projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge 4.14.24 into android-4.14
[GitHub/LineageOS/android_kernel_motorola_exynos9610.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
1ff75a3e 16#include <linux/vmalloc.h>
96518518
PM		 17#include <linux/netfilter.h>
18#include <linux/netfilter/nfnetlink.h>
19#include <linux/netfilter/nf_tables.h>
20#include <net/netfilter/nf_tables_core.h>
21#include <net/netfilter/nf_tables.h>
99633ab2 22#include <net/net_namespace.h>
96518518
PM		 23#include <net/sock.h>
24
96518518 25static LIST_HEAD(nf_tables_expressions);
e5009240 26static LIST_HEAD(nf_tables_objects);
96518518
PM		 27
28/**
29 * nft_register_afinfo - register nf_tables address family info
30 *
31 * @afi: address family info to register
32 *
33 * Register the address family for use with nf_tables. Returns zero on
34 * success or a negative errno code otherwise.
35 */
99633ab2 36int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 37{
38 INIT_LIST_HEAD(&afi->tables);
39 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 40 list_add_tail_rcu(&afi->list, &net->nft.af_info);
96518518
PM		 41 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
42 return 0;
43}
44EXPORT_SYMBOL_GPL(nft_register_afinfo);
45
df05ef87
PNA		 46static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi);
47
96518518
PM		 48/**
49 * nft_unregister_afinfo - unregister nf_tables address family info
50 *
51 * @afi: address family info to unregister
52 *
53 * Unregister the address family for use with nf_tables.
54 */
df05ef87 55void nft_unregister_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 56{
57 nfnl_lock(NFNL_SUBSYS_NFTABLES);
df05ef87 58 __nft_release_afinfo(net, afi);
e688a7f8 59 list_del_rcu(&afi->list);
96518518
PM		 60 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
61}
62EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
63
99633ab2 64static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
96518518
PM		 65{
66 struct nft_af_info *afi;
67
99633ab2 68 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 69 if (afi->family == family)
70 return afi;
71 }
72 return NULL;
73}
74
99633ab2
PNA		 75static struct nft_af_info *
76nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
96518518
PM		 77{
78 struct nft_af_info *afi;
79
99633ab2 80 afi = nft_afinfo_lookup(net, family);
96518518
PM		 81 if (afi != NULL)
82 return afi;
83#ifdef CONFIG_MODULES
84 if (autoload) {
85 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
86 request_module("nft-afinfo-%u", family);
87 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 88 afi = nft_afinfo_lookup(net, family);
96518518
PM		 89 if (afi != NULL)
90 return ERR_PTR(-EAGAIN);
91 }
92#endif
93 return ERR_PTR(-EAFNOSUPPORT);
94}
95
7c95f6d8 96static void nft_ctx_init(struct nft_ctx *ctx,
633c9a84 97 struct net *net,
7c95f6d8
PNA		 98 const struct sk_buff *skb,
99 const struct nlmsghdr *nlh,
100 struct nft_af_info *afi,
101 struct nft_table *table,
102 struct nft_chain *chain,
103 const struct nlattr * const *nla)
104{
633c9a84 105 ctx->net = net;
128ad332
PNA		 106 ctx->afi = afi;
107 ctx->table = table;
108 ctx->chain = chain;
109 ctx->nla = nla;
110 ctx->portid = NETLINK_CB(skb).portid;
111 ctx->report = nlmsg_report(nlh);
112 ctx->seq = nlh->nlmsg_seq;
7c95f6d8
PNA		 113}
114
8411b644
PNA		 115static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
116 int msg_type, u32 size, gfp_t gfp)
1081d11b
PNA		 117{
118 struct nft_trans *trans;
119
8411b644 120 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
1081d11b
PNA		 121 if (trans == NULL)
122 return NULL;
123
b380e5c7 124 trans->msg_type = msg_type;
1081d11b
PNA		 125 trans->ctx = *ctx;
126
127 return trans;
128}
129
8411b644
PNA		 130static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
131 int msg_type, u32 size)
132{
133 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
134}
135
1081d11b
PNA		 136static void nft_trans_destroy(struct nft_trans *trans)
137{
138 list_del(&trans->list);
139 kfree(trans);
140}
141
82bec71d
PNA		 142static int nf_tables_register_hooks(struct net *net,
143 const struct nft_table *table,
d8ee8f7c
PNA		 144 struct nft_chain *chain,
145 unsigned int hook_nops)
146{
147 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 148 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 149 return 0;
150
82bec71d
PNA		 151 return nf_register_net_hooks(net, nft_base_chain(chain)->ops,
152 hook_nops);
d8ee8f7c
PNA		 153}
154
82bec71d
PNA		 155static void nf_tables_unregister_hooks(struct net *net,
156 const struct nft_table *table,
d8ee8f7c 157 struct nft_chain *chain,
c5598794
AB		 158 unsigned int hook_nops)
159{
d8ee8f7c 160 if (table->flags & NFT_TABLE_F_DORMANT ||
f323d954 161 !nft_is_base_chain(chain))
d8ee8f7c
PNA		 162 return;
163
82bec71d 164 nf_unregister_net_hooks(net, nft_base_chain(chain)->ops, hook_nops);
c5598794
AB		 165}
166
ee01d542
AB		 167static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
168{
169 struct nft_trans *trans;
170
171 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
172 if (trans == NULL)
173 return -ENOMEM;
174
175 if (msg_type == NFT_MSG_NEWTABLE)
f2a6d766 176 nft_activate_next(ctx->net, ctx->table);
ee01d542
AB		 177
178 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
179 return 0;
180}
181
182static int nft_deltable(struct nft_ctx *ctx)
183{
184 int err;
185
186 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
187 if (err < 0)
188 return err;
189
f2a6d766 190 nft_deactivate_next(ctx->net, ctx->table);
ee01d542
AB		 191 return err;
192}
193
194static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
195{
196 struct nft_trans *trans;
197
198 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
199 if (trans == NULL)
200 return -ENOMEM;
201
202 if (msg_type == NFT_MSG_NEWCHAIN)
664b0f8c 203 nft_activate_next(ctx->net, ctx->chain);
ee01d542
AB		 204
205 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
206 return 0;
207}
208
209static int nft_delchain(struct nft_ctx *ctx)
210{
211 int err;
212
213 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
214 if (err < 0)
215 return err;
216
217 ctx->table->use--;
664b0f8c 218 nft_deactivate_next(ctx->net, ctx->chain);
ee01d542
AB		 219
220 return err;
221}
222
ee01d542
AB		 223static int
224nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
225{
226 /* You cannot delete the same rule twice */
889f7ee7
PNA		 227 if (nft_is_active_next(ctx->net, rule)) {
228 nft_deactivate_next(ctx->net, rule);
ee01d542
AB		 229 ctx->chain->use--;
230 return 0;
231 }
232 return -ENOENT;
233}
234
235static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
236 struct nft_rule *rule)
237{
238 struct nft_trans *trans;
239
240 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
241 if (trans == NULL)
242 return NULL;
243
1a94e38d
PNA		 244 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
245 nft_trans_rule_id(trans) =
246 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
247 }
ee01d542
AB		 248 nft_trans_rule(trans) = rule;
249 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
250
251 return trans;
252}
253
254static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
255{
256 struct nft_trans *trans;
257 int err;
258
259 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
260 if (trans == NULL)
261 return -ENOMEM;
262
263 err = nf_tables_delrule_deactivate(ctx, rule);
264 if (err < 0) {
265 nft_trans_destroy(trans);
266 return err;
267 }
268
269 return 0;
270}
271
272static int nft_delrule_by_chain(struct nft_ctx *ctx)
273{
274 struct nft_rule *rule;
275 int err;
276
277 list_for_each_entry(rule, &ctx->chain->rules, list) {
278 err = nft_delrule(ctx, rule);
279 if (err < 0)
280 return err;
281 }
282 return 0;
283}
284
ee01d542
AB		 285static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
286 struct nft_set *set)
287{
288 struct nft_trans *trans;
289
290 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
291 if (trans == NULL)
292 return -ENOMEM;
293
294 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
295 nft_trans_set_id(trans) =
296 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
37a9cc52 297 nft_activate_next(ctx->net, set);
ee01d542
AB		 298 }
299 nft_trans_set(trans) = set;
300 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
301
302 return 0;
303}
304
305static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
306{
307 int err;
308
309 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
310 if (err < 0)
311 return err;
312
37a9cc52 313 nft_deactivate_next(ctx->net, set);
ee01d542
AB		 314 ctx->table->use--;
315
316 return err;
317}
318
e5009240
PNA		 319static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
320 struct nft_object *obj)
321{
322 struct nft_trans *trans;
323
324 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
325 if (trans == NULL)
326 return -ENOMEM;
327
328 if (msg_type == NFT_MSG_NEWOBJ)
329 nft_activate_next(ctx->net, obj);
330
331 nft_trans_obj(trans) = obj;
332 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
333
334 return 0;
335}
336
337static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
338{
339 int err;
340
341 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
342 if (err < 0)
343 return err;
344
345 nft_deactivate_next(ctx->net, obj);
346 ctx->table->use--;
347
348 return err;
349}
350
96518518
PM		 351/*
352 * Tables
353 */
354
355static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
f2a6d766
PNA		 356 const struct nlattr *nla,
357 u8 genmask)
96518518
PM		 358{
359 struct nft_table *table;
360
361 list_for_each_entry(table, &afi->tables, list) {
f2a6d766
PNA		 362 if (!nla_strcmp(nla, table->name) &&
363 nft_active_genmask(table, genmask))
96518518
PM		 364 return table;
365 }
366 return NULL;
367}
368
369static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
f2a6d766
PNA		 370 const struct nlattr *nla,
371 u8 genmask)
96518518
PM		 372{
373 struct nft_table *table;
374
375 if (nla == NULL)
376 return ERR_PTR(-EINVAL);
377
f2a6d766 378 table = nft_table_lookup(afi, nla, genmask);
96518518
PM		 379 if (table != NULL)
380 return table;
381
96518518
PM		 382 return ERR_PTR(-ENOENT);
383}
384
385static inline u64 nf_tables_alloc_handle(struct nft_table *table)
386{
387 return ++table->hgenerator;
388}
389
d8297d4f 390static const struct nf_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
9370761c 391
2a37d755 392static const struct nf_chain_type *
baae3e62 393__nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
9370761c
PNA		 394{
395 int i;
396
baae3e62 397 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 398 if (chain_type[family][i] != NULL &&
399 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 400 return chain_type[family][i];
9370761c 401 }
baae3e62 402 return NULL;
9370761c
PNA		 403}
404
2a37d755 405static const struct nf_chain_type *
baae3e62
PM		 406nf_tables_chain_type_lookup(const struct nft_af_info *afi,
407 const struct nlattr *nla,
408 bool autoload)
9370761c 409{
2a37d755 410 const struct nf_chain_type *type;
9370761c
PNA		 411
412 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 413 if (type != NULL)
414 return type;
9370761c 415#ifdef CONFIG_MODULES
93b0806f 416 if (autoload) {
9370761c 417 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2fec6bb6
PNA		 418 request_module("nft-chain-%u-%.*s", afi->family,
419 nla_len(nla), (const char *)nla_data(nla));
9370761c
PNA		 420 nfnl_lock(NFNL_SUBSYS_NFTABLES);
421 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 422 if (type != NULL)
423 return ERR_PTR(-EAGAIN);
9370761c
PNA		 424 }
425#endif
93b0806f 426 return ERR_PTR(-ENOENT);
9370761c
PNA		 427}
428
96518518 429static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
1cae565e
PNA		 430 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
431 .len = NFT_TABLE_MAXNAMELEN - 1 },
9ddf6323 432 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
96518518
PM		 433};
434
84d7fce6
PNA		 435static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
436 u32 portid, u32 seq, int event, u32 flags,
437 int family, const struct nft_table *table)
96518518
PM		 438{
439 struct nlmsghdr *nlh;
440 struct nfgenmsg *nfmsg;
441
dedb67c4 442 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 443 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
444 if (nlh == NULL)
445 goto nla_put_failure;
446
447 nfmsg = nlmsg_data(nlh);
448 nfmsg->nfgen_family = family;
449 nfmsg->version = NFNETLINK_V0;
84d7fce6 450 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518 451
9ddf6323 452 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768
TB		 453 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
454 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
96518518
PM		 455 goto nla_put_failure;
456
053c095a
JB		 457 nlmsg_end(skb, nlh);
458 return 0;
96518518
PM		 459
460nla_put_failure:
461 nlmsg_trim(skb, nlh);
462 return -1;
463}
464
25e94a99 465static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 466{
467 struct sk_buff *skb;
96518518
PM		 468 int err;
469
128ad332
PNA		 470 if (!ctx->report &&
471 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 472 return;
96518518 473
96518518
PM		 474 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
475 if (skb == NULL)
476 goto err;
477
84d7fce6
PNA		 478 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
479 event, 0, ctx->afi->family, ctx->table);
96518518
PM		 480 if (err < 0) {
481 kfree_skb(skb);
482 goto err;
483 }
484
25e94a99
PNA		 485 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
486 ctx->report, GFP_KERNEL);
487 return;
96518518 488err:
25e94a99 489 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 490}
491
492static int nf_tables_dump_tables(struct sk_buff *skb,
493 struct netlink_callback *cb)
494{
495 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
496 const struct nft_af_info *afi;
497 const struct nft_table *table;
498 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 499 struct net *net = sock_net(skb->sk);
96518518
PM		 500 int family = nfmsg->nfgen_family;
501
e688a7f8 502 rcu_read_lock();
38e029f1
PNA		 503 cb->seq = net->nft.base_seq;
504
e688a7f8 505 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 506 if (family != NFPROTO_UNSPEC && family != afi->family)
507 continue;
508
e688a7f8 509 list_for_each_entry_rcu(table, &afi->tables, list) {
96518518
PM		 510 if (idx < s_idx)
511 goto cont;
512 if (idx > s_idx)
513 memset(&cb->args[1], 0,
514 sizeof(cb->args) - sizeof(cb->args[0]));
f2a6d766
PNA		 515 if (!nft_is_active(net, table))
516 continue;
84d7fce6 517 if (nf_tables_fill_table_info(skb, net,
96518518
PM		 518 NETLINK_CB(cb->skb).portid,
519 cb->nlh->nlmsg_seq,
520 NFT_MSG_NEWTABLE,
521 NLM_F_MULTI,
522 afi->family, table) < 0)
523 goto done;
38e029f1
PNA		 524
525 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 526cont:
527 idx++;
528 }
529 }
530done:
e688a7f8 531 rcu_read_unlock();
96518518
PM		 532 cb->args[0] = idx;
533 return skb->len;
534}
535
7b8002a1
PNA		 536static int nf_tables_gettable(struct net *net, struct sock *nlsk,
537 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 538 const struct nlattr * const nla[],
539 struct netlink_ext_ack *extack)
96518518
PM		 540{
541 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 542 u8 genmask = nft_genmask_cur(net);
96518518
PM		 543 const struct nft_af_info *afi;
544 const struct nft_table *table;
545 struct sk_buff *skb2;
546 int family = nfmsg->nfgen_family;
547 int err;
548
549 if (nlh->nlmsg_flags & NLM_F_DUMP) {
550 struct netlink_dump_control c = {
551 .dump = nf_tables_dump_tables,
552 };
553 return netlink_dump_start(nlsk, skb, nlh, &c);
554 }
555
99633ab2 556 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 557 if (IS_ERR(afi))
558 return PTR_ERR(afi);
559
f2a6d766 560 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
96518518
PM		 561 if (IS_ERR(table))
562 return PTR_ERR(table);
563
564 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
565 if (!skb2)
566 return -ENOMEM;
567
84d7fce6 568 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 569 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
570 family, table);
571 if (err < 0)
572 goto err;
573
574 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
575
576err:
577 kfree_skb(skb2);
578 return err;
579}
580
10435c11
F		 581static void _nf_tables_table_disable(struct net *net,
582 const struct nft_af_info *afi,
583 struct nft_table *table,
584 u32 cnt)
585{
586 struct nft_chain *chain;
587 u32 i = 0;
588
589 list_for_each_entry(chain, &table->chains, list) {
590 if (!nft_is_active_next(net, chain))
591 continue;
f323d954 592 if (!nft_is_base_chain(chain))
10435c11
F		 593 continue;
594
595 if (cnt && i++ == cnt)
596 break;
597
598 nf_unregister_net_hooks(net, nft_base_chain(chain)->ops,
599 afi->nops);
600 }
601}
602
664b0f8c
PNA		 603static int nf_tables_table_enable(struct net *net,
604 const struct nft_af_info *afi,
115a60b1 605 struct nft_table *table)
9ddf6323
PNA		 606{
607 struct nft_chain *chain;
608 int err, i = 0;
609
610 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 611 if (!nft_is_active_next(net, chain))
612 continue;
f323d954 613 if (!nft_is_base_chain(chain))
d2012975
PNA		 614 continue;
615
82bec71d
PNA		 616 err = nf_register_net_hooks(net, nft_base_chain(chain)->ops,
617 afi->nops);
9ddf6323
PNA		 618 if (err < 0)
619 goto err;
620
621 i++;
622 }
623 return 0;
624err:
10435c11
F		 625 if (i)
626 _nf_tables_table_disable(net, afi, table, i);
9ddf6323
PNA		 627 return err;
628}
629
664b0f8c
PNA		 630static void nf_tables_table_disable(struct net *net,
631 const struct nft_af_info *afi,
d8ee8f7c 632 struct nft_table *table)
9ddf6323 633{
10435c11 634 _nf_tables_table_disable(net, afi, table, 0);
9ddf6323
PNA		 635}
636
e1aaca93 637static int nf_tables_updtable(struct nft_ctx *ctx)
9ddf6323 638{
55dd6f93 639 struct nft_trans *trans;
e1aaca93 640 u32 flags;
55dd6f93 641 int ret = 0;
9ddf6323 642
e1aaca93
PNA		 643 if (!ctx->nla[NFTA_TABLE_FLAGS])
644 return 0;
9ddf6323 645
e1aaca93
PNA		 646 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
647 if (flags & ~NFT_TABLE_F_DORMANT)
648 return -EINVAL;
649
63283dd2
PNA		 650 if (flags == ctx->table->flags)
651 return 0;
652
55dd6f93
PNA		 653 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
654 sizeof(struct nft_trans_table));
655 if (trans == NULL)
656 return -ENOMEM;
9ddf6323 657
e1aaca93
PNA		 658 if ((flags & NFT_TABLE_F_DORMANT) &&
659 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
55dd6f93 660 nft_trans_table_enable(trans) = false;
e1aaca93
PNA		 661 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
662 ctx->table->flags & NFT_TABLE_F_DORMANT) {
664b0f8c 663 ret = nf_tables_table_enable(ctx->net, ctx->afi, ctx->table);
55dd6f93 664 if (ret >= 0) {
e1aaca93 665 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
55dd6f93 666 nft_trans_table_enable(trans) = true;
9ddf6323 667 }
9ddf6323 668 }
e1aaca93
PNA		 669 if (ret < 0)
670 goto err;
9ddf6323 671
55dd6f93
PNA		 672 nft_trans_table_update(trans) = true;
673 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
674 return 0;
9ddf6323 675err:
55dd6f93 676 nft_trans_destroy(trans);
9ddf6323
PNA		 677 return ret;
678}
679
633c9a84
PNA		 680static int nf_tables_newtable(struct net *net, struct sock *nlsk,
681 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 682 const struct nlattr * const nla[],
683 struct netlink_ext_ack *extack)
96518518
PM		 684{
685 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 686 u8 genmask = nft_genmask_next(net);
96518518
PM		 687 const struct nlattr *name;
688 struct nft_af_info *afi;
689 struct nft_table *table;
690 int family = nfmsg->nfgen_family;
c5c1f975 691 u32 flags = 0;
e1aaca93 692 struct nft_ctx ctx;
55dd6f93 693 int err;
96518518 694
99633ab2 695 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 696 if (IS_ERR(afi))
697 return PTR_ERR(afi);
698
699 name = nla[NFTA_TABLE_NAME];
f2a6d766 700 table = nf_tables_table_lookup(afi, name, genmask);
96518518
PM		 701 if (IS_ERR(table)) {
702 if (PTR_ERR(table) != -ENOENT)
703 return PTR_ERR(table);
1a28ad74 704 } else {
96518518
PM		 705 if (nlh->nlmsg_flags & NLM_F_EXCL)
706 return -EEXIST;
707 if (nlh->nlmsg_flags & NLM_F_REPLACE)
708 return -EOPNOTSUPP;
e1aaca93 709
633c9a84 710 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
e1aaca93 711 return nf_tables_updtable(&ctx);
96518518
PM		 712 }
713
c5c1f975
PM		 714 if (nla[NFTA_TABLE_FLAGS]) {
715 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
716 if (flags & ~NFT_TABLE_F_DORMANT)
717 return -EINVAL;
718 }
719
ebddf1a8 720 err = -EAFNOSUPPORT;
7047f9d0 721 if (!try_module_get(afi->owner))
ebddf1a8 722 goto err1;
7047f9d0 723
ffdb210e 724 err = -ENOMEM;
1cae565e 725 table = kzalloc(sizeof(*table), GFP_KERNEL);
ffdb210e 726 if (table == NULL)
ebddf1a8 727 goto err2;
96518518 728
e46abbcc
PS		 729 table->name = nla_strdup(name, GFP_KERNEL);
730 if (table->name == NULL)
731 goto err3;
732
96518518 733 INIT_LIST_HEAD(&table->chains);
20a69341 734 INIT_LIST_HEAD(&table->sets);
e5009240 735 INIT_LIST_HEAD(&table->objects);
c5c1f975 736 table->flags = flags;
9ddf6323 737
633c9a84 738 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
55dd6f93 739 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
ffdb210e 740 if (err < 0)
e46abbcc 741 goto err4;
ffdb210e 742
e688a7f8 743 list_add_tail_rcu(&table->list, &afi->tables);
96518518 744 return 0;
e46abbcc
PS		 745err4:
746 kfree(table->name);
ebddf1a8 747err3:
ffdb210e 748 kfree(table);
ebddf1a8 749err2:
ffdb210e 750 module_put(afi->owner);
ebddf1a8 751err1:
ffdb210e 752 return err;
96518518
PM		 753}
754
b9ac12ef
AB		 755static int nft_flush_table(struct nft_ctx *ctx)
756{
757 int err;
758 struct nft_chain *chain, *nc;
e5009240 759 struct nft_object *obj, *ne;
b9ac12ef
AB		 760 struct nft_set *set, *ns;
761
a2f18db0 762 list_for_each_entry(chain, &ctx->table->chains, list) {
664b0f8c
PNA		 763 if (!nft_is_active_next(ctx->net, chain))
764 continue;
765
b9ac12ef
AB		 766 ctx->chain = chain;
767
768 err = nft_delrule_by_chain(ctx);
769 if (err < 0)
770 goto out;
b9ac12ef
AB		 771 }
772
773 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
37a9cc52
PNA		 774 if (!nft_is_active_next(ctx->net, set))
775 continue;
776
b9ac12ef
AB		 777 if (set->flags & NFT_SET_ANONYMOUS &&
778 !list_empty(&set->bindings))
779 continue;
780
781 err = nft_delset(ctx, set);
782 if (err < 0)
783 goto out;
784 }
785
e5009240
PNA		 786 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
787 err = nft_delobj(ctx, obj);
788 if (err < 0)
789 goto out;
790 }
791
a2f18db0 792 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
664b0f8c
PNA		 793 if (!nft_is_active_next(ctx->net, chain))
794 continue;
795
a2f18db0
PNA		 796 ctx->chain = chain;
797
798 err = nft_delchain(ctx);
799 if (err < 0)
800 goto out;
801 }
802
b9ac12ef
AB		 803 err = nft_deltable(ctx);
804out:
805 return err;
806}
807
808static int nft_flush(struct nft_ctx *ctx, int family)
809{
810 struct nft_af_info *afi;
811 struct nft_table *table, *nt;
812 const struct nlattr * const *nla = ctx->nla;
813 int err = 0;
814
815 list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
816 if (family != AF_UNSPEC && afi->family != family)
817 continue;
818
819 ctx->afi = afi;
820 list_for_each_entry_safe(table, nt, &afi->tables, list) {
f2a6d766
PNA		 821 if (!nft_is_active_next(ctx->net, table))
822 continue;
823
b9ac12ef
AB		 824 if (nla[NFTA_TABLE_NAME] &&
825 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
826 continue;
827
828 ctx->table = table;
829
830 err = nft_flush_table(ctx);
831 if (err < 0)
832 goto out;
833 }
834 }
835out:
836 return err;
837}
838
633c9a84
PNA		 839static int nf_tables_deltable(struct net *net, struct sock *nlsk,
840 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 841 const struct nlattr * const nla[],
842 struct netlink_ext_ack *extack)
96518518
PM		 843{
844 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 845 u8 genmask = nft_genmask_next(net);
96518518
PM		 846 struct nft_af_info *afi;
847 struct nft_table *table;
ee01d542 848 int family = nfmsg->nfgen_family;
55dd6f93 849 struct nft_ctx ctx;
96518518 850
633c9a84 851 nft_ctx_init(&ctx, net, skb, nlh, NULL, NULL, NULL, nla);
b9ac12ef
AB		 852 if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
853 return nft_flush(&ctx, family);
854
99633ab2 855 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 856 if (IS_ERR(afi))
857 return PTR_ERR(afi);
858
f2a6d766 859 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME], genmask);
96518518
PM		 860 if (IS_ERR(table))
861 return PTR_ERR(table);
96518518 862
a8278400
PNA		 863 if (nlh->nlmsg_flags & NLM_F_NONREC &&
864 table->use > 0)
865 return -EBUSY;
866
b9ac12ef
AB		 867 ctx.afi = afi;
868 ctx.table = table;
55dd6f93 869
b9ac12ef 870 return nft_flush_table(&ctx);
96518518
PM		 871}
872
55dd6f93
PNA		 873static void nf_tables_table_destroy(struct nft_ctx *ctx)
874{
4fefee57
PNA		 875 BUG_ON(ctx->table->use > 0);
876
e46abbcc 877 kfree(ctx->table->name);
55dd6f93
PNA		 878 kfree(ctx->table);
879 module_put(ctx->afi->owner);
880}
881
2a37d755 882int nft_register_chain_type(const struct nf_chain_type *ctype)
96518518 883{
9370761c 884 int err = 0;
96518518 885
d8297d4f
FW		 886 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
887 return -EINVAL;
888
96518518 889 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c
PNA		 890 if (chain_type[ctype->family][ctype->type] != NULL) {
891 err = -EBUSY;
892 goto out;
96518518 893 }
9370761c
PNA		 894 chain_type[ctype->family][ctype->type] = ctype;
895out:
96518518
PM		 896 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
897 return err;
898}
9370761c 899EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 900
2a37d755 901void nft_unregister_chain_type(const struct nf_chain_type *ctype)
96518518 902{
96518518 903 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 904 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 905 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
906}
9370761c 907EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 908
909/*
910 * Chains
911 */
912
913static struct nft_chain *
664b0f8c
PNA		 914nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
915 u8 genmask)
96518518
PM		 916{
917 struct nft_chain *chain;
918
919 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 920 if (chain->handle == handle &&
921 nft_active_genmask(chain, genmask))
96518518
PM		 922 return chain;
923 }
924
925 return ERR_PTR(-ENOENT);
926}
927
928static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
664b0f8c
PNA		 929 const struct nlattr *nla,
930 u8 genmask)
96518518
PM		 931{
932 struct nft_chain *chain;
933
934 if (nla == NULL)
935 return ERR_PTR(-EINVAL);
936
937 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 938 if (!nla_strcmp(nla, chain->name) &&
939 nft_active_genmask(chain, genmask))
96518518
PM		 940 return chain;
941 }
942
943 return ERR_PTR(-ENOENT);
944}
945
946static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
b2fbd044
LZ		 947 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
948 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 949 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
950 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
951 .len = NFT_CHAIN_MAXNAMELEN - 1 },
952 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 953 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 954 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 955 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 956};
957
958static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
959 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
960 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
2cbce139
PNA		 961 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
962 .len = IFNAMSIZ - 1 },
96518518
PM		 963};
964
0ca743a5
PNA		 965static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
966{
967 struct nft_stats *cpu_stats, total;
968 struct nlattr *nest;
ce355e20
ED		 969 unsigned int seq;
970 u64 pkts, bytes;
0ca743a5
PNA		 971 int cpu;
972
973 memset(&total, 0, sizeof(total));
974 for_each_possible_cpu(cpu) {
975 cpu_stats = per_cpu_ptr(stats, cpu);
ce355e20
ED		 976 do {
977 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
978 pkts = cpu_stats->pkts;
979 bytes = cpu_stats->bytes;
980 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
981 total.pkts += pkts;
982 total.bytes += bytes;
0ca743a5
PNA		 983 }
984 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
985 if (nest == NULL)
986 goto nla_put_failure;
987
b46f6ded
ND		 988 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
989 NFTA_COUNTER_PAD) ||
990 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
991 NFTA_COUNTER_PAD))
0ca743a5
PNA		 992 goto nla_put_failure;
993
994 nla_nest_end(skb, nest);
995 return 0;
996
997nla_put_failure:
998 return -ENOSPC;
999}
1000
84d7fce6
PNA		 1001static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1002 u32 portid, u32 seq, int event, u32 flags,
1003 int family, const struct nft_table *table,
96518518
PM		 1004 const struct nft_chain *chain)
1005{
1006 struct nlmsghdr *nlh;
1007 struct nfgenmsg *nfmsg;
1008
dedb67c4 1009 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518
PM		 1010 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1011 if (nlh == NULL)
1012 goto nla_put_failure;
1013
1014 nfmsg = nlmsg_data(nlh);
1015 nfmsg->nfgen_family = family;
1016 nfmsg->version = NFNETLINK_V0;
84d7fce6 1017 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1018
1019 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1020 goto nla_put_failure;
b46f6ded
ND		 1021 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1022 NFTA_CHAIN_PAD))
96518518
PM		 1023 goto nla_put_failure;
1024 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1025 goto nla_put_failure;
1026
f323d954 1027 if (nft_is_base_chain(chain)) {
0ca743a5 1028 const struct nft_base_chain *basechain = nft_base_chain(chain);
115a60b1 1029 const struct nf_hook_ops *ops = &basechain->ops[0];
0ca743a5
PNA		 1030 struct nlattr *nest;
1031
1032 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 1033 if (nest == NULL)
1034 goto nla_put_failure;
1035 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1036 goto nla_put_failure;
1037 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1038 goto nla_put_failure;
2cbce139
PNA		 1039 if (basechain->dev_name[0] &&
1040 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1041 goto nla_put_failure;
96518518 1042 nla_nest_end(skb, nest);
9370761c 1043
0ca743a5
PNA		 1044 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1045 htonl(basechain->policy)))
1046 goto nla_put_failure;
1047
baae3e62
PM		 1048 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1049 goto nla_put_failure;
0ca743a5 1050
5f9bfe0e 1051 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
0ca743a5 1052 goto nla_put_failure;
96518518
PM		 1053 }
1054
0ca743a5
PNA		 1055 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1056 goto nla_put_failure;
1057
053c095a
JB		 1058 nlmsg_end(skb, nlh);
1059 return 0;
96518518
PM		 1060
1061nla_put_failure:
1062 nlmsg_trim(skb, nlh);
1063 return -1;
1064}
1065
25e94a99 1066static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
96518518
PM		 1067{
1068 struct sk_buff *skb;
96518518
PM		 1069 int err;
1070
128ad332
PNA		 1071 if (!ctx->report &&
1072 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 1073 return;
96518518 1074
96518518
PM		 1075 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1076 if (skb == NULL)
1077 goto err;
1078
84d7fce6
PNA		 1079 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1080 event, 0, ctx->afi->family, ctx->table,
35151d84 1081 ctx->chain);
96518518
PM		 1082 if (err < 0) {
1083 kfree_skb(skb);
1084 goto err;
1085 }
1086
25e94a99
PNA		 1087 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1088 ctx->report, GFP_KERNEL);
1089 return;
96518518 1090err:
25e94a99 1091 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 1092}
1093
1094static int nf_tables_dump_chains(struct sk_buff *skb,
1095 struct netlink_callback *cb)
1096{
1097 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1098 const struct nft_af_info *afi;
1099 const struct nft_table *table;
1100 const struct nft_chain *chain;
1101 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1102 struct net *net = sock_net(skb->sk);
96518518
PM		 1103 int family = nfmsg->nfgen_family;
1104
e688a7f8 1105 rcu_read_lock();
38e029f1
PNA		 1106 cb->seq = net->nft.base_seq;
1107
e688a7f8 1108 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 1109 if (family != NFPROTO_UNSPEC && family != afi->family)
1110 continue;
1111
e688a7f8
PNA		 1112 list_for_each_entry_rcu(table, &afi->tables, list) {
1113 list_for_each_entry_rcu(chain, &table->chains, list) {
96518518
PM		 1114 if (idx < s_idx)
1115 goto cont;
1116 if (idx > s_idx)
1117 memset(&cb->args[1], 0,
1118 sizeof(cb->args) - sizeof(cb->args[0]));
664b0f8c
PNA		 1119 if (!nft_is_active(net, chain))
1120 continue;
84d7fce6
PNA		 1121 if (nf_tables_fill_chain_info(skb, net,
1122 NETLINK_CB(cb->skb).portid,
96518518
PM		 1123 cb->nlh->nlmsg_seq,
1124 NFT_MSG_NEWCHAIN,
1125 NLM_F_MULTI,
1126 afi->family, table, chain) < 0)
1127 goto done;
38e029f1
PNA		 1128
1129 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 1130cont:
1131 idx++;
1132 }
1133 }
1134 }
1135done:
e688a7f8 1136 rcu_read_unlock();
96518518
PM		 1137 cb->args[0] = idx;
1138 return skb->len;
1139}
1140
7b8002a1
PNA		 1141static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1142 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1143 const struct nlattr * const nla[],
1144 struct netlink_ext_ack *extack)
96518518
PM		 1145{
1146 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1147 u8 genmask = nft_genmask_cur(net);
96518518
PM		 1148 const struct nft_af_info *afi;
1149 const struct nft_table *table;
1150 const struct nft_chain *chain;
1151 struct sk_buff *skb2;
1152 int family = nfmsg->nfgen_family;
1153 int err;
1154
1155 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1156 struct netlink_dump_control c = {
1157 .dump = nf_tables_dump_chains,
1158 };
1159 return netlink_dump_start(nlsk, skb, nlh, &c);
1160 }
1161
99633ab2 1162 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1163 if (IS_ERR(afi))
1164 return PTR_ERR(afi);
1165
f2a6d766 1166 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1167 if (IS_ERR(table))
1168 return PTR_ERR(table);
1169
664b0f8c 1170 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
96518518
PM		 1171 if (IS_ERR(chain))
1172 return PTR_ERR(chain);
1173
1174 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1175 if (!skb2)
1176 return -ENOMEM;
1177
84d7fce6 1178 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 1179 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1180 family, table, chain);
1181 if (err < 0)
1182 goto err;
1183
1184 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1185
1186err:
1187 kfree_skb(skb2);
1188 return err;
1189}
1190
0ca743a5
PNA		 1191static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1192 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1193 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1194};
1195
ff3cd7b3 1196static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
0ca743a5
PNA		 1197{
1198 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1199 struct nft_stats __percpu *newstats;
1200 struct nft_stats *stats;
1201 int err;
1202
fceb6435
JB		 1203 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1204 NULL);
0ca743a5 1205 if (err < 0)
ff3cd7b3 1206 return ERR_PTR(err);
0ca743a5
PNA		 1207
1208 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
ff3cd7b3 1209 return ERR_PTR(-EINVAL);
0ca743a5 1210
ce355e20 1211 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
0ca743a5 1212 if (newstats == NULL)
ff3cd7b3 1213 return ERR_PTR(-ENOMEM);
0ca743a5
PNA		 1214
1215 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1216 * are not exposed to userspace.
1217 */
e8781f70 1218 preempt_disable();
0ca743a5
PNA		 1219 stats = this_cpu_ptr(newstats);
1220 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1221 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
e8781f70 1222 preempt_enable();
0ca743a5 1223
ff3cd7b3
PNA		 1224 return newstats;
1225}
1226
1227static void nft_chain_stats_replace(struct nft_base_chain *chain,
1228 struct nft_stats __percpu *newstats)
1229{
b88825de
PNA		 1230 if (newstats == NULL)
1231 return;
1232
0ca743a5 1233 if (chain->stats) {
0ca743a5 1234 struct nft_stats __percpu *oldstats =
67a8fc27 1235 nft_dereference(chain->stats);
0ca743a5
PNA		 1236
1237 rcu_assign_pointer(chain->stats, newstats);
1238 synchronize_rcu();
1239 free_percpu(oldstats);
1240 } else
1241 rcu_assign_pointer(chain->stats, newstats);
0ca743a5
PNA		 1242}
1243
91c7b38d
PNA		 1244static void nf_tables_chain_destroy(struct nft_chain *chain)
1245{
1246 BUG_ON(chain->use > 0);
1247
f323d954 1248 if (nft_is_base_chain(chain)) {
2cbce139
PNA		 1249 struct nft_base_chain *basechain = nft_base_chain(chain);
1250
1251 module_put(basechain->type->owner);
1252 free_percpu(basechain->stats);
9f08ea84
PNA		 1253 if (basechain->stats)
1254 static_branch_dec(&nft_counters_enabled);
2cbce139
PNA		 1255 if (basechain->ops[0].dev != NULL)
1256 dev_put(basechain->ops[0].dev);
b7263e07 1257 kfree(chain->name);
2cbce139 1258 kfree(basechain);
91c7b38d 1259 } else {
b7263e07 1260 kfree(chain->name);
91c7b38d
PNA		 1261 kfree(chain);
1262 }
1263}
1264
508f8ccd
PNA		 1265struct nft_chain_hook {
1266 u32 num;
1267 u32 priority;
1268 const struct nf_chain_type *type;
1269 struct net_device *dev;
1270};
1271
1272static int nft_chain_parse_hook(struct net *net,
1273 const struct nlattr * const nla[],
1274 struct nft_af_info *afi,
1275 struct nft_chain_hook *hook, bool create)
1276{
1277 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1278 const struct nf_chain_type *type;
1279 struct net_device *dev;
1280 int err;
1281
1282 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
fceb6435 1283 nft_hook_policy, NULL);
508f8ccd
PNA		 1284 if (err < 0)
1285 return err;
1286
1287 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1288 ha[NFTA_HOOK_PRIORITY] == NULL)
1289 return -EINVAL;
1290
1291 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1292 if (hook->num >= afi->nhooks)
1293 return -EINVAL;
1294
1295 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1296
1297 type = chain_type[afi->family][NFT_CHAIN_T_DEFAULT];
1298 if (nla[NFTA_CHAIN_TYPE]) {
1299 type = nf_tables_chain_type_lookup(afi, nla[NFTA_CHAIN_TYPE],
1300 create);
1301 if (IS_ERR(type))
1302 return PTR_ERR(type);
1303 }
1304 if (!(type->hook_mask & (1 << hook->num)))
1305 return -EOPNOTSUPP;
1306 if (!try_module_get(type->owner))
1307 return -ENOENT;
1308
1309 hook->type = type;
1310
1311 hook->dev = NULL;
1312 if (afi->flags & NFT_AF_NEEDS_DEV) {
1313 char ifname[IFNAMSIZ];
1314
1315 if (!ha[NFTA_HOOK_DEV]) {
1316 module_put(type->owner);
1317 return -EOPNOTSUPP;
1318 }
1319
1320 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1321 dev = dev_get_by_name(net, ifname);
1322 if (!dev) {
1323 module_put(type->owner);
1324 return -ENOENT;
1325 }
1326 hook->dev = dev;
1327 } else if (ha[NFTA_HOOK_DEV]) {
1328 module_put(type->owner);
1329 return -EOPNOTSUPP;
1330 }
1331
1332 return 0;
1333}
1334
1335static void nft_chain_release_hook(struct nft_chain_hook *hook)
1336{
1337 module_put(hook->type->owner);
1338 if (hook->dev != NULL)
1339 dev_put(hook->dev);
1340}
1341
4035285f
PNA		 1342static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1343 u8 policy, bool create)
1344{
1345 const struct nlattr * const *nla = ctx->nla;
1346 struct nft_table *table = ctx->table;
1347 struct nft_af_info *afi = ctx->afi;
1348 struct nft_base_chain *basechain;
1349 struct nft_stats __percpu *stats;
1350 struct net *net = ctx->net;
1351 struct nft_chain *chain;
1352 unsigned int i;
1353 int err;
1354
1355 if (table->use == UINT_MAX)
1356 return -EOVERFLOW;
1357
1358 if (nla[NFTA_CHAIN_HOOK]) {
1359 struct nft_chain_hook hook;
1360 struct nf_hook_ops *ops;
1361 nf_hookfn *hookfn;
1362
1363 err = nft_chain_parse_hook(net, nla, afi, &hook, create);
1364 if (err < 0)
1365 return err;
1366
1367 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1368 if (basechain == NULL) {
1369 nft_chain_release_hook(&hook);
1370 return -ENOMEM;
1371 }
1372
1373 if (hook.dev != NULL)
1374 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1375
1376 if (nla[NFTA_CHAIN_COUNTERS]) {
1377 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1378 if (IS_ERR(stats)) {
1379 nft_chain_release_hook(&hook);
1380 kfree(basechain);
1381 return PTR_ERR(stats);
1382 }
1383 basechain->stats = stats;
1384 static_branch_inc(&nft_counters_enabled);
1385 }
1386
1387 hookfn = hook.type->hooks[hook.num];
1388 basechain->type = hook.type;
1389 chain = &basechain->chain;
1390
1391 for (i = 0; i < afi->nops; i++) {
1392 ops = &basechain->ops[i];
1393 ops->pf = family;
1394 ops->hooknum = hook.num;
1395 ops->priority = hook.priority;
1396 ops->priv = chain;
1397 ops->hook = afi->hooks[ops->hooknum];
1398 ops->dev = hook.dev;
1399 if (hookfn)
1400 ops->hook = hookfn;
1401 if (afi->hook_ops_init)
1402 afi->hook_ops_init(ops, i);
1403 }
1404
1405 chain->flags |= NFT_BASE_CHAIN;
1406 basechain->policy = policy;
1407 } else {
1408 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1409 if (chain == NULL)
1410 return -ENOMEM;
1411 }
1412 INIT_LIST_HEAD(&chain->rules);
1413 chain->handle = nf_tables_alloc_handle(table);
1414 chain->table = table;
1415 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1416 if (!chain->name) {
1417 err = -ENOMEM;
1418 goto err1;
1419 }
1420
1421 err = nf_tables_register_hooks(net, table, chain, afi->nops);
1422 if (err < 0)
1423 goto err1;
1424
1425 ctx->chain = chain;
1426 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1427 if (err < 0)
1428 goto err2;
1429
1430 table->use++;
1431 list_add_tail_rcu(&chain->list, &table->chains);
1432
1433 return 0;
1434err2:
1435 nf_tables_unregister_hooks(net, table, chain, afi->nops);
1436err1:
1437 nf_tables_chain_destroy(chain);
1438
1439 return err;
1440}
1441
2c4a488a
PNA		 1442static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1443 bool create)
1444{
1445 const struct nlattr * const *nla = ctx->nla;
1446 struct nft_table *table = ctx->table;
1447 struct nft_chain *chain = ctx->chain;
1448 struct nft_af_info *afi = ctx->afi;
1449 struct nft_base_chain *basechain;
1450 struct nft_stats *stats = NULL;
1451 struct nft_chain_hook hook;
1452 const struct nlattr *name;
1453 struct nf_hook_ops *ops;
1454 struct nft_trans *trans;
1455 int err, i;
1456
1457 if (nla[NFTA_CHAIN_HOOK]) {
1458 if (!nft_is_base_chain(chain))
1459 return -EBUSY;
1460
1461 err = nft_chain_parse_hook(ctx->net, nla, ctx->afi, &hook,
1462 create);
1463 if (err < 0)
1464 return err;
1465
1466 basechain = nft_base_chain(chain);
1467 if (basechain->type != hook.type) {
1468 nft_chain_release_hook(&hook);
1469 return -EBUSY;
1470 }
1471
1472 for (i = 0; i < afi->nops; i++) {
1473 ops = &basechain->ops[i];
1474 if (ops->hooknum != hook.num ||
1475 ops->priority != hook.priority ||
1476 ops->dev != hook.dev) {
1477 nft_chain_release_hook(&hook);
1478 return -EBUSY;
1479 }
1480 }
1481 nft_chain_release_hook(&hook);
1482 }
1483
1484 if (nla[NFTA_CHAIN_HANDLE] &&
1485 nla[NFTA_CHAIN_NAME]) {
1486 struct nft_chain *chain2;
1487
1488 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
1489 genmask);
0d18779b
JC		 1490 if (!IS_ERR(chain2))
1491 return -EEXIST;
2c4a488a
PNA		 1492 }
1493
1494 if (nla[NFTA_CHAIN_COUNTERS]) {
1495 if (!nft_is_base_chain(chain))
1496 return -EOPNOTSUPP;
1497
1498 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1499 if (IS_ERR(stats))
1500 return PTR_ERR(stats);
1501 }
1502
1503 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1504 sizeof(struct nft_trans_chain));
1505 if (trans == NULL) {
1506 free_percpu(stats);
1507 return -ENOMEM;
1508 }
1509
1510 nft_trans_chain_stats(trans) = stats;
1511 nft_trans_chain_update(trans) = true;
1512
1513 if (nla[NFTA_CHAIN_POLICY])
1514 nft_trans_chain_policy(trans) = policy;
1515 else
1516 nft_trans_chain_policy(trans) = -1;
1517
1518 name = nla[NFTA_CHAIN_NAME];
1519 if (nla[NFTA_CHAIN_HANDLE] && name) {
1520 nft_trans_chain_name(trans) =
1521 nla_strdup(name, GFP_KERNEL);
1522 if (!nft_trans_chain_name(trans)) {
1523 kfree(trans);
1524 free_percpu(stats);
1525 return -ENOMEM;
1526 }
1527 }
1528 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1529
1530 return 0;
1531}
1532
633c9a84
PNA		 1533static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1534 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1535 const struct nlattr * const nla[],
1536 struct netlink_ext_ack *extack)
96518518
PM		 1537{
1538 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1539 const struct nlattr * uninitialized_var(name);
4035285f
PNA		 1540 u8 genmask = nft_genmask_next(net);
1541 int family = nfmsg->nfgen_family;
7c95f6d8 1542 struct nft_af_info *afi;
96518518
PM		 1543 struct nft_table *table;
1544 struct nft_chain *chain;
57de2a0c 1545 u8 policy = NF_ACCEPT;
4035285f 1546 struct nft_ctx ctx;
96518518 1547 u64 handle = 0;
96518518
PM		 1548 bool create;
1549
1550 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1551
99633ab2 1552 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 1553 if (IS_ERR(afi))
1554 return PTR_ERR(afi);
1555
f2a6d766 1556 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1557 if (IS_ERR(table))
1558 return PTR_ERR(table);
1559
96518518
PM		 1560 chain = NULL;
1561 name = nla[NFTA_CHAIN_NAME];
1562
1563 if (nla[NFTA_CHAIN_HANDLE]) {
1564 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
664b0f8c 1565 chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
96518518
PM		 1566 if (IS_ERR(chain))
1567 return PTR_ERR(chain);
1568 } else {
664b0f8c 1569 chain = nf_tables_chain_lookup(table, name, genmask);
96518518
PM		 1570 if (IS_ERR(chain)) {
1571 if (PTR_ERR(chain) != -ENOENT)
1572 return PTR_ERR(chain);
1573 chain = NULL;
1574 }
1575 }
1576
57de2a0c 1577 if (nla[NFTA_CHAIN_POLICY]) {
f323d954
PNA		 1578 if (chain != NULL &&
1579 !nft_is_base_chain(chain))
d6b6cb1d
PNA		 1580 return -EOPNOTSUPP;
1581
1582 if (chain == NULL &&
57de2a0c
PM		 1583 nla[NFTA_CHAIN_HOOK] == NULL)
1584 return -EOPNOTSUPP;
1585
8f46df18 1586 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 1587 switch (policy) {
1588 case NF_DROP:
1589 case NF_ACCEPT:
1590 break;
1591 default:
1592 return -EINVAL;
1593 }
1594 }
1595
4035285f
PNA		 1596 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
1597
96518518
PM		 1598 if (chain != NULL) {
1599 if (nlh->nlmsg_flags & NLM_F_EXCL)
1600 return -EEXIST;
1601 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1602 return -EOPNOTSUPP;
1603
2c4a488a 1604 return nf_tables_updchain(&ctx, genmask, policy, create);
96518518
PM		 1605 }
1606
4035285f 1607 return nf_tables_addchain(&ctx, family, genmask, policy, create);
96518518
PM		 1608}
1609
633c9a84
PNA		 1610static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1611 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 1612 const struct nlattr * const nla[],
1613 struct netlink_ext_ack *extack)
96518518
PM		 1614{
1615 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 1616 u8 genmask = nft_genmask_next(net);
7c95f6d8 1617 struct nft_af_info *afi;
96518518
PM		 1618 struct nft_table *table;
1619 struct nft_chain *chain;
9dee1474 1620 struct nft_rule *rule;
96518518 1621 int family = nfmsg->nfgen_family;
91c7b38d 1622 struct nft_ctx ctx;
9dee1474
PNA		 1623 u32 use;
1624 int err;
96518518 1625
99633ab2 1626 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1627 if (IS_ERR(afi))
1628 return PTR_ERR(afi);
1629
f2a6d766 1630 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE], genmask);
96518518
PM		 1631 if (IS_ERR(table))
1632 return PTR_ERR(table);
1633
664b0f8c 1634 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
96518518
PM		 1635 if (IS_ERR(chain))
1636 return PTR_ERR(chain);
9dee1474
PNA		 1637
1638 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1639 chain->use > 0)
96518518
PM		 1640 return -EBUSY;
1641
633c9a84 1642 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0165d932 1643
9dee1474
PNA		 1644 use = chain->use;
1645 list_for_each_entry(rule, &chain->rules, list) {
1646 if (!nft_is_active_next(net, rule))
1647 continue;
1648 use--;
1649
1650 err = nft_delrule(&ctx, rule);
1651 if (err < 0)
1652 return err;
1653 }
1654
1655 /* There are rules and elements that are still holding references to us,
1656 * we cannot do a recursive removal in this case.
1657 */
1658 if (use > 0)
1659 return -EBUSY;
1660
ee01d542 1661 return nft_delchain(&ctx);
96518518
PM		 1662}
1663
96518518
PM		 1664/*
1665 * Expressions
1666 */
1667
1668/**
ef1f7df9
PM		 1669 * nft_register_expr - register nf_tables expr type
1670 * @ops: expr type
96518518 1671 *
ef1f7df9 1672 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1673 * success or a negative errno code otherwise.
1674 */
ef1f7df9 1675int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1676{
1677 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec 1678 if (type->family == NFPROTO_UNSPEC)
e688a7f8 1679 list_add_tail_rcu(&type->list, &nf_tables_expressions);
758dbcec 1680 else
e688a7f8 1681 list_add_rcu(&type->list, &nf_tables_expressions);
96518518
PM		 1682 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1683 return 0;
1684}
1685EXPORT_SYMBOL_GPL(nft_register_expr);
1686
1687/**
ef1f7df9
PM		 1688 * nft_unregister_expr - unregister nf_tables expr type
1689 * @ops: expr type
96518518 1690 *
ef1f7df9 1691 * Unregisters the expr typefor use with nf_tables.
96518518 1692 */
ef1f7df9 1693void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1694{
1695 nfnl_lock(NFNL_SUBSYS_NFTABLES);
e688a7f8 1696 list_del_rcu(&type->list);
96518518
PM		 1697 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1698}
1699EXPORT_SYMBOL_GPL(nft_unregister_expr);
1700
64d46806
PM		 1701static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1702 struct nlattr *nla)
96518518 1703{
ef1f7df9 1704 const struct nft_expr_type *type;
96518518 1705
ef1f7df9 1706 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1707 if (!nla_strcmp(nla, type->name) &&
1708 (!type->family || type->family == family))
ef1f7df9 1709 return type;
96518518
PM		 1710 }
1711 return NULL;
1712}
1713
64d46806
PM		 1714static const struct nft_expr_type *nft_expr_type_get(u8 family,
1715 struct nlattr *nla)
96518518 1716{
ef1f7df9 1717 const struct nft_expr_type *type;
96518518
PM		 1718
1719 if (nla == NULL)
1720 return ERR_PTR(-EINVAL);
1721
64d46806 1722 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1723 if (type != NULL && try_module_get(type->owner))
1724 return type;
96518518
PM		 1725
1726#ifdef CONFIG_MODULES
ef1f7df9 1727 if (type == NULL) {
64d46806
PM		 1728 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1729 request_module("nft-expr-%u-%.*s", family,
1730 nla_len(nla), (char *)nla_data(nla));
1731 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1732 if (__nft_expr_type_get(family, nla))
1733 return ERR_PTR(-EAGAIN);
1734
96518518
PM		 1735 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1736 request_module("nft-expr-%.*s",
1737 nla_len(nla), (char *)nla_data(nla));
1738 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1739 if (__nft_expr_type_get(family, nla))
96518518
PM		 1740 return ERR_PTR(-EAGAIN);
1741 }
1742#endif
1743 return ERR_PTR(-ENOENT);
1744}
1745
1746static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1747 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1748 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1749};
1750
1751static int nf_tables_fill_expr_info(struct sk_buff *skb,
1752 const struct nft_expr *expr)
1753{
ef1f7df9 1754 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1755 goto nla_put_failure;
1756
1757 if (expr->ops->dump) {
1758 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1759 if (data == NULL)
1760 goto nla_put_failure;
1761 if (expr->ops->dump(skb, expr) < 0)
1762 goto nla_put_failure;
1763 nla_nest_end(skb, data);
1764 }
1765
1766 return skb->len;
1767
1768nla_put_failure:
1769 return -1;
1770};
1771
0b2d8a7b
PM		 1772int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1773 const struct nft_expr *expr)
1774{
1775 struct nlattr *nest;
1776
1777 nest = nla_nest_start(skb, attr);
1778 if (!nest)
1779 goto nla_put_failure;
1780 if (nf_tables_fill_expr_info(skb, expr) < 0)
1781 goto nla_put_failure;
1782 nla_nest_end(skb, nest);
1783 return 0;
1784
1785nla_put_failure:
1786 return -1;
1787}
1788
96518518
PM		 1789struct nft_expr_info {
1790 const struct nft_expr_ops *ops;
ef1f7df9 1791 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1792};
1793
0ca743a5
PNA		 1794static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1795 const struct nlattr *nla,
96518518
PM		 1796 struct nft_expr_info *info)
1797{
ef1f7df9 1798 const struct nft_expr_type *type;
96518518 1799 const struct nft_expr_ops *ops;
ef1f7df9 1800 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1801 int err;
1802
fceb6435 1803 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
96518518
PM		 1804 if (err < 0)
1805 return err;
1806
64d46806 1807 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1808 if (IS_ERR(type))
1809 return PTR_ERR(type);
1810
1811 if (tb[NFTA_EXPR_DATA]) {
1812 err = nla_parse_nested(info->tb, type->maxattr,
fceb6435 1813 tb[NFTA_EXPR_DATA], type->policy, NULL);
ef1f7df9
PM		 1814 if (err < 0)
1815 goto err1;
1816 } else
1817 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1818
1819 if (type->select_ops != NULL) {
0ca743a5
PNA		 1820 ops = type->select_ops(ctx,
1821 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1822 if (IS_ERR(ops)) {
1823 err = PTR_ERR(ops);
1824 goto err1;
1825 }
1826 } else
1827 ops = type->ops;
1828
96518518
PM		 1829 info->ops = ops;
1830 return 0;
ef1f7df9
PM		 1831
1832err1:
1833 module_put(type->owner);
1834 return err;
96518518
PM		 1835}
1836
1837static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1838 const struct nft_expr_info *info,
96518518
PM		 1839 struct nft_expr *expr)
1840{
1841 const struct nft_expr_ops *ops = info->ops;
1842 int err;
1843
1844 expr->ops = ops;
1845 if (ops->init) {
ef1f7df9 1846 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1847 if (err < 0)
1848 goto err1;
1849 }
1850
c56e3956
LZ		 1851 if (ops->validate) {
1852 const struct nft_data *data = NULL;
1853
1854 err = ops->validate(ctx, expr, &data);
1855 if (err < 0)
1856 goto err2;
1857 }
1858
96518518
PM		 1859 return 0;
1860
c56e3956
LZ		 1861err2:
1862 if (ops->destroy)
1863 ops->destroy(ctx, expr);
96518518
PM		 1864err1:
1865 expr->ops = NULL;
1866 return err;
1867}
1868
62472bce
PM		 1869static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1870 struct nft_expr *expr)
96518518
PM		 1871{
1872 if (expr->ops->destroy)
62472bce 1873 expr->ops->destroy(ctx, expr);
ef1f7df9 1874 module_put(expr->ops->type->owner);
96518518
PM		 1875}
1876
0b2d8a7b
PM		 1877struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1878 const struct nlattr *nla)
1879{
1880 struct nft_expr_info info;
1881 struct nft_expr *expr;
1882 int err;
1883
1884 err = nf_tables_expr_parse(ctx, nla, &info);
1885 if (err < 0)
1886 goto err1;
1887
1888 err = -ENOMEM;
1889 expr = kzalloc(info.ops->size, GFP_KERNEL);
1890 if (expr == NULL)
1891 goto err2;
1892
1893 err = nf_tables_newexpr(ctx, &info, expr);
1894 if (err < 0)
6cafaf47 1895 goto err3;
0b2d8a7b
PM		 1896
1897 return expr;
6cafaf47
LZ		 1898err3:
1899 kfree(expr);
0b2d8a7b
PM		 1900err2:
1901 module_put(info.ops->type->owner);
1902err1:
1903 return ERR_PTR(err);
1904}
1905
1906void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1907{
1908 nf_tables_expr_destroy(ctx, expr);
1909 kfree(expr);
1910}
1911
96518518
PM		 1912/*
1913 * Rules
1914 */
1915
1916static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1917 u64 handle)
1918{
1919 struct nft_rule *rule;
1920
1921 // FIXME: this sucks
1922 list_for_each_entry(rule, &chain->rules, list) {
1923 if (handle == rule->handle)
1924 return rule;
1925 }
1926
1927 return ERR_PTR(-ENOENT);
1928}
1929
1930static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1931 const struct nlattr *nla)
1932{
1933 if (nla == NULL)
1934 return ERR_PTR(-EINVAL);
1935
1936 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1937}
1938
1939static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
b2fbd044
LZ		 1940 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
1941 .len = NFT_TABLE_MAXNAMELEN - 1 },
96518518
PM		 1942 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1943 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1944 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1945 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1946 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1947 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1948 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1949 .len = NFT_USERDATA_MAXLEN },
96518518
PM		 1950};
1951
84d7fce6
PNA		 1952static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1953 u32 portid, u32 seq, int event,
1954 u32 flags, int family,
96518518
PM		 1955 const struct nft_table *table,
1956 const struct nft_chain *chain,
1957 const struct nft_rule *rule)
1958{
1959 struct nlmsghdr *nlh;
1960 struct nfgenmsg *nfmsg;
1961 const struct nft_expr *expr, *next;
1962 struct nlattr *list;
5e948466 1963 const struct nft_rule *prule;
dedb67c4 1964 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
96518518 1965
dedb67c4 1966 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
96518518
PM		 1967 if (nlh == NULL)
1968 goto nla_put_failure;
1969
1970 nfmsg = nlmsg_data(nlh);
1971 nfmsg->nfgen_family = family;
1972 nfmsg->version = NFNETLINK_V0;
84d7fce6 1973 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
96518518
PM		 1974
1975 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1976 goto nla_put_failure;
1977 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1978 goto nla_put_failure;
b46f6ded
ND		 1979 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
1980 NFTA_RULE_PAD))
96518518
PM		 1981 goto nla_put_failure;
1982
5e948466 1983 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
cbbb40e2 1984 prule = list_prev_entry(rule, list);
5e948466 1985 if (nla_put_be64(skb, NFTA_RULE_POSITION,
b46f6ded
ND		 1986 cpu_to_be64(prule->handle),
1987 NFTA_RULE_PAD))
5e948466
EL		 1988 goto nla_put_failure;
1989 }
1990
96518518
PM		 1991 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1992 if (list == NULL)
1993 goto nla_put_failure;
1994 nft_rule_for_each_expr(expr, next, rule) {
0b2d8a7b 1995 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
96518518 1996 goto nla_put_failure;
96518518
PM		 1997 }
1998 nla_nest_end(skb, list);
1999
86f1ec32
PM		 2000 if (rule->udata) {
2001 struct nft_userdata *udata = nft_userdata(rule);
2002 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2003 udata->data) < 0)
2004 goto nla_put_failure;
2005 }
0768b3b3 2006
053c095a
JB		 2007 nlmsg_end(skb, nlh);
2008 return 0;
96518518
PM		 2009
2010nla_put_failure:
2011 nlmsg_trim(skb, nlh);
2012 return -1;
2013}
2014
25e94a99
PNA		 2015static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2016 const struct nft_rule *rule, int event)
96518518
PM		 2017{
2018 struct sk_buff *skb;
96518518
PM		 2019 int err;
2020
128ad332
PNA		 2021 if (!ctx->report &&
2022 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2023 return;
96518518 2024
96518518
PM		 2025 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2026 if (skb == NULL)
2027 goto err;
2028
84d7fce6
PNA		 2029 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2030 event, 0, ctx->afi->family, ctx->table,
35151d84 2031 ctx->chain, rule);
96518518
PM		 2032 if (err < 0) {
2033 kfree_skb(skb);
2034 goto err;
2035 }
2036
25e94a99
PNA		 2037 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2038 ctx->report, GFP_KERNEL);
2039 return;
96518518 2040err:
25e94a99 2041 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
96518518
PM		 2042}
2043
6e1f760e 2044struct nft_rule_dump_ctx {
e46abbcc 2045 char *table;
b7263e07 2046 char *chain;
6e1f760e
PNA		 2047};
2048
96518518
PM		 2049static int nf_tables_dump_rules(struct sk_buff *skb,
2050 struct netlink_callback *cb)
2051{
2052 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6e1f760e 2053 const struct nft_rule_dump_ctx *ctx = cb->data;
96518518
PM		 2054 const struct nft_af_info *afi;
2055 const struct nft_table *table;
2056 const struct nft_chain *chain;
2057 const struct nft_rule *rule;
2058 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 2059 struct net *net = sock_net(skb->sk);
96518518
PM		 2060 int family = nfmsg->nfgen_family;
2061
e688a7f8 2062 rcu_read_lock();
38e029f1
PNA		 2063 cb->seq = net->nft.base_seq;
2064
e688a7f8 2065 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
96518518
PM		 2066 if (family != NFPROTO_UNSPEC && family != afi->family)
2067 continue;
2068
e688a7f8 2069 list_for_each_entry_rcu(table, &afi->tables, list) {
e46abbcc 2070 if (ctx && ctx->table &&
6e1f760e
PNA		 2071 strcmp(ctx->table, table->name) != 0)
2072 continue;
2073
e688a7f8 2074 list_for_each_entry_rcu(chain, &table->chains, list) {
e2f52fa3 2075 if (ctx && ctx->chain &&
6e1f760e
PNA		 2076 strcmp(ctx->chain, chain->name) != 0)
2077 continue;
2078
e688a7f8 2079 list_for_each_entry_rcu(rule, &chain->rules, list) {
889f7ee7 2080 if (!nft_is_active(net, rule))
0628b123 2081 goto cont;
96518518
PM		 2082 if (idx < s_idx)
2083 goto cont;
2084 if (idx > s_idx)
2085 memset(&cb->args[1], 0,
2086 sizeof(cb->args) - sizeof(cb->args[0]));
84d7fce6 2087 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
96518518
PM		 2088 cb->nlh->nlmsg_seq,
2089 NFT_MSG_NEWRULE,
2090 NLM_F_MULTI | NLM_F_APPEND,
2091 afi->family, table, chain, rule) < 0)
2092 goto done;
38e029f1
PNA		 2093
2094 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
96518518
PM		 2095cont:
2096 idx++;
2097 }
2098 }
2099 }
2100 }
2101done:
e688a7f8
PNA		 2102 rcu_read_unlock();
2103
96518518
PM		 2104 cb->args[0] = idx;
2105 return skb->len;
2106}
2107
6e1f760e
PNA		 2108static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2109{
e46abbcc
PS		 2110 struct nft_rule_dump_ctx *ctx = cb->data;
2111
2112 if (ctx) {
2113 kfree(ctx->table);
b7263e07 2114 kfree(ctx->chain);
e46abbcc
PS		 2115 kfree(ctx);
2116 }
6e1f760e
PNA		 2117 return 0;
2118}
2119
7b8002a1
PNA		 2120static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2121 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2122 const struct nlattr * const nla[],
2123 struct netlink_ext_ack *extack)
96518518
PM		 2124{
2125 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2126 u8 genmask = nft_genmask_cur(net);
96518518
PM		 2127 const struct nft_af_info *afi;
2128 const struct nft_table *table;
2129 const struct nft_chain *chain;
2130 const struct nft_rule *rule;
2131 struct sk_buff *skb2;
2132 int family = nfmsg->nfgen_family;
2133 int err;
2134
2135 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2136 struct netlink_dump_control c = {
2137 .dump = nf_tables_dump_rules,
6e1f760e 2138 .done = nf_tables_dump_rules_done,
96518518 2139 };
6e1f760e
PNA		 2140
2141 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2142 struct nft_rule_dump_ctx *ctx;
2143
2144 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2145 if (!ctx)
2146 return -ENOMEM;
2147
e46abbcc
PS		 2148 if (nla[NFTA_RULE_TABLE]) {
2149 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2150 GFP_KERNEL);
2151 if (!ctx->table) {
2152 kfree(ctx);
2153 return -ENOMEM;
2154 }
2155 }
b7263e07
PS		 2156 if (nla[NFTA_RULE_CHAIN]) {
2157 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2158 GFP_KERNEL);
2159 if (!ctx->chain) {
2160 kfree(ctx->table);
2161 kfree(ctx);
2162 return -ENOMEM;
2163 }
2164 }
6e1f760e
PNA		 2165 c.data = ctx;
2166 }
2167
96518518
PM		 2168 return netlink_dump_start(nlsk, skb, nlh, &c);
2169 }
2170
99633ab2 2171 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 2172 if (IS_ERR(afi))
2173 return PTR_ERR(afi);
2174
f2a6d766 2175 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2176 if (IS_ERR(table))
2177 return PTR_ERR(table);
2178
664b0f8c 2179 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2180 if (IS_ERR(chain))
2181 return PTR_ERR(chain);
2182
2183 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2184 if (IS_ERR(rule))
2185 return PTR_ERR(rule);
2186
2187 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2188 if (!skb2)
2189 return -ENOMEM;
2190
84d7fce6 2191 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
96518518
PM		 2192 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2193 family, table, chain, rule);
2194 if (err < 0)
2195 goto err;
2196
2197 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2198
2199err:
2200 kfree_skb(skb2);
2201 return err;
2202}
2203
62472bce
PM		 2204static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2205 struct nft_rule *rule)
96518518 2206{
96518518
PM		 2207 struct nft_expr *expr;
2208
2209 /*
2210 * Careful: some expressions might not be initialized in case this
2211 * is called on error from nf_tables_newrule().
2212 */
2213 expr = nft_expr_first(rule);
3e38df13 2214 while (expr != nft_expr_last(rule) && expr->ops) {
62472bce 2215 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 2216 expr = nft_expr_next(expr);
2217 }
2218 kfree(rule);
2219}
2220
1081d11b
PNA		 2221#define NFT_RULE_MAXEXPRS 128
2222
2223static struct nft_expr_info *info;
2224
633c9a84
PNA		 2225static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2226 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2227 const struct nlattr * const nla[],
2228 struct netlink_ext_ack *extack)
96518518
PM		 2229{
2230 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2231 u8 genmask = nft_genmask_next(net);
7c95f6d8 2232 struct nft_af_info *afi;
96518518
PM		 2233 struct nft_table *table;
2234 struct nft_chain *chain;
2235 struct nft_rule *rule, *old_rule = NULL;
86f1ec32 2236 struct nft_userdata *udata;
1081d11b 2237 struct nft_trans *trans = NULL;
96518518
PM		 2238 struct nft_expr *expr;
2239 struct nft_ctx ctx;
2240 struct nlattr *tmp;
86f1ec32 2241 unsigned int size, i, n, ulen = 0, usize = 0;
96518518
PM		 2242 int err, rem;
2243 bool create;
5e948466 2244 u64 handle, pos_handle;
96518518
PM		 2245
2246 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2247
99633ab2 2248 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
96518518
PM		 2249 if (IS_ERR(afi))
2250 return PTR_ERR(afi);
2251
f2a6d766 2252 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2253 if (IS_ERR(table))
2254 return PTR_ERR(table);
2255
664b0f8c 2256 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
96518518
PM		 2257 if (IS_ERR(chain))
2258 return PTR_ERR(chain);
2259
2260 if (nla[NFTA_RULE_HANDLE]) {
2261 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2262 rule = __nf_tables_rule_lookup(chain, handle);
2263 if (IS_ERR(rule))
2264 return PTR_ERR(rule);
2265
2266 if (nlh->nlmsg_flags & NLM_F_EXCL)
2267 return -EEXIST;
2268 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2269 old_rule = rule;
2270 else
2271 return -EOPNOTSUPP;
2272 } else {
2273 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2274 return -EINVAL;
2275 handle = nf_tables_alloc_handle(table);
a0a7379e
PNA		 2276
2277 if (chain->use == UINT_MAX)
2278 return -EOVERFLOW;
96518518
PM		 2279 }
2280
5e948466
EL		 2281 if (nla[NFTA_RULE_POSITION]) {
2282 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2283 return -EOPNOTSUPP;
2284
2285 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2286 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
2287 if (IS_ERR(old_rule))
2288 return PTR_ERR(old_rule);
2289 }
2290
633c9a84 2291 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0ca743a5 2292
96518518
PM		 2293 n = 0;
2294 size = 0;
2295 if (nla[NFTA_RULE_EXPRESSIONS]) {
2296 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2297 err = -EINVAL;
2298 if (nla_type(tmp) != NFTA_LIST_ELEM)
2299 goto err1;
2300 if (n == NFT_RULE_MAXEXPRS)
2301 goto err1;
0ca743a5 2302 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 2303 if (err < 0)
2304 goto err1;
2305 size += info[n].ops->size;
2306 n++;
2307 }
2308 }
9889840f
PM		 2309 /* Check for overflow of dlen field */
2310 err = -EFBIG;
2311 if (size >= 1 << 12)
2312 goto err1;
96518518 2313
86f1ec32 2314 if (nla[NFTA_RULE_USERDATA]) {
0768b3b3 2315 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
86f1ec32
PM		 2316 if (ulen > 0)
2317 usize = sizeof(struct nft_userdata) + ulen;
2318 }
0768b3b3 2319
96518518 2320 err = -ENOMEM;
86f1ec32 2321 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
96518518
PM		 2322 if (rule == NULL)
2323 goto err1;
2324
889f7ee7 2325 nft_activate_next(net, rule);
0628b123 2326
96518518
PM		 2327 rule->handle = handle;
2328 rule->dlen = size;
86f1ec32 2329 rule->udata = ulen ? 1 : 0;
0768b3b3 2330
86f1ec32
PM		 2331 if (ulen) {
2332 udata = nft_userdata(rule);
2333 udata->len = ulen - 1;
2334 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2335 }
96518518 2336
96518518
PM		 2337 expr = nft_expr_first(rule);
2338 for (i = 0; i < n; i++) {
2339 err = nf_tables_newexpr(&ctx, &info[i], expr);
2340 if (err < 0)
2341 goto err2;
ef1f7df9 2342 info[i].ops = NULL;
96518518
PM		 2343 expr = nft_expr_next(expr);
2344 }
2345
96518518 2346 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
889f7ee7 2347 if (nft_is_active_next(net, old_rule)) {
ac904ac8 2348 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
b380e5c7 2349 old_rule);
1081d11b 2350 if (trans == NULL) {
0628b123
PNA		 2351 err = -ENOMEM;
2352 goto err2;
2353 }
889f7ee7 2354 nft_deactivate_next(net, old_rule);
ac34b861 2355 chain->use--;
5bc5c307 2356 list_add_tail_rcu(&rule->list, &old_rule->list);
0628b123
PNA		 2357 } else {
2358 err = -ENOENT;
2359 goto err2;
2360 }
96518518 2361 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 2362 if (old_rule)
2363 list_add_rcu(&rule->list, &old_rule->list);
2364 else
2365 list_add_tail_rcu(&rule->list, &chain->rules);
2366 else {
2367 if (old_rule)
2368 list_add_tail_rcu(&rule->list, &old_rule->list);
2369 else
2370 list_add_rcu(&rule->list, &chain->rules);
2371 }
96518518 2372
b380e5c7 2373 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 2374 err = -ENOMEM;
2375 goto err3;
2376 }
4fefee57 2377 chain->use++;
96518518
PM		 2378 return 0;
2379
0628b123
PNA		 2380err3:
2381 list_del_rcu(&rule->list);
96518518 2382err2:
62472bce 2383 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 2384err1:
2385 for (i = 0; i < n; i++) {
2386 if (info[i].ops != NULL)
ef1f7df9 2387 module_put(info[i].ops->type->owner);
96518518
PM		 2388 }
2389 return err;
2390}
2391
1a94e38d
PNA		 2392static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2393 const struct nlattr *nla)
2394{
2395 u32 id = ntohl(nla_get_be32(nla));
2396 struct nft_trans *trans;
2397
2398 list_for_each_entry(trans, &net->nft.commit_list, list) {
2399 struct nft_rule *rule = nft_trans_rule(trans);
2400
2401 if (trans->msg_type == NFT_MSG_NEWRULE &&
2402 id == nft_trans_rule_id(trans))
2403 return rule;
2404 }
2405 return ERR_PTR(-ENOENT);
2406}
2407
633c9a84
PNA		 2408static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2409 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2410 const struct nlattr * const nla[],
2411 struct netlink_ext_ack *extack)
96518518
PM		 2412{
2413 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 2414 u8 genmask = nft_genmask_next(net);
7c95f6d8 2415 struct nft_af_info *afi;
7c95f6d8 2416 struct nft_table *table;
cf9dc09d
PNA		 2417 struct nft_chain *chain = NULL;
2418 struct nft_rule *rule;
0628b123
PNA		 2419 int family = nfmsg->nfgen_family, err = 0;
2420 struct nft_ctx ctx;
96518518 2421
99633ab2 2422 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 2423 if (IS_ERR(afi))
2424 return PTR_ERR(afi);
2425
f2a6d766 2426 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE], genmask);
96518518
PM		 2427 if (IS_ERR(table))
2428 return PTR_ERR(table);
2429
cf9dc09d 2430 if (nla[NFTA_RULE_CHAIN]) {
664b0f8c
PNA		 2431 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN],
2432 genmask);
cf9dc09d
PNA		 2433 if (IS_ERR(chain))
2434 return PTR_ERR(chain);
2435 }
96518518 2436
633c9a84 2437 nft_ctx_init(&ctx, net, skb, nlh, afi, table, chain, nla);
0628b123 2438
cf9dc09d
PNA		 2439 if (chain) {
2440 if (nla[NFTA_RULE_HANDLE]) {
2441 rule = nf_tables_rule_lookup(chain,
2442 nla[NFTA_RULE_HANDLE]);
2443 if (IS_ERR(rule))
2444 return PTR_ERR(rule);
96518518 2445
1a94e38d
PNA		 2446 err = nft_delrule(&ctx, rule);
2447 } else if (nla[NFTA_RULE_ID]) {
2448 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2449 if (IS_ERR(rule))
2450 return PTR_ERR(rule);
2451
5e266fe7 2452 err = nft_delrule(&ctx, rule);
cf9dc09d 2453 } else {
ce24b721 2454 err = nft_delrule_by_chain(&ctx);
cf9dc09d
PNA		 2455 }
2456 } else {
2457 list_for_each_entry(chain, &table->chains, list) {
664b0f8c
PNA		 2458 if (!nft_is_active_next(net, chain))
2459 continue;
2460
cf9dc09d 2461 ctx.chain = chain;
ce24b721 2462 err = nft_delrule_by_chain(&ctx);
0628b123
PNA		 2463 if (err < 0)
2464 break;
2465 }
2466 }
2467
2468 return err;
2469}
2470
20a69341
PM		 2471/*
2472 * Sets
2473 */
2474
2b664957 2475static LIST_HEAD(nf_tables_set_types);
20a69341 2476
2b664957 2477int nft_register_set(struct nft_set_type *type)
20a69341
PM		 2478{
2479 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2480 list_add_tail_rcu(&type->list, &nf_tables_set_types);
20a69341
PM		 2481 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2482 return 0;
2483}
2484EXPORT_SYMBOL_GPL(nft_register_set);
2485
2b664957 2486void nft_unregister_set(struct nft_set_type *type)
20a69341
PM		 2487{
2488 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2489 list_del_rcu(&type->list);
20a69341
PM		 2490 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2491}
2492EXPORT_SYMBOL_GPL(nft_unregister_set);
2493
2b664957
PNA		 2494#define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2495 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
2496
2497static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
2498{
2499 return (flags & ops->features) == (flags & NFT_SET_FEATURES);
2500}
2501
c50b960c
PM		 2502/*
2503 * Select a set implementation based on the data characteristics and the
2504 * given policy. The total memory use might not be known if no size is
2505 * given, in that case the amount of memory per element is used.
2506 */
2507static const struct nft_set_ops *
2b664957
PNA		 2508nft_select_set_ops(const struct nft_ctx *ctx,
2509 const struct nlattr * const nla[],
c50b960c
PM		 2510 const struct nft_set_desc *desc,
2511 enum nft_set_policies policy)
20a69341 2512{
c50b960c
PM		 2513 const struct nft_set_ops *ops, *bops;
2514 struct nft_set_estimate est, best;
2b664957
PNA		 2515 const struct nft_set_type *type;
2516 u32 flags = 0;
20a69341
PM		 2517
2518#ifdef CONFIG_MODULES
2b664957 2519 if (list_empty(&nf_tables_set_types)) {
20a69341
PM		 2520 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2521 request_module("nft-set");
2522 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2b664957 2523 if (!list_empty(&nf_tables_set_types))
20a69341
PM		 2524 return ERR_PTR(-EAGAIN);
2525 }
2526#endif
2b664957
PNA		 2527 if (nla[NFTA_SET_FLAGS] != NULL)
2528 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
20a69341 2529
55af753c
PNA		 2530 bops = NULL;
2531 best.size = ~0;
2532 best.lookup = ~0;
0b5a7874 2533 best.space = ~0;
c50b960c 2534
2b664957
PNA		 2535 list_for_each_entry(type, &nf_tables_set_types, list) {
2536 if (!type->select_ops)
2537 ops = type->ops;
2538 else
2539 ops = type->select_ops(ctx, desc, flags);
2540 if (!ops)
2541 continue;
2542
2543 if (!nft_set_ops_candidate(ops, flags))
20a69341 2544 continue;
2b664957 2545 if (!ops->estimate(desc, flags, &est))
c50b960c
PM		 2546 continue;
2547
2548 switch (policy) {
2549 case NFT_SET_POL_PERFORMANCE:
55af753c 2550 if (est.lookup < best.lookup)
c50b960c 2551 break;
0b5a7874
PNA		 2552 if (est.lookup == best.lookup) {
2553 if (!desc->size) {
2554 if (est.space < best.space)
2555 break;
2556 } else if (est.size < best.size) {
2557 break;
2558 }
2559 }
c50b960c
PM		 2560 continue;
2561 case NFT_SET_POL_MEMORY:
0b5a7874
PNA		 2562 if (!desc->size) {
2563 if (est.space < best.space)
2564 break;
2565 if (est.space == best.space &&
2566 est.lookup < best.lookup)
2567 break;
2568 } else if (est.size < best.size) {
c50b960c 2569 break;
0b5a7874 2570 }
c50b960c
PM		 2571 continue;
2572 default:
2573 break;
2574 }
2575
2b664957 2576 if (!try_module_get(type->owner))
20a69341 2577 continue;
c50b960c 2578 if (bops != NULL)
2b664957 2579 module_put(bops->type->owner);
c50b960c
PM		 2580
2581 bops = ops;
2582 best = est;
20a69341
PM		 2583 }
2584
c50b960c
PM		 2585 if (bops != NULL)
2586 return bops;
2587
20a69341
PM		 2588 return ERR_PTR(-EOPNOTSUPP);
2589}
2590
2591static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
b2fbd044
LZ		 2592 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2593 .len = NFT_TABLE_MAXNAMELEN - 1 },
a9bdd836 2594 [NFTA_SET_NAME] = { .type = NLA_STRING,
cb39ad8b 2595 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341
PM		 2596 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2597 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2598 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2599 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2600 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 2601 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2602 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 2603 [NFTA_SET_ID] = { .type = NLA_U32 },
761da293
PM		 2604 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2605 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
e6d8ecac
CFG		 2606 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2607 .len = NFT_USERDATA_MAXLEN },
8aeff920 2608 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
c50b960c
PM		 2609};
2610
2611static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2612 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 2613};
2614
633c9a84 2615static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 2616 const struct sk_buff *skb,
2617 const struct nlmsghdr *nlh,
f2a6d766
PNA		 2618 const struct nlattr * const nla[],
2619 u8 genmask)
20a69341
PM		 2620{
2621 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 2622 struct nft_af_info *afi = NULL;
2623 struct nft_table *table = NULL;
20a69341 2624
c9c8e485
PNA		 2625 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
2626 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
2627 if (IS_ERR(afi))
2628 return PTR_ERR(afi);
2629 }
20a69341
PM		 2630
2631 if (nla[NFTA_SET_TABLE] != NULL) {
ec2c9935
PM		 2632 if (afi == NULL)
2633 return -EAFNOSUPPORT;
2634
f2a6d766
PNA		 2635 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE],
2636 genmask);
20a69341
PM		 2637 if (IS_ERR(table))
2638 return PTR_ERR(table);
2639 }
2640
633c9a84 2641 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2642 return 0;
2643}
2644
c7a72e3f
PNA		 2645static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2646 const struct nlattr *nla, u8 genmask)
20a69341
PM		 2647{
2648 struct nft_set *set;
2649
2650 if (nla == NULL)
2651 return ERR_PTR(-EINVAL);
2652
2653 list_for_each_entry(set, &table->sets, list) {
37a9cc52
PNA		 2654 if (!nla_strcmp(nla, set->name) &&
2655 nft_active_genmask(set, genmask))
20a69341
PM		 2656 return set;
2657 }
2658 return ERR_PTR(-ENOENT);
2659}
2660
c7a72e3f
PNA		 2661static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2662 const struct nlattr *nla,
2663 u8 genmask)
958bee14
PNA		 2664{
2665 struct nft_trans *trans;
2666 u32 id = ntohl(nla_get_be32(nla));
2667
2668 list_for_each_entry(trans, &net->nft.commit_list, list) {
37a9cc52
PNA		 2669 struct nft_set *set = nft_trans_set(trans);
2670
958bee14 2671 if (trans->msg_type == NFT_MSG_NEWSET &&
37a9cc52
PNA		 2672 id == nft_trans_set_id(trans) &&
2673 nft_active_genmask(set, genmask))
2674 return set;
958bee14
PNA		 2675 }
2676 return ERR_PTR(-ENOENT);
2677}
c7a72e3f
PNA		 2678
2679struct nft_set *nft_set_lookup(const struct net *net,
2680 const struct nft_table *table,
2681 const struct nlattr *nla_set_name,
2682 const struct nlattr *nla_set_id,
2683 u8 genmask)
2684{
2685 struct nft_set *set;
2686
2687 set = nf_tables_set_lookup(table, nla_set_name, genmask);
2688 if (IS_ERR(set)) {
2689 if (!nla_set_id)
2690 return set;
2691
2692 set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
2693 }
2694 return set;
2695}
2696EXPORT_SYMBOL_GPL(nft_set_lookup);
958bee14 2697
20a69341
PM		 2698static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2699 const char *name)
2700{
2701 const struct nft_set *i;
2702 const char *p;
2703 unsigned long *inuse;
60eb1894 2704 unsigned int n = 0, min = 0;
20a69341 2705
38745490 2706 p = strchr(name, '%');
20a69341
PM		 2707 if (p != NULL) {
2708 if (p[1] != 'd' || strchr(p + 2, '%'))
2709 return -EINVAL;
2710
2711 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2712 if (inuse == NULL)
2713 return -ENOMEM;
60eb1894 2714cont:
20a69341 2715 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2716 int tmp;
2717
37a9cc52
PNA		 2718 if (!nft_is_active_next(ctx->net, set))
2719 continue;
14662917 2720 if (!sscanf(i->name, name, &tmp))
20a69341 2721 continue;
60eb1894 2722 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2723 continue;
14662917 2724
60eb1894 2725 set_bit(tmp - min, inuse);
20a69341
PM		 2726 }
2727
53b70287 2728 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2729 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2730 min += BITS_PER_BYTE * PAGE_SIZE;
2731 memset(inuse, 0, PAGE_SIZE);
2732 goto cont;
2733 }
20a69341
PM		 2734 free_page((unsigned long)inuse);
2735 }
2736
38745490
PS		 2737 set->name = kasprintf(GFP_KERNEL, name, min + n);
2738 if (!set->name)
2739 return -ENOMEM;
2740
20a69341 2741 list_for_each_entry(i, &ctx->table->sets, list) {
37a9cc52
PNA		 2742 if (!nft_is_active_next(ctx->net, i))
2743 continue;
e63aaaa6
AY		 2744 if (!strcmp(set->name, i->name)) {
2745 kfree(set->name);
20a69341 2746 return -ENFILE;
e63aaaa6 2747 }
20a69341
PM		 2748 }
2749 return 0;
2750}
2751
2752static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2753 const struct nft_set *set, u16 event, u16 flags)
2754{
2755 struct nfgenmsg *nfmsg;
2756 struct nlmsghdr *nlh;
c50b960c 2757 struct nlattr *desc;
128ad332
PNA		 2758 u32 portid = ctx->portid;
2759 u32 seq = ctx->seq;
20a69341 2760
dedb67c4 2761 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
20a69341
PM		 2762 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2763 flags);
2764 if (nlh == NULL)
2765 goto nla_put_failure;
2766
2767 nfmsg = nlmsg_data(nlh);
2768 nfmsg->nfgen_family = ctx->afi->family;
2769 nfmsg->version = NFNETLINK_V0;
84d7fce6 2770 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
20a69341
PM		 2771
2772 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2773 goto nla_put_failure;
2774 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2775 goto nla_put_failure;
2776 if (set->flags != 0)
2777 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2778 goto nla_put_failure;
2779
2780 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2781 goto nla_put_failure;
2782 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2783 goto nla_put_failure;
2784 if (set->flags & NFT_SET_MAP) {
2785 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2786 goto nla_put_failure;
2787 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2788 goto nla_put_failure;
2789 }
8aeff920
PNA		 2790 if (set->flags & NFT_SET_OBJECT &&
2791 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2792 goto nla_put_failure;
20a69341 2793
761da293 2794 if (set->timeout &&
d3e2a111
AP		 2795 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2796 cpu_to_be64(jiffies_to_msecs(set->timeout)),
b46f6ded 2797 NFTA_SET_PAD))
761da293
PM		 2798 goto nla_put_failure;
2799 if (set->gc_int &&
2800 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2801 goto nla_put_failure;
2802
9363dc4b
AB		 2803 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2804 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2805 goto nla_put_failure;
2806 }
2807
e6d8ecac
CFG		 2808 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2809 goto nla_put_failure;
2810
c50b960c
PM		 2811 desc = nla_nest_start(skb, NFTA_SET_DESC);
2812 if (desc == NULL)
2813 goto nla_put_failure;
2814 if (set->size &&
2815 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2816 goto nla_put_failure;
2817 nla_nest_end(skb, desc);
2818
053c095a
JB		 2819 nlmsg_end(skb, nlh);
2820 return 0;
20a69341
PM		 2821
2822nla_put_failure:
2823 nlmsg_trim(skb, nlh);
2824 return -1;
2825}
2826
25e94a99
PNA		 2827static void nf_tables_set_notify(const struct nft_ctx *ctx,
2828 const struct nft_set *set, int event,
2829 gfp_t gfp_flags)
20a69341
PM		 2830{
2831 struct sk_buff *skb;
128ad332 2832 u32 portid = ctx->portid;
20a69341
PM		 2833 int err;
2834
128ad332
PNA		 2835 if (!ctx->report &&
2836 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
25e94a99 2837 return;
20a69341 2838
31f8441c 2839 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
20a69341
PM		 2840 if (skb == NULL)
2841 goto err;
2842
2843 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2844 if (err < 0) {
2845 kfree_skb(skb);
2846 goto err;
2847 }
2848
25e94a99
PNA		 2849 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
2850 gfp_flags);
2851 return;
20a69341 2852err:
25e94a99 2853 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
20a69341
PM		 2854}
2855
5b96af77 2856static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
c9c8e485
PNA		 2857{
2858 const struct nft_set *set;
2859 unsigned int idx, s_idx = cb->args[0];
7c95f6d8 2860 struct nft_af_info *afi;
c9c8e485
PNA		 2861 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2862 struct net *net = sock_net(skb->sk);
2863 int cur_family = cb->args[3];
5b96af77 2864 struct nft_ctx *ctx = cb->data, ctx_set;
c9c8e485
PNA		 2865
2866 if (cb->args[1])
2867 return skb->len;
2868
e688a7f8 2869 rcu_read_lock();
38e029f1
PNA		 2870 cb->seq = net->nft.base_seq;
2871
e688a7f8 2872 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
5b96af77
PNA		 2873 if (ctx->afi && ctx->afi != afi)
2874 continue;
2875
c9c8e485
PNA		 2876 if (cur_family) {
2877 if (afi->family != cur_family)
2878 continue;
2879
2880 cur_family = 0;
2881 }
e688a7f8 2882 list_for_each_entry_rcu(table, &afi->tables, list) {
5b96af77
PNA		 2883 if (ctx->table && ctx->table != table)
2884 continue;
2885
c9c8e485
PNA		 2886 if (cur_table) {
2887 if (cur_table != table)
2888 continue;
2889
2890 cur_table = NULL;
2891 }
c9c8e485 2892 idx = 0;
5b96af77 2893 list_for_each_entry_rcu(set, &table->sets, list) {
c9c8e485
PNA		 2894 if (idx < s_idx)
2895 goto cont;
37a9cc52
PNA		 2896 if (!nft_is_active(net, set))
2897 goto cont;
5b96af77
PNA		 2898
2899 ctx_set = *ctx;
2900 ctx_set.table = table;
2901 ctx_set.afi = afi;
2902 if (nf_tables_fill_set(skb, &ctx_set, set,
c9c8e485
PNA		 2903 NFT_MSG_NEWSET,
2904 NLM_F_MULTI) < 0) {
2905 cb->args[0] = idx;
2906 cb->args[2] = (unsigned long) table;
2907 cb->args[3] = afi->family;
2908 goto done;
2909 }
38e029f1 2910 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
c9c8e485
PNA		 2911cont:
2912 idx++;
2913 }
2914 if (s_idx)
2915 s_idx = 0;
2916 }
2917 }
2918 cb->args[1] = 1;
2919done:
e688a7f8 2920 rcu_read_unlock();
c9c8e485
PNA		 2921 return skb->len;
2922}
2923
5b96af77 2924static int nf_tables_dump_sets_done(struct netlink_callback *cb)
20a69341 2925{
5b96af77
PNA		 2926 kfree(cb->data);
2927 return 0;
20a69341
PM		 2928}
2929
7b8002a1
PNA		 2930static int nf_tables_getset(struct net *net, struct sock *nlsk,
2931 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 2932 const struct nlattr * const nla[],
2933 struct netlink_ext_ack *extack)
20a69341 2934{
f2a6d766 2935 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 2936 const struct nft_set *set;
2937 struct nft_ctx ctx;
2938 struct sk_buff *skb2;
c9c8e485 2939 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2940 int err;
2941
01cfa0a4 2942 /* Verify existence before starting dump */
f2a6d766 2943 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 2944 if (err < 0)
2945 return err;
2946
2947 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2948 struct netlink_dump_control c = {
2949 .dump = nf_tables_dump_sets,
5b96af77 2950 .done = nf_tables_dump_sets_done,
20a69341 2951 };
5b96af77
PNA		 2952 struct nft_ctx *ctx_dump;
2953
2954 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2955 if (ctx_dump == NULL)
2956 return -ENOMEM;
2957
2958 *ctx_dump = ctx;
2959 c.data = ctx_dump;
2960
20a69341
PM		 2961 return netlink_dump_start(nlsk, skb, nlh, &c);
2962 }
2963
c9c8e485
PNA		 2964 /* Only accept unspec with dump */
2965 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2966 return -EAFNOSUPPORT;
eaa2bcd6
PT		 2967 if (!nla[NFTA_SET_TABLE])
2968 return -EINVAL;
c9c8e485 2969
37a9cc52 2970 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 2971 if (IS_ERR(set))
2972 return PTR_ERR(set);
2973
2974 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2975 if (skb2 == NULL)
2976 return -ENOMEM;
2977
2978 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2979 if (err < 0)
2980 goto err;
2981
2982 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2983
2984err:
2985 kfree_skb(skb2);
2986 return err;
2987}
2988
c50b960c
PM		 2989static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2990 struct nft_set_desc *desc,
2991 const struct nlattr *nla)
2992{
2993 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2994 int err;
2995
fceb6435
JB		 2996 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
2997 nft_set_desc_policy, NULL);
c50b960c
PM		 2998 if (err < 0)
2999 return err;
3000
3001 if (da[NFTA_SET_DESC_SIZE] != NULL)
3002 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3003
3004 return 0;
3005}
3006
633c9a84
PNA		 3007static int nf_tables_newset(struct net *net, struct sock *nlsk,
3008 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3009 const struct nlattr * const nla[],
3010 struct netlink_ext_ack *extack)
20a69341
PM		 3011{
3012 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3013 u8 genmask = nft_genmask_next(net);
20a69341 3014 const struct nft_set_ops *ops;
7c95f6d8 3015 struct nft_af_info *afi;
20a69341
PM		 3016 struct nft_table *table;
3017 struct nft_set *set;
3018 struct nft_ctx ctx;
38745490 3019 char *name;
20a69341
PM		 3020 unsigned int size;
3021 bool create;
761da293 3022 u64 timeout;
8aeff920 3023 u32 ktype, dtype, flags, policy, gc_int, objtype;
c50b960c 3024 struct nft_set_desc desc;
e6d8ecac
CFG		 3025 unsigned char *udata;
3026 u16 udlen;
20a69341
PM		 3027 int err;
3028
3029 if (nla[NFTA_SET_TABLE] == NULL ||
3030 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 3031 nla[NFTA_SET_KEY_LEN] == NULL ||
3032 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 3033 return -EINVAL;
3034
c50b960c
PM		 3035 memset(&desc, 0, sizeof(desc));
3036
20a69341
PM		 3037 ktype = NFT_DATA_VALUE;
3038 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3039 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3040 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3041 return -EINVAL;
3042 }
3043
c50b960c 3044 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
7d740264 3045 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3046 return -EINVAL;
3047
3048 flags = 0;
3049 if (nla[NFTA_SET_FLAGS] != NULL) {
3050 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3051 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
7c6c6e95 3052 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
8aeff920
PNA		 3053 NFT_SET_MAP | NFT_SET_EVAL |
3054 NFT_SET_OBJECT))
20a69341 3055 return -EINVAL;
8aeff920
PNA		 3056 /* Only one of these operations is supported */
3057 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3058 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
7c6c6e95 3059 return -EOPNOTSUPP;
20a69341
PM		 3060 }
3061
3062 dtype = 0;
20a69341
PM		 3063 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3064 if (!(flags & NFT_SET_MAP))
3065 return -EINVAL;
3066
3067 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3068 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3069 dtype != NFT_DATA_VERDICT)
3070 return -EINVAL;
3071
3072 if (dtype != NFT_DATA_VERDICT) {
3073 if (nla[NFTA_SET_DATA_LEN] == NULL)
3074 return -EINVAL;
c50b960c 3075 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
7d740264 3076 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
20a69341
PM		 3077 return -EINVAL;
3078 } else
7d740264 3079 desc.dlen = sizeof(struct nft_verdict);
20a69341
PM		 3080 } else if (flags & NFT_SET_MAP)
3081 return -EINVAL;
3082
8aeff920
PNA		 3083 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3084 if (!(flags & NFT_SET_OBJECT))
3085 return -EINVAL;
3086
3087 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3088 if (objtype == NFT_OBJECT_UNSPEC ||
3089 objtype > NFT_OBJECT_MAX)
3090 return -EINVAL;
3091 } else if (flags & NFT_SET_OBJECT)
3092 return -EINVAL;
3093 else
3094 objtype = NFT_OBJECT_UNSPEC;
3095
761da293
PM		 3096 timeout = 0;
3097 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3098 if (!(flags & NFT_SET_TIMEOUT))
3099 return -EINVAL;
d3e2a111
AP		 3100 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3101 nla[NFTA_SET_TIMEOUT])));
761da293
PM		 3102 }
3103 gc_int = 0;
3104 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3105 if (!(flags & NFT_SET_TIMEOUT))
3106 return -EINVAL;
3107 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3108 }
3109
c50b960c
PM		 3110 policy = NFT_SET_POL_PERFORMANCE;
3111 if (nla[NFTA_SET_POLICY] != NULL)
3112 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3113
3114 if (nla[NFTA_SET_DESC] != NULL) {
3115 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3116 if (err < 0)
3117 return err;
3118 }
3119
20a69341
PM		 3120 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3121
99633ab2 3122 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
20a69341
PM		 3123 if (IS_ERR(afi))
3124 return PTR_ERR(afi);
3125
f2a6d766 3126 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE], genmask);
20a69341
PM		 3127 if (IS_ERR(table))
3128 return PTR_ERR(table);
3129
633c9a84 3130 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341 3131
37a9cc52 3132 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3133 if (IS_ERR(set)) {
3134 if (PTR_ERR(set) != -ENOENT)
3135 return PTR_ERR(set);
1a28ad74 3136 } else {
20a69341
PM		 3137 if (nlh->nlmsg_flags & NLM_F_EXCL)
3138 return -EEXIST;
3139 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3140 return -EOPNOTSUPP;
3141 return 0;
3142 }
3143
3144 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3145 return -ENOENT;
3146
2b664957 3147 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
20a69341
PM		 3148 if (IS_ERR(ops))
3149 return PTR_ERR(ops);
3150
e6d8ecac
CFG		 3151 udlen = 0;
3152 if (nla[NFTA_SET_USERDATA])
3153 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3154
20a69341
PM		 3155 size = 0;
3156 if (ops->privsize != NULL)
347b408d 3157 size = ops->privsize(nla, &desc);
20a69341 3158
1ff75a3e
PNA		 3159 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3160 if (!set) {
3161 err = -ENOMEM;
20a69341 3162 goto err1;
1ff75a3e 3163 }
20a69341 3164
38745490
PS		 3165 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3166 if (!name) {
3167 err = -ENOMEM;
3168 goto err2;
3169 }
3170
20a69341 3171 err = nf_tables_set_alloc_name(&ctx, set, name);
38745490 3172 kfree(name);
20a69341
PM		 3173 if (err < 0)
3174 goto err2;
3175
e6d8ecac
CFG		 3176 udata = NULL;
3177 if (udlen) {
3178 udata = set->data + size;
3179 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3180 }
3181
20a69341
PM		 3182 INIT_LIST_HEAD(&set->bindings);
3183 set->ops = ops;
3184 set->ktype = ktype;
c50b960c 3185 set->klen = desc.klen;
20a69341 3186 set->dtype = dtype;
8aeff920 3187 set->objtype = objtype;
c50b960c 3188 set->dlen = desc.dlen;
20a69341 3189 set->flags = flags;
c50b960c 3190 set->size = desc.size;
9363dc4b 3191 set->policy = policy;
e6d8ecac
CFG		 3192 set->udlen = udlen;
3193 set->udata = udata;
761da293
PM		 3194 set->timeout = timeout;
3195 set->gc_int = gc_int;
20a69341 3196
c50b960c 3197 err = ops->init(set, &desc, nla);
20a69341
PM		 3198 if (err < 0)
3199 goto err2;
3200
958bee14 3201 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
20a69341 3202 if (err < 0)
c17c3cdf 3203 goto err3;
20a69341 3204
e688a7f8 3205 list_add_tail_rcu(&set->list, &table->sets);
4fefee57 3206 table->use++;
20a69341
PM		 3207 return 0;
3208
c17c3cdf
LZ		 3209err3:
3210 ops->destroy(set);
20a69341 3211err2:
1ff75a3e 3212 kvfree(set);
20a69341 3213err1:
2b664957 3214 module_put(ops->type->owner);
20a69341
PM		 3215 return err;
3216}
3217
958bee14 3218static void nft_set_destroy(struct nft_set *set)
20a69341 3219{
20a69341 3220 set->ops->destroy(set);
2b664957 3221 module_put(set->ops->type->owner);
38745490 3222 kfree(set->name);
1ff75a3e 3223 kvfree(set);
20a69341
PM		 3224}
3225
958bee14
PNA		 3226static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3227{
e688a7f8 3228 list_del_rcu(&set->list);
31f8441c 3229 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
958bee14
PNA		 3230 nft_set_destroy(set);
3231}
3232
633c9a84
PNA		 3233static int nf_tables_delset(struct net *net, struct sock *nlsk,
3234 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3235 const struct nlattr * const nla[],
3236 struct netlink_ext_ack *extack)
20a69341 3237{
c9c8e485 3238 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
f2a6d766 3239 u8 genmask = nft_genmask_next(net);
20a69341
PM		 3240 struct nft_set *set;
3241 struct nft_ctx ctx;
3242 int err;
3243
ec2c9935
PM		 3244 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3245 return -EAFNOSUPPORT;
20a69341
PM		 3246 if (nla[NFTA_SET_TABLE] == NULL)
3247 return -EINVAL;
3248
f2a6d766 3249 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 3250 if (err < 0)
3251 return err;
3252
37a9cc52 3253 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
20a69341
PM		 3254 if (IS_ERR(set))
3255 return PTR_ERR(set);
a8278400
PNA		 3256
3257 if (!list_empty(&set->bindings) ||
3258 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0))
20a69341
PM		 3259 return -EBUSY;
3260
ee01d542 3261 return nft_delset(&ctx, set);
20a69341
PM		 3262}
3263
3264static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
de70185d 3265 struct nft_set *set,
20a69341 3266 const struct nft_set_iter *iter,
de70185d 3267 struct nft_set_elem *elem)
20a69341 3268{
fe2811eb 3269 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3270 enum nft_registers dreg;
3271
3272 dreg = nft_type_to_reg(set->dtype);
1ec10212
PM		 3273 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3274 set->dtype == NFT_DATA_VERDICT ?
3275 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3276 set->dlen);
20a69341
PM		 3277}
3278
3279int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3280 struct nft_set_binding *binding)
3281{
3282 struct nft_set_binding *i;
3283 struct nft_set_iter iter;
3284
3285 if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
3286 return -EBUSY;
3287
11113e19 3288 if (binding->flags & NFT_SET_MAP) {
20a69341
PM		 3289 /* If the set is already bound to the same chain all
3290 * jumps are already validated for that chain.
3291 */
3292 list_for_each_entry(i, &set->bindings, list) {
a4684402 3293 if (i->flags & NFT_SET_MAP &&
11113e19 3294 i->chain == binding->chain)
20a69341
PM		 3295 goto bind;
3296 }
3297
8588ac09 3298 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 3299 iter.skip = 0;
3300 iter.count = 0;
3301 iter.err = 0;
3302 iter.fn = nf_tables_bind_check_setelem;
3303
3304 set->ops->walk(ctx, set, &iter);
a02f4248 3305 if (iter.err < 0)
20a69341 3306 return iter.err;
20a69341
PM		 3307 }
3308bind:
3309 binding->chain = ctx->chain;
e688a7f8 3310 list_add_tail_rcu(&binding->list, &set->bindings);
20a69341
PM		 3311 return 0;
3312}
63aea290 3313EXPORT_SYMBOL_GPL(nf_tables_bind_set);
20a69341
PM		 3314
3315void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3316 struct nft_set_binding *binding)
3317{
e688a7f8 3318 list_del_rcu(&binding->list);
20a69341 3319
958bee14 3320 if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS &&
37a9cc52 3321 nft_is_active(ctx->net, set))
20a69341
PM		 3322 nf_tables_set_destroy(ctx, set);
3323}
63aea290 3324EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
20a69341 3325
3ac4c07a
PM		 3326const struct nft_set_ext_type nft_set_ext_types[] = {
3327 [NFT_SET_EXT_KEY] = {
7d740264 3328 .align = __alignof__(u32),
3ac4c07a
PM		 3329 },
3330 [NFT_SET_EXT_DATA] = {
7d740264 3331 .align = __alignof__(u32),
3ac4c07a 3332 },
f25ad2e9
PM		 3333 [NFT_SET_EXT_EXPR] = {
3334 .align = __alignof__(struct nft_expr),
3335 },
8aeff920
PNA		 3336 [NFT_SET_EXT_OBJREF] = {
3337 .len = sizeof(struct nft_object *),
3338 .align = __alignof__(struct nft_object *),
3339 },
3ac4c07a
PM		 3340 [NFT_SET_EXT_FLAGS] = {
3341 .len = sizeof(u8),
3342 .align = __alignof__(u8),
3343 },
c3e1b005
PM		 3344 [NFT_SET_EXT_TIMEOUT] = {
3345 .len = sizeof(u64),
3346 .align = __alignof__(u64),
3347 },
3348 [NFT_SET_EXT_EXPIRATION] = {
3349 .len = sizeof(unsigned long),
3350 .align = __alignof__(unsigned long),
3351 },
68e942e8
PM		 3352 [NFT_SET_EXT_USERDATA] = {
3353 .len = sizeof(struct nft_userdata),
3354 .align = __alignof__(struct nft_userdata),
3355 },
3ac4c07a
PM		 3356};
3357EXPORT_SYMBOL_GPL(nft_set_ext_types);
3358
20a69341
PM		 3359/*
3360 * Set elements
3361 */
3362
3363static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3364 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3365 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3366 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
c3e1b005 3367 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
68e942e8
PM		 3368 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3369 .len = NFT_USERDATA_MAXLEN },
20a69341
PM		 3370};
3371
3372static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
b2fbd044
LZ		 3373 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3374 .len = NFT_TABLE_MAXNAMELEN - 1 },
3375 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3376 .len = NFT_SET_MAXNAMELEN - 1 },
20a69341 3377 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 3378 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 3379};
3380
633c9a84 3381static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
20a69341
PM		 3382 const struct sk_buff *skb,
3383 const struct nlmsghdr *nlh,
f2a6d766
PNA		 3384 const struct nlattr * const nla[],
3385 u8 genmask)
20a69341
PM		 3386{
3387 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 3388 struct nft_af_info *afi;
3389 struct nft_table *table;
20a69341 3390
99633ab2 3391 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
20a69341
PM		 3392 if (IS_ERR(afi))
3393 return PTR_ERR(afi);
3394
f2a6d766
PNA		 3395 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE],
3396 genmask);
20a69341
PM		 3397 if (IS_ERR(table))
3398 return PTR_ERR(table);
3399
633c9a84 3400 nft_ctx_init(ctx, net, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 3401 return 0;
3402}
3403
3404static int nf_tables_fill_setelem(struct sk_buff *skb,
3405 const struct nft_set *set,
3406 const struct nft_set_elem *elem)
3407{
fe2811eb 3408 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
20a69341
PM		 3409 unsigned char *b = skb_tail_pointer(skb);
3410 struct nlattr *nest;
3411
3412 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3413 if (nest == NULL)
3414 goto nla_put_failure;
3415
fe2811eb
PM		 3416 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3417 NFT_DATA_VALUE, set->klen) < 0)
20a69341
PM		 3418 goto nla_put_failure;
3419
fe2811eb
PM		 3420 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3421 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
20a69341
PM		 3422 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3423 set->dlen) < 0)
3424 goto nla_put_failure;
3425
f25ad2e9
PM		 3426 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3427 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3428 goto nla_put_failure;
3429
8aeff920
PNA		 3430 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3431 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3432 (*nft_set_ext_obj(ext))->name) < 0)
3433 goto nla_put_failure;
3434
fe2811eb
PM		 3435 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3436 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3437 htonl(*nft_set_ext_flags(ext))))
3438 goto nla_put_failure;
20a69341 3439
c3e1b005
PM		 3440 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3441 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
d3e2a111
AP		 3442 cpu_to_be64(jiffies_to_msecs(
3443 *nft_set_ext_timeout(ext))),
b46f6ded 3444 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3445 goto nla_put_failure;
3446
3447 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3448 unsigned long expires, now = jiffies;
3449
3450 expires = *nft_set_ext_expiration(ext);
3451 if (time_before(now, expires))
3452 expires -= now;
3453 else
3454 expires = 0;
3455
3456 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
b46f6ded
ND		 3457 cpu_to_be64(jiffies_to_msecs(expires)),
3458 NFTA_SET_ELEM_PAD))
c3e1b005
PM		 3459 goto nla_put_failure;
3460 }
3461
68e942e8
PM		 3462 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3463 struct nft_userdata *udata;
3464
3465 udata = nft_set_ext_userdata(ext);
3466 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3467 udata->len + 1, udata->data))
3468 goto nla_put_failure;
3469 }
3470
20a69341
PM		 3471 nla_nest_end(skb, nest);
3472 return 0;
3473
3474nla_put_failure:
3475 nlmsg_trim(skb, b);
3476 return -EMSGSIZE;
3477}
3478
3479struct nft_set_dump_args {
3480 const struct netlink_callback *cb;
3481 struct nft_set_iter iter;
3482 struct sk_buff *skb;
3483};
3484
3485static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
de70185d 3486 struct nft_set *set,
20a69341 3487 const struct nft_set_iter *iter,
de70185d 3488 struct nft_set_elem *elem)
20a69341
PM		 3489{
3490 struct nft_set_dump_args *args;
3491
3492 args = container_of(iter, struct nft_set_dump_args, iter);
3493 return nf_tables_fill_setelem(args->skb, set, elem);
3494}
3495
fa803605
LZ		 3496struct nft_set_dump_ctx {
3497 const struct nft_set *set;
3498 struct nft_ctx ctx;
3499};
3500
20a69341
PM		 3501static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3502{
fa803605 3503 struct nft_set_dump_ctx *dump_ctx = cb->data;
633c9a84 3504 struct net *net = sock_net(skb->sk);
fa803605
LZ		 3505 struct nft_af_info *afi;
3506 struct nft_table *table;
de70185d 3507 struct nft_set *set;
20a69341 3508 struct nft_set_dump_args args;
fa803605 3509 bool set_found = false;
20a69341
PM		 3510 struct nfgenmsg *nfmsg;
3511 struct nlmsghdr *nlh;
3512 struct nlattr *nest;
3513 u32 portid, seq;
fa803605 3514 int event;
20a69341 3515
fa803605
LZ		 3516 rcu_read_lock();
3517 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
3518 if (afi != dump_ctx->ctx.afi)
3519 continue;
20a69341 3520
fa803605
LZ		 3521 list_for_each_entry_rcu(table, &afi->tables, list) {
3522 if (table != dump_ctx->ctx.table)
3523 continue;
20a69341 3524
fa803605
LZ		 3525 list_for_each_entry_rcu(set, &table->sets, list) {
3526 if (set == dump_ctx->set) {
3527 set_found = true;
3528 break;
3529 }
3530 }
3531 break;
3532 }
3533 break;
3534 }
3535
3536 if (!set_found) {
3537 rcu_read_unlock();
3538 return -ENOENT;
3539 }
20a69341 3540
dedb67c4 3541 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
20a69341
PM		 3542 portid = NETLINK_CB(cb->skb).portid;
3543 seq = cb->nlh->nlmsg_seq;
3544
3545 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3546 NLM_F_MULTI);
3547 if (nlh == NULL)
3548 goto nla_put_failure;
3549
3550 nfmsg = nlmsg_data(nlh);
fa803605 3551 nfmsg->nfgen_family = afi->family;
20a69341 3552 nfmsg->version = NFNETLINK_V0;
fa803605 3553 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
20a69341 3554
fa803605 3555 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
20a69341
PM		 3556 goto nla_put_failure;
3557 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3558 goto nla_put_failure;
3559
3560 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3561 if (nest == NULL)
3562 goto nla_put_failure;
3563
8588ac09
PNA		 3564 args.cb = cb;
3565 args.skb = skb;
fa803605 3566 args.iter.genmask = nft_genmask_cur(net);
8588ac09
PNA		 3567 args.iter.skip = cb->args[0];
3568 args.iter.count = 0;
3569 args.iter.err = 0;
3570 args.iter.fn = nf_tables_dump_setelem;
fa803605
LZ		 3571 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3572 rcu_read_unlock();
20a69341
PM		 3573
3574 nla_nest_end(skb, nest);
3575 nlmsg_end(skb, nlh);
3576
3577 if (args.iter.err && args.iter.err != -EMSGSIZE)
3578 return args.iter.err;
3579 if (args.iter.count == cb->args[0])
3580 return 0;
3581
3582 cb->args[0] = args.iter.count;
3583 return skb->len;
3584
3585nla_put_failure:
fa803605 3586 rcu_read_unlock();
20a69341
PM		 3587 return -ENOSPC;
3588}
3589
fa803605
LZ		 3590static int nf_tables_dump_set_done(struct netlink_callback *cb)
3591{
3592 kfree(cb->data);
3593 return 0;
3594}
3595
7b8002a1
PNA		 3596static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3597 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 3598 const struct nlattr * const nla[],
3599 struct netlink_ext_ack *extack)
20a69341 3600{
f2a6d766 3601 u8 genmask = nft_genmask_cur(net);
20a69341
PM		 3602 const struct nft_set *set;
3603 struct nft_ctx ctx;
3604 int err;
3605
f2a6d766 3606 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 3607 if (err < 0)
3608 return err;
3609
37a9cc52
PNA		 3610 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
3611 genmask);
20a69341
PM		 3612 if (IS_ERR(set))
3613 return PTR_ERR(set);
3614
3615 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3616 struct netlink_dump_control c = {
3617 .dump = nf_tables_dump_set,
fa803605 3618 .done = nf_tables_dump_set_done,
20a69341 3619 };
fa803605
LZ		 3620 struct nft_set_dump_ctx *dump_ctx;
3621
3622 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
3623 if (!dump_ctx)
3624 return -ENOMEM;
3625
3626 dump_ctx->set = set;
3627 dump_ctx->ctx = ctx;
3628
3629 c.data = dump_ctx;
20a69341
PM		 3630 return netlink_dump_start(nlsk, skb, nlh, &c);
3631 }
3632 return -EOPNOTSUPP;
3633}
3634
d60ce62f
AB		 3635static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3636 const struct nft_ctx *ctx, u32 seq,
3637 u32 portid, int event, u16 flags,
3638 const struct nft_set *set,
3639 const struct nft_set_elem *elem)
3640{
3641 struct nfgenmsg *nfmsg;
3642 struct nlmsghdr *nlh;
3643 struct nlattr *nest;
3644 int err;
3645
dedb67c4 3646 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
d60ce62f
AB		 3647 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3648 flags);
3649 if (nlh == NULL)
3650 goto nla_put_failure;
3651
3652 nfmsg = nlmsg_data(nlh);
3653 nfmsg->nfgen_family = ctx->afi->family;
3654 nfmsg->version = NFNETLINK_V0;
84d7fce6 3655 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
d60ce62f
AB		 3656
3657 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3658 goto nla_put_failure;
3659 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3660 goto nla_put_failure;
3661
3662 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3663 if (nest == NULL)
3664 goto nla_put_failure;
3665
3666 err = nf_tables_fill_setelem(skb, set, elem);
3667 if (err < 0)
3668 goto nla_put_failure;
3669
3670 nla_nest_end(skb, nest);
3671
053c095a
JB		 3672 nlmsg_end(skb, nlh);
3673 return 0;
d60ce62f
AB		 3674
3675nla_put_failure:
3676 nlmsg_trim(skb, nlh);
3677 return -1;
3678}
3679
25e94a99
PNA		 3680static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3681 const struct nft_set *set,
3682 const struct nft_set_elem *elem,
3683 int event, u16 flags)
d60ce62f 3684{
128ad332
PNA		 3685 struct net *net = ctx->net;
3686 u32 portid = ctx->portid;
d60ce62f
AB		 3687 struct sk_buff *skb;
3688 int err;
3689
128ad332 3690 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 3691 return;
d60ce62f 3692
d60ce62f
AB		 3693 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3694 if (skb == NULL)
3695 goto err;
3696
3697 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3698 set, elem);
3699 if (err < 0) {
3700 kfree_skb(skb);
3701 goto err;
3702 }
3703
25e94a99
PNA		 3704 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3705 GFP_KERNEL);
3706 return;
d60ce62f 3707err:
25e94a99 3708 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
d60ce62f
AB		 3709}
3710
60319eb1
PNA		 3711static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3712 int msg_type,
3713 struct nft_set *set)
3714{
3715 struct nft_trans *trans;
3716
3717 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3718 if (trans == NULL)
3719 return NULL;
3720
3721 nft_trans_elem_set(trans) = set;
3722 return trans;
3723}
3724
22fe54d5
PM		 3725void *nft_set_elem_init(const struct nft_set *set,
3726 const struct nft_set_ext_tmpl *tmpl,
49499c3e 3727 const u32 *key, const u32 *data,
22fe54d5 3728 u64 timeout, gfp_t gfp)
fe2811eb
PM		 3729{
3730 struct nft_set_ext *ext;
3731 void *elem;
3732
3733 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
3734 if (elem == NULL)
3735 return NULL;
3736
3737 ext = nft_set_elem_ext(set, elem);
3738 nft_set_ext_init(ext, tmpl);
3739
3740 memcpy(nft_set_ext_key(ext), key, set->klen);
3741 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
3742 memcpy(nft_set_ext_data(ext), data, set->dlen);
c3e1b005
PM		 3743 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
3744 *nft_set_ext_expiration(ext) =
d3e2a111 3745 jiffies + timeout;
c3e1b005
PM		 3746 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
3747 *nft_set_ext_timeout(ext) = timeout;
fe2811eb
PM		 3748
3749 return elem;
3750}
3751
61f9e292
LZ		 3752void nft_set_elem_destroy(const struct nft_set *set, void *elem,
3753 bool destroy_expr)
61edafbb
PM		 3754{
3755 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3756
59105446 3757 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
61edafbb 3758 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
59105446 3759 nft_data_release(nft_set_ext_data(ext), set->dtype);
61f9e292 3760 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
f25ad2e9 3761 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
8aeff920
PNA		 3762 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
3763 (*nft_set_ext_obj(ext))->use--;
61edafbb
PM		 3764 kfree(elem);
3765}
3766EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
3767
59105446
PNA		 3768/* Only called from commit path, nft_set_elem_deactivate() already deals with
3769 * the refcounting from the preparation phase.
3770 */
3771static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
3772{
3773 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
3774
3775 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
3776 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
3777 kfree(elem);
3778}
3779
0e9091d6
PNA		 3780static int nft_setelem_parse_flags(const struct nft_set *set,
3781 const struct nlattr *attr, u32 *flags)
3782{
3783 if (attr == NULL)
3784 return 0;
3785
3786 *flags = ntohl(nla_get_be32(attr));
3787 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3788 return -EINVAL;
3789 if (!(set->flags & NFT_SET_INTERVAL) &&
3790 *flags & NFT_SET_ELEM_INTERVAL_END)
3791 return -EINVAL;
3792
3793 return 0;
3794}
3795
60319eb1 3796static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
c016c7e4 3797 const struct nlattr *attr, u32 nlmsg_flags)
20a69341
PM		 3798{
3799 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
8aeff920 3800 u8 genmask = nft_genmask_next(ctx->net);
20a69341 3801 struct nft_data_desc d1, d2;
fe2811eb 3802 struct nft_set_ext_tmpl tmpl;
c016c7e4 3803 struct nft_set_ext *ext, *ext2;
20a69341
PM		 3804 struct nft_set_elem elem;
3805 struct nft_set_binding *binding;
8aeff920 3806 struct nft_object *obj = NULL;
68e942e8 3807 struct nft_userdata *udata;
fe2811eb 3808 struct nft_data data;
20a69341 3809 enum nft_registers dreg;
60319eb1 3810 struct nft_trans *trans;
0e9091d6 3811 u32 flags = 0;
c3e1b005 3812 u64 timeout;
68e942e8 3813 u8 ulen;
20a69341
PM		 3814 int err;
3815
3816 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 3817 nft_set_elem_policy, NULL);
20a69341
PM		 3818 if (err < 0)
3819 return err;
3820
3821 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3822 return -EINVAL;
3823
fe2811eb
PM		 3824 nft_set_ext_prepare(&tmpl);
3825
0e9091d6
PNA		 3826 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3827 if (err < 0)
3828 return err;
3829 if (flags != 0)
3830 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
20a69341
PM		 3831
3832 if (set->flags & NFT_SET_MAP) {
3833 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
fe2811eb 3834 !(flags & NFT_SET_ELEM_INTERVAL_END))
20a69341 3835 return -EINVAL;
bd7fc645 3836 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
fe2811eb 3837 flags & NFT_SET_ELEM_INTERVAL_END)
bd7fc645 3838 return -EINVAL;
20a69341
PM		 3839 } else {
3840 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3841 return -EINVAL;
3842 }
3843
c3e1b005
PM		 3844 timeout = 0;
3845 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
3846 if (!(set->flags & NFT_SET_TIMEOUT))
3847 return -EINVAL;
d3e2a111
AP		 3848 timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
3849 nla[NFTA_SET_ELEM_TIMEOUT])));
c3e1b005
PM		 3850 } else if (set->flags & NFT_SET_TIMEOUT) {
3851 timeout = set->timeout;
3852 }
3853
7d740264 3854 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
d0a11fc3 3855 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 3856 if (err < 0)
3857 goto err1;
3858 err = -EINVAL;
3859 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3860 goto err2;
3861
7d740264 3862 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
c3e1b005
PM		 3863 if (timeout > 0) {
3864 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
3865 if (timeout != set->timeout)
3866 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
3867 }
fe2811eb 3868
8aeff920
PNA		 3869 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
3870 if (!(set->flags & NFT_SET_OBJECT)) {
3871 err = -EINVAL;
3872 goto err2;
3873 }
3874 obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
3875 set->objtype, genmask);
3876 if (IS_ERR(obj)) {
3877 err = PTR_ERR(obj);
3878 goto err2;
3879 }
3880 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
3881 }
3882
20a69341 3883 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
d0a11fc3
PM		 3884 err = nft_data_init(ctx, &data, sizeof(data), &d2,
3885 nla[NFTA_SET_ELEM_DATA]);
20a69341
PM		 3886 if (err < 0)
3887 goto err2;
3888
3889 err = -EINVAL;
3890 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3891 goto err3;
3892
3893 dreg = nft_type_to_reg(set->dtype);
3894 list_for_each_entry(binding, &set->bindings, list) {
3895 struct nft_ctx bind_ctx = {
58c78e10 3896 .net = ctx->net,
20a69341
PM		 3897 .afi = ctx->afi,
3898 .table = ctx->table,
7c95f6d8 3899 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 3900 };
3901
11113e19
PM		 3902 if (!(binding->flags & NFT_SET_MAP))
3903 continue;
3904
1ec10212
PM		 3905 err = nft_validate_register_store(&bind_ctx, dreg,
3906 &data,
3907 d2.type, d2.len);
20a69341
PM		 3908 if (err < 0)
3909 goto err3;
3910 }
fe2811eb 3911
7d740264 3912 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
20a69341
PM		 3913 }
3914
68e942e8
PM		 3915 /* The full maximum length of userdata can exceed the maximum
3916 * offset value (U8_MAX) for following extensions, therefor it
3917 * must be the last extension added.
3918 */
3919 ulen = 0;
3920 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
3921 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
3922 if (ulen > 0)
3923 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
3924 ulen);
3925 }
3926
fe2811eb 3927 err = -ENOMEM;
7d740264 3928 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
c3e1b005 3929 timeout, GFP_KERNEL);
fe2811eb
PM		 3930 if (elem.priv == NULL)
3931 goto err3;
3932
3933 ext = nft_set_elem_ext(set, elem.priv);
3934 if (flags)
3935 *nft_set_ext_flags(ext) = flags;
68e942e8
PM		 3936 if (ulen > 0) {
3937 udata = nft_set_ext_userdata(ext);
3938 udata->len = ulen - 1;
3939 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
3940 }
8aeff920
PNA		 3941 if (obj) {
3942 *nft_set_ext_obj(ext) = obj;
3943 obj->use++;
3944 }
fe2811eb 3945
60319eb1
PNA		 3946 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
3947 if (trans == NULL)
fe2811eb 3948 goto err4;
60319eb1 3949
69086658 3950 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
c016c7e4
PNA		 3951 err = set->ops->insert(ctx->net, set, &elem, &ext2);
3952 if (err) {
3953 if (err == -EEXIST) {
9744a6fc
PNA		 3954 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
3955 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
3956 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
3957 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
3958 return -EBUSY;
8aeff920
PNA		 3959 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3960 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
3961 memcmp(nft_set_ext_data(ext),
3962 nft_set_ext_data(ext2), set->dlen) != 0) ||
3963 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3964 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
3965 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
c016c7e4
PNA		 3966 err = -EBUSY;
3967 else if (!(nlmsg_flags & NLM_F_EXCL))
3968 err = 0;
3969 }
fe2811eb 3970 goto err5;
c016c7e4 3971 }
20a69341 3972
35d0ac90
PNA		 3973 if (set->size &&
3974 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
3975 err = -ENFILE;
3976 goto err6;
3977 }
3978
60319eb1 3979 nft_trans_elem(trans) = elem;
46bbafce 3980 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
20a69341
PM		 3981 return 0;
3982
35d0ac90 3983err6:
5cb82a38 3984 set->ops->remove(ctx->net, set, &elem);
fe2811eb 3985err5:
60319eb1 3986 kfree(trans);
fe2811eb
PM		 3987err4:
3988 kfree(elem.priv);
20a69341
PM		 3989err3:
3990 if (nla[NFTA_SET_ELEM_DATA] != NULL)
59105446 3991 nft_data_release(&data, d2.type);
20a69341 3992err2:
59105446 3993 nft_data_release(&elem.key.val, d1.type);
20a69341
PM		 3994err1:
3995 return err;
3996}
3997
633c9a84
PNA		 3998static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
3999 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4000 const struct nlattr * const nla[],
4001 struct netlink_ext_ack *extack)
20a69341 4002{
f2a6d766 4003 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4004 const struct nlattr *attr;
4005 struct nft_set *set;
4006 struct nft_ctx ctx;
60319eb1 4007 int rem, err = 0;
20a69341 4008
7d5570ca
PNA		 4009 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4010 return -EINVAL;
4011
f2a6d766 4012 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 4013 if (err < 0)
4014 return err;
4015
37a9cc52
PNA		 4016 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4017 genmask);
958bee14
PNA		 4018 if (IS_ERR(set)) {
4019 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
4020 set = nf_tables_set_lookup_byid(net,
37a9cc52
PNA		 4021 nla[NFTA_SET_ELEM_LIST_SET_ID],
4022 genmask);
958bee14
PNA		 4023 }
4024 if (IS_ERR(set))
4025 return PTR_ERR(set);
4026 }
4027
20a69341
PM		 4028 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4029 return -EBUSY;
4030
4031 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
c016c7e4 4032 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
35d0ac90 4033 if (err < 0)
60319eb1 4034 break;
20a69341 4035 }
60319eb1 4036 return err;
20a69341
PM		 4037}
4038
59105446
PNA		 4039/**
4040 * nft_data_hold - hold a nft_data item
4041 *
4042 * @data: struct nft_data to release
4043 * @type: type of data
4044 *
4045 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4046 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4047 * NFT_GOTO verdicts. This function must be called on active data objects
4048 * from the second phase of the commit protocol.
4049 */
4050static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4051{
4052 if (type == NFT_DATA_VERDICT) {
4053 switch (data->verdict.code) {
4054 case NFT_JUMP:
4055 case NFT_GOTO:
4056 data->verdict.chain->use++;
4057 break;
4058 }
4059 }
4060}
4061
4062static void nft_set_elem_activate(const struct net *net,
4063 const struct nft_set *set,
4064 struct nft_set_elem *elem)
4065{
4066 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4067
4068 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4069 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4070 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4071 (*nft_set_ext_obj(ext))->use++;
4072}
4073
4074static void nft_set_elem_deactivate(const struct net *net,
4075 const struct nft_set *set,
4076 struct nft_set_elem *elem)
4077{
4078 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4079
4080 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4081 nft_data_release(nft_set_ext_data(ext), set->dtype);
4082 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4083 (*nft_set_ext_obj(ext))->use--;
4084}
4085
60319eb1 4086static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
20a69341
PM		 4087 const struct nlattr *attr)
4088{
4089 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3971ca14 4090 struct nft_set_ext_tmpl tmpl;
20a69341
PM		 4091 struct nft_data_desc desc;
4092 struct nft_set_elem elem;
3971ca14 4093 struct nft_set_ext *ext;
60319eb1 4094 struct nft_trans *trans;
3971ca14
PNA		 4095 u32 flags = 0;
4096 void *priv;
20a69341
PM		 4097 int err;
4098
4099 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
fceb6435 4100 nft_set_elem_policy, NULL);
20a69341
PM		 4101 if (err < 0)
4102 goto err1;
4103
4104 err = -EINVAL;
4105 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4106 goto err1;
4107
3971ca14
PNA		 4108 nft_set_ext_prepare(&tmpl);
4109
4110 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4111 if (err < 0)
4112 return err;
4113 if (flags != 0)
4114 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4115
7d740264 4116 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
d0a11fc3 4117 nla[NFTA_SET_ELEM_KEY]);
20a69341
PM		 4118 if (err < 0)
4119 goto err1;
4120
4121 err = -EINVAL;
4122 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4123 goto err2;
4124
3971ca14
PNA		 4125 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4126
4127 err = -ENOMEM;
4128 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4129 GFP_KERNEL);
4130 if (elem.priv == NULL)
4131 goto err2;
4132
4133 ext = nft_set_elem_ext(set, elem.priv);
4134 if (flags)
4135 *nft_set_ext_flags(ext) = flags;
4136
60319eb1 4137 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
609ccf08
JL		 4138 if (trans == NULL) {
4139 err = -ENOMEM;
3971ca14 4140 goto err3;
609ccf08 4141 }
20a69341 4142
42a55769 4143 priv = set->ops->deactivate(ctx->net, set, &elem);
3971ca14 4144 if (priv == NULL) {
cc02e457 4145 err = -ENOENT;
3971ca14 4146 goto err4;
cc02e457 4147 }
3971ca14
PNA		 4148 kfree(elem.priv);
4149 elem.priv = priv;
cc02e457 4150
59105446
PNA		 4151 nft_set_elem_deactivate(ctx->net, set, &elem);
4152
60319eb1 4153 nft_trans_elem(trans) = elem;
46bbafce 4154 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0dc13625 4155 return 0;
cc02e457 4156
3971ca14 4157err4:
cc02e457 4158 kfree(trans);
3971ca14
PNA		 4159err3:
4160 kfree(elem.priv);
20a69341 4161err2:
59105446 4162 nft_data_release(&elem.key.val, desc.type);
20a69341
PM		 4163err1:
4164 return err;
4165}
4166
8411b644 4167static int nft_flush_set(const struct nft_ctx *ctx,
de70185d 4168 struct nft_set *set,
8411b644 4169 const struct nft_set_iter *iter,
de70185d 4170 struct nft_set_elem *elem)
8411b644
PNA		 4171{
4172 struct nft_trans *trans;
4173 int err;
4174
4175 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4176 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4177 if (!trans)
4178 return -ENOMEM;
4179
1ba1c414 4180 if (!set->ops->flush(ctx->net, set, elem->priv)) {
8411b644
PNA		 4181 err = -ENOENT;
4182 goto err1;
4183 }
b2c11e4b 4184 set->ndeact++;
8411b644 4185
de70185d
PNA		 4186 nft_trans_elem_set(trans) = set;
4187 nft_trans_elem(trans) = *elem;
8411b644
PNA		 4188 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4189
4190 return 0;
4191err1:
4192 kfree(trans);
4193 return err;
4194}
4195
633c9a84
PNA		 4196static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4197 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4198 const struct nlattr * const nla[],
4199 struct netlink_ext_ack *extack)
20a69341 4200{
f2a6d766 4201 u8 genmask = nft_genmask_next(net);
20a69341
PM		 4202 const struct nlattr *attr;
4203 struct nft_set *set;
4204 struct nft_ctx ctx;
60319eb1 4205 int rem, err = 0;
20a69341 4206
f2a6d766 4207 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
20a69341
PM		 4208 if (err < 0)
4209 return err;
4210
37a9cc52
PNA		 4211 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4212 genmask);
20a69341
PM		 4213 if (IS_ERR(set))
4214 return PTR_ERR(set);
4215 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4216 return -EBUSY;
4217
8411b644 4218 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
baa2d42c
PNA		 4219 struct nft_set_iter iter = {
4220 .genmask = genmask,
4221 .fn = nft_flush_set,
8411b644 4222 };
baa2d42c 4223 set->ops->walk(&ctx, set, &iter);
8411b644 4224
baa2d42c 4225 return iter.err;
8411b644
PNA		 4226 }
4227
20a69341
PM		 4228 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4229 err = nft_del_setelem(&ctx, set, attr);
4230 if (err < 0)
60319eb1 4231 break;
4fefee57 4232
3dd0673a 4233 set->ndeact++;
20a69341 4234 }
60319eb1 4235 return err;
20a69341
PM		 4236}
4237
cfed7e1b
PM		 4238void nft_set_gc_batch_release(struct rcu_head *rcu)
4239{
4240 struct nft_set_gc_batch *gcb;
4241 unsigned int i;
4242
4243 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4244 for (i = 0; i < gcb->head.cnt; i++)
61f9e292 4245 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
cfed7e1b
PM		 4246 kfree(gcb);
4247}
4248EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4249
4250struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4251 gfp_t gfp)
4252{
4253 struct nft_set_gc_batch *gcb;
4254
4255 gcb = kzalloc(sizeof(*gcb), gfp);
4256 if (gcb == NULL)
4257 return gcb;
4258 gcb->head.set = set;
4259 return gcb;
4260}
4261EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4262
e5009240
PNA		 4263/*
4264 * Stateful objects
4265 */
4266
4267/**
4268 * nft_register_obj- register nf_tables stateful object type
4269 * @obj: object type
4270 *
4271 * Registers the object type for use with nf_tables. Returns zero on
4272 * success or a negative errno code otherwise.
4273 */
4274int nft_register_obj(struct nft_object_type *obj_type)
4275{
4276 if (obj_type->type == NFT_OBJECT_UNSPEC)
4277 return -EINVAL;
4278
4279 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4280 list_add_rcu(&obj_type->list, &nf_tables_objects);
4281 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4282 return 0;
4283}
4284EXPORT_SYMBOL_GPL(nft_register_obj);
4285
4286/**
4287 * nft_unregister_obj - unregister nf_tables object type
4288 * @obj: object type
4289 *
4290 * Unregisters the object type for use with nf_tables.
4291 */
4292void nft_unregister_obj(struct nft_object_type *obj_type)
4293{
4294 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4295 list_del_rcu(&obj_type->list);
4296 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4297}
4298EXPORT_SYMBOL_GPL(nft_unregister_obj);
4299
4300struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
4301 const struct nlattr *nla,
4302 u32 objtype, u8 genmask)
4303{
4304 struct nft_object *obj;
4305
4306 list_for_each_entry(obj, &table->objects, list) {
4307 if (!nla_strcmp(nla, obj->name) &&
dfc46034 4308 objtype == obj->ops->type->type &&
e5009240
PNA		 4309 nft_active_genmask(obj, genmask))
4310 return obj;
4311 }
4312 return ERR_PTR(-ENOENT);
4313}
4314EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
4315
4316static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
b2fbd044
LZ		 4317 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4318 .len = NFT_TABLE_MAXNAMELEN - 1 },
4319 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4320 .len = NFT_OBJ_MAXNAMELEN - 1 },
e5009240
PNA		 4321 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4322 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4323};
4324
84fba055
FW		 4325static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4326 const struct nft_object_type *type,
e5009240
PNA		 4327 const struct nlattr *attr)
4328{
4329 struct nlattr *tb[type->maxattr + 1];
dfc46034 4330 const struct nft_object_ops *ops;
e5009240
PNA		 4331 struct nft_object *obj;
4332 int err;
4333
4334 if (attr) {
fceb6435
JB		 4335 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4336 NULL);
e5009240
PNA		 4337 if (err < 0)
4338 goto err1;
4339 } else {
4340 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4341 }
4342
dfc46034
PBG		 4343 if (type->select_ops) {
4344 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4345 if (IS_ERR(ops)) {
4346 err = PTR_ERR(ops);
4347 goto err1;
4348 }
4349 } else {
4350 ops = type->ops;
4351 }
4352
e5009240 4353 err = -ENOMEM;
dfc46034 4354 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
e5009240
PNA		 4355 if (obj == NULL)
4356 goto err1;
4357
dfc46034 4358 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
e5009240
PNA		 4359 if (err < 0)
4360 goto err2;
4361
dfc46034
PBG		 4362 obj->ops = ops;
4363
e5009240
PNA		 4364 return obj;
4365err2:
4366 kfree(obj);
4367err1:
4368 return ERR_PTR(err);
4369}
4370
4371static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
43da04a5 4372 struct nft_object *obj, bool reset)
e5009240
PNA		 4373{
4374 struct nlattr *nest;
4375
4376 nest = nla_nest_start(skb, attr);
4377 if (!nest)
4378 goto nla_put_failure;
dfc46034 4379 if (obj->ops->dump(skb, obj, reset) < 0)
e5009240
PNA		 4380 goto nla_put_failure;
4381 nla_nest_end(skb, nest);
4382 return 0;
4383
4384nla_put_failure:
4385 return -1;
4386}
4387
4388static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4389{
4390 const struct nft_object_type *type;
4391
4392 list_for_each_entry(type, &nf_tables_objects, list) {
4393 if (objtype == type->type)
4394 return type;
4395 }
4396 return NULL;
4397}
4398
4399static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4400{
4401 const struct nft_object_type *type;
4402
4403 type = __nft_obj_type_get(objtype);
4404 if (type != NULL && try_module_get(type->owner))
4405 return type;
4406
4407#ifdef CONFIG_MODULES
4408 if (type == NULL) {
4409 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4410 request_module("nft-obj-%u", objtype);
4411 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4412 if (__nft_obj_type_get(objtype))
4413 return ERR_PTR(-EAGAIN);
4414 }
4415#endif
4416 return ERR_PTR(-ENOENT);
4417}
4418
4419static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4420 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4421 const struct nlattr * const nla[],
4422 struct netlink_ext_ack *extack)
e5009240
PNA		 4423{
4424 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4425 const struct nft_object_type *type;
4426 u8 genmask = nft_genmask_next(net);
4427 int family = nfmsg->nfgen_family;
4428 struct nft_af_info *afi;
4429 struct nft_table *table;
4430 struct nft_object *obj;
4431 struct nft_ctx ctx;
4432 u32 objtype;
4433 int err;
4434
4435 if (!nla[NFTA_OBJ_TYPE] ||
4436 !nla[NFTA_OBJ_NAME] ||
4437 !nla[NFTA_OBJ_DATA])
4438 return -EINVAL;
4439
4440 afi = nf_tables_afinfo_lookup(net, family, true);
4441 if (IS_ERR(afi))
4442 return PTR_ERR(afi);
4443
4444 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4445 if (IS_ERR(table))
4446 return PTR_ERR(table);
4447
4448 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4449 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4450 if (IS_ERR(obj)) {
4451 err = PTR_ERR(obj);
4452 if (err != -ENOENT)
4453 return err;
4454
1a28ad74 4455 } else {
e5009240
PNA		 4456 if (nlh->nlmsg_flags & NLM_F_EXCL)
4457 return -EEXIST;
4458
4459 return 0;
4460 }
4461
4462 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4463
4464 type = nft_obj_type_get(objtype);
4465 if (IS_ERR(type))
4466 return PTR_ERR(type);
4467
84fba055 4468 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
e5009240
PNA		 4469 if (IS_ERR(obj)) {
4470 err = PTR_ERR(obj);
4471 goto err1;
4472 }
18965317 4473 obj->table = table;
61509575
PS		 4474 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4475 if (!obj->name) {
4476 err = -ENOMEM;
4477 goto err2;
4478 }
e5009240
PNA		 4479
4480 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4481 if (err < 0)
61509575 4482 goto err3;
e5009240
PNA		 4483
4484 list_add_tail_rcu(&obj->list, &table->objects);
4485 table->use++;
4486 return 0;
61509575
PS		 4487err3:
4488 kfree(obj->name);
e5009240 4489err2:
dfc46034
PBG		 4490 if (obj->ops->destroy)
4491 obj->ops->destroy(obj);
e5009240
PNA		 4492 kfree(obj);
4493err1:
4494 module_put(type->owner);
4495 return err;
4496}
4497
4498static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4499 u32 portid, u32 seq, int event, u32 flags,
4500 int family, const struct nft_table *table,
43da04a5 4501 struct nft_object *obj, bool reset)
e5009240
PNA		 4502{
4503 struct nfgenmsg *nfmsg;
4504 struct nlmsghdr *nlh;
4505
dedb67c4 4506 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
e5009240
PNA		 4507 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4508 if (nlh == NULL)
4509 goto nla_put_failure;
4510
4511 nfmsg = nlmsg_data(nlh);
4512 nfmsg->nfgen_family = family;
4513 nfmsg->version = NFNETLINK_V0;
4514 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4515
4516 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4517 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
dfc46034 4518 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
e5009240 4519 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
43da04a5 4520 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset))
e5009240
PNA		 4521 goto nla_put_failure;
4522
4523 nlmsg_end(skb, nlh);
4524 return 0;
4525
4526nla_put_failure:
4527 nlmsg_trim(skb, nlh);
4528 return -1;
4529}
4530
a9fea2a3 4531struct nft_obj_filter {
e46abbcc 4532 char *table;
a9fea2a3
PNA		 4533 u32 type;
4534};
4535
e5009240
PNA		 4536static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4537{
4538 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
4539 const struct nft_af_info *afi;
4540 const struct nft_table *table;
e5009240 4541 unsigned int idx = 0, s_idx = cb->args[0];
a9fea2a3 4542 struct nft_obj_filter *filter = cb->data;
e5009240
PNA		 4543 struct net *net = sock_net(skb->sk);
4544 int family = nfmsg->nfgen_family;
43da04a5
PNA		 4545 struct nft_object *obj;
4546 bool reset = false;
4547
4548 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4549 reset = true;
e5009240
PNA		 4550
4551 rcu_read_lock();
4552 cb->seq = net->nft.base_seq;
4553
4554 list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
4555 if (family != NFPROTO_UNSPEC && family != afi->family)
4556 continue;
4557
4558 list_for_each_entry_rcu(table, &afi->tables, list) {
4559 list_for_each_entry_rcu(obj, &table->objects, list) {
4560 if (!nft_is_active(net, obj))
4561 goto cont;
4562 if (idx < s_idx)
4563 goto cont;
4564 if (idx > s_idx)
4565 memset(&cb->args[1], 0,
4566 sizeof(cb->args) - sizeof(cb->args[0]));
d21e540b 4567 if (filter && filter->table[0] &&
a9fea2a3
PNA		 4568 strcmp(filter->table, table->name))
4569 goto cont;
d21e540b
LZ		 4570 if (filter &&
4571 filter->type != NFT_OBJECT_UNSPEC &&
dfc46034 4572 obj->ops->type->type != filter->type)
a9fea2a3
PNA		 4573 goto cont;
4574
e5009240
PNA		 4575 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4576 cb->nlh->nlmsg_seq,
4577 NFT_MSG_NEWOBJ,
4578 NLM_F_MULTI | NLM_F_APPEND,
43da04a5 4579 afi->family, table, obj, reset) < 0)
e5009240
PNA		 4580 goto done;
4581
4582 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4583cont:
4584 idx++;
4585 }
4586 }
4587 }
4588done:
4589 rcu_read_unlock();
4590
4591 cb->args[0] = idx;
4592 return skb->len;
4593}
4594
a9fea2a3
PNA		 4595static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4596{
e46abbcc
PS		 4597 struct nft_obj_filter *filter = cb->data;
4598
cbc3dbfe
HL		 4599 if (filter) {
4600 kfree(filter->table);
4601 kfree(filter);
4602 }
a9fea2a3
PNA		 4603
4604 return 0;
4605}
4606
4607static struct nft_obj_filter *
4608nft_obj_filter_alloc(const struct nlattr * const nla[])
4609{
4610 struct nft_obj_filter *filter;
4611
4612 filter = kzalloc(sizeof(*filter), GFP_KERNEL);
4613 if (!filter)
4614 return ERR_PTR(-ENOMEM);
4615
e46abbcc
PS		 4616 if (nla[NFTA_OBJ_TABLE]) {
4617 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_KERNEL);
4618 if (!filter->table) {
4619 kfree(filter);
4620 return ERR_PTR(-ENOMEM);
4621 }
4622 }
a9fea2a3
PNA		 4623 if (nla[NFTA_OBJ_TYPE])
4624 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4625
4626 return filter;
4627}
4628
e5009240
PNA		 4629static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4630 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4631 const struct nlattr * const nla[],
4632 struct netlink_ext_ack *extack)
e5009240
PNA		 4633{
4634 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4635 u8 genmask = nft_genmask_cur(net);
4636 int family = nfmsg->nfgen_family;
4637 const struct nft_af_info *afi;
4638 const struct nft_table *table;
4639 struct nft_object *obj;
4640 struct sk_buff *skb2;
43da04a5 4641 bool reset = false;
e5009240
PNA		 4642 u32 objtype;
4643 int err;
4644
4645 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4646 struct netlink_dump_control c = {
4647 .dump = nf_tables_dump_obj,
a9fea2a3 4648 .done = nf_tables_dump_obj_done,
e5009240 4649 };
a9fea2a3
PNA		 4650
4651 if (nla[NFTA_OBJ_TABLE] ||
4652 nla[NFTA_OBJ_TYPE]) {
4653 struct nft_obj_filter *filter;
4654
4655 filter = nft_obj_filter_alloc(nla);
4656 if (IS_ERR(filter))
4657 return -ENOMEM;
4658
4659 c.data = filter;
4660 }
e5009240
PNA		 4661 return netlink_dump_start(nlsk, skb, nlh, &c);
4662 }
4663
4664 if (!nla[NFTA_OBJ_NAME] ||
4665 !nla[NFTA_OBJ_TYPE])
4666 return -EINVAL;
4667
4668 afi = nf_tables_afinfo_lookup(net, family, false);
4669 if (IS_ERR(afi))
4670 return PTR_ERR(afi);
4671
4672 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4673 if (IS_ERR(table))
4674 return PTR_ERR(table);
4675
4676 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4677 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4678 if (IS_ERR(obj))
4679 return PTR_ERR(obj);
4680
4681 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4682 if (!skb2)
4683 return -ENOMEM;
4684
43da04a5
PNA		 4685 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4686 reset = true;
4687
e5009240
PNA		 4688 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4689 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
43da04a5 4690 family, table, obj, reset);
e5009240
PNA		 4691 if (err < 0)
4692 goto err;
4693
4694 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4695err:
4696 kfree_skb(skb2);
4697 return err;
e5009240
PNA		 4698}
4699
4700static void nft_obj_destroy(struct nft_object *obj)
4701{
dfc46034
PBG		 4702 if (obj->ops->destroy)
4703 obj->ops->destroy(obj);
e5009240 4704
dfc46034 4705 module_put(obj->ops->type->owner);
61509575 4706 kfree(obj->name);
e5009240
PNA		 4707 kfree(obj);
4708}
4709
4710static int nf_tables_delobj(struct net *net, struct sock *nlsk,
04ba724b
PNA		 4711 struct sk_buff *skb, const struct nlmsghdr *nlh,
4712 const struct nlattr * const nla[],
4713 struct netlink_ext_ack *extack)
e5009240
PNA		 4714{
4715 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4716 u8 genmask = nft_genmask_next(net);
4717 int family = nfmsg->nfgen_family;
4718 struct nft_af_info *afi;
4719 struct nft_table *table;
4720 struct nft_object *obj;
4721 struct nft_ctx ctx;
4722 u32 objtype;
4723
4724 if (!nla[NFTA_OBJ_TYPE] ||
4725 !nla[NFTA_OBJ_NAME])
4726 return -EINVAL;
4727
4728 afi = nf_tables_afinfo_lookup(net, family, true);
4729 if (IS_ERR(afi))
4730 return PTR_ERR(afi);
4731
4732 table = nf_tables_table_lookup(afi, nla[NFTA_OBJ_TABLE], genmask);
4733 if (IS_ERR(table))
4734 return PTR_ERR(table);
4735
4736 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4737 obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4738 if (IS_ERR(obj))
4739 return PTR_ERR(obj);
4740 if (obj->use > 0)
4741 return -EBUSY;
4742
4743 nft_ctx_init(&ctx, net, skb, nlh, afi, table, NULL, nla);
4744
4745 return nft_delobj(&ctx, obj);
4746}
4747
25e94a99
PNA		 4748void nft_obj_notify(struct net *net, struct nft_table *table,
4749 struct nft_object *obj, u32 portid, u32 seq, int event,
4750 int family, int report, gfp_t gfp)
e5009240
PNA		 4751{
4752 struct sk_buff *skb;
4753 int err;
4754
2599e989
PNA		 4755 if (!report &&
4756 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4757 return;
e5009240 4758
2599e989 4759 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
e5009240
PNA		 4760 if (skb == NULL)
4761 goto err;
4762
2599e989
PNA		 4763 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
4764 table, obj, false);
e5009240
PNA		 4765 if (err < 0) {
4766 kfree_skb(skb);
4767 goto err;
4768 }
4769
25e94a99
PNA		 4770 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
4771 return;
e5009240 4772err:
25e94a99 4773 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
e5009240 4774}
2599e989
PNA		 4775EXPORT_SYMBOL_GPL(nft_obj_notify);
4776
25e94a99
PNA		 4777static void nf_tables_obj_notify(const struct nft_ctx *ctx,
4778 struct nft_object *obj, int event)
2599e989 4779{
25e94a99
PNA		 4780 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
4781 ctx->afi->family, ctx->report, GFP_KERNEL);
2599e989 4782}
e5009240 4783
84d7fce6
PNA		 4784static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
4785 u32 portid, u32 seq)
4786{
4787 struct nlmsghdr *nlh;
4788 struct nfgenmsg *nfmsg;
784b4e61 4789 char buf[TASK_COMM_LEN];
dedb67c4 4790 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
84d7fce6
PNA		 4791
4792 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
4793 if (nlh == NULL)
4794 goto nla_put_failure;
4795
4796 nfmsg = nlmsg_data(nlh);
4797 nfmsg->nfgen_family = AF_UNSPEC;
4798 nfmsg->version = NFNETLINK_V0;
4799 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4800
784b4e61
PS		 4801 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
4802 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
4803 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
84d7fce6
PNA		 4804 goto nla_put_failure;
4805
053c095a
JB		 4806 nlmsg_end(skb, nlh);
4807 return 0;
84d7fce6
PNA		 4808
4809nla_put_failure:
4810 nlmsg_trim(skb, nlh);
4811 return -EMSGSIZE;
4812}
4813
25e94a99
PNA		 4814static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
4815 int event)
84d7fce6
PNA		 4816{
4817 struct nlmsghdr *nlh = nlmsg_hdr(skb);
4818 struct sk_buff *skb2;
4819 int err;
4820
4821 if (nlmsg_report(nlh) &&
4822 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
25e94a99 4823 return;
84d7fce6 4824
84d7fce6
PNA		 4825 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4826 if (skb2 == NULL)
4827 goto err;
4828
4829 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
4830 nlh->nlmsg_seq);
4831 if (err < 0) {
4832 kfree_skb(skb2);
4833 goto err;
4834 }
4835
25e94a99
PNA		 4836 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
4837 nlmsg_report(nlh), GFP_KERNEL);
4838 return;
84d7fce6 4839err:
25e94a99
PNA		 4840 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
4841 -ENOBUFS);
84d7fce6
PNA		 4842}
4843
7b8002a1
PNA		 4844static int nf_tables_getgen(struct net *net, struct sock *nlsk,
4845 struct sk_buff *skb, const struct nlmsghdr *nlh,
04ba724b
PNA		 4846 const struct nlattr * const nla[],
4847 struct netlink_ext_ack *extack)
84d7fce6 4848{
84d7fce6
PNA		 4849 struct sk_buff *skb2;
4850 int err;
4851
4852 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4853 if (skb2 == NULL)
4854 return -ENOMEM;
4855
4856 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
4857 nlh->nlmsg_seq);
4858 if (err < 0)
4859 goto err;
4860
4861 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
4862err:
4863 kfree_skb(skb2);
4864 return err;
4865}
4866
96518518
PM		 4867static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
4868 [NFT_MSG_NEWTABLE] = {
55dd6f93 4869 .call_batch = nf_tables_newtable,
96518518
PM		 4870 .attr_count = NFTA_TABLE_MAX,
4871 .policy = nft_table_policy,
4872 },
4873 [NFT_MSG_GETTABLE] = {
4874 .call = nf_tables_gettable,
4875 .attr_count = NFTA_TABLE_MAX,
4876 .policy = nft_table_policy,
4877 },
4878 [NFT_MSG_DELTABLE] = {
55dd6f93 4879 .call_batch = nf_tables_deltable,
96518518
PM		 4880 .attr_count = NFTA_TABLE_MAX,
4881 .policy = nft_table_policy,
4882 },
4883 [NFT_MSG_NEWCHAIN] = {
91c7b38d 4884 .call_batch = nf_tables_newchain,
96518518
PM		 4885 .attr_count = NFTA_CHAIN_MAX,
4886 .policy = nft_chain_policy,
4887 },
4888 [NFT_MSG_GETCHAIN] = {
4889 .call = nf_tables_getchain,
4890 .attr_count = NFTA_CHAIN_MAX,
4891 .policy = nft_chain_policy,
4892 },
4893 [NFT_MSG_DELCHAIN] = {
91c7b38d 4894 .call_batch = nf_tables_delchain,
96518518
PM		 4895 .attr_count = NFTA_CHAIN_MAX,
4896 .policy = nft_chain_policy,
4897 },
4898 [NFT_MSG_NEWRULE] = {
0628b123 4899 .call_batch = nf_tables_newrule,
96518518
PM		 4900 .attr_count = NFTA_RULE_MAX,
4901 .policy = nft_rule_policy,
4902 },
4903 [NFT_MSG_GETRULE] = {
4904 .call = nf_tables_getrule,
4905 .attr_count = NFTA_RULE_MAX,
4906 .policy = nft_rule_policy,
4907 },
4908 [NFT_MSG_DELRULE] = {
0628b123 4909 .call_batch = nf_tables_delrule,
96518518
PM		 4910 .attr_count = NFTA_RULE_MAX,
4911 .policy = nft_rule_policy,
4912 },
20a69341 4913 [NFT_MSG_NEWSET] = {
958bee14 4914 .call_batch = nf_tables_newset,
20a69341
PM		 4915 .attr_count = NFTA_SET_MAX,
4916 .policy = nft_set_policy,
4917 },
4918 [NFT_MSG_GETSET] = {
4919 .call = nf_tables_getset,
4920 .attr_count = NFTA_SET_MAX,
4921 .policy = nft_set_policy,
4922 },
4923 [NFT_MSG_DELSET] = {
958bee14 4924 .call_batch = nf_tables_delset,
20a69341
PM		 4925 .attr_count = NFTA_SET_MAX,
4926 .policy = nft_set_policy,
4927 },
4928 [NFT_MSG_NEWSETELEM] = {
958bee14 4929 .call_batch = nf_tables_newsetelem,
20a69341
PM		 4930 .attr_count = NFTA_SET_ELEM_LIST_MAX,
4931 .policy = nft_set_elem_list_policy,
4932 },
4933 [NFT_MSG_GETSETELEM] = {
4934 .call = nf_tables_getsetelem,
4935 .attr_count = NFTA_SET_ELEM_LIST_MAX,
4936 .policy = nft_set_elem_list_policy,
4937 },
4938 [NFT_MSG_DELSETELEM] = {
958bee14 4939 .call_batch = nf_tables_delsetelem,
20a69341
PM		 4940 .attr_count = NFTA_SET_ELEM_LIST_MAX,
4941 .policy = nft_set_elem_list_policy,
4942 },
84d7fce6
PNA		 4943 [NFT_MSG_GETGEN] = {
4944 .call = nf_tables_getgen,
4945 },
e5009240
PNA		 4946 [NFT_MSG_NEWOBJ] = {
4947 .call_batch = nf_tables_newobj,
4948 .attr_count = NFTA_OBJ_MAX,
4949 .policy = nft_obj_policy,
4950 },
4951 [NFT_MSG_GETOBJ] = {
4952 .call = nf_tables_getobj,
4953 .attr_count = NFTA_OBJ_MAX,
4954 .policy = nft_obj_policy,
4955 },
4956 [NFT_MSG_DELOBJ] = {
4957 .call_batch = nf_tables_delobj,
4958 .attr_count = NFTA_OBJ_MAX,
4959 .policy = nft_obj_policy,
4960 },
43da04a5
PNA		 4961 [NFT_MSG_GETOBJ_RESET] = {
4962 .call = nf_tables_getobj,
4963 .attr_count = NFTA_OBJ_MAX,
4964 .policy = nft_obj_policy,
4965 },
96518518
PM		 4966};
4967
91c7b38d
PNA		 4968static void nft_chain_commit_update(struct nft_trans *trans)
4969{
4970 struct nft_base_chain *basechain;
4971
b7263e07 4972 if (nft_trans_chain_name(trans))
91c7b38d
PNA		 4973 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
4974
f323d954 4975 if (!nft_is_base_chain(trans->ctx.chain))
91c7b38d
PNA		 4976 return;
4977
4978 basechain = nft_base_chain(trans->ctx.chain);
4979 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
4980
4981 switch (nft_trans_chain_policy(trans)) {
4982 case NF_DROP:
4983 case NF_ACCEPT:
4984 basechain->policy = nft_trans_chain_policy(trans);
4985 break;
4986 }
4987}
4988
b326dd37 4989static void nf_tables_commit_release(struct nft_trans *trans)
c7c32e72 4990{
c7c32e72
PNA		 4991 switch (trans->msg_type) {
4992 case NFT_MSG_DELTABLE:
4993 nf_tables_table_destroy(&trans->ctx);
4994 break;
4995 case NFT_MSG_DELCHAIN:
4996 nf_tables_chain_destroy(trans->ctx.chain);
4997 break;
4998 case NFT_MSG_DELRULE:
4999 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5000 break;
5001 case NFT_MSG_DELSET:
5002 nft_set_destroy(nft_trans_set(trans));
5003 break;
61edafbb 5004 case NFT_MSG_DELSETELEM:
59105446
PNA		 5005 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
5006 nft_trans_elem(trans).priv);
61edafbb 5007 break;
e5009240
PNA		 5008 case NFT_MSG_DELOBJ:
5009 nft_obj_destroy(nft_trans_obj(trans));
5010 break;
c7c32e72
PNA		 5011 }
5012 kfree(trans);
5013}
5014
5913beaf 5015static int nf_tables_commit(struct net *net, struct sk_buff *skb)
37082f93 5016{
37082f93 5017 struct nft_trans *trans, *next;
a3716e70 5018 struct nft_trans_elem *te;
37082f93
PNA		 5019
5020 /* Bump generation counter, invalidate any dump in progress */
38e029f1 5021 while (++net->nft.base_seq == 0);
37082f93
PNA		 5022
5023 /* A new generation has just started */
ea4bd995 5024 net->nft.gencursor = nft_gencursor_next(net);
37082f93
PNA		 5025
5026 /* Make sure all packets have left the previous generation before
5027 * purging old rules.
5028 */
5029 synchronize_rcu();
5030
5031 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7 5032 switch (trans->msg_type) {
55dd6f93
PNA		 5033 case NFT_MSG_NEWTABLE:
5034 if (nft_trans_table_update(trans)) {
5035 if (!nft_trans_table_enable(trans)) {
664b0f8c
PNA		 5036 nf_tables_table_disable(net,
5037 trans->ctx.afi,
55dd6f93
PNA		 5038 trans->ctx.table);
5039 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5040 }
5041 } else {
f2a6d766 5042 nft_clear(net, trans->ctx.table);
55dd6f93 5043 }
35151d84 5044 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
55dd6f93
PNA		 5045 nft_trans_destroy(trans);
5046 break;
5047 case NFT_MSG_DELTABLE:
f2a6d766 5048 list_del_rcu(&trans->ctx.table->list);
35151d84 5049 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
55dd6f93 5050 break;
91c7b38d
PNA		 5051 case NFT_MSG_NEWCHAIN:
5052 if (nft_trans_chain_update(trans))
5053 nft_chain_commit_update(trans);
4fefee57 5054 else
664b0f8c 5055 nft_clear(net, trans->ctx.chain);
4fefee57 5056
35151d84 5057 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
91c7b38d
PNA		 5058 nft_trans_destroy(trans);
5059 break;
5060 case NFT_MSG_DELCHAIN:
664b0f8c 5061 list_del_rcu(&trans->ctx.chain->list);
35151d84 5062 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
82bec71d
PNA		 5063 nf_tables_unregister_hooks(trans->ctx.net,
5064 trans->ctx.table,
c5598794
AB		 5065 trans->ctx.chain,
5066 trans->ctx.afi->nops);
91c7b38d 5067 break;
b380e5c7 5068 case NFT_MSG_NEWRULE:
889f7ee7 5069 nft_clear(trans->ctx.net, nft_trans_rule(trans));
35151d84 5070 nf_tables_rule_notify(&trans->ctx,
37082f93 5071 nft_trans_rule(trans),
35151d84 5072 NFT_MSG_NEWRULE);
37082f93 5073 nft_trans_destroy(trans);
b380e5c7
PNA		 5074 break;
5075 case NFT_MSG_DELRULE:
5076 list_del_rcu(&nft_trans_rule(trans)->list);
35151d84
PNA		 5077 nf_tables_rule_notify(&trans->ctx,
5078 nft_trans_rule(trans),
5079 NFT_MSG_DELRULE);
b380e5c7 5080 break;
958bee14 5081 case NFT_MSG_NEWSET:
37a9cc52 5082 nft_clear(net, nft_trans_set(trans));
4fefee57
PNA		 5083 /* This avoids hitting -EBUSY when deleting the table
5084 * from the transaction.
5085 */
5086 if (nft_trans_set(trans)->flags & NFT_SET_ANONYMOUS &&
5087 !list_empty(&nft_trans_set(trans)->bindings))
5088 trans->ctx.table->use--;
5089
958bee14 5090 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5091 NFT_MSG_NEWSET, GFP_KERNEL);
958bee14
PNA		 5092 nft_trans_destroy(trans);
5093 break;
5094 case NFT_MSG_DELSET:
37a9cc52 5095 list_del_rcu(&nft_trans_set(trans)->list);
958bee14 5096 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
31f8441c 5097 NFT_MSG_DELSET, GFP_KERNEL);
958bee14 5098 break;
60319eb1 5099 case NFT_MSG_NEWSETELEM:
cc02e457
PM		 5100 te = (struct nft_trans_elem *)trans->data;
5101
42a55769 5102 te->set->ops->activate(net, te->set, &te->elem);
cc02e457
PM		 5103 nf_tables_setelem_notify(&trans->ctx, te->set,
5104 &te->elem,
60319eb1
PNA		 5105 NFT_MSG_NEWSETELEM, 0);
5106 nft_trans_destroy(trans);
5107 break;
5108 case NFT_MSG_DELSETELEM:
a3716e70 5109 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5110
a3716e70
PNA		 5111 nf_tables_setelem_notify(&trans->ctx, te->set,
5112 &te->elem,
60319eb1 5113 NFT_MSG_DELSETELEM, 0);
5cb82a38 5114 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a
PM		 5115 atomic_dec(&te->set->nelems);
5116 te->set->ndeact--;
60319eb1 5117 break;
e5009240
PNA		 5118 case NFT_MSG_NEWOBJ:
5119 nft_clear(net, nft_trans_obj(trans));
5120 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5121 NFT_MSG_NEWOBJ);
5122 nft_trans_destroy(trans);
5123 break;
5124 case NFT_MSG_DELOBJ:
5125 list_del_rcu(&nft_trans_obj(trans)->list);
5126 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
5127 NFT_MSG_DELOBJ);
5128 break;
37082f93 5129 }
37082f93
PNA		 5130 }
5131
b326dd37
PNA		 5132 synchronize_rcu();
5133
37082f93 5134 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
c7c32e72 5135 list_del(&trans->list);
b326dd37 5136 nf_tables_commit_release(trans);
37082f93 5137 }
84d7fce6
PNA		 5138
5139 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
37082f93
PNA		 5140
5141 return 0;
5142}
5143
b326dd37 5144static void nf_tables_abort_release(struct nft_trans *trans)
c7c32e72 5145{
c7c32e72
PNA		 5146 switch (trans->msg_type) {
5147 case NFT_MSG_NEWTABLE:
5148 nf_tables_table_destroy(&trans->ctx);
5149 break;
5150 case NFT_MSG_NEWCHAIN:
5151 nf_tables_chain_destroy(trans->ctx.chain);
5152 break;
5153 case NFT_MSG_NEWRULE:
5154 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5155 break;
5156 case NFT_MSG_NEWSET:
5157 nft_set_destroy(nft_trans_set(trans));
5158 break;
61edafbb
PM		 5159 case NFT_MSG_NEWSETELEM:
5160 nft_set_elem_destroy(nft_trans_elem_set(trans),
61f9e292 5161 nft_trans_elem(trans).priv, true);
61edafbb 5162 break;
e5009240
PNA		 5163 case NFT_MSG_NEWOBJ:
5164 nft_obj_destroy(nft_trans_obj(trans));
5165 break;
c7c32e72
PNA		 5166 }
5167 kfree(trans);
5168}
5169
5913beaf 5170static int nf_tables_abort(struct net *net, struct sk_buff *skb)
37082f93 5171{
37082f93 5172 struct nft_trans *trans, *next;
02263db0 5173 struct nft_trans_elem *te;
37082f93 5174
a907e36d
XL		 5175 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
5176 list) {
b380e5c7 5177 switch (trans->msg_type) {
55dd6f93
PNA		 5178 case NFT_MSG_NEWTABLE:
5179 if (nft_trans_table_update(trans)) {
5180 if (nft_trans_table_enable(trans)) {
664b0f8c
PNA		 5181 nf_tables_table_disable(net,
5182 trans->ctx.afi,
55dd6f93
PNA		 5183 trans->ctx.table);
5184 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
5185 }
5186 nft_trans_destroy(trans);
5187 } else {
e688a7f8 5188 list_del_rcu(&trans->ctx.table->list);
55dd6f93
PNA		 5189 }
5190 break;
5191 case NFT_MSG_DELTABLE:
f2a6d766 5192 nft_clear(trans->ctx.net, trans->ctx.table);
55dd6f93
PNA		 5193 nft_trans_destroy(trans);
5194 break;
91c7b38d
PNA		 5195 case NFT_MSG_NEWCHAIN:
5196 if (nft_trans_chain_update(trans)) {
982f4051 5197 free_percpu(nft_trans_chain_stats(trans));
91c7b38d
PNA		 5198
5199 nft_trans_destroy(trans);
5200 } else {
4fefee57 5201 trans->ctx.table->use--;
e688a7f8 5202 list_del_rcu(&trans->ctx.chain->list);
82bec71d
PNA		 5203 nf_tables_unregister_hooks(trans->ctx.net,
5204 trans->ctx.table,
c5598794
AB		 5205 trans->ctx.chain,
5206 trans->ctx.afi->nops);
91c7b38d
PNA		 5207 }
5208 break;
5209 case NFT_MSG_DELCHAIN:
4fefee57 5210 trans->ctx.table->use++;
664b0f8c 5211 nft_clear(trans->ctx.net, trans->ctx.chain);
91c7b38d
PNA		 5212 nft_trans_destroy(trans);
5213 break;
b380e5c7 5214 case NFT_MSG_NEWRULE:
4fefee57 5215 trans->ctx.chain->use--;
b380e5c7
PNA		 5216 list_del_rcu(&nft_trans_rule(trans)->list);
5217 break;
5218 case NFT_MSG_DELRULE:
4fefee57 5219 trans->ctx.chain->use++;
889f7ee7 5220 nft_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 5221 nft_trans_destroy(trans);
b380e5c7 5222 break;
958bee14 5223 case NFT_MSG_NEWSET:
4fefee57 5224 trans->ctx.table->use--;
e688a7f8 5225 list_del_rcu(&nft_trans_set(trans)->list);
958bee14
PNA		 5226 break;
5227 case NFT_MSG_DELSET:
4fefee57 5228 trans->ctx.table->use++;
37a9cc52 5229 nft_clear(trans->ctx.net, nft_trans_set(trans));
958bee14
PNA		 5230 nft_trans_destroy(trans);
5231 break;
60319eb1 5232 case NFT_MSG_NEWSETELEM:
02263db0 5233 te = (struct nft_trans_elem *)trans->data;
fe2811eb 5234
5cb82a38 5235 te->set->ops->remove(net, te->set, &te->elem);
3dd0673a 5236 atomic_dec(&te->set->nelems);
60319eb1
PNA		 5237 break;
5238 case NFT_MSG_DELSETELEM:
cc02e457
PM		 5239 te = (struct nft_trans_elem *)trans->data;
5240
59105446 5241 nft_set_elem_activate(net, te->set, &te->elem);
42a55769 5242 te->set->ops->activate(net, te->set, &te->elem);
3dd0673a 5243 te->set->ndeact--;
cc02e457 5244
e5009240
PNA		 5245 nft_trans_destroy(trans);
5246 break;
5247 case NFT_MSG_NEWOBJ:
5248 trans->ctx.table->use--;
5249 list_del_rcu(&nft_trans_obj(trans)->list);
5250 break;
5251 case NFT_MSG_DELOBJ:
5252 trans->ctx.table->use++;
5253 nft_clear(trans->ctx.net, nft_trans_obj(trans));
60319eb1
PNA		 5254 nft_trans_destroy(trans);
5255 break;
37082f93 5256 }
37082f93
PNA		 5257 }
5258
b326dd37
PNA		 5259 synchronize_rcu();
5260
a1cee076
PNA		 5261 list_for_each_entry_safe_reverse(trans, next,
5262 &net->nft.commit_list, list) {
c7c32e72 5263 list_del(&trans->list);
b326dd37 5264 nf_tables_abort_release(trans);
37082f93
PNA		 5265 }
5266
5267 return 0;
5268}
5269
74e8bcd2
PNA		 5270static bool nf_tables_valid_genid(struct net *net, u32 genid)
5271{
5272 return net->nft.base_seq == genid;
5273}
5274
96518518
PM		 5275static const struct nfnetlink_subsystem nf_tables_subsys = {
5276 .name = "nf_tables",
5277 .subsys_id = NFNL_SUBSYS_NFTABLES,
5278 .cb_count = NFT_MSG_MAX,
5279 .cb = nf_tables_cb,
0628b123
PNA		 5280 .commit = nf_tables_commit,
5281 .abort = nf_tables_abort,
74e8bcd2 5282 .valid_genid = nf_tables_valid_genid,
96518518
PM		 5283};
5284
7210e4e3
PNA		 5285int nft_chain_validate_dependency(const struct nft_chain *chain,
5286 enum nft_chain_type type)
5287{
5288 const struct nft_base_chain *basechain;
5289
f323d954 5290 if (nft_is_base_chain(chain)) {
7210e4e3
PNA		 5291 basechain = nft_base_chain(chain);
5292 if (basechain->type->type != type)
5293 return -EOPNOTSUPP;
5294 }
5295 return 0;
5296}
5297EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
5298
75e8d06d
PNA		 5299int nft_chain_validate_hooks(const struct nft_chain *chain,
5300 unsigned int hook_flags)
5301{
5302 struct nft_base_chain *basechain;
5303
f323d954 5304 if (nft_is_base_chain(chain)) {
75e8d06d
PNA		 5305 basechain = nft_base_chain(chain);
5306
5307 if ((1 << basechain->ops[0].hooknum) & hook_flags)
5308 return 0;
5309
5310 return -EOPNOTSUPP;
5311 }
5312
5313 return 0;
5314}
5315EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
5316
20a69341
PM		 5317/*
5318 * Loop detection - walk through the ruleset beginning at the destination chain
5319 * of a new jump until either the source chain is reached (loop) or all
5320 * reachable chains have been traversed.
5321 *
5322 * The loop check is performed whenever a new jump verdict is added to an
5323 * expression or verdict map or a verdict map is bound to a new chain.
5324 */
5325
5326static int nf_tables_check_loops(const struct nft_ctx *ctx,
5327 const struct nft_chain *chain);
5328
5329static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
de70185d 5330 struct nft_set *set,
20a69341 5331 const struct nft_set_iter *iter,
de70185d 5332 struct nft_set_elem *elem)
20a69341 5333{
fe2811eb
PM		 5334 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5335 const struct nft_data *data;
5336
5337 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
5338 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
62f9c8b4
PNA		 5339 return 0;
5340
fe2811eb 5341 data = nft_set_ext_data(ext);
1ca2e170 5342 switch (data->verdict.code) {
20a69341
PM		 5343 case NFT_JUMP:
5344 case NFT_GOTO:
1ca2e170 5345 return nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 5346 default:
5347 return 0;
5348 }
5349}
5350
5351static int nf_tables_check_loops(const struct nft_ctx *ctx,
5352 const struct nft_chain *chain)
5353{
5354 const struct nft_rule *rule;
5355 const struct nft_expr *expr, *last;
de70185d 5356 struct nft_set *set;
20a69341
PM		 5357 struct nft_set_binding *binding;
5358 struct nft_set_iter iter;
20a69341
PM		 5359
5360 if (ctx->chain == chain)
5361 return -ELOOP;
5362
5363 list_for_each_entry(rule, &chain->rules, list) {
5364 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 5365 const struct nft_data *data = NULL;
5366 int err;
5367
5368 if (!expr->ops->validate)
20a69341
PM		 5369 continue;
5370
0ca743a5
PNA		 5371 err = expr->ops->validate(ctx, expr, &data);
5372 if (err < 0)
5373 return err;
5374
20a69341 5375 if (data == NULL)
0ca743a5 5376 continue;
20a69341 5377
1ca2e170 5378 switch (data->verdict.code) {
20a69341
PM		 5379 case NFT_JUMP:
5380 case NFT_GOTO:
1ca2e170
PM		 5381 err = nf_tables_check_loops(ctx,
5382 data->verdict.chain);
20a69341
PM		 5383 if (err < 0)
5384 return err;
5385 default:
5386 break;
5387 }
5388 }
5389 }
5390
5391 list_for_each_entry(set, &ctx->table->sets, list) {
37a9cc52
PNA		 5392 if (!nft_is_active_next(ctx->net, set))
5393 continue;
20a69341
PM		 5394 if (!(set->flags & NFT_SET_MAP) ||
5395 set->dtype != NFT_DATA_VERDICT)
5396 continue;
5397
5398 list_for_each_entry(binding, &set->bindings, list) {
11113e19
PM		 5399 if (!(binding->flags & NFT_SET_MAP) ||
5400 binding->chain != chain)
20a69341
PM		 5401 continue;
5402
8588ac09 5403 iter.genmask = nft_genmask_next(ctx->net);
20a69341
PM		 5404 iter.skip = 0;
5405 iter.count = 0;
5406 iter.err = 0;
5407 iter.fn = nf_tables_loop_check_setelem;
5408
5409 set->ops->walk(ctx, set, &iter);
5410 if (iter.err < 0)
5411 return iter.err;
5412 }
5413 }
5414
5415 return 0;
5416}
5417
36b701fa
LGL		 5418/**
5419 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
5420 *
5421 * @attr: netlink attribute to fetch value from
5422 * @max: maximum value to be stored in dest
5423 * @dest: pointer to the variable
5424 *
5425 * Parse, check and store a given u32 netlink attribute into variable.
5426 * This function returns -ERANGE if the value goes over maximum value.
5427 * Otherwise a 0 is returned and the attribute value is stored in the
5428 * destination variable.
5429 */
f1d505bb 5430int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
36b701fa 5431{
09525a09 5432 u32 val;
36b701fa
LGL		 5433
5434 val = ntohl(nla_get_be32(attr));
5435 if (val > max)
5436 return -ERANGE;
5437
5438 *dest = val;
5439 return 0;
5440}
5441EXPORT_SYMBOL_GPL(nft_parse_u32_check);
5442
49499c3e
PM		 5443/**
5444 * nft_parse_register - parse a register value from a netlink attribute
5445 *
5446 * @attr: netlink attribute
5447 *
5448 * Parse and translate a register value from a netlink attribute.
5449 * Registers used to be 128 bit wide, these register numbers will be
5450 * mapped to the corresponding 32 bit register numbers.
5451 */
b1c96ed3
PM		 5452unsigned int nft_parse_register(const struct nlattr *attr)
5453{
49499c3e
PM		 5454 unsigned int reg;
5455
5456 reg = ntohl(nla_get_be32(attr));
5457 switch (reg) {
5458 case NFT_REG_VERDICT...NFT_REG_4:
5459 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
5460 default:
5461 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
5462 }
b1c96ed3
PM		 5463}
5464EXPORT_SYMBOL_GPL(nft_parse_register);
5465
49499c3e
PM		 5466/**
5467 * nft_dump_register - dump a register value to a netlink attribute
5468 *
5469 * @skb: socket buffer
5470 * @attr: attribute number
5471 * @reg: register number
5472 *
5473 * Construct a netlink attribute containing the register number. For
5474 * compatibility reasons, register numbers being a multiple of 4 are
5475 * translated to the corresponding 128 bit register numbers.
5476 */
b1c96ed3
PM		 5477int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
5478{
49499c3e
PM		 5479 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
5480 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
5481 else
5482 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
5483
b1c96ed3
PM		 5484 return nla_put_be32(skb, attr, htonl(reg));
5485}
5486EXPORT_SYMBOL_GPL(nft_dump_register);
5487
96518518 5488/**
d07db988 5489 * nft_validate_register_load - validate a load from a register
96518518
PM		 5490 *
5491 * @reg: the register number
d07db988 5492 * @len: the length of the data
96518518
PM		 5493 *
5494 * Validate that the input register is one of the general purpose
d07db988 5495 * registers and that the length of the load is within the bounds.
96518518 5496 */
d07db988 5497int nft_validate_register_load(enum nft_registers reg, unsigned int len)
96518518 5498{
49499c3e 5499 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
96518518 5500 return -EINVAL;
d07db988
PM		 5501 if (len == 0)
5502 return -EINVAL;
49499c3e 5503 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
d07db988 5504 return -ERANGE;
49499c3e 5505
96518518
PM		 5506 return 0;
5507}
d07db988 5508EXPORT_SYMBOL_GPL(nft_validate_register_load);
96518518 5509
96518518 5510/**
1ec10212 5511 * nft_validate_register_store - validate an expressions' register store
96518518
PM		 5512 *
5513 * @ctx: context of the expression performing the load
5514 * @reg: the destination register number
5515 * @data: the data to load
5516 * @type: the data type
45d9bcda 5517 * @len: the length of the data
96518518
PM		 5518 *
5519 * Validate that a data load uses the appropriate data type for
45d9bcda
PM		 5520 * the destination register and the length is within the bounds.
5521 * A value of NULL for the data means that its runtime gathered
58f40ab6 5522 * data.
96518518 5523 */
1ec10212
PM		 5524int nft_validate_register_store(const struct nft_ctx *ctx,
5525 enum nft_registers reg,
5526 const struct nft_data *data,
5527 enum nft_data_types type, unsigned int len)
96518518 5528{
20a69341
PM		 5529 int err;
5530
96518518
PM		 5531 switch (reg) {
5532 case NFT_REG_VERDICT:
58f40ab6 5533 if (type != NFT_DATA_VERDICT)
96518518 5534 return -EINVAL;
20a69341 5535
58f40ab6 5536 if (data != NULL &&
1ca2e170
PM		 5537 (data->verdict.code == NFT_GOTO ||
5538 data->verdict.code == NFT_JUMP)) {
5539 err = nf_tables_check_loops(ctx, data->verdict.chain);
20a69341
PM		 5540 if (err < 0)
5541 return err;
5542
1ca2e170
PM		 5543 if (ctx->chain->level + 1 >
5544 data->verdict.chain->level) {
20a69341
PM		 5545 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
5546 return -EMLINK;
1ca2e170 5547 data->verdict.chain->level = ctx->chain->level + 1;
20a69341
PM		 5548 }
5549 }
5550
96518518
PM		 5551 return 0;
5552 default:
49499c3e 5553 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
27e6d201 5554 return -EINVAL;
45d9bcda
PM		 5555 if (len == 0)
5556 return -EINVAL;
49499c3e
PM		 5557 if (reg * NFT_REG32_SIZE + len >
5558 FIELD_SIZEOF(struct nft_regs, data))
45d9bcda 5559 return -ERANGE;
27e6d201 5560
96518518
PM		 5561 if (data != NULL && type != NFT_DATA_VALUE)
5562 return -EINVAL;
5563 return 0;
5564 }
5565}
1ec10212 5566EXPORT_SYMBOL_GPL(nft_validate_register_store);
96518518
PM		 5567
5568static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
5569 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
5570 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
5571 .len = NFT_CHAIN_MAXNAMELEN - 1 },
5572};
5573
5574static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
5575 struct nft_data_desc *desc, const struct nlattr *nla)
5576{
664b0f8c 5577 u8 genmask = nft_genmask_next(ctx->net);
96518518
PM		 5578 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
5579 struct nft_chain *chain;
5580 int err;
5581
fceb6435
JB		 5582 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
5583 NULL);
96518518
PM		 5584 if (err < 0)
5585 return err;
5586
5587 if (!tb[NFTA_VERDICT_CODE])
5588 return -EINVAL;
1ca2e170 5589 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
96518518 5590
1ca2e170 5591 switch (data->verdict.code) {
e0abdadc 5592 default:
1ca2e170 5593 switch (data->verdict.code & NF_VERDICT_MASK) {
e0abdadc
PM		 5594 case NF_ACCEPT:
5595 case NF_DROP:
5596 case NF_QUEUE:
5597 break;
5598 default:
5599 return -EINVAL;
5600 }
5601 /* fall through */
96518518
PM		 5602 case NFT_CONTINUE:
5603 case NFT_BREAK:
5604 case NFT_RETURN:
96518518
PM		 5605 break;
5606 case NFT_JUMP:
5607 case NFT_GOTO:
5608 if (!tb[NFTA_VERDICT_CHAIN])
5609 return -EINVAL;
5610 chain = nf_tables_chain_lookup(ctx->table,
664b0f8c 5611 tb[NFTA_VERDICT_CHAIN], genmask);
96518518
PM		 5612 if (IS_ERR(chain))
5613 return PTR_ERR(chain);
f323d954 5614 if (nft_is_base_chain(chain))
96518518
PM		 5615 return -EOPNOTSUPP;
5616
96518518 5617 chain->use++;
1ca2e170 5618 data->verdict.chain = chain;
96518518 5619 break;
96518518
PM		 5620 }
5621
4c4ed074 5622 desc->len = sizeof(data->verdict);
96518518
PM		 5623 desc->type = NFT_DATA_VERDICT;
5624 return 0;
5625}
5626
5627static void nft_verdict_uninit(const struct nft_data *data)
5628{
1ca2e170 5629 switch (data->verdict.code) {
96518518
PM		 5630 case NFT_JUMP:
5631 case NFT_GOTO:
1ca2e170 5632 data->verdict.chain->use--;
96518518
PM		 5633 break;
5634 }
5635}
5636
33d5a7b1 5637int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
96518518
PM		 5638{
5639 struct nlattr *nest;
5640
33d5a7b1 5641 nest = nla_nest_start(skb, type);
96518518
PM		 5642 if (!nest)
5643 goto nla_put_failure;
5644
33d5a7b1 5645 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
96518518
PM		 5646 goto nla_put_failure;
5647
33d5a7b1 5648 switch (v->code) {
96518518
PM		 5649 case NFT_JUMP:
5650 case NFT_GOTO:
1ca2e170 5651 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
33d5a7b1 5652 v->chain->name))
96518518
PM		 5653 goto nla_put_failure;
5654 }
5655 nla_nest_end(skb, nest);
5656 return 0;
5657
5658nla_put_failure:
5659 return -1;
5660}
5661
d0a11fc3
PM		 5662static int nft_value_init(const struct nft_ctx *ctx,
5663 struct nft_data *data, unsigned int size,
96518518
PM		 5664 struct nft_data_desc *desc, const struct nlattr *nla)
5665{
5666 unsigned int len;
5667
5668 len = nla_len(nla);
5669 if (len == 0)
5670 return -EINVAL;
d0a11fc3 5671 if (len > size)
96518518
PM		 5672 return -EOVERFLOW;
5673
d0a11fc3 5674 nla_memcpy(data->data, nla, len);
96518518
PM		 5675 desc->type = NFT_DATA_VALUE;
5676 desc->len = len;
5677 return 0;
5678}
5679
5680static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
5681 unsigned int len)
5682{
5683 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
5684}
5685
5686static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
d0a11fc3 5687 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
96518518
PM		 5688 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
5689};
5690
5691/**
5692 * nft_data_init - parse nf_tables data netlink attributes
5693 *
5694 * @ctx: context of the expression using the data
5695 * @data: destination struct nft_data
d0a11fc3 5696 * @size: maximum data length
96518518
PM		 5697 * @desc: data description
5698 * @nla: netlink attribute containing data
5699 *
5700 * Parse the netlink data attributes and initialize a struct nft_data.
5701 * The type and length of data are returned in the data description.
5702 *
5703 * The caller can indicate that it only wants to accept data of type
5704 * NFT_DATA_VALUE by passing NULL for the ctx argument.
5705 */
d0a11fc3
PM		 5706int nft_data_init(const struct nft_ctx *ctx,
5707 struct nft_data *data, unsigned int size,
96518518
PM		 5708 struct nft_data_desc *desc, const struct nlattr *nla)
5709{
5710 struct nlattr *tb[NFTA_DATA_MAX + 1];
5711 int err;
5712
fceb6435 5713 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
96518518
PM		 5714 if (err < 0)
5715 return err;
5716
5717 if (tb[NFTA_DATA_VALUE])
d0a11fc3
PM		 5718 return nft_value_init(ctx, data, size, desc,
5719 tb[NFTA_DATA_VALUE]);
96518518
PM		 5720 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
5721 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
5722 return -EINVAL;
5723}
5724EXPORT_SYMBOL_GPL(nft_data_init);
5725
5726/**
59105446 5727 * nft_data_release - release a nft_data item
96518518
PM		 5728 *
5729 * @data: struct nft_data to release
5730 * @type: type of data
5731 *
5732 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5733 * all others need to be released by calling this function.
5734 */
59105446 5735void nft_data_release(const struct nft_data *data, enum nft_data_types type)
96518518 5736{
960bd2c2 5737 if (type < NFT_DATA_VERDICT)
96518518 5738 return;
960bd2c2 5739 switch (type) {
96518518
PM		 5740 case NFT_DATA_VERDICT:
5741 return nft_verdict_uninit(data);
5742 default:
5743 WARN_ON(1);
5744 }
5745}
59105446 5746EXPORT_SYMBOL_GPL(nft_data_release);
96518518
PM		 5747
5748int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
5749 enum nft_data_types type, unsigned int len)
5750{
5751 struct nlattr *nest;
5752 int err;
5753
5754 nest = nla_nest_start(skb, attr);
5755 if (nest == NULL)
5756 return -1;
5757
5758 switch (type) {
5759 case NFT_DATA_VALUE:
5760 err = nft_value_dump(skb, data, len);
5761 break;
5762 case NFT_DATA_VERDICT:
33d5a7b1 5763 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
96518518
PM		 5764 break;
5765 default:
5766 err = -EINVAL;
5767 WARN_ON(1);
5768 }
5769
5770 nla_nest_end(skb, nest);
5771 return err;
5772}
5773EXPORT_SYMBOL_GPL(nft_data_dump);
5774
df05ef87 5775static int __net_init nf_tables_init_net(struct net *net)
99633ab2
PNA		 5776{
5777 INIT_LIST_HEAD(&net->nft.af_info);
0628b123 5778 INIT_LIST_HEAD(&net->nft.commit_list);
38e029f1 5779 net->nft.base_seq = 1;
99633ab2
PNA		 5780 return 0;
5781}
5782
5ebe0b0e
PNA		 5783int __nft_release_basechain(struct nft_ctx *ctx)
5784{
5785 struct nft_rule *rule, *nr;
5786
f323d954 5787 BUG_ON(!nft_is_base_chain(ctx->chain));
5ebe0b0e 5788
82bec71d 5789 nf_tables_unregister_hooks(ctx->net, ctx->chain->table, ctx->chain,
5ebe0b0e
PNA		 5790 ctx->afi->nops);
5791 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
5792 list_del(&rule->list);
5793 ctx->chain->use--;
5794 nf_tables_rule_destroy(ctx, rule);
5795 }
5796 list_del(&ctx->chain->list);
5797 ctx->table->use--;
5798 nf_tables_chain_destroy(ctx->chain);
5799
5800 return 0;
5801}
5802EXPORT_SYMBOL_GPL(__nft_release_basechain);
5803
df05ef87
PNA		 5804/* Called by nft_unregister_afinfo() from __net_exit path, nfnl_lock is held. */
5805static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
5806{
5807 struct nft_table *table, *nt;
5808 struct nft_chain *chain, *nc;
e5009240 5809 struct nft_object *obj, *ne;
df05ef87
PNA		 5810 struct nft_rule *rule, *nr;
5811 struct nft_set *set, *ns;
5812 struct nft_ctx ctx = {
5813 .net = net,
5814 .afi = afi,
5815 };
5816
5817 list_for_each_entry_safe(table, nt, &afi->tables, list) {
5818 list_for_each_entry(chain, &table->chains, list)
82bec71d
PNA		 5819 nf_tables_unregister_hooks(net, table, chain,
5820 afi->nops);
df05ef87
PNA		 5821 /* No packets are walking on these chains anymore. */
5822 ctx.table = table;
5823 list_for_each_entry(chain, &table->chains, list) {
5824 ctx.chain = chain;
5825 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
5826 list_del(&rule->list);
5827 chain->use--;
5828 nf_tables_rule_destroy(&ctx, rule);
5829 }
5830 }
5831 list_for_each_entry_safe(set, ns, &table->sets, list) {
5832 list_del(&set->list);
5833 table->use--;
5834 nft_set_destroy(set);
5835 }
e5009240
PNA		 5836 list_for_each_entry_safe(obj, ne, &table->objects, list) {
5837 list_del(&obj->list);
5838 table->use--;
5839 nft_obj_destroy(obj);
5840 }
df05ef87
PNA		 5841 list_for_each_entry_safe(chain, nc, &table->chains, list) {
5842 list_del(&chain->list);
5843 table->use--;
5844 nf_tables_chain_destroy(chain);
5845 }
5846 list_del(&table->list);
5847 nf_tables_table_destroy(&ctx);
5848 }
5849}
5850
99633ab2
PNA		 5851static struct pernet_operations nf_tables_net_ops = {
5852 .init = nf_tables_init_net,
5853};
5854
96518518
PM		 5855static int __init nf_tables_module_init(void)
5856{
5857 int err;
5858
5859 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
5860 GFP_KERNEL);
5861 if (info == NULL) {
5862 err = -ENOMEM;
5863 goto err1;
5864 }
5865
5866 err = nf_tables_core_module_init();
5867 if (err < 0)
5868 goto err2;
5869
5870 err = nfnetlink_subsys_register(&nf_tables_subsys);
5871 if (err < 0)
5872 goto err3;
5873
5874 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
99633ab2 5875 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 5876err3:
5877 nf_tables_core_module_exit();
5878err2:
5879 kfree(info);
5880err1:
5881 return err;
5882}
5883
5884static void __exit nf_tables_module_exit(void)
5885{
99633ab2 5886 unregister_pernet_subsys(&nf_tables_net_ops);
96518518 5887 nfnetlink_subsys_unregister(&nf_tables_subsys);
1b1bc49c 5888 rcu_barrier();
96518518
PM		 5889 nf_tables_core_module_exit();
5890 kfree(info);
5891}
5892
5893module_init(nf_tables_module_init);
5894module_exit(nf_tables_module_exit);
5895
5896MODULE_LICENSE("GPL");
5897MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
5898MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);