char *name = arg->key;
1159
1160 return strcmp(chain->name, name);
1161 }
1162
nft_objname_hash(const void * data,u32 len,u32 seed)1163 static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
1164 {
1165 const struct nft_object_hash_key *k = data;
1166
1167 seed ^= hash_ptr(k->table, 32);
1168
1169 return jhash(k->name, strlen(k->name), seed);
1170 }
1171
nft_objname_hash_obj(const void * data,u32 len,u32 seed)1172 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
1173 {
1174 const struct nft_object *obj = data;
1175
1176 return nft_objname_hash(&obj->key, 0, seed);
1177 }
1178
nft_objname_hash_cmp(struct rhashtable_compare_arg * arg,const void * ptr)1179 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
1180 const void *ptr)
1181 {
1182 const struct nft_object_hash_key *k = arg->key;
1183 const struct nft_object *obj = ptr;
1184
1185 if (obj->key.table != k->table)
1186 return -1;
1187
1188 return strcmp(obj->key.name, k->name);
1189 }
1190
nft_supported_family(u8 family)1191 static bool nft_supported_family(u8 family)
1192 {
1193 return false
1194 #ifdef CONFIG_NF_TABLES_INET
1195 || family == NFPROTO_INET
1196 #endif
1197 #ifdef CONFIG_NF_TABLES_IPV4
1198 || family == NFPROTO_IPV4
1199 #endif
1200 #ifdef CONFIG_NF_TABLES_ARP
1201 || family == NFPROTO_ARP
1202 #endif
1203 #ifdef CONFIG_NF_TABLES_NETDEV
1204 || family == NFPROTO_NETDEV
1205 #endif
1206 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
1207 || family == NFPROTO_BRIDGE
1208 #endif
1209 #ifdef CONFIG_NF_TABLES_IPV6
1210 || family == NFPROTO_IPV6
1211 #endif
1212 ;
1213 }
1214
nf_tables_newtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)1215 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
1216 struct sk_buff *skb, const struct nlmsghdr *nlh,
1217 const struct nlattr * const nla[],
1218 struct netlink_ext_ack *extack)
1219 {
1220 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
1221 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1222 u8 genmask = nft_genmask_next(net);
1223 int family = nfmsg->nfgen_family;
1224 const struct nlattr *attr;
1225 struct nft_table *table;
1226 struct nft_ctx ctx;
1227 u32 flags = 0;
1228 int err;
1229
1230 if (!nft_supported_family(family))
1231 return -EOPNOTSUPP;
1232
1233 lockdep_assert_held(&nft_net->commit_mutex);
1234 attr = nla[NFTA_TABLE_NAME];
1235 table = nft_table_lookup(net, attr, family, genmask);
1236 if (IS_ERR(table)) {
1237 if (PTR_ERR(table) != -ENOENT)
1238 return PTR_ERR(table);
1239 } else {
1240 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1241 NL_SET_BAD_ATTR(extack, attr);
1242 return -EEXIST;
1243 }
1244 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1245 return -EOPNOTSUPP;
1246
1247 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
1248 return nf_tables_updtable(&ctx);
1249 }
1250
1251 if (nla[NFTA_TABLE_FLAGS]) {
1252 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
1253 if (flags & ~NFT_TABLE_F_DORMANT)
1254 return -EINVAL;
1255 }
1256
1257 err = -ENOMEM;
1258 table = kzalloc(sizeof(*table), GFP_KERNEL);
1259 if (table == NULL)
1260 goto err_kzalloc;
1261
1262 table->name = nla_strdup(attr, GFP_KERNEL);
1263 if (table->name == NULL)
1264 goto err_strdup;
1265
1266 if (nla[NFTA_TABLE_USERDATA]) {
1267 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL);
1268 if (table->udata == NULL)
1269 goto err_table_udata;
1270
1271 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]);
1272 }
1273
1274 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
1275 if (err)
1276 goto err_chain_ht;
1277
1278 INIT_LIST_HEAD(&table->chains);
1279 INIT_LIST_HEAD(&table->sets);
1280 INIT_LIST_HEAD(&table->objects);
1281 INIT_LIST_HEAD(&table->flowtables);
1282 table->family = family;
1283 table->flags = flags;
1284 table->handle = ++table_handle;
1285
1286 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
1287 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
1288 if (err < 0)
1289 goto err_trans;
1290
1291 list_add_tail_rcu(&table->list, &nft_net->tables);
1292 return 0;
1293 err_trans:
1294 rhltable_destroy(&table->chains_ht);
1295 err_chain_ht:
1296 kfree(table->udata);
1297 err_table_udata:
1298 kfree(table->name);
1299 err_strdup:
1300 kfree(table);
1301 err_kzalloc:
1302 return err;
1303 }
1304
nft_flush_table(struct nft_ctx * ctx)1305 static int nft_flush_table(struct nft_ctx *ctx)
1306 {
1307 struct nft_flowtable *flowtable, *nft;
1308 struct nft_chain *chain, *nc;
1309 struct nft_object *obj, *ne;
1310 struct nft_set *set, *ns;
1311 int err;
1312
1313 list_for_each_entry(chain, &ctx->table->chains, list) {
1314 if (!nft_is_active_next(ctx->net, chain))
1315 continue;
1316
1317 if (nft_chain_binding(chain))
1318 continue;
1319
1320 ctx->chain = chain;
1321
1322 err = nft_delrule_by_chain(ctx);
1323 if (err < 0)
1324 goto out;
1325 }
1326
1327 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
1328 if (!nft_is_active_next(ctx->net, set))
1329 continue;
1330
1331 if (nft_set_is_anonymous(set))
1332 continue;
1333
1334 err = nft_delset(ctx, set);
1335 if (err < 0)
1336 goto out;
1337 }
1338
1339 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
1340 if (!nft_is_active_next(ctx->net, flowtable))
1341 continue;
1342
1343 err = nft_delflowtable(ctx, flowtable);
1344 if (err < 0)
1345 goto out;
1346 }
1347
1348 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
1349 if (!nft_is_active_next(ctx->net, obj))
1350 continue;
1351
1352 err = nft_delobj(ctx, obj);
1353 if (err < 0)
1354 goto out;
1355 }
1356
1357 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
1358 if (!nft_is_active_next(ctx->net, chain))
1359 continue;
1360
1361 if (nft_chain_binding(chain))
1362 continue;
1363
1364 ctx->chain = chain;
1365
1366 err = nft_delchain(ctx);
1367 if (err < 0)
1368 goto out;
1369 }
1370
1371 err = nft_deltable(ctx);
1372 out:
1373 return err;
1374 }
1375
nft_flush(struct nft_ctx * ctx,int family)1376 static int nft_flush(struct nft_ctx *ctx, int family)
1377 {
1378 struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
1379 struct nft_table *table, *nt;
1380 const struct nlattr * const *nla = ctx->nla;
1381 int err = 0;
1382
1383 list_for_each_entry_safe(table, nt, &nft_net->tables, list) {
1384 if (family != AF_UNSPEC && table->family != family)
1385 continue;
1386
1387 ctx->family = table->family;
1388
1389 if (!nft_is_active_next(ctx->net, table))
1390 continue;
1391
1392 if (nla[NFTA_TABLE_NAME] &&
1393 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1394 continue;
1395
1396 ctx->table = table;
1397
1398 err = nft_flush_table(ctx);
1399 if (err < 0)
1400 goto out;
1401 }
1402 out:
1403 return err;
1404 }
1405
nf_tables_deltable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)1406 static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1407 struct sk_buff *skb, const struct nlmsghdr *nlh,
1408 const struct nlattr * const nla[],
1409 struct netlink_ext_ack *extack)
1410 {
1411 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1412 u8 genmask = nft_genmask_next(net);
1413 int family = nfmsg->nfgen_family;
1414 const struct nlattr *attr;
1415 struct nft_table *table;
1416 struct nft_ctx ctx;
1417
1418 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
1419 if (family == AF_UNSPEC ||
1420 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
1421 return nft_flush(&ctx, family);
1422
1423 if (nla[NFTA_TABLE_HANDLE]) {
1424 attr = nla[NFTA_TABLE_HANDLE];
1425 table = nft_table_lookup_byhandle(net, attr, genmask);
1426 } else {
1427 attr = nla[NFTA_TABLE_NAME];
1428 table = nft_table_lookup(net, attr, family, genmask);
1429 }
1430
1431 if (IS_ERR(table)) {
1432 NL_SET_BAD_ATTR(extack, attr);
1433 return PTR_ERR(table);
1434 }
1435
1436 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1437 table->use > 0)
1438 return -EBUSY;
1439
1440 ctx.family = family;
1441 ctx.table = table;
1442
1443 return nft_flush_table(&ctx);
1444 }
1445
nf_tables_table_destroy(struct nft_ctx * ctx)1446 static void nf_tables_table_destroy(struct nft_ctx *ctx)
1447 {
1448 if (WARN_ON(ctx->table->use > 0))
1449 return;
1450
1451 rhltable_destroy(&ctx->table->chains_ht);
1452 kfree(ctx->table->name);
1453 kfree(ctx->table->udata);
1454 kfree(ctx->table);
1455 }
1456
nft_register_chain_type(const struct nft_chain_type * ctype)1457 void nft_register_chain_type(const struct nft_chain_type *ctype)
1458 {
1459 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1460 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
1461 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1462 return;
1463 }
1464 chain_type[ctype->family][ctype->type] = ctype;
1465 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1466 }
1467 EXPORT_SYMBOL_GPL(nft_register_chain_type);
1468
nft_unregister_chain_type(const struct nft_chain_type * ctype)1469 void nft_unregister_chain_type(const struct nft_chain_type *ctype)
1470 {
1471 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1472 chain_type[ctype->family][ctype->type] = NULL;
1473 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1474 }
1475 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
1476
1477 /*
1478 * Chains
1479 */
1480
1481 static struct nft_chain *
nft_chain_lookup_byhandle(const struct nft_table * table,u64 handle,u8 genmask)1482 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
1483 {
1484 struct nft_chain *chain;
1485
1486 list_for_each_entry(chain, &table->chains, list) {
1487 if (chain->handle == handle &&
1488 nft_active_genmask(chain, genmask))
1489 return chain;
1490 }
1491
1492 return ERR_PTR(-ENOENT);
1493 }
1494
lockdep_commit_lock_is_held(const struct net * net)1495 static bool lockdep_commit_lock_is_held(const struct net *net)
1496 {
1497 #ifdef CONFIG_PROVE_LOCKING
1498 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
1499
1500 return lockdep_is_held(&nft_net->commit_mutex);
1501 #else
1502 return true;
1503 #endif
1504 }
1505
nft_chain_lookup(struct net * net,struct nft_table * table,const struct nlattr * nla,u8 genmask)1506 static struct nft_chain *nft_chain_lookup(struct net *net,
1507 struct nft_table *table,
1508 const struct nlattr *nla, u8 genmask)
1509 {
1510 char search[NFT_CHAIN_MAXNAMELEN + 1];
1511 struct rhlist_head *tmp, *list;
1512 struct nft_chain *chain;
1513
1514 if (nla == NULL)
1515 return ERR_PTR(-EINVAL);
1516
1517 nla_strlcpy(search, nla, sizeof(search));
1518
1519 WARN_ON(!rcu_read_lock_held() &&
1520 !lockdep_commit_lock_is_held(net));
1521
1522 chain = ERR_PTR(-ENOENT);
1523 rcu_read_lock();
1524 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1525 if (!list)
1526 goto out_unlock;
1527
1528 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1529 if (nft_active_genmask(chain, genmask))
1530 goto out_unlock;
1531 }
1532 chain = ERR_PTR(-ENOENT);
1533 out_unlock:
1534 rcu_read_unlock();
1535 return chain;
1536 }
1537
1538 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
1539 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
1540 .len = NFT_TABLE_MAXNAMELEN - 1 },
1541 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
1542 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
1543 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1544 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
1545 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
1546 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING,
1547 .len = NFT_MODULE_AUTOLOAD_LIMIT },
1548 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
1549 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
1550 [NFTA_CHAIN_ID] = { .type = NLA_U32 },
1551 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY,
1552 .len = NFT_USERDATA_MAXLEN },
1553 };
1554
1555 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1556 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1557 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
1558 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1559 .len = IFNAMSIZ - 1 },
1560 };
1561
nft_dump_stats(struct sk_buff * skb,struct nft_stats __percpu * stats)1562 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1563 {
1564 struct nft_stats *cpu_stats, total;
1565 struct nlattr *nest;
1566 unsigned int seq;
1567 u64 pkts, bytes;
1568 int cpu;
1569
1570 if (!stats)
1571 return 0;
1572
1573 memset(&total, 0, sizeof(total));
1574 for_each_possible_cpu(cpu) {
1575 cpu_stats = per_cpu_ptr(stats, cpu);
1576 do {
1577 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1578 pkts = cpu_stats->pkts;
1579 bytes = cpu_stats->bytes;
1580 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1581 total.pkts += pkts;
1582 total.bytes += bytes;
1583 }
1584 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
1585 if (nest == NULL)
1586 goto nla_put_failure;
1587
1588 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1589 NFTA_COUNTER_PAD) ||
1590 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1591 NFTA_COUNTER_PAD))
1592 goto nla_put_failure;
1593
1594 nla_nest_end(skb, nest);
1595 return 0;
1596
1597 nla_put_failure:
1598 return -ENOSPC;
1599 }
1600
nft_dump_basechain_hook(struct sk_buff * skb,int family,const struct nft_base_chain * basechain)1601 static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
1602 const struct nft_base_chain *basechain)
1603 {
1604 const struct nf_hook_ops *ops = &basechain->ops;
1605 struct nft_hook *hook, *first = NULL;
1606 struct nlattr *nest, *nest_devs;
1607 int n = 0;
1608
1609 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1610 if (nest == NULL)
1611 goto nla_put_failure;
1612 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1613 goto nla_put_failure;
1614 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1615 goto nla_put_failure;
1616
1617 if (nft_base_chain_netdev(family, ops->hooknum)) {
1618 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
1619 list_for_each_entry(hook, &basechain->hook_list, list) {
1620 if (!first)
1621 first = hook;
1622
1623 if (nla_put_string(skb, NFTA_DEVICE_NAME,
1624 hook->ops.dev->name))
1625 goto nla_put_failure;
1626 n++;
1627 }
1628 nla_nest_end(skb, nest_devs);
1629
1630 if (n == 1 &&
1631 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name))
1632 goto nla_put_failure;
1633 }
1634 nla_nest_end(skb, nest);
1635
1636 return 0;
1637 nla_put_failure:
1638 return -1;
1639 }
1640
nf_tables_fill_chain_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table,const struct nft_chain * chain)1641 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1642 u32 portid, u32 seq, int event, u32 flags,
1643 int family, const struct nft_table *table,
1644 const struct nft_chain *chain)
1645 {
1646 struct nlmsghdr *nlh;
1647
1648 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1649 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
1650 NFNETLINK_V0, nft_base_seq(net));
1651 if (!nlh)
1652 goto nla_put_failure;
1653
1654 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1655 goto nla_put_failure;
1656 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1657 NFTA_CHAIN_PAD))
1658 goto nla_put_failure;
1659 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1660 goto nla_put_failure;
1661
1662 if (nft_is_base_chain(chain)) {
1663 const struct nft_base_chain *basechain = nft_base_chain(chain);
1664 struct nft_stats __percpu *stats;
1665
1666 if (nft_dump_basechain_hook(skb, family, basechain))
1667 goto nla_put_failure;
1668
1669 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1670 htonl(basechain->policy)))
1671 goto nla_put_failure;
1672
1673 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1674 goto nla_put_failure;
1675
1676 stats = rcu_dereference_check(basechain->stats,
1677 lockdep_commit_lock_is_held(net));
1678 if (nft_dump_stats(skb, stats))
1679 goto nla_put_failure;
1680 }
1681
1682 if (chain->flags &&
1683 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags)))
1684 goto nla_put_failure;
1685
1686 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1687 goto nla_put_failure;
1688
1689 if (chain->udata &&
1690 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata))
1691 goto nla_put_failure;
1692
1693 nlmsg_end(skb, nlh);
1694 return 0;
1695
1696 nla_put_failure:
1697 nlmsg_trim(skb, nlh);
1698 return -1;
1699 }
1700
nf_tables_chain_notify(const struct nft_ctx * ctx,int event)1701 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1702 {
1703 struct nftables_pernet *nft_net;
1704 struct sk_buff *skb;
1705 int err;
1706
1707 if (!ctx->report &&
1708 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1709 return;
1710
1711 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1712 if (skb == NULL)
1713 goto err;
1714
1715 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1716 event, 0, ctx->family, ctx->table,
1717 ctx->chain);
1718 if (err < 0) {
1719 kfree_skb(skb);
1720 goto err;
1721 }
1722
1723 nft_net = net_generic(ctx->net, nf_tables_net_id);
1724 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
1725 return;
1726 err:
1727 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1728 }
1729
nf_tables_dump_chains(struct sk_buff * skb,struct netlink_callback * cb)1730 static int nf_tables_dump_chains(struct sk_buff *skb,
1731 struct netlink_callback *cb)
1732 {
1733 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1734 const struct nft_table *table;
1735 const struct nft_chain *chain;
1736 unsigned int idx = 0, s_idx = cb->args[0];
1737 struct net *net = sock_net(skb->sk);
1738 int family = nfmsg->nfgen_family;
1739 struct nftables_pernet *nft_net;
1740
1741 rcu_read_lock();
1742 nft_net = net_generic(net, nf_tables_net_id);
1743 cb->seq = nft_net->base_seq;
1744
1745 list_for_each_entry_rcu(table, &nft_net->tables, list) {
1746 if (family != NFPROTO_UNSPEC && family != table->family)
1747 continue;
1748
1749 list_for_each_entry_rcu(chain, &table->chains, list) {
1750 if (idx < s_idx)
1751 goto cont;
1752 if (idx > s_idx)
1753 memset(&cb->args[1], 0,
1754 sizeof(cb->args) - sizeof(cb->args[0]));
1755 if (!nft_is_active(net, chain))
1756 continue;
1757 if (nf_tables_fill_chain_info(skb, net,
1758 NETLINK_CB(cb->skb).portid,
1759 cb->nlh->nlmsg_seq,
1760 NFT_MSG_NEWCHAIN,
1761 NLM_F_MULTI,
1762 table->family, table,
1763 chain) < 0)
1764 goto done;
1765
1766 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1767 cont:
1768 idx++;
1769 }
1770 }
1771 done:
1772 rcu_read_unlock();
1773 cb->args[0] = idx;
1774 return skb->len;
1775 }
1776
1777 /* called with rcu_read_lock held */
nf_tables_getchain(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)1778 static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1779 struct sk_buff *skb, const struct nlmsghdr *nlh,
1780 const struct nlattr * const nla[],
1781 struct netlink_ext_ack *extack)
1782 {
1783 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1784 u8 genmask = nft_genmask_cur(net);
1785 const struct nft_chain *chain;
1786 struct nft_table *table;
1787 struct sk_buff *skb2;
1788 int family = nfmsg->nfgen_family;
1789 int err;
1790
1791 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1792 struct netlink_dump_control c = {
1793 .dump = nf_tables_dump_chains,
1794 .module = THIS_MODULE,
1795 };
1796
1797 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
1798 }
1799
1800 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1801 if (IS_ERR(table)) {
1802 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1803 return PTR_ERR(table);
1804 }
1805
1806 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
1807 if (IS_ERR(chain)) {
1808 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
1809 return PTR_ERR(chain);
1810 }
1811
1812 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1813 if (!skb2)
1814 return -ENOMEM;
1815
1816 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1817 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1818 family, table, chain);
1819 if (err < 0)
1820 goto err_fill_chain_info;
1821
1822 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
1823
1824 err_fill_chain_info:
1825 kfree_skb(skb2);
1826 return err;
1827 }
1828
1829 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1830 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1831 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1832 };
1833
nft_stats_alloc(const struct nlattr * attr)1834 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1835 {
1836 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1837 struct nft_stats __percpu *newstats;
1838 struct nft_stats *stats;
1839 int err;
1840
1841 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1842 nft_counter_policy, NULL);
1843 if (err < 0)
1844 return ERR_PTR(err);
1845
1846 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1847 return ERR_PTR(-EINVAL);
1848
1849 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1850 if (newstats == NULL)
1851 return ERR_PTR(-ENOMEM);
1852
1853 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1854 * are not exposed to userspace.
1855 */
1856 preempt_disable();
1857 stats = this_cpu_ptr(newstats);
1858 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1859 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1860 preempt_enable();
1861
1862 return newstats;
1863 }
1864
nft_chain_stats_replace(struct nft_trans * trans)1865 static void nft_chain_stats_replace(struct nft_trans *trans)
1866 {
1867 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
1868
1869 if (!nft_trans_chain_stats(trans))
1870 return;
1871
1872 nft_trans_chain_stats(trans) =
1873 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans),
1874 lockdep_commit_lock_is_held(trans->ctx.net));
1875
1876 if (!nft_trans_chain_stats(trans))
1877 static_branch_inc(&nft_counters_enabled);
1878 }
1879
nf_tables_chain_free_chain_rules(struct nft_chain * chain)1880 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1881 {
1882 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1883 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1884
1885 if (g0 != g1)
1886 kvfree(g1);
1887 kvfree(g0);
1888
1889 /* should be NULL either via abort or via successful commit */
1890 WARN_ON_ONCE(chain->rules_next);
1891 kvfree(chain->rules_next);
1892 }
1893
nf_tables_chain_destroy(struct nft_ctx * ctx)1894 void nf_tables_chain_destroy(struct nft_ctx *ctx)
1895 {
1896 struct nft_chain *chain = ctx->chain;
1897 struct nft_hook *hook, *next;
1898
1899 if (WARN_ON(chain->use > 0))
1900 return;
1901
1902 /* no concurrent access possible anymore */
1903 nf_tables_chain_free_chain_rules(chain);
1904
1905 if (nft_is_base_chain(chain)) {
1906 struct nft_base_chain *basechain = nft_base_chain(chain);
1907
1908 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
1909 list_for_each_entry_safe(hook, next,
1910 &basechain->hook_list, list) {
1911 list_del_rcu(&hook->list);
1912 kfree_rcu(hook, rcu);
1913 }
1914 }
1915 module_put(basechain->type->owner);
1916 if (rcu_access_pointer(basechain->stats)) {
1917 static_branch_dec(&nft_counters_enabled);
1918 free_percpu(rcu_dereference_raw(basechain->stats));
1919 }
1920 kfree(chain->name);
1921 kfree(chain->udata);
1922 kfree(basechain);
1923 } else {
1924 kfree(chain->name);
1925 kfree(chain->udata);
1926 kfree(chain);
1927 }
1928 }
1929
nft_netdev_hook_alloc(struct net * net,const struct nlattr * attr)1930 static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
1931 const struct nlattr *attr)
1932 {
1933 struct net_device *dev;
1934 char ifname[IFNAMSIZ];
1935 struct nft_hook *hook;
1936 int err;
1937
1938 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1939 if (!hook) {
1940 err = -ENOMEM;
1941 goto err_hook_alloc;
1942 }
1943
1944 nla_strlcpy(ifname, attr, IFNAMSIZ);
1945 /* nf_tables_netdev_event() is called under rtnl_mutex, this is
1946 * indirectly serializing all the other holders of the commit_mutex with
1947 * the rtnl_mutex.
1948 */
1949 dev = __dev_get_by_name(net, ifname);
1950 if (!dev) {
1951 err = -ENOENT;
1952 goto err_hook_dev;
1953 }
1954 hook->ops.dev = dev;
1955
1956 return hook;
1957
1958 err_hook_dev:
1959 kfree(hook);
1960 err_hook_alloc:
1961 return ERR_PTR(err);
1962 }
1963
nft_hook_list_find(struct list_head * hook_list,const struct nft_hook * this)1964 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,
1965 const struct nft_hook *this)
1966 {
1967 struct nft_hook *hook;
1968
1969 list_for_each_entry(hook, hook_list, list) {
1970 if (this->ops.dev == hook->ops.dev)
1971 return hook;
1972 }
1973
1974 return NULL;
1975 }
1976
nf_tables_parse_netdev_hooks(struct net * net,const struct nlattr * attr,struct list_head * hook_list)1977 static int nf_tables_parse_netdev_hooks(struct net *net,
1978 const struct nlattr *attr,
1979 struct list_head *hook_list)
1980 {
1981 struct nft_hook *hook, *next;
1982 const struct nlattr *tmp;
1983 int rem, n = 0, err;
1984
1985 nla_for_each_nested(tmp, attr, rem) {
1986 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
1987 err = -EINVAL;
1988 goto err_hook;
1989 }
1990
1991 hook = nft_netdev_hook_alloc(net, tmp);
1992 if (IS_ERR(hook)) {
1993 err = PTR_ERR(hook);
1994 goto err_hook;
1995 }
1996 if (nft_hook_list_find(hook_list, hook)) {
1997 kfree(hook);
1998 err = -EEXIST;
1999 goto err_hook;
2000 }
2001 list_add_tail(&hook->list, hook_list);
2002 n++;
2003
2004 if (n == NFT_NETDEVICE_MAX) {
2005 err = -EFBIG;
2006 goto err_hook;
2007 }
2008 }
2009
2010 return 0;
2011
2012 err_hook:
2013 list_for_each_entry_safe(hook, next, hook_list, list) {
2014 list_del(&hook->list);
2015 kfree(hook);
2016 }
2017 return err;
2018 }
2019
2020 struct nft_chain_hook {
2021 u32 num;
2022 s32 priority;
2023 const struct nft_chain_type *type;
2024 struct list_head list;
2025 };
2026
nft_chain_parse_netdev(struct net * net,struct nlattr * tb[],struct list_head * hook_list)2027 static int nft_chain_parse_netdev(struct net *net,
2028 struct nlattr *tb[],
2029 struct list_head *hook_list)
2030 {
2031 struct nft_hook *hook;
2032 int err;
2033
2034 if (tb[NFTA_HOOK_DEV]) {
2035 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
2036 if (IS_ERR(hook))
2037 return PTR_ERR(hook);
2038
2039 list_add_tail(&hook->list, hook_list);
2040 } else if (tb[NFTA_HOOK_DEVS]) {
2041 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
2042 hook_list);
2043 if (err < 0)
2044 return err;
2045
2046 if (list_empty(hook_list))
2047 return -EINVAL;
2048 } else {
2049 return -EINVAL;
2050 }
2051
2052 return 0;
2053 }
2054
nft_chain_parse_hook(struct net * net,const struct nlattr * const nla[],struct nft_chain_hook * hook,u8 family,bool autoload)2055 static int nft_chain_parse_hook(struct net *net,
2056 const struct nlattr * const nla[],
2057 struct nft_chain_hook *hook, u8 family,
2058 bool autoload)
2059 {
2060 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
2061 struct nlattr *ha[NFTA_HOOK_MAX + 1];
2062 const struct nft_chain_type *type;
2063 int err;
2064
2065 lockdep_assert_held(&nft_net->commit_mutex);
2066 lockdep_nfnl_nft_mutex_not_held();
2067
2068 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
2069 nla[NFTA_CHAIN_HOOK],
2070 nft_hook_policy, NULL);
2071 if (err < 0)
2072 return err;
2073
2074 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
2075 ha[NFTA_HOOK_PRIORITY] == NULL)
2076 return -EINVAL;
2077
2078 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
2079 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
2080
2081 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
2082 if (!type)
2083 return -EOPNOTSUPP;
2084
2085 if (nla[NFTA_CHAIN_TYPE]) {
2086 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
2087 family, autoload);
2088 if (IS_ERR(type))
2089 return PTR_ERR(type);
2090 }
2091 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
2092 return -EOPNOTSUPP;
2093
2094 if (type->type == NFT_CHAIN_T_NAT &&
2095 hook->priority <= NF_IP_PRI_CONNTRACK)
2096 return -EOPNOTSUPP;
2097
2098 if (!try_module_get(type->owner))
2099 return -ENOENT;
2100
2101 hook->type = type;
2102
2103 INIT_LIST_HEAD(&hook->list);
2104 if (nft_base_chain_netdev(family, hook->num)) {
2105 err = nft_chain_parse_netdev(net, ha, &hook->list);
2106 if (err < 0) {
2107 module_put(type->owner);
2108 return err;
2109 }
2110 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) {
2111 module_put(type->owner);
2112 return -EOPNOTSUPP;
2113 }
2114
2115 return 0;
2116 }
2117
nft_chain_release_hook(struct nft_chain_hook * hook)2118 static void nft_chain_release_hook(struct nft_chain_hook *hook)
2119 {
2120 struct nft_hook *h, *next;
2121
2122 list_for_each_entry_safe(h, next, &hook->list, list) {
2123 list_del(&h->list);
2124 kfree(h);
2125 }
2126 module_put(hook->type->owner);
2127 }
2128
2129 struct nft_rules_old {
2130 struct rcu_head h;
2131 struct nft_rule **start;
2132 };
2133
nf_tables_chain_alloc_rules(const struct nft_chain * chain,unsigned int alloc)2134 static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
2135 unsigned int alloc)
2136 {
2137 if (alloc > INT_MAX)
2138 return NULL;
2139
2140 alloc += 1; /* NULL, ends rules */
2141 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
2142 return NULL;
2143
2144 alloc *= sizeof(struct nft_rule *);
2145 alloc += sizeof(struct nft_rules_old);
2146
2147 return kvmalloc(alloc, GFP_KERNEL);
2148 }
2149
nft_basechain_hook_init(struct nf_hook_ops * ops,u8 family,const struct nft_chain_hook * hook,struct nft_chain * chain)2150 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family,
2151 const struct nft_chain_hook *hook,
2152 struct nft_chain *chain)
2153 {
2154 ops->pf = family;
2155 ops->hooknum = hook->num;
2156 ops->priority = hook->priority;
2157 ops->priv = chain;
2158 ops->hook = hook->type->hooks[ops->hooknum];
2159 }
2160
nft_basechain_init(struct nft_base_chain * basechain,u8 family,struct nft_chain_hook * hook,u32 flags)2161 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
2162 struct nft_chain_hook *hook, u32 flags)
2163 {
2164 struct nft_chain *chain;
2165 struct nft_hook *h;
2166
2167 basechain->type = hook->type;
2168 INIT_LIST_HEAD(&basechain->hook_list);
2169 chain = &basechain->chain;
2170
2171 if (nft_base_chain_netdev(family, hook->num)) {
2172 list_splice_init(&hook->list, &basechain->hook_list);
2173 list_for_each_entry(h, &basechain->hook_list, list)
2174 nft_basechain_hook_init(&h->ops, family, hook, chain);
2175
2176 basechain->ops.hooknum = hook->num;
2177 basechain->ops.priority = hook->priority;
2178 } else {
2179 nft_basechain_hook_init(&basechain->ops, family, hook, chain);
2180 }
2181
2182 chain->flags |= NFT_CHAIN_BASE | flags;
2183 basechain->policy = NF_ACCEPT;
2184 if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
2185 !nft_chain_offload_support(basechain)) {
2186 list_splice_init(&basechain->hook_list, &hook->list);
2187 return -EOPNOTSUPP;
2188 }
2189
2190 flow_block_init(&basechain->flow_block);
2191
2192 return 0;
2193 }
2194
nft_chain_add(struct nft_table * table,struct nft_chain * chain)2195 int nft_chain_add(struct nft_table *table, struct nft_chain *chain)
2196 {
2197 int err;
2198
2199 err = rhltable_insert_key(&table->chains_ht, chain->name,
2200 &chain->rhlhead, nft_chain_ht_params);
2201 if (err)
2202 return err;
2203
2204 list_add_tail_rcu(&chain->list, &table->chains);
2205
2206 return 0;
2207 }
2208
2209 static u64 chain_id;
2210
nf_tables_addchain(struct nft_ctx * ctx,u8 family,u8 genmask,u8 policy,u32 flags)2211 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
2212 u8 policy, u32 flags)
2213 {
2214 const struct nlattr * const *nla = ctx->nla;
2215 struct nft_table *table = ctx->table;
2216 struct nft_base_chain *basechain;
2217 struct net *net = ctx->net;
2218 char name[NFT_NAME_MAXLEN];
2219 struct nft_trans *trans;
2220 struct nft_chain *chain;
2221 struct nft_rule **rules;
2222 int err;
2223
2224 if (nla[NFTA_CHAIN_HOOK]) {
2225 struct nft_stats __percpu *stats = NULL;
2226 struct nft_chain_hook hook;
2227
2228 if (flags & NFT_CHAIN_BINDING)
2229 return -EOPNOTSUPP;
2230
2231 err = nft_chain_parse_hook(net, nla, &hook, family, true);
2232 if (err < 0)
2233 return err;
2234
2235 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
2236 if (basechain == NULL) {
2237 nft_chain_release_hook(&hook);
2238 return -ENOMEM;
2239 }
2240 chain = &basechain->chain;
2241
2242 if (nla[NFTA_CHAIN_COUNTERS]) {
2243 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2244 if (IS_ERR(stats)) {
2245 nft_chain_release_hook(&hook);
2246 kfree(basechain);
2247 return PTR_ERR(stats);
2248 }
2249 rcu_assign_pointer(basechain->stats, stats);
2250 }
2251
2252 err = nft_basechain_init(basechain, family, &hook, flags);
2253 if (err < 0) {
2254 nft_chain_release_hook(&hook);
2255 kfree(basechain);
2256 free_percpu(stats);
2257 return err;
2258 }
2259 if (stats)
2260 static_branch_inc(&nft_counters_enabled);
2261 } else {
2262 if (flags & NFT_CHAIN_BASE)
2263 return -EINVAL;
2264 if (flags & NFT_CHAIN_HW_OFFLOAD)
2265 return -EOPNOTSUPP;
2266
2267 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
2268 if (chain == NULL)
2269 return -ENOMEM;
2270
2271 chain->flags = flags;
2272 }
2273 ctx->chain = chain;
2274
2275 INIT_LIST_HEAD(&chain->rules);
2276 chain->handle = nf_tables_alloc_handle(table);
2277 chain->table = table;
2278
2279 if (nla[NFTA_CHAIN_NAME]) {
2280 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2281 } else {
2282 if (!(flags & NFT_CHAIN_BINDING)) {
2283 err = -EINVAL;
2284 goto err_destroy_chain;
2285 }
2286
2287 snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
2288 chain->name = kstrdup(name, GFP_KERNEL);
2289 }
2290
2291 if (!chain->name) {
2292 err = -ENOMEM;
2293 goto err_destroy_chain;
2294 }
2295
2296 if (nla[NFTA_CHAIN_USERDATA]) {
2297 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);
2298 if (chain->udata == NULL) {
2299 err = -ENOMEM;
2300 goto err_destroy_chain;
2301 }
2302 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]);
2303 }
2304
2305 rules = nf_tables_chain_alloc_rules(chain, 0);
2306 if (!rules) {
2307 err = -ENOMEM;
2308 goto err_destroy_chain;
2309 }
2310
2311 *rules = NULL;
2312 rcu_assign_pointer(chain->rules_gen_0, rules);
2313 rcu_assign_pointer(chain->rules_gen_1, rules);
2314
2315 err = nf_tables_register_hook(net, table, chain);
2316 if (err < 0)
2317 goto err_destroy_chain;
2318
2319 if (!nft_use_inc(&table->use)) {
2320 err = -EMFILE;
2321 goto err_use;
2322 }
2323
2324 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
2325 if (IS_ERR(trans)) {
2326 err = PTR_ERR(trans);
2327 goto err_unregister_hook;
2328 }
2329
2330 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
2331 if (nft_is_base_chain(chain))
2332 nft_trans_chain_policy(trans) = policy;
2333
2334 err = nft_chain_add(table, chain);
2335 if (err < 0) {
2336 nft_trans_destroy(trans);
2337 goto err_unregister_hook;
2338 }
2339
2340 return 0;
2341
2342 err_unregister_hook:
2343 nft_use_dec_restore(&table->use);
2344 err_use:
2345 nf_tables_unregister_hook(net, table, chain);
2346 err_destroy_chain:
2347 nf_tables_chain_destroy(ctx);
2348
2349 return err;
2350 }
2351
nft_hook_list_equal(struct list_head * hook_list1,struct list_head * hook_list2)2352 static bool nft_hook_list_equal(struct list_head *hook_list1,
2353 struct list_head *hook_list2)
2354 {
2355 struct nft_hook *hook;
2356 int n = 0, m = 0;
2357
2358 n = 0;
2359 list_for_each_entry(hook, hook_list2, list) {
2360 if (!nft_hook_list_find(hook_list1, hook))
2361 return false;
2362
2363 n++;
2364 }
2365 list_for_each_entry(hook, hook_list1, list)
2366 m++;
2367
2368 return n == m;
2369 }
2370
nf_tables_updchain(struct nft_ctx * ctx,u8 genmask,u8 policy,u32 flags,const struct nlattr * attr,struct netlink_ext_ack * extack)2371 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
2372 u32 flags, const struct nlattr *attr,
2373 struct netlink_ext_ack *extack)
2374 {
2375 const struct nlattr * const *nla = ctx->nla;
2376 struct nft_table *table = ctx->table;
2377 struct nft_chain *chain = ctx->chain;
2378 struct nft_base_chain *basechain;
2379 struct nft_stats *stats = NULL;
2380 struct nft_chain_hook hook;
2381 struct nf_hook_ops *ops;
2382 struct nft_trans *trans;
2383 int err;
2384
2385 if (chain->flags ^ flags)
2386 return -EOPNOTSUPP;
2387
2388 if (nla[NFTA_CHAIN_HOOK]) {
2389 if (!nft_is_base_chain(chain)) {
2390 NL_SET_BAD_ATTR(extack, attr);
2391 return -EEXIST;
2392 }
2393 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
2394 false);
2395 if (err < 0)
2396 return err;
2397
2398 basechain = nft_base_chain(chain);
2399 if (basechain->type != hook.type) {
2400 nft_chain_release_hook(&hook);
2401 NL_SET_BAD_ATTR(extack, attr);
2402 return -EEXIST;
2403 }
2404
2405 if (nft_base_chain_netdev(ctx->family, hook.num)) {
2406 if (!nft_hook_list_equal(&basechain->hook_list,
2407 &hook.list)) {
2408 nft_chain_release_hook(&hook);
2409 NL_SET_BAD_ATTR(extack, attr);
2410 return -EEXIST;
2411 }
2412 } else {
2413 ops = &basechain->ops;
2414 if (ops->hooknum != hook.num ||
2415 ops->priority != hook.priority) {
2416 nft_chain_release_hook(&hook);
2417 NL_SET_BAD_ATTR(extack, attr);
2418 return -EEXIST;
2419 }
2420 }
2421 nft_chain_release_hook(&hook);
2422 }
2423
2424 if (nla[NFTA_CHAIN_HANDLE] &&
2425 nla[NFTA_CHAIN_NAME]) {
2426 struct nft_chain *chain2;
2427
2428 chain2 = nft_chain_lookup(ctx->net, table,
2429 nla[NFTA_CHAIN_NAME], genmask);
2430 if (!IS_ERR(chain2)) {
2431 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2432 return -EEXIST;
2433 }
2434 }
2435
2436 if (nla[NFTA_CHAIN_COUNTERS]) {
2437 if (!nft_is_base_chain(chain))
2438 return -EOPNOTSUPP;
2439
2440 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2441 if (IS_ERR(stats))
2442 return PTR_ERR(stats);
2443 }
2444
2445 err = -ENOMEM;
2446 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
2447 sizeof(struct nft_trans_chain));
2448 if (trans == NULL)
2449 goto err;
2450
2451 nft_trans_chain_stats(trans) = stats;
2452 nft_trans_chain_update(trans) = true;
2453
2454 if (nla[NFTA_CHAIN_POLICY])
2455 nft_trans_chain_policy(trans) = policy;
2456 else
2457 nft_trans_chain_policy(trans) = -1;
2458
2459 if (nla[NFTA_CHAIN_HANDLE] &&
2460 nla[NFTA_CHAIN_NAME]) {
2461 struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
2462 struct nft_trans *tmp;
2463 char *name;
2464
2465 err = -ENOMEM;
2466 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2467 if (!name)
2468 goto err;
2469
2470 err = -EEXIST;
2471 list_for_each_entry(tmp, &nft_net->commit_list, list) {
2472 if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
2473 tmp->ctx.table == table &&
2474 nft_trans_chain_update(tmp) &&
2475 nft_trans_chain_name(tmp) &&
2476 strcmp(name, nft_trans_chain_name(tmp)) == 0) {
2477 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2478 kfree(name);
2479 goto err;
2480 }
2481 }
2482
2483 nft_trans_chain_name(trans) = name;
2484 }
2485 nft_trans_commit_list_add_tail(ctx->net, trans);
2486
2487 return 0;
2488 err:
2489 free_percpu(stats);
2490 kfree(trans);
2491 return err;
2492 }
2493
nft_chain_lookup_byid(const struct net * net,const struct nft_table * table,const struct nlattr * nla,u8 genmask)2494 static struct nft_chain *nft_chain_lookup_byid(const struct net *net,
2495 const struct nft_table *table,
2496 const struct nlattr *nla, u8 genmask)
2497 {
2498 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
2499 u32 id = ntohl(nla_get_be32(nla));
2500 struct nft_trans *trans;
2501
2502 list_for_each_entry(trans, &nft_net->commit_list, list) {
2503 struct nft_chain *chain = trans->ctx.chain;
2504
2505 if (trans->msg_type == NFT_MSG_NEWCHAIN &&
2506 chain->table == table &&
2507 id == nft_trans_chain_id(trans) &&
2508 nft_active_genmask(chain, genmask))
2509 return chain;
2510 }
2511 return ERR_PTR(-ENOENT);
2512 }
2513
nf_tables_newchain(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)2514 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
2515 struct sk_buff *skb, const struct nlmsghdr *nlh,
2516 const struct nlattr * const nla[],
2517 struct netlink_ext_ack *extack)
2518 {
2519 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
2520 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2521 u8 genmask = nft_genmask_next(net);
2522 int family = nfmsg->nfgen_family;
2523 struct nft_chain *chain = NULL;
2524 const struct nlattr *attr;
2525 struct nft_table *table;
2526 u8 policy = NF_ACCEPT;
2527 struct nft_ctx ctx;
2528 u64 handle = 0;
2529 u32 flags = 0;
2530
2531 lockdep_assert_held(&nft_net->commit_mutex);
2532
2533 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
2534 if (IS_ERR(table)) {
2535 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2536 return PTR_ERR(table);
2537 }
2538
2539 chain = NULL;
2540 attr = nla[NFTA_CHAIN_NAME];
2541
2542 if (nla[NFTA_CHAIN_HANDLE]) {
2543 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
2544 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2545 if (IS_ERR(chain)) {
2546 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
2547 return PTR_ERR(chain);
2548 }
2549 attr = nla[NFTA_CHAIN_HANDLE];
2550 } else if (nla[NFTA_CHAIN_NAME]) {
2551 chain = nft_chain_lookup(net, table, attr, genmask);
2552 if (IS_ERR(chain)) {
2553 if (PTR_ERR(chain) != -ENOENT) {
2554 NL_SET_BAD_ATTR(extack, attr);
2555 return PTR_ERR(chain);
2556 }
2557 chain = NULL;
2558 }
2559 } else if (!nla[NFTA_CHAIN_ID]) {
2560 return -EINVAL;
2561 }
2562
2563 if (nla[NFTA_CHAIN_POLICY]) {
2564 if (chain != NULL &&
2565 !nft_is_base_chain(chain)) {
2566 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2567 return -EOPNOTSUPP;
2568 }
2569
2570 if (chain == NULL &&
2571 nla[NFTA_CHAIN_HOOK] == NULL) {
2572 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2573 return -EOPNOTSUPP;
2574 }
2575
2576 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
2577 switch (policy) {
2578 case NF_DROP:
2579 case NF_ACCEPT:
2580 break;
2581 default:
2582 return -EINVAL;
2583 }
2584 }
2585
2586 if (nla[NFTA_CHAIN_FLAGS])
2587 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
2588 else if (chain)
2589 flags = chain->flags;
2590
2591 if (flags & ~NFT_CHAIN_FLAGS)
2592 return -EOPNOTSUPP;
2593
2594 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2595
2596 if (chain != NULL) {
2597 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2598 NL_SET_BAD_ATTR(extack, attr);
2599 return -EEXIST;
2600 }
2601 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2602 return -EOPNOTSUPP;
2603
2604 flags |= chain->flags & NFT_CHAIN_BASE;
2605 return nf_tables_updchain(&ctx, genmask, policy, flags, attr,
2606 extack);
2607 }
2608
2609 return nf_tables_addchain(&ctx, family, genmask, policy, flags);
2610 }
2611
nf_tables_delchain(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)2612 static int nf_tables_delchain(struct net *net, struct sock *nlsk,
2613 struct sk_buff *skb, const struct nlmsghdr *nlh,
2614 const struct nlattr * const nla[],
2615 struct netlink_ext_ack *extack)
2616 {
2617 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2618 u8 genmask = nft_genmask_next(net);
2619 int family = nfmsg->nfgen_family;
2620 const struct nlattr *attr;
2621 struct nft_table *table;
2622 struct nft_chain *chain;
2623 struct nft_rule *rule;
2624 struct nft_ctx ctx;
2625 u64 handle;
2626 u32 use;
2627 int err;
2628
2629 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
2630 if (IS_ERR(table)) {
2631 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2632 return PTR_ERR(table);
2633 }
2634
2635 if (nla[NFTA_CHAIN_HANDLE]) {
2636 attr = nla[NFTA_CHAIN_HANDLE];
2637 handle = be64_to_cpu(nla_get_be64(attr));
2638 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2639 } else {
2640 attr = nla[NFTA_CHAIN_NAME];
2641 chain = nft_chain_lookup(net, table, attr, genmask);
2642 }
2643 if (IS_ERR(chain)) {
2644 NL_SET_BAD_ATTR(extack, attr);
2645 return PTR_ERR(chain);
2646 }
2647
2648 if (nft_chain_binding(chain))
2649 return -EOPNOTSUPP;
2650
2651 if (nlh->nlmsg_flags & NLM_F_NONREC &&
2652 chain->use > 0)
2653 return -EBUSY;
2654
2655 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2656
2657 use = chain->use;
2658 list_for_each_entry(rule, &chain->rules, list) {
2659 if (!nft_is_active_next(net, rule))
2660 continue;
2661 use--;
2662
2663 err = nft_delrule(&ctx, rule);
2664 if (err < 0)
2665 return err;
2666 }
2667
2668 /* There are rules and elements that are still holding references to us,
2669 * we cannot do a recursive removal in this case.
2670 */
2671 if (use > 0) {
2672 NL_SET_BAD_ATTR(extack, attr);
2673 return -EBUSY;
2674 }
2675
2676 return nft_delchain(&ctx);
2677 }
2678
2679 /*
2680 * Expressions
2681 */
2682
2683 /**
2684 * nft_register_expr - register nf_tables expr type
2685 * @type: expr type
2686 *
2687 * Registers the expr type for use with nf_tables. Returns zero on
2688 * success or a negative errno code otherwise.
2689 */
nft_register_expr(struct nft_expr_type * type)2690 int nft_register_expr(struct nft_expr_type *type)
2691 {
2692 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2693 if (type->family == NFPROTO_UNSPEC)
2694 list_add_tail_rcu(&type->list, &nf_tables_expressions);
2695 else
2696 list_add_rcu(&type->list, &nf_tables_expressions);
2697 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2698 return 0;
2699 }
2700 EXPORT_SYMBOL_GPL(nft_register_expr);
2701
2702 /**
2703 * nft_unregister_expr - unregister nf_tables expr type
2704 * @type: expr type
2705 *
2706 * Unregisters the expr typefor use with nf_tables.
2707 */
nft_unregister_expr(struct nft_expr_type * type)2708 void nft_unregister_expr(struct nft_expr_type *type)
2709 {
2710 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2711 list_del_rcu(&type->list);
2712 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2713 }
2714 EXPORT_SYMBOL_GPL(nft_unregister_expr);
2715
__nft_expr_type_get(u8 family,struct nlattr * nla)2716 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2717 struct nlattr *nla)
2718 {
2719 const struct nft_expr_type *type, *candidate = NULL;
2720
2721 list_for_each_entry(type, &nf_tables_expressions, list) {
2722 if (!nla_strcmp(nla, type->name)) {
2723 if (!type->family && !candidate)
2724 candidate = type;
2725 else if (type->family == family)
2726 candidate = type;
2727 }
2728 }
2729 return candidate;
2730 }
2731
2732 #ifdef CONFIG_MODULES
nft_expr_type_request_module(struct net * net,u8 family,struct nlattr * nla)2733 static int nft_expr_type_request_module(struct net *net, u8 family,
2734 struct nlattr *nla)
2735 {
2736 if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2737 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
2738 return -EAGAIN;
2739
2740 return 0;
2741 }
2742 #endif
2743
nft_expr_type_get(struct net * net,u8 family,struct nlattr * nla)2744 static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2745 u8 family,
2746 struct nlattr *nla)
2747 {
2748 const struct nft_expr_type *type;
2749
2750 if (nla == NULL)
2751 return ERR_PTR(-EINVAL);
2752
2753 type = __nft_expr_type_get(family, nla);
2754 if (type != NULL && try_module_get(type->owner))
2755 return type;
2756
2757 lockdep_nfnl_nft_mutex_not_held();
2758 #ifdef CONFIG_MODULES
2759 if (type == NULL) {
2760 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
2761 return ERR_PTR(-EAGAIN);
2762
2763 if (nft_request_module(net, "nft-expr-%.*s",
2764 nla_len(nla),
2765 (char *)nla_data(nla)) == -EAGAIN)
2766 return ERR_PTR(-EAGAIN);
2767 }
2768 #endif
2769 return ERR_PTR(-ENOENT);
2770 }
2771
2772 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2773 [NFTA_EXPR_NAME] = { .type = NLA_STRING,
2774 .len = NFT_MODULE_AUTOLOAD_LIMIT },
2775 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
2776 };
2777
nf_tables_fill_expr_info(struct sk_buff * skb,const struct nft_expr * expr)2778 static int nf_tables_fill_expr_info(struct sk_buff *skb,
2779 const struct nft_expr *expr)
2780 {
2781 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
2782 goto nla_put_failure;
2783
2784 if (expr->ops->dump) {
2785 struct nlattr *data = nla_nest_start_noflag(skb,
2786 NFTA_EXPR_DATA);
2787 if (data == NULL)
2788 goto nla_put_failure;
2789 if (expr->ops->dump(skb, expr) < 0)
2790 goto nla_put_failure;
2791 nla_nest_end(skb, data);
2792 }
2793
2794 return skb->len;
2795
2796 nla_put_failure:
2797 return -1;
2798 };
2799
nft_expr_dump(struct sk_buff * skb,unsigned int attr,const struct nft_expr * expr)2800 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2801 const struct nft_expr *expr)
2802 {
2803 struct nlattr *nest;
2804
2805 nest = nla_nest_start_noflag(skb, attr);
2806 if (!nest)
2807 goto nla_put_failure;
2808 if (nf_tables_fill_expr_info(skb, expr) < 0)
2809 goto nla_put_failure;
2810 nla_nest_end(skb, nest);
2811 return 0;
2812
2813 nla_put_failure:
2814 return -1;
2815 }
2816
2817 struct nft_expr_info {
2818 const struct nft_expr_ops *ops;
2819 const struct nlattr *attr;
2820 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
2821 };
2822
nf_tables_expr_parse(const struct nft_ctx * ctx,const struct nlattr * nla,struct nft_expr_info * info)2823 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2824 const struct nlattr *nla,
2825 struct nft_expr_info *info)
2826 {
2827 const struct nft_expr_type *type;
2828 const struct nft_expr_ops *ops;
2829 struct nlattr *tb[NFTA_EXPR_MAX + 1];
2830 int err;
2831
2832 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2833 nft_expr_policy, NULL);
2834 if (err < 0)
2835 return err;
2836
2837 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
2838 if (IS_ERR(type))
2839 return PTR_ERR(type);
2840
2841 if (tb[NFTA_EXPR_DATA]) {
2842 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2843 tb[NFTA_EXPR_DATA],
2844 type->policy, NULL);
2845 if (err < 0)
2846 goto err1;
2847 } else
2848 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2849
2850 if (type->select_ops != NULL) {
2851 ops = type->select_ops(ctx,
2852 (const struct nlattr * const *)info->tb);
2853 if (IS_ERR(ops)) {
2854 err = PTR_ERR(ops);
2855 #ifdef CONFIG_MODULES
2856 if (err == -EAGAIN)
2857 if (nft_expr_type_request_module(ctx->net,
2858 ctx->family,
2859 tb[NFTA_EXPR_NAME]) != -EAGAIN)
2860 err = -ENOENT;
2861 #endif
2862 goto err1;
2863 }
2864 } else
2865 ops = type->ops;
2866
2867 info->attr = nla;
2868 info->ops = ops;
2869
2870 return 0;
2871
2872 err1:
2873 module_put(type->owner);
2874 return err;
2875 }
2876
nf_tables_newexpr(const struct nft_ctx * ctx,const struct nft_expr_info * info,struct nft_expr * expr)2877 static int nf_tables_newexpr(const struct nft_ctx *ctx,
2878 const struct nft_expr_info *info,
2879 struct nft_expr *expr)
2880 {
2881 const struct nft_expr_ops *ops = info->ops;
2882 int err;
2883
2884 expr->ops = ops;
2885 if (ops->init) {
2886 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
2887 if (err < 0)
2888 goto err1;
2889 }
2890
2891 return 0;
2892 err1:
2893 expr->ops = NULL;
2894 return err;
2895 }
2896
nf_tables_expr_destroy(const struct nft_ctx * ctx,struct nft_expr * expr)2897 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2898 struct nft_expr *expr)
2899 {
2900 const struct nft_expr_type *type = expr->ops->type;
2901
2902 if (expr->ops->destroy)
2903 expr->ops->destroy(ctx, expr);
2904 module_put(type->owner);
2905 }
2906
nft_expr_init(const struct nft_ctx * ctx,const struct nlattr * nla)2907 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2908 const struct nlattr *nla)
2909 {
2910 struct nft_expr_info info;
2911 struct nft_expr *expr;
2912 struct module *owner;
2913 int err;
2914
2915 err = nf_tables_expr_parse(ctx, nla, &info);
2916 if (err < 0)
2917 goto err_expr_parse;
2918
2919 err = -EOPNOTSUPP;
2920 if (!(info.ops->type->flags & NFT_EXPR_STATEFUL))
2921 goto err_expr_stateful;
2922
2923 err = -ENOMEM;
2924 expr = kzalloc(info.ops->size, GFP_KERNEL);
2925 if (expr == NULL)
2926 goto err_expr_stateful;
2927
2928 err = nf_tables_newexpr(ctx, &info, expr);
2929 if (err < 0)
2930 goto err_expr_new;
2931
2932 return expr;
2933 err_expr_new:
2934 kfree(expr);
2935 err_expr_stateful:
2936 owner = info.ops->type->owner;
2937 if (info.ops->type->release_ops)
2938 info.ops->type->release_ops(info.ops);
2939
2940 module_put(owner);
2941 err_expr_parse:
2942 return ERR_PTR(err);
2943 }
2944
nft_expr_clone(struct nft_expr * dst,struct nft_expr * src)2945 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
2946 {
2947 int err;
2948
2949 if (src->ops->clone) {
2950 dst->ops = src->ops;
2951 err = src->ops->clone(dst, src);
2952 if (err < 0)
2953 return err;
2954 } else {
2955 memcpy(dst, src, src->ops->size);
2956 }
2957
2958 __module_get(src->ops->type->owner);
2959
2960 return 0;
2961 }
2962
nft_expr_destroy(const struct nft_ctx * ctx,struct nft_expr * expr)2963 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2964 {
2965 nf_tables_expr_destroy(ctx, expr);
2966 kfree(expr);
2967 }
2968
2969 /*
2970 * Rules
2971 */
2972
__nft_rule_lookup(const struct nft_chain * chain,u64 handle)2973 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2974 u64 handle)
2975 {
2976 struct nft_rule *rule;
2977
2978 // FIXME: this sucks
2979 list_for_each_entry_rcu(rule, &chain->rules, list) {
2980 if (handle == rule->handle)
2981 return rule;
2982 }
2983
2984 return ERR_PTR(-ENOENT);
2985 }
2986
nft_rule_lookup(const struct nft_chain * chain,const struct nlattr * nla)2987 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2988 const struct nlattr *nla)
2989 {
2990 if (nla == NULL)
2991 return ERR_PTR(-EINVAL);
2992
2993 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
2994 }
2995
2996 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
2997 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2998 .len = NFT_TABLE_MAXNAMELEN - 1 },
2999 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
3000 .len = NFT_CHAIN_MAXNAMELEN - 1 },
3001 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
3002 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
3003 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
3004 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
3005 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
3006 .len = NFT_USERDATA_MAXLEN },
3007 [NFTA_RULE_ID] = { .type = NLA_U32 },
3008 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
3009 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 },
3010 };
3011
nf_tables_fill_rule_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table,const struct nft_chain * chain,const struct nft_rule * rule,const struct nft_rule * prule)3012 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
3013 u32 portid, u32 seq, int event,
3014 u32 flags, int family,
3015 const struct nft_table *table,
3016 const struct nft_chain *chain,
3017 const struct nft_rule *rule,
3018 const struct nft_rule *prule)
3019 {
3020 struct nlmsghdr *nlh;
3021 const struct nft_expr *expr, *next;
3022 struct nlattr *list;
3023 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3024
3025 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0,
3026 nft_base_seq(net));
3027 if (!nlh)
3028 goto nla_put_failure;
3029
3030 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
3031 goto nla_put_failure;
3032 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
3033 goto nla_put_failure;
3034 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
3035 NFTA_RULE_PAD))
3036 goto nla_put_failure;
3037
3038 if (event != NFT_MSG_DELRULE && prule) {
3039 if (nla_put_be64(skb, NFTA_RULE_POSITION,
3040 cpu_to_be64(prule->handle),
3041 NFTA_RULE_PAD))
3042 goto nla_put_failure;
3043 }
3044
3045 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
3046 if (list == NULL)
3047 goto nla_put_failure;
3048 nft_rule_for_each_expr(expr, next, rule) {
3049 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
3050 goto nla_put_failure;
3051 }
3052 nla_nest_end(skb, list);
3053
3054 if (rule->udata) {
3055 struct nft_userdata *udata = nft_userdata(rule);
3056 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
3057 udata->data) < 0)
3058 goto nla_put_failure;
3059 }
3060
3061 nlmsg_end(skb, nlh);
3062 return 0;
3063
3064 nla_put_failure:
3065 nlmsg_trim(skb, nlh);
3066 return -1;
3067 }
3068
nf_tables_rule_notify(const struct nft_ctx * ctx,const struct nft_rule * rule,int event)3069 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
3070 const struct nft_rule *rule, int event)
3071 {
3072 struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
3073 struct sk_buff *skb;
3074 int err;
3075
3076 if (!ctx->report &&
3077 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
3078 return;
3079
3080 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3081 if (skb == NULL)
3082 goto err;
3083
3084 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
3085 event, 0, ctx->family, ctx->table,
3086 ctx->chain, rule, NULL);
3087 if (err < 0) {
3088 kfree_skb(skb);
3089 goto err;
3090 }
3091
3092 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
3093 return;
3094 err:
3095 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
3096 }
3097
3098 struct nft_rule_dump_ctx {
3099 char *table;
3100 char *chain;
3101 };
3102
__nf_tables_dump_rules(struct sk_buff * skb,unsigned int * idx,struct netlink_callback * cb,const struct nft_table * table,const struct nft_chain * chain)3103 static int __nf_tables_dump_rules(struct sk_buff *skb,
3104 unsigned int *idx,
3105 struct netlink_callback *cb,
3106 const struct nft_table *table,
3107 const struct nft_chain *chain)
3108 {
3109 struct net *net = sock_net(skb->sk);
3110 const struct nft_rule *rule, *prule;
3111 unsigned int s_idx = cb->args[0];
3112
3113 prule = NULL;
3114 list_for_each_entry_rcu(rule, &chain->rules, list) {
3115 if (!nft_is_active(net, rule))
3116 goto cont_skip;
3117 if (*idx < s_idx)
3118 goto cont;
3119 if (*idx > s_idx) {
3120 memset(&cb->args[1], 0,
3121 sizeof(cb->args) - sizeof(cb->args[0]));
3122 }
3123 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
3124 cb->nlh->nlmsg_seq,
3125 NFT_MSG_NEWRULE,
3126 NLM_F_MULTI | NLM_F_APPEND,
3127 table->family,
3128 table, chain, rule, prule) < 0)
3129 return 1;
3130
3131 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3132 cont:
3133 prule = rule;
3134 cont_skip:
3135 (*idx)++;
3136 }
3137 return 0;
3138 }
3139
nf_tables_dump_rules(struct sk_buff * skb,struct netlink_callback * cb)3140 static int nf_tables_dump_rules(struct sk_buff *skb,
3141 struct netlink_callback *cb)
3142 {
3143 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
3144 const struct nft_rule_dump_ctx *ctx = cb->data;
3145 struct nft_table *table;
3146 const struct nft_chain *chain;
3147 unsigned int idx = 0;
3148 struct net *net = sock_net(skb->sk);
3149 int family = nfmsg->nfgen_family;
3150 struct nftables_pernet *nft_net;
3151
3152 rcu_read_lock();
3153 nft_net = net_generic(net, nf_tables_net_id);
3154 cb->seq = nft_net->base_seq;
3155
3156 list_for_each_entry_rcu(table, &nft_net->tables, list) {
3157 if (family != NFPROTO_UNSPEC && family != table->family)
3158 continue;
3159
3160 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
3161 continue;
3162
3163 if (ctx && ctx->table && ctx->chain) {
3164 struct rhlist_head *list, *tmp;
3165
3166 list = rhltable_lookup(&table->chains_ht, ctx->chain,
3167 nft_chain_ht_params);
3168 if (!list)
3169 goto done;
3170
3171 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
3172 if (!nft_is_active(net, chain))
3173 continue;
3174 __nf_tables_dump_rules(skb, &idx,
3175 cb, table, chain);
3176 break;
3177 }
3178 goto done;
3179 }
3180
3181 list_for_each_entry_rcu(chain, &table->chains, list) {
3182 if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
3183 goto done;
3184 }
3185
3186 if (ctx && ctx->table)
3187 break;
3188 }
3189 done:
3190 rcu_read_unlock();
3191
3192 cb->args[0] = idx;
3193 return skb->len;
3194 }
3195
nf_tables_dump_rules_start(struct netlink_callback * cb)3196 static int nf_tables_dump_rules_start(struct netlink_callback *cb)
3197 {
3198 const struct nlattr * const *nla = cb->data;
3199 struct nft_rule_dump_ctx *ctx = NULL;
3200
3201 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
3202 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
3203 if (!ctx)
3204 return -ENOMEM;
3205
3206 if (nla[NFTA_RULE_TABLE]) {
3207 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
3208 GFP_ATOMIC);
3209 if (!ctx->table) {
3210 kfree(ctx);
3211 return -ENOMEM;
3212 }
3213 }
3214 if (nla[NFTA_RULE_CHAIN]) {
3215 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
3216 GFP_ATOMIC);
3217 if (!ctx->chain) {
3218 kfree(ctx->table);
3219 kfree(ctx);
3220 return -ENOMEM;
3221 }
3222 }
3223 }
3224
3225 cb->data = ctx;
3226 return 0;
3227 }
3228
nf_tables_dump_rules_done(struct netlink_callback * cb)3229 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
3230 {
3231 struct nft_rule_dump_ctx *ctx = cb->data;
3232
3233 if (ctx) {
3234 kfree(ctx->table);
3235 kfree(ctx->chain);
3236 kfree(ctx);
3237 }
3238 return 0;
3239 }
3240
3241 /* called with rcu_read_lock held */
nf_tables_getrule(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)3242 static int nf_tables_getrule(struct net *net, struct sock *nlsk,
3243 struct sk_buff *skb, const struct nlmsghdr *nlh,
3244 const struct nlattr * const nla[],
3245 struct netlink_ext_ack *extack)
3246 {
3247 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3248 u8 genmask = nft_genmask_cur(net);
3249 const struct nft_chain *chain;
3250 const struct nft_rule *rule;
3251 struct nft_table *table;
3252 struct sk_buff *skb2;
3253 int family = nfmsg->nfgen_family;
3254 int err;
3255
3256 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3257 struct netlink_dump_control c = {
3258 .start= nf_tables_dump_rules_start,
3259 .dump = nf_tables_dump_rules,
3260 .done = nf_tables_dump_rules_done,
3261 .module = THIS_MODULE,
3262 .data = (void *)nla,
3263 };
3264
3265 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3266 }
3267
3268 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3269 if (IS_ERR(table)) {
3270 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3271 return PTR_ERR(table);
3272 }
3273
3274 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
3275 if (IS_ERR(chain)) {
3276 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3277 return PTR_ERR(chain);
3278 }
3279
3280 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3281 if (IS_ERR(rule)) {
3282 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3283 return PTR_ERR(rule);
3284 }
3285
3286 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3287 if (!skb2)
3288 return -ENOMEM;
3289
3290 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
3291 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
3292 family, table, chain, rule, NULL);
3293 if (err < 0)
3294 goto err_fill_rule_info;
3295
3296 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
3297
3298 err_fill_rule_info:
3299 kfree_skb(skb2);
3300 return err;
3301 }
3302
nf_tables_rule_destroy(const struct nft_ctx * ctx,struct nft_rule * rule)3303 void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule)
3304 {
3305 struct nft_expr *expr, *next;
3306
3307 /*
3308 * Careful: some expressions might not be initialized in case this
3309 * is called on error from nf_tables_newrule().
3310 */
3311 expr = nft_expr_first(rule);
3312 while (nft_expr_more(rule, expr)) {
3313 next = nft_expr_next(expr);
3314 nf_tables_expr_destroy(ctx, expr);
3315 expr = next;
3316 }
3317 kfree(rule);
3318 }
3319
nf_tables_rule_release(const struct nft_ctx * ctx,struct nft_rule * rule)3320 static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)
3321 {
3322 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
3323 nf_tables_rule_destroy(ctx, rule);
3324 }
3325
nft_chain_validate(const struct nft_ctx * ctx,const struct nft_chain * chain)3326 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
3327 {
3328 struct nft_expr *expr, *last;
3329 const struct nft_data *data;
3330 struct nft_rule *rule;
3331 int err;
3332
3333 if (ctx->level == NFT_JUMP_STACK_SIZE)
3334 return -EMLINK;
3335
3336 list_for_each_entry(rule, &chain->rules, list) {
3337 if (!nft_is_active_next(ctx->net, rule))
3338 continue;
3339
3340 nft_rule_for_each_expr(expr, last, rule) {
3341 if (!expr->ops->validate)
3342 continue;
3343
3344 err = expr->ops->validate(ctx, expr, &data);
3345 if (err < 0)
3346 return err;
3347 }
3348 }
3349
3350 return 0;
3351 }
3352 EXPORT_SYMBOL_GPL(nft_chain_validate);
3353
nft_table_validate(struct net * net,const struct nft_table * table)3354 static int nft_table_validate(struct net *net, const struct nft_table *table)
3355 {
3356 struct nft_chain *chain;
3357 struct nft_ctx ctx = {
3358 .net = net,
3359 .family = table->family,
3360 };
3361 int err;
3362
3363 list_for_each_entry(chain, &table->chains, list) {
3364 if (!nft_is_base_chain(chain))
3365 continue;
3366
3367 ctx.chain = chain;
3368 err = nft_chain_validate(&ctx, chain);
3369 if (err < 0)
3370 return err;
3371
3372 cond_resched();
3373 }
3374
3375 return 0;
3376 }
3377
3378 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3379 const struct nft_chain *chain,
3380 const struct nlattr *nla);
3381
3382 #define NFT_RULE_MAXEXPRS 128
3383
nf_tables_newrule(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)3384 static int nf_tables_newrule(struct net *net, struct sock *nlsk,
3385 struct sk_buff *skb, const struct nlmsghdr *nlh,
3386 const struct nlattr * const nla[],
3387 struct netlink_ext_ack *extack)
3388 {
3389 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
3390 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3391 u8 genmask = nft_genmask_next(net);
3392 struct nft_expr_info *info = NULL;
3393 int family = nfmsg->nfgen_family;
3394 struct nft_flow_rule *flow;
3395 struct nft_table *table;
3396 struct nft_chain *chain;
3397 struct nft_rule *rule, *old_rule = NULL;
3398 struct nft_userdata *udata;
3399 struct nft_trans *trans = NULL;
3400 struct nft_expr *expr;
3401 struct nft_ctx ctx;
3402 struct nlattr *tmp;
3403 unsigned int size, i, n, ulen = 0, usize = 0;
3404 int err, rem;
3405 u64 handle, pos_handle;
3406
3407 lockdep_assert_held(&nft_net->commit_mutex);
3408
3409 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3410 if (IS_ERR(table)) {
3411 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3412 return PTR_ERR(table);
3413 }
3414
3415 if (nla[NFTA_RULE_CHAIN]) {
3416 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3417 genmask);
3418 if (IS_ERR(chain)) {
3419 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3420 return PTR_ERR(chain);
3421 }
3422
3423 } else if (nla[NFTA_RULE_CHAIN_ID]) {
3424 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
3425 genmask);
3426 if (IS_ERR(chain)) {
3427 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);
3428 return PTR_ERR(chain);
3429 }
3430 } else {
3431 return -EINVAL;
3432 }
3433
3434 if (nft_chain_is_bound(chain))
3435 return -EOPNOTSUPP;
3436
3437 if (nla[NFTA_RULE_HANDLE]) {
3438 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
3439 rule = __nft_rule_lookup(chain, handle);
3440 if (IS_ERR(rule)) {
3441 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3442 return PTR_ERR(rule);
3443 }
3444
3445 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3446 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3447 return -EEXIST;
3448 }
3449 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3450 old_rule = rule;
3451 else
3452 return -EOPNOTSUPP;
3453 } else {
3454 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
3455 nlh->nlmsg_flags & NLM_F_REPLACE)
3456 return -EINVAL;
3457 handle = nf_tables_alloc_handle(table);
3458
3459 if (nla[NFTA_RULE_POSITION]) {
3460 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
3461 old_rule = __nft_rule_lookup(chain, pos_handle);
3462 if (IS_ERR(old_rule)) {
3463 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
3464 return PTR_ERR(old_rule);
3465 }
3466 } else if (nla[NFTA_RULE_POSITION_ID]) {
3467 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]);
3468 if (IS_ERR(old_rule)) {
3469 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
3470 return PTR_ERR(old_rule);
3471 }
3472 }
3473 }
3474
3475 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
3476
3477 n = 0;
3478 size = 0;
3479 if (nla[NFTA_RULE_EXPRESSIONS]) {
3480 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
3481 sizeof(struct nft_expr_info),
3482 GFP_KERNEL);
3483 if (!info)
3484 return -ENOMEM;
3485
3486 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
3487 err = -EINVAL;
3488 if (nla_type(tmp) != NFTA_LIST_ELEM)
3489 goto err1;
3490 if (n == NFT_RULE_MAXEXPRS)
3491 goto err1;
3492 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
3493 if (err < 0) {
3494 NL_SET_BAD_ATTR(extack, tmp);
3495 goto err1;
3496 }
3497 size += info[n].ops->size;
3498 n++;
3499 }
3500 }
3501 /* Check for overflow of dlen field */
3502 err = -EFBIG;
3503 if (size >= 1 << 12)
3504 goto err1;
3505
3506 if (nla[NFTA_RULE_USERDATA]) {
3507 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
3508 if (ulen > 0)
3509 usize = sizeof(struct nft_userdata) + ulen;
3510 }
3511
3512 err = -ENOMEM;
3513 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
3514 if (rule == NULL)
3515 goto err1;
3516
3517 nft_activate_next(net, rule);
3518
3519 rule->handle = handle;
3520 rule->dlen = size;
3521 rule->udata = ulen ? 1 : 0;
3522
3523 if (ulen) {
3524 udata = nft_userdata(rule);
3525 udata->len = ulen - 1;
3526 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
3527 }
3528
3529 expr = nft_expr_first(rule);
3530 for (i = 0; i < n; i++) {
3531 err = nf_tables_newexpr(&ctx, &info[i], expr);
3532 if (err < 0) {
3533 NL_SET_BAD_ATTR(extack, info[i].attr);
3534 goto err2;
3535 }
3536
3537 if (info[i].ops->validate)
3538 nft_validate_state_update(net, NFT_VALIDATE_NEED);
3539
3540 info[i].ops = NULL;
3541 expr = nft_expr_next(expr);
3542 }
3543
3544 if (!nft_use_inc(&chain->use)) {
3545 err = -EMFILE;
3546 goto err2;
3547 }
3548
3549 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
3550 if (nft_chain_binding(chain)) {
3551 err = -EOPNOTSUPP;
3552 goto err_destroy_flow_rule;
3553 }
3554
3555 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3556 if (trans == NULL) {
3557 err = -ENOMEM;
3558 goto err_destroy_flow_rule;
3559 }
3560 err = nft_delrule(&ctx, old_rule);
3561 if (err < 0) {
3562 nft_trans_destroy(trans);
3563 goto err_destroy_flow_rule;
3564 }
3565
3566 list_add_tail_rcu(&rule->list, &old_rule->list);
3567 } else {
3568 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3569 if (!trans) {
3570 err = -ENOMEM;
3571 goto err_destroy_flow_rule;
3572 }
3573
3574 if (nlh->nlmsg_flags & NLM_F_APPEND) {
3575 if (old_rule)
3576 list_add_rcu(&rule->list, &old_rule->list);
3577 else
3578 list_add_tail_rcu(&rule->list, &chain->rules);
3579 } else {
3580 if (old_rule)
3581 list_add_tail_rcu(&rule->list, &old_rule->list);
3582 else
3583 list_add_rcu(&rule->list, &chain->rules);
3584 }
3585 }
3586 kvfree(info);
3587
3588 if (nft_net->validate_state == NFT_VALIDATE_DO)
3589 return nft_table_validate(net, table);
3590
3591 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
3592 flow = nft_flow_rule_create(net, rule);
3593 if (IS_ERR(flow))
3594 return PTR_ERR(flow);
3595
3596 nft_trans_flow_rule(trans) = flow;
3597 }
3598
3599 return 0;
3600
3601 err_destroy_flow_rule:
3602 nft_use_dec_restore(&chain->use);
3603 err2:
3604 nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR);
3605 nf_tables_rule_destroy(&ctx, rule);
3606 err1:
3607 for (i = 0; i < n; i++) {
3608 if (info[i].ops) {
3609 module_put(info[i].ops->type->owner);
3610 if (info[i].ops->type->release_ops)
3611 info[i].ops->type->release_ops(info[i].ops);
3612 }
3613 }
3614 kvfree(info);
3615 return err;
3616 }
3617
nft_rule_lookup_byid(const struct net * net,const struct nft_chain * chain,const struct nlattr * nla)3618 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3619 const struct nft_chain *chain,
3620 const struct nlattr *nla)
3621 {
3622 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
3623 u32 id = ntohl(nla_get_be32(nla));
3624 struct nft_trans *trans;
3625
3626 list_for_each_entry(trans, &nft_net->commit_list, list) {
3627 struct nft_rule *rule = nft_trans_rule(trans);
3628
3629 if (trans->msg_type == NFT_MSG_NEWRULE &&
3630 trans->ctx.chain == chain &&
3631 id == nft_trans_rule_id(trans))
3632 return rule;
3633 }
3634 return ERR_PTR(-ENOENT);
3635 }
3636
nf_tables_delrule(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)3637 static int nf_tables_delrule(struct net *net, struct sock *nlsk,
3638 struct sk_buff *skb, const struct nlmsghdr *nlh,
3639 const struct nlattr * const nla[],
3640 struct netlink_ext_ack *extack)
3641 {
3642 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3643 u8 genmask = nft_genmask_next(net);
3644 struct nft_table *table;
3645 struct nft_chain *chain = NULL;
3646 struct nft_rule *rule;
3647 int family = nfmsg->nfgen_family, err = 0;
3648 struct nft_ctx ctx;
3649
3650 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3651 if (IS_ERR(table)) {
3652 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3653 return PTR_ERR(table);
3654 }
3655
3656 if (nla[NFTA_RULE_CHAIN]) {
3657 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3658 genmask);
3659 if (IS_ERR(chain)) {
3660 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3661 return PTR_ERR(chain);
3662 }
3663 if (nft_chain_binding(chain))
3664 return -EOPNOTSUPP;
3665 }
3666
3667 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
3668
3669 if (chain) {
3670 if (nla[NFTA_RULE_HANDLE]) {
3671 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3672 if (IS_ERR(rule)) {
3673 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3674 return PTR_ERR(rule);
3675 }
3676
3677 err = nft_delrule(&ctx, rule);
3678 } else if (nla[NFTA_RULE_ID]) {
3679 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]);
3680 if (IS_ERR(rule)) {
3681 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
3682 return PTR_ERR(rule);
3683 }
3684
3685 err = nft_delrule(&ctx, rule);
3686 } else {
3687 err = nft_delrule_by_chain(&ctx);
3688 }
3689 } else {
3690 list_for_each_entry(chain, &table->chains, list) {
3691 if (!nft_is_active_next(net, chain))
3692 continue;
3693 if (nft_chain_binding(chain))
3694 continue;
3695
3696 ctx.chain = chain;
3697 err = nft_delrule_by_chain(&ctx);
3698 if (err < 0)
3699 break;
3700 }
3701 }
3702
3703 return err;
3704 }
3705
3706 /*
3707 * Sets
3708 */
3709 static const struct nft_set_type *nft_set_types[] = {
3710 &nft_set_hash_fast_type,
3711 &nft_set_hash_type,
3712 &nft_set_rhash_type,
3713 &nft_set_bitmap_type,
3714 &nft_set_rbtree_type,
3715 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
3716 &nft_set_pipapo_avx2_type,
3717 #endif
3718 &nft_set_pipapo_type,
3719 };
3720
3721 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
3722 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3723 NFT_SET_EVAL)
3724
nft_set_ops_candidate(const struct nft_set_type * type,u32 flags)3725 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
3726 {
3727 return (flags & type->features) == (flags & NFT_SET_FEATURES);
3728 }
3729
3730 /*
3731 * Select a set implementation based on the data characteristics and the
3732 * given policy. The total memory use might not be known if no size is
3733 * given, in that case the amount of memory per element is used.
3734 */
3735 static const struct nft_set_ops *
nft_select_set_ops(const struct nft_ctx * ctx,const struct nlattr * const nla[],const struct nft_set_desc * desc,enum nft_set_policies policy)3736 nft_select_set_ops(const struct nft_ctx *ctx,
3737 const struct nlattr * const nla[],
3738 const struct nft_set_desc *desc,
3739 enum nft_set_policies policy)
3740 {
3741 struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
3742 const struct nft_set_ops *ops, *bops;
3743 struct nft_set_estimate est, best;
3744 const struct nft_set_type *type;
3745 u32 flags = 0;
3746 int i;
3747
3748 lockdep_assert_held(&nft_net->commit_mutex);
3749 lockdep_nfnl_nft_mutex_not_held();
3750
3751 if (nla[NFTA_SET_FLAGS] != NULL)
3752 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3753
3754 bops = NULL;
3755 best.size = ~0;
3756 best.lookup = ~0;
3757 best.space = ~0;
3758
3759 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) {
3760 type = nft_set_types[i];
3761 ops = &type->ops;
3762
3763 if (!nft_set_ops_candidate(type, flags))
3764 continue;
3765 if (!ops->estimate(desc, flags, &est))
3766 continue;
3767
3768 switch (policy) {
3769 case NFT_SET_POL_PERFORMANCE:
3770 if (est.lookup < best.lookup)
3771 break;
3772 if (est.lookup == best.lookup &&
3773 est.space < best.space)
3774 break;
3775 continue;
3776 case NFT_SET_POL_MEMORY:
3777 if (!desc->size) {
3778 if (est.space < best.space)
3779 break;
3780 if (est.space == best.space &&
3781 est.lookup < best.lookup)
3782 break;
3783 } else if (est.size < best.size || !bops) {
3784 break;
3785 }
3786 continue;
3787 default:
3788 break;
3789 }
3790
3791 bops = ops;
3792 best = est;
3793 }
3794
3795 if (bops != NULL)
3796 return bops;
3797
3798 return ERR_PTR(-EOPNOTSUPP);
3799 }
3800
3801 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
3802 [NFTA_SET_TABLE] = { .type = NLA_STRING,
3803 .len = NFT_TABLE_MAXNAMELEN - 1 },
3804 [NFTA_SET_NAME] = { .type = NLA_STRING,
3805 .len = NFT_SET_MAXNAMELEN - 1 },
3806 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
3807 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
3808 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
3809 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
3810 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
3811 [NFTA_SET_POLICY] = { .type = NLA_U32 },
3812 [NFTA_SET_DESC] = { .type = NLA_NESTED },
3813 [NFTA_SET_ID] = { .type = NLA_U32 },
3814 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
3815 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
3816 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
3817 .len = NFT_USERDATA_MAXLEN },
3818 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
3819 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
3820 [NFTA_SET_EXPR] = { .type = NLA_NESTED },
3821 };
3822
3823 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3824 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
3825 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED },
3826 };
3827
nft_ctx_init_from_setattr(struct nft_ctx * ctx,struct net * net,const struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack,u8 genmask)3828 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
3829 const struct sk_buff *skb,
3830 const struct nlmsghdr *nlh,
3831 const struct nlattr * const nla[],
3832 struct netlink_ext_ack *extack,
3833 u8 genmask)
3834 {
3835 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3836 int family = nfmsg->nfgen_family;
3837 struct nft_table *table = NULL;
3838
3839 if (nla[NFTA_SET_TABLE] != NULL) {
3840 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3841 genmask);
3842 if (IS_ERR(table)) {
3843 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
3844 return PTR_ERR(table);
3845 }
3846 }
3847
3848 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
3849 return 0;
3850 }
3851
nft_set_lookup(const struct nft_table * table,const struct nlattr * nla,u8 genmask)3852 static struct nft_set *nft_set_lookup(const struct nft_table *table,
3853 const struct nlattr *nla, u8 genmask)
3854 {
3855 struct nft_set *set;
3856
3857 if (nla == NULL)
3858 return ERR_PTR(-EINVAL);
3859
3860 list_for_each_entry_rcu(set, &table->sets, list) {
3861 if (!nla_strcmp(nla, set->name) &&
3862 nft_active_genmask(set, genmask))
3863 return set;
3864 }
3865 return ERR_PTR(-ENOENT);
3866 }
3867
nft_set_lookup_byhandle(const struct nft_table * table,const struct nlattr * nla,u8 genmask)3868 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3869 const struct nlattr *nla,
3870 u8 genmask)
3871 {
3872 struct nft_set *set;
3873
3874 list_for_each_entry(set, &table->sets, list) {
3875 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3876 nft_active_genmask(set, genmask))
3877 return set;
3878 }
3879 return ERR_PTR(-ENOENT);
3880 }
3881
nft_set_lookup_byid(const struct net * net,const struct nft_table * table,const struct nlattr * nla,u8 genmask)3882 static struct nft_set *nft_set_lookup_byid(const struct net *net,
3883 const struct nft_table *table,
3884 const struct nlattr *nla, u8 genmask)
3885 {
3886 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
3887 struct nft_trans *trans;
3888 u32 id = ntohl(nla_get_be32(nla));
3889
3890 list_for_each_entry(trans, &nft_net->commit_list, list) {
3891 if (trans->msg_type == NFT_MSG_NEWSET) {
3892 struct nft_set *set = nft_trans_set(trans);
3893
3894 if (id == nft_trans_set_id(trans) &&
3895 set->table == table &&
3896 nft_active_genmask(set, genmask))
3897 return set;
3898 }
3899 }
3900 return ERR_PTR(-ENOENT);
3901 }
3902
nft_set_lookup_global(const struct net * net,const struct nft_table * table,const struct nlattr * nla_set_name,const struct nlattr * nla_set_id,u8 genmask)3903 struct nft_set *nft_set_lookup_global(const struct net *net,
3904 const struct nft_table *table,
3905 const struct nlattr *nla_set_name,
3906 const struct nlattr *nla_set_id,
3907 u8 genmask)
3908 {
3909 struct nft_set *set;
3910
3911 set = nft_set_lookup(table, nla_set_name, genmask);
3912 if (IS_ERR(set)) {
3913 if (!nla_set_id)
3914 return set;
3915
3916 set = nft_set_lookup_byid(net, table, nla_set_id, genmask);
3917 }
3918 return set;
3919 }
3920 EXPORT_SYMBOL_GPL(nft_set_lookup_global);
3921
nf_tables_set_alloc_name(struct nft_ctx * ctx,struct nft_set * set,const char * name)3922 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3923 const char *name)
3924 {
3925 const struct nft_set *i;
3926 const char *p;
3927 unsigned long *inuse;
3928 unsigned int n = 0, min = 0;
3929
3930 p = strchr(name, '%');
3931 if (p != NULL) {
3932 if (p[1] != 'd' || strchr(p + 2, '%'))
3933 return -EINVAL;
3934
3935 if (strnlen(name, NFT_SET_MAX_ANONLEN) >= NFT_SET_MAX_ANONLEN)
3936 return -EINVAL;
3937
3938 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3939 if (inuse == NULL)
3940 return -ENOMEM;
3941 cont:
3942 list_for_each_entry(i, &ctx->table->sets, list) {
3943 int tmp;
3944
3945 if (!nft_is_active_next(ctx->net, i))
3946 continue;
3947 if (!sscanf(i->name, name, &tmp))
3948 continue;
3949 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
3950 continue;
3951
3952 set_bit(tmp - min, inuse);
3953 }
3954
3955 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
3956 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3957 min += BITS_PER_BYTE * PAGE_SIZE;
3958 memset(inuse, 0, PAGE_SIZE);
3959 goto cont;
3960 }
3961 free_page((unsigned long)inuse);
3962 }
3963
3964 set->name = kasprintf(GFP_KERNEL, name, min + n);
3965 if (!set->name)
3966 return -ENOMEM;
3967
3968 list_for_each_entry(i, &ctx->table->sets, list) {
3969 if (!nft_is_active_next(ctx->net, i))
3970 continue;
3971 if (!strcmp(set->name, i->name)) {
3972 kfree(set->name);
3973 set->name = NULL;
3974 return -ENFILE;
3975 }
3976 }
3977 return 0;
3978 }
3979
nf_msecs_to_jiffies64(const struct nlattr * nla,u64 * result)3980 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3981 {
3982 u64 ms = be64_to_cpu(nla_get_be64(nla));
3983 u64 max = (u64)(~((u64)0));
3984
3985 max = div_u64(max, NSEC_PER_MSEC);
3986 if (ms >= max)
3987 return -ERANGE;
3988
3989 ms *= NSEC_PER_MSEC;
3990 *result = nsecs_to_jiffies64(ms);
3991 return 0;
3992 }
3993
nf_jiffies64_to_msecs(u64 input)3994 __be64 nf_jiffies64_to_msecs(u64 input)
3995 {
3996 return cpu_to_be64(jiffies64_to_msecs(input));
3997 }
3998
nf_tables_fill_set_concat(struct sk_buff * skb,const struct nft_set * set)3999 static int nf_tables_fill_set_concat(struct sk_buff *skb,
4000 const struct nft_set *set)
4001 {
4002 struct nlattr *concat, *field;
4003 int i;
4004
4005 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT);
4006 if (!concat)
4007 return -ENOMEM;
4008
4009 for (i = 0; i < set->field_count; i++) {
4010 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
4011 if (!field)
4012 return -ENOMEM;
4013
4014 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN,
4015 htonl(set->field_len[i])))
4016 return -ENOMEM;
4017
4018 nla_nest_end(skb, field);
4019 }
4020
4021 nla_nest_end(skb, concat);
4022
4023 return 0;
4024 }
4025
nf_tables_fill_set(struct sk_buff * skb,const struct nft_ctx * ctx,const struct nft_set * set,u16 event,u16 flags)4026 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
4027 const struct nft_set *set, u16 event, u16 flags)
4028 {
4029 struct nlmsghdr *nlh;
4030 u32 portid = ctx->portid;
4031 struct nlattr *nest;
4032 u32 seq = ctx->seq;
4033
4034 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4035 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
4036 NFNETLINK_V0, nft_base_seq(ctx->net));
4037 if (!nlh)
4038 goto nla_put_failure;
4039
4040 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4041 goto nla_put_failure;
4042 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4043 goto nla_put_failure;
4044 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
4045 NFTA_SET_PAD))
4046 goto nla_put_failure;
4047 if (set->flags != 0)
4048 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
4049 goto nla_put_failure;
4050
4051 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
4052 goto nla_put_failure;
4053 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
4054 goto nla_put_failure;
4055 if (set->flags & NFT_SET_MAP) {
4056 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
4057 goto nla_put_failure;
4058 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
4059 goto nla_put_failure;
4060 }
4061 if (set->flags & NFT_SET_OBJECT &&
4062 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
4063 goto nla_put_failure;
4064
4065 if (set->timeout &&
4066 nla_put_be64(skb, NFTA_SET_TIMEOUT,
4067 nf_jiffies64_to_msecs(set->timeout),
4068 NFTA_SET_PAD))
4069 goto nla_put_failure;
4070 if (set->gc_int &&
4071 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
4072 goto nla_put_failure;
4073
4074 if (set->policy != NFT_SET_POL_PERFORMANCE) {
4075 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
4076 goto nla_put_failure;
4077 }
4078
4079 if (set->udata &&
4080 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
4081 goto nla_put_failure;
4082
4083 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC);
4084 if (!nest)
4085 goto nla_put_failure;
4086 if (set->size &&
4087 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
4088 goto nla_put_failure;
4089
4090 if (set->field_count > 1 &&
4091 nf_tables_fill_set_concat(skb, set))
4092 goto nla_put_failure;
4093
4094 nla_nest_end(skb, nest);
4095
4096 if (set->expr) {
4097 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR);
4098 if (nf_tables_fill_expr_info(skb, set->expr) < 0)
4099 goto nla_put_failure;
4100
4101 nla_nest_end(skb, nest);
4102 }
4103
4104 nlmsg_end(skb, nlh);
4105 return 0;
4106
4107 nla_put_failure:
4108 nlmsg_trim(skb, nlh);
4109 return -1;
4110 }
4111
nf_tables_set_notify(const struct nft_ctx * ctx,const struct nft_set * set,int event,gfp_t gfp_flags)4112 static void nf_tables_set_notify(const struct nft_ctx *ctx,
4113 const struct nft_set *set, int event,
4114 gfp_t gfp_flags)
4115 {
4116 struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
4117 struct sk_buff *skb;
4118 u32 portid = ctx->portid;
4119 int err;
4120
4121 if (!ctx->report &&
4122 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
4123 return;
4124
4125 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
4126 if (skb == NULL)
4127 goto err;
4128
4129 err = nf_tables_fill_set(skb, ctx, set, event, 0);
4130 if (err < 0) {
4131 kfree_skb(skb);
4132 goto err;
4133 }
4134
4135 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
4136 return;
4137 err:
4138 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
4139 }
4140
nf_tables_dump_sets(struct sk_buff * skb,struct netlink_callback * cb)4141 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
4142 {
4143 const struct nft_set *set;
4144 unsigned int idx, s_idx = cb->args[0];
4145 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
4146 struct net *net = sock_net(skb->sk);
4147 struct nft_ctx *ctx = cb->data, ctx_set;
4148 struct nftables_pernet *nft_net;
4149
4150 if (cb->args[1])
4151 return skb->len;
4152
4153 rcu_read_lock();
4154 nft_net = net_generic(net, nf_tables_net_id);
4155 cb->seq = nft_net->base_seq;
4156
4157 list_for_each_entry_rcu(table, &nft_net->tables, list) {
4158 if (ctx->family != NFPROTO_UNSPEC &&
4159 ctx->family != table->family)
4160 continue;
4161
4162 if (ctx->table && ctx->table != table)
4163 continue;
4164
4165 if (cur_table) {
4166 if (cur_table != table)
4167 continue;
4168
4169 cur_table = NULL;
4170 }
4171 idx = 0;
4172 list_for_each_entry_rcu(set, &table->sets, list) {
4173 if (idx < s_idx)
4174 goto cont;
4175 if (!nft_is_active(net, set))
4176 goto cont;
4177
4178 ctx_set = *ctx;
4179 ctx_set.table = table;
4180 ctx_set.family = table->family;
4181
4182 if (nf_tables_fill_set(skb, &ctx_set, set,
4183 NFT_MSG_NEWSET,
4184 NLM_F_MULTI) < 0) {
4185 cb->args[0] = idx;
4186 cb->args[2] = (unsigned long) table;
4187 goto done;
4188 }
4189 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4190 cont:
4191 idx++;
4192 }
4193 if (s_idx)
4194 s_idx = 0;
4195 }
4196 cb->args[1] = 1;
4197 done:
4198 rcu_read_unlock();
4199 return skb->len;
4200 }
4201
nf_tables_dump_sets_start(struct netlink_callback * cb)4202 static int nf_tables_dump_sets_start(struct netlink_callback *cb)
4203 {
4204 struct nft_ctx *ctx_dump = NULL;
4205
4206 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
4207 if (ctx_dump == NULL)
4208 return -ENOMEM;
4209
4210 cb->data = ctx_dump;
4211 return 0;
4212 }
4213
nf_tables_dump_sets_done(struct netlink_callback * cb)4214 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
4215 {
4216 kfree(cb->data);
4217 return 0;
4218 }
4219
4220 /* called with rcu_read_lock held */
nf_tables_getset(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)4221 static int nf_tables_getset(struct net *net, struct sock *nlsk,
4222 struct sk_buff *skb, const struct nlmsghdr *nlh,
4223 const struct nlattr * const nla[],
4224 struct netlink_ext_ack *extack)
4225 {
4226 u8 genmask = nft_genmask_cur(net);
4227 const struct nft_set *set;
4228 struct nft_ctx ctx;
4229 struct sk_buff *skb2;
4230 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4231 int err;
4232
4233 /* Verify existence before starting dump */
4234 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
4235 genmask);
4236 if (err < 0)
4237 return err;
4238
4239 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4240 struct netlink_dump_control c = {
4241 .start = nf_tables_dump_sets_start,
4242 .dump = nf_tables_dump_sets,
4243 .done = nf_tables_dump_sets_done,
4244 .data = &ctx,
4245 .module = THIS_MODULE,
4246 };
4247
4248 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4249 }
4250
4251 /* Only accept unspec with dump */
4252 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4253 return -EAFNOSUPPORT;
4254 if (!nla[NFTA_SET_TABLE])
4255 return -EINVAL;
4256
4257 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
4258 if (IS_ERR(set))
4259 return PTR_ERR(set);
4260
4261 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
4262 if (skb2 == NULL)
4263 return -ENOMEM;
4264
4265 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
4266 if (err < 0)
4267 goto err_fill_set_info;
4268
4269 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
4270
4271 err_fill_set_info:
4272 kfree_skb(skb2);
4273 return err;
4274 }
4275
4276 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = {
4277 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 },
4278 };
4279
nft_set_desc_concat_parse(const struct nlattr * attr,struct nft_set_desc * desc)4280 static int nft_set_desc_concat_parse(const struct nlattr *attr,
4281 struct nft_set_desc *desc)
4282 {
4283 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1];
4284 u32 len;
4285 int err;
4286
4287 if (desc->field_count >= ARRAY_SIZE(desc->field_len))
4288 return -E2BIG;
4289
4290 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr,
4291 nft_concat_policy, NULL);
4292 if (err < 0)
4293 return err;
4294
4295 if (!tb[NFTA_SET_FIELD_LEN])
4296 return -EINVAL;
4297
4298 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN]));
4299 if (!len || len > U8_MAX)
4300 return -EINVAL;
4301
4302 desc->field_len[desc->field_count++] = len;
4303
4304 return 0;
4305 }
4306
nft_set_desc_concat(struct nft_set_desc * desc,const struct nlattr * nla)4307 static int nft_set_desc_concat(struct nft_set_desc *desc,
4308 const struct nlattr *nla)
4309 {
4310 u32 num_regs = 0, key_num_regs = 0;
4311 struct nlattr *attr;
4312 int rem, err, i;
4313
4314 nla_for_each_nested(attr, nla, rem) {
4315 if (nla_type(attr) != NFTA_LIST_ELEM)
4316 return -EINVAL;
4317
4318 err = nft_set_desc_concat_parse(attr, desc);
4319 if (err < 0)
4320 return err;
4321 }
4322
4323 for (i = 0; i < desc->field_count; i++)
4324 num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32));
4325
4326 key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32));
4327 if (key_num_regs != num_regs)
4328 return -EINVAL;
4329
4330 if (num_regs > NFT_REG32_COUNT)
4331 return -E2BIG;
4332
4333 return 0;
4334 }
4335
nf_tables_set_desc_parse(struct nft_set_desc * desc,const struct nlattr * nla)4336 static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
4337 const struct nlattr *nla)
4338 {
4339 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
4340 int err;
4341
4342 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
4343 nft_set_desc_policy, NULL);
4344 if (err < 0)
4345 return err;
4346
4347 if (da[NFTA_SET_DESC_SIZE] != NULL)
4348 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
4349 if (da[NFTA_SET_DESC_CONCAT])
4350 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]);
4351
4352 return err;
4353 }
4354
nf_tables_newset(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)4355 static int nf_tables_newset(struct net *net, struct sock *nlsk,
4356 struct sk_buff *skb, const struct nlmsghdr *nlh,
4357 const struct nlattr * const nla[],
4358 struct netlink_ext_ack *extack)
4359 {
4360 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4361 u8 genmask = nft_genmask_next(net);
4362 int family = nfmsg->nfgen_family;
4363 const struct nft_set_ops *ops;
4364 struct nft_expr *expr = NULL;
4365 struct nft_table *table;
4366 struct nft_set *set;
4367 struct nft_ctx ctx;
4368 size_t alloc_size;
4369 char *name;
4370 u64 size;
4371 u64 timeout;
4372 u32 ktype, dtype, flags, policy, gc_int, objtype;
4373 struct nft_set_desc desc;
4374 unsigned char *udata;
4375 u16 udlen;
4376 int err;
4377 int i;
4378
4379 if (nla[NFTA_SET_TABLE] == NULL ||
4380 nla[NFTA_SET_NAME] == NULL ||
4381 nla[NFTA_SET_KEY_LEN] == NULL ||
4382 nla[NFTA_SET_ID] == NULL)
4383 return -EINVAL;
4384
4385 memset(&desc, 0, sizeof(desc));
4386
4387 ktype = NFT_DATA_VALUE;
4388 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
4389 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
4390 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
4391 return -EINVAL;
4392 }
4393
4394 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
4395 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
4396 return -EINVAL;
4397
4398 flags = 0;
4399 if (nla[NFTA_SET_FLAGS] != NULL) {
4400 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
4401 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
4402 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
4403 NFT_SET_MAP | NFT_SET_EVAL |
4404 NFT_SET_OBJECT | NFT_SET_CONCAT))
4405 return -EOPNOTSUPP;
4406 /* Only one of these operations is supported */
4407 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
4408 (NFT_SET_MAP | NFT_SET_OBJECT))
4409 return -EOPNOTSUPP;
4410 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
4411 (NFT_SET_EVAL | NFT_SET_OBJECT))
4412 return -EOPNOTSUPP;
4413 }
4414
4415 dtype = 0;
4416 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
4417 if (!(flags & NFT_SET_MAP))
4418 return -EINVAL;
4419
4420 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
4421 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
4422 dtype != NFT_DATA_VERDICT)
4423 return -EINVAL;
4424
4425 if (dtype != NFT_DATA_VERDICT) {
4426 if (nla[NFTA_SET_DATA_LEN] == NULL)
4427 return -EINVAL;
4428 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
4429 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
4430 return -EINVAL;
4431 } else
4432 desc.dlen = sizeof(struct nft_verdict);
4433 } else if (flags & NFT_SET_MAP)
4434 return -EINVAL;
4435
4436 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
4437 if (!(flags & NFT_SET_OBJECT))
4438 return -EINVAL;
4439
4440 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
4441 if (objtype == NFT_OBJECT_UNSPEC ||
4442 objtype > NFT_OBJECT_MAX)
4443 return -EOPNOTSUPP;
4444 } else if (flags & NFT_SET_OBJECT)
4445 return -EINVAL;
4446 else
4447 objtype = NFT_OBJECT_UNSPEC;
4448
4449 timeout = 0;
4450 if (nla[NFTA_SET_TIMEOUT] != NULL) {
4451 if (!(flags & NFT_SET_TIMEOUT))
4452 return -EINVAL;
4453
4454 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
4455 if (err)
4456 return err;
4457 }
4458 gc_int = 0;
4459 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
4460 if (!(flags & NFT_SET_TIMEOUT))
4461 return -EINVAL;
4462 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
4463 }
4464
4465 policy = NFT_SET_POL_PERFORMANCE;
4466 if (nla[NFTA_SET_POLICY] != NULL)
4467 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
4468
4469 if (nla[NFTA_SET_DESC] != NULL) {
4470 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
4471 if (err < 0)
4472 return err;
4473
4474 if (desc.field_count > 1) {
4475 if (!(flags & NFT_SET_CONCAT))
4476 return -EINVAL;
4477 } else if (flags & NFT_SET_CONCAT) {
4478 return -EINVAL;
4479 }
4480 } else if (flags & NFT_SET_CONCAT) {
4481 return -EINVAL;
4482 }
4483
4484 if (nla[NFTA_SET_EXPR])
4485 desc.expr = true;
4486
4487 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
4488 if (IS_ERR(table)) {
4489 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
4490 return PTR_ERR(table);
4491 }
4492
4493 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
4494
4495 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
4496 if (IS_ERR(set)) {
4497 if (PTR_ERR(set) != -ENOENT) {
4498 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4499 return PTR_ERR(set);
4500 }
4501 } else {
4502 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4503 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4504 return -EEXIST;
4505 }
4506 if (nlh->nlmsg_flags & NLM_F_REPLACE)
4507 return -EOPNOTSUPP;
4508
4509 return 0;
4510 }
4511
4512 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
4513 return -ENOENT;
4514
4515 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
4516 if (IS_ERR(ops))
4517 return PTR_ERR(ops);
4518
4519 udlen = 0;
4520 if (nla[NFTA_SET_USERDATA])
4521 udlen = nla_len(nla[NFTA_SET_USERDATA]);
4522
4523 size = 0;
4524 if (ops->privsize != NULL)
4525 size = ops->privsize(nla, &desc);
4526 alloc_size = sizeof(*set) + size + udlen;
4527 if (alloc_size < size || alloc_size > INT_MAX)
4528 return -ENOMEM;
4529
4530 if (!nft_use_inc(&table->use))
4531 return -EMFILE;
4532
4533 set = kvzalloc(alloc_size, GFP_KERNEL);
4534 if (!set) {
4535 err = -ENOMEM;
4536 goto err_alloc;
4537 }
4538
4539 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
4540 if (!name) {
4541 err = -ENOMEM;
4542 goto err_set_name;
4543 }
4544
4545 err = nf_tables_set_alloc_name(&ctx, set, name);
4546 kfree(name);
4547 if (err < 0)
4548 goto err_set_name;
4549
4550 udata = NULL;
4551 if (udlen) {
4552 udata = set->data + size;
4553 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
4554 }
4555
4556 INIT_LIST_HEAD(&set->bindings);
4557 refcount_set(&set->refs, 1);
4558 set->table = table;
4559 write_pnet(&set->net, net);
4560 set->ops = ops;
4561 set->ktype = ktype;
4562 set->klen = desc.klen;
4563 set->dtype = dtype;
4564 set->objtype = objtype;
4565 set->dlen = desc.dlen;
4566 set->flags = flags;
4567 set->size = desc.size;
4568 set->policy = policy;
4569 set->udlen = udlen;
4570 set->udata = udata;
4571 set->timeout = timeout;
4572 set->gc_int = gc_int;
4573
4574 set->field_count = desc.field_count;
4575 for (i = 0; i < desc.field_count; i++)
4576 set->field_len[i] = desc.field_len[i];
4577
4578 err = ops->init(set, &desc, nla);
4579 if (err < 0)
4580 goto err_set_init;
4581
4582 if (nla[NFTA_SET_EXPR]) {
4583 expr = nft_set_elem_expr_alloc(&ctx, set, nla[NFTA_SET_EXPR]);
4584 if (IS_ERR(expr)) {
4585 err = PTR_ERR(expr);
4586 goto err_set_expr_alloc;
4587 }
4588
4589 set->expr = expr;
4590 }
4591
4592 set->handle = nf_tables_alloc_handle(table);
4593 INIT_LIST_HEAD(&set->pending_update);
4594
4595 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
4596 if (err < 0)
4597 goto err_set_expr_alloc;
4598
4599 list_add_tail_rcu(&set->list, &table->sets);
4600
4601 return 0;
4602
4603 err_set_expr_alloc:
4604 if (set->expr)
4605 nft_expr_destroy(&ctx, set->expr);
4606
4607 ops->destroy(&ctx, set);
4608 err_set_init:
4609 kfree(set->name);
4610 err_set_name:
4611 kvfree(set);
4612 err_alloc:
4613 nft_use_dec_restore(&table->use);
4614
4615 return err;
4616 }
4617
nft_set_put(struct nft_set * set)4618 static void nft_set_put(struct nft_set *set)
4619 {
4620 if (refcount_dec_and_test(&set->refs)) {
4621 kfree(set->name);
4622 kvfree(set);
4623 }
4624 }
4625
nft_set_destroy(const struct nft_ctx * ctx,struct nft_set * set)4626 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
4627 {
4628 if (WARN_ON(set->use > 0))
4629 return;
4630
4631 if (set->expr)
4632 nft_expr_destroy(ctx, set->expr);
4633
4634 set->ops->destroy(ctx, set);
4635 nft_set_put(set);
4636 }
4637
nf_tables_delset(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)4638 static int nf_tables_delset(struct net *net, struct sock *nlsk,
4639 struct sk_buff *skb, const struct nlmsghdr *nlh,
4640 const struct nlattr * const nla[],
4641 struct netlink_ext_ack *extack)
4642 {
4643 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4644 u8 genmask = nft_genmask_next(net);
4645 const struct nlattr *attr;
4646 struct nft_set *set;
4647 struct nft_ctx ctx;
4648 int err;
4649
4650 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4651 return -EAFNOSUPPORT;
4652 if (nla[NFTA_SET_TABLE] == NULL)
4653 return -EINVAL;
4654
4655 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
4656 genmask);
4657 if (err < 0)
4658 return err;
4659
4660 if (nla[NFTA_SET_HANDLE]) {
4661 attr = nla[NFTA_SET_HANDLE];
4662 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
4663 } else {
4664 attr = nla[NFTA_SET_NAME];
4665 set = nft_set_lookup(ctx.table, attr, genmask);
4666 }
4667
4668 if (IS_ERR(set)) {
4669 NL_SET_BAD_ATTR(extack, attr);
4670 return PTR_ERR(set);
4671 }
4672 if (set->use ||
4673 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
4674 NL_SET_BAD_ATTR(extack, attr);
4675 return -EBUSY;
4676 }
4677
4678 return nft_delset(&ctx, set);
4679 }
4680
4681 static int nft_validate_register_store(const struct nft_ctx *ctx,
4682 enum nft_registers reg,
4683 const struct nft_data *data,
4684 enum nft_data_types type,
4685 unsigned int len);
4686
nft_setelem_data_validate(const struct nft_ctx * ctx,struct nft_set * set,struct nft_set_elem * elem)4687 static int nft_setelem_data_validate(const struct nft_ctx *ctx,
4688 struct nft_set *set,
4689 struct nft_set_elem *elem)
4690 {
4691 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4692 enum nft_registers dreg;
4693
4694 dreg = nft_type_to_reg(set->dtype);
4695 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
4696 set->dtype == NFT_DATA_VERDICT ?
4697 NFT_DATA_VERDICT : NFT_DATA_VALUE,
4698 set->dlen);
4699 }
4700
nf_tables_bind_check_setelem(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)4701 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
4702 struct nft_set *set,
4703 const struct nft_set_iter *iter,
4704 struct nft_set_elem *elem)
4705 {
4706 return nft_setelem_data_validate(ctx, set, elem);
4707 }
4708
nf_tables_bind_set(const struct nft_ctx * ctx,struct nft_set * set,struct nft_set_binding * binding)4709 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
4710 struct nft_set_binding *binding)
4711 {
4712 struct nft_set_binding *i;
4713 struct nft_set_iter iter;
4714
4715 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
4716 return -EBUSY;
4717
4718 if (binding->flags & NFT_SET_MAP) {
4719 /* If the set is already bound to the same chain all
4720 * jumps are already validated for that chain.
4721 */
4722 list_for_each_entry(i, &set->bindings, list) {
4723 if (i->flags & NFT_SET_MAP &&
4724 i->chain == binding->chain)
4725 goto bind;
4726 }
4727
4728 iter.genmask = nft_genmask_next(ctx->net);
4729 iter.skip = 0;
4730 iter.count = 0;
4731 iter.err = 0;
4732 iter.fn = nf_tables_bind_check_setelem;
4733
4734 set->ops->walk(ctx, set, &iter);
4735 if (iter.err < 0)
4736 return iter.err;
4737 }
4738 bind:
4739 if (!nft_use_inc(&set->use))
4740 return -EMFILE;
4741
4742 binding->chain = ctx->chain;
4743 list_add_tail_rcu(&binding->list, &set->bindings);
4744 nft_set_trans_bind(ctx, set);
4745
4746 return 0;
4747 }
4748 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
4749
nf_tables_unbind_set(const struct nft_ctx * ctx,struct nft_set * set,struct nft_set_binding * binding,bool event)4750 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
4751 struct nft_set_binding *binding, bool event)
4752 {
4753 list_del_rcu(&binding->list);
4754
4755 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
4756 list_del_rcu(&set->list);
4757 if (event)
4758 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
4759 GFP_KERNEL);
4760 }
4761 }
4762
4763 static void nft_setelem_data_activate(const struct net *net,
4764 const struct nft_set *set,
4765 struct nft_set_elem *elem);
4766
nft_mapelem_activate(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)4767 static int nft_mapelem_activate(const struct nft_ctx *ctx,
4768 struct nft_set *set,
4769 const struct nft_set_iter *iter,
4770 struct nft_set_elem *elem)
4771 {
4772 nft_setelem_data_activate(ctx->net, set, elem);
4773
4774 return 0;
4775 }
4776
nft_map_activate(const struct nft_ctx * ctx,struct nft_set * set)4777 static void nft_map_activate(const struct nft_ctx *ctx, struct nft_set *set)
4778 {
4779 struct nft_set_iter iter = {
4780 .genmask = nft_genmask_next(ctx->net),
4781 .fn = nft_mapelem_activate,
4782 };
4783
4784 set->ops->walk(ctx, set, &iter);
4785 WARN_ON_ONCE(iter.err);
4786 }
4787
nf_tables_activate_set(const struct nft_ctx * ctx,struct nft_set * set)4788 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
4789 {
4790 if (nft_set_is_anonymous(set)) {
4791 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
4792 nft_map_activate(ctx, set);
4793
4794 nft_clear(ctx->net, set);
4795 }
4796
4797 nft_use_inc_restore(&set->use);
4798 }
4799 EXPORT_SYMBOL_GPL(nf_tables_activate_set);
4800
nf_tables_deactivate_set(const struct nft_ctx * ctx,struct nft_set * set,struct nft_set_binding * binding,enum nft_trans_phase phase)4801 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
4802 struct nft_set_binding *binding,
4803 enum nft_trans_phase phase)
4804 {
4805 switch (phase) {
4806 case NFT_TRANS_PREPARE_ERROR:
4807 nft_set_trans_unbind(ctx, set);
4808 if (nft_set_is_anonymous(set))
4809 nft_deactivate_next(ctx->net, set);
4810 else
4811 list_del_rcu(&binding->list);
4812
4813 nft_use_dec(&set->use);
4814 break;
4815 case NFT_TRANS_PREPARE:
4816 if (nft_set_is_anonymous(set)) {
4817 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
4818 nft_map_deactivate(ctx, set);
4819
4820 nft_deactivate_next(ctx->net, set);
4821 }
4822 nft_use_dec(&set->use);
4823 return;
4824 case NFT_TRANS_ABORT:
4825 case NFT_TRANS_RELEASE:
4826 if (nft_set_is_anonymous(set) &&
4827 set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
4828 nft_map_deactivate(ctx, set);
4829
4830 nft_use_dec(&set->use);
4831 fallthrough;
4832 default:
4833 nf_tables_unbind_set(ctx, set, binding,
4834 phase == NFT_TRANS_COMMIT);
4835 }
4836 }
4837 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
4838
nf_tables_destroy_set(const struct nft_ctx * ctx,struct nft_set * set)4839 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
4840 {
4841 if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
4842 nft_set_destroy(ctx, set);
4843 }
4844 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
4845
4846 const struct nft_set_ext_type nft_set_ext_types[] = {
4847 [NFT_SET_EXT_KEY] = {
4848 .align = __alignof__(u32),
4849 },
4850 [NFT_SET_EXT_DATA] = {
4851 .align = __alignof__(u32),
4852 },
4853 [NFT_SET_EXT_EXPR] = {
4854 .align = __alignof__(struct nft_expr),
4855 },
4856 [NFT_SET_EXT_OBJREF] = {
4857 .len = sizeof(struct nft_object *),
4858 .align = __alignof__(struct nft_object *),
4859 },
4860 [NFT_SET_EXT_FLAGS] = {
4861 .len = sizeof(u8),
4862 .align = __alignof__(u8),
4863 },
4864 [NFT_SET_EXT_TIMEOUT] = {
4865 .len = sizeof(u64),
4866 .align = __alignof__(u64),
4867 },
4868 [NFT_SET_EXT_EXPIRATION] = {
4869 .len = sizeof(u64),
4870 .align = __alignof__(u64),
4871 },
4872 [NFT_SET_EXT_USERDATA] = {
4873 .len = sizeof(struct nft_userdata),
4874 .align = __alignof__(struct nft_userdata),
4875 },
4876 [NFT_SET_EXT_KEY_END] = {
4877 .align = __alignof__(u32),
4878 },
4879 };
4880
4881 /*
4882 * Set elements
4883 */
4884
4885 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
4886 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
4887 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
4888 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
4889 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
4890 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 },
4891 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
4892 .len = NFT_USERDATA_MAXLEN },
4893 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
4894 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING,
4895 .len = NFT_OBJ_MAXNAMELEN - 1 },
4896 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED },
4897 };
4898
4899 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
4900 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
4901 .len = NFT_TABLE_MAXNAMELEN - 1 },
4902 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
4903 .len = NFT_SET_MAXNAMELEN - 1 },
4904 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
4905 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
4906 };
4907
nft_ctx_init_from_elemattr(struct nft_ctx * ctx,struct net * net,const struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack,u8 genmask)4908 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
4909 const struct sk_buff *skb,
4910 const struct nlmsghdr *nlh,
4911 const struct nlattr * const nla[],
4912 struct netlink_ext_ack *extack,
4913 u8 genmask)
4914 {
4915 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4916 int family = nfmsg->nfgen_family;
4917 struct nft_table *table;
4918
4919 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
4920 genmask);
4921 if (IS_ERR(table)) {
4922 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
4923 return PTR_ERR(table);
4924 }
4925
4926 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
4927 return 0;
4928 }
4929
nf_tables_fill_setelem(struct sk_buff * skb,const struct nft_set * set,const struct nft_set_elem * elem)4930 static int nf_tables_fill_setelem(struct sk_buff *skb,
4931 const struct nft_set *set,
4932 const struct nft_set_elem *elem)
4933 {
4934 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4935 unsigned char *b = skb_tail_pointer(skb);
4936 struct nlattr *nest;
4937
4938 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
4939 if (nest == NULL)
4940 goto nla_put_failure;
4941
4942 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4943 NFT_DATA_VALUE, set->klen) < 0)
4944 goto nla_put_failure;
4945
4946 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) &&
4947 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext),
4948 NFT_DATA_VALUE, set->klen) < 0)
4949 goto nla_put_failure;
4950
4951 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4952 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
4953 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4954 set->dlen) < 0)
4955 goto nla_put_failure;
4956
4957 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
4958 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
4959 goto nla_put_failure;
4960
4961 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4962 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
4963 (*nft_set_ext_obj(ext))->key.name) < 0)
4964 goto nla_put_failure;
4965
4966 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4967 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4968 htonl(*nft_set_ext_flags(ext))))
4969 goto nla_put_failure;
4970
4971 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4972 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
4973 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
4974 NFTA_SET_ELEM_PAD))
4975 goto nla_put_failure;
4976
4977 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4978 u64 expires, now = get_jiffies_64();
4979
4980 expires = *nft_set_ext_expiration(ext);
4981 if (time_before64(now, expires))
4982 expires -= now;
4983 else
4984 expires = 0;
4985
4986 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
4987 nf_jiffies64_to_msecs(expires),
4988 NFTA_SET_ELEM_PAD))
4989 goto nla_put_failure;
4990 }
4991
4992 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4993 struct nft_userdata *udata;
4994
4995 udata = nft_set_ext_userdata(ext);
4996 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4997 udata->len + 1, udata->data))
4998 goto nla_put_failure;
4999 }
5000
5001 nla_nest_end(skb, nest);
5002 return 0;
5003
5004 nla_put_failure:
5005 nlmsg_trim(skb, b);
5006 return -EMSGSIZE;
5007 }
5008
5009 struct nft_set_dump_args {
5010 const struct netlink_callback *cb;
5011 struct nft_set_iter iter;
5012 struct sk_buff *skb;
5013 };
5014
nf_tables_dump_setelem(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)5015 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
5016 struct nft_set *set,
5017 const struct nft_set_iter *iter,
5018 struct nft_set_elem *elem)
5019 {
5020 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5021 struct nft_set_dump_args *args;
5022
5023 if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext))
5024 return 0;
5025
5026 args = container_of(iter, struct nft_set_dump_args, iter);
5027 return nf_tables_fill_setelem(args->skb, set, elem);
5028 }
5029
5030 struct nft_set_dump_ctx {
5031 const struct nft_set *set;
5032 struct nft_ctx ctx;
5033 };
5034
nf_tables_dump_set(struct sk_buff * skb,struct netlink_callback * cb)5035 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
5036 {
5037 struct nft_set_dump_ctx *dump_ctx = cb->data;
5038 struct net *net = sock_net(skb->sk);
5039 struct nftables_pernet *nft_net;
5040 struct nft_table *table;
5041 struct nft_set *set;
5042 struct nft_set_dump_args args;
5043 bool set_found = false;
5044 struct nlmsghdr *nlh;
5045 struct nlattr *nest;
5046 u32 portid, seq;
5047 int event;
5048
5049 rcu_read_lock();
5050 nft_net = net_generic(net, nf_tables_net_id);
5051 list_for_each_entry_rcu(table, &nft_net->tables, list) {
5052 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
5053 dump_ctx->ctx.family != table->family)
5054 continue;
5055
5056 if (table != dump_ctx->ctx.table)
5057 continue;
5058
5059 list_for_each_entry_rcu(set, &table->sets, list) {
5060 if (set == dump_ctx->set) {
5061 set_found = true;
5062 break;
5063 }
5064 }
5065 break;
5066 }
5067
5068 if (!set_found) {
5069 rcu_read_unlock();
5070 return -ENOENT;
5071 }
5072
5073 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
5074 portid = NETLINK_CB(cb->skb).portid;
5075 seq = cb->nlh->nlmsg_seq;
5076
5077 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI,
5078 table->family, NFNETLINK_V0, nft_base_seq(net));
5079 if (!nlh)
5080 goto nla_put_failure;
5081
5082 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
5083 goto nla_put_failure;
5084 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
5085 goto nla_put_failure;
5086
5087 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
5088 if (nest == NULL)
5089 goto nla_put_failure;
5090
5091 args.cb = cb;
5092 args.skb = skb;
5093 args.iter.genmask = nft_genmask_cur(net);
5094 args.iter.skip = cb->args[0];
5095 args.iter.count = 0;
5096 args.iter.err = 0;
5097 args.iter.fn = nf_tables_dump_setelem;
5098 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
5099 rcu_read_unlock();
5100
5101 nla_nest_end(skb, nest);
5102 nlmsg_end(skb, nlh);
5103
5104 if (args.iter.err && args.iter.err != -EMSGSIZE)
5105 return args.iter.err;
5106 if (args.iter.count == cb->args[0])
5107 return 0;
5108
5109 cb->args[0] = args.iter.count;
5110 return skb->len;
5111
5112 nla_put_failure:
5113 rcu_read_unlock();
5114 return -ENOSPC;
5115 }
5116
nf_tables_dump_set_start(struct netlink_callback * cb)5117 static int nf_tables_dump_set_start(struct netlink_callback *cb)
5118 {
5119 struct nft_set_dump_ctx *dump_ctx = cb->data;
5120
5121 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
5122
5123 return cb->data ? 0 : -ENOMEM;
5124 }
5125
nf_tables_dump_set_done(struct netlink_callback * cb)5126 static int nf_tables_dump_set_done(struct netlink_callback *cb)
5127 {
5128 kfree(cb->data);
5129 return 0;
5130 }
5131
nf_tables_fill_setelem_info(struct sk_buff * skb,const struct nft_ctx * ctx,u32 seq,u32 portid,int event,u16 flags,const struct nft_set * set,const struct nft_set_elem * elem)5132 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
5133 const struct nft_ctx *ctx, u32 seq,
5134 u32 portid, int event, u16 flags,
5135 const struct nft_set *set,
5136 const struct nft_set_elem *elem)
5137 {
5138 struct nlmsghdr *nlh;
5139 struct nlattr *nest;
5140 int err;
5141
5142 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5143 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
5144 NFNETLINK_V0, nft_base_seq(ctx->net));
5145 if (!nlh)
5146 goto nla_put_failure;
5147
5148 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
5149 goto nla_put_failure;
5150 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
5151 goto nla_put_failure;
5152
5153 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
5154 if (nest == NULL)
5155 goto nla_put_failure;
5156
5157 err = nf_tables_fill_setelem(skb, set, elem);
5158 if (err < 0)
5159 goto nla_put_failure;
5160
5161 nla_nest_end(skb, nest);
5162
5163 nlmsg_end(skb, nlh);
5164 return 0;
5165
5166 nla_put_failure:
5167 nlmsg_trim(skb, nlh);
5168 return -1;
5169 }
5170
nft_setelem_parse_flags(const struct nft_set * set,const struct nlattr * attr,u32 * flags)5171 static int nft_setelem_parse_flags(const struct nft_set *set,
5172 const struct nlattr *attr, u32 *flags)
5173 {
5174 if (attr == NULL)
5175 return 0;
5176
5177 *flags = ntohl(nla_get_be32(attr));
5178 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
5179 return -EINVAL;
5180 if (!(set->flags & NFT_SET_INTERVAL) &&
5181 *flags & NFT_SET_ELEM_INTERVAL_END)
5182 return -EINVAL;
5183
5184 return 0;
5185 }
5186
nft_setelem_parse_key(struct nft_ctx * ctx,struct nft_set * set,struct nft_data * key,struct nlattr * attr)5187 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
5188 struct nft_data *key, struct nlattr *attr)
5189 {
5190 struct nft_data_desc desc = {
5191 .type = NFT_DATA_VALUE,
5192 .size = NFT_DATA_VALUE_MAXLEN,
5193 .len = set->klen,
5194 };
5195
5196 return nft_data_init(ctx, key, &desc, attr);
5197 }
5198
nft_setelem_parse_data(struct nft_ctx * ctx,struct nft_set * set,struct nft_data_desc * desc,struct nft_data * data,struct nlattr * attr)5199 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
5200 struct nft_data_desc *desc,
5201 struct nft_data *data,
5202 struct nlattr *attr)
5203 {
5204 u32 dtype;
5205
5206 if (set->dtype == NFT_DATA_VERDICT)
5207 dtype = NFT_DATA_VERDICT;
5208 else
5209 dtype = NFT_DATA_VALUE;
5210
5211 desc->type = dtype;
5212 desc->size = NFT_DATA_VALUE_MAXLEN;
5213 desc->len = set->dlen;
5214 desc->flags = NFT_DATA_DESC_SETELEM;
5215
5216 return nft_data_init(ctx, data, desc, attr);
5217 }
5218
nft_get_set_elem(struct nft_ctx * ctx,struct nft_set * set,const struct nlattr * attr)5219 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
5220 const struct nlattr *attr)
5221 {
5222 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5223 struct nft_set_elem elem;
5224 struct sk_buff *skb;
5225 uint32_t flags = 0;
5226 void *priv;
5227 int err;
5228
5229 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5230 nft_set_elem_policy, NULL);
5231 if (err < 0)
5232 return err;
5233
5234 if (!nla[NFTA_SET_ELEM_KEY])
5235 return -EINVAL;
5236
5237 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5238 if (err < 0)
5239 return err;
5240
5241 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5242 nla[NFTA_SET_ELEM_KEY]);
5243 if (err < 0)
5244 return err;
5245
5246 if (nla[NFTA_SET_ELEM_KEY_END]) {
5247 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5248 nla[NFTA_SET_ELEM_KEY_END]);
5249 if (err < 0)
5250 return err;
5251 }
5252
5253 priv = set->ops->get(ctx->net, set, &elem, flags);
5254 if (IS_ERR(priv))
5255 return PTR_ERR(priv);
5256
5257 elem.priv = priv;
5258
5259 err = -ENOMEM;
5260 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
5261 if (skb == NULL)
5262 return err;
5263
5264 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
5265 NFT_MSG_NEWSETELEM, 0, set, &elem);
5266 if (err < 0)
5267 goto err_fill_setelem;
5268
5269 return nfnetlink_unicast(skb, ctx->net, ctx->portid);
5270
5271 err_fill_setelem:
5272 kfree_skb(skb);
5273 return err;
5274 }
5275
5276 /* called with rcu_read_lock held */
nf_tables_getsetelem(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)5277 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
5278 struct sk_buff *skb, const struct nlmsghdr *nlh,
5279 const struct nlattr * const nla[],
5280 struct netlink_ext_ack *extack)
5281 {
5282 u8 genmask = nft_genmask_cur(net);
5283 struct nft_set *set;
5284 struct nlattr *attr;
5285 struct nft_ctx ctx;
5286 int rem, err = 0;
5287
5288 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5289 genmask);
5290 if (err < 0)
5291 return err;
5292
5293 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
5294 if (IS_ERR(set))
5295 return PTR_ERR(set);
5296
5297 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5298 struct netlink_dump_control c = {
5299 .start = nf_tables_dump_set_start,
5300 .dump = nf_tables_dump_set,
5301 .done = nf_tables_dump_set_done,
5302 .module = THIS_MODULE,
5303 };
5304 struct nft_set_dump_ctx dump_ctx = {
5305 .set = set,
5306 .ctx = ctx,
5307 };
5308
5309 c.data = &dump_ctx;
5310 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
5311 }
5312
5313 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
5314 return -EINVAL;
5315
5316 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5317 err = nft_get_set_elem(&ctx, set, attr);
5318 if (err < 0)
5319 break;
5320 }
5321
5322 return err;
5323 }
5324
nf_tables_setelem_notify(const struct nft_ctx * ctx,const struct nft_set * set,const struct nft_set_elem * elem,int event,u16 flags)5325 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
5326 const struct nft_set *set,
5327 const struct nft_set_elem *elem,
5328 int event, u16 flags)
5329 {
5330 struct nftables_pernet *nft_net;
5331 struct net *net = ctx->net;
5332 u32 portid = ctx->portid;
5333 struct sk_buff *skb;
5334 int err;
5335
5336 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5337 return;
5338
5339 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5340 if (skb == NULL)
5341 goto err;
5342
5343 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
5344 set, elem);
5345 if (err < 0) {
5346 kfree_skb(skb);
5347 goto err;
5348 }
5349
5350 nft_net = net_generic(net, nf_tables_net_id);
5351 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
5352 return;
5353 err:
5354 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
5355 }
5356
nft_trans_elem_alloc(struct nft_ctx * ctx,int msg_type,struct nft_set * set)5357 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
5358 int msg_type,
5359 struct nft_set *set)
5360 {
5361 struct nft_trans *trans;
5362
5363 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
5364 if (trans == NULL)
5365 return NULL;
5366
5367 nft_trans_elem_set(trans) = set;
5368 return trans;
5369 }
5370
nft_set_elem_expr_alloc(const struct nft_ctx * ctx,const struct nft_set * set,const struct nlattr * attr)5371 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
5372 const struct nft_set *set,
5373 const struct nlattr *attr)
5374 {
5375 struct nft_expr *expr;
5376 int err;
5377
5378 expr = nft_expr_init(ctx, attr);
5379 if (IS_ERR(expr))
5380 return expr;
5381
5382 err = -EOPNOTSUPP;
5383 if (expr->ops->type->flags & NFT_EXPR_GC) {
5384 if (set->flags & NFT_SET_TIMEOUT)
5385 goto err_set_elem_expr;
5386 if (!set->ops->gc_init)
5387 goto err_set_elem_expr;
5388 set->ops->gc_init(set);
5389 }
5390
5391 return expr;
5392
5393 err_set_elem_expr:
5394 nft_expr_destroy(ctx, expr);
5395 return ERR_PTR(err);
5396 }
5397
nft_set_elem_init(const struct nft_set * set,const struct nft_set_ext_tmpl * tmpl,const u32 * key,const u32 * key_end,const u32 * data,u64 timeout,u64 expiration,gfp_t gfp)5398 void *nft_set_elem_init(const struct nft_set *set,
5399 const struct nft_set_ext_tmpl *tmpl,
5400 const u32 *key, const u32 *key_end,
5401 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp)
5402 {
5403 struct nft_set_ext *ext;
5404 void *elem;
5405
5406 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
5407 if (elem == NULL)
5408 return NULL;
5409
5410 ext = nft_set_elem_ext(set, elem);
5411 nft_set_ext_init(ext, tmpl);
5412
5413 memcpy(nft_set_ext_key(ext), key, set->klen);
5414 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
5415 memcpy(nft_set_ext_key_end(ext), key_end, set->klen);
5416 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5417 memcpy(nft_set_ext_data(ext), data, set->dlen);
5418 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
5419 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
5420 if (expiration == 0)
5421 *nft_set_ext_expiration(ext) += timeout;
5422 }
5423 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
5424 *nft_set_ext_timeout(ext) = timeout;
5425
5426 return elem;
5427 }
5428
nft_set_elem_expr_destroy(const struct nft_ctx * ctx,struct nft_expr * expr)5429 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
5430 struct nft_expr *expr)
5431 {
5432 if (expr->ops->destroy_clone) {
5433 expr->ops->destroy_clone(ctx, expr);
5434 module_put(expr->ops->type->owner);
5435 } else {
5436 nf_tables_expr_destroy(ctx, expr);
5437 }
5438 }
5439
5440 /* Drop references and destroy. Called from gc, dynset and abort path. */
nft_set_elem_destroy(const struct nft_set * set,void * elem,bool destroy_expr)5441 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
5442 bool destroy_expr)
5443 {
5444 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5445 struct nft_ctx ctx = {
5446 .net = read_pnet(&set->net),
5447 .family = set->table->family,
5448 };
5449
5450 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
5451 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5452 nft_data_release(nft_set_ext_data(ext), set->dtype);
5453 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
5454 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext));
5455
5456 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5457 nft_use_dec(&(*nft_set_ext_obj(ext))->use);
5458 kfree(elem);
5459 }
5460 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
5461
5462 /* Destroy element. References have been already dropped in the preparation
5463 * path via nft_setelem_data_deactivate().
5464 */
nf_tables_set_elem_destroy(const struct nft_ctx * ctx,const struct nft_set * set,void * elem)5465 void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
5466 const struct nft_set *set, void *elem)
5467 {
5468 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5469
5470 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
5471 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));
5472
5473 kfree(elem);
5474 }
5475
nft_set_elem_expr_setup(struct nft_ctx * ctx,const struct nft_set_ext * ext,struct nft_expr * expr)5476 static int nft_set_elem_expr_setup(struct nft_ctx *ctx,
5477 const struct nft_set_ext *ext,
5478 struct nft_expr *expr)
5479 {
5480 struct nft_expr *elem_expr = nft_set_ext_expr(ext);
5481 int err;
5482
5483 if (expr == NULL)
5484 return 0;
5485
5486 err = nft_expr_clone(elem_expr, expr);
5487 if (err < 0)
5488 return -ENOMEM;
5489
5490 nft_expr_destroy(ctx, expr);
5491 return 0;
5492 }
5493
nft_add_set_elem(struct nft_ctx * ctx,struct nft_set * set,const struct nlattr * attr,u32 nlmsg_flags)5494 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
5495 const struct nlattr *attr, u32 nlmsg_flags)
5496 {
5497 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5498 u8 genmask = nft_genmask_next(ctx->net);
5499 struct nft_set_ext_tmpl tmpl;
5500 struct nft_set_ext *ext, *ext2;
5501 struct nft_set_elem elem;
5502 struct nft_set_binding *binding;
5503 struct nft_object *obj = NULL;
5504 struct nft_expr *expr = NULL;
5505 struct nft_userdata *udata;
5506 struct nft_data_desc desc;
5507 enum nft_registers dreg;
5508 struct nft_trans *trans;
5509 u32 flags = 0;
5510 u64 timeout;
5511 u64 expiration;
5512 u8 ulen;
5513 int err;
5514
5515 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5516 nft_set_elem_policy, NULL);
5517 if (err < 0)
5518 return err;
5519
5520 if (nla[NFTA_SET_ELEM_KEY] == NULL)
5521 return -EINVAL;
5522
5523 nft_set_ext_prepare(&tmpl);
5524
5525 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5526 if (err < 0)
5527 return err;
5528 if (flags != 0)
5529 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5530
5531 if (set->flags & NFT_SET_MAP) {
5532 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
5533 !(flags & NFT_SET_ELEM_INTERVAL_END))
5534 return -EINVAL;
5535 } else {
5536 if (nla[NFTA_SET_ELEM_DATA] != NULL)
5537 return -EINVAL;
5538 }
5539
5540 if (set->flags & NFT_SET_OBJECT) {
5541 if (!nla[NFTA_SET_ELEM_OBJREF] &&
5542 !(flags & NFT_SET_ELEM_INTERVAL_END))
5543 return -EINVAL;
5544 } else {
5545 if (nla[NFTA_SET_ELEM_OBJREF])
5546 return -EINVAL;
5547 }
5548
5549 if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
5550 (nla[NFTA_SET_ELEM_DATA] ||
5551 nla[NFTA_SET_ELEM_OBJREF] ||
5552 nla[NFTA_SET_ELEM_TIMEOUT] ||
5553 nla[NFTA_SET_ELEM_EXPIRATION] ||
5554 nla[NFTA_SET_ELEM_USERDATA] ||
5555 nla[NFTA_SET_ELEM_EXPR]))
5556 return -EINVAL;
5557
5558 timeout = 0;
5559 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
5560 if (!(set->flags & NFT_SET_TIMEOUT))
5561 return -EINVAL;
5562 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
5563 &timeout);
5564 if (err)
5565 return err;
5566 } else if (set->flags & NFT_SET_TIMEOUT) {
5567 timeout = set->timeout;
5568 }
5569
5570 expiration = 0;
5571 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
5572 if (!(set->flags & NFT_SET_TIMEOUT))
5573 return -EINVAL;
5574 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
5575 &expiration);
5576 if (err)
5577 return err;
5578 }
5579
5580 if (nla[NFTA_SET_ELEM_EXPR] != NULL) {
5581 expr = nft_set_elem_expr_alloc(ctx, set,
5582 nla[NFTA_SET_ELEM_EXPR]);
5583 if (IS_ERR(expr))
5584 return PTR_ERR(expr);
5585
5586 err = -EOPNOTSUPP;
5587 if (set->expr && set->expr->ops != expr->ops)
5588 goto err_set_elem_expr;
5589 } else if (set->expr) {
5590 expr = kzalloc(set->expr->ops->size, GFP_KERNEL);
5591 if (!expr)
5592 return -ENOMEM;
5593
5594 err = nft_expr_clone(expr, set->expr);
5595 if (err < 0)
5596 goto err_set_elem_expr;
5597 }
5598
5599 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5600 nla[NFTA_SET_ELEM_KEY]);
5601 if (err < 0)
5602 goto err_set_elem_expr;
5603
5604 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
5605
5606 if (nla[NFTA_SET_ELEM_KEY_END]) {
5607 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5608 nla[NFTA_SET_ELEM_KEY_END]);
5609 if (err < 0)
5610 goto err_parse_key;
5611
5612 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5613 }
5614
5615 if (timeout > 0) {
5616 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
5617 if (timeout != set->timeout)
5618 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
5619 }
5620
5621 if (expr)
5622 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPR,
5623 expr->ops->size);
5624
5625 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
5626 obj = nft_obj_lookup(ctx->net, ctx->table,
5627 nla[NFTA_SET_ELEM_OBJREF],
5628 set->objtype, genmask);
5629 if (IS_ERR(obj)) {
5630 err = PTR_ERR(obj);
5631 obj = NULL;
5632 goto err_parse_key_end;
5633 }
5634
5635 if (!nft_use_inc(&obj->use)) {
5636 err = -EMFILE;
5637 obj = NULL;
5638 goto err_parse_key_end;
5639 }
5640
5641 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
5642 }
5643
5644 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
5645 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
5646 nla[NFTA_SET_ELEM_DATA]);
5647 if (err < 0)
5648 goto err_parse_key_end;
5649
5650 dreg = nft_type_to_reg(set->dtype);
5651 list_for_each_entry(binding, &set->bindings, list) {
5652 struct nft_ctx bind_ctx = {
5653 .net = ctx->net,
5654 .family = ctx->family,
5655 .table = ctx->table,
5656 .chain = (struct nft_chain *)binding->chain,
5657 };
5658
5659 if (!(binding->flags & NFT_SET_MAP))
5660 continue;
5661
5662 err = nft_validate_register_store(&bind_ctx, dreg,
5663 &elem.data.val,
5664 desc.type, desc.len);
5665 if (err < 0)
5666 goto err_parse_data;
5667
5668 if (desc.type == NFT_DATA_VERDICT &&
5669 (elem.data.val.verdict.code == NFT_GOTO ||
5670 elem.data.val.verdict.code == NFT_JUMP))
5671 nft_validate_state_update(ctx->net,
5672 NFT_VALIDATE_NEED);
5673 }
5674
5675 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len);
5676 }
5677
5678 /* The full maximum length of userdata can exceed the maximum
5679 * offset value (U8_MAX) for following extensions, therefor it
5680 * must be the last extension added.
5681 */
5682 ulen = 0;
5683 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
5684 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
5685 if (ulen > 0)
5686 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
5687 ulen);
5688 }
5689
5690 err = -ENOMEM;
5691 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5692 elem.key_end.val.data, elem.data.val.data,
5693 timeout, expiration, GFP_KERNEL);
5694 if (elem.priv == NULL)
5695 goto err_parse_data;
5696
5697 ext = nft_set_elem_ext(set, elem.priv);
5698 if (flags)
5699 *nft_set_ext_flags(ext) = flags;
5700 if (ulen > 0) {
5701 udata = nft_set_ext_userdata(ext);
5702 udata->len = ulen - 1;
5703 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
5704 }
5705 if (obj)
5706 *nft_set_ext_obj(ext) = obj;
5707
5708 err = nft_set_elem_expr_setup(ctx, ext, expr);
5709 if (err < 0)
5710 goto err_elem_expr;
5711 expr = NULL;
5712
5713 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
5714 if (trans == NULL) {
5715 err = -ENOMEM;
5716 goto err_elem_expr;
5717 }
5718
5719 ext->genmask = nft_genmask_cur(ctx->net);
5720
5721 err = set->ops->insert(ctx->net, set, &elem, &ext2);
5722 if (err) {
5723 if (err == -EEXIST) {
5724 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
5725 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
5726 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
5727 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
5728 goto err_element_clash;
5729 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
5730 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
5731 memcmp(nft_set_ext_data(ext),
5732 nft_set_ext_data(ext2), set->dlen) != 0) ||
5733 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
5734 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
5735 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
5736 goto err_element_clash;
5737 else if (!(nlmsg_flags & NLM_F_EXCL))
5738 err = 0;
5739 } else if (err == -ENOTEMPTY) {
5740 /* ENOTEMPTY reports overlapping between this element
5741 * and an existing one.
5742 */
5743 err = -EEXIST;
5744 }
5745 goto err_element_clash;
5746 }
5747
5748 if (set->size &&
5749 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
5750 err = -ENFILE;
5751 goto err_set_full;
5752 }
5753
5754 nft_trans_elem(trans) = elem;
5755 nft_trans_commit_list_add_tail(ctx->net, trans);
5756 return 0;
5757
5758 err_set_full:
5759 set->ops->remove(ctx->net, set, &elem);
5760 err_element_clash:
5761 kfree(trans);
5762 err_elem_expr:
5763 nf_tables_set_elem_destroy(ctx, set, elem.priv);
5764 err_parse_data:
5765 if (nla[NFTA_SET_ELEM_DATA] != NULL)
5766 nft_data_release(&elem.data.val, desc.type);
5767 err_parse_key_end:
5768 if (obj)
5769 nft_use_dec_restore(&obj->use);
5770
5771 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
5772 err_parse_key:
5773 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
5774 err_set_elem_expr:
5775 if (expr != NULL)
5776 nft_expr_destroy(ctx, expr);
5777
5778 return err;
5779 }
5780
nf_tables_newsetelem(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)5781 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
5782 struct sk_buff *skb, const struct nlmsghdr *nlh,
5783 const struct nlattr * const nla[],
5784 struct netlink_ext_ack *extack)
5785 {
5786 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
5787 u8 genmask = nft_genmask_next(net);
5788 const struct nlattr *attr;
5789 struct nft_set *set;
5790 struct nft_ctx ctx;
5791 int rem, err;
5792
5793 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
5794 return -EINVAL;
5795
5796 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5797 genmask);
5798 if (err < 0)
5799 return err;
5800
5801 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
5802 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
5803 if (IS_ERR(set))
5804 return PTR_ERR(set);
5805
5806 if (!list_empty(&set->bindings) &&
5807 (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
5808 return -EBUSY;
5809
5810 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5811 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
5812 if (err < 0)
5813 return err;
5814 }
5815
5816 if (nft_net->validate_state == NFT_VALIDATE_DO)
5817 return nft_table_validate(net, ctx.table);
5818
5819 return 0;
5820 }
5821
5822 /**
5823 * nft_data_hold - hold a nft_data item
5824 *
5825 * @data: struct nft_data to release
5826 * @type: type of data
5827 *
5828 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5829 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
5830 * NFT_GOTO verdicts. This function must be called on active data objects
5831 * from the second phase of the commit protocol.
5832 */
nft_data_hold(const struct nft_data * data,enum nft_data_types type)5833 void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
5834 {
5835 struct nft_chain *chain;
5836
5837 if (type == NFT_DATA_VERDICT) {
5838 switch (data->verdict.code) {
5839 case NFT_JUMP:
5840 case NFT_GOTO:
5841 chain = data->verdict.chain;
5842 nft_use_inc_restore(&chain->use);
5843 break;
5844 }
5845 }
5846 }
5847
nft_setelem_data_activate(const struct net * net,const struct nft_set * set,struct nft_set_elem * elem)5848 static void nft_setelem_data_activate(const struct net *net,
5849 const struct nft_set *set,
5850 struct nft_set_elem *elem)
5851 {
5852 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5853
5854 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5855 nft_data_hold(nft_set_ext_data(ext), set->dtype);
5856 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5857 nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use);
5858 }
5859
nft_setelem_data_deactivate(const struct net * net,const struct nft_set * set,struct nft_set_elem * elem)5860 void nft_setelem_data_deactivate(const struct net *net,
5861 const struct nft_set *set,
5862 struct nft_set_elem *elem)
5863 {
5864 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5865
5866 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5867 nft_data_release(nft_set_ext_data(ext), set->dtype);
5868 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5869 nft_use_dec(&(*nft_set_ext_obj(ext))->use);
5870 }
5871
nft_del_setelem(struct nft_ctx * ctx,struct nft_set * set,const struct nlattr * attr)5872 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
5873 const struct nlattr *attr)
5874 {
5875 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5876 struct nft_set_ext_tmpl tmpl;
5877 struct nft_set_elem elem;
5878 struct nft_set_ext *ext;
5879 struct nft_trans *trans;
5880 u32 flags = 0;
5881 void *priv;
5882 int err;
5883
5884 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5885 nft_set_elem_policy, NULL);
5886 if (err < 0)
5887 return err;
5888
5889 if (nla[NFTA_SET_ELEM_KEY] == NULL)
5890 return -EINVAL;
5891
5892 nft_set_ext_prepare(&tmpl);
5893
5894 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5895 if (err < 0)
5896 return err;
5897 if (flags != 0)
5898 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5899
5900 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5901 nla[NFTA_SET_ELEM_KEY]);
5902 if (err < 0)
5903 return err;
5904
5905 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
5906
5907 if (nla[NFTA_SET_ELEM_KEY_END]) {
5908 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5909 nla[NFTA_SET_ELEM_KEY_END]);
5910 if (err < 0)
5911 return err;
5912
5913 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5914 }
5915
5916 err = -ENOMEM;
5917 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5918 elem.key_end.val.data, NULL, 0, 0,
5919 GFP_KERNEL);
5920 if (elem.priv == NULL)
5921 goto fail_elem;
5922
5923 ext = nft_set_elem_ext(set, elem.priv);
5924 if (flags)
5925 *nft_set_ext_flags(ext) = flags;
5926
5927 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
5928 if (trans == NULL)
5929 goto fail_trans;
5930
5931 priv = set->ops->deactivate(ctx->net, set, &elem);
5932 if (priv == NULL) {
5933 err = -ENOENT;
5934 goto fail_ops;
5935 }
5936 kfree(elem.priv);
5937 elem.priv = priv;
5938
5939 nft_setelem_data_deactivate(ctx->net, set, &elem);
5940
5941 nft_trans_elem(trans) = elem;
5942 nft_trans_commit_list_add_tail(ctx->net, trans);
5943 return 0;
5944
5945 fail_ops:
5946 kfree(trans);
5947 fail_trans:
5948 kfree(elem.priv);
5949 fail_elem:
5950 nft_data_release(&elem.key.val, NFT_DATA_VALUE);
5951 return err;
5952 }
5953
nft_flush_set(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)5954 static int nft_flush_set(const struct nft_ctx *ctx,
5955 struct nft_set *set,
5956 const struct nft_set_iter *iter,
5957 struct nft_set_elem *elem)
5958 {
5959 struct nft_trans *trans;
5960 int err;
5961
5962 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
5963 sizeof(struct nft_trans_elem), GFP_ATOMIC);
5964 if (!trans)
5965 return -ENOMEM;
5966
5967 if (!set->ops->flush(ctx->net, set, elem->priv)) {
5968 err = -ENOENT;
5969 goto err1;
5970 }
5971 set->ndeact++;
5972
5973 nft_setelem_data_deactivate(ctx->net, set, elem);
5974 nft_trans_elem_set(trans) = set;
5975 nft_trans_elem(trans) = *elem;
5976 nft_trans_commit_list_add_tail(ctx->net, trans);
5977
5978 return 0;
5979 err1:
5980 kfree(trans);
5981 return err;
5982 }
5983
nf_tables_delsetelem(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)5984 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
5985 struct sk_buff *skb, const struct nlmsghdr *nlh,
5986 const struct nlattr * const nla[],
5987 struct netlink_ext_ack *extack)
5988 {
5989 u8 genmask = nft_genmask_next(net);
5990 const struct nlattr *attr;
5991 struct nft_set *set;
5992 struct nft_ctx ctx;
5993 int rem, err = 0;
5994
5995 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5996 genmask);
5997 if (err < 0)
5998 return err;
5999
6000 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
6001 if (IS_ERR(set))
6002 return PTR_ERR(set);
6003
6004 if (nft_set_is_anonymous(set))
6005 return -EOPNOTSUPP;
6006
6007 if (!list_empty(&set->bindings) && (set->flags & NFT_SET_CONSTANT))
6008 return -EBUSY;
6009
6010 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
6011 struct nft_set_iter iter = {
6012 .genmask = genmask,
6013 .fn = nft_flush_set,
6014 };
6015 set->ops->walk(&ctx, set, &iter);
6016
6017 return iter.err;
6018 }
6019
6020 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
6021 err = nft_del_setelem(&ctx, set, attr);
6022 if (err < 0)
6023 break;
6024
6025 set->ndeact++;
6026 }
6027 return err;
6028 }
6029
6030 /*
6031 * Stateful objects
6032 */
6033
6034 /**
6035 * nft_register_obj- register nf_tables stateful object type
6036 * @obj_type: object type
6037 *
6038 * Registers the object type for use with nf_tables. Returns zero on
6039 * success or a negative errno code otherwise.
6040 */
nft_register_obj(struct nft_object_type * obj_type)6041 int nft_register_obj(struct nft_object_type *obj_type)
6042 {
6043 if (obj_type->type == NFT_OBJECT_UNSPEC)
6044 return -EINVAL;
6045
6046 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6047 list_add_rcu(&obj_type->list, &nf_tables_objects);
6048 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6049 return 0;
6050 }
6051 EXPORT_SYMBOL_GPL(nft_register_obj);
6052
6053 /**
6054 * nft_unregister_obj - unregister nf_tables object type
6055 * @obj_type: object type
6056 *
6057 * Unregisters the object type for use with nf_tables.
6058 */
nft_unregister_obj(struct nft_object_type * obj_type)6059 void nft_unregister_obj(struct nft_object_type *obj_type)
6060 {
6061 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6062 list_del_rcu(&obj_type->list);
6063 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6064 }
6065 EXPORT_SYMBOL_GPL(nft_unregister_obj);
6066
nft_obj_lookup(const struct net * net,const struct nft_table * table,const struct nlattr * nla,u32 objtype,u8 genmask)6067 struct nft_object *nft_obj_lookup(const struct net *net,
6068 const struct nft_table *table,
6069 const struct nlattr *nla, u32 objtype,
6070 u8 genmask)
6071 {
6072 struct nft_object_hash_key k = { .table = table };
6073 char search[NFT_OBJ_MAXNAMELEN];
6074 struct rhlist_head *tmp, *list;
6075 struct nft_object *obj;
6076
6077 nla_strlcpy(search, nla, sizeof(search));
6078 k.name = search;
6079
6080 WARN_ON_ONCE(!rcu_read_lock_held() &&
6081 !lockdep_commit_lock_is_held(net));
6082
6083 rcu_read_lock();
6084 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
6085 if (!list)
6086 goto out;
6087
6088 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
6089 if (objtype == obj->ops->type->type &&
6090 nft_active_genmask(obj, genmask)) {
6091 rcu_read_unlock();
6092 return obj;
6093 }
6094 }
6095 out:
6096 rcu_read_unlock();
6097 return ERR_PTR(-ENOENT);
6098 }
6099 EXPORT_SYMBOL_GPL(nft_obj_lookup);
6100
nft_obj_lookup_byhandle(const struct nft_table * table,const struct nlattr * nla,u32 objtype,u8 genmask)6101 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
6102 const struct nlattr *nla,
6103 u32 objtype, u8 genmask)
6104 {
6105 struct nft_object *obj;
6106
6107 list_for_each_entry(obj, &table->objects, list) {
6108 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
6109 objtype == obj->ops->type->type &&
6110 nft_active_genmask(obj, genmask))
6111 return obj;
6112 }
6113 return ERR_PTR(-ENOENT);
6114 }
6115
6116 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
6117 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
6118 .len = NFT_TABLE_MAXNAMELEN - 1 },
6119 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
6120 .len = NFT_OBJ_MAXNAMELEN - 1 },
6121 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
6122 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
6123 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
6124 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY,
6125 .len = NFT_USERDATA_MAXLEN },
6126 };
6127
nft_obj_init(const struct nft_ctx * ctx,const struct nft_object_type * type,const struct nlattr * attr)6128 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
6129 const struct nft_object_type *type,
6130 const struct nlattr *attr)
6131 {
6132 struct nlattr **tb;
6133 const struct nft_object_ops *ops;
6134 struct nft_object *obj;
6135 int err = -ENOMEM;
6136
6137 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
6138 if (!tb)
6139 goto err1;
6140
6141 if (attr) {
6142 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
6143 type->policy, NULL);
6144 if (err < 0)
6145 goto err2;
6146 } else {
6147 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
6148 }
6149
6150 if (type->select_ops) {
6151 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
6152 if (IS_ERR(ops)) {
6153 err = PTR_ERR(ops);
6154 goto err2;
6155 }
6156 } else {
6157 ops = type->ops;
6158 }
6159
6160 err = -ENOMEM;
6161 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
6162 if (!obj)
6163 goto err2;
6164
6165 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
6166 if (err < 0)
6167 goto err3;
6168
6169 obj->ops = ops;
6170
6171 kfree(tb);
6172 return obj;
6173 err3:
6174 kfree(obj);
6175 err2:
6176 kfree(tb);
6177 err1:
6178 return ERR_PTR(err);
6179 }
6180
nft_object_dump(struct sk_buff * skb,unsigned int attr,struct nft_object * obj,bool reset)6181 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
6182 struct nft_object *obj, bool reset)
6183 {
6184 struct nlattr *nest;
6185
6186 nest = nla_nest_start_noflag(skb, attr);
6187 if (!nest)
6188 goto nla_put_failure;
6189 if (obj->ops->dump(skb, obj, reset) < 0)
6190 goto nla_put_failure;
6191 nla_nest_end(skb, nest);
6192 return 0;
6193
6194 nla_put_failure:
6195 return -1;
6196 }
6197
__nft_obj_type_get(u32 objtype)6198 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
6199 {
6200 const struct nft_object_type *type;
6201
6202 list_for_each_entry(type, &nf_tables_objects, list) {
6203 if (objtype == type->type)
6204 return type;
6205 }
6206 return NULL;
6207 }
6208
6209 static const struct nft_object_type *
nft_obj_type_get(struct net * net,u32 objtype)6210 nft_obj_type_get(struct net *net, u32 objtype)
6211 {
6212 const struct nft_object_type *type;
6213
6214 type = __nft_obj_type_get(objtype);
6215 if (type != NULL && try_module_get(type->owner))
6216 return type;
6217
6218 lockdep_nfnl_nft_mutex_not_held();
6219 #ifdef CONFIG_MODULES
6220 if (type == NULL) {
6221 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
6222 return ERR_PTR(-EAGAIN);
6223 }
6224 #endif
6225 return ERR_PTR(-ENOENT);
6226 }
6227
nf_tables_updobj(const struct nft_ctx * ctx,const struct nft_object_type * type,const struct nlattr * attr,struct nft_object * obj)6228 static int nf_tables_updobj(const struct nft_ctx *ctx,
6229 const struct nft_object_type *type,
6230 const struct nlattr *attr,
6231 struct nft_object *obj)
6232 {
6233 struct nft_object *newobj;
6234 struct nft_trans *trans;
6235 int err = -ENOMEM;
6236
6237 if (!try_module_get(type->owner))
6238 return -ENOENT;
6239
6240 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
6241 sizeof(struct nft_trans_obj));
6242 if (!trans)
6243 goto err_trans;
6244
6245 newobj = nft_obj_init(ctx, type, attr);
6246 if (IS_ERR(newobj)) {
6247 err = PTR_ERR(newobj);
6248 goto err_free_trans;
6249 }
6250
6251 nft_trans_obj(trans) = obj;
6252 nft_trans_obj_update(trans) = true;
6253 nft_trans_obj_newobj(trans) = newobj;
6254 nft_trans_commit_list_add_tail(ctx->net, trans);
6255
6256 return 0;
6257
6258 err_free_trans:
6259 kfree(trans);
6260 err_trans:
6261 module_put(type->owner);
6262 return err;
6263 }
6264
nf_tables_newobj(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)6265 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
6266 struct sk_buff *skb, const struct nlmsghdr *nlh,
6267 const struct nlattr * const nla[],
6268 struct netlink_ext_ack *extack)
6269 {
6270 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6271 const struct nft_object_type *type;
6272 u8 genmask = nft_genmask_next(net);
6273 int family = nfmsg->nfgen_family;
6274 struct nft_table *table;
6275 struct nft_object *obj;
6276 struct nft_ctx ctx;
6277 u32 objtype;
6278 int err;
6279
6280 if (!nla[NFTA_OBJ_TYPE] ||
6281 !nla[NFTA_OBJ_NAME] ||
6282 !nla[NFTA_OBJ_DATA])
6283 return -EINVAL;
6284
6285 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
6286 if (IS_ERR(table)) {
6287 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6288 return PTR_ERR(table);
6289 }
6290
6291 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6292 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
6293 if (IS_ERR(obj)) {
6294 err = PTR_ERR(obj);
6295 if (err != -ENOENT) {
6296 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6297 return err;
6298 }
6299 } else {
6300 if (nlh->nlmsg_flags & NLM_F_EXCL) {
6301 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6302 return -EEXIST;
6303 }
6304 if (nlh->nlmsg_flags & NLM_F_REPLACE)
6305 return -EOPNOTSUPP;
6306
6307 type = __nft_obj_type_get(objtype);
6308 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6309
6310 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
6311 }
6312
6313 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6314
6315 if (!nft_use_inc(&table->use))
6316 return -EMFILE;
6317
6318 type = nft_obj_type_get(net, objtype);
6319 if (IS_ERR(type)) {
6320 err = PTR_ERR(type);
6321 goto err_type;
6322 }
6323
6324 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
6325 if (IS_ERR(obj)) {
6326 err = PTR_ERR(obj);
6327 goto err_init;
6328 }
6329 obj->key.table = table;
6330 obj->handle = nf_tables_alloc_handle(table);
6331
6332 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
6333 if (!obj->key.name) {
6334 err = -ENOMEM;
6335 goto err_strdup;
6336 }
6337
6338 if (nla[NFTA_OBJ_USERDATA]) {
6339 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL);
6340 if (obj->udata == NULL)
6341 goto err_userdata;
6342
6343 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]);
6344 }
6345
6346 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
6347 if (err < 0)
6348 goto err_trans;
6349
6350 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
6351 nft_objname_ht_params);
6352 if (err < 0)
6353 goto err_obj_ht;
6354
6355 list_add_tail_rcu(&obj->list, &table->objects);
6356
6357 return 0;
6358 err_obj_ht:
6359 /* queued in transaction log */
6360 INIT_LIST_HEAD(&obj->list);
6361 return err;
6362 err_trans:
6363 kfree(obj->udata);
6364 err_userdata:
6365 kfree(obj->key.name);
6366 err_strdup:
6367 if (obj->ops->destroy)
6368 obj->ops->destroy(&ctx, obj);
6369 kfree(obj);
6370 err_init:
6371 module_put(type->owner);
6372 err_type:
6373 nft_use_dec_restore(&table->use);
6374
6375 return err;
6376 }
6377
nf_tables_fill_obj_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,const struct nft_table * table,struct nft_object * obj,bool reset)6378 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
6379 u32 portid, u32 seq, int event, u32 flags,
6380 int family, const struct nft_table *table,
6381 struct nft_object *obj, bool reset)
6382 {
6383 struct nlmsghdr *nlh;
6384
6385 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6386 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
6387 NFNETLINK_V0, nft_base_seq(net));
6388 if (!nlh)
6389 goto nla_put_failure;
6390
6391 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
6392 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
6393 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
6394 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
6395 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
6396 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
6397 NFTA_OBJ_PAD))
6398 goto nla_put_failure;
6399
6400 if (obj->udata &&
6401 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata))
6402 goto nla_put_failure;
6403
6404 nlmsg_end(skb, nlh);
6405 return 0;
6406
6407 nla_put_failure:
6408 nlmsg_trim(skb, nlh);
6409 return -1;
6410 }
6411
6412 struct nft_obj_filter {
6413 char *table;
6414 u32 type;
6415 };
6416
nf_tables_dump_obj(struct sk_buff * skb,struct netlink_callback * cb)6417 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
6418 {
6419 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6420 const struct nft_table *table;
6421 unsigned int idx = 0, s_idx = cb->args[0];
6422 struct nft_obj_filter *filter = cb->data;
6423 struct net *net = sock_net(skb->sk);
6424 int family = nfmsg->nfgen_family;
6425 struct nftables_pernet *nft_net;
6426 struct nft_object *obj;
6427 bool reset = false;
6428
6429 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6430 reset = true;
6431
6432 rcu_read_lock();
6433 nft_net = net_generic(net, nf_tables_net_id);
6434 cb->seq = nft_net->base_seq;
6435
6436 list_for_each_entry_rcu(table, &nft_net->tables, list) {
6437 if (family != NFPROTO_UNSPEC && family != table->family)
6438 continue;
6439
6440 list_for_each_entry_rcu(obj, &table->objects, list) {
6441 if (!nft_is_active(net, obj))
6442 goto cont;
6443 if (idx < s_idx)
6444 goto cont;
6445 if (idx > s_idx)
6446 memset(&cb->args[1], 0,
6447 sizeof(cb->args) - sizeof(cb->args[0]));
6448 if (filter && filter->table &&
6449 strcmp(filter->table, table->name))
6450 goto cont;
6451 if (filter &&
6452 filter->type != NFT_OBJECT_UNSPEC &&
6453 obj->ops->type->type != filter->type)
6454 goto cont;
6455 if (reset) {
6456 char *buf = kasprintf(GFP_ATOMIC,
6457 "%s:%u",
6458 table->name,
6459 nft_net->base_seq);
6460
6461 audit_log_nfcfg(buf,
6462 family,
6463 obj->handle,
6464 AUDIT_NFT_OP_OBJ_RESET,
6465 GFP_ATOMIC);
6466 kfree(buf);
6467 }
6468
6469 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
6470 cb->nlh->nlmsg_seq,
6471 NFT_MSG_NEWOBJ,
6472 NLM_F_MULTI | NLM_F_APPEND,
6473 table->family, table,
6474 obj, reset) < 0)
6475 goto done;
6476
6477 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
6478 cont:
6479 idx++;
6480 }
6481 }
6482 done:
6483 rcu_read_unlock();
6484
6485 cb->args[0] = idx;
6486 return skb->len;
6487 }
6488
nf_tables_dump_obj_start(struct netlink_callback * cb)6489 static int nf_tables_dump_obj_start(struct netlink_callback *cb)
6490 {
6491 const struct nlattr * const *nla = cb->data;
6492 struct nft_obj_filter *filter = NULL;
6493
6494 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
6495 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6496 if (!filter)
6497 return -ENOMEM;
6498
6499 if (nla[NFTA_OBJ_TABLE]) {
6500 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
6501 if (!filter->table) {
6502 kfree(filter);
6503 return -ENOMEM;
6504 }
6505 }
6506
6507 if (nla[NFTA_OBJ_TYPE])
6508 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6509 }
6510
6511 cb->data = filter;
6512 return 0;
6513 }
6514
nf_tables_dump_obj_done(struct netlink_callback * cb)6515 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
6516 {
6517 struct nft_obj_filter *filter = cb->data;
6518
6519 if (filter) {
6520 kfree(filter->table);
6521 kfree(filter);
6522 }
6523
6524 return 0;
6525 }
6526
6527 /* called with rcu_read_lock held */
nf_tables_getobj(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)6528 static int nf_tables_getobj(struct net *net, struct sock *nlsk,
6529 struct sk_buff *skb, const struct nlmsghdr *nlh,
6530 const struct nlattr * const nla[],
6531 struct netlink_ext_ack *extack)
6532 {
6533 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6534 u8 genmask = nft_genmask_cur(net);
6535 int family = nfmsg->nfgen_family;
6536 const struct nft_table *table;
6537 struct nft_object *obj;
6538 struct sk_buff *skb2;
6539 bool reset = false;
6540 u32 objtype;
6541 int err;
6542
6543 if (nlh->nlmsg_flags & NLM_F_DUMP) {
6544 struct netlink_dump_control c = {
6545 .start = nf_tables_dump_obj_start,
6546 .dump = nf_tables_dump_obj,
6547 .done = nf_tables_dump_obj_done,
6548 .module = THIS_MODULE,
6549 .data = (void *)nla,
6550 };
6551
6552 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
6553 }
6554
6555 if (!nla[NFTA_OBJ_NAME] ||
6556 !nla[NFTA_OBJ_TYPE])
6557 return -EINVAL;
6558
6559 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
6560 if (IS_ERR(table)) {
6561 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6562 return PTR_ERR(table);
6563 }
6564
6565 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6566 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
6567 if (IS_ERR(obj)) {
6568 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6569 return PTR_ERR(obj);
6570 }
6571
6572 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
6573 if (!skb2)
6574 return -ENOMEM;
6575
6576 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6577 reset = true;
6578
6579 if (reset) {
6580 const struct nftables_pernet *nft_net;
6581 char *buf;
6582
6583 nft_net = net_generic(net, nf_tables_net_id);
6584 buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq);
6585
6586 audit_log_nfcfg(buf,
6587 family,
6588 obj->handle,
6589 AUDIT_NFT_OP_OBJ_RESET,
6590 GFP_ATOMIC);
6591 kfree(buf);
6592 }
6593
6594 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
6595 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
6596 family, table, obj, reset);
6597 if (err < 0)
6598 goto err_fill_obj_info;
6599
6600 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
6601
6602 err_fill_obj_info:
6603 kfree_skb(skb2);
6604 return err;
6605 }
6606
nft_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)6607 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
6608 {
6609 if (obj->ops->destroy)
6610 obj->ops->destroy(ctx, obj);
6611
6612 module_put(obj->ops->type->owner);
6613 kfree(obj->key.name);
6614 kfree(obj->udata);
6615 kfree(obj);
6616 }
6617
nf_tables_delobj(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)6618 static int nf_tables_delobj(struct net *net, struct sock *nlsk,
6619 struct sk_buff *skb, const struct nlmsghdr *nlh,
6620 const struct nlattr * const nla[],
6621 struct netlink_ext_ack *extack)
6622 {
6623 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6624 u8 genmask = nft_genmask_next(net);
6625 int family = nfmsg->nfgen_family;
6626 const struct nlattr *attr;
6627 struct nft_table *table;
6628 struct nft_object *obj;
6629 struct nft_ctx ctx;
6630 u32 objtype;
6631
6632 if (!nla[NFTA_OBJ_TYPE] ||
6633 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
6634 return -EINVAL;
6635
6636 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
6637 if (IS_ERR(table)) {
6638 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6639 return PTR_ERR(table);
6640 }
6641
6642 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6643 if (nla[NFTA_OBJ_HANDLE]) {
6644 attr = nla[NFTA_OBJ_HANDLE];
6645 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
6646 } else {
6647 attr = nla[NFTA_OBJ_NAME];
6648 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
6649 }
6650
6651 if (IS_ERR(obj)) {
6652 NL_SET_BAD_ATTR(extack, attr);
6653 return PTR_ERR(obj);
6654 }
6655 if (obj->use > 0) {
6656 NL_SET_BAD_ATTR(extack, attr);
6657 return -EBUSY;
6658 }
6659
6660 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6661
6662 return nft_delobj(&ctx, obj);
6663 }
6664
nft_obj_notify(struct net * net,const struct nft_table * table,struct nft_object * obj,u32 portid,u32 seq,int event,int family,int report,gfp_t gfp)6665 void nft_obj_notify(struct net *net, const struct nft_table *table,
6666 struct nft_object *obj, u32 portid, u32 seq, int event,
6667 int family, int report, gfp_t gfp)
6668 {
6669 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
6670 struct sk_buff *skb;
6671 int err;
6672 char *buf = kasprintf(gfp, "%s:%u",
6673 table->name, nft_net->base_seq);
6674
6675 audit_log_nfcfg(buf,
6676 family,
6677 obj->handle,
6678 event == NFT_MSG_NEWOBJ ?
6679 AUDIT_NFT_OP_OBJ_REGISTER :
6680 AUDIT_NFT_OP_OBJ_UNREGISTER,
6681 gfp);
6682 kfree(buf);
6683
6684 if (!report &&
6685 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
6686 return;
6687
6688 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
6689 if (skb == NULL)
6690 goto err;
6691
6692 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
6693 table, obj, false);
6694 if (err < 0) {
6695 kfree_skb(skb);
6696 goto err;
6697 }
6698
6699 nft_notify_enqueue(skb, report, &nft_net->notify_list);
6700 return;
6701 err:
6702 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
6703 }
6704 EXPORT_SYMBOL_GPL(nft_obj_notify);
6705
nf_tables_obj_notify(const struct nft_ctx * ctx,struct nft_object * obj,int event)6706 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
6707 struct nft_object *obj, int event)
6708 {
6709 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
6710 ctx->family, ctx->report, GFP_KERNEL);
6711 }
6712
6713 /*
6714 * Flow tables
6715 */
nft_register_flowtable_type(struct nf_flowtable_type * type)6716 void nft_register_flowtable_type(struct nf_flowtable_type *type)
6717 {
6718 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6719 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
6720 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6721 }
6722 EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
6723
nft_unregister_flowtable_type(struct nf_flowtable_type * type)6724 void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
6725 {
6726 nfnl_lock(NFNL_SUBSYS_NFTABLES);
6727 list_del_rcu(&type->list);
6728 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6729 }
6730 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
6731
6732 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
6733 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
6734 .len = NFT_NAME_MAXLEN - 1 },
6735 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
6736 .len = NFT_NAME_MAXLEN - 1 },
6737 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
6738 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
6739 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 },
6740 };
6741
nft_flowtable_lookup(const struct nft_table * table,const struct nlattr * nla,u8 genmask)6742 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
6743 const struct nlattr *nla, u8 genmask)
6744 {
6745 struct nft_flowtable *flowtable;
6746
6747 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6748 if (!nla_strcmp(nla, flowtable->name) &&
6749 nft_active_genmask(flowtable, genmask))
6750 return flowtable;
6751 }
6752 return ERR_PTR(-ENOENT);
6753 }
6754 EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
6755
nf_tables_deactivate_flowtable(const struct nft_ctx * ctx,struct nft_flowtable * flowtable,enum nft_trans_phase phase)6756 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
6757 struct nft_flowtable *flowtable,
6758 enum nft_trans_phase phase)
6759 {
6760 switch (phase) {
6761 case NFT_TRANS_PREPARE_ERROR:
6762 case NFT_TRANS_PREPARE:
6763 case NFT_TRANS_ABORT:
6764 case NFT_TRANS_RELEASE:
6765 nft_use_dec(&flowtable->use);
6766 fallthrough;
6767 default:
6768 return;
6769 }
6770 }
6771 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
6772
6773 static struct nft_flowtable *
nft_flowtable_lookup_byhandle(const struct nft_table * table,const struct nlattr * nla,u8 genmask)6774 nft_flowtable_lookup_byhandle(const struct nft_table *table,
6775 const struct nlattr *nla, u8 genmask)
6776 {
6777 struct nft_flowtable *flowtable;
6778
6779 list_for_each_entry(flowtable, &table->flowtables, list) {
6780 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
6781 nft_active_genmask(flowtable, genmask))
6782 return flowtable;
6783 }
6784 return ERR_PTR(-ENOENT);
6785 }
6786
6787 struct nft_flowtable_hook {
6788 u32 num;
6789 int priority;
6790 struct list_head list;
6791 };
6792
6793 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
6794 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
6795 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
6796 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
6797 };
6798
nft_flowtable_parse_hook(const struct nft_ctx * ctx,const struct nlattr * attr,struct nft_flowtable_hook * flowtable_hook,struct nft_flowtable * flowtable,bool add)6799 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
6800 const struct nlattr *attr,
6801 struct nft_flowtable_hook *flowtable_hook,
6802 struct nft_flowtable *flowtable, bool add)
6803 {
6804 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
6805 struct nft_hook *hook;
6806 int hooknum, priority;
6807 int err;
6808
6809 INIT_LIST_HEAD(&flowtable_hook->list);
6810
6811 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
6812 nft_flowtable_hook_policy, NULL);
6813 if (err < 0)
6814 return err;
6815
6816 if (add) {
6817 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
6818 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY])
6819 return -EINVAL;
6820
6821 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6822 if (hooknum != NF_NETDEV_INGRESS)
6823 return -EOPNOTSUPP;
6824
6825 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6826
6827 flowtable_hook->priority = priority;
6828 flowtable_hook->num = hooknum;
6829 } else {
6830 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) {
6831 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6832 if (hooknum != flowtable->hooknum)
6833 return -EOPNOTSUPP;
6834 }
6835
6836 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
6837 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6838 if (priority != flowtable->data.priority)
6839 return -EOPNOTSUPP;
6840 }
6841
6842 flowtable_hook->priority = flowtable->data.priority;
6843 flowtable_hook->num = flowtable->hooknum;
6844 }
6845
6846 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
6847 err = nf_tables_parse_netdev_hooks(ctx->net,
6848 tb[NFTA_FLOWTABLE_HOOK_DEVS],
6849 &flowtable_hook->list);
6850 if (err < 0)
6851 return err;
6852 }
6853
6854 list_for_each_entry(hook, &flowtable_hook->list, list) {
6855 hook->ops.pf = NFPROTO_NETDEV;
6856 hook->ops.hooknum = flowtable_hook->num;
6857 hook->ops.priority = flowtable_hook->priority;
6858 hook->ops.priv = &flowtable->data;
6859 hook->ops.hook = flowtable->data.type->hook;
6860 }
6861
6862 return err;
6863 }
6864
__nft_flowtable_type_get(u8 family)6865 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
6866 {
6867 const struct nf_flowtable_type *type;
6868
6869 list_for_each_entry(type, &nf_tables_flowtables, list) {
6870 if (family == type->family)
6871 return type;
6872 }
6873 return NULL;
6874 }
6875
6876 static const struct nf_flowtable_type *
nft_flowtable_type_get(struct net * net,u8 family)6877 nft_flowtable_type_get(struct net *net, u8 family)
6878 {
6879 const struct nf_flowtable_type *type;
6880
6881 type = __nft_flowtable_type_get(family);
6882 if (type != NULL && try_module_get(type->owner))
6883 return type;
6884
6885 lockdep_nfnl_nft_mutex_not_held();
6886 #ifdef CONFIG_MODULES
6887 if (type == NULL) {
6888 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
6889 return ERR_PTR(-EAGAIN);
6890 }
6891 #endif
6892 return ERR_PTR(-ENOENT);
6893 }
6894
6895 /* Only called from error and netdev event paths. */
nft_unregister_flowtable_hook(struct net * net,struct nft_flowtable * flowtable,struct nft_hook * hook)6896 static void nft_unregister_flowtable_hook(struct net *net,
6897 struct nft_flowtable *flowtable,
6898 struct nft_hook *hook)
6899 {
6900 nf_unregister_net_hook(net, &hook->ops);
6901 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
6902 FLOW_BLOCK_UNBIND);
6903 }
6904
__nft_unregister_flowtable_net_hooks(struct net * net,struct list_head * hook_list,bool release_netdev)6905 static void __nft_unregister_flowtable_net_hooks(struct net *net,
6906 struct list_head *hook_list,
6907 bool release_netdev)
6908 {
6909 struct nft_hook *hook, *next;
6910
6911 list_for_each_entry_safe(hook, next, hook_list, list) {
6912 nf_unregister_net_hook(net, &hook->ops);
6913 if (release_netdev) {
6914 list_del(&hook->list);
6915 kfree_rcu(hook, rcu);
6916 }
6917 }
6918 }
6919
nft_unregister_flowtable_net_hooks(struct net * net,struct list_head * hook_list)6920 static void nft_unregister_flowtable_net_hooks(struct net *net,
6921 struct list_head *hook_list)
6922 {
6923 __nft_unregister_flowtable_net_hooks(net, hook_list, false);
6924 }
6925
nft_register_flowtable_net_hooks(struct net * net,struct nft_table * table,struct list_head * hook_list,struct nft_flowtable * flowtable)6926 static int nft_register_flowtable_net_hooks(struct net *net,
6927 struct nft_table *table,
6928 struct list_head *hook_list,
6929 struct nft_flowtable *flowtable)
6930 {
6931 struct nft_hook *hook, *hook2, *next;
6932 struct nft_flowtable *ft;
6933 int err, i = 0;
6934
6935 list_for_each_entry(hook, hook_list, list) {
6936 list_for_each_entry(ft, &table->flowtables, list) {
6937 if (!nft_is_active_next(net, ft))
6938 continue;
6939
6940 list_for_each_entry(hook2, &ft->hook_list, list) {
6941 if (hook->ops.dev == hook2->ops.dev &&
6942 hook->ops.pf == hook2->ops.pf) {
6943 err = -EEXIST;
6944 goto err_unregister_net_hooks;
6945 }
6946 }
6947 }
6948
6949 err = flowtable->data.type->setup(&flowtable->data,
6950 hook->ops.dev,
6951 FLOW_BLOCK_BIND);
6952 if (err < 0)
6953 goto err_unregister_net_hooks;
6954
6955 err = nf_register_net_hook(net, &hook->ops);
6956 if (err < 0) {
6957 flowtable->data.type->setup(&flowtable->data,
6958 hook->ops.dev,
6959 FLOW_BLOCK_UNBIND);
6960 goto err_unregister_net_hooks;
6961 }
6962
6963 i++;
6964 }
6965
6966 return 0;
6967
6968 err_unregister_net_hooks:
6969 list_for_each_entry_safe(hook, next, hook_list, list) {
6970 if (i-- <= 0)
6971 break;
6972
6973 nft_unregister_flowtable_hook(net, flowtable, hook);
6974 list_del_rcu(&hook->list);
6975 kfree_rcu(hook, rcu);
6976 }
6977
6978 return err;
6979 }
6980
nft_flowtable_hooks_destroy(struct list_head * hook_list)6981 static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
6982 {
6983 struct nft_hook *hook, *next;
6984
6985 list_for_each_entry_safe(hook, next, hook_list, list) {
6986 list_del_rcu(&hook->list);
6987 kfree_rcu(hook, rcu);
6988 }
6989 }
6990
nft_flowtable_update(struct nft_ctx * ctx,const struct nlmsghdr * nlh,struct nft_flowtable * flowtable)6991 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
6992 struct nft_flowtable *flowtable)
6993 {
6994 const struct nlattr * const *nla = ctx->nla;
6995 struct nft_flowtable_hook flowtable_hook;
6996 struct nft_hook *hook, *next;
6997 struct nft_trans *trans;
6998 bool unregister = false;
6999 u32 flags;
7000 int err;
7001
7002 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
7003 &flowtable_hook, flowtable, false);
7004 if (err < 0)
7005 return err;
7006
7007 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
7008 if (nft_hook_list_find(&flowtable->hook_list, hook)) {
7009 list_del(&hook->list);
7010 kfree(hook);
7011 }
7012 }
7013
7014 if (nla[NFTA_FLOWTABLE_FLAGS]) {
7015 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
7016 if (flags & ~NFT_FLOWTABLE_MASK) {
7017 err = -EOPNOTSUPP;
7018 goto err_flowtable_update_hook;
7019 }
7020 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^
7021 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) {
7022 err = -EOPNOTSUPP;
7023 goto err_flowtable_update_hook;
7024 }
7025 } else {
7026 flags = flowtable->data.flags;
7027 }
7028
7029 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table,
7030 &flowtable_hook.list, flowtable);
7031 if (err < 0)
7032 goto err_flowtable_update_hook;
7033
7034 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE,
7035 sizeof(struct nft_trans_flowtable));
7036 if (!trans) {
7037 unregister = true;
7038 err = -ENOMEM;
7039 goto err_flowtable_update_hook;
7040 }
7041
7042 nft_trans_flowtable_flags(trans) = flags;
7043 nft_trans_flowtable(trans) = flowtable;
7044 nft_trans_flowtable_update(trans) = true;
7045 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
7046 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans));
7047
7048 nft_trans_commit_list_add_tail(ctx->net, trans);
7049
7050 return 0;
7051
7052 err_flowtable_update_hook:
7053 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
7054 if (unregister)
7055 nft_unregister_flowtable_hook(ctx->net, flowtable, hook);
7056 list_del_rcu(&hook->list);
7057 kfree_rcu(hook, rcu);
7058 }
7059
7060 return err;
7061
7062 }
7063
nf_tables_newflowtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)7064 static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
7065 struct sk_buff *skb,
7066 const struct nlmsghdr *nlh,
7067 const struct nlattr * const nla[],
7068 struct netlink_ext_ack *extack)
7069 {
7070 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7071 struct nft_flowtable_hook flowtable_hook;
7072 const struct nf_flowtable_type *type;
7073 u8 genmask = nft_genmask_next(net);
7074 int family = nfmsg->nfgen_family;
7075 struct nft_flowtable *flowtable;
7076 struct nft_hook *hook, *next;
7077 struct nft_table *table;
7078 struct nft_ctx ctx;
7079 int err;
7080
7081 if (!nla[NFTA_FLOWTABLE_TABLE] ||
7082 !nla[NFTA_FLOWTABLE_NAME] ||
7083 !nla[NFTA_FLOWTABLE_HOOK])
7084 return -EINVAL;
7085
7086 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7087 genmask);
7088 if (IS_ERR(table)) {
7089 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
7090 return PTR_ERR(table);
7091 }
7092
7093 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
7094 genmask);
7095 if (IS_ERR(flowtable)) {
7096 err = PTR_ERR(flowtable);
7097 if (err != -ENOENT) {
7098 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
7099 return err;
7100 }
7101 } else {
7102 if (nlh->nlmsg_flags & NLM_F_EXCL) {
7103 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
7104 return -EEXIST;
7105 }
7106
7107 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
7108
7109 return nft_flowtable_update(&ctx, nlh, flowtable);
7110 }
7111
7112 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
7113
7114 if (!nft_use_inc(&table->use))
7115 return -EMFILE;
7116
7117 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
7118 if (!flowtable) {
7119 err = -ENOMEM;
7120 goto flowtable_alloc;
7121 }
7122
7123 flowtable->table = table;
7124 flowtable->handle = nf_tables_alloc_handle(table);
7125 INIT_LIST_HEAD(&flowtable->hook_list);
7126
7127 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
7128 if (!flowtable->name) {
7129 err = -ENOMEM;
7130 goto err1;
7131 }
7132
7133 type = nft_flowtable_type_get(net, family);
7134 if (IS_ERR(type)) {
7135 err = PTR_ERR(type);
7136 goto err2;
7137 }
7138
7139 if (nla[NFTA_FLOWTABLE_FLAGS]) {
7140 flowtable->data.flags =
7141 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
7142 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) {
7143 err = -EOPNOTSUPP;
7144 goto err3;
7145 }
7146 }
7147
7148 write_pnet(&flowtable->data.net, net);
7149 flowtable->data.type = type;
7150 err = type->init(&flowtable->data);
7151 if (err < 0)
7152 goto err3;
7153
7154 err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
7155 &flowtable_hook, flowtable, true);
7156 if (err < 0)
7157 goto err4;
7158
7159 list_splice(&flowtable_hook.list, &flowtable->hook_list);
7160 flowtable->data.priority = flowtable_hook.priority;
7161 flowtable->hooknum = flowtable_hook.num;
7162
7163 err = nft_register_flowtable_net_hooks(ctx.net, table,
7164 &flowtable->hook_list,
7165 flowtable);
7166 if (err < 0) {
7167 nft_flowtable_hooks_destroy(&flowtable->hook_list);
7168 goto err4;
7169 }
7170
7171 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
7172 if (err < 0)
7173 goto err5;
7174
7175 list_add_tail_rcu(&flowtable->list, &table->flowtables);
7176
7177 return 0;
7178 err5:
7179 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7180 nft_unregister_flowtable_hook(net, flowtable, hook);
7181 list_del_rcu(&hook->list);
7182 kfree_rcu(hook, rcu);
7183 }
7184 err4:
7185 flowtable->data.type->free(&flowtable->data);
7186 err3:
7187 module_put(type->owner);
7188 err2:
7189 kfree(flowtable->name);
7190 err1:
7191 kfree(flowtable);
7192 flowtable_alloc:
7193 nft_use_dec_restore(&table->use);
7194
7195 return err;
7196 }
7197
nft_flowtable_hook_release(struct nft_flowtable_hook * flowtable_hook)7198 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook)
7199 {
7200 struct nft_hook *this, *next;
7201
7202 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) {
7203 list_del(&this->list);
7204 kfree(this);
7205 }
7206 }
7207
nft_delflowtable_hook(struct nft_ctx * ctx,struct nft_flowtable * flowtable)7208 static int nft_delflowtable_hook(struct nft_ctx *ctx,
7209 struct nft_flowtable *flowtable)
7210 {
7211 const struct nlattr * const *nla = ctx->nla;
7212 struct nft_flowtable_hook flowtable_hook;
7213 LIST_HEAD(flowtable_del_list);
7214 struct nft_hook *this, *hook;
7215 struct nft_trans *trans;
7216 int err;
7217
7218 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
7219 &flowtable_hook, flowtable, false);
7220 if (err < 0)
7221 return err;
7222
7223 list_for_each_entry(this, &flowtable_hook.list, list) {
7224 hook = nft_hook_list_find(&flowtable->hook_list, this);
7225 if (!hook) {
7226 err = -ENOENT;
7227 goto err_flowtable_del_hook;
7228 }
7229 list_move(&hook->list, &flowtable_del_list);
7230 }
7231
7232 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
7233 sizeof(struct nft_trans_flowtable));
7234 if (!trans) {
7235 err = -ENOMEM;
7236 goto err_flowtable_del_hook;
7237 }
7238
7239 nft_trans_flowtable(trans) = flowtable;
7240 nft_trans_flowtable_update(trans) = true;
7241 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
7242 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans));
7243 nft_flowtable_hook_release(&flowtable_hook);
7244
7245 nft_trans_commit_list_add_tail(ctx->net, trans);
7246
7247 return 0;
7248
7249 err_flowtable_del_hook:
7250 list_splice(&flowtable_del_list, &flowtable->hook_list);
7251 nft_flowtable_hook_release(&flowtable_hook);
7252
7253 return err;
7254 }
7255
nf_tables_delflowtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)7256 static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
7257 struct sk_buff *skb,
7258 const struct nlmsghdr *nlh,
7259 const struct nlattr * const nla[],
7260 struct netlink_ext_ack *extack)
7261 {
7262 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7263 u8 genmask = nft_genmask_next(net);
7264 int family = nfmsg->nfgen_family;
7265 struct nft_flowtable *flowtable;
7266 const struct nlattr *attr;
7267 struct nft_table *table;
7268 struct nft_ctx ctx;
7269
7270 if (!nla[NFTA_FLOWTABLE_TABLE] ||
7271 (!nla[NFTA_FLOWTABLE_NAME] &&
7272 !nla[NFTA_FLOWTABLE_HANDLE]))
7273 return -EINVAL;
7274
7275 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7276 genmask);
7277 if (IS_ERR(table)) {
7278 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
7279 return PTR_ERR(table);
7280 }
7281
7282 if (nla[NFTA_FLOWTABLE_HANDLE]) {
7283 attr = nla[NFTA_FLOWTABLE_HANDLE];
7284 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
7285 } else {
7286 attr = nla[NFTA_FLOWTABLE_NAME];
7287 flowtable = nft_flowtable_lookup(table, attr, genmask);
7288 }
7289
7290 if (IS_ERR(flowtable)) {
7291 NL_SET_BAD_ATTR(extack, attr);
7292 return PTR_ERR(flowtable);
7293 }
7294
7295 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
7296
7297 if (nla[NFTA_FLOWTABLE_HOOK])
7298 return nft_delflowtable_hook(&ctx, flowtable);
7299
7300 if (flowtable->use > 0) {
7301 NL_SET_BAD_ATTR(extack, attr);
7302 return -EBUSY;
7303 }
7304
7305 return nft_delflowtable(&ctx, flowtable);
7306 }
7307
nf_tables_fill_flowtable_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq,int event,u32 flags,int family,struct nft_flowtable * flowtable,struct list_head * hook_list)7308 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
7309 u32 portid, u32 seq, int event,
7310 u32 flags, int family,
7311 struct nft_flowtable *flowtable,
7312 struct list_head *hook_list)
7313 {
7314 struct nlattr *nest, *nest_devs;
7315 struct nft_hook *hook;
7316 struct nlmsghdr *nlh;
7317
7318 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
7319 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
7320 NFNETLINK_V0, nft_base_seq(net));
7321 if (!nlh)
7322 goto nla_put_failure;
7323
7324 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
7325 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
7326 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
7327 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
7328 NFTA_FLOWTABLE_PAD) ||
7329 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags)))
7330 goto nla_put_failure;
7331
7332 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
7333 if (!nest)
7334 goto nla_put_failure;
7335 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
7336 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority)))
7337 goto nla_put_failure;
7338
7339 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
7340 if (!nest_devs)
7341 goto nla_put_failure;
7342
7343 list_for_each_entry_rcu(hook, hook_list, list) {
7344 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))
7345 goto nla_put_failure;
7346 }
7347 nla_nest_end(skb, nest_devs);
7348 nla_nest_end(skb, nest);
7349
7350 nlmsg_end(skb, nlh);
7351 return 0;
7352
7353 nla_put_failure:
7354 nlmsg_trim(skb, nlh);
7355 return -1;
7356 }
7357
7358 struct nft_flowtable_filter {
7359 char *table;
7360 };
7361
nf_tables_dump_flowtable(struct sk_buff * skb,struct netlink_callback * cb)7362 static int nf_tables_dump_flowtable(struct sk_buff *skb,
7363 struct netlink_callback *cb)
7364 {
7365 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
7366 struct nft_flowtable_filter *filter = cb->data;
7367 unsigned int idx = 0, s_idx = cb->args[0];
7368 struct net *net = sock_net(skb->sk);
7369 int family = nfmsg->nfgen_family;
7370 struct nft_flowtable *flowtable;
7371 struct nftables_pernet *nft_net;
7372 const struct nft_table *table;
7373
7374 rcu_read_lock();
7375 nft_net = net_generic(net, nf_tables_net_id);
7376 cb->seq = nft_net->base_seq;
7377
7378 list_for_each_entry_rcu(table, &nft_net->tables, list) {
7379 if (family != NFPROTO_UNSPEC && family != table->family)
7380 continue;
7381
7382 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
7383 if (!nft_is_active(net, flowtable))
7384 goto cont;
7385 if (idx < s_idx)
7386 goto cont;
7387 if (idx > s_idx)
7388 memset(&cb->args[1], 0,
7389 sizeof(cb->args) - sizeof(cb->args[0]));
7390 if (filter && filter->table &&
7391 strcmp(filter->table, table->name))
7392 goto cont;
7393
7394 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
7395 cb->nlh->nlmsg_seq,
7396 NFT_MSG_NEWFLOWTABLE,
7397 NLM_F_MULTI | NLM_F_APPEND,
7398 table->family,
7399 flowtable,
7400 &flowtable->hook_list) < 0)
7401 goto done;
7402
7403 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
7404 cont:
7405 idx++;
7406 }
7407 }
7408 done:
7409 rcu_read_unlock();
7410
7411 cb->args[0] = idx;
7412 return skb->len;
7413 }
7414
nf_tables_dump_flowtable_start(struct netlink_callback * cb)7415 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
7416 {
7417 const struct nlattr * const *nla = cb->data;
7418 struct nft_flowtable_filter *filter = NULL;
7419
7420 if (nla[NFTA_FLOWTABLE_TABLE]) {
7421 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
7422 if (!filter)
7423 return -ENOMEM;
7424
7425 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
7426 GFP_ATOMIC);
7427 if (!filter->table) {
7428 kfree(filter);
7429 return -ENOMEM;
7430 }
7431 }
7432
7433 cb->data = filter;
7434 return 0;
7435 }
7436
nf_tables_dump_flowtable_done(struct netlink_callback * cb)7437 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
7438 {
7439 struct nft_flowtable_filter *filter = cb->data;
7440
7441 if (!filter)
7442 return 0;
7443
7444 kfree(filter->table);
7445 kfree(filter);
7446
7447 return 0;
7448 }
7449
7450 /* called with rcu_read_lock held */
nf_tables_getflowtable(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)7451 static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
7452 struct sk_buff *skb,
7453 const struct nlmsghdr *nlh,
7454 const struct nlattr * const nla[],
7455 struct netlink_ext_ack *extack)
7456 {
7457 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7458 u8 genmask = nft_genmask_cur(net);
7459 int family = nfmsg->nfgen_family;
7460 struct nft_flowtable *flowtable;
7461 const struct nft_table *table;
7462 struct sk_buff *skb2;
7463 int err;
7464
7465 if (nlh->nlmsg_flags & NLM_F_DUMP) {
7466 struct netlink_dump_control c = {
7467 .start = nf_tables_dump_flowtable_start,
7468 .dump = nf_tables_dump_flowtable,
7469 .done = nf_tables_dump_flowtable_done,
7470 .module = THIS_MODULE,
7471 .data = (void *)nla,
7472 };
7473
7474 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
7475 }
7476
7477 if (!nla[NFTA_FLOWTABLE_NAME])
7478 return -EINVAL;
7479
7480 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7481 genmask);
7482 if (IS_ERR(table))
7483 return PTR_ERR(table);
7484
7485 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
7486 genmask);
7487 if (IS_ERR(flowtable))
7488 return PTR_ERR(flowtable);
7489
7490 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7491 if (!skb2)
7492 return -ENOMEM;
7493
7494 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
7495 nlh->nlmsg_seq,
7496 NFT_MSG_NEWFLOWTABLE, 0, family,
7497 flowtable, &flowtable->hook_list);
7498 if (err < 0)
7499 goto err_fill_flowtable_info;
7500
7501 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7502
7503 err_fill_flowtable_info:
7504 kfree_skb(skb2);
7505 return err;
7506 }
7507
nf_tables_flowtable_notify(struct nft_ctx * ctx,struct nft_flowtable * flowtable,struct list_head * hook_list,int event)7508 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
7509 struct nft_flowtable *flowtable,
7510 struct list_head *hook_list,
7511 int event)
7512 {
7513 struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
7514 struct sk_buff *skb;
7515 int err;
7516
7517 if (!ctx->report &&
7518 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
7519 return;
7520
7521 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7522 if (skb == NULL)
7523 goto err;
7524
7525 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
7526 ctx->seq, event, 0,
7527 ctx->family, flowtable, hook_list);
7528 if (err < 0) {
7529 kfree_skb(skb);
7530 goto err;
7531 }
7532
7533 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
7534 return;
7535 err:
7536 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
7537 }
7538
nf_tables_flowtable_destroy(struct nft_flowtable * flowtable)7539 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
7540 {
7541 struct nft_hook *hook, *next;
7542
7543 flowtable->data.type->free(&flowtable->data);
7544 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7545 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
7546 FLOW_BLOCK_UNBIND);
7547 list_del_rcu(&hook->list);
7548 kfree(hook);
7549 }
7550 kfree(flowtable->name);
7551 module_put(flowtable->data.type->owner);
7552 kfree(flowtable);
7553 }
7554
nf_tables_fill_gen_info(struct sk_buff * skb,struct net * net,u32 portid,u32 seq)7555 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
7556 u32 portid, u32 seq)
7557 {
7558 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
7559 struct nlmsghdr *nlh;
7560 char buf[TASK_COMM_LEN];
7561 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
7562
7563 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC,
7564 NFNETLINK_V0, nft_base_seq(net));
7565 if (!nlh)
7566 goto nla_put_failure;
7567
7568 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) ||
7569 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
7570 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
7571 goto nla_put_failure;
7572
7573 nlmsg_end(skb, nlh);
7574 return 0;
7575
7576 nla_put_failure:
7577 nlmsg_trim(skb, nlh);
7578 return -EMSGSIZE;
7579 }
7580
nft_flowtable_event(unsigned long event,struct net_device * dev,struct nft_flowtable * flowtable)7581 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
7582 struct nft_flowtable *flowtable)
7583 {
7584 struct nft_hook *hook;
7585
7586 list_for_each_entry(hook, &flowtable->hook_list, list) {
7587 if (hook->ops.dev != dev)
7588 continue;
7589
7590 /* flow_offload_netdev_event() cleans up entries for us. */
7591 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook);
7592 list_del_rcu(&hook->list);
7593 kfree_rcu(hook, rcu);
7594 break;
7595 }
7596 }
7597
nf_tables_flowtable_event(struct notifier_block * this,unsigned long event,void * ptr)7598 static int nf_tables_flowtable_event(struct notifier_block *this,
7599 unsigned long event, void *ptr)
7600 {
7601 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
7602 struct nft_flowtable *flowtable;
7603 struct nftables_pernet *nft_net;
7604 struct nft_table *table;
7605 struct net *net;
7606
7607 if (event != NETDEV_UNREGISTER)
7608 return 0;
7609
7610 net = dev_net(dev);
7611 nft_net = net_generic(net, nf_tables_net_id);
7612 mutex_lock(&nft_net->commit_mutex);
7613 list_for_each_entry(table, &nft_net->tables, list) {
7614 list_for_each_entry(flowtable, &table->flowtables, list) {
7615 nft_flowtable_event(event, dev, flowtable);
7616 }
7617 }
7618 mutex_unlock(&nft_net->commit_mutex);
7619
7620 return NOTIFY_DONE;
7621 }
7622
7623 static struct notifier_block nf_tables_flowtable_notifier = {
7624 .notifier_call = nf_tables_flowtable_event,
7625 };
7626
nf_tables_gen_notify(struct net * net,struct sk_buff * skb,int event)7627 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
7628 int event)
7629 {
7630 struct nlmsghdr *nlh = nlmsg_hdr(skb);
7631 struct sk_buff *skb2;
7632 int err;
7633
7634 if (!nlmsg_report(nlh) &&
7635 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
7636 return;
7637
7638 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7639 if (skb2 == NULL)
7640 goto err;
7641
7642 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7643 nlh->nlmsg_seq);
7644 if (err < 0) {
7645 kfree_skb(skb2);
7646 goto err;
7647 }
7648
7649 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7650 nlmsg_report(nlh), GFP_KERNEL);
7651 return;
7652 err:
7653 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7654 -ENOBUFS);
7655 }
7656
nf_tables_getgen(struct net * net,struct sock * nlsk,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const nla[],struct netlink_ext_ack * extack)7657 static int nf_tables_getgen(struct net *net, struct sock *nlsk,
7658 struct sk_buff *skb, const struct nlmsghdr *nlh,
7659 const struct nlattr * const nla[],
7660 struct netlink_ext_ack *extack)
7661 {
7662 struct sk_buff *skb2;
7663 int err;
7664
7665 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7666 if (skb2 == NULL)
7667 return -ENOMEM;
7668
7669 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7670 nlh->nlmsg_seq);
7671 if (err < 0)
7672 goto err_fill_gen_info;
7673
7674 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7675
7676 err_fill_gen_info:
7677 kfree_skb(skb2);
7678 return err;
7679 }
7680
7681 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
7682 [NFT_MSG_NEWTABLE] = {
7683 .call_batch = nf_tables_newtable,
7684 .attr_count = NFTA_TABLE_MAX,
7685 .policy = nft_table_policy,
7686 },
7687 [NFT_MSG_GETTABLE] = {
7688 .call_rcu = nf_tables_gettable,
7689 .attr_count = NFTA_TABLE_MAX,
7690 .policy = nft_table_policy,
7691 },
7692 [NFT_MSG_DELTABLE] = {
7693 .call_batch = nf_tables_deltable,
7694 .attr_count = NFTA_TABLE_MAX,
7695 .policy = nft_table_policy,
7696 },
7697 [NFT_MSG_NEWCHAIN] = {
7698 .call_batch = nf_tables_newchain,
7699 .attr_count = NFTA_CHAIN_MAX,
7700 .policy = nft_chain_policy,
7701 },
7702 [NFT_MSG_GETCHAIN] = {
7703 .call_rcu = nf_tables_getchain,
7704 .attr_count = NFTA_CHAIN_MAX,
7705 .policy = nft_chain_policy,
7706 },
7707 [NFT_MSG_DELCHAIN] = {
7708 .call_batch = nf_tables_delchain,
7709 .attr_count = NFTA_CHAIN_MAX,
7710 .policy = nft_chain_policy,
7711 },
7712 [NFT_MSG_NEWRULE] = {
7713 .call_batch = nf_tables_newrule,
7714 .attr_count = NFTA_RULE_MAX,
7715 .policy = nft_rule_policy,
7716 },
7717 [NFT_MSG_GETRULE] = {
7718 .call_rcu = nf_tables_getrule,
7719 .attr_count = NFTA_RULE_MAX,
7720 .policy = nft_rule_policy,
7721 },
7722 [NFT_MSG_DELRULE] = {
7723 .call_batch = nf_tables_delrule,
7724 .attr_count = NFTA_RULE_MAX,
7725 .policy = nft_rule_policy,
7726 },
7727 [NFT_MSG_NEWSET] = {
7728 .call_batch = nf_tables_newset,
7729 .attr_count = NFTA_SET_MAX,
7730 .policy = nft_set_policy,
7731 },
7732 [NFT_MSG_GETSET] = {
7733 .call_rcu = nf_tables_getset,
7734 .attr_count = NFTA_SET_MAX,
7735 .policy = nft_set_policy,
7736 },
7737 [NFT_MSG_DELSET] = {
7738 .call_batch = nf_tables_delset,
7739 .attr_count = NFTA_SET_MAX,
7740 .policy = nft_set_policy,
7741 },
7742 [NFT_MSG_NEWSETELEM] = {
7743 .call_batch = nf_tables_newsetelem,
7744 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7745 .policy = nft_set_elem_list_policy,
7746 },
7747 [NFT_MSG_GETSETELEM] = {
7748 .call_rcu = nf_tables_getsetelem,
7749 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7750 .policy = nft_set_elem_list_policy,
7751 },
7752 [NFT_MSG_DELSETELEM] = {
7753 .call_batch = nf_tables_delsetelem,
7754 .attr_count = NFTA_SET_ELEM_LIST_MAX,
7755 .policy = nft_set_elem_list_policy,
7756 },
7757 [NFT_MSG_GETGEN] = {
7758 .call_rcu = nf_tables_getgen,
7759 },
7760 [NFT_MSG_NEWOBJ] = {
7761 .call_batch = nf_tables_newobj,
7762 .attr_count = NFTA_OBJ_MAX,
7763 .policy = nft_obj_policy,
7764 },
7765 [NFT_MSG_GETOBJ] = {
7766 .call_rcu = nf_tables_getobj,
7767 .attr_count = NFTA_OBJ_MAX,
7768 .policy = nft_obj_policy,
7769 },
7770 [NFT_MSG_DELOBJ] = {
7771 .call_batch = nf_tables_delobj,
7772 .attr_count = NFTA_OBJ_MAX,
7773 .policy = nft_obj_policy,
7774 },
7775 [NFT_MSG_GETOBJ_RESET] = {
7776 .call_rcu = nf_tables_getobj,
7777 .attr_count = NFTA_OBJ_MAX,
7778 .policy = nft_obj_policy,
7779 },
7780 [NFT_MSG_NEWFLOWTABLE] = {
7781 .call_batch = nf_tables_newflowtable,
7782 .attr_count = NFTA_FLOWTABLE_MAX,
7783 .policy = nft_flowtable_policy,
7784 },
7785 [NFT_MSG_GETFLOWTABLE] = {
7786 .call_rcu = nf_tables_getflowtable,
7787 .attr_count = NFTA_FLOWTABLE_MAX,
7788 .policy = nft_flowtable_policy,
7789 },
7790 [NFT_MSG_DELFLOWTABLE] = {
7791 .call_batch = nf_tables_delflowtable,
7792 .attr_count = NFTA_FLOWTABLE_MAX,
7793 .policy = nft_flowtable_policy,
7794 },
7795 };
7796
nf_tables_validate(struct net * net)7797 static int nf_tables_validate(struct net *net)
7798 {
7799 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
7800 struct nft_table *table;
7801
7802 switch (nft_net->validate_state) {
7803 case NFT_VALIDATE_SKIP:
7804 break;
7805 case NFT_VALIDATE_NEED:
7806 nft_validate_state_update(net, NFT_VALIDATE_DO);
7807 fallthrough;
7808 case NFT_VALIDATE_DO:
7809 list_for_each_entry(table, &nft_net->tables, list) {
7810 if (nft_table_validate(net, table) < 0)
7811 return -EAGAIN;
7812 }
7813
7814 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
7815 break;
7816 }
7817
7818 return 0;
7819 }
7820
7821 /* a drop policy has to be deferred until all rules have been activated,
7822 * otherwise a large ruleset that contains a drop-policy base chain will
7823 * cause all packets to get dropped until the full transaction has been
7824 * processed.
7825 *
7826 * We defer the drop policy until the transaction has been finalized.
7827 */
nft_chain_commit_drop_policy(struct nft_trans * trans)7828 static void nft_chain_commit_drop_policy(struct nft_trans *trans)
7829 {
7830 struct nft_base_chain *basechain;
7831
7832 if (nft_trans_chain_policy(trans) != NF_DROP)
7833 return;
7834
7835 if (!nft_is_base_chain(trans->ctx.chain))
7836 return;
7837
7838 basechain = nft_base_chain(trans->ctx.chain);
7839 basechain->policy = NF_DROP;
7840 }
7841
nft_chain_commit_update(struct nft_trans * trans)7842 static void nft_chain_commit_update(struct nft_trans *trans)
7843 {
7844 struct nft_base_chain *basechain;
7845
7846 if (nft_trans_chain_name(trans)) {
7847 rhltable_remove(&trans->ctx.table->chains_ht,
7848 &trans->ctx.chain->rhlhead,
7849 nft_chain_ht_params);
7850 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
7851 rhltable_insert_key(&trans->ctx.table->chains_ht,
7852 trans->ctx.chain->name,
7853 &trans->ctx.chain->rhlhead,
7854 nft_chain_ht_params);
7855 }
7856
7857 if (!nft_is_base_chain(trans->ctx.chain))
7858 return;
7859
7860 nft_chain_stats_replace(trans);
7861
7862 basechain = nft_base_chain(trans->ctx.chain);
7863
7864 switch (nft_trans_chain_policy(trans)) {
7865 case NF_DROP:
7866 case NF_ACCEPT:
7867 basechain->policy = nft_trans_chain_policy(trans);
7868 break;
7869 }
7870 }
7871
nft_obj_commit_update(struct nft_trans * trans)7872 static void nft_obj_commit_update(struct nft_trans *trans)
7873 {
7874 struct nft_object *newobj;
7875 struct nft_object *obj;
7876
7877 obj = nft_trans_obj(trans);
7878 newobj = nft_trans_obj_newobj(trans);
7879
7880 if (obj->ops->update)
7881 obj->ops->update(obj, newobj);
7882
7883 nft_obj_destroy(&trans->ctx, newobj);
7884 }
7885
nft_commit_release(struct nft_trans * trans)7886 static void nft_commit_release(struct nft_trans *trans)
7887 {
7888 switch (trans->msg_type) {
7889 case NFT_MSG_DELTABLE:
7890 nf_tables_table_destroy(&trans->ctx);
7891 break;
7892 case NFT_MSG_NEWCHAIN:
7893 free_percpu(nft_trans_chain_stats(trans));
7894 kfree(nft_trans_chain_name(trans));
7895 break;
7896 case NFT_MSG_DELCHAIN:
7897 nf_tables_chain_destroy(&trans->ctx);
7898 break;
7899 case NFT_MSG_DELRULE:
7900 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
7901 break;
7902 case NFT_MSG_DELSET:
7903 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
7904 break;
7905 case NFT_MSG_DELSETELEM:
7906 nf_tables_set_elem_destroy(&trans->ctx,
7907 nft_trans_elem_set(trans),
7908 nft_trans_elem(trans).priv);
7909 break;
7910 case NFT_MSG_DELOBJ:
7911 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
7912 break;
7913 case NFT_MSG_DELFLOWTABLE:
7914 if (nft_trans_flowtable_update(trans))
7915 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
7916 else
7917 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
7918 break;
7919 }
7920
7921 if (trans->put_net)
7922 put_net(trans->ctx.net);
7923
7924 kfree(trans);
7925 }
7926
nf_tables_trans_destroy_work(struct work_struct * w)7927 static void nf_tables_trans_destroy_work(struct work_struct *w)
7928 {
7929 struct nft_trans *trans, *next;
7930 LIST_HEAD(head);
7931
7932 spin_lock(&nf_tables_destroy_list_lock);
7933 list_splice_init(&nf_tables_destroy_list, &head);
7934 spin_unlock(&nf_tables_destroy_list_lock);
7935
7936 if (list_empty(&head))
7937 return;
7938
7939 synchronize_rcu();
7940
7941 list_for_each_entry_safe(trans, next, &head, list) {
7942 nft_trans_list_del(trans);
7943 nft_commit_release(trans);
7944 }
7945 }
7946
nf_tables_trans_destroy_flush_work(void)7947 void nf_tables_trans_destroy_flush_work(void)
7948 {
7949 flush_work(&trans_destroy_work);
7950 }
7951 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
7952
nf_tables_commit_chain_prepare(struct net * net,struct nft_chain * chain)7953 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
7954 {
7955 struct nft_rule *rule;
7956 unsigned int alloc = 0;
7957 int i;
7958
7959 /* already handled or inactive chain? */
7960 if (chain->rules_next || !nft_is_active_next(net, chain))
7961 return 0;
7962
7963 rule = list_entry(&chain->rules, struct nft_rule, list);
7964 i = 0;
7965
7966 list_for_each_entry_continue(rule, &chain->rules, list) {
7967 if (nft_is_active_next(net, rule))
7968 alloc++;
7969 }
7970
7971 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
7972 if (!chain->rules_next)
7973 return -ENOMEM;
7974
7975 list_for_each_entry_continue(rule, &chain->rules, list) {
7976 if (nft_is_active_next(net, rule))
7977 chain->rules_next[i++] = rule;
7978 }
7979
7980 chain->rules_next[i] = NULL;
7981 return 0;
7982 }
7983
nf_tables_commit_chain_prepare_cancel(struct net * net)7984 static void nf_tables_commit_chain_prepare_cancel(struct net *net)
7985 {
7986 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
7987 struct nft_trans *trans, *next;
7988
7989 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
7990 struct nft_chain *chain = trans->ctx.chain;
7991
7992 if (trans->msg_type == NFT_MSG_NEWRULE ||
7993 trans->msg_type == NFT_MSG_DELRULE) {
7994 kvfree(chain->rules_next);
7995 chain->rules_next = NULL;
7996 }
7997 }
7998 }
7999
__nf_tables_commit_chain_free_rules_old(struct rcu_head * h)8000 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
8001 {
8002 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
8003
8004 kvfree(o->start);
8005 }
8006
nf_tables_commit_chain_free_rules_old(struct nft_rule ** rules)8007 static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
8008 {
8009 struct nft_rule **r = rules;
8010 struct nft_rules_old *old;
8011
8012 while (*r)
8013 r++;
8014
8015 r++; /* rcu_head is after end marker */
8016 old = (void *) r;
8017 old->start = rules;
8018
8019 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
8020 }
8021
nf_tables_commit_chain(struct net * net,struct nft_chain * chain)8022 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
8023 {
8024 struct nft_rule **g0, **g1;
8025 bool next_genbit;
8026
8027 next_genbit = nft_gencursor_next(net);
8028
8029 g0 = rcu_dereference_protected(chain->rules_gen_0,
8030 lockdep_commit_lock_is_held(net));
8031 g1 = rcu_dereference_protected(chain->rules_gen_1,
8032 lockdep_commit_lock_is_held(net));
8033
8034 /* No changes to this chain? */
8035 if (chain->rules_next == NULL) {
8036 /* chain had no change in last or next generation */
8037 if (g0 == g1)
8038 return;
8039 /*
8040 * chain had no change in this generation; make sure next
8041 * one uses same rules as current generation.
8042 */
8043 if (next_genbit) {
8044 rcu_assign_pointer(chain->rules_gen_1, g0);
8045 nf_tables_commit_chain_free_rules_old(g1);
8046 } else {
8047 rcu_assign_pointer(chain->rules_gen_0, g1);
8048 nf_tables_commit_chain_free_rules_old(g0);
8049 }
8050
8051 return;
8052 }
8053
8054 if (next_genbit)
8055 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
8056 else
8057 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
8058
8059 chain->rules_next = NULL;
8060
8061 if (g0 == g1)
8062 return;
8063
8064 if (next_genbit)
8065 nf_tables_commit_chain_free_rules_old(g1);
8066 else
8067 nf_tables_commit_chain_free_rules_old(g0);
8068 }
8069
nft_obj_del(struct nft_object * obj)8070 static void nft_obj_del(struct nft_object *obj)
8071 {
8072 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
8073 list_del_rcu(&obj->list);
8074 }
8075
nft_chain_del(struct nft_chain * chain)8076 void nft_chain_del(struct nft_chain *chain)
8077 {
8078 struct nft_table *table = chain->table;
8079
8080 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
8081 nft_chain_ht_params));
8082 list_del_rcu(&chain->list);
8083 }
8084
nft_trans_gc_setelem_remove(struct nft_ctx * ctx,struct nft_trans_gc * trans)8085 static void nft_trans_gc_setelem_remove(struct nft_ctx *ctx,
8086 struct nft_trans_gc *trans)
8087 {
8088 void **priv = trans->priv;
8089 unsigned int i;
8090
8091 for (i = 0; i < trans->count; i++) {
8092 struct nft_set_elem elem = {
8093 .priv = priv[i],
8094 };
8095
8096 nft_setelem_data_deactivate(ctx->net, trans->set, &elem);
8097 trans->set->ops->remove(trans->net, trans->set, &elem);
8098 }
8099 }
8100
nft_trans_gc_destroy(struct nft_trans_gc * trans)8101 void nft_trans_gc_destroy(struct nft_trans_gc *trans)
8102 {
8103 nft_set_put(trans->set);
8104 put_net(trans->net);
8105 kfree(trans);
8106 }
8107
nft_trans_gc_trans_free(struct rcu_head * rcu)8108 static void nft_trans_gc_trans_free(struct rcu_head *rcu)
8109 {
8110 struct nft_set_elem elem = {};
8111 struct nft_trans_gc *trans;
8112 struct nft_ctx ctx = {};
8113 unsigned int i;
8114
8115 trans = container_of(rcu, struct nft_trans_gc, rcu);
8116 ctx.net = read_pnet(&trans->set->net);
8117
8118 for (i = 0; i < trans->count; i++) {
8119 elem.priv = trans->priv[i];
8120 atomic_dec(&trans->set->nelems);
8121
8122 nf_tables_set_elem_destroy(&ctx, trans->set, elem.priv);
8123 }
8124
8125 nft_trans_gc_destroy(trans);
8126 }
8127
nft_trans_gc_work_done(struct nft_trans_gc * trans)8128 static bool nft_trans_gc_work_done(struct nft_trans_gc *trans)
8129 {
8130 struct nftables_pernet *nft_net;
8131 struct nft_ctx ctx = {};
8132
8133 nft_net = net_generic(trans->net, nf_tables_net_id);
8134
8135 mutex_lock(&nft_net->commit_mutex);
8136
8137 /* Check for race with transaction, otherwise this batch refers to
8138 * stale objects that might not be there anymore. Skip transaction if
8139 * set has been destroyed from control plane transaction in case gc
8140 * worker loses race.
8141 */
8142 if (READ_ONCE(nft_net->gc_seq) != trans->seq || trans->set->dead) {
8143 mutex_unlock(&nft_net->commit_mutex);
8144 return false;
8145 }
8146
8147 ctx.net = trans->net;
8148 ctx.table = trans->set->table;
8149
8150 nft_trans_gc_setelem_remove(&ctx, trans);
8151 mutex_unlock(&nft_net->commit_mutex);
8152
8153 return true;
8154 }
8155
nft_trans_gc_work(struct work_struct * work)8156 static void nft_trans_gc_work(struct work_struct *work)
8157 {
8158 struct nft_trans_gc *trans, *next;
8159 LIST_HEAD(trans_gc_list);
8160
8161 spin_lock(&nf_tables_gc_list_lock);
8162 list_splice_init(&nf_tables_gc_list, &trans_gc_list);
8163 spin_unlock(&nf_tables_gc_list_lock);
8164
8165 list_for_each_entry_safe(trans, next, &trans_gc_list, list) {
8166 list_del(&trans->list);
8167 if (!nft_trans_gc_work_done(trans)) {
8168 nft_trans_gc_destroy(trans);
8169 continue;
8170 }
8171 call_rcu(&trans->rcu, nft_trans_gc_trans_free);
8172 }
8173 }
8174
nft_trans_gc_alloc(struct nft_set * set,unsigned int gc_seq,gfp_t gfp)8175 struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,
8176 unsigned int gc_seq, gfp_t gfp)
8177 {
8178 struct net *net = read_pnet(&set->net);
8179 struct nft_trans_gc *trans;
8180
8181 trans = kzalloc(sizeof(*trans), gfp);
8182 if (!trans)
8183 return NULL;
8184
8185 trans->net = maybe_get_net(net);
8186 if (!trans->net) {
8187 kfree(trans);
8188 return NULL;
8189 }
8190
8191 refcount_inc(&set->refs);
8192 trans->set = set;
8193 trans->seq = gc_seq;
8194
8195 return trans;
8196 }
8197
nft_trans_gc_elem_add(struct nft_trans_gc * trans,void * priv)8198 void nft_trans_gc_elem_add(struct nft_trans_gc *trans, void *priv)
8199 {
8200 trans->priv[trans->count++] = priv;
8201 }
8202
nft_trans_gc_queue_work(struct nft_trans_gc * trans)8203 static void nft_trans_gc_queue_work(struct nft_trans_gc *trans)
8204 {
8205 spin_lock(&nf_tables_gc_list_lock);
8206 list_add_tail(&trans->list, &nf_tables_gc_list);
8207 spin_unlock(&nf_tables_gc_list_lock);
8208
8209 schedule_work(&trans_gc_work);
8210 }
8211
nft_trans_gc_space(struct nft_trans_gc * trans)8212 static int nft_trans_gc_space(struct nft_trans_gc *trans)
8213 {
8214 return NFT_TRANS_GC_BATCHCOUNT - trans->count;
8215 }
8216
nft_trans_gc_queue_async(struct nft_trans_gc * gc,unsigned int gc_seq,gfp_t gfp)8217 struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc,
8218 unsigned int gc_seq, gfp_t gfp)
8219 {
8220 struct nft_set *set;
8221
8222 if (nft_trans_gc_space(gc))
8223 return gc;
8224
8225 set = gc->set;
8226 nft_trans_gc_queue_work(gc);
8227
8228 return nft_trans_gc_alloc(set, gc_seq, gfp);
8229 }
8230
nft_trans_gc_queue_async_done(struct nft_trans_gc * trans)8231 void nft_trans_gc_queue_async_done(struct nft_trans_gc *trans)
8232 {
8233 if (trans->count == 0) {
8234 nft_trans_gc_destroy(trans);
8235 return;
8236 }
8237
8238 nft_trans_gc_queue_work(trans);
8239 }
8240
nft_trans_gc_queue_sync(struct nft_trans_gc * gc,gfp_t gfp)8241 struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp)
8242 {
8243 struct nft_set *set;
8244
8245 if (WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc->net)))
8246 return NULL;
8247
8248 if (nft_trans_gc_space(gc))
8249 return gc;
8250
8251 set = gc->set;
8252 call_rcu(&gc->rcu, nft_trans_gc_trans_free);
8253
8254 return nft_trans_gc_alloc(set, 0, gfp);
8255 }
8256
nft_trans_gc_queue_sync_done(struct nft_trans_gc * trans)8257 void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans)
8258 {
8259 WARN_ON_ONCE(!lockdep_commit_lock_is_held(trans->net));
8260
8261 if (trans->count == 0) {
8262 nft_trans_gc_destroy(trans);
8263 return;
8264 }
8265
8266 call_rcu(&trans->rcu, nft_trans_gc_trans_free);
8267 }
8268
nf_tables_module_autoload_cleanup(struct net * net)8269 static void nf_tables_module_autoload_cleanup(struct net *net)
8270 {
8271 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8272 struct nft_module_request *req, *next;
8273
8274 WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
8275 list_for_each_entry_safe(req, next, &nft_net->module_list, list) {
8276 WARN_ON_ONCE(!req->done);
8277 list_del(&req->list);
8278 kfree(req);
8279 }
8280 }
8281
nf_tables_commit_release(struct net * net)8282 static void nf_tables_commit_release(struct net *net)
8283 {
8284 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8285 struct nft_trans *trans;
8286
8287 /* all side effects have to be made visible.
8288 * For example, if a chain named 'foo' has been deleted, a
8289 * new transaction must not find it anymore.
8290 *
8291 * Memory reclaim happens asynchronously from work queue
8292 * to prevent expensive synchronize_rcu() in commit phase.
8293 */
8294 if (list_empty(&nft_net->commit_list)) {
8295 nf_tables_module_autoload_cleanup(net);
8296 mutex_unlock(&nft_net->commit_mutex);
8297 return;
8298 }
8299
8300 trans = list_last_entry(&nft_net->commit_list,
8301 struct nft_trans, list);
8302 get_net(trans->ctx.net);
8303 WARN_ON_ONCE(trans->put_net);
8304
8305 trans->put_net = true;
8306 spin_lock(&nf_tables_destroy_list_lock);
8307 list_splice_tail_init(&nft_net->commit_list, &nf_tables_destroy_list);
8308 spin_unlock(&nf_tables_destroy_list_lock);
8309
8310 nf_tables_module_autoload_cleanup(net);
8311 schedule_work(&trans_destroy_work);
8312
8313 mutex_unlock(&nft_net->commit_mutex);
8314 }
8315
nft_commit_notify(struct net * net,u32 portid)8316 static void nft_commit_notify(struct net *net, u32 portid)
8317 {
8318 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8319 struct sk_buff *batch_skb = NULL, *nskb, *skb;
8320 unsigned char *data;
8321 int len;
8322
8323 list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) {
8324 if (!batch_skb) {
8325 new_batch:
8326 batch_skb = skb;
8327 len = NLMSG_GOODSIZE - skb->len;
8328 list_del(&skb->list);
8329 continue;
8330 }
8331 len -= skb->len;
8332 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) {
8333 data = skb_put(batch_skb, skb->len);
8334 memcpy(data, skb->data, skb->len);
8335 list_del(&skb->list);
8336 kfree_skb(skb);
8337 continue;
8338 }
8339 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
8340 NFT_CB(batch_skb).report, GFP_KERNEL);
8341 goto new_batch;
8342 }
8343
8344 if (batch_skb) {
8345 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
8346 NFT_CB(batch_skb).report, GFP_KERNEL);
8347 }
8348
8349 WARN_ON_ONCE(!list_empty(&nft_net->notify_list));
8350 }
8351
nf_tables_commit_audit_alloc(struct list_head * adl,struct nft_table * table)8352 static int nf_tables_commit_audit_alloc(struct list_head *adl,
8353 struct nft_table *table)
8354 {
8355 struct nft_audit_data *adp;
8356
8357 list_for_each_entry(adp, adl, list) {
8358 if (adp->table == table)
8359 return 0;
8360 }
8361 adp = kzalloc(sizeof(*adp), GFP_KERNEL);
8362 if (!adp)
8363 return -ENOMEM;
8364 adp->table = table;
8365 list_add(&adp->list, adl);
8366 return 0;
8367 }
8368
nf_tables_commit_audit_free(struct list_head * adl)8369 static void nf_tables_commit_audit_free(struct list_head *adl)
8370 {
8371 struct nft_audit_data *adp, *adn;
8372
8373 list_for_each_entry_safe(adp, adn, adl, list) {
8374 list_del(&adp->list);
8375 kfree(adp);
8376 }
8377 }
8378
nf_tables_commit_audit_collect(struct list_head * adl,struct nft_table * table,u32 op)8379 static void nf_tables_commit_audit_collect(struct list_head *adl,
8380 struct nft_table *table, u32 op)
8381 {
8382 struct nft_audit_data *adp;
8383
8384 list_for_each_entry(adp, adl, list) {
8385 if (adp->table == table)
8386 goto found;
8387 }
8388 WARN_ONCE(1, "table=%s not expected in commit list", table->name);
8389 return;
8390 found:
8391 adp->entries++;
8392 if (!adp->op || adp->op > op)
8393 adp->op = op;
8394 }
8395
8396 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22)
8397
nf_tables_commit_audit_log(struct list_head * adl,u32 generation)8398 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation)
8399 {
8400 struct nft_audit_data *adp, *adn;
8401 char aubuf[AUNFTABLENAMELEN];
8402
8403 list_for_each_entry_safe(adp, adn, adl, list) {
8404 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name,
8405 generation);
8406 audit_log_nfcfg(aubuf, adp->table->family, adp->entries,
8407 nft2audit_op[adp->op], GFP_KERNEL);
8408 list_del(&adp->list);
8409 kfree(adp);
8410 }
8411 }
8412
nft_set_commit_update(struct list_head * set_update_list)8413 static void nft_set_commit_update(struct list_head *set_update_list)
8414 {
8415 struct nft_set *set, *next;
8416
8417 list_for_each_entry_safe(set, next, set_update_list, pending_update) {
8418 list_del_init(&set->pending_update);
8419
8420 if (!set->ops->commit || set->dead)
8421 continue;
8422
8423 set->ops->commit(set);
8424 }
8425 }
8426
nft_gc_seq_begin(struct nftables_pernet * nft_net)8427 static unsigned int nft_gc_seq_begin(struct nftables_pernet *nft_net)
8428 {
8429 unsigned int gc_seq;
8430
8431 /* Bump gc counter, it becomes odd, this is the busy mark. */
8432 gc_seq = READ_ONCE(nft_net->gc_seq);
8433 WRITE_ONCE(nft_net->gc_seq, ++gc_seq);
8434
8435 return gc_seq;
8436 }
8437
nft_gc_seq_end(struct nftables_pernet * nft_net,unsigned int gc_seq)8438 static void nft_gc_seq_end(struct nftables_pernet *nft_net, unsigned int gc_seq)
8439 {
8440 WRITE_ONCE(nft_net->gc_seq, ++gc_seq);
8441 }
8442
nf_tables_commit(struct net * net,struct sk_buff * skb)8443 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
8444 {
8445 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8446 struct nft_trans *trans, *next;
8447 LIST_HEAD(set_update_list);
8448 struct nft_trans_elem *te;
8449 struct nft_chain *chain;
8450 struct nft_table *table;
8451 unsigned int gc_seq;
8452 LIST_HEAD(adl);
8453 int err;
8454
8455 if (list_empty(&nft_net->commit_list)) {
8456 mutex_unlock(&nft_net->commit_mutex);
8457 return 0;
8458 }
8459
8460 list_for_each_entry(trans, &nft_net->binding_list, binding_list) {
8461 switch (trans->msg_type) {
8462 case NFT_MSG_NEWSET:
8463 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
8464 !nft_trans_set_bound(trans)) {
8465 pr_warn_once("nftables ruleset with unbound set\n");
8466 return -EINVAL;
8467 }
8468 break;
8469 case NFT_MSG_NEWCHAIN:
8470 if (!nft_trans_chain_update(trans) &&
8471 nft_chain_binding(nft_trans_chain(trans)) &&
8472 !nft_trans_chain_bound(trans)) {
8473 pr_warn_once("nftables ruleset with unbound chain\n");
8474 return -EINVAL;
8475 }
8476 break;
8477 }
8478 }
8479
8480 /* 0. Validate ruleset, otherwise roll back for error reporting. */
8481 if (nf_tables_validate(net) < 0)
8482 return -EAGAIN;
8483
8484 err = nft_flow_rule_offload_commit(net);
8485 if (err < 0)
8486 return err;
8487
8488 /* 1. Allocate space for next generation rules_gen_X[] */
8489 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
8490 int ret;
8491
8492 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table);
8493 if (ret) {
8494 nf_tables_commit_chain_prepare_cancel(net);
8495 nf_tables_commit_audit_free(&adl);
8496 return ret;
8497 }
8498 if (trans->msg_type == NFT_MSG_NEWRULE ||
8499 trans->msg_type == NFT_MSG_DELRULE) {
8500 chain = trans->ctx.chain;
8501
8502 ret = nf_tables_commit_chain_prepare(net, chain);
8503 if (ret < 0) {
8504 nf_tables_commit_chain_prepare_cancel(net);
8505 nf_tables_commit_audit_free(&adl);
8506 return ret;
8507 }
8508 }
8509 }
8510
8511 /* step 2. Make rules_gen_X visible to packet path */
8512 list_for_each_entry(table, &nft_net->tables, list) {
8513 list_for_each_entry(chain, &table->chains, list)
8514 nf_tables_commit_chain(net, chain);
8515 }
8516
8517 /*
8518 * Bump generation counter, invalidate any dump in progress.
8519 * Cannot fail after this point.
8520 */
8521 while (++nft_net->base_seq == 0)
8522 ;
8523
8524 gc_seq = nft_gc_seq_begin(nft_net);
8525
8526 /* step 3. Start new generation, rules_gen_X now in use. */
8527 net->nft.gencursor = nft_gencursor_next(net);
8528
8529 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
8530 nf_tables_commit_audit_collect(&adl, trans->ctx.table,
8531 trans->msg_type);
8532 switch (trans->msg_type) {
8533 case NFT_MSG_NEWTABLE:
8534 if (nft_trans_table_update(trans)) {
8535 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {
8536 nft_trans_destroy(trans);
8537 break;
8538 }
8539 if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT)
8540 nf_tables_table_disable(net, trans->ctx.table);
8541
8542 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;
8543 } else {
8544 nft_clear(net, trans->ctx.table);
8545 }
8546 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
8547 nft_trans_destroy(trans);
8548 break;
8549 case NFT_MSG_DELTABLE:
8550 list_del_rcu(&trans->ctx.table->list);
8551 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
8552 break;
8553 case NFT_MSG_NEWCHAIN:
8554 if (nft_trans_chain_update(trans)) {
8555 nft_chain_commit_update(trans);
8556 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
8557 /* trans destroyed after rcu grace period */
8558 } else {
8559 nft_chain_commit_drop_policy(trans);
8560 nft_clear(net, trans->ctx.chain);
8561 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
8562 nft_trans_destroy(trans);
8563 }
8564 break;
8565 case NFT_MSG_DELCHAIN:
8566 nft_chain_del(trans->ctx.chain);
8567 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
8568 nf_tables_unregister_hook(trans->ctx.net,
8569 trans->ctx.table,
8570 trans->ctx.chain);
8571 break;
8572 case NFT_MSG_NEWRULE:
8573 nft_clear(trans->ctx.net, nft_trans_rule(trans));
8574 nf_tables_rule_notify(&trans->ctx,
8575 nft_trans_rule(trans),
8576 NFT_MSG_NEWRULE);
8577 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
8578 nft_flow_rule_destroy(nft_trans_flow_rule(trans));
8579
8580 nft_trans_destroy(trans);
8581 break;
8582 case NFT_MSG_DELRULE:
8583 list_del_rcu(&nft_trans_rule(trans)->list);
8584 nf_tables_rule_notify(&trans->ctx,
8585 nft_trans_rule(trans),
8586 NFT_MSG_DELRULE);
8587 nft_rule_expr_deactivate(&trans->ctx,
8588 nft_trans_rule(trans),
8589 NFT_TRANS_COMMIT);
8590
8591 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
8592 nft_flow_rule_destroy(nft_trans_flow_rule(trans));
8593 break;
8594 case NFT_MSG_NEWSET:
8595 nft_clear(net, nft_trans_set(trans));
8596 /* This avoids hitting -EBUSY when deleting the table
8597 * from the transaction.
8598 */
8599 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
8600 !list_empty(&nft_trans_set(trans)->bindings))
8601 nft_use_dec(&trans->ctx.table->use);
8602
8603 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
8604 NFT_MSG_NEWSET, GFP_KERNEL);
8605 nft_trans_destroy(trans);
8606 break;
8607 case NFT_MSG_DELSET:
8608 nft_trans_set(trans)->dead = 1;
8609 list_del_rcu(&nft_trans_set(trans)->list);
8610 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
8611 NFT_MSG_DELSET, GFP_KERNEL);
8612 break;
8613 case NFT_MSG_NEWSETELEM:
8614 te = (struct nft_trans_elem *)trans->data;
8615
8616 te->set->ops->activate(net, te->set, &te->elem);
8617 nf_tables_setelem_notify(&trans->ctx, te->set,
8618 &te->elem,
8619 NFT_MSG_NEWSETELEM, 0);
8620 if (te->set->ops->commit &&
8621 list_empty(&te->set->pending_update)) {
8622 list_add_tail(&te->set->pending_update,
8623 &set_update_list);
8624 }
8625 nft_trans_destroy(trans);
8626 break;
8627 case NFT_MSG_DELSETELEM:
8628 te = (struct nft_trans_elem *)trans->data;
8629
8630 nf_tables_setelem_notify(&trans->ctx, te->set,
8631 &te->elem,
8632 NFT_MSG_DELSETELEM, 0);
8633 te->set->ops->remove(net, te->set, &te->elem);
8634 atomic_dec(&te->set->nelems);
8635 te->set->ndeact--;
8636 if (te->set->ops->commit &&
8637 list_empty(&te->set->pending_update)) {
8638 list_add_tail(&te->set->pending_update,
8639 &set_update_list);
8640 }
8641 break;
8642 case NFT_MSG_NEWOBJ:
8643 if (nft_trans_obj_update(trans)) {
8644 nft_obj_commit_update(trans);
8645 nf_tables_obj_notify(&trans->ctx,
8646 nft_trans_obj(trans),
8647 NFT_MSG_NEWOBJ);
8648 } else {
8649 nft_clear(net, nft_trans_obj(trans));
8650 nf_tables_obj_notify(&trans->ctx,
8651 nft_trans_obj(trans),
8652 NFT_MSG_NEWOBJ);
8653 nft_trans_destroy(trans);
8654 }
8655 break;
8656 case NFT_MSG_DELOBJ:
8657 nft_obj_del(nft_trans_obj(trans));
8658 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
8659 NFT_MSG_DELOBJ);
8660 break;
8661 case NFT_MSG_NEWFLOWTABLE:
8662 if (nft_trans_flowtable_update(trans)) {
8663 nft_trans_flowtable(trans)->data.flags =
8664 nft_trans_flowtable_flags(trans);
8665 nf_tables_flowtable_notify(&trans->ctx,
8666 nft_trans_flowtable(trans),
8667 &nft_trans_flowtable_hooks(trans),
8668 NFT_MSG_NEWFLOWTABLE);
8669 list_splice(&nft_trans_flowtable_hooks(trans),
8670 &nft_trans_flowtable(trans)->hook_list);
8671 } else {
8672 nft_clear(net, nft_trans_flowtable(trans));
8673 nf_tables_flowtable_notify(&trans->ctx,
8674 nft_trans_flowtable(trans),
8675 &nft_trans_flowtable(trans)->hook_list,
8676 NFT_MSG_NEWFLOWTABLE);
8677 }
8678 nft_trans_destroy(trans);
8679 break;
8680 case NFT_MSG_DELFLOWTABLE:
8681 if (nft_trans_flowtable_update(trans)) {
8682 nf_tables_flowtable_notify(&trans->ctx,
8683 nft_trans_flowtable(trans),
8684 &nft_trans_flowtable_hooks(trans),
8685 NFT_MSG_DELFLOWTABLE);
8686 nft_unregister_flowtable_net_hooks(net,
8687 &nft_trans_flowtable_hooks(trans));
8688 } else {
8689 list_del_rcu(&nft_trans_flowtable(trans)->list);
8690 nf_tables_flowtable_notify(&trans->ctx,
8691 nft_trans_flowtable(trans),
8692 &nft_trans_flowtable(trans)->hook_list,
8693 NFT_MSG_DELFLOWTABLE);
8694 nft_unregister_flowtable_net_hooks(net,
8695 &nft_trans_flowtable(trans)->hook_list);
8696 }
8697 break;
8698 }
8699 }
8700
8701 nft_set_commit_update(&set_update_list);
8702
8703 nft_commit_notify(net, NETLINK_CB(skb).portid);
8704 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
8705 nf_tables_commit_audit_log(&adl, nft_net->base_seq);
8706
8707 nft_gc_seq_end(nft_net, gc_seq);
8708 nf_tables_commit_release(net);
8709
8710 return 0;
8711 }
8712
nf_tables_module_autoload(struct net * net)8713 static void nf_tables_module_autoload(struct net *net)
8714 {
8715 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8716 struct nft_module_request *req, *next;
8717 LIST_HEAD(module_list);
8718
8719 list_splice_init(&nft_net->module_list, &module_list);
8720 mutex_unlock(&nft_net->commit_mutex);
8721 list_for_each_entry_safe(req, next, &module_list, list) {
8722 request_module("%s", req->module);
8723 req->done = true;
8724 }
8725 mutex_lock(&nft_net->commit_mutex);
8726 list_splice(&module_list, &nft_net->module_list);
8727 }
8728
nf_tables_abort_release(struct nft_trans * trans)8729 static void nf_tables_abort_release(struct nft_trans *trans)
8730 {
8731 switch (trans->msg_type) {
8732 case NFT_MSG_NEWTABLE:
8733 nf_tables_table_destroy(&trans->ctx);
8734 break;
8735 case NFT_MSG_NEWCHAIN:
8736 nf_tables_chain_destroy(&trans->ctx);
8737 break;
8738 case NFT_MSG_NEWRULE:
8739 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
8740 break;
8741 case NFT_MSG_NEWSET:
8742 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
8743 break;
8744 case NFT_MSG_NEWSETELEM:
8745 nft_set_elem_destroy(nft_trans_elem_set(trans),
8746 nft_trans_elem(trans).priv, true);
8747 break;
8748 case NFT_MSG_NEWOBJ:
8749 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
8750 break;
8751 case NFT_MSG_NEWFLOWTABLE:
8752 if (nft_trans_flowtable_update(trans))
8753 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
8754 else
8755 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
8756 break;
8757 }
8758 kfree(trans);
8759 }
8760
nft_set_abort_update(struct list_head * set_update_list)8761 static void nft_set_abort_update(struct list_head *set_update_list)
8762 {
8763 struct nft_set *set, *next;
8764
8765 list_for_each_entry_safe(set, next, set_update_list, pending_update) {
8766 list_del_init(&set->pending_update);
8767
8768 if (!set->ops->abort)
8769 continue;
8770
8771 set->ops->abort(set);
8772 }
8773 }
8774
__nf_tables_abort(struct net * net,enum nfnl_abort_action action)8775 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
8776 {
8777 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8778 struct nft_trans *trans, *next;
8779 LIST_HEAD(set_update_list);
8780 struct nft_trans_elem *te;
8781
8782 if (action == NFNL_ABORT_VALIDATE &&
8783 nf_tables_validate(net) < 0)
8784 return -EAGAIN;
8785
8786 list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list,
8787 list) {
8788 switch (trans->msg_type) {
8789 case NFT_MSG_NEWTABLE:
8790 if (nft_trans_table_update(trans)) {
8791 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {
8792 nft_trans_destroy(trans);
8793 break;
8794 }
8795 if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) {
8796 nf_tables_table_disable(net, trans->ctx.table);
8797 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
8798 } else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) {
8799 trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT;
8800 }
8801 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;
8802 nft_trans_destroy(trans);
8803 } else {
8804 list_del_rcu(&trans->ctx.table->list);
8805 }
8806 break;
8807 case NFT_MSG_DELTABLE:
8808 nft_clear(trans->ctx.net, trans->ctx.table);
8809 nft_trans_destroy(trans);
8810 break;
8811 case NFT_MSG_NEWCHAIN:
8812 if (nft_trans_chain_update(trans)) {
8813 free_percpu(nft_trans_chain_stats(trans));
8814 kfree(nft_trans_chain_name(trans));
8815 nft_trans_destroy(trans);
8816 } else {
8817 if (nft_trans_chain_bound(trans)) {
8818 nft_trans_destroy(trans);
8819 break;
8820 }
8821 nft_use_dec_restore(&trans->ctx.table->use);
8822 nft_chain_del(trans->ctx.chain);
8823 nf_tables_unregister_hook(trans->ctx.net,
8824 trans->ctx.table,
8825 trans->ctx.chain);
8826 }
8827 break;
8828 case NFT_MSG_DELCHAIN:
8829 nft_use_inc_restore(&trans->ctx.table->use);
8830 nft_clear(trans->ctx.net, trans->ctx.chain);
8831 nft_trans_destroy(trans);
8832 break;
8833 case NFT_MSG_NEWRULE:
8834 if (nft_trans_rule_bound(trans)) {
8835 nft_trans_destroy(trans);
8836 break;
8837 }
8838 nft_use_dec_restore(&trans->ctx.chain->use);
8839 list_del_rcu(&nft_trans_rule(trans)->list);
8840 nft_rule_expr_deactivate(&trans->ctx,
8841 nft_trans_rule(trans),
8842 NFT_TRANS_ABORT);
8843 break;
8844 case NFT_MSG_DELRULE:
8845 nft_use_inc_restore(&trans->ctx.chain->use);
8846 nft_clear(trans->ctx.net, nft_trans_rule(trans));
8847 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
8848 nft_trans_destroy(trans);
8849 break;
8850 case NFT_MSG_NEWSET:
8851 nft_use_dec_restore(&trans->ctx.table->use);
8852 if (nft_trans_set_bound(trans)) {
8853 nft_trans_destroy(trans);
8854 break;
8855 }
8856 nft_trans_set(trans)->dead = 1;
8857 list_del_rcu(&nft_trans_set(trans)->list);
8858 break;
8859 case NFT_MSG_DELSET:
8860 nft_use_inc_restore(&trans->ctx.table->use);
8861 nft_clear(trans->ctx.net, nft_trans_set(trans));
8862 if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
8863 nft_map_activate(&trans->ctx, nft_trans_set(trans));
8864
8865 nft_trans_destroy(trans);
8866 break;
8867 case NFT_MSG_NEWSETELEM:
8868 if (nft_trans_elem_set_bound(trans)) {
8869 nft_trans_destroy(trans);
8870 break;
8871 }
8872 te = (struct nft_trans_elem *)trans->data;
8873 te->set->ops->remove(net, te->set, &te->elem);
8874 atomic_dec(&te->set->nelems);
8875
8876 if (te->set->ops->abort &&
8877 list_empty(&te->set->pending_update)) {
8878 list_add_tail(&te->set->pending_update,
8879 &set_update_list);
8880 }
8881 break;
8882 case NFT_MSG_DELSETELEM:
8883 te = (struct nft_trans_elem *)trans->data;
8884
8885 nft_setelem_data_activate(net, te->set, &te->elem);
8886 te->set->ops->activate(net, te->set, &te->elem);
8887 te->set->ndeact--;
8888
8889 if (te->set->ops->abort &&
8890 list_empty(&te->set->pending_update)) {
8891 list_add_tail(&te->set->pending_update,
8892 &set_update_list);
8893 }
8894 nft_trans_destroy(trans);
8895 break;
8896 case NFT_MSG_NEWOBJ:
8897 if (nft_trans_obj_update(trans)) {
8898 nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans));
8899 nft_trans_destroy(trans);
8900 } else {
8901 nft_use_dec_restore(&trans->ctx.table->use);
8902 nft_obj_del(nft_trans_obj(trans));
8903 }
8904 break;
8905 case NFT_MSG_DELOBJ:
8906 nft_use_inc_restore(&trans->ctx.table->use);
8907 nft_clear(trans->ctx.net, nft_trans_obj(trans));
8908 nft_trans_destroy(trans);
8909 break;
8910 case NFT_MSG_NEWFLOWTABLE:
8911 if (nft_trans_flowtable_update(trans)) {
8912 nft_unregister_flowtable_net_hooks(net,
8913 &nft_trans_flowtable_hooks(trans));
8914 } else {
8915 nft_use_dec_restore(&trans->ctx.table->use);
8916 list_del_rcu(&nft_trans_flowtable(trans)->list);
8917 nft_unregister_flowtable_net_hooks(net,
8918 &nft_trans_flowtable(trans)->hook_list);
8919 }
8920 break;
8921 case NFT_MSG_DELFLOWTABLE:
8922 if (nft_trans_flowtable_update(trans)) {
8923 list_splice(&nft_trans_flowtable_hooks(trans),
8924 &nft_trans_flowtable(trans)->hook_list);
8925 } else {
8926 nft_use_inc_restore(&trans->ctx.table->use);
8927 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
8928 }
8929 nft_trans_destroy(trans);
8930 break;
8931 }
8932 }
8933
8934 nft_set_abort_update(&set_update_list);
8935
8936 synchronize_rcu();
8937
8938 list_for_each_entry_safe_reverse(trans, next,
8939 &nft_net->commit_list, list) {
8940 nft_trans_list_del(trans);
8941 nf_tables_abort_release(trans);
8942 }
8943
8944 if (action == NFNL_ABORT_AUTOLOAD)
8945 nf_tables_module_autoload(net);
8946 else
8947 nf_tables_module_autoload_cleanup(net);
8948
8949 return 0;
8950 }
8951
nf_tables_abort(struct net * net,struct sk_buff * skb,enum nfnl_abort_action action)8952 static int nf_tables_abort(struct net *net, struct sk_buff *skb,
8953 enum nfnl_abort_action action)
8954 {
8955 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8956 unsigned int gc_seq;
8957 int ret;
8958
8959 gc_seq = nft_gc_seq_begin(nft_net);
8960 ret = __nf_tables_abort(net, action);
8961 nft_gc_seq_end(nft_net, gc_seq);
8962
8963 mutex_unlock(&nft_net->commit_mutex);
8964
8965 return ret;
8966 }
8967
nf_tables_valid_genid(struct net * net,u32 genid)8968 static bool nf_tables_valid_genid(struct net *net, u32 genid)
8969 {
8970 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
8971 bool genid_ok;
8972
8973 mutex_lock(&nft_net->commit_mutex);
8974
8975 genid_ok = genid == 0 || nft_net->base_seq == genid;
8976 if (!genid_ok)
8977 mutex_unlock(&nft_net->commit_mutex);
8978
8979 /* else, commit mutex has to be released by commit or abort function */
8980 return genid_ok;
8981 }
8982
8983 static const struct nfnetlink_subsystem nf_tables_subsys = {
8984 .name = "nf_tables",
8985 .subsys_id = NFNL_SUBSYS_NFTABLES,
8986 .cb_count = NFT_MSG_MAX,
8987 .cb = nf_tables_cb,
8988 .commit = nf_tables_commit,
8989 .abort = nf_tables_abort,
8990 .valid_genid = nf_tables_valid_genid,
8991 .owner = THIS_MODULE,
8992 };
8993
nft_chain_validate_dependency(const struct nft_chain * chain,enum nft_chain_types type)8994 int nft_chain_validate_dependency(const struct nft_chain *chain,
8995 enum nft_chain_types type)
8996 {
8997 const struct nft_base_chain *basechain;
8998
8999 if (nft_is_base_chain(chain)) {
9000 basechain = nft_base_chain(chain);
9001 if (basechain->type->type != type)
9002 return -EOPNOTSUPP;
9003 }
9004 return 0;
9005 }
9006 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
9007
nft_chain_validate_hooks(const struct nft_chain * chain,unsigned int hook_flags)9008 int nft_chain_validate_hooks(const struct nft_chain *chain,
9009 unsigned int hook_flags)
9010 {
9011 struct nft_base_chain *basechain;
9012
9013 if (nft_is_base_chain(chain)) {
9014 basechain = nft_base_chain(chain);
9015
9016 if ((1 << basechain->ops.hooknum) & hook_flags)
9017 return 0;
9018
9019 return -EOPNOTSUPP;
9020 }
9021
9022 return 0;
9023 }
9024 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
9025
9026 /*
9027 * Loop detection - walk through the ruleset beginning at the destination chain
9028 * of a new jump until either the source chain is reached (loop) or all
9029 * reachable chains have been traversed.
9030 *
9031 * The loop check is performed whenever a new jump verdict is added to an
9032 * expression or verdict map or a verdict map is bound to a new chain.
9033 */
9034
9035 static int nf_tables_check_loops(const struct nft_ctx *ctx,
9036 const struct nft_chain *chain);
9037
nft_check_loops(const struct nft_ctx * ctx,const struct nft_set_ext * ext)9038 static int nft_check_loops(const struct nft_ctx *ctx,
9039 const struct nft_set_ext *ext)
9040 {
9041 const struct nft_data *data;
9042 int ret;
9043
9044 data = nft_set_ext_data(ext);
9045 switch (data->verdict.code) {
9046 case NFT_JUMP:
9047 case NFT_GOTO:
9048 ret = nf_tables_check_loops(ctx, data->verdict.chain);
9049 break;
9050 default:
9051 ret = 0;
9052 break;
9053 }
9054
9055 return ret;
9056 }
9057
nf_tables_loop_check_setelem(const struct nft_ctx * ctx,struct nft_set * set,const struct nft_set_iter * iter,struct nft_set_elem * elem)9058 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
9059 struct nft_set *set,
9060 const struct nft_set_iter *iter,
9061 struct nft_set_elem *elem)
9062 {
9063 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
9064
9065 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
9066 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
9067 return 0;
9068
9069 return nft_check_loops(ctx, ext);
9070 }
9071
nf_tables_check_loops(const struct nft_ctx * ctx,const struct nft_chain * chain)9072 static int nf_tables_check_loops(const struct nft_ctx *ctx,
9073 const struct nft_chain *chain)
9074 {
9075 const struct nft_rule *rule;
9076 const struct nft_expr *expr, *last;
9077 struct nft_set *set;
9078 struct nft_set_binding *binding;
9079 struct nft_set_iter iter;
9080
9081 if (ctx->chain == chain)
9082 return -ELOOP;
9083
9084 list_for_each_entry(rule, &chain->rules, list) {
9085 nft_rule_for_each_expr(expr, last, rule) {
9086 struct nft_immediate_expr *priv;
9087 const struct nft_data *data;
9088 int err;
9089
9090 if (strcmp(expr->ops->type->name, "immediate"))
9091 continue;
9092
9093 priv = nft_expr_priv(expr);
9094 if (priv->dreg != NFT_REG_VERDICT)
9095 continue;
9096
9097 data = &priv->data;
9098 switch (data->verdict.code) {
9099 case NFT_JUMP:
9100 case NFT_GOTO:
9101 err = nf_tables_check_loops(ctx,
9102 data->verdict.chain);
9103 if (err < 0)
9104 return err;
9105 break;
9106 default:
9107 break;
9108 }
9109 }
9110 }
9111
9112 list_for_each_entry(set, &ctx->table->sets, list) {
9113 if (!nft_is_active_next(ctx->net, set))
9114 continue;
9115 if (!(set->flags & NFT_SET_MAP) ||
9116 set->dtype != NFT_DATA_VERDICT)
9117 continue;
9118
9119 list_for_each_entry(binding, &set->bindings, list) {
9120 if (!(binding->flags & NFT_SET_MAP) ||
9121 binding->chain != chain)
9122 continue;
9123
9124 iter.genmask = nft_genmask_next(ctx->net);
9125 iter.skip = 0;
9126 iter.count = 0;
9127 iter.err = 0;
9128 iter.fn = nf_tables_loop_check_setelem;
9129
9130 set->ops->walk(ctx, set, &iter);
9131 if (iter.err < 0)
9132 return iter.err;
9133 }
9134 }
9135
9136 return 0;
9137 }
9138
9139 /**
9140 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
9141 *
9142 * @attr: netlink attribute to fetch value from
9143 * @max: maximum value to be stored in dest
9144 * @dest: pointer to the variable
9145 *
9146 * Parse, check and store a given u32 netlink attribute into variable.
9147 * This function returns -ERANGE if the value goes over maximum value.
9148 * Otherwise a 0 is returned and the attribute value is stored in the
9149 * destination variable.
9150 */
nft_parse_u32_check(const struct nlattr * attr,int max,u32 * dest)9151 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
9152 {
9153 u32 val;
9154
9155 val = ntohl(nla_get_be32(attr));
9156 if (val > max)
9157 return -ERANGE;
9158
9159 *dest = val;
9160 return 0;
9161 }
9162 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
9163
nft_parse_register(const struct nlattr * attr,u32 * preg)9164 static int nft_parse_register(const struct nlattr *attr, u32 *preg)
9165 {
9166 unsigned int reg;
9167
9168 reg = ntohl(nla_get_be32(attr));
9169 switch (reg) {
9170 case NFT_REG_VERDICT...NFT_REG_4:
9171 *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE;
9172 break;
9173 case NFT_REG32_00...NFT_REG32_15:
9174 *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
9175 break;
9176 default:
9177 return -ERANGE;
9178 }
9179
9180 return 0;
9181 }
9182
9183 /**
9184 * nft_dump_register - dump a register value to a netlink attribute
9185 *
9186 * @skb: socket buffer
9187 * @attr: attribute number
9188 * @reg: register number
9189 *
9190 * Construct a netlink attribute containing the register number. For
9191 * compatibility reasons, register numbers being a multiple of 4 are
9192 * translated to the corresponding 128 bit register numbers.
9193 */
nft_dump_register(struct sk_buff * skb,unsigned int attr,unsigned int reg)9194 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
9195 {
9196 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
9197 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
9198 else
9199 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
9200
9201 return nla_put_be32(skb, attr, htonl(reg));
9202 }
9203 EXPORT_SYMBOL_GPL(nft_dump_register);
9204
9205 /**
9206 * nft_validate_register_load - validate a load from a register
9207 *
9208 * @reg: the register number
9209 * @len: the length of the data
9210 *
9211 * Validate that the input register is one of the general purpose
9212 * registers and that the length of the load is within the bounds.
9213 */
nft_validate_register_load(enum nft_registers reg,unsigned int len)9214 static int nft_validate_register_load(enum nft_registers reg, unsigned int len)
9215 {
9216 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
9217 return -EINVAL;
9218 if (len == 0)
9219 return -EINVAL;
9220 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data))
9221 return -ERANGE;
9222
9223 return 0;
9224 }
9225
nft_parse_register_load(const struct nlattr * attr,u8 * sreg,u32 len)9226 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len)
9227 {
9228 u32 reg;
9229 int err;
9230
9231 err = nft_parse_register(attr, ®);
9232 if (err < 0)
9233 return err;
9234
9235 err = nft_validate_register_load(reg, len);
9236 if (err < 0)
9237 return err;
9238
9239 *sreg = reg;
9240 return 0;
9241 }
9242 EXPORT_SYMBOL_GPL(nft_parse_register_load);
9243
9244 /**
9245 * nft_validate_register_store - validate an expressions' register store
9246 *
9247 * @ctx: context of the expression performing the load
9248 * @reg: the destination register number
9249 * @data: the data to load
9250 * @type: the data type
9251 * @len: the length of the data
9252 *
9253 * Validate that a data load uses the appropriate data type for
9254 * the destination register and the length is within the bounds.
9255 * A value of NULL for the data means that its runtime gathered
9256 * data.
9257 */
nft_validate_register_store(const struct nft_ctx * ctx,enum nft_registers reg,const struct nft_data * data,enum nft_data_types type,unsigned int len)9258 static int nft_validate_register_store(const struct nft_ctx *ctx,
9259 enum nft_registers reg,
9260 const struct nft_data *data,
9261 enum nft_data_types type,
9262 unsigned int len)
9263 {
9264 int err;
9265
9266 switch (reg) {
9267 case NFT_REG_VERDICT:
9268 if (type != NFT_DATA_VERDICT)
9269 return -EINVAL;
9270
9271 if (data != NULL &&
9272 (data->verdict.code == NFT_GOTO ||
9273 data->verdict.code == NFT_JUMP)) {
9274 err = nf_tables_check_loops(ctx, data->verdict.chain);
9275 if (err < 0)
9276 return err;
9277 }
9278
9279 return 0;
9280 default:
9281 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
9282 return -EINVAL;
9283 if (len == 0)
9284 return -EINVAL;
9285 if (reg * NFT_REG32_SIZE + len >
9286 sizeof_field(struct nft_regs, data))
9287 return -ERANGE;
9288
9289 if (data != NULL && type != NFT_DATA_VALUE)
9290 return -EINVAL;
9291 return 0;
9292 }
9293 }
9294
nft_parse_register_store(const struct nft_ctx * ctx,const struct nlattr * attr,u8 * dreg,const struct nft_data * data,enum nft_data_types type,unsigned int len)9295 int nft_parse_register_store(const struct nft_ctx *ctx,
9296 const struct nlattr *attr, u8 *dreg,
9297 const struct nft_data *data,
9298 enum nft_data_types type, unsigned int len)
9299 {
9300 int err;
9301 u32 reg;
9302
9303 err = nft_parse_register(attr, ®);
9304 if (err < 0)
9305 return err;
9306
9307 err = nft_validate_register_store(ctx, reg, data, type, len);
9308 if (err < 0)
9309 return err;
9310
9311 *dreg = reg;
9312 return 0;
9313 }
9314 EXPORT_SYMBOL_GPL(nft_parse_register_store);
9315
9316 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
9317 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
9318 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
9319 .len = NFT_CHAIN_MAXNAMELEN - 1 },
9320 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 },
9321 };
9322
nft_verdict_init(const struct nft_ctx * ctx,struct nft_data * data,struct nft_data_desc * desc,const struct nlattr * nla)9323 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
9324 struct nft_data_desc *desc, const struct nlattr *nla)
9325 {
9326 u8 genmask = nft_genmask_next(ctx->net);
9327 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
9328 struct nft_chain *chain;
9329 int err;
9330
9331 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
9332 nft_verdict_policy, NULL);
9333 if (err < 0)
9334 return err;
9335
9336 if (!tb[NFTA_VERDICT_CODE])
9337 return -EINVAL;
9338
9339 /* zero padding hole for memcmp */
9340 memset(data, 0, sizeof(*data));
9341 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
9342
9343 switch (data->verdict.code) {
9344 case NF_ACCEPT:
9345 case NF_DROP:
9346 case NF_QUEUE:
9347 break;
9348 case NFT_CONTINUE:
9349 case NFT_BREAK:
9350 case NFT_RETURN:
9351 break;
9352 case NFT_JUMP:
9353 case NFT_GOTO:
9354 if (tb[NFTA_VERDICT_CHAIN]) {
9355 chain = nft_chain_lookup(ctx->net, ctx->table,
9356 tb[NFTA_VERDICT_CHAIN],
9357 genmask);
9358 } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
9359 chain = nft_chain_lookup_byid(ctx->net, ctx->table,
9360 tb[NFTA_VERDICT_CHAIN_ID],
9361 genmask);
9362 if (IS_ERR(chain))
9363 return PTR_ERR(chain);
9364 } else {
9365 return -EINVAL;
9366 }
9367
9368 if (IS_ERR(chain))
9369 return PTR_ERR(chain);
9370 if (nft_is_base_chain(chain))
9371 return -EOPNOTSUPP;
9372 if (nft_chain_is_bound(chain))
9373 return -EINVAL;
9374 if (desc->flags & NFT_DATA_DESC_SETELEM &&
9375 chain->flags & NFT_CHAIN_BINDING)
9376 return -EINVAL;
9377 if (!nft_use_inc(&chain->use))
9378 return -EMFILE;
9379
9380 data->verdict.chain = chain;
9381 break;
9382 default:
9383 return -EINVAL;
9384 }
9385
9386 desc->len = sizeof(data->verdict);
9387
9388 return 0;
9389 }
9390
nft_verdict_uninit(const struct nft_data * data)9391 static void nft_verdict_uninit(const struct nft_data *data)
9392 {
9393 struct nft_chain *chain;
9394
9395 switch (data->verdict.code) {
9396 case NFT_JUMP:
9397 case NFT_GOTO:
9398 chain = data->verdict.chain;
9399 nft_use_dec(&chain->use);
9400 break;
9401 }
9402 }
9403
nft_verdict_dump(struct sk_buff * skb,int type,const struct nft_verdict * v)9404 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
9405 {
9406 struct nlattr *nest;
9407
9408 nest = nla_nest_start_noflag(skb, type);
9409 if (!nest)
9410 goto nla_put_failure;
9411
9412 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
9413 goto nla_put_failure;
9414
9415 switch (v->code) {
9416 case NFT_JUMP:
9417 case NFT_GOTO:
9418 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
9419 v->chain->name))
9420 goto nla_put_failure;
9421 }
9422 nla_nest_end(skb, nest);
9423 return 0;
9424
9425 nla_put_failure:
9426 return -1;
9427 }
9428
nft_value_init(const struct nft_ctx * ctx,struct nft_data * data,struct nft_data_desc * desc,const struct nlattr * nla)9429 static int nft_value_init(const struct nft_ctx *ctx,
9430 struct nft_data *data, struct nft_data_desc *desc,
9431 const struct nlattr *nla)
9432 {
9433 unsigned int len;
9434
9435 len = nla_len(nla);
9436 if (len == 0)
9437 return -EINVAL;
9438 if (len > desc->size)
9439 return -EOVERFLOW;
9440 if (desc->len) {
9441 if (len != desc->len)
9442 return -EINVAL;
9443 } else {
9444 desc->len = len;
9445 }
9446
9447 nla_memcpy(data->data, nla, len);
9448
9449 return 0;
9450 }
9451
nft_value_dump(struct sk_buff * skb,const struct nft_data * data,unsigned int len)9452 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
9453 unsigned int len)
9454 {
9455 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
9456 }
9457
9458 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
9459 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
9460 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
9461 };
9462
9463 /**
9464 * nft_data_init - parse nf_tables data netlink attributes
9465 *
9466 * @ctx: context of the expression using the data
9467 * @data: destination struct nft_data
9468 * @desc: data description
9469 * @nla: netlink attribute containing data
9470 *
9471 * Parse the netlink data attributes and initialize a struct nft_data.
9472 * The type and length of data are returned in the data description.
9473 *
9474 * The caller can indicate that it only wants to accept data of type
9475 * NFT_DATA_VALUE by passing NULL for the ctx argument.
9476 */
nft_data_init(const struct nft_ctx * ctx,struct nft_data * data,struct nft_data_desc * desc,const struct nlattr * nla)9477 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
9478 struct nft_data_desc *desc, const struct nlattr *nla)
9479 {
9480 struct nlattr *tb[NFTA_DATA_MAX + 1];
9481 int err;
9482
9483 if (WARN_ON_ONCE(!desc->size))
9484 return -EINVAL;
9485
9486 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
9487 nft_data_policy, NULL);
9488 if (err < 0)
9489 return err;
9490
9491 if (tb[NFTA_DATA_VALUE]) {
9492 if (desc->type != NFT_DATA_VALUE)
9493 return -EINVAL;
9494
9495 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]);
9496 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) {
9497 if (desc->type != NFT_DATA_VERDICT)
9498 return -EINVAL;
9499
9500 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
9501 } else {
9502 err = -EINVAL;
9503 }
9504
9505 return err;
9506 }
9507 EXPORT_SYMBOL_GPL(nft_data_init);
9508
9509 /**
9510 * nft_data_release - release a nft_data item
9511 *
9512 * @data: struct nft_data to release
9513 * @type: type of data
9514 *
9515 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
9516 * all others need to be released by calling this function.
9517 */
nft_data_release(const struct nft_data * data,enum nft_data_types type)9518 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
9519 {
9520 if (type < NFT_DATA_VERDICT)
9521 return;
9522 switch (type) {
9523 case NFT_DATA_VERDICT:
9524 return nft_verdict_uninit(data);
9525 default:
9526 WARN_ON(1);
9527 }
9528 }
9529 EXPORT_SYMBOL_GPL(nft_data_release);
9530
nft_data_dump(struct sk_buff * skb,int attr,const struct nft_data * data,enum nft_data_types type,unsigned int len)9531 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
9532 enum nft_data_types type, unsigned int len)
9533 {
9534 struct nlattr *nest;
9535 int err;
9536
9537 nest = nla_nest_start_noflag(skb, attr);
9538 if (nest == NULL)
9539 return -1;
9540
9541 switch (type) {
9542 case NFT_DATA_VALUE:
9543 err = nft_value_dump(skb, data, len);
9544 break;
9545 case NFT_DATA_VERDICT:
9546 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
9547 break;
9548 default:
9549 err = -EINVAL;
9550 WARN_ON(1);
9551 }
9552
9553 nla_nest_end(skb, nest);
9554 return err;
9555 }
9556 EXPORT_SYMBOL_GPL(nft_data_dump);
9557
__nft_release_basechain(struct nft_ctx * ctx)9558 int __nft_release_basechain(struct nft_ctx *ctx)
9559 {
9560 struct nft_rule *rule, *nr;
9561
9562 if (WARN_ON(!nft_is_base_chain(ctx->chain)))
9563 return 0;
9564
9565 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
9566 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
9567 list_del(&rule->list);
9568 nft_use_dec(&ctx->chain->use);
9569 nf_tables_rule_release(ctx, rule);
9570 }
9571 nft_chain_del(ctx->chain);
9572 nft_use_dec(&ctx->table->use);
9573 nf_tables_chain_destroy(ctx);
9574
9575 return 0;
9576 }
9577 EXPORT_SYMBOL_GPL(__nft_release_basechain);
9578
__nft_release_hook(struct net * net,struct nft_table * table)9579 static void __nft_release_hook(struct net *net, struct nft_table *table)
9580 {
9581 struct nft_flowtable *flowtable;
9582 struct nft_chain *chain;
9583
9584 list_for_each_entry(chain, &table->chains, list)
9585 __nf_tables_unregister_hook(net, table, chain, true);
9586 list_for_each_entry(flowtable, &table->flowtables, list)
9587 __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list,
9588 true);
9589 }
9590
__nft_release_hooks(struct net * net)9591 static void __nft_release_hooks(struct net *net)
9592 {
9593 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
9594 struct nft_table *table;
9595
9596 list_for_each_entry(table, &nft_net->tables, list)
9597 __nft_release_hook(net, table);
9598 }
9599
__nft_release_table(struct net * net,struct nft_table * table)9600 static void __nft_release_table(struct net *net, struct nft_table *table)
9601 {
9602 struct nft_flowtable *flowtable, *nf;
9603 struct nft_chain *chain, *nc;
9604 struct nft_object *obj, *ne;
9605 struct nft_rule *rule, *nr;
9606 struct nft_set *set, *ns;
9607 struct nft_ctx ctx = {
9608 .net = net,
9609 .family = NFPROTO_NETDEV,
9610 };
9611
9612 ctx.family = table->family;
9613 ctx.table = table;
9614 list_for_each_entry(chain, &table->chains, list) {
9615 if (nft_chain_binding(chain))
9616 continue;
9617
9618 ctx.chain = chain;
9619 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
9620 list_del(&rule->list);
9621 nft_use_dec(&chain->use);
9622 nf_tables_rule_release(&ctx, rule);
9623 }
9624 }
9625 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
9626 list_del(&flowtable->list);
9627 nft_use_dec(&table->use);
9628 nf_tables_flowtable_destroy(flowtable);
9629 }
9630 list_for_each_entry_safe(set, ns, &table->sets, list) {
9631 list_del(&set->list);
9632 nft_use_dec(&table->use);
9633 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
9634 nft_map_deactivate(&ctx, set);
9635
9636 nft_set_destroy(&ctx, set);
9637 }
9638 list_for_each_entry_safe(obj, ne, &table->objects, list) {
9639 nft_obj_del(obj);
9640 nft_use_dec(&table->use);
9641 nft_obj_destroy(&ctx, obj);
9642 }
9643 list_for_each_entry_safe(chain, nc, &table->chains, list) {
9644 ctx.chain = chain;
9645 nft_chain_del(chain);
9646 nft_use_dec(&table->use);
9647 nf_tables_chain_destroy(&ctx);
9648 }
9649 list_del(&table->list);
9650 nf_tables_table_destroy(&ctx);
9651 }
9652
__nft_release_tables(struct net * net)9653 static void __nft_release_tables(struct net *net)
9654 {
9655 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
9656 struct nft_table *table, *nt;
9657
9658 list_for_each_entry_safe(table, nt, &nft_net->tables, list)
9659 __nft_release_table(net, table);
9660 }
9661
nf_tables_init_net(struct net * net)9662 static int __net_init nf_tables_init_net(struct net *net)
9663 {
9664 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
9665
9666 INIT_LIST_HEAD(&nft_net->tables);
9667 INIT_LIST_HEAD(&nft_net->commit_list);
9668 INIT_LIST_HEAD(&nft_net->binding_list);
9669 INIT_LIST_HEAD(&nft_net->module_list);
9670 INIT_LIST_HEAD(&nft_net->notify_list);
9671 mutex_init(&nft_net->commit_mutex);
9672 nft_net->base_seq = 1;
9673 nft_net->validate_state = NFT_VALIDATE_SKIP;
9674 nft_net->gc_seq = 0;
9675
9676 return 0;
9677 }
9678
nf_tables_pre_exit_net(struct net * net)9679 static void __net_exit nf_tables_pre_exit_net(struct net *net)
9680 {
9681 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
9682
9683 mutex_lock(&nft_net->commit_mutex);
9684 __nft_release_hooks(net);
9685 mutex_unlock(&nft_net->commit_mutex);
9686 }
9687
nf_tables_exit_net(struct net * net)9688 static void __net_exit nf_tables_exit_net(struct net *net)
9689 {
9690 struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
9691 unsigned int gc_seq;
9692
9693 mutex_lock(&nft_net->commit_mutex);
9694
9695 gc_seq = nft_gc_seq_begin(nft_net);
9696
9697 if (!list_empty(&nft_net->commit_list))
9698 __nf_tables_abort(net, NFNL_ABORT_NONE);
9699 __nft_release_tables(net);
9700
9701 nft_gc_seq_end(nft_net, gc_seq);
9702
9703 mutex_unlock(&nft_net->commit_mutex);
9704 WARN_ON_ONCE(!list_empty(&nft_net->tables));
9705 WARN_ON_ONCE(!list_empty(&nft_net->module_list));
9706 WARN_ON_ONCE(!list_empty(&nft_net->notify_list));
9707 }
9708
nf_tables_exit_batch(struct list_head * net_exit_list)9709 static void nf_tables_exit_batch(struct list_head *net_exit_list)
9710 {
9711 flush_work(&trans_gc_work);
9712 }
9713
9714 static struct pernet_operations nf_tables_net_ops = {
9715 .init = nf_tables_init_net,
9716 .pre_exit = nf_tables_pre_exit_net,
9717 .exit = nf_tables_exit_net,
9718 .exit_batch = nf_tables_exit_batch,
9719 .id = &nf_tables_net_id,
9720 .size = sizeof(struct nftables_pernet),
9721 };
9722
nf_tables_module_init(void)9723 static int __init nf_tables_module_init(void)
9724 {
9725 int err;
9726
9727 spin_lock_init(&nf_tables_destroy_list_lock);
9728 err = register_pernet_subsys(&nf_tables_net_ops);
9729 if (err < 0)
9730 return err;
9731
9732 err = nft_chain_filter_init();
9733 if (err < 0)
9734 goto err1;
9735
9736 err = nf_tables_core_module_init();
9737 if (err < 0)
9738 goto err2;
9739
9740 err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
9741 if (err < 0)
9742 goto err3;
9743
9744 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
9745 if (err < 0)
9746 goto err4;
9747
9748 err = nft_offload_init();
9749 if (err < 0)
9750 goto err5;
9751
9752 /* must be last */
9753 err = nfnetlink_subsys_register(&nf_tables_subsys);
9754 if (err < 0)
9755 goto err6;
9756
9757 nft_chain_route_init();
9758
9759 return err;
9760 err6:
9761 nft_offload_exit();
9762 err5:
9763 rhltable_destroy(&nft_objname_ht);
9764 err4:
9765 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
9766 err3:
9767 nf_tables_core_module_exit();
9768 err2:
9769 nft_chain_filter_fini();
9770 err1:
9771 unregister_pernet_subsys(&nf_tables_net_ops);
9772 return err;
9773 }
9774
nf_tables_module_exit(void)9775 static void __exit nf_tables_module_exit(void)
9776 {
9777 nfnetlink_subsys_unregister(&nf_tables_subsys);
9778 nft_offload_exit();
9779 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
9780 nft_chain_filter_fini();
9781 nft_chain_route_fini();
9782 unregister_pernet_subsys(&nf_tables_net_ops);
9783 cancel_work_sync(&trans_gc_work);
9784 cancel_work_sync(&trans_destroy_work);
9785 rcu_barrier();
9786 rhltable_destroy(&nft_objname_ht);
9787 nf_tables_core_module_exit();
9788 }
9789
9790 module_init(nf_tables_module_init);
9791 module_exit(nf_tables_module_exit);
9792
9793 MODULE_LICENSE("GPL");
9794 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
9795 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
9796