1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/module.h> 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/skbuff.h> 12 #include <linux/netlink.h> 13 #include <linux/vmalloc.h> 14 #include <linux/rhashtable.h> 15 #include <linux/audit.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nfnetlink.h> 18 #include <linux/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_flow_table.h> 20 #include <net/netfilter/nf_tables_core.h> 21 #include <net/netfilter/nf_tables.h> 22 #include <net/netfilter/nf_tables_offload.h> 23 #include <net/net_namespace.h> 24 #include <net/sock.h> 25 26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) 27 28 unsigned int nf_tables_net_id __read_mostly; 29 30 static LIST_HEAD(nf_tables_expressions); 31 static LIST_HEAD(nf_tables_objects); 32 static LIST_HEAD(nf_tables_flowtables); 33 static LIST_HEAD(nf_tables_destroy_list); 34 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock); 35 36 enum { 37 NFT_VALIDATE_SKIP = 0, 38 NFT_VALIDATE_NEED, 39 NFT_VALIDATE_DO, 40 }; 41 42 static struct rhltable nft_objname_ht; 43 44 static u32 nft_chain_hash(const void *data, u32 len, u32 seed); 45 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed); 46 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *); 47 48 static u32 nft_objname_hash(const void *data, u32 len, u32 seed); 49 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed); 50 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *); 51 52 static const struct rhashtable_params nft_chain_ht_params = { 53 .head_offset = offsetof(struct nft_chain, rhlhead), 54 .key_offset = offsetof(struct nft_chain, name), 55 .hashfn = nft_chain_hash, 56 .obj_hashfn = nft_chain_hash_obj, 57 .obj_cmpfn = nft_chain_hash_cmp, 58 .automatic_shrinking = true, 59 }; 60 61 static const struct rhashtable_params nft_objname_ht_params = { 62 .head_offset = offsetof(struct nft_object, rhlhead), 63 .key_offset = offsetof(struct nft_object, key), 64 .hashfn = nft_objname_hash, 65 .obj_hashfn = nft_objname_hash_obj, 66 .obj_cmpfn = nft_objname_hash_cmp, 67 .automatic_shrinking = true, 68 }; 69 70 struct nft_audit_data { 71 struct nft_table *table; 72 int entries; 73 int op; 74 struct list_head list; 75 }; 76 77 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types 78 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, 79 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, 80 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, 81 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, 82 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, 83 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, 84 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, 85 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, 86 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, 87 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, 88 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, 89 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, 90 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, 91 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, 92 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, 93 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, 94 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, 95 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, 96 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, 97 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, 98 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, 99 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, 100 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, 101 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, 102 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 103 }; 104 105 static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state) 106 { 107 switch (table->validate_state) { 108 case NFT_VALIDATE_SKIP: 109 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); 110 break; 111 case NFT_VALIDATE_NEED: 112 break; 113 case NFT_VALIDATE_DO: 114 if (new_validate_state == NFT_VALIDATE_NEED) 115 return; 116 } 117 118 table->validate_state = new_validate_state; 119 } 120 static void nf_tables_trans_destroy_work(struct work_struct *w); 121 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work); 122 123 static void nft_ctx_init(struct nft_ctx *ctx, 124 struct net *net, 125 const struct sk_buff *skb, 126 const struct nlmsghdr *nlh, 127 u8 family, 128 struct nft_table *table, 129 struct nft_chain *chain, 130 const struct nlattr * const *nla) 131 { 132 ctx->net = net; 133 ctx->family = family; 134 ctx->level = 0; 135 ctx->table = table; 136 ctx->chain = chain; 137 ctx->nla = nla; 138 ctx->portid = NETLINK_CB(skb).portid; 139 ctx->report = nlmsg_report(nlh); 140 ctx->flags = nlh->nlmsg_flags; 141 ctx->seq = nlh->nlmsg_seq; 142 } 143 144 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, 145 int msg_type, u32 size, gfp_t gfp) 146 { 147 struct nft_trans *trans; 148 149 trans = kzalloc(sizeof(struct nft_trans) + size, gfp); 150 if (trans == NULL) 151 return NULL; 152 153 INIT_LIST_HEAD(&trans->list); 154 trans->msg_type = msg_type; 155 trans->ctx = *ctx; 156 157 return trans; 158 } 159 160 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, 161 int msg_type, u32 size) 162 { 163 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL); 164 } 165 166 static void nft_trans_destroy(struct nft_trans *trans) 167 { 168 list_del(&trans->list); 169 kfree(trans); 170 } 171 172 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) 173 { 174 struct nftables_pernet *nft_net; 175 struct net *net = ctx->net; 176 struct nft_trans *trans; 177 178 if (!nft_set_is_anonymous(set)) 179 return; 180 181 nft_net = nft_pernet(net); 182 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 183 switch (trans->msg_type) { 184 case NFT_MSG_NEWSET: 185 if (nft_trans_set(trans) == set) 186 nft_trans_set_bound(trans) = true; 187 break; 188 case NFT_MSG_NEWSETELEM: 189 if (nft_trans_elem_set(trans) == set) 190 nft_trans_elem_set_bound(trans) = true; 191 break; 192 } 193 } 194 } 195 196 static int nft_netdev_register_hooks(struct net *net, 197 struct list_head *hook_list) 198 { 199 struct nft_hook *hook; 200 int err, j; 201 202 j = 0; 203 list_for_each_entry(hook, hook_list, list) { 204 err = nf_register_net_hook(net, &hook->ops); 205 if (err < 0) 206 goto err_register; 207 208 j++; 209 } 210 return 0; 211 212 err_register: 213 list_for_each_entry(hook, hook_list, list) { 214 if (j-- <= 0) 215 break; 216 217 nf_unregister_net_hook(net, &hook->ops); 218 } 219 return err; 220 } 221 222 static void nft_netdev_unregister_hooks(struct net *net, 223 struct list_head *hook_list, 224 bool release_netdev) 225 { 226 struct nft_hook *hook, *next; 227 228 list_for_each_entry_safe(hook, next, hook_list, list) { 229 nf_unregister_net_hook(net, &hook->ops); 230 if (release_netdev) { 231 list_del(&hook->list); 232 kfree_rcu(hook, rcu); 233 } 234 } 235 } 236 237 static int nf_tables_register_hook(struct net *net, 238 const struct nft_table *table, 239 struct nft_chain *chain) 240 { 241 struct nft_base_chain *basechain; 242 const struct nf_hook_ops *ops; 243 244 if (table->flags & NFT_TABLE_F_DORMANT || 245 !nft_is_base_chain(chain)) 246 return 0; 247 248 basechain = nft_base_chain(chain); 249 ops = &basechain->ops; 250 251 if (basechain->type->ops_register) 252 return basechain->type->ops_register(net, ops); 253 254 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 255 return nft_netdev_register_hooks(net, &basechain->hook_list); 256 257 return nf_register_net_hook(net, &basechain->ops); 258 } 259 260 static void __nf_tables_unregister_hook(struct net *net, 261 const struct nft_table *table, 262 struct nft_chain *chain, 263 bool release_netdev) 264 { 265 struct nft_base_chain *basechain; 266 const struct nf_hook_ops *ops; 267 268 if (table->flags & NFT_TABLE_F_DORMANT || 269 !nft_is_base_chain(chain)) 270 return; 271 basechain = nft_base_chain(chain); 272 ops = &basechain->ops; 273 274 if (basechain->type->ops_unregister) 275 return basechain->type->ops_unregister(net, ops); 276 277 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 278 nft_netdev_unregister_hooks(net, &basechain->hook_list, 279 release_netdev); 280 else 281 nf_unregister_net_hook(net, &basechain->ops); 282 } 283 284 static void nf_tables_unregister_hook(struct net *net, 285 const struct nft_table *table, 286 struct nft_chain *chain) 287 { 288 return __nf_tables_unregister_hook(net, table, chain, false); 289 } 290 291 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans) 292 { 293 struct nftables_pernet *nft_net = nft_pernet(net); 294 295 list_add_tail(&trans->list, &nft_net->commit_list); 296 } 297 298 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 299 { 300 struct nft_trans *trans; 301 302 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 303 if (trans == NULL) 304 return -ENOMEM; 305 306 if (msg_type == NFT_MSG_NEWTABLE) 307 nft_activate_next(ctx->net, ctx->table); 308 309 nft_trans_commit_list_add_tail(ctx->net, trans); 310 return 0; 311 } 312 313 static int nft_deltable(struct nft_ctx *ctx) 314 { 315 int err; 316 317 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 318 if (err < 0) 319 return err; 320 321 nft_deactivate_next(ctx->net, ctx->table); 322 return err; 323 } 324 325 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 326 { 327 struct nft_trans *trans; 328 329 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 330 if (trans == NULL) 331 return ERR_PTR(-ENOMEM); 332 333 if (msg_type == NFT_MSG_NEWCHAIN) { 334 nft_activate_next(ctx->net, ctx->chain); 335 336 if (ctx->nla[NFTA_CHAIN_ID]) { 337 nft_trans_chain_id(trans) = 338 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID])); 339 } 340 } 341 342 nft_trans_commit_list_add_tail(ctx->net, trans); 343 return trans; 344 } 345 346 static int nft_delchain(struct nft_ctx *ctx) 347 { 348 struct nft_trans *trans; 349 350 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 351 if (IS_ERR(trans)) 352 return PTR_ERR(trans); 353 354 ctx->table->use--; 355 nft_deactivate_next(ctx->net, ctx->chain); 356 357 return 0; 358 } 359 360 static void nft_rule_expr_activate(const struct nft_ctx *ctx, 361 struct nft_rule *rule) 362 { 363 struct nft_expr *expr; 364 365 expr = nft_expr_first(rule); 366 while (nft_expr_more(rule, expr)) { 367 if (expr->ops->activate) 368 expr->ops->activate(ctx, expr); 369 370 expr = nft_expr_next(expr); 371 } 372 } 373 374 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx, 375 struct nft_rule *rule, 376 enum nft_trans_phase phase) 377 { 378 struct nft_expr *expr; 379 380 expr = nft_expr_first(rule); 381 while (nft_expr_more(rule, expr)) { 382 if (expr->ops->deactivate) 383 expr->ops->deactivate(ctx, expr, phase); 384 385 expr = nft_expr_next(expr); 386 } 387 } 388 389 static int 390 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 391 { 392 /* You cannot delete the same rule twice */ 393 if (nft_is_active_next(ctx->net, rule)) { 394 nft_deactivate_next(ctx->net, rule); 395 ctx->chain->use--; 396 return 0; 397 } 398 return -ENOENT; 399 } 400 401 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 402 struct nft_rule *rule) 403 { 404 struct nft_trans *trans; 405 406 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 407 if (trans == NULL) 408 return NULL; 409 410 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) { 411 nft_trans_rule_id(trans) = 412 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); 413 } 414 nft_trans_rule(trans) = rule; 415 nft_trans_commit_list_add_tail(ctx->net, trans); 416 417 return trans; 418 } 419 420 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 421 { 422 struct nft_flow_rule *flow; 423 struct nft_trans *trans; 424 int err; 425 426 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 427 if (trans == NULL) 428 return -ENOMEM; 429 430 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) { 431 flow = nft_flow_rule_create(ctx->net, rule); 432 if (IS_ERR(flow)) { 433 nft_trans_destroy(trans); 434 return PTR_ERR(flow); 435 } 436 437 nft_trans_flow_rule(trans) = flow; 438 } 439 440 err = nf_tables_delrule_deactivate(ctx, rule); 441 if (err < 0) { 442 nft_trans_destroy(trans); 443 return err; 444 } 445 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE); 446 447 return 0; 448 } 449 450 static int nft_delrule_by_chain(struct nft_ctx *ctx) 451 { 452 struct nft_rule *rule; 453 int err; 454 455 list_for_each_entry(rule, &ctx->chain->rules, list) { 456 if (!nft_is_active_next(ctx->net, rule)) 457 continue; 458 459 err = nft_delrule(ctx, rule); 460 if (err < 0) 461 return err; 462 } 463 return 0; 464 } 465 466 static int __nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 467 struct nft_set *set, 468 const struct nft_set_desc *desc) 469 { 470 struct nft_trans *trans; 471 472 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 473 if (trans == NULL) 474 return -ENOMEM; 475 476 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] && !desc) { 477 nft_trans_set_id(trans) = 478 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 479 nft_activate_next(ctx->net, set); 480 } 481 nft_trans_set(trans) = set; 482 if (desc) { 483 nft_trans_set_update(trans) = true; 484 nft_trans_set_gc_int(trans) = desc->gc_int; 485 nft_trans_set_timeout(trans) = desc->timeout; 486 } 487 nft_trans_commit_list_add_tail(ctx->net, trans); 488 489 return 0; 490 } 491 492 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 493 struct nft_set *set) 494 { 495 return __nft_trans_set_add(ctx, msg_type, set, NULL); 496 } 497 498 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set) 499 { 500 int err; 501 502 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 503 if (err < 0) 504 return err; 505 506 nft_deactivate_next(ctx->net, set); 507 ctx->table->use--; 508 509 return err; 510 } 511 512 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, 513 struct nft_object *obj) 514 { 515 struct nft_trans *trans; 516 517 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj)); 518 if (trans == NULL) 519 return -ENOMEM; 520 521 if (msg_type == NFT_MSG_NEWOBJ) 522 nft_activate_next(ctx->net, obj); 523 524 nft_trans_obj(trans) = obj; 525 nft_trans_commit_list_add_tail(ctx->net, trans); 526 527 return 0; 528 } 529 530 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj) 531 { 532 int err; 533 534 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj); 535 if (err < 0) 536 return err; 537 538 nft_deactivate_next(ctx->net, obj); 539 ctx->table->use--; 540 541 return err; 542 } 543 544 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, 545 struct nft_flowtable *flowtable) 546 { 547 struct nft_trans *trans; 548 549 trans = nft_trans_alloc(ctx, msg_type, 550 sizeof(struct nft_trans_flowtable)); 551 if (trans == NULL) 552 return -ENOMEM; 553 554 if (msg_type == NFT_MSG_NEWFLOWTABLE) 555 nft_activate_next(ctx->net, flowtable); 556 557 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 558 nft_trans_flowtable(trans) = flowtable; 559 nft_trans_commit_list_add_tail(ctx->net, trans); 560 561 return 0; 562 } 563 564 static int nft_delflowtable(struct nft_ctx *ctx, 565 struct nft_flowtable *flowtable) 566 { 567 int err; 568 569 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); 570 if (err < 0) 571 return err; 572 573 nft_deactivate_next(ctx->net, flowtable); 574 ctx->table->use--; 575 576 return err; 577 } 578 579 static void __nft_reg_track_clobber(struct nft_regs_track *track, u8 dreg) 580 { 581 int i; 582 583 for (i = track->regs[dreg].num_reg; i > 0; i--) 584 __nft_reg_track_cancel(track, dreg - i); 585 } 586 587 static void __nft_reg_track_update(struct nft_regs_track *track, 588 const struct nft_expr *expr, 589 u8 dreg, u8 num_reg) 590 { 591 track->regs[dreg].selector = expr; 592 track->regs[dreg].bitwise = NULL; 593 track->regs[dreg].num_reg = num_reg; 594 } 595 596 void nft_reg_track_update(struct nft_regs_track *track, 597 const struct nft_expr *expr, u8 dreg, u8 len) 598 { 599 unsigned int regcount; 600 int i; 601 602 __nft_reg_track_clobber(track, dreg); 603 604 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 605 for (i = 0; i < regcount; i++, dreg++) 606 __nft_reg_track_update(track, expr, dreg, i); 607 } 608 EXPORT_SYMBOL_GPL(nft_reg_track_update); 609 610 void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len) 611 { 612 unsigned int regcount; 613 int i; 614 615 __nft_reg_track_clobber(track, dreg); 616 617 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 618 for (i = 0; i < regcount; i++, dreg++) 619 __nft_reg_track_cancel(track, dreg); 620 } 621 EXPORT_SYMBOL_GPL(nft_reg_track_cancel); 622 623 void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg) 624 { 625 track->regs[dreg].selector = NULL; 626 track->regs[dreg].bitwise = NULL; 627 track->regs[dreg].num_reg = 0; 628 } 629 EXPORT_SYMBOL_GPL(__nft_reg_track_cancel); 630 631 /* 632 * Tables 633 */ 634 635 static struct nft_table *nft_table_lookup(const struct net *net, 636 const struct nlattr *nla, 637 u8 family, u8 genmask, u32 nlpid) 638 { 639 struct nftables_pernet *nft_net; 640 struct nft_table *table; 641 642 if (nla == NULL) 643 return ERR_PTR(-EINVAL); 644 645 nft_net = nft_pernet(net); 646 list_for_each_entry_rcu(table, &nft_net->tables, list, 647 lockdep_is_held(&nft_net->commit_mutex)) { 648 if (!nla_strcmp(nla, table->name) && 649 table->family == family && 650 nft_active_genmask(table, genmask)) { 651 if (nft_table_has_owner(table) && 652 nlpid && table->nlpid != nlpid) 653 return ERR_PTR(-EPERM); 654 655 return table; 656 } 657 } 658 659 return ERR_PTR(-ENOENT); 660 } 661 662 static struct nft_table *nft_table_lookup_byhandle(const struct net *net, 663 const struct nlattr *nla, 664 u8 genmask, u32 nlpid) 665 { 666 struct nftables_pernet *nft_net; 667 struct nft_table *table; 668 669 nft_net = nft_pernet(net); 670 list_for_each_entry(table, &nft_net->tables, list) { 671 if (be64_to_cpu(nla_get_be64(nla)) == table->handle && 672 nft_active_genmask(table, genmask)) { 673 if (nft_table_has_owner(table) && 674 nlpid && table->nlpid != nlpid) 675 return ERR_PTR(-EPERM); 676 677 return table; 678 } 679 } 680 681 return ERR_PTR(-ENOENT); 682 } 683 684 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 685 { 686 return ++table->hgenerator; 687 } 688 689 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; 690 691 static const struct nft_chain_type * 692 __nft_chain_type_get(u8 family, enum nft_chain_types type) 693 { 694 if (family >= NFPROTO_NUMPROTO || 695 type >= NFT_CHAIN_T_MAX) 696 return NULL; 697 698 return chain_type[family][type]; 699 } 700 701 static const struct nft_chain_type * 702 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) 703 { 704 const struct nft_chain_type *type; 705 int i; 706 707 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 708 type = __nft_chain_type_get(family, i); 709 if (!type) 710 continue; 711 if (!nla_strcmp(nla, type->name)) 712 return type; 713 } 714 return NULL; 715 } 716 717 struct nft_module_request { 718 struct list_head list; 719 char module[MODULE_NAME_LEN]; 720 bool done; 721 }; 722 723 #ifdef CONFIG_MODULES 724 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, 725 ...) 726 { 727 char module_name[MODULE_NAME_LEN]; 728 struct nftables_pernet *nft_net; 729 struct nft_module_request *req; 730 va_list args; 731 int ret; 732 733 va_start(args, fmt); 734 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); 735 va_end(args); 736 if (ret >= MODULE_NAME_LEN) 737 return 0; 738 739 nft_net = nft_pernet(net); 740 list_for_each_entry(req, &nft_net->module_list, list) { 741 if (!strcmp(req->module, module_name)) { 742 if (req->done) 743 return 0; 744 745 /* A request to load this module already exists. */ 746 return -EAGAIN; 747 } 748 } 749 750 req = kmalloc(sizeof(*req), GFP_KERNEL); 751 if (!req) 752 return -ENOMEM; 753 754 req->done = false; 755 strscpy(req->module, module_name, MODULE_NAME_LEN); 756 list_add_tail(&req->list, &nft_net->module_list); 757 758 return -EAGAIN; 759 } 760 EXPORT_SYMBOL_GPL(nft_request_module); 761 #endif 762 763 static void lockdep_nfnl_nft_mutex_not_held(void) 764 { 765 #ifdef CONFIG_PROVE_LOCKING 766 if (debug_locks) 767 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES)); 768 #endif 769 } 770 771 static const struct nft_chain_type * 772 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, 773 u8 family, bool autoload) 774 { 775 const struct nft_chain_type *type; 776 777 type = __nf_tables_chain_type_lookup(nla, family); 778 if (type != NULL) 779 return type; 780 781 lockdep_nfnl_nft_mutex_not_held(); 782 #ifdef CONFIG_MODULES 783 if (autoload) { 784 if (nft_request_module(net, "nft-chain-%u-%.*s", family, 785 nla_len(nla), 786 (const char *)nla_data(nla)) == -EAGAIN) 787 return ERR_PTR(-EAGAIN); 788 } 789 #endif 790 return ERR_PTR(-ENOENT); 791 } 792 793 static __be16 nft_base_seq(const struct net *net) 794 { 795 struct nftables_pernet *nft_net = nft_pernet(net); 796 797 return htons(nft_net->base_seq & 0xffff); 798 } 799 800 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 801 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 802 .len = NFT_TABLE_MAXNAMELEN - 1 }, 803 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 804 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, 805 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY, 806 .len = NFT_USERDATA_MAXLEN } 807 }; 808 809 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 810 u32 portid, u32 seq, int event, u32 flags, 811 int family, const struct nft_table *table) 812 { 813 struct nlmsghdr *nlh; 814 815 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 816 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 817 NFNETLINK_V0, nft_base_seq(net)); 818 if (!nlh) 819 goto nla_put_failure; 820 821 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 822 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || 823 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), 824 NFTA_TABLE_PAD)) 825 goto nla_put_failure; 826 827 if (event == NFT_MSG_DELTABLE) { 828 nlmsg_end(skb, nlh); 829 return 0; 830 } 831 832 if (nla_put_be32(skb, NFTA_TABLE_FLAGS, 833 htonl(table->flags & NFT_TABLE_F_MASK))) 834 goto nla_put_failure; 835 836 if (nft_table_has_owner(table) && 837 nla_put_be32(skb, NFTA_TABLE_OWNER, htonl(table->nlpid))) 838 goto nla_put_failure; 839 840 if (table->udata) { 841 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata)) 842 goto nla_put_failure; 843 } 844 845 nlmsg_end(skb, nlh); 846 return 0; 847 848 nla_put_failure: 849 nlmsg_trim(skb, nlh); 850 return -1; 851 } 852 853 struct nftnl_skb_parms { 854 bool report; 855 }; 856 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb)) 857 858 static void nft_notify_enqueue(struct sk_buff *skb, bool report, 859 struct list_head *notify_list) 860 { 861 NFT_CB(skb).report = report; 862 list_add_tail(&skb->list, notify_list); 863 } 864 865 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) 866 { 867 struct nftables_pernet *nft_net; 868 struct sk_buff *skb; 869 u16 flags = 0; 870 int err; 871 872 if (!ctx->report && 873 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 874 return; 875 876 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 877 if (skb == NULL) 878 goto err; 879 880 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 881 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 882 883 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 884 event, flags, ctx->family, ctx->table); 885 if (err < 0) { 886 kfree_skb(skb); 887 goto err; 888 } 889 890 nft_net = nft_pernet(ctx->net); 891 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 892 return; 893 err: 894 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 895 } 896 897 static int nf_tables_dump_tables(struct sk_buff *skb, 898 struct netlink_callback *cb) 899 { 900 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 901 struct nftables_pernet *nft_net; 902 const struct nft_table *table; 903 unsigned int idx = 0, s_idx = cb->args[0]; 904 struct net *net = sock_net(skb->sk); 905 int family = nfmsg->nfgen_family; 906 907 rcu_read_lock(); 908 nft_net = nft_pernet(net); 909 cb->seq = READ_ONCE(nft_net->base_seq); 910 911 list_for_each_entry_rcu(table, &nft_net->tables, list) { 912 if (family != NFPROTO_UNSPEC && family != table->family) 913 continue; 914 915 if (idx < s_idx) 916 goto cont; 917 if (idx > s_idx) 918 memset(&cb->args[1], 0, 919 sizeof(cb->args) - sizeof(cb->args[0])); 920 if (!nft_is_active(net, table)) 921 continue; 922 if (nf_tables_fill_table_info(skb, net, 923 NETLINK_CB(cb->skb).portid, 924 cb->nlh->nlmsg_seq, 925 NFT_MSG_NEWTABLE, NLM_F_MULTI, 926 table->family, table) < 0) 927 goto done; 928 929 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 930 cont: 931 idx++; 932 } 933 done: 934 rcu_read_unlock(); 935 cb->args[0] = idx; 936 return skb->len; 937 } 938 939 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb, 940 const struct nlmsghdr *nlh, 941 struct netlink_dump_control *c) 942 { 943 int err; 944 945 if (!try_module_get(THIS_MODULE)) 946 return -EINVAL; 947 948 rcu_read_unlock(); 949 err = netlink_dump_start(nlsk, skb, nlh, c); 950 rcu_read_lock(); 951 module_put(THIS_MODULE); 952 953 return err; 954 } 955 956 /* called with rcu_read_lock held */ 957 static int nf_tables_gettable(struct sk_buff *skb, const struct nfnl_info *info, 958 const struct nlattr * const nla[]) 959 { 960 struct netlink_ext_ack *extack = info->extack; 961 u8 genmask = nft_genmask_cur(info->net); 962 u8 family = info->nfmsg->nfgen_family; 963 const struct nft_table *table; 964 struct net *net = info->net; 965 struct sk_buff *skb2; 966 int err; 967 968 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 969 struct netlink_dump_control c = { 970 .dump = nf_tables_dump_tables, 971 .module = THIS_MODULE, 972 }; 973 974 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 975 } 976 977 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask, 0); 978 if (IS_ERR(table)) { 979 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]); 980 return PTR_ERR(table); 981 } 982 983 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 984 if (!skb2) 985 return -ENOMEM; 986 987 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 988 info->nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 989 0, family, table); 990 if (err < 0) 991 goto err_fill_table_info; 992 993 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 994 995 err_fill_table_info: 996 kfree_skb(skb2); 997 return err; 998 } 999 1000 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) 1001 { 1002 struct nft_chain *chain; 1003 u32 i = 0; 1004 1005 list_for_each_entry(chain, &table->chains, list) { 1006 if (!nft_is_active_next(net, chain)) 1007 continue; 1008 if (!nft_is_base_chain(chain)) 1009 continue; 1010 1011 if (cnt && i++ == cnt) 1012 break; 1013 1014 nf_tables_unregister_hook(net, table, chain); 1015 } 1016 } 1017 1018 static int nf_tables_table_enable(struct net *net, struct nft_table *table) 1019 { 1020 struct nft_chain *chain; 1021 int err, i = 0; 1022 1023 list_for_each_entry(chain, &table->chains, list) { 1024 if (!nft_is_active_next(net, chain)) 1025 continue; 1026 if (!nft_is_base_chain(chain)) 1027 continue; 1028 1029 err = nf_tables_register_hook(net, table, chain); 1030 if (err < 0) 1031 goto err_register_hooks; 1032 1033 i++; 1034 } 1035 return 0; 1036 1037 err_register_hooks: 1038 if (i) 1039 nft_table_disable(net, table, i); 1040 return err; 1041 } 1042 1043 static void nf_tables_table_disable(struct net *net, struct nft_table *table) 1044 { 1045 table->flags &= ~NFT_TABLE_F_DORMANT; 1046 nft_table_disable(net, table, 0); 1047 table->flags |= NFT_TABLE_F_DORMANT; 1048 } 1049 1050 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1) 1051 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0) 1052 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1) 1053 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ 1054 __NFT_TABLE_F_WAS_AWAKEN) 1055 1056 static int nf_tables_updtable(struct nft_ctx *ctx) 1057 { 1058 struct nft_trans *trans; 1059 u32 flags; 1060 int ret; 1061 1062 if (!ctx->nla[NFTA_TABLE_FLAGS]) 1063 return 0; 1064 1065 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 1066 if (flags & ~NFT_TABLE_F_MASK) 1067 return -EOPNOTSUPP; 1068 1069 if (flags == ctx->table->flags) 1070 return 0; 1071 1072 if ((nft_table_has_owner(ctx->table) && 1073 !(flags & NFT_TABLE_F_OWNER)) || 1074 (!nft_table_has_owner(ctx->table) && 1075 flags & NFT_TABLE_F_OWNER)) 1076 return -EOPNOTSUPP; 1077 1078 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 1079 sizeof(struct nft_trans_table)); 1080 if (trans == NULL) 1081 return -ENOMEM; 1082 1083 if ((flags & NFT_TABLE_F_DORMANT) && 1084 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 1085 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1086 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) 1087 ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN; 1088 } else if (!(flags & NFT_TABLE_F_DORMANT) && 1089 ctx->table->flags & NFT_TABLE_F_DORMANT) { 1090 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 1091 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) { 1092 ret = nf_tables_table_enable(ctx->net, ctx->table); 1093 if (ret < 0) 1094 goto err_register_hooks; 1095 1096 ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT; 1097 } 1098 } 1099 1100 nft_trans_table_update(trans) = true; 1101 nft_trans_commit_list_add_tail(ctx->net, trans); 1102 1103 return 0; 1104 1105 err_register_hooks: 1106 nft_trans_destroy(trans); 1107 return ret; 1108 } 1109 1110 static u32 nft_chain_hash(const void *data, u32 len, u32 seed) 1111 { 1112 const char *name = data; 1113 1114 return jhash(name, strlen(name), seed); 1115 } 1116 1117 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed) 1118 { 1119 const struct nft_chain *chain = data; 1120 1121 return nft_chain_hash(chain->name, 0, seed); 1122 } 1123 1124 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg, 1125 const void *ptr) 1126 { 1127 const struct nft_chain *chain = ptr; 1128 const char *name = arg->key; 1129 1130 return strcmp(chain->name, name); 1131 } 1132 1133 static u32 nft_objname_hash(const void *data, u32 len, u32 seed) 1134 { 1135 const struct nft_object_hash_key *k = data; 1136 1137 seed ^= hash_ptr(k->table, 32); 1138 1139 return jhash(k->name, strlen(k->name), seed); 1140 } 1141 1142 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed) 1143 { 1144 const struct nft_object *obj = data; 1145 1146 return nft_objname_hash(&obj->key, 0, seed); 1147 } 1148 1149 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg, 1150 const void *ptr) 1151 { 1152 const struct nft_object_hash_key *k = arg->key; 1153 const struct nft_object *obj = ptr; 1154 1155 if (obj->key.table != k->table) 1156 return -1; 1157 1158 return strcmp(obj->key.name, k->name); 1159 } 1160 1161 static bool nft_supported_family(u8 family) 1162 { 1163 return false 1164 #ifdef CONFIG_NF_TABLES_INET 1165 || family == NFPROTO_INET 1166 #endif 1167 #ifdef CONFIG_NF_TABLES_IPV4 1168 || family == NFPROTO_IPV4 1169 #endif 1170 #ifdef CONFIG_NF_TABLES_ARP 1171 || family == NFPROTO_ARP 1172 #endif 1173 #ifdef CONFIG_NF_TABLES_NETDEV 1174 || family == NFPROTO_NETDEV 1175 #endif 1176 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) 1177 || family == NFPROTO_BRIDGE 1178 #endif 1179 #ifdef CONFIG_NF_TABLES_IPV6 1180 || family == NFPROTO_IPV6 1181 #endif 1182 ; 1183 } 1184 1185 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 1186 const struct nlattr * const nla[]) 1187 { 1188 struct nftables_pernet *nft_net = nft_pernet(info->net); 1189 struct netlink_ext_ack *extack = info->extack; 1190 u8 genmask = nft_genmask_next(info->net); 1191 u8 family = info->nfmsg->nfgen_family; 1192 struct net *net = info->net; 1193 const struct nlattr *attr; 1194 struct nft_table *table; 1195 struct nft_ctx ctx; 1196 u32 flags = 0; 1197 int err; 1198 1199 if (!nft_supported_family(family)) 1200 return -EOPNOTSUPP; 1201 1202 lockdep_assert_held(&nft_net->commit_mutex); 1203 attr = nla[NFTA_TABLE_NAME]; 1204 table = nft_table_lookup(net, attr, family, genmask, 1205 NETLINK_CB(skb).portid); 1206 if (IS_ERR(table)) { 1207 if (PTR_ERR(table) != -ENOENT) 1208 return PTR_ERR(table); 1209 } else { 1210 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 1211 NL_SET_BAD_ATTR(extack, attr); 1212 return -EEXIST; 1213 } 1214 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 1215 return -EOPNOTSUPP; 1216 1217 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1218 1219 return nf_tables_updtable(&ctx); 1220 } 1221 1222 if (nla[NFTA_TABLE_FLAGS]) { 1223 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 1224 if (flags & ~NFT_TABLE_F_MASK) 1225 return -EOPNOTSUPP; 1226 } 1227 1228 err = -ENOMEM; 1229 table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT); 1230 if (table == NULL) 1231 goto err_kzalloc; 1232 1233 table->validate_state = NFT_VALIDATE_SKIP; 1234 table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); 1235 if (table->name == NULL) 1236 goto err_strdup; 1237 1238 if (nla[NFTA_TABLE_USERDATA]) { 1239 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT); 1240 if (table->udata == NULL) 1241 goto err_table_udata; 1242 1243 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]); 1244 } 1245 1246 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params); 1247 if (err) 1248 goto err_chain_ht; 1249 1250 INIT_LIST_HEAD(&table->chains); 1251 INIT_LIST_HEAD(&table->sets); 1252 INIT_LIST_HEAD(&table->objects); 1253 INIT_LIST_HEAD(&table->flowtables); 1254 table->family = family; 1255 table->flags = flags; 1256 table->handle = ++nft_net->table_handle; 1257 if (table->flags & NFT_TABLE_F_OWNER) 1258 table->nlpid = NETLINK_CB(skb).portid; 1259 1260 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1261 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 1262 if (err < 0) 1263 goto err_trans; 1264 1265 list_add_tail_rcu(&table->list, &nft_net->tables); 1266 return 0; 1267 err_trans: 1268 rhltable_destroy(&table->chains_ht); 1269 err_chain_ht: 1270 kfree(table->udata); 1271 err_table_udata: 1272 kfree(table->name); 1273 err_strdup: 1274 kfree(table); 1275 err_kzalloc: 1276 return err; 1277 } 1278 1279 static int nft_flush_table(struct nft_ctx *ctx) 1280 { 1281 struct nft_flowtable *flowtable, *nft; 1282 struct nft_chain *chain, *nc; 1283 struct nft_object *obj, *ne; 1284 struct nft_set *set, *ns; 1285 int err; 1286 1287 list_for_each_entry(chain, &ctx->table->chains, list) { 1288 if (!nft_is_active_next(ctx->net, chain)) 1289 continue; 1290 1291 if (nft_chain_is_bound(chain)) 1292 continue; 1293 1294 ctx->chain = chain; 1295 1296 err = nft_delrule_by_chain(ctx); 1297 if (err < 0) 1298 goto out; 1299 } 1300 1301 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 1302 if (!nft_is_active_next(ctx->net, set)) 1303 continue; 1304 1305 if (nft_set_is_anonymous(set) && 1306 !list_empty(&set->bindings)) 1307 continue; 1308 1309 err = nft_delset(ctx, set); 1310 if (err < 0) 1311 goto out; 1312 } 1313 1314 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { 1315 if (!nft_is_active_next(ctx->net, flowtable)) 1316 continue; 1317 1318 err = nft_delflowtable(ctx, flowtable); 1319 if (err < 0) 1320 goto out; 1321 } 1322 1323 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { 1324 if (!nft_is_active_next(ctx->net, obj)) 1325 continue; 1326 1327 err = nft_delobj(ctx, obj); 1328 if (err < 0) 1329 goto out; 1330 } 1331 1332 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 1333 if (!nft_is_active_next(ctx->net, chain)) 1334 continue; 1335 1336 if (nft_chain_is_bound(chain)) 1337 continue; 1338 1339 ctx->chain = chain; 1340 1341 err = nft_delchain(ctx); 1342 if (err < 0) 1343 goto out; 1344 } 1345 1346 err = nft_deltable(ctx); 1347 out: 1348 return err; 1349 } 1350 1351 static int nft_flush(struct nft_ctx *ctx, int family) 1352 { 1353 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1354 const struct nlattr * const *nla = ctx->nla; 1355 struct nft_table *table, *nt; 1356 int err = 0; 1357 1358 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 1359 if (family != AF_UNSPEC && table->family != family) 1360 continue; 1361 1362 ctx->family = table->family; 1363 1364 if (!nft_is_active_next(ctx->net, table)) 1365 continue; 1366 1367 if (nft_table_has_owner(table) && table->nlpid != ctx->portid) 1368 continue; 1369 1370 if (nla[NFTA_TABLE_NAME] && 1371 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 1372 continue; 1373 1374 ctx->table = table; 1375 1376 err = nft_flush_table(ctx); 1377 if (err < 0) 1378 goto out; 1379 } 1380 out: 1381 return err; 1382 } 1383 1384 static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, 1385 const struct nlattr * const nla[]) 1386 { 1387 struct netlink_ext_ack *extack = info->extack; 1388 u8 genmask = nft_genmask_next(info->net); 1389 u8 family = info->nfmsg->nfgen_family; 1390 struct net *net = info->net; 1391 const struct nlattr *attr; 1392 struct nft_table *table; 1393 struct nft_ctx ctx; 1394 1395 nft_ctx_init(&ctx, net, skb, info->nlh, 0, NULL, NULL, nla); 1396 if (family == AF_UNSPEC || 1397 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) 1398 return nft_flush(&ctx, family); 1399 1400 if (nla[NFTA_TABLE_HANDLE]) { 1401 attr = nla[NFTA_TABLE_HANDLE]; 1402 table = nft_table_lookup_byhandle(net, attr, genmask, 1403 NETLINK_CB(skb).portid); 1404 } else { 1405 attr = nla[NFTA_TABLE_NAME]; 1406 table = nft_table_lookup(net, attr, family, genmask, 1407 NETLINK_CB(skb).portid); 1408 } 1409 1410 if (IS_ERR(table)) { 1411 if (PTR_ERR(table) == -ENOENT && 1412 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYTABLE) 1413 return 0; 1414 1415 NL_SET_BAD_ATTR(extack, attr); 1416 return PTR_ERR(table); 1417 } 1418 1419 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 1420 table->use > 0) 1421 return -EBUSY; 1422 1423 ctx.family = family; 1424 ctx.table = table; 1425 1426 return nft_flush_table(&ctx); 1427 } 1428 1429 static void nf_tables_table_destroy(struct nft_ctx *ctx) 1430 { 1431 if (WARN_ON(ctx->table->use > 0)) 1432 return; 1433 1434 rhltable_destroy(&ctx->table->chains_ht); 1435 kfree(ctx->table->name); 1436 kfree(ctx->table->udata); 1437 kfree(ctx->table); 1438 } 1439 1440 void nft_register_chain_type(const struct nft_chain_type *ctype) 1441 { 1442 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1443 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) { 1444 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1445 return; 1446 } 1447 chain_type[ctype->family][ctype->type] = ctype; 1448 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1449 } 1450 EXPORT_SYMBOL_GPL(nft_register_chain_type); 1451 1452 void nft_unregister_chain_type(const struct nft_chain_type *ctype) 1453 { 1454 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1455 chain_type[ctype->family][ctype->type] = NULL; 1456 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1457 } 1458 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 1459 1460 /* 1461 * Chains 1462 */ 1463 1464 static struct nft_chain * 1465 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask) 1466 { 1467 struct nft_chain *chain; 1468 1469 list_for_each_entry(chain, &table->chains, list) { 1470 if (chain->handle == handle && 1471 nft_active_genmask(chain, genmask)) 1472 return chain; 1473 } 1474 1475 return ERR_PTR(-ENOENT); 1476 } 1477 1478 static bool lockdep_commit_lock_is_held(const struct net *net) 1479 { 1480 #ifdef CONFIG_PROVE_LOCKING 1481 struct nftables_pernet *nft_net = nft_pernet(net); 1482 1483 return lockdep_is_held(&nft_net->commit_mutex); 1484 #else 1485 return true; 1486 #endif 1487 } 1488 1489 static struct nft_chain *nft_chain_lookup(struct net *net, 1490 struct nft_table *table, 1491 const struct nlattr *nla, u8 genmask) 1492 { 1493 char search[NFT_CHAIN_MAXNAMELEN + 1]; 1494 struct rhlist_head *tmp, *list; 1495 struct nft_chain *chain; 1496 1497 if (nla == NULL) 1498 return ERR_PTR(-EINVAL); 1499 1500 nla_strscpy(search, nla, sizeof(search)); 1501 1502 WARN_ON(!rcu_read_lock_held() && 1503 !lockdep_commit_lock_is_held(net)); 1504 1505 chain = ERR_PTR(-ENOENT); 1506 rcu_read_lock(); 1507 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params); 1508 if (!list) 1509 goto out_unlock; 1510 1511 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 1512 if (nft_active_genmask(chain, genmask)) 1513 goto out_unlock; 1514 } 1515 chain = ERR_PTR(-ENOENT); 1516 out_unlock: 1517 rcu_read_unlock(); 1518 return chain; 1519 } 1520 1521 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 1522 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING, 1523 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1524 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 1525 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 1526 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1527 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 1528 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 1529 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING, 1530 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 1531 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 1532 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 }, 1533 [NFTA_CHAIN_ID] = { .type = NLA_U32 }, 1534 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY, 1535 .len = NFT_USERDATA_MAXLEN }, 1536 }; 1537 1538 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 1539 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 1540 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 1541 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 1542 .len = IFNAMSIZ - 1 }, 1543 }; 1544 1545 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 1546 { 1547 struct nft_stats *cpu_stats, total; 1548 struct nlattr *nest; 1549 unsigned int seq; 1550 u64 pkts, bytes; 1551 int cpu; 1552 1553 if (!stats) 1554 return 0; 1555 1556 memset(&total, 0, sizeof(total)); 1557 for_each_possible_cpu(cpu) { 1558 cpu_stats = per_cpu_ptr(stats, cpu); 1559 do { 1560 seq = u64_stats_fetch_begin(&cpu_stats->syncp); 1561 pkts = cpu_stats->pkts; 1562 bytes = cpu_stats->bytes; 1563 } while (u64_stats_fetch_retry(&cpu_stats->syncp, seq)); 1564 total.pkts += pkts; 1565 total.bytes += bytes; 1566 } 1567 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS); 1568 if (nest == NULL) 1569 goto nla_put_failure; 1570 1571 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts), 1572 NFTA_COUNTER_PAD) || 1573 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 1574 NFTA_COUNTER_PAD)) 1575 goto nla_put_failure; 1576 1577 nla_nest_end(skb, nest); 1578 return 0; 1579 1580 nla_put_failure: 1581 return -ENOSPC; 1582 } 1583 1584 static int nft_dump_basechain_hook(struct sk_buff *skb, int family, 1585 const struct nft_base_chain *basechain, 1586 const struct list_head *hook_list) 1587 { 1588 const struct nf_hook_ops *ops = &basechain->ops; 1589 struct nft_hook *hook, *first = NULL; 1590 struct nlattr *nest, *nest_devs; 1591 int n = 0; 1592 1593 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK); 1594 if (nest == NULL) 1595 goto nla_put_failure; 1596 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 1597 goto nla_put_failure; 1598 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 1599 goto nla_put_failure; 1600 1601 if (nft_base_chain_netdev(family, ops->hooknum)) { 1602 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS); 1603 1604 if (!hook_list) 1605 hook_list = &basechain->hook_list; 1606 1607 list_for_each_entry(hook, hook_list, list) { 1608 if (!first) 1609 first = hook; 1610 1611 if (nla_put_string(skb, NFTA_DEVICE_NAME, 1612 hook->ops.dev->name)) 1613 goto nla_put_failure; 1614 n++; 1615 } 1616 nla_nest_end(skb, nest_devs); 1617 1618 if (n == 1 && 1619 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name)) 1620 goto nla_put_failure; 1621 } 1622 nla_nest_end(skb, nest); 1623 1624 return 0; 1625 nla_put_failure: 1626 return -1; 1627 } 1628 1629 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 1630 u32 portid, u32 seq, int event, u32 flags, 1631 int family, const struct nft_table *table, 1632 const struct nft_chain *chain, 1633 const struct list_head *hook_list) 1634 { 1635 struct nlmsghdr *nlh; 1636 1637 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 1638 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 1639 NFNETLINK_V0, nft_base_seq(net)); 1640 if (!nlh) 1641 goto nla_put_failure; 1642 1643 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name) || 1644 nla_put_string(skb, NFTA_CHAIN_NAME, chain->name) || 1645 nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), 1646 NFTA_CHAIN_PAD)) 1647 goto nla_put_failure; 1648 1649 if (event == NFT_MSG_DELCHAIN && !hook_list) { 1650 nlmsg_end(skb, nlh); 1651 return 0; 1652 } 1653 1654 if (nft_is_base_chain(chain)) { 1655 const struct nft_base_chain *basechain = nft_base_chain(chain); 1656 struct nft_stats __percpu *stats; 1657 1658 if (nft_dump_basechain_hook(skb, family, basechain, hook_list)) 1659 goto nla_put_failure; 1660 1661 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 1662 htonl(basechain->policy))) 1663 goto nla_put_failure; 1664 1665 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 1666 goto nla_put_failure; 1667 1668 stats = rcu_dereference_check(basechain->stats, 1669 lockdep_commit_lock_is_held(net)); 1670 if (nft_dump_stats(skb, stats)) 1671 goto nla_put_failure; 1672 } 1673 1674 if (chain->flags && 1675 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags))) 1676 goto nla_put_failure; 1677 1678 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 1679 goto nla_put_failure; 1680 1681 if (chain->udata && 1682 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata)) 1683 goto nla_put_failure; 1684 1685 nlmsg_end(skb, nlh); 1686 return 0; 1687 1688 nla_put_failure: 1689 nlmsg_trim(skb, nlh); 1690 return -1; 1691 } 1692 1693 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, 1694 const struct list_head *hook_list) 1695 { 1696 struct nftables_pernet *nft_net; 1697 struct sk_buff *skb; 1698 u16 flags = 0; 1699 int err; 1700 1701 if (!ctx->report && 1702 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1703 return; 1704 1705 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1706 if (skb == NULL) 1707 goto err; 1708 1709 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 1710 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 1711 1712 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 1713 event, flags, ctx->family, ctx->table, 1714 ctx->chain, hook_list); 1715 if (err < 0) { 1716 kfree_skb(skb); 1717 goto err; 1718 } 1719 1720 nft_net = nft_pernet(ctx->net); 1721 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 1722 return; 1723 err: 1724 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1725 } 1726 1727 static int nf_tables_dump_chains(struct sk_buff *skb, 1728 struct netlink_callback *cb) 1729 { 1730 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1731 unsigned int idx = 0, s_idx = cb->args[0]; 1732 struct net *net = sock_net(skb->sk); 1733 int family = nfmsg->nfgen_family; 1734 struct nftables_pernet *nft_net; 1735 const struct nft_table *table; 1736 const struct nft_chain *chain; 1737 1738 rcu_read_lock(); 1739 nft_net = nft_pernet(net); 1740 cb->seq = READ_ONCE(nft_net->base_seq); 1741 1742 list_for_each_entry_rcu(table, &nft_net->tables, list) { 1743 if (family != NFPROTO_UNSPEC && family != table->family) 1744 continue; 1745 1746 list_for_each_entry_rcu(chain, &table->chains, list) { 1747 if (idx < s_idx) 1748 goto cont; 1749 if (idx > s_idx) 1750 memset(&cb->args[1], 0, 1751 sizeof(cb->args) - sizeof(cb->args[0])); 1752 if (!nft_is_active(net, chain)) 1753 continue; 1754 if (nf_tables_fill_chain_info(skb, net, 1755 NETLINK_CB(cb->skb).portid, 1756 cb->nlh->nlmsg_seq, 1757 NFT_MSG_NEWCHAIN, 1758 NLM_F_MULTI, 1759 table->family, table, 1760 chain, NULL) < 0) 1761 goto done; 1762 1763 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1764 cont: 1765 idx++; 1766 } 1767 } 1768 done: 1769 rcu_read_unlock(); 1770 cb->args[0] = idx; 1771 return skb->len; 1772 } 1773 1774 /* called with rcu_read_lock held */ 1775 static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, 1776 const struct nlattr * const nla[]) 1777 { 1778 struct netlink_ext_ack *extack = info->extack; 1779 u8 genmask = nft_genmask_cur(info->net); 1780 u8 family = info->nfmsg->nfgen_family; 1781 const struct nft_chain *chain; 1782 struct net *net = info->net; 1783 struct nft_table *table; 1784 struct sk_buff *skb2; 1785 int err; 1786 1787 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1788 struct netlink_dump_control c = { 1789 .dump = nf_tables_dump_chains, 1790 .module = THIS_MODULE, 1791 }; 1792 1793 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 1794 } 1795 1796 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 0); 1797 if (IS_ERR(table)) { 1798 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 1799 return PTR_ERR(table); 1800 } 1801 1802 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask); 1803 if (IS_ERR(chain)) { 1804 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 1805 return PTR_ERR(chain); 1806 } 1807 1808 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 1809 if (!skb2) 1810 return -ENOMEM; 1811 1812 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 1813 info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 1814 0, family, table, chain, NULL); 1815 if (err < 0) 1816 goto err_fill_chain_info; 1817 1818 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 1819 1820 err_fill_chain_info: 1821 kfree_skb(skb2); 1822 return err; 1823 } 1824 1825 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 1826 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 1827 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 1828 }; 1829 1830 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 1831 { 1832 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 1833 struct nft_stats __percpu *newstats; 1834 struct nft_stats *stats; 1835 int err; 1836 1837 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr, 1838 nft_counter_policy, NULL); 1839 if (err < 0) 1840 return ERR_PTR(err); 1841 1842 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 1843 return ERR_PTR(-EINVAL); 1844 1845 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 1846 if (newstats == NULL) 1847 return ERR_PTR(-ENOMEM); 1848 1849 /* Restore old counters on this cpu, no problem. Per-cpu statistics 1850 * are not exposed to userspace. 1851 */ 1852 preempt_disable(); 1853 stats = this_cpu_ptr(newstats); 1854 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 1855 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 1856 preempt_enable(); 1857 1858 return newstats; 1859 } 1860 1861 static void nft_chain_stats_replace(struct nft_trans *trans) 1862 { 1863 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain); 1864 1865 if (!nft_trans_chain_stats(trans)) 1866 return; 1867 1868 nft_trans_chain_stats(trans) = 1869 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans), 1870 lockdep_commit_lock_is_held(trans->ctx.net)); 1871 1872 if (!nft_trans_chain_stats(trans)) 1873 static_branch_inc(&nft_counters_enabled); 1874 } 1875 1876 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) 1877 { 1878 struct nft_rule_blob *g0 = rcu_dereference_raw(chain->blob_gen_0); 1879 struct nft_rule_blob *g1 = rcu_dereference_raw(chain->blob_gen_1); 1880 1881 if (g0 != g1) 1882 kvfree(g1); 1883 kvfree(g0); 1884 1885 /* should be NULL either via abort or via successful commit */ 1886 WARN_ON_ONCE(chain->blob_next); 1887 kvfree(chain->blob_next); 1888 } 1889 1890 void nf_tables_chain_destroy(struct nft_ctx *ctx) 1891 { 1892 struct nft_chain *chain = ctx->chain; 1893 struct nft_hook *hook, *next; 1894 1895 if (WARN_ON(chain->use > 0)) 1896 return; 1897 1898 /* no concurrent access possible anymore */ 1899 nf_tables_chain_free_chain_rules(chain); 1900 1901 if (nft_is_base_chain(chain)) { 1902 struct nft_base_chain *basechain = nft_base_chain(chain); 1903 1904 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 1905 list_for_each_entry_safe(hook, next, 1906 &basechain->hook_list, list) { 1907 list_del_rcu(&hook->list); 1908 kfree_rcu(hook, rcu); 1909 } 1910 } 1911 module_put(basechain->type->owner); 1912 if (rcu_access_pointer(basechain->stats)) { 1913 static_branch_dec(&nft_counters_enabled); 1914 free_percpu(rcu_dereference_raw(basechain->stats)); 1915 } 1916 kfree(chain->name); 1917 kfree(chain->udata); 1918 kfree(basechain); 1919 } else { 1920 kfree(chain->name); 1921 kfree(chain->udata); 1922 kfree(chain); 1923 } 1924 } 1925 1926 static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 1927 const struct nlattr *attr) 1928 { 1929 struct net_device *dev; 1930 char ifname[IFNAMSIZ]; 1931 struct nft_hook *hook; 1932 int err; 1933 1934 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT); 1935 if (!hook) { 1936 err = -ENOMEM; 1937 goto err_hook_alloc; 1938 } 1939 1940 nla_strscpy(ifname, attr, IFNAMSIZ); 1941 /* nf_tables_netdev_event() is called under rtnl_mutex, this is 1942 * indirectly serializing all the other holders of the commit_mutex with 1943 * the rtnl_mutex. 1944 */ 1945 dev = __dev_get_by_name(net, ifname); 1946 if (!dev) { 1947 err = -ENOENT; 1948 goto err_hook_dev; 1949 } 1950 hook->ops.dev = dev; 1951 1952 return hook; 1953 1954 err_hook_dev: 1955 kfree(hook); 1956 err_hook_alloc: 1957 return ERR_PTR(err); 1958 } 1959 1960 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, 1961 const struct nft_hook *this) 1962 { 1963 struct nft_hook *hook; 1964 1965 list_for_each_entry(hook, hook_list, list) { 1966 if (this->ops.dev == hook->ops.dev) 1967 return hook; 1968 } 1969 1970 return NULL; 1971 } 1972 1973 static int nf_tables_parse_netdev_hooks(struct net *net, 1974 const struct nlattr *attr, 1975 struct list_head *hook_list, 1976 struct netlink_ext_ack *extack) 1977 { 1978 struct nft_hook *hook, *next; 1979 const struct nlattr *tmp; 1980 int rem, n = 0, err; 1981 1982 nla_for_each_nested(tmp, attr, rem) { 1983 if (nla_type(tmp) != NFTA_DEVICE_NAME) { 1984 err = -EINVAL; 1985 goto err_hook; 1986 } 1987 1988 hook = nft_netdev_hook_alloc(net, tmp); 1989 if (IS_ERR(hook)) { 1990 NL_SET_BAD_ATTR(extack, tmp); 1991 err = PTR_ERR(hook); 1992 goto err_hook; 1993 } 1994 if (nft_hook_list_find(hook_list, hook)) { 1995 NL_SET_BAD_ATTR(extack, tmp); 1996 kfree(hook); 1997 err = -EEXIST; 1998 goto err_hook; 1999 } 2000 list_add_tail(&hook->list, hook_list); 2001 n++; 2002 2003 if (n == NFT_NETDEVICE_MAX) { 2004 err = -EFBIG; 2005 goto err_hook; 2006 } 2007 } 2008 2009 return 0; 2010 2011 err_hook: 2012 list_for_each_entry_safe(hook, next, hook_list, list) { 2013 list_del(&hook->list); 2014 kfree(hook); 2015 } 2016 return err; 2017 } 2018 2019 struct nft_chain_hook { 2020 u32 num; 2021 s32 priority; 2022 const struct nft_chain_type *type; 2023 struct list_head list; 2024 }; 2025 2026 static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[], 2027 struct list_head *hook_list, 2028 struct netlink_ext_ack *extack, u32 flags) 2029 { 2030 struct nft_hook *hook; 2031 int err; 2032 2033 if (tb[NFTA_HOOK_DEV]) { 2034 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]); 2035 if (IS_ERR(hook)) { 2036 NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]); 2037 return PTR_ERR(hook); 2038 } 2039 2040 list_add_tail(&hook->list, hook_list); 2041 } else if (tb[NFTA_HOOK_DEVS]) { 2042 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS], 2043 hook_list, extack); 2044 if (err < 0) 2045 return err; 2046 2047 } 2048 2049 if (flags & NFT_CHAIN_HW_OFFLOAD && 2050 list_empty(hook_list)) 2051 return -EINVAL; 2052 2053 return 0; 2054 } 2055 2056 static int nft_chain_parse_hook(struct net *net, 2057 struct nft_base_chain *basechain, 2058 const struct nlattr * const nla[], 2059 struct nft_chain_hook *hook, u8 family, 2060 u32 flags, struct netlink_ext_ack *extack) 2061 { 2062 struct nftables_pernet *nft_net = nft_pernet(net); 2063 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 2064 const struct nft_chain_type *type; 2065 int err; 2066 2067 lockdep_assert_held(&nft_net->commit_mutex); 2068 lockdep_nfnl_nft_mutex_not_held(); 2069 2070 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX, 2071 nla[NFTA_CHAIN_HOOK], 2072 nft_hook_policy, NULL); 2073 if (err < 0) 2074 return err; 2075 2076 if (!basechain) { 2077 if (!ha[NFTA_HOOK_HOOKNUM] || 2078 !ha[NFTA_HOOK_PRIORITY]) { 2079 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2080 return -ENOENT; 2081 } 2082 2083 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2084 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2085 2086 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT); 2087 if (!type) 2088 return -EOPNOTSUPP; 2089 2090 if (nla[NFTA_CHAIN_TYPE]) { 2091 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE], 2092 family, true); 2093 if (IS_ERR(type)) { 2094 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2095 return PTR_ERR(type); 2096 } 2097 } 2098 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num))) 2099 return -EOPNOTSUPP; 2100 2101 if (type->type == NFT_CHAIN_T_NAT && 2102 hook->priority <= NF_IP_PRI_CONNTRACK) 2103 return -EOPNOTSUPP; 2104 } else { 2105 if (ha[NFTA_HOOK_HOOKNUM]) { 2106 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2107 if (hook->num != basechain->ops.hooknum) 2108 return -EOPNOTSUPP; 2109 } 2110 if (ha[NFTA_HOOK_PRIORITY]) { 2111 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2112 if (hook->priority != basechain->ops.priority) 2113 return -EOPNOTSUPP; 2114 } 2115 2116 type = basechain->type; 2117 } 2118 2119 if (!try_module_get(type->owner)) { 2120 if (nla[NFTA_CHAIN_TYPE]) 2121 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2122 return -ENOENT; 2123 } 2124 2125 hook->type = type; 2126 2127 INIT_LIST_HEAD(&hook->list); 2128 if (nft_base_chain_netdev(family, hook->num)) { 2129 err = nft_chain_parse_netdev(net, ha, &hook->list, extack, flags); 2130 if (err < 0) { 2131 module_put(type->owner); 2132 return err; 2133 } 2134 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) { 2135 module_put(type->owner); 2136 return -EOPNOTSUPP; 2137 } 2138 2139 return 0; 2140 } 2141 2142 static void nft_chain_release_hook(struct nft_chain_hook *hook) 2143 { 2144 struct nft_hook *h, *next; 2145 2146 list_for_each_entry_safe(h, next, &hook->list, list) { 2147 list_del(&h->list); 2148 kfree(h); 2149 } 2150 module_put(hook->type->owner); 2151 } 2152 2153 static void nft_last_rule(const struct nft_chain *chain, const void *ptr) 2154 { 2155 struct nft_rule_dp_last *lrule; 2156 2157 BUILD_BUG_ON(offsetof(struct nft_rule_dp_last, end) != 0); 2158 2159 lrule = (struct nft_rule_dp_last *)ptr; 2160 lrule->end.is_last = 1; 2161 lrule->chain = chain; 2162 /* blob size does not include the trailer rule */ 2163 } 2164 2165 static struct nft_rule_blob *nf_tables_chain_alloc_rules(const struct nft_chain *chain, 2166 unsigned int size) 2167 { 2168 struct nft_rule_blob *blob; 2169 2170 if (size > INT_MAX) 2171 return NULL; 2172 2173 size += sizeof(struct nft_rule_blob) + sizeof(struct nft_rule_dp_last); 2174 2175 blob = kvmalloc(size, GFP_KERNEL_ACCOUNT); 2176 if (!blob) 2177 return NULL; 2178 2179 blob->size = 0; 2180 nft_last_rule(chain, blob->data); 2181 2182 return blob; 2183 } 2184 2185 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family, 2186 const struct nft_chain_hook *hook, 2187 struct nft_chain *chain) 2188 { 2189 ops->pf = family; 2190 ops->hooknum = hook->num; 2191 ops->priority = hook->priority; 2192 ops->priv = chain; 2193 ops->hook = hook->type->hooks[ops->hooknum]; 2194 ops->hook_ops_type = NF_HOOK_OP_NF_TABLES; 2195 } 2196 2197 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, 2198 struct nft_chain_hook *hook, u32 flags) 2199 { 2200 struct nft_chain *chain; 2201 struct nft_hook *h; 2202 2203 basechain->type = hook->type; 2204 INIT_LIST_HEAD(&basechain->hook_list); 2205 chain = &basechain->chain; 2206 2207 if (nft_base_chain_netdev(family, hook->num)) { 2208 list_splice_init(&hook->list, &basechain->hook_list); 2209 list_for_each_entry(h, &basechain->hook_list, list) 2210 nft_basechain_hook_init(&h->ops, family, hook, chain); 2211 } 2212 nft_basechain_hook_init(&basechain->ops, family, hook, chain); 2213 2214 chain->flags |= NFT_CHAIN_BASE | flags; 2215 basechain->policy = NF_ACCEPT; 2216 if (chain->flags & NFT_CHAIN_HW_OFFLOAD && 2217 !nft_chain_offload_support(basechain)) { 2218 list_splice_init(&basechain->hook_list, &hook->list); 2219 return -EOPNOTSUPP; 2220 } 2221 2222 flow_block_init(&basechain->flow_block); 2223 2224 return 0; 2225 } 2226 2227 static int nft_chain_add(struct nft_table *table, struct nft_chain *chain) 2228 { 2229 int err; 2230 2231 err = rhltable_insert_key(&table->chains_ht, chain->name, 2232 &chain->rhlhead, nft_chain_ht_params); 2233 if (err) 2234 return err; 2235 2236 list_add_tail_rcu(&chain->list, &table->chains); 2237 2238 return 0; 2239 } 2240 2241 static u64 chain_id; 2242 2243 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 2244 u8 policy, u32 flags, 2245 struct netlink_ext_ack *extack) 2246 { 2247 const struct nlattr * const *nla = ctx->nla; 2248 struct nft_table *table = ctx->table; 2249 struct nft_base_chain *basechain; 2250 struct net *net = ctx->net; 2251 char name[NFT_NAME_MAXLEN]; 2252 struct nft_rule_blob *blob; 2253 struct nft_trans *trans; 2254 struct nft_chain *chain; 2255 int err; 2256 2257 if (table->use == UINT_MAX) 2258 return -EOVERFLOW; 2259 2260 if (nla[NFTA_CHAIN_HOOK]) { 2261 struct nft_stats __percpu *stats = NULL; 2262 struct nft_chain_hook hook = {}; 2263 2264 if (flags & NFT_CHAIN_BINDING) 2265 return -EOPNOTSUPP; 2266 2267 err = nft_chain_parse_hook(net, NULL, nla, &hook, family, flags, 2268 extack); 2269 if (err < 0) 2270 return err; 2271 2272 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT); 2273 if (basechain == NULL) { 2274 nft_chain_release_hook(&hook); 2275 return -ENOMEM; 2276 } 2277 chain = &basechain->chain; 2278 2279 if (nla[NFTA_CHAIN_COUNTERS]) { 2280 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2281 if (IS_ERR(stats)) { 2282 nft_chain_release_hook(&hook); 2283 kfree(basechain); 2284 return PTR_ERR(stats); 2285 } 2286 rcu_assign_pointer(basechain->stats, stats); 2287 } 2288 2289 err = nft_basechain_init(basechain, family, &hook, flags); 2290 if (err < 0) { 2291 nft_chain_release_hook(&hook); 2292 kfree(basechain); 2293 free_percpu(stats); 2294 return err; 2295 } 2296 if (stats) 2297 static_branch_inc(&nft_counters_enabled); 2298 } else { 2299 if (flags & NFT_CHAIN_BASE) 2300 return -EINVAL; 2301 if (flags & NFT_CHAIN_HW_OFFLOAD) 2302 return -EOPNOTSUPP; 2303 2304 chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT); 2305 if (chain == NULL) 2306 return -ENOMEM; 2307 2308 chain->flags = flags; 2309 } 2310 ctx->chain = chain; 2311 2312 INIT_LIST_HEAD(&chain->rules); 2313 chain->handle = nf_tables_alloc_handle(table); 2314 chain->table = table; 2315 2316 if (nla[NFTA_CHAIN_NAME]) { 2317 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2318 } else { 2319 if (!(flags & NFT_CHAIN_BINDING)) { 2320 err = -EINVAL; 2321 goto err_destroy_chain; 2322 } 2323 2324 snprintf(name, sizeof(name), "__chain%llu", ++chain_id); 2325 chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT); 2326 } 2327 2328 if (!chain->name) { 2329 err = -ENOMEM; 2330 goto err_destroy_chain; 2331 } 2332 2333 if (nla[NFTA_CHAIN_USERDATA]) { 2334 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT); 2335 if (chain->udata == NULL) { 2336 err = -ENOMEM; 2337 goto err_destroy_chain; 2338 } 2339 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]); 2340 } 2341 2342 blob = nf_tables_chain_alloc_rules(chain, 0); 2343 if (!blob) { 2344 err = -ENOMEM; 2345 goto err_destroy_chain; 2346 } 2347 2348 RCU_INIT_POINTER(chain->blob_gen_0, blob); 2349 RCU_INIT_POINTER(chain->blob_gen_1, blob); 2350 2351 err = nf_tables_register_hook(net, table, chain); 2352 if (err < 0) 2353 goto err_destroy_chain; 2354 2355 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN); 2356 if (IS_ERR(trans)) { 2357 err = PTR_ERR(trans); 2358 goto err_unregister_hook; 2359 } 2360 2361 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET; 2362 if (nft_is_base_chain(chain)) 2363 nft_trans_chain_policy(trans) = policy; 2364 2365 err = nft_chain_add(table, chain); 2366 if (err < 0) { 2367 nft_trans_destroy(trans); 2368 goto err_unregister_hook; 2369 } 2370 2371 table->use++; 2372 2373 return 0; 2374 err_unregister_hook: 2375 nf_tables_unregister_hook(net, table, chain); 2376 err_destroy_chain: 2377 nf_tables_chain_destroy(ctx); 2378 2379 return err; 2380 } 2381 2382 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 2383 u32 flags, const struct nlattr *attr, 2384 struct netlink_ext_ack *extack) 2385 { 2386 const struct nlattr * const *nla = ctx->nla; 2387 struct nft_base_chain *basechain = NULL; 2388 struct nft_table *table = ctx->table; 2389 struct nft_chain *chain = ctx->chain; 2390 struct nft_chain_hook hook = {}; 2391 struct nft_stats *stats = NULL; 2392 struct nft_hook *h, *next; 2393 struct nf_hook_ops *ops; 2394 struct nft_trans *trans; 2395 bool unregister = false; 2396 int err; 2397 2398 if (chain->flags ^ flags) 2399 return -EOPNOTSUPP; 2400 2401 INIT_LIST_HEAD(&hook.list); 2402 2403 if (nla[NFTA_CHAIN_HOOK]) { 2404 if (!nft_is_base_chain(chain)) { 2405 NL_SET_BAD_ATTR(extack, attr); 2406 return -EEXIST; 2407 } 2408 2409 basechain = nft_base_chain(chain); 2410 err = nft_chain_parse_hook(ctx->net, basechain, nla, &hook, 2411 ctx->family, flags, extack); 2412 if (err < 0) 2413 return err; 2414 2415 if (basechain->type != hook.type) { 2416 nft_chain_release_hook(&hook); 2417 NL_SET_BAD_ATTR(extack, attr); 2418 return -EEXIST; 2419 } 2420 2421 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 2422 list_for_each_entry_safe(h, next, &hook.list, list) { 2423 h->ops.pf = basechain->ops.pf; 2424 h->ops.hooknum = basechain->ops.hooknum; 2425 h->ops.priority = basechain->ops.priority; 2426 h->ops.priv = basechain->ops.priv; 2427 h->ops.hook = basechain->ops.hook; 2428 2429 if (nft_hook_list_find(&basechain->hook_list, h)) { 2430 list_del(&h->list); 2431 kfree(h); 2432 } 2433 } 2434 } else { 2435 ops = &basechain->ops; 2436 if (ops->hooknum != hook.num || 2437 ops->priority != hook.priority) { 2438 nft_chain_release_hook(&hook); 2439 NL_SET_BAD_ATTR(extack, attr); 2440 return -EEXIST; 2441 } 2442 } 2443 } 2444 2445 if (nla[NFTA_CHAIN_HANDLE] && 2446 nla[NFTA_CHAIN_NAME]) { 2447 struct nft_chain *chain2; 2448 2449 chain2 = nft_chain_lookup(ctx->net, table, 2450 nla[NFTA_CHAIN_NAME], genmask); 2451 if (!IS_ERR(chain2)) { 2452 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2453 err = -EEXIST; 2454 goto err_hooks; 2455 } 2456 } 2457 2458 if (nla[NFTA_CHAIN_COUNTERS]) { 2459 if (!nft_is_base_chain(chain)) { 2460 err = -EOPNOTSUPP; 2461 goto err_hooks; 2462 } 2463 2464 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2465 if (IS_ERR(stats)) { 2466 err = PTR_ERR(stats); 2467 goto err_hooks; 2468 } 2469 } 2470 2471 if (!(table->flags & NFT_TABLE_F_DORMANT) && 2472 nft_is_base_chain(chain) && 2473 !list_empty(&hook.list)) { 2474 basechain = nft_base_chain(chain); 2475 ops = &basechain->ops; 2476 2477 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { 2478 err = nft_netdev_register_hooks(ctx->net, &hook.list); 2479 if (err < 0) 2480 goto err_hooks; 2481 } 2482 } 2483 2484 unregister = true; 2485 err = -ENOMEM; 2486 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, 2487 sizeof(struct nft_trans_chain)); 2488 if (trans == NULL) 2489 goto err_trans; 2490 2491 nft_trans_chain_stats(trans) = stats; 2492 nft_trans_chain_update(trans) = true; 2493 2494 if (nla[NFTA_CHAIN_POLICY]) 2495 nft_trans_chain_policy(trans) = policy; 2496 else 2497 nft_trans_chain_policy(trans) = -1; 2498 2499 if (nla[NFTA_CHAIN_HANDLE] && 2500 nla[NFTA_CHAIN_NAME]) { 2501 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 2502 struct nft_trans *tmp; 2503 char *name; 2504 2505 err = -ENOMEM; 2506 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2507 if (!name) 2508 goto err_trans; 2509 2510 err = -EEXIST; 2511 list_for_each_entry(tmp, &nft_net->commit_list, list) { 2512 if (tmp->msg_type == NFT_MSG_NEWCHAIN && 2513 tmp->ctx.table == table && 2514 nft_trans_chain_update(tmp) && 2515 nft_trans_chain_name(tmp) && 2516 strcmp(name, nft_trans_chain_name(tmp)) == 0) { 2517 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2518 kfree(name); 2519 goto err_trans; 2520 } 2521 } 2522 2523 nft_trans_chain_name(trans) = name; 2524 } 2525 2526 nft_trans_basechain(trans) = basechain; 2527 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 2528 list_splice(&hook.list, &nft_trans_chain_hooks(trans)); 2529 2530 nft_trans_commit_list_add_tail(ctx->net, trans); 2531 2532 return 0; 2533 2534 err_trans: 2535 free_percpu(stats); 2536 kfree(trans); 2537 err_hooks: 2538 if (nla[NFTA_CHAIN_HOOK]) { 2539 list_for_each_entry_safe(h, next, &hook.list, list) { 2540 if (unregister) 2541 nf_unregister_net_hook(ctx->net, &h->ops); 2542 list_del(&h->list); 2543 kfree_rcu(h, rcu); 2544 } 2545 module_put(hook.type->owner); 2546 } 2547 2548 return err; 2549 } 2550 2551 static struct nft_chain *nft_chain_lookup_byid(const struct net *net, 2552 const struct nft_table *table, 2553 const struct nlattr *nla) 2554 { 2555 struct nftables_pernet *nft_net = nft_pernet(net); 2556 u32 id = ntohl(nla_get_be32(nla)); 2557 struct nft_trans *trans; 2558 2559 list_for_each_entry(trans, &nft_net->commit_list, list) { 2560 struct nft_chain *chain = trans->ctx.chain; 2561 2562 if (trans->msg_type == NFT_MSG_NEWCHAIN && 2563 chain->table == table && 2564 id == nft_trans_chain_id(trans)) 2565 return chain; 2566 } 2567 return ERR_PTR(-ENOENT); 2568 } 2569 2570 static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, 2571 const struct nlattr * const nla[]) 2572 { 2573 struct nftables_pernet *nft_net = nft_pernet(info->net); 2574 struct netlink_ext_ack *extack = info->extack; 2575 u8 genmask = nft_genmask_next(info->net); 2576 u8 family = info->nfmsg->nfgen_family; 2577 struct nft_chain *chain = NULL; 2578 struct net *net = info->net; 2579 const struct nlattr *attr; 2580 struct nft_table *table; 2581 u8 policy = NF_ACCEPT; 2582 struct nft_ctx ctx; 2583 u64 handle = 0; 2584 u32 flags = 0; 2585 2586 lockdep_assert_held(&nft_net->commit_mutex); 2587 2588 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2589 NETLINK_CB(skb).portid); 2590 if (IS_ERR(table)) { 2591 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2592 return PTR_ERR(table); 2593 } 2594 2595 chain = NULL; 2596 attr = nla[NFTA_CHAIN_NAME]; 2597 2598 if (nla[NFTA_CHAIN_HANDLE]) { 2599 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 2600 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2601 if (IS_ERR(chain)) { 2602 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]); 2603 return PTR_ERR(chain); 2604 } 2605 attr = nla[NFTA_CHAIN_HANDLE]; 2606 } else if (nla[NFTA_CHAIN_NAME]) { 2607 chain = nft_chain_lookup(net, table, attr, genmask); 2608 if (IS_ERR(chain)) { 2609 if (PTR_ERR(chain) != -ENOENT) { 2610 NL_SET_BAD_ATTR(extack, attr); 2611 return PTR_ERR(chain); 2612 } 2613 chain = NULL; 2614 } 2615 } else if (!nla[NFTA_CHAIN_ID]) { 2616 return -EINVAL; 2617 } 2618 2619 if (nla[NFTA_CHAIN_POLICY]) { 2620 if (chain != NULL && 2621 !nft_is_base_chain(chain)) { 2622 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2623 return -EOPNOTSUPP; 2624 } 2625 2626 if (chain == NULL && 2627 nla[NFTA_CHAIN_HOOK] == NULL) { 2628 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2629 return -EOPNOTSUPP; 2630 } 2631 2632 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 2633 switch (policy) { 2634 case NF_DROP: 2635 case NF_ACCEPT: 2636 break; 2637 default: 2638 return -EINVAL; 2639 } 2640 } 2641 2642 if (nla[NFTA_CHAIN_FLAGS]) 2643 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS])); 2644 else if (chain) 2645 flags = chain->flags; 2646 2647 if (flags & ~NFT_CHAIN_FLAGS) 2648 return -EOPNOTSUPP; 2649 2650 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2651 2652 if (chain != NULL) { 2653 if (chain->flags & NFT_CHAIN_BINDING) 2654 return -EINVAL; 2655 2656 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 2657 NL_SET_BAD_ATTR(extack, attr); 2658 return -EEXIST; 2659 } 2660 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 2661 return -EOPNOTSUPP; 2662 2663 flags |= chain->flags & NFT_CHAIN_BASE; 2664 return nf_tables_updchain(&ctx, genmask, policy, flags, attr, 2665 extack); 2666 } 2667 2668 return nf_tables_addchain(&ctx, family, genmask, policy, flags, extack); 2669 } 2670 2671 static int nft_delchain_hook(struct nft_ctx *ctx, struct nft_chain *chain, 2672 struct netlink_ext_ack *extack) 2673 { 2674 const struct nlattr * const *nla = ctx->nla; 2675 struct nft_chain_hook chain_hook = {}; 2676 struct nft_base_chain *basechain; 2677 struct nft_hook *this, *hook; 2678 LIST_HEAD(chain_del_list); 2679 struct nft_trans *trans; 2680 int err; 2681 2682 if (!nft_is_base_chain(chain)) 2683 return -EOPNOTSUPP; 2684 2685 basechain = nft_base_chain(chain); 2686 err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook, 2687 ctx->family, chain->flags, extack); 2688 if (err < 0) 2689 return err; 2690 2691 list_for_each_entry(this, &chain_hook.list, list) { 2692 hook = nft_hook_list_find(&basechain->hook_list, this); 2693 if (!hook) { 2694 err = -ENOENT; 2695 goto err_chain_del_hook; 2696 } 2697 list_move(&hook->list, &chain_del_list); 2698 } 2699 2700 trans = nft_trans_alloc(ctx, NFT_MSG_DELCHAIN, 2701 sizeof(struct nft_trans_chain)); 2702 if (!trans) { 2703 err = -ENOMEM; 2704 goto err_chain_del_hook; 2705 } 2706 2707 nft_trans_basechain(trans) = basechain; 2708 nft_trans_chain_update(trans) = true; 2709 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 2710 list_splice(&chain_del_list, &nft_trans_chain_hooks(trans)); 2711 nft_chain_release_hook(&chain_hook); 2712 2713 nft_trans_commit_list_add_tail(ctx->net, trans); 2714 2715 return 0; 2716 2717 err_chain_del_hook: 2718 list_splice(&chain_del_list, &basechain->hook_list); 2719 nft_chain_release_hook(&chain_hook); 2720 2721 return err; 2722 } 2723 2724 static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, 2725 const struct nlattr * const nla[]) 2726 { 2727 struct netlink_ext_ack *extack = info->extack; 2728 u8 genmask = nft_genmask_next(info->net); 2729 u8 family = info->nfmsg->nfgen_family; 2730 struct net *net = info->net; 2731 const struct nlattr *attr; 2732 struct nft_table *table; 2733 struct nft_chain *chain; 2734 struct nft_rule *rule; 2735 struct nft_ctx ctx; 2736 u64 handle; 2737 u32 use; 2738 int err; 2739 2740 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2741 NETLINK_CB(skb).portid); 2742 if (IS_ERR(table)) { 2743 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2744 return PTR_ERR(table); 2745 } 2746 2747 if (nla[NFTA_CHAIN_HANDLE]) { 2748 attr = nla[NFTA_CHAIN_HANDLE]; 2749 handle = be64_to_cpu(nla_get_be64(attr)); 2750 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2751 } else { 2752 attr = nla[NFTA_CHAIN_NAME]; 2753 chain = nft_chain_lookup(net, table, attr, genmask); 2754 } 2755 if (IS_ERR(chain)) { 2756 if (PTR_ERR(chain) == -ENOENT && 2757 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN) 2758 return 0; 2759 2760 NL_SET_BAD_ATTR(extack, attr); 2761 return PTR_ERR(chain); 2762 } 2763 2764 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2765 2766 if (nla[NFTA_CHAIN_HOOK]) { 2767 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 2768 return -EOPNOTSUPP; 2769 2770 return nft_delchain_hook(&ctx, chain, extack); 2771 } 2772 2773 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 2774 chain->use > 0) 2775 return -EBUSY; 2776 2777 use = chain->use; 2778 list_for_each_entry(rule, &chain->rules, list) { 2779 if (!nft_is_active_next(net, rule)) 2780 continue; 2781 use--; 2782 2783 err = nft_delrule(&ctx, rule); 2784 if (err < 0) 2785 return err; 2786 } 2787 2788 /* There are rules and elements that are still holding references to us, 2789 * we cannot do a recursive removal in this case. 2790 */ 2791 if (use > 0) { 2792 NL_SET_BAD_ATTR(extack, attr); 2793 return -EBUSY; 2794 } 2795 2796 return nft_delchain(&ctx); 2797 } 2798 2799 /* 2800 * Expressions 2801 */ 2802 2803 /** 2804 * nft_register_expr - register nf_tables expr type 2805 * @type: expr type 2806 * 2807 * Registers the expr type for use with nf_tables. Returns zero on 2808 * success or a negative errno code otherwise. 2809 */ 2810 int nft_register_expr(struct nft_expr_type *type) 2811 { 2812 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2813 if (type->family == NFPROTO_UNSPEC) 2814 list_add_tail_rcu(&type->list, &nf_tables_expressions); 2815 else 2816 list_add_rcu(&type->list, &nf_tables_expressions); 2817 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2818 return 0; 2819 } 2820 EXPORT_SYMBOL_GPL(nft_register_expr); 2821 2822 /** 2823 * nft_unregister_expr - unregister nf_tables expr type 2824 * @type: expr type 2825 * 2826 * Unregisters the expr typefor use with nf_tables. 2827 */ 2828 void nft_unregister_expr(struct nft_expr_type *type) 2829 { 2830 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2831 list_del_rcu(&type->list); 2832 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2833 } 2834 EXPORT_SYMBOL_GPL(nft_unregister_expr); 2835 2836 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 2837 struct nlattr *nla) 2838 { 2839 const struct nft_expr_type *type, *candidate = NULL; 2840 2841 list_for_each_entry(type, &nf_tables_expressions, list) { 2842 if (!nla_strcmp(nla, type->name)) { 2843 if (!type->family && !candidate) 2844 candidate = type; 2845 else if (type->family == family) 2846 candidate = type; 2847 } 2848 } 2849 return candidate; 2850 } 2851 2852 #ifdef CONFIG_MODULES 2853 static int nft_expr_type_request_module(struct net *net, u8 family, 2854 struct nlattr *nla) 2855 { 2856 if (nft_request_module(net, "nft-expr-%u-%.*s", family, 2857 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN) 2858 return -EAGAIN; 2859 2860 return 0; 2861 } 2862 #endif 2863 2864 static const struct nft_expr_type *nft_expr_type_get(struct net *net, 2865 u8 family, 2866 struct nlattr *nla) 2867 { 2868 const struct nft_expr_type *type; 2869 2870 if (nla == NULL) 2871 return ERR_PTR(-EINVAL); 2872 2873 type = __nft_expr_type_get(family, nla); 2874 if (type != NULL && try_module_get(type->owner)) 2875 return type; 2876 2877 lockdep_nfnl_nft_mutex_not_held(); 2878 #ifdef CONFIG_MODULES 2879 if (type == NULL) { 2880 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN) 2881 return ERR_PTR(-EAGAIN); 2882 2883 if (nft_request_module(net, "nft-expr-%.*s", 2884 nla_len(nla), 2885 (char *)nla_data(nla)) == -EAGAIN) 2886 return ERR_PTR(-EAGAIN); 2887 } 2888 #endif 2889 return ERR_PTR(-ENOENT); 2890 } 2891 2892 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 2893 [NFTA_EXPR_NAME] = { .type = NLA_STRING, 2894 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 2895 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 2896 }; 2897 2898 static int nf_tables_fill_expr_info(struct sk_buff *skb, 2899 const struct nft_expr *expr, bool reset) 2900 { 2901 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 2902 goto nla_put_failure; 2903 2904 if (expr->ops->dump) { 2905 struct nlattr *data = nla_nest_start_noflag(skb, 2906 NFTA_EXPR_DATA); 2907 if (data == NULL) 2908 goto nla_put_failure; 2909 if (expr->ops->dump(skb, expr, reset) < 0) 2910 goto nla_put_failure; 2911 nla_nest_end(skb, data); 2912 } 2913 2914 return skb->len; 2915 2916 nla_put_failure: 2917 return -1; 2918 }; 2919 2920 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 2921 const struct nft_expr *expr, bool reset) 2922 { 2923 struct nlattr *nest; 2924 2925 nest = nla_nest_start_noflag(skb, attr); 2926 if (!nest) 2927 goto nla_put_failure; 2928 if (nf_tables_fill_expr_info(skb, expr, reset) < 0) 2929 goto nla_put_failure; 2930 nla_nest_end(skb, nest); 2931 return 0; 2932 2933 nla_put_failure: 2934 return -1; 2935 } 2936 2937 struct nft_expr_info { 2938 const struct nft_expr_ops *ops; 2939 const struct nlattr *attr; 2940 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 2941 }; 2942 2943 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 2944 const struct nlattr *nla, 2945 struct nft_expr_info *info) 2946 { 2947 const struct nft_expr_type *type; 2948 const struct nft_expr_ops *ops; 2949 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 2950 int err; 2951 2952 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 2953 nft_expr_policy, NULL); 2954 if (err < 0) 2955 return err; 2956 2957 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]); 2958 if (IS_ERR(type)) 2959 return PTR_ERR(type); 2960 2961 if (tb[NFTA_EXPR_DATA]) { 2962 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 2963 tb[NFTA_EXPR_DATA], 2964 type->policy, NULL); 2965 if (err < 0) 2966 goto err1; 2967 } else 2968 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 2969 2970 if (type->select_ops != NULL) { 2971 ops = type->select_ops(ctx, 2972 (const struct nlattr * const *)info->tb); 2973 if (IS_ERR(ops)) { 2974 err = PTR_ERR(ops); 2975 #ifdef CONFIG_MODULES 2976 if (err == -EAGAIN) 2977 if (nft_expr_type_request_module(ctx->net, 2978 ctx->family, 2979 tb[NFTA_EXPR_NAME]) != -EAGAIN) 2980 err = -ENOENT; 2981 #endif 2982 goto err1; 2983 } 2984 } else 2985 ops = type->ops; 2986 2987 info->attr = nla; 2988 info->ops = ops; 2989 2990 return 0; 2991 2992 err1: 2993 module_put(type->owner); 2994 return err; 2995 } 2996 2997 int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, 2998 struct nft_expr_info *info) 2999 { 3000 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3001 const struct nft_expr_type *type; 3002 int err; 3003 3004 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3005 nft_expr_policy, NULL); 3006 if (err < 0) 3007 return err; 3008 3009 if (!tb[NFTA_EXPR_DATA]) 3010 return -EINVAL; 3011 3012 type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); 3013 if (!type) 3014 return -ENOENT; 3015 3016 if (!type->inner_ops) 3017 return -EOPNOTSUPP; 3018 3019 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3020 tb[NFTA_EXPR_DATA], 3021 type->policy, NULL); 3022 if (err < 0) 3023 goto err_nla_parse; 3024 3025 info->attr = nla; 3026 info->ops = type->inner_ops; 3027 3028 return 0; 3029 3030 err_nla_parse: 3031 return err; 3032 } 3033 3034 static int nf_tables_newexpr(const struct nft_ctx *ctx, 3035 const struct nft_expr_info *expr_info, 3036 struct nft_expr *expr) 3037 { 3038 const struct nft_expr_ops *ops = expr_info->ops; 3039 int err; 3040 3041 expr->ops = ops; 3042 if (ops->init) { 3043 err = ops->init(ctx, expr, (const struct nlattr **)expr_info->tb); 3044 if (err < 0) 3045 goto err1; 3046 } 3047 3048 return 0; 3049 err1: 3050 expr->ops = NULL; 3051 return err; 3052 } 3053 3054 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 3055 struct nft_expr *expr) 3056 { 3057 const struct nft_expr_type *type = expr->ops->type; 3058 3059 if (expr->ops->destroy) 3060 expr->ops->destroy(ctx, expr); 3061 module_put(type->owner); 3062 } 3063 3064 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 3065 const struct nlattr *nla) 3066 { 3067 struct nft_expr_info expr_info; 3068 struct nft_expr *expr; 3069 struct module *owner; 3070 int err; 3071 3072 err = nf_tables_expr_parse(ctx, nla, &expr_info); 3073 if (err < 0) 3074 goto err_expr_parse; 3075 3076 err = -EOPNOTSUPP; 3077 if (!(expr_info.ops->type->flags & NFT_EXPR_STATEFUL)) 3078 goto err_expr_stateful; 3079 3080 err = -ENOMEM; 3081 expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT); 3082 if (expr == NULL) 3083 goto err_expr_stateful; 3084 3085 err = nf_tables_newexpr(ctx, &expr_info, expr); 3086 if (err < 0) 3087 goto err_expr_new; 3088 3089 return expr; 3090 err_expr_new: 3091 kfree(expr); 3092 err_expr_stateful: 3093 owner = expr_info.ops->type->owner; 3094 if (expr_info.ops->type->release_ops) 3095 expr_info.ops->type->release_ops(expr_info.ops); 3096 3097 module_put(owner); 3098 err_expr_parse: 3099 return ERR_PTR(err); 3100 } 3101 3102 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) 3103 { 3104 int err; 3105 3106 if (src->ops->clone) { 3107 dst->ops = src->ops; 3108 err = src->ops->clone(dst, src); 3109 if (err < 0) 3110 return err; 3111 } else { 3112 memcpy(dst, src, src->ops->size); 3113 } 3114 3115 __module_get(src->ops->type->owner); 3116 3117 return 0; 3118 } 3119 3120 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 3121 { 3122 nf_tables_expr_destroy(ctx, expr); 3123 kfree(expr); 3124 } 3125 3126 /* 3127 * Rules 3128 */ 3129 3130 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain, 3131 u64 handle) 3132 { 3133 struct nft_rule *rule; 3134 3135 // FIXME: this sucks 3136 list_for_each_entry_rcu(rule, &chain->rules, list) { 3137 if (handle == rule->handle) 3138 return rule; 3139 } 3140 3141 return ERR_PTR(-ENOENT); 3142 } 3143 3144 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain, 3145 const struct nlattr *nla) 3146 { 3147 if (nla == NULL) 3148 return ERR_PTR(-EINVAL); 3149 3150 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla))); 3151 } 3152 3153 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 3154 [NFTA_RULE_TABLE] = { .type = NLA_STRING, 3155 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3156 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 3157 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 3158 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 3159 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED }, 3160 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 3161 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 3162 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 3163 .len = NFT_USERDATA_MAXLEN }, 3164 [NFTA_RULE_ID] = { .type = NLA_U32 }, 3165 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 }, 3166 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 }, 3167 }; 3168 3169 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 3170 u32 portid, u32 seq, int event, 3171 u32 flags, int family, 3172 const struct nft_table *table, 3173 const struct nft_chain *chain, 3174 const struct nft_rule *rule, u64 handle, 3175 bool reset) 3176 { 3177 struct nlmsghdr *nlh; 3178 const struct nft_expr *expr, *next; 3179 struct nlattr *list; 3180 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 3181 3182 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, 3183 nft_base_seq(net)); 3184 if (!nlh) 3185 goto nla_put_failure; 3186 3187 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 3188 goto nla_put_failure; 3189 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 3190 goto nla_put_failure; 3191 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle), 3192 NFTA_RULE_PAD)) 3193 goto nla_put_failure; 3194 3195 if (event != NFT_MSG_DELRULE && handle) { 3196 if (nla_put_be64(skb, NFTA_RULE_POSITION, cpu_to_be64(handle), 3197 NFTA_RULE_PAD)) 3198 goto nla_put_failure; 3199 } 3200 3201 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 3202 nft_flow_rule_stats(chain, rule); 3203 3204 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS); 3205 if (list == NULL) 3206 goto nla_put_failure; 3207 nft_rule_for_each_expr(expr, next, rule) { 3208 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 3209 goto nla_put_failure; 3210 } 3211 nla_nest_end(skb, list); 3212 3213 if (rule->udata) { 3214 struct nft_userdata *udata = nft_userdata(rule); 3215 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 3216 udata->data) < 0) 3217 goto nla_put_failure; 3218 } 3219 3220 nlmsg_end(skb, nlh); 3221 return 0; 3222 3223 nla_put_failure: 3224 nlmsg_trim(skb, nlh); 3225 return -1; 3226 } 3227 3228 static void nf_tables_rule_notify(const struct nft_ctx *ctx, 3229 const struct nft_rule *rule, int event) 3230 { 3231 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3232 const struct nft_rule *prule; 3233 struct sk_buff *skb; 3234 u64 handle = 0; 3235 u16 flags = 0; 3236 int err; 3237 3238 if (!ctx->report && 3239 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 3240 return; 3241 3242 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3243 if (skb == NULL) 3244 goto err; 3245 3246 if (event == NFT_MSG_NEWRULE && 3247 !list_is_first(&rule->list, &ctx->chain->rules) && 3248 !list_is_last(&rule->list, &ctx->chain->rules)) { 3249 prule = list_prev_entry(rule, list); 3250 handle = prule->handle; 3251 } 3252 if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) 3253 flags |= NLM_F_APPEND; 3254 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 3255 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 3256 3257 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 3258 event, flags, ctx->family, ctx->table, 3259 ctx->chain, rule, handle, false); 3260 if (err < 0) { 3261 kfree_skb(skb); 3262 goto err; 3263 } 3264 3265 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 3266 return; 3267 err: 3268 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 3269 } 3270 3271 struct nft_rule_dump_ctx { 3272 char *table; 3273 char *chain; 3274 }; 3275 3276 static int __nf_tables_dump_rules(struct sk_buff *skb, 3277 unsigned int *idx, 3278 struct netlink_callback *cb, 3279 const struct nft_table *table, 3280 const struct nft_chain *chain, 3281 bool reset) 3282 { 3283 struct net *net = sock_net(skb->sk); 3284 const struct nft_rule *rule, *prule; 3285 unsigned int s_idx = cb->args[0]; 3286 u64 handle; 3287 3288 prule = NULL; 3289 list_for_each_entry_rcu(rule, &chain->rules, list) { 3290 if (!nft_is_active(net, rule)) 3291 goto cont_skip; 3292 if (*idx < s_idx) 3293 goto cont; 3294 if (*idx > s_idx) { 3295 memset(&cb->args[1], 0, 3296 sizeof(cb->args) - sizeof(cb->args[0])); 3297 } 3298 if (prule) 3299 handle = prule->handle; 3300 else 3301 handle = 0; 3302 3303 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 3304 cb->nlh->nlmsg_seq, 3305 NFT_MSG_NEWRULE, 3306 NLM_F_MULTI | NLM_F_APPEND, 3307 table->family, 3308 table, chain, rule, handle, reset) < 0) 3309 return 1; 3310 3311 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 3312 cont: 3313 prule = rule; 3314 cont_skip: 3315 (*idx)++; 3316 } 3317 return 0; 3318 } 3319 3320 static int nf_tables_dump_rules(struct sk_buff *skb, 3321 struct netlink_callback *cb) 3322 { 3323 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3324 const struct nft_rule_dump_ctx *ctx = cb->data; 3325 struct nft_table *table; 3326 const struct nft_chain *chain; 3327 unsigned int idx = 0; 3328 struct net *net = sock_net(skb->sk); 3329 int family = nfmsg->nfgen_family; 3330 struct nftables_pernet *nft_net; 3331 bool reset = false; 3332 3333 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3334 reset = true; 3335 3336 rcu_read_lock(); 3337 nft_net = nft_pernet(net); 3338 cb->seq = READ_ONCE(nft_net->base_seq); 3339 3340 list_for_each_entry_rcu(table, &nft_net->tables, list) { 3341 if (family != NFPROTO_UNSPEC && family != table->family) 3342 continue; 3343 3344 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0) 3345 continue; 3346 3347 if (ctx && ctx->table && ctx->chain) { 3348 struct rhlist_head *list, *tmp; 3349 3350 list = rhltable_lookup(&table->chains_ht, ctx->chain, 3351 nft_chain_ht_params); 3352 if (!list) 3353 goto done; 3354 3355 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 3356 if (!nft_is_active(net, chain)) 3357 continue; 3358 __nf_tables_dump_rules(skb, &idx, 3359 cb, table, chain, reset); 3360 break; 3361 } 3362 goto done; 3363 } 3364 3365 list_for_each_entry_rcu(chain, &table->chains, list) { 3366 if (__nf_tables_dump_rules(skb, &idx, 3367 cb, table, chain, reset)) 3368 goto done; 3369 } 3370 3371 if (ctx && ctx->table) 3372 break; 3373 } 3374 done: 3375 rcu_read_unlock(); 3376 3377 cb->args[0] = idx; 3378 return skb->len; 3379 } 3380 3381 static int nf_tables_dump_rules_start(struct netlink_callback *cb) 3382 { 3383 const struct nlattr * const *nla = cb->data; 3384 struct nft_rule_dump_ctx *ctx = NULL; 3385 3386 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) { 3387 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC); 3388 if (!ctx) 3389 return -ENOMEM; 3390 3391 if (nla[NFTA_RULE_TABLE]) { 3392 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE], 3393 GFP_ATOMIC); 3394 if (!ctx->table) { 3395 kfree(ctx); 3396 return -ENOMEM; 3397 } 3398 } 3399 if (nla[NFTA_RULE_CHAIN]) { 3400 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN], 3401 GFP_ATOMIC); 3402 if (!ctx->chain) { 3403 kfree(ctx->table); 3404 kfree(ctx); 3405 return -ENOMEM; 3406 } 3407 } 3408 } 3409 3410 cb->data = ctx; 3411 return 0; 3412 } 3413 3414 static int nf_tables_dump_rules_done(struct netlink_callback *cb) 3415 { 3416 struct nft_rule_dump_ctx *ctx = cb->data; 3417 3418 if (ctx) { 3419 kfree(ctx->table); 3420 kfree(ctx->chain); 3421 kfree(ctx); 3422 } 3423 return 0; 3424 } 3425 3426 /* called with rcu_read_lock held */ 3427 static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, 3428 const struct nlattr * const nla[]) 3429 { 3430 struct netlink_ext_ack *extack = info->extack; 3431 u8 genmask = nft_genmask_cur(info->net); 3432 u8 family = info->nfmsg->nfgen_family; 3433 const struct nft_chain *chain; 3434 const struct nft_rule *rule; 3435 struct net *net = info->net; 3436 struct nft_table *table; 3437 struct sk_buff *skb2; 3438 bool reset = false; 3439 int err; 3440 3441 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3442 struct netlink_dump_control c = { 3443 .start= nf_tables_dump_rules_start, 3444 .dump = nf_tables_dump_rules, 3445 .done = nf_tables_dump_rules_done, 3446 .module = THIS_MODULE, 3447 .data = (void *)nla, 3448 }; 3449 3450 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 3451 } 3452 3453 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0); 3454 if (IS_ERR(table)) { 3455 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3456 return PTR_ERR(table); 3457 } 3458 3459 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask); 3460 if (IS_ERR(chain)) { 3461 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3462 return PTR_ERR(chain); 3463 } 3464 3465 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 3466 if (IS_ERR(rule)) { 3467 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3468 return PTR_ERR(rule); 3469 } 3470 3471 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 3472 if (!skb2) 3473 return -ENOMEM; 3474 3475 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3476 reset = true; 3477 3478 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid, 3479 info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 3480 family, table, chain, rule, 0, reset); 3481 if (err < 0) 3482 goto err_fill_rule_info; 3483 3484 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 3485 3486 err_fill_rule_info: 3487 kfree_skb(skb2); 3488 return err; 3489 } 3490 3491 static void nf_tables_rule_destroy(const struct nft_ctx *ctx, 3492 struct nft_rule *rule) 3493 { 3494 struct nft_expr *expr, *next; 3495 3496 /* 3497 * Careful: some expressions might not be initialized in case this 3498 * is called on error from nf_tables_newrule(). 3499 */ 3500 expr = nft_expr_first(rule); 3501 while (nft_expr_more(rule, expr)) { 3502 next = nft_expr_next(expr); 3503 nf_tables_expr_destroy(ctx, expr); 3504 expr = next; 3505 } 3506 kfree(rule); 3507 } 3508 3509 void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) 3510 { 3511 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); 3512 nf_tables_rule_destroy(ctx, rule); 3513 } 3514 3515 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) 3516 { 3517 struct nft_expr *expr, *last; 3518 const struct nft_data *data; 3519 struct nft_rule *rule; 3520 int err; 3521 3522 if (ctx->level == NFT_JUMP_STACK_SIZE) 3523 return -EMLINK; 3524 3525 list_for_each_entry(rule, &chain->rules, list) { 3526 if (!nft_is_active_next(ctx->net, rule)) 3527 continue; 3528 3529 nft_rule_for_each_expr(expr, last, rule) { 3530 if (!expr->ops->validate) 3531 continue; 3532 3533 err = expr->ops->validate(ctx, expr, &data); 3534 if (err < 0) 3535 return err; 3536 } 3537 3538 cond_resched(); 3539 } 3540 3541 return 0; 3542 } 3543 EXPORT_SYMBOL_GPL(nft_chain_validate); 3544 3545 static int nft_table_validate(struct net *net, const struct nft_table *table) 3546 { 3547 struct nft_chain *chain; 3548 struct nft_ctx ctx = { 3549 .net = net, 3550 .family = table->family, 3551 }; 3552 int err; 3553 3554 list_for_each_entry(chain, &table->chains, list) { 3555 if (!nft_is_base_chain(chain)) 3556 continue; 3557 3558 ctx.chain = chain; 3559 err = nft_chain_validate(&ctx, chain); 3560 if (err < 0) 3561 return err; 3562 } 3563 3564 return 0; 3565 } 3566 3567 int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, 3568 const struct nft_set_iter *iter, 3569 struct nft_set_elem *elem) 3570 { 3571 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 3572 struct nft_ctx *pctx = (struct nft_ctx *)ctx; 3573 const struct nft_data *data; 3574 int err; 3575 3576 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 3577 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 3578 return 0; 3579 3580 data = nft_set_ext_data(ext); 3581 switch (data->verdict.code) { 3582 case NFT_JUMP: 3583 case NFT_GOTO: 3584 pctx->level++; 3585 err = nft_chain_validate(ctx, data->verdict.chain); 3586 if (err < 0) 3587 return err; 3588 pctx->level--; 3589 break; 3590 default: 3591 break; 3592 } 3593 3594 return 0; 3595 } 3596 3597 struct nft_set_elem_catchall { 3598 struct list_head list; 3599 struct rcu_head rcu; 3600 void *elem; 3601 }; 3602 3603 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set) 3604 { 3605 u8 genmask = nft_genmask_next(ctx->net); 3606 struct nft_set_elem_catchall *catchall; 3607 struct nft_set_elem elem; 3608 struct nft_set_ext *ext; 3609 int ret = 0; 3610 3611 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 3612 ext = nft_set_elem_ext(set, catchall->elem); 3613 if (!nft_set_elem_active(ext, genmask)) 3614 continue; 3615 3616 elem.priv = catchall->elem; 3617 ret = nft_setelem_validate(ctx, set, NULL, &elem); 3618 if (ret < 0) 3619 return ret; 3620 } 3621 3622 return ret; 3623 } 3624 3625 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 3626 const struct nft_chain *chain, 3627 const struct nlattr *nla); 3628 3629 #define NFT_RULE_MAXEXPRS 128 3630 3631 static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 3632 const struct nlattr * const nla[]) 3633 { 3634 struct nftables_pernet *nft_net = nft_pernet(info->net); 3635 struct netlink_ext_ack *extack = info->extack; 3636 unsigned int size, i, n, ulen = 0, usize = 0; 3637 u8 genmask = nft_genmask_next(info->net); 3638 struct nft_rule *rule, *old_rule = NULL; 3639 struct nft_expr_info *expr_info = NULL; 3640 u8 family = info->nfmsg->nfgen_family; 3641 struct nft_flow_rule *flow = NULL; 3642 struct net *net = info->net; 3643 struct nft_userdata *udata; 3644 struct nft_table *table; 3645 struct nft_chain *chain; 3646 struct nft_trans *trans; 3647 u64 handle, pos_handle; 3648 struct nft_expr *expr; 3649 struct nft_ctx ctx; 3650 struct nlattr *tmp; 3651 int err, rem; 3652 3653 lockdep_assert_held(&nft_net->commit_mutex); 3654 3655 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 3656 NETLINK_CB(skb).portid); 3657 if (IS_ERR(table)) { 3658 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3659 return PTR_ERR(table); 3660 } 3661 3662 if (nla[NFTA_RULE_CHAIN]) { 3663 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 3664 genmask); 3665 if (IS_ERR(chain)) { 3666 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3667 return PTR_ERR(chain); 3668 } 3669 if (nft_chain_is_bound(chain)) 3670 return -EOPNOTSUPP; 3671 3672 } else if (nla[NFTA_RULE_CHAIN_ID]) { 3673 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID]); 3674 if (IS_ERR(chain)) { 3675 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]); 3676 return PTR_ERR(chain); 3677 } 3678 } else { 3679 return -EINVAL; 3680 } 3681 3682 if (nla[NFTA_RULE_HANDLE]) { 3683 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 3684 rule = __nft_rule_lookup(chain, handle); 3685 if (IS_ERR(rule)) { 3686 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3687 return PTR_ERR(rule); 3688 } 3689 3690 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 3691 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3692 return -EEXIST; 3693 } 3694 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 3695 old_rule = rule; 3696 else 3697 return -EOPNOTSUPP; 3698 } else { 3699 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE) || 3700 info->nlh->nlmsg_flags & NLM_F_REPLACE) 3701 return -EINVAL; 3702 handle = nf_tables_alloc_handle(table); 3703 3704 if (chain->use == UINT_MAX) 3705 return -EOVERFLOW; 3706 3707 if (nla[NFTA_RULE_POSITION]) { 3708 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 3709 old_rule = __nft_rule_lookup(chain, pos_handle); 3710 if (IS_ERR(old_rule)) { 3711 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); 3712 return PTR_ERR(old_rule); 3713 } 3714 } else if (nla[NFTA_RULE_POSITION_ID]) { 3715 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]); 3716 if (IS_ERR(old_rule)) { 3717 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); 3718 return PTR_ERR(old_rule); 3719 } 3720 } 3721 } 3722 3723 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3724 3725 n = 0; 3726 size = 0; 3727 if (nla[NFTA_RULE_EXPRESSIONS]) { 3728 expr_info = kvmalloc_array(NFT_RULE_MAXEXPRS, 3729 sizeof(struct nft_expr_info), 3730 GFP_KERNEL); 3731 if (!expr_info) 3732 return -ENOMEM; 3733 3734 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 3735 err = -EINVAL; 3736 if (nla_type(tmp) != NFTA_LIST_ELEM) 3737 goto err_release_expr; 3738 if (n == NFT_RULE_MAXEXPRS) 3739 goto err_release_expr; 3740 err = nf_tables_expr_parse(&ctx, tmp, &expr_info[n]); 3741 if (err < 0) { 3742 NL_SET_BAD_ATTR(extack, tmp); 3743 goto err_release_expr; 3744 } 3745 size += expr_info[n].ops->size; 3746 n++; 3747 } 3748 } 3749 /* Check for overflow of dlen field */ 3750 err = -EFBIG; 3751 if (size >= 1 << 12) 3752 goto err_release_expr; 3753 3754 if (nla[NFTA_RULE_USERDATA]) { 3755 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 3756 if (ulen > 0) 3757 usize = sizeof(struct nft_userdata) + ulen; 3758 } 3759 3760 err = -ENOMEM; 3761 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT); 3762 if (rule == NULL) 3763 goto err_release_expr; 3764 3765 nft_activate_next(net, rule); 3766 3767 rule->handle = handle; 3768 rule->dlen = size; 3769 rule->udata = ulen ? 1 : 0; 3770 3771 if (ulen) { 3772 udata = nft_userdata(rule); 3773 udata->len = ulen - 1; 3774 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 3775 } 3776 3777 expr = nft_expr_first(rule); 3778 for (i = 0; i < n; i++) { 3779 err = nf_tables_newexpr(&ctx, &expr_info[i], expr); 3780 if (err < 0) { 3781 NL_SET_BAD_ATTR(extack, expr_info[i].attr); 3782 goto err_release_rule; 3783 } 3784 3785 if (expr_info[i].ops->validate) 3786 nft_validate_state_update(table, NFT_VALIDATE_NEED); 3787 3788 expr_info[i].ops = NULL; 3789 expr = nft_expr_next(expr); 3790 } 3791 3792 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { 3793 flow = nft_flow_rule_create(net, rule); 3794 if (IS_ERR(flow)) { 3795 err = PTR_ERR(flow); 3796 goto err_release_rule; 3797 } 3798 } 3799 3800 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) { 3801 err = nft_delrule(&ctx, old_rule); 3802 if (err < 0) 3803 goto err_destroy_flow_rule; 3804 3805 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 3806 if (trans == NULL) { 3807 err = -ENOMEM; 3808 goto err_destroy_flow_rule; 3809 } 3810 list_add_tail_rcu(&rule->list, &old_rule->list); 3811 } else { 3812 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 3813 if (!trans) { 3814 err = -ENOMEM; 3815 goto err_destroy_flow_rule; 3816 } 3817 3818 if (info->nlh->nlmsg_flags & NLM_F_APPEND) { 3819 if (old_rule) 3820 list_add_rcu(&rule->list, &old_rule->list); 3821 else 3822 list_add_tail_rcu(&rule->list, &chain->rules); 3823 } else { 3824 if (old_rule) 3825 list_add_tail_rcu(&rule->list, &old_rule->list); 3826 else 3827 list_add_rcu(&rule->list, &chain->rules); 3828 } 3829 } 3830 kvfree(expr_info); 3831 chain->use++; 3832 3833 if (flow) 3834 nft_trans_flow_rule(trans) = flow; 3835 3836 if (table->validate_state == NFT_VALIDATE_DO) 3837 return nft_table_validate(net, table); 3838 3839 return 0; 3840 3841 err_destroy_flow_rule: 3842 if (flow) 3843 nft_flow_rule_destroy(flow); 3844 err_release_rule: 3845 nf_tables_rule_release(&ctx, rule); 3846 err_release_expr: 3847 for (i = 0; i < n; i++) { 3848 if (expr_info[i].ops) { 3849 module_put(expr_info[i].ops->type->owner); 3850 if (expr_info[i].ops->type->release_ops) 3851 expr_info[i].ops->type->release_ops(expr_info[i].ops); 3852 } 3853 } 3854 kvfree(expr_info); 3855 3856 return err; 3857 } 3858 3859 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 3860 const struct nft_chain *chain, 3861 const struct nlattr *nla) 3862 { 3863 struct nftables_pernet *nft_net = nft_pernet(net); 3864 u32 id = ntohl(nla_get_be32(nla)); 3865 struct nft_trans *trans; 3866 3867 list_for_each_entry(trans, &nft_net->commit_list, list) { 3868 if (trans->msg_type == NFT_MSG_NEWRULE && 3869 trans->ctx.chain == chain && 3870 id == nft_trans_rule_id(trans)) 3871 return nft_trans_rule(trans); 3872 } 3873 return ERR_PTR(-ENOENT); 3874 } 3875 3876 static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 3877 const struct nlattr * const nla[]) 3878 { 3879 struct netlink_ext_ack *extack = info->extack; 3880 u8 genmask = nft_genmask_next(info->net); 3881 u8 family = info->nfmsg->nfgen_family; 3882 struct nft_chain *chain = NULL; 3883 struct net *net = info->net; 3884 struct nft_table *table; 3885 struct nft_rule *rule; 3886 struct nft_ctx ctx; 3887 int err = 0; 3888 3889 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 3890 NETLINK_CB(skb).portid); 3891 if (IS_ERR(table)) { 3892 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3893 return PTR_ERR(table); 3894 } 3895 3896 if (nla[NFTA_RULE_CHAIN]) { 3897 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 3898 genmask); 3899 if (IS_ERR(chain)) { 3900 if (PTR_ERR(chain) == -ENOENT && 3901 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 3902 return 0; 3903 3904 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3905 return PTR_ERR(chain); 3906 } 3907 if (nft_chain_is_bound(chain)) 3908 return -EOPNOTSUPP; 3909 } 3910 3911 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3912 3913 if (chain) { 3914 if (nla[NFTA_RULE_HANDLE]) { 3915 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 3916 if (IS_ERR(rule)) { 3917 if (PTR_ERR(rule) == -ENOENT && 3918 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 3919 return 0; 3920 3921 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3922 return PTR_ERR(rule); 3923 } 3924 3925 err = nft_delrule(&ctx, rule); 3926 } else if (nla[NFTA_RULE_ID]) { 3927 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); 3928 if (IS_ERR(rule)) { 3929 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); 3930 return PTR_ERR(rule); 3931 } 3932 3933 err = nft_delrule(&ctx, rule); 3934 } else { 3935 err = nft_delrule_by_chain(&ctx); 3936 } 3937 } else { 3938 list_for_each_entry(chain, &table->chains, list) { 3939 if (!nft_is_active_next(net, chain)) 3940 continue; 3941 3942 ctx.chain = chain; 3943 err = nft_delrule_by_chain(&ctx); 3944 if (err < 0) 3945 break; 3946 } 3947 } 3948 3949 return err; 3950 } 3951 3952 /* 3953 * Sets 3954 */ 3955 static const struct nft_set_type *nft_set_types[] = { 3956 &nft_set_hash_fast_type, 3957 &nft_set_hash_type, 3958 &nft_set_rhash_type, 3959 &nft_set_bitmap_type, 3960 &nft_set_rbtree_type, 3961 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML) 3962 &nft_set_pipapo_avx2_type, 3963 #endif 3964 &nft_set_pipapo_type, 3965 }; 3966 3967 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ 3968 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \ 3969 NFT_SET_EVAL) 3970 3971 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags) 3972 { 3973 return (flags & type->features) == (flags & NFT_SET_FEATURES); 3974 } 3975 3976 /* 3977 * Select a set implementation based on the data characteristics and the 3978 * given policy. The total memory use might not be known if no size is 3979 * given, in that case the amount of memory per element is used. 3980 */ 3981 static const struct nft_set_ops * 3982 nft_select_set_ops(const struct nft_ctx *ctx, 3983 const struct nlattr * const nla[], 3984 const struct nft_set_desc *desc) 3985 { 3986 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3987 const struct nft_set_ops *ops, *bops; 3988 struct nft_set_estimate est, best; 3989 const struct nft_set_type *type; 3990 u32 flags = 0; 3991 int i; 3992 3993 lockdep_assert_held(&nft_net->commit_mutex); 3994 lockdep_nfnl_nft_mutex_not_held(); 3995 3996 if (nla[NFTA_SET_FLAGS] != NULL) 3997 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 3998 3999 bops = NULL; 4000 best.size = ~0; 4001 best.lookup = ~0; 4002 best.space = ~0; 4003 4004 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) { 4005 type = nft_set_types[i]; 4006 ops = &type->ops; 4007 4008 if (!nft_set_ops_candidate(type, flags)) 4009 continue; 4010 if (!ops->estimate(desc, flags, &est)) 4011 continue; 4012 4013 switch (desc->policy) { 4014 case NFT_SET_POL_PERFORMANCE: 4015 if (est.lookup < best.lookup) 4016 break; 4017 if (est.lookup == best.lookup && 4018 est.space < best.space) 4019 break; 4020 continue; 4021 case NFT_SET_POL_MEMORY: 4022 if (!desc->size) { 4023 if (est.space < best.space) 4024 break; 4025 if (est.space == best.space && 4026 est.lookup < best.lookup) 4027 break; 4028 } else if (est.size < best.size || !bops) { 4029 break; 4030 } 4031 continue; 4032 default: 4033 break; 4034 } 4035 4036 bops = ops; 4037 best = est; 4038 } 4039 4040 if (bops != NULL) 4041 return bops; 4042 4043 return ERR_PTR(-EOPNOTSUPP); 4044 } 4045 4046 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 4047 [NFTA_SET_TABLE] = { .type = NLA_STRING, 4048 .len = NFT_TABLE_MAXNAMELEN - 1 }, 4049 [NFTA_SET_NAME] = { .type = NLA_STRING, 4050 .len = NFT_SET_MAXNAMELEN - 1 }, 4051 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 4052 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 4053 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 4054 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 4055 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 4056 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 4057 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 4058 [NFTA_SET_ID] = { .type = NLA_U32 }, 4059 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 4060 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 4061 [NFTA_SET_USERDATA] = { .type = NLA_BINARY, 4062 .len = NFT_USERDATA_MAXLEN }, 4063 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, 4064 [NFTA_SET_HANDLE] = { .type = NLA_U64 }, 4065 [NFTA_SET_EXPR] = { .type = NLA_NESTED }, 4066 [NFTA_SET_EXPRESSIONS] = { .type = NLA_NESTED }, 4067 }; 4068 4069 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 4070 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 4071 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED }, 4072 }; 4073 4074 static struct nft_set *nft_set_lookup(const struct nft_table *table, 4075 const struct nlattr *nla, u8 genmask) 4076 { 4077 struct nft_set *set; 4078 4079 if (nla == NULL) 4080 return ERR_PTR(-EINVAL); 4081 4082 list_for_each_entry_rcu(set, &table->sets, list) { 4083 if (!nla_strcmp(nla, set->name) && 4084 nft_active_genmask(set, genmask)) 4085 return set; 4086 } 4087 return ERR_PTR(-ENOENT); 4088 } 4089 4090 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, 4091 const struct nlattr *nla, 4092 u8 genmask) 4093 { 4094 struct nft_set *set; 4095 4096 list_for_each_entry(set, &table->sets, list) { 4097 if (be64_to_cpu(nla_get_be64(nla)) == set->handle && 4098 nft_active_genmask(set, genmask)) 4099 return set; 4100 } 4101 return ERR_PTR(-ENOENT); 4102 } 4103 4104 static struct nft_set *nft_set_lookup_byid(const struct net *net, 4105 const struct nft_table *table, 4106 const struct nlattr *nla, u8 genmask) 4107 { 4108 struct nftables_pernet *nft_net = nft_pernet(net); 4109 u32 id = ntohl(nla_get_be32(nla)); 4110 struct nft_trans *trans; 4111 4112 list_for_each_entry(trans, &nft_net->commit_list, list) { 4113 if (trans->msg_type == NFT_MSG_NEWSET) { 4114 struct nft_set *set = nft_trans_set(trans); 4115 4116 if (id == nft_trans_set_id(trans) && 4117 set->table == table && 4118 nft_active_genmask(set, genmask)) 4119 return set; 4120 } 4121 } 4122 return ERR_PTR(-ENOENT); 4123 } 4124 4125 struct nft_set *nft_set_lookup_global(const struct net *net, 4126 const struct nft_table *table, 4127 const struct nlattr *nla_set_name, 4128 const struct nlattr *nla_set_id, 4129 u8 genmask) 4130 { 4131 struct nft_set *set; 4132 4133 set = nft_set_lookup(table, nla_set_name, genmask); 4134 if (IS_ERR(set)) { 4135 if (!nla_set_id) 4136 return set; 4137 4138 set = nft_set_lookup_byid(net, table, nla_set_id, genmask); 4139 } 4140 return set; 4141 } 4142 EXPORT_SYMBOL_GPL(nft_set_lookup_global); 4143 4144 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 4145 const char *name) 4146 { 4147 const struct nft_set *i; 4148 const char *p; 4149 unsigned long *inuse; 4150 unsigned int n = 0, min = 0; 4151 4152 p = strchr(name, '%'); 4153 if (p != NULL) { 4154 if (p[1] != 'd' || strchr(p + 2, '%')) 4155 return -EINVAL; 4156 4157 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 4158 if (inuse == NULL) 4159 return -ENOMEM; 4160 cont: 4161 list_for_each_entry(i, &ctx->table->sets, list) { 4162 int tmp; 4163 4164 if (!nft_is_active_next(ctx->net, i)) 4165 continue; 4166 if (!sscanf(i->name, name, &tmp)) 4167 continue; 4168 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 4169 continue; 4170 4171 set_bit(tmp - min, inuse); 4172 } 4173 4174 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 4175 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 4176 min += BITS_PER_BYTE * PAGE_SIZE; 4177 memset(inuse, 0, PAGE_SIZE); 4178 goto cont; 4179 } 4180 free_page((unsigned long)inuse); 4181 } 4182 4183 set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n); 4184 if (!set->name) 4185 return -ENOMEM; 4186 4187 list_for_each_entry(i, &ctx->table->sets, list) { 4188 if (!nft_is_active_next(ctx->net, i)) 4189 continue; 4190 if (!strcmp(set->name, i->name)) { 4191 kfree(set->name); 4192 set->name = NULL; 4193 return -ENFILE; 4194 } 4195 } 4196 return 0; 4197 } 4198 4199 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) 4200 { 4201 u64 ms = be64_to_cpu(nla_get_be64(nla)); 4202 u64 max = (u64)(~((u64)0)); 4203 4204 max = div_u64(max, NSEC_PER_MSEC); 4205 if (ms >= max) 4206 return -ERANGE; 4207 4208 ms *= NSEC_PER_MSEC; 4209 *result = nsecs_to_jiffies64(ms); 4210 return 0; 4211 } 4212 4213 __be64 nf_jiffies64_to_msecs(u64 input) 4214 { 4215 return cpu_to_be64(jiffies64_to_msecs(input)); 4216 } 4217 4218 static int nf_tables_fill_set_concat(struct sk_buff *skb, 4219 const struct nft_set *set) 4220 { 4221 struct nlattr *concat, *field; 4222 int i; 4223 4224 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT); 4225 if (!concat) 4226 return -ENOMEM; 4227 4228 for (i = 0; i < set->field_count; i++) { 4229 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 4230 if (!field) 4231 return -ENOMEM; 4232 4233 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN, 4234 htonl(set->field_len[i]))) 4235 return -ENOMEM; 4236 4237 nla_nest_end(skb, field); 4238 } 4239 4240 nla_nest_end(skb, concat); 4241 4242 return 0; 4243 } 4244 4245 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 4246 const struct nft_set *set, u16 event, u16 flags) 4247 { 4248 u64 timeout = READ_ONCE(set->timeout); 4249 u32 gc_int = READ_ONCE(set->gc_int); 4250 u32 portid = ctx->portid; 4251 struct nlmsghdr *nlh; 4252 struct nlattr *nest; 4253 u32 seq = ctx->seq; 4254 int i; 4255 4256 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 4257 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 4258 NFNETLINK_V0, nft_base_seq(ctx->net)); 4259 if (!nlh) 4260 goto nla_put_failure; 4261 4262 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 4263 goto nla_put_failure; 4264 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 4265 goto nla_put_failure; 4266 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), 4267 NFTA_SET_PAD)) 4268 goto nla_put_failure; 4269 4270 if (event == NFT_MSG_DELSET) { 4271 nlmsg_end(skb, nlh); 4272 return 0; 4273 } 4274 4275 if (set->flags != 0) 4276 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 4277 goto nla_put_failure; 4278 4279 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 4280 goto nla_put_failure; 4281 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 4282 goto nla_put_failure; 4283 if (set->flags & NFT_SET_MAP) { 4284 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 4285 goto nla_put_failure; 4286 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 4287 goto nla_put_failure; 4288 } 4289 if (set->flags & NFT_SET_OBJECT && 4290 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype))) 4291 goto nla_put_failure; 4292 4293 if (timeout && 4294 nla_put_be64(skb, NFTA_SET_TIMEOUT, 4295 nf_jiffies64_to_msecs(timeout), 4296 NFTA_SET_PAD)) 4297 goto nla_put_failure; 4298 if (gc_int && 4299 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(gc_int))) 4300 goto nla_put_failure; 4301 4302 if (set->policy != NFT_SET_POL_PERFORMANCE) { 4303 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 4304 goto nla_put_failure; 4305 } 4306 4307 if (set->udata && 4308 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) 4309 goto nla_put_failure; 4310 4311 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC); 4312 if (!nest) 4313 goto nla_put_failure; 4314 if (set->size && 4315 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) 4316 goto nla_put_failure; 4317 4318 if (set->field_count > 1 && 4319 nf_tables_fill_set_concat(skb, set)) 4320 goto nla_put_failure; 4321 4322 nla_nest_end(skb, nest); 4323 4324 if (set->num_exprs == 1) { 4325 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR); 4326 if (nf_tables_fill_expr_info(skb, set->exprs[0], false) < 0) 4327 goto nla_put_failure; 4328 4329 nla_nest_end(skb, nest); 4330 } else if (set->num_exprs > 1) { 4331 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPRESSIONS); 4332 if (nest == NULL) 4333 goto nla_put_failure; 4334 4335 for (i = 0; i < set->num_exprs; i++) { 4336 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 4337 set->exprs[i], false) < 0) 4338 goto nla_put_failure; 4339 } 4340 nla_nest_end(skb, nest); 4341 } 4342 4343 nlmsg_end(skb, nlh); 4344 return 0; 4345 4346 nla_put_failure: 4347 nlmsg_trim(skb, nlh); 4348 return -1; 4349 } 4350 4351 static void nf_tables_set_notify(const struct nft_ctx *ctx, 4352 const struct nft_set *set, int event, 4353 gfp_t gfp_flags) 4354 { 4355 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4356 u32 portid = ctx->portid; 4357 struct sk_buff *skb; 4358 u16 flags = 0; 4359 int err; 4360 4361 if (!ctx->report && 4362 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 4363 return; 4364 4365 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 4366 if (skb == NULL) 4367 goto err; 4368 4369 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 4370 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 4371 4372 err = nf_tables_fill_set(skb, ctx, set, event, flags); 4373 if (err < 0) { 4374 kfree_skb(skb); 4375 goto err; 4376 } 4377 4378 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 4379 return; 4380 err: 4381 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 4382 } 4383 4384 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 4385 { 4386 const struct nft_set *set; 4387 unsigned int idx, s_idx = cb->args[0]; 4388 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 4389 struct net *net = sock_net(skb->sk); 4390 struct nft_ctx *ctx = cb->data, ctx_set; 4391 struct nftables_pernet *nft_net; 4392 4393 if (cb->args[1]) 4394 return skb->len; 4395 4396 rcu_read_lock(); 4397 nft_net = nft_pernet(net); 4398 cb->seq = READ_ONCE(nft_net->base_seq); 4399 4400 list_for_each_entry_rcu(table, &nft_net->tables, list) { 4401 if (ctx->family != NFPROTO_UNSPEC && 4402 ctx->family != table->family) 4403 continue; 4404 4405 if (ctx->table && ctx->table != table) 4406 continue; 4407 4408 if (cur_table) { 4409 if (cur_table != table) 4410 continue; 4411 4412 cur_table = NULL; 4413 } 4414 idx = 0; 4415 list_for_each_entry_rcu(set, &table->sets, list) { 4416 if (idx < s_idx) 4417 goto cont; 4418 if (!nft_is_active(net, set)) 4419 goto cont; 4420 4421 ctx_set = *ctx; 4422 ctx_set.table = table; 4423 ctx_set.family = table->family; 4424 4425 if (nf_tables_fill_set(skb, &ctx_set, set, 4426 NFT_MSG_NEWSET, 4427 NLM_F_MULTI) < 0) { 4428 cb->args[0] = idx; 4429 cb->args[2] = (unsigned long) table; 4430 goto done; 4431 } 4432 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 4433 cont: 4434 idx++; 4435 } 4436 if (s_idx) 4437 s_idx = 0; 4438 } 4439 cb->args[1] = 1; 4440 done: 4441 rcu_read_unlock(); 4442 return skb->len; 4443 } 4444 4445 static int nf_tables_dump_sets_start(struct netlink_callback *cb) 4446 { 4447 struct nft_ctx *ctx_dump = NULL; 4448 4449 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC); 4450 if (ctx_dump == NULL) 4451 return -ENOMEM; 4452 4453 cb->data = ctx_dump; 4454 return 0; 4455 } 4456 4457 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 4458 { 4459 kfree(cb->data); 4460 return 0; 4461 } 4462 4463 /* called with rcu_read_lock held */ 4464 static int nf_tables_getset(struct sk_buff *skb, const struct nfnl_info *info, 4465 const struct nlattr * const nla[]) 4466 { 4467 struct netlink_ext_ack *extack = info->extack; 4468 u8 genmask = nft_genmask_cur(info->net); 4469 u8 family = info->nfmsg->nfgen_family; 4470 struct nft_table *table = NULL; 4471 struct net *net = info->net; 4472 const struct nft_set *set; 4473 struct sk_buff *skb2; 4474 struct nft_ctx ctx; 4475 int err; 4476 4477 if (nla[NFTA_SET_TABLE]) { 4478 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 4479 genmask, 0); 4480 if (IS_ERR(table)) { 4481 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4482 return PTR_ERR(table); 4483 } 4484 } 4485 4486 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4487 4488 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 4489 struct netlink_dump_control c = { 4490 .start = nf_tables_dump_sets_start, 4491 .dump = nf_tables_dump_sets, 4492 .done = nf_tables_dump_sets_done, 4493 .data = &ctx, 4494 .module = THIS_MODULE, 4495 }; 4496 4497 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4498 } 4499 4500 /* Only accept unspec with dump */ 4501 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 4502 return -EAFNOSUPPORT; 4503 if (!nla[NFTA_SET_TABLE]) 4504 return -EINVAL; 4505 4506 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 4507 if (IS_ERR(set)) 4508 return PTR_ERR(set); 4509 4510 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 4511 if (skb2 == NULL) 4512 return -ENOMEM; 4513 4514 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 4515 if (err < 0) 4516 goto err_fill_set_info; 4517 4518 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 4519 4520 err_fill_set_info: 4521 kfree_skb(skb2); 4522 return err; 4523 } 4524 4525 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = { 4526 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 }, 4527 }; 4528 4529 static int nft_set_desc_concat_parse(const struct nlattr *attr, 4530 struct nft_set_desc *desc) 4531 { 4532 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1]; 4533 u32 len; 4534 int err; 4535 4536 if (desc->field_count >= ARRAY_SIZE(desc->field_len)) 4537 return -E2BIG; 4538 4539 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, 4540 nft_concat_policy, NULL); 4541 if (err < 0) 4542 return err; 4543 4544 if (!tb[NFTA_SET_FIELD_LEN]) 4545 return -EINVAL; 4546 4547 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); 4548 if (!len || len > U8_MAX) 4549 return -EINVAL; 4550 4551 desc->field_len[desc->field_count++] = len; 4552 4553 return 0; 4554 } 4555 4556 static int nft_set_desc_concat(struct nft_set_desc *desc, 4557 const struct nlattr *nla) 4558 { 4559 struct nlattr *attr; 4560 u32 num_regs = 0; 4561 int rem, err, i; 4562 4563 nla_for_each_nested(attr, nla, rem) { 4564 if (nla_type(attr) != NFTA_LIST_ELEM) 4565 return -EINVAL; 4566 4567 err = nft_set_desc_concat_parse(attr, desc); 4568 if (err < 0) 4569 return err; 4570 } 4571 4572 for (i = 0; i < desc->field_count; i++) 4573 num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); 4574 4575 if (num_regs > NFT_REG32_COUNT) 4576 return -E2BIG; 4577 4578 return 0; 4579 } 4580 4581 static int nf_tables_set_desc_parse(struct nft_set_desc *desc, 4582 const struct nlattr *nla) 4583 { 4584 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 4585 int err; 4586 4587 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla, 4588 nft_set_desc_policy, NULL); 4589 if (err < 0) 4590 return err; 4591 4592 if (da[NFTA_SET_DESC_SIZE] != NULL) 4593 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 4594 if (da[NFTA_SET_DESC_CONCAT]) 4595 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]); 4596 4597 return err; 4598 } 4599 4600 static int nft_set_expr_alloc(struct nft_ctx *ctx, struct nft_set *set, 4601 const struct nlattr * const *nla, 4602 struct nft_expr **exprs, int *num_exprs, 4603 u32 flags) 4604 { 4605 struct nft_expr *expr; 4606 int err, i; 4607 4608 if (nla[NFTA_SET_EXPR]) { 4609 expr = nft_set_elem_expr_alloc(ctx, set, nla[NFTA_SET_EXPR]); 4610 if (IS_ERR(expr)) { 4611 err = PTR_ERR(expr); 4612 goto err_set_expr_alloc; 4613 } 4614 exprs[0] = expr; 4615 (*num_exprs)++; 4616 } else if (nla[NFTA_SET_EXPRESSIONS]) { 4617 struct nlattr *tmp; 4618 int left; 4619 4620 if (!(flags & NFT_SET_EXPR)) { 4621 err = -EINVAL; 4622 goto err_set_expr_alloc; 4623 } 4624 i = 0; 4625 nla_for_each_nested(tmp, nla[NFTA_SET_EXPRESSIONS], left) { 4626 if (i == NFT_SET_EXPR_MAX) { 4627 err = -E2BIG; 4628 goto err_set_expr_alloc; 4629 } 4630 if (nla_type(tmp) != NFTA_LIST_ELEM) { 4631 err = -EINVAL; 4632 goto err_set_expr_alloc; 4633 } 4634 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 4635 if (IS_ERR(expr)) { 4636 err = PTR_ERR(expr); 4637 goto err_set_expr_alloc; 4638 } 4639 exprs[i++] = expr; 4640 (*num_exprs)++; 4641 } 4642 } 4643 4644 return 0; 4645 4646 err_set_expr_alloc: 4647 for (i = 0; i < *num_exprs; i++) 4648 nft_expr_destroy(ctx, exprs[i]); 4649 4650 return err; 4651 } 4652 4653 static bool nft_set_is_same(const struct nft_set *set, 4654 const struct nft_set_desc *desc, 4655 struct nft_expr *exprs[], u32 num_exprs, u32 flags) 4656 { 4657 int i; 4658 4659 if (set->ktype != desc->ktype || 4660 set->dtype != desc->dtype || 4661 set->flags != flags || 4662 set->klen != desc->klen || 4663 set->dlen != desc->dlen || 4664 set->field_count != desc->field_count || 4665 set->num_exprs != num_exprs) 4666 return false; 4667 4668 for (i = 0; i < desc->field_count; i++) { 4669 if (set->field_len[i] != desc->field_len[i]) 4670 return false; 4671 } 4672 4673 for (i = 0; i < num_exprs; i++) { 4674 if (set->exprs[i]->ops != exprs[i]->ops) 4675 return false; 4676 } 4677 4678 return true; 4679 } 4680 4681 static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 4682 const struct nlattr * const nla[]) 4683 { 4684 struct netlink_ext_ack *extack = info->extack; 4685 u8 genmask = nft_genmask_next(info->net); 4686 u8 family = info->nfmsg->nfgen_family; 4687 const struct nft_set_ops *ops; 4688 struct net *net = info->net; 4689 struct nft_set_desc desc; 4690 struct nft_table *table; 4691 unsigned char *udata; 4692 struct nft_set *set; 4693 struct nft_ctx ctx; 4694 size_t alloc_size; 4695 int num_exprs = 0; 4696 char *name; 4697 int err, i; 4698 u16 udlen; 4699 u32 flags; 4700 u64 size; 4701 4702 if (nla[NFTA_SET_TABLE] == NULL || 4703 nla[NFTA_SET_NAME] == NULL || 4704 nla[NFTA_SET_KEY_LEN] == NULL || 4705 nla[NFTA_SET_ID] == NULL) 4706 return -EINVAL; 4707 4708 memset(&desc, 0, sizeof(desc)); 4709 4710 desc.ktype = NFT_DATA_VALUE; 4711 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 4712 desc.ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 4713 if ((desc.ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 4714 return -EINVAL; 4715 } 4716 4717 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 4718 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 4719 return -EINVAL; 4720 4721 flags = 0; 4722 if (nla[NFTA_SET_FLAGS] != NULL) { 4723 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 4724 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 4725 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 4726 NFT_SET_MAP | NFT_SET_EVAL | 4727 NFT_SET_OBJECT | NFT_SET_CONCAT | NFT_SET_EXPR)) 4728 return -EOPNOTSUPP; 4729 /* Only one of these operations is supported */ 4730 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) == 4731 (NFT_SET_MAP | NFT_SET_OBJECT)) 4732 return -EOPNOTSUPP; 4733 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == 4734 (NFT_SET_EVAL | NFT_SET_OBJECT)) 4735 return -EOPNOTSUPP; 4736 } 4737 4738 desc.dtype = 0; 4739 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 4740 if (!(flags & NFT_SET_MAP)) 4741 return -EINVAL; 4742 4743 desc.dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 4744 if ((desc.dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 4745 desc.dtype != NFT_DATA_VERDICT) 4746 return -EINVAL; 4747 4748 if (desc.dtype != NFT_DATA_VERDICT) { 4749 if (nla[NFTA_SET_DATA_LEN] == NULL) 4750 return -EINVAL; 4751 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 4752 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 4753 return -EINVAL; 4754 } else 4755 desc.dlen = sizeof(struct nft_verdict); 4756 } else if (flags & NFT_SET_MAP) 4757 return -EINVAL; 4758 4759 if (nla[NFTA_SET_OBJ_TYPE] != NULL) { 4760 if (!(flags & NFT_SET_OBJECT)) 4761 return -EINVAL; 4762 4763 desc.objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE])); 4764 if (desc.objtype == NFT_OBJECT_UNSPEC || 4765 desc.objtype > NFT_OBJECT_MAX) 4766 return -EOPNOTSUPP; 4767 } else if (flags & NFT_SET_OBJECT) 4768 return -EINVAL; 4769 else 4770 desc.objtype = NFT_OBJECT_UNSPEC; 4771 4772 desc.timeout = 0; 4773 if (nla[NFTA_SET_TIMEOUT] != NULL) { 4774 if (!(flags & NFT_SET_TIMEOUT)) 4775 return -EINVAL; 4776 4777 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &desc.timeout); 4778 if (err) 4779 return err; 4780 } 4781 desc.gc_int = 0; 4782 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 4783 if (!(flags & NFT_SET_TIMEOUT)) 4784 return -EINVAL; 4785 desc.gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 4786 } 4787 4788 desc.policy = NFT_SET_POL_PERFORMANCE; 4789 if (nla[NFTA_SET_POLICY] != NULL) 4790 desc.policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 4791 4792 if (nla[NFTA_SET_DESC] != NULL) { 4793 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); 4794 if (err < 0) 4795 return err; 4796 4797 if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT)) 4798 return -EINVAL; 4799 } else if (flags & NFT_SET_CONCAT) { 4800 return -EINVAL; 4801 } 4802 4803 if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS]) 4804 desc.expr = true; 4805 4806 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask, 4807 NETLINK_CB(skb).portid); 4808 if (IS_ERR(table)) { 4809 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4810 return PTR_ERR(table); 4811 } 4812 4813 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4814 4815 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 4816 if (IS_ERR(set)) { 4817 if (PTR_ERR(set) != -ENOENT) { 4818 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4819 return PTR_ERR(set); 4820 } 4821 } else { 4822 struct nft_expr *exprs[NFT_SET_EXPR_MAX] = {}; 4823 4824 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 4825 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4826 return -EEXIST; 4827 } 4828 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 4829 return -EOPNOTSUPP; 4830 4831 err = nft_set_expr_alloc(&ctx, set, nla, exprs, &num_exprs, flags); 4832 if (err < 0) 4833 return err; 4834 4835 err = 0; 4836 if (!nft_set_is_same(set, &desc, exprs, num_exprs, flags)) { 4837 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4838 err = -EEXIST; 4839 } 4840 4841 for (i = 0; i < num_exprs; i++) 4842 nft_expr_destroy(&ctx, exprs[i]); 4843 4844 if (err < 0) 4845 return err; 4846 4847 return __nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set, &desc); 4848 } 4849 4850 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE)) 4851 return -ENOENT; 4852 4853 ops = nft_select_set_ops(&ctx, nla, &desc); 4854 if (IS_ERR(ops)) 4855 return PTR_ERR(ops); 4856 4857 udlen = 0; 4858 if (nla[NFTA_SET_USERDATA]) 4859 udlen = nla_len(nla[NFTA_SET_USERDATA]); 4860 4861 size = 0; 4862 if (ops->privsize != NULL) 4863 size = ops->privsize(nla, &desc); 4864 alloc_size = sizeof(*set) + size + udlen; 4865 if (alloc_size < size || alloc_size > INT_MAX) 4866 return -ENOMEM; 4867 set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT); 4868 if (!set) 4869 return -ENOMEM; 4870 4871 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT); 4872 if (!name) { 4873 err = -ENOMEM; 4874 goto err_set_name; 4875 } 4876 4877 err = nf_tables_set_alloc_name(&ctx, set, name); 4878 kfree(name); 4879 if (err < 0) 4880 goto err_set_name; 4881 4882 udata = NULL; 4883 if (udlen) { 4884 udata = set->data + size; 4885 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen); 4886 } 4887 4888 INIT_LIST_HEAD(&set->bindings); 4889 INIT_LIST_HEAD(&set->catchall_list); 4890 set->table = table; 4891 write_pnet(&set->net, net); 4892 set->ops = ops; 4893 set->ktype = desc.ktype; 4894 set->klen = desc.klen; 4895 set->dtype = desc.dtype; 4896 set->objtype = desc.objtype; 4897 set->dlen = desc.dlen; 4898 set->flags = flags; 4899 set->size = desc.size; 4900 set->policy = desc.policy; 4901 set->udlen = udlen; 4902 set->udata = udata; 4903 set->timeout = desc.timeout; 4904 set->gc_int = desc.gc_int; 4905 4906 set->field_count = desc.field_count; 4907 for (i = 0; i < desc.field_count; i++) 4908 set->field_len[i] = desc.field_len[i]; 4909 4910 err = ops->init(set, &desc, nla); 4911 if (err < 0) 4912 goto err_set_init; 4913 4914 err = nft_set_expr_alloc(&ctx, set, nla, set->exprs, &num_exprs, flags); 4915 if (err < 0) 4916 goto err_set_destroy; 4917 4918 set->num_exprs = num_exprs; 4919 set->handle = nf_tables_alloc_handle(table); 4920 4921 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 4922 if (err < 0) 4923 goto err_set_expr_alloc; 4924 4925 list_add_tail_rcu(&set->list, &table->sets); 4926 table->use++; 4927 return 0; 4928 4929 err_set_expr_alloc: 4930 for (i = 0; i < set->num_exprs; i++) 4931 nft_expr_destroy(&ctx, set->exprs[i]); 4932 err_set_destroy: 4933 ops->destroy(set); 4934 err_set_init: 4935 kfree(set->name); 4936 err_set_name: 4937 kvfree(set); 4938 return err; 4939 } 4940 4941 static void nft_set_catchall_destroy(const struct nft_ctx *ctx, 4942 struct nft_set *set) 4943 { 4944 struct nft_set_elem_catchall *next, *catchall; 4945 4946 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 4947 list_del_rcu(&catchall->list); 4948 nft_set_elem_destroy(set, catchall->elem, true); 4949 kfree_rcu(catchall, rcu); 4950 } 4951 } 4952 4953 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 4954 { 4955 int i; 4956 4957 if (WARN_ON(set->use > 0)) 4958 return; 4959 4960 for (i = 0; i < set->num_exprs; i++) 4961 nft_expr_destroy(ctx, set->exprs[i]); 4962 4963 set->ops->destroy(set); 4964 nft_set_catchall_destroy(ctx, set); 4965 kfree(set->name); 4966 kvfree(set); 4967 } 4968 4969 static int nf_tables_delset(struct sk_buff *skb, const struct nfnl_info *info, 4970 const struct nlattr * const nla[]) 4971 { 4972 struct netlink_ext_ack *extack = info->extack; 4973 u8 genmask = nft_genmask_next(info->net); 4974 u8 family = info->nfmsg->nfgen_family; 4975 struct net *net = info->net; 4976 const struct nlattr *attr; 4977 struct nft_table *table; 4978 struct nft_set *set; 4979 struct nft_ctx ctx; 4980 4981 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 4982 return -EAFNOSUPPORT; 4983 4984 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 4985 genmask, NETLINK_CB(skb).portid); 4986 if (IS_ERR(table)) { 4987 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4988 return PTR_ERR(table); 4989 } 4990 4991 if (nla[NFTA_SET_HANDLE]) { 4992 attr = nla[NFTA_SET_HANDLE]; 4993 set = nft_set_lookup_byhandle(table, attr, genmask); 4994 } else { 4995 attr = nla[NFTA_SET_NAME]; 4996 set = nft_set_lookup(table, attr, genmask); 4997 } 4998 4999 if (IS_ERR(set)) { 5000 if (PTR_ERR(set) == -ENOENT && 5001 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSET) 5002 return 0; 5003 5004 NL_SET_BAD_ATTR(extack, attr); 5005 return PTR_ERR(set); 5006 } 5007 if (set->use || 5008 (info->nlh->nlmsg_flags & NLM_F_NONREC && 5009 atomic_read(&set->nelems) > 0)) { 5010 NL_SET_BAD_ATTR(extack, attr); 5011 return -EBUSY; 5012 } 5013 5014 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5015 5016 return nft_delset(&ctx, set); 5017 } 5018 5019 static int nft_validate_register_store(const struct nft_ctx *ctx, 5020 enum nft_registers reg, 5021 const struct nft_data *data, 5022 enum nft_data_types type, 5023 unsigned int len); 5024 5025 static int nft_setelem_data_validate(const struct nft_ctx *ctx, 5026 struct nft_set *set, 5027 struct nft_set_elem *elem) 5028 { 5029 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5030 enum nft_registers dreg; 5031 5032 dreg = nft_type_to_reg(set->dtype); 5033 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 5034 set->dtype == NFT_DATA_VERDICT ? 5035 NFT_DATA_VERDICT : NFT_DATA_VALUE, 5036 set->dlen); 5037 } 5038 5039 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 5040 struct nft_set *set, 5041 const struct nft_set_iter *iter, 5042 struct nft_set_elem *elem) 5043 { 5044 return nft_setelem_data_validate(ctx, set, elem); 5045 } 5046 5047 static int nft_set_catchall_bind_check(const struct nft_ctx *ctx, 5048 struct nft_set *set) 5049 { 5050 u8 genmask = nft_genmask_next(ctx->net); 5051 struct nft_set_elem_catchall *catchall; 5052 struct nft_set_elem elem; 5053 struct nft_set_ext *ext; 5054 int ret = 0; 5055 5056 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5057 ext = nft_set_elem_ext(set, catchall->elem); 5058 if (!nft_set_elem_active(ext, genmask)) 5059 continue; 5060 5061 elem.priv = catchall->elem; 5062 ret = nft_setelem_data_validate(ctx, set, &elem); 5063 if (ret < 0) 5064 break; 5065 } 5066 5067 return ret; 5068 } 5069 5070 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 5071 struct nft_set_binding *binding) 5072 { 5073 struct nft_set_binding *i; 5074 struct nft_set_iter iter; 5075 5076 if (set->use == UINT_MAX) 5077 return -EOVERFLOW; 5078 5079 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5080 return -EBUSY; 5081 5082 if (binding->flags & NFT_SET_MAP) { 5083 /* If the set is already bound to the same chain all 5084 * jumps are already validated for that chain. 5085 */ 5086 list_for_each_entry(i, &set->bindings, list) { 5087 if (i->flags & NFT_SET_MAP && 5088 i->chain == binding->chain) 5089 goto bind; 5090 } 5091 5092 iter.genmask = nft_genmask_next(ctx->net); 5093 iter.skip = 0; 5094 iter.count = 0; 5095 iter.err = 0; 5096 iter.fn = nf_tables_bind_check_setelem; 5097 5098 set->ops->walk(ctx, set, &iter); 5099 if (!iter.err) 5100 iter.err = nft_set_catchall_bind_check(ctx, set); 5101 5102 if (iter.err < 0) 5103 return iter.err; 5104 } 5105 bind: 5106 binding->chain = ctx->chain; 5107 list_add_tail_rcu(&binding->list, &set->bindings); 5108 nft_set_trans_bind(ctx, set); 5109 set->use++; 5110 5111 return 0; 5112 } 5113 EXPORT_SYMBOL_GPL(nf_tables_bind_set); 5114 5115 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 5116 struct nft_set_binding *binding, bool event) 5117 { 5118 list_del_rcu(&binding->list); 5119 5120 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { 5121 list_del_rcu(&set->list); 5122 if (event) 5123 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, 5124 GFP_KERNEL); 5125 } 5126 } 5127 5128 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) 5129 { 5130 if (nft_set_is_anonymous(set)) 5131 nft_clear(ctx->net, set); 5132 5133 set->use++; 5134 } 5135 EXPORT_SYMBOL_GPL(nf_tables_activate_set); 5136 5137 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, 5138 struct nft_set_binding *binding, 5139 enum nft_trans_phase phase) 5140 { 5141 switch (phase) { 5142 case NFT_TRANS_PREPARE: 5143 if (nft_set_is_anonymous(set)) 5144 nft_deactivate_next(ctx->net, set); 5145 5146 set->use--; 5147 return; 5148 case NFT_TRANS_ABORT: 5149 case NFT_TRANS_RELEASE: 5150 set->use--; 5151 fallthrough; 5152 default: 5153 nf_tables_unbind_set(ctx, set, binding, 5154 phase == NFT_TRANS_COMMIT); 5155 } 5156 } 5157 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set); 5158 5159 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set) 5160 { 5161 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5162 nft_set_destroy(ctx, set); 5163 } 5164 EXPORT_SYMBOL_GPL(nf_tables_destroy_set); 5165 5166 const struct nft_set_ext_type nft_set_ext_types[] = { 5167 [NFT_SET_EXT_KEY] = { 5168 .align = __alignof__(u32), 5169 }, 5170 [NFT_SET_EXT_DATA] = { 5171 .align = __alignof__(u32), 5172 }, 5173 [NFT_SET_EXT_EXPRESSIONS] = { 5174 .align = __alignof__(struct nft_set_elem_expr), 5175 }, 5176 [NFT_SET_EXT_OBJREF] = { 5177 .len = sizeof(struct nft_object *), 5178 .align = __alignof__(struct nft_object *), 5179 }, 5180 [NFT_SET_EXT_FLAGS] = { 5181 .len = sizeof(u8), 5182 .align = __alignof__(u8), 5183 }, 5184 [NFT_SET_EXT_TIMEOUT] = { 5185 .len = sizeof(u64), 5186 .align = __alignof__(u64), 5187 }, 5188 [NFT_SET_EXT_EXPIRATION] = { 5189 .len = sizeof(u64), 5190 .align = __alignof__(u64), 5191 }, 5192 [NFT_SET_EXT_USERDATA] = { 5193 .len = sizeof(struct nft_userdata), 5194 .align = __alignof__(struct nft_userdata), 5195 }, 5196 [NFT_SET_EXT_KEY_END] = { 5197 .align = __alignof__(u32), 5198 }, 5199 }; 5200 5201 /* 5202 * Set elements 5203 */ 5204 5205 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 5206 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 5207 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 5208 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 5209 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 5210 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 }, 5211 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 5212 .len = NFT_USERDATA_MAXLEN }, 5213 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, 5214 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING, 5215 .len = NFT_OBJ_MAXNAMELEN - 1 }, 5216 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED }, 5217 [NFTA_SET_ELEM_EXPRESSIONS] = { .type = NLA_NESTED }, 5218 }; 5219 5220 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 5221 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING, 5222 .len = NFT_TABLE_MAXNAMELEN - 1 }, 5223 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING, 5224 .len = NFT_SET_MAXNAMELEN - 1 }, 5225 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED }, 5226 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 5227 }; 5228 5229 static int nft_set_elem_expr_dump(struct sk_buff *skb, 5230 const struct nft_set *set, 5231 const struct nft_set_ext *ext) 5232 { 5233 struct nft_set_elem_expr *elem_expr; 5234 u32 size, num_exprs = 0; 5235 struct nft_expr *expr; 5236 struct nlattr *nest; 5237 5238 elem_expr = nft_set_ext_expr(ext); 5239 nft_setelem_expr_foreach(expr, elem_expr, size) 5240 num_exprs++; 5241 5242 if (num_exprs == 1) { 5243 expr = nft_setelem_expr_at(elem_expr, 0); 5244 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, false) < 0) 5245 return -1; 5246 5247 return 0; 5248 } else if (num_exprs > 1) { 5249 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_EXPRESSIONS); 5250 if (nest == NULL) 5251 goto nla_put_failure; 5252 5253 nft_setelem_expr_foreach(expr, elem_expr, size) { 5254 expr = nft_setelem_expr_at(elem_expr, size); 5255 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, false) < 0) 5256 goto nla_put_failure; 5257 } 5258 nla_nest_end(skb, nest); 5259 } 5260 return 0; 5261 5262 nla_put_failure: 5263 return -1; 5264 } 5265 5266 static int nf_tables_fill_setelem(struct sk_buff *skb, 5267 const struct nft_set *set, 5268 const struct nft_set_elem *elem) 5269 { 5270 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5271 unsigned char *b = skb_tail_pointer(skb); 5272 struct nlattr *nest; 5273 5274 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 5275 if (nest == NULL) 5276 goto nla_put_failure; 5277 5278 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 5279 nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 5280 NFT_DATA_VALUE, set->klen) < 0) 5281 goto nla_put_failure; 5282 5283 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 5284 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext), 5285 NFT_DATA_VALUE, set->klen) < 0) 5286 goto nla_put_failure; 5287 5288 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 5289 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 5290 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, 5291 set->dlen) < 0) 5292 goto nla_put_failure; 5293 5294 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && 5295 nft_set_elem_expr_dump(skb, set, ext)) 5296 goto nla_put_failure; 5297 5298 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 5299 nla_put_string(skb, NFTA_SET_ELEM_OBJREF, 5300 (*nft_set_ext_obj(ext))->key.name) < 0) 5301 goto nla_put_failure; 5302 5303 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 5304 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 5305 htonl(*nft_set_ext_flags(ext)))) 5306 goto nla_put_failure; 5307 5308 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) && 5309 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, 5310 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)), 5311 NFTA_SET_ELEM_PAD)) 5312 goto nla_put_failure; 5313 5314 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 5315 u64 expires, now = get_jiffies_64(); 5316 5317 expires = *nft_set_ext_expiration(ext); 5318 if (time_before64(now, expires)) 5319 expires -= now; 5320 else 5321 expires = 0; 5322 5323 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 5324 nf_jiffies64_to_msecs(expires), 5325 NFTA_SET_ELEM_PAD)) 5326 goto nla_put_failure; 5327 } 5328 5329 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 5330 struct nft_userdata *udata; 5331 5332 udata = nft_set_ext_userdata(ext); 5333 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 5334 udata->len + 1, udata->data)) 5335 goto nla_put_failure; 5336 } 5337 5338 nla_nest_end(skb, nest); 5339 return 0; 5340 5341 nla_put_failure: 5342 nlmsg_trim(skb, b); 5343 return -EMSGSIZE; 5344 } 5345 5346 struct nft_set_dump_args { 5347 const struct netlink_callback *cb; 5348 struct nft_set_iter iter; 5349 struct sk_buff *skb; 5350 }; 5351 5352 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 5353 struct nft_set *set, 5354 const struct nft_set_iter *iter, 5355 struct nft_set_elem *elem) 5356 { 5357 struct nft_set_dump_args *args; 5358 5359 args = container_of(iter, struct nft_set_dump_args, iter); 5360 return nf_tables_fill_setelem(args->skb, set, elem); 5361 } 5362 5363 struct nft_set_dump_ctx { 5364 const struct nft_set *set; 5365 struct nft_ctx ctx; 5366 }; 5367 5368 static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb, 5369 const struct nft_set *set) 5370 { 5371 struct nft_set_elem_catchall *catchall; 5372 u8 genmask = nft_genmask_cur(net); 5373 struct nft_set_elem elem; 5374 struct nft_set_ext *ext; 5375 int ret = 0; 5376 5377 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5378 ext = nft_set_elem_ext(set, catchall->elem); 5379 if (!nft_set_elem_active(ext, genmask) || 5380 nft_set_elem_expired(ext)) 5381 continue; 5382 5383 elem.priv = catchall->elem; 5384 ret = nf_tables_fill_setelem(skb, set, &elem); 5385 break; 5386 } 5387 5388 return ret; 5389 } 5390 5391 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 5392 { 5393 struct nft_set_dump_ctx *dump_ctx = cb->data; 5394 struct net *net = sock_net(skb->sk); 5395 struct nftables_pernet *nft_net; 5396 struct nft_table *table; 5397 struct nft_set *set; 5398 struct nft_set_dump_args args; 5399 bool set_found = false; 5400 struct nlmsghdr *nlh; 5401 struct nlattr *nest; 5402 u32 portid, seq; 5403 int event; 5404 5405 rcu_read_lock(); 5406 nft_net = nft_pernet(net); 5407 cb->seq = READ_ONCE(nft_net->base_seq); 5408 5409 list_for_each_entry_rcu(table, &nft_net->tables, list) { 5410 if (dump_ctx->ctx.family != NFPROTO_UNSPEC && 5411 dump_ctx->ctx.family != table->family) 5412 continue; 5413 5414 if (table != dump_ctx->ctx.table) 5415 continue; 5416 5417 list_for_each_entry_rcu(set, &table->sets, list) { 5418 if (set == dump_ctx->set) { 5419 set_found = true; 5420 break; 5421 } 5422 } 5423 break; 5424 } 5425 5426 if (!set_found) { 5427 rcu_read_unlock(); 5428 return -ENOENT; 5429 } 5430 5431 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM); 5432 portid = NETLINK_CB(cb->skb).portid; 5433 seq = cb->nlh->nlmsg_seq; 5434 5435 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, 5436 table->family, NFNETLINK_V0, nft_base_seq(net)); 5437 if (!nlh) 5438 goto nla_put_failure; 5439 5440 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) 5441 goto nla_put_failure; 5442 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 5443 goto nla_put_failure; 5444 5445 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5446 if (nest == NULL) 5447 goto nla_put_failure; 5448 5449 args.cb = cb; 5450 args.skb = skb; 5451 args.iter.genmask = nft_genmask_cur(net); 5452 args.iter.skip = cb->args[0]; 5453 args.iter.count = 0; 5454 args.iter.err = 0; 5455 args.iter.fn = nf_tables_dump_setelem; 5456 set->ops->walk(&dump_ctx->ctx, set, &args.iter); 5457 5458 if (!args.iter.err && args.iter.count == cb->args[0]) 5459 args.iter.err = nft_set_catchall_dump(net, skb, set); 5460 rcu_read_unlock(); 5461 5462 nla_nest_end(skb, nest); 5463 nlmsg_end(skb, nlh); 5464 5465 if (args.iter.err && args.iter.err != -EMSGSIZE) 5466 return args.iter.err; 5467 if (args.iter.count == cb->args[0]) 5468 return 0; 5469 5470 cb->args[0] = args.iter.count; 5471 return skb->len; 5472 5473 nla_put_failure: 5474 rcu_read_unlock(); 5475 return -ENOSPC; 5476 } 5477 5478 static int nf_tables_dump_set_start(struct netlink_callback *cb) 5479 { 5480 struct nft_set_dump_ctx *dump_ctx = cb->data; 5481 5482 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC); 5483 5484 return cb->data ? 0 : -ENOMEM; 5485 } 5486 5487 static int nf_tables_dump_set_done(struct netlink_callback *cb) 5488 { 5489 kfree(cb->data); 5490 return 0; 5491 } 5492 5493 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 5494 const struct nft_ctx *ctx, u32 seq, 5495 u32 portid, int event, u16 flags, 5496 const struct nft_set *set, 5497 const struct nft_set_elem *elem) 5498 { 5499 struct nlmsghdr *nlh; 5500 struct nlattr *nest; 5501 int err; 5502 5503 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 5504 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 5505 NFNETLINK_V0, nft_base_seq(ctx->net)); 5506 if (!nlh) 5507 goto nla_put_failure; 5508 5509 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 5510 goto nla_put_failure; 5511 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 5512 goto nla_put_failure; 5513 5514 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5515 if (nest == NULL) 5516 goto nla_put_failure; 5517 5518 err = nf_tables_fill_setelem(skb, set, elem); 5519 if (err < 0) 5520 goto nla_put_failure; 5521 5522 nla_nest_end(skb, nest); 5523 5524 nlmsg_end(skb, nlh); 5525 return 0; 5526 5527 nla_put_failure: 5528 nlmsg_trim(skb, nlh); 5529 return -1; 5530 } 5531 5532 static int nft_setelem_parse_flags(const struct nft_set *set, 5533 const struct nlattr *attr, u32 *flags) 5534 { 5535 if (attr == NULL) 5536 return 0; 5537 5538 *flags = ntohl(nla_get_be32(attr)); 5539 if (*flags & ~(NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5540 return -EOPNOTSUPP; 5541 if (!(set->flags & NFT_SET_INTERVAL) && 5542 *flags & NFT_SET_ELEM_INTERVAL_END) 5543 return -EINVAL; 5544 if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == 5545 (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5546 return -EINVAL; 5547 5548 return 0; 5549 } 5550 5551 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set, 5552 struct nft_data *key, struct nlattr *attr) 5553 { 5554 struct nft_data_desc desc = { 5555 .type = NFT_DATA_VALUE, 5556 .size = NFT_DATA_VALUE_MAXLEN, 5557 .len = set->klen, 5558 }; 5559 5560 return nft_data_init(ctx, key, &desc, attr); 5561 } 5562 5563 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, 5564 struct nft_data_desc *desc, 5565 struct nft_data *data, 5566 struct nlattr *attr) 5567 { 5568 u32 dtype; 5569 5570 if (set->dtype == NFT_DATA_VERDICT) 5571 dtype = NFT_DATA_VERDICT; 5572 else 5573 dtype = NFT_DATA_VALUE; 5574 5575 desc->type = dtype; 5576 desc->size = NFT_DATA_VALUE_MAXLEN; 5577 desc->len = set->dlen; 5578 desc->flags = NFT_DATA_DESC_SETELEM; 5579 5580 return nft_data_init(ctx, data, desc, attr); 5581 } 5582 5583 static void *nft_setelem_catchall_get(const struct net *net, 5584 const struct nft_set *set) 5585 { 5586 struct nft_set_elem_catchall *catchall; 5587 u8 genmask = nft_genmask_cur(net); 5588 struct nft_set_ext *ext; 5589 void *priv = NULL; 5590 5591 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5592 ext = nft_set_elem_ext(set, catchall->elem); 5593 if (!nft_set_elem_active(ext, genmask) || 5594 nft_set_elem_expired(ext)) 5595 continue; 5596 5597 priv = catchall->elem; 5598 break; 5599 } 5600 5601 return priv; 5602 } 5603 5604 static int nft_setelem_get(struct nft_ctx *ctx, struct nft_set *set, 5605 struct nft_set_elem *elem, u32 flags) 5606 { 5607 void *priv; 5608 5609 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 5610 priv = set->ops->get(ctx->net, set, elem, flags); 5611 if (IS_ERR(priv)) 5612 return PTR_ERR(priv); 5613 } else { 5614 priv = nft_setelem_catchall_get(ctx->net, set); 5615 if (!priv) 5616 return -ENOENT; 5617 } 5618 elem->priv = priv; 5619 5620 return 0; 5621 } 5622 5623 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, 5624 const struct nlattr *attr) 5625 { 5626 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 5627 struct nft_set_elem elem; 5628 struct sk_buff *skb; 5629 uint32_t flags = 0; 5630 int err; 5631 5632 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 5633 nft_set_elem_policy, NULL); 5634 if (err < 0) 5635 return err; 5636 5637 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 5638 if (err < 0) 5639 return err; 5640 5641 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 5642 return -EINVAL; 5643 5644 if (nla[NFTA_SET_ELEM_KEY]) { 5645 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 5646 nla[NFTA_SET_ELEM_KEY]); 5647 if (err < 0) 5648 return err; 5649 } 5650 5651 if (nla[NFTA_SET_ELEM_KEY_END]) { 5652 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 5653 nla[NFTA_SET_ELEM_KEY_END]); 5654 if (err < 0) 5655 return err; 5656 } 5657 5658 err = nft_setelem_get(ctx, set, &elem, flags); 5659 if (err < 0) 5660 return err; 5661 5662 err = -ENOMEM; 5663 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 5664 if (skb == NULL) 5665 return err; 5666 5667 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, 5668 NFT_MSG_NEWSETELEM, 0, set, &elem); 5669 if (err < 0) 5670 goto err_fill_setelem; 5671 5672 return nfnetlink_unicast(skb, ctx->net, ctx->portid); 5673 5674 err_fill_setelem: 5675 kfree_skb(skb); 5676 return err; 5677 } 5678 5679 /* called with rcu_read_lock held */ 5680 static int nf_tables_getsetelem(struct sk_buff *skb, 5681 const struct nfnl_info *info, 5682 const struct nlattr * const nla[]) 5683 { 5684 struct netlink_ext_ack *extack = info->extack; 5685 u8 genmask = nft_genmask_cur(info->net); 5686 u8 family = info->nfmsg->nfgen_family; 5687 struct net *net = info->net; 5688 struct nft_table *table; 5689 struct nft_set *set; 5690 struct nlattr *attr; 5691 struct nft_ctx ctx; 5692 int rem, err = 0; 5693 5694 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 5695 genmask, 0); 5696 if (IS_ERR(table)) { 5697 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 5698 return PTR_ERR(table); 5699 } 5700 5701 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 5702 if (IS_ERR(set)) 5703 return PTR_ERR(set); 5704 5705 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5706 5707 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 5708 struct netlink_dump_control c = { 5709 .start = nf_tables_dump_set_start, 5710 .dump = nf_tables_dump_set, 5711 .done = nf_tables_dump_set_done, 5712 .module = THIS_MODULE, 5713 }; 5714 struct nft_set_dump_ctx dump_ctx = { 5715 .set = set, 5716 .ctx = ctx, 5717 }; 5718 5719 c.data = &dump_ctx; 5720 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 5721 } 5722 5723 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 5724 return -EINVAL; 5725 5726 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 5727 err = nft_get_set_elem(&ctx, set, attr); 5728 if (err < 0) { 5729 NL_SET_BAD_ATTR(extack, attr); 5730 break; 5731 } 5732 } 5733 5734 return err; 5735 } 5736 5737 static void nf_tables_setelem_notify(const struct nft_ctx *ctx, 5738 const struct nft_set *set, 5739 const struct nft_set_elem *elem, 5740 int event) 5741 { 5742 struct nftables_pernet *nft_net; 5743 struct net *net = ctx->net; 5744 u32 portid = ctx->portid; 5745 struct sk_buff *skb; 5746 u16 flags = 0; 5747 int err; 5748 5749 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 5750 return; 5751 5752 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 5753 if (skb == NULL) 5754 goto err; 5755 5756 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 5757 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 5758 5759 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 5760 set, elem); 5761 if (err < 0) { 5762 kfree_skb(skb); 5763 goto err; 5764 } 5765 5766 nft_net = nft_pernet(net); 5767 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 5768 return; 5769 err: 5770 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 5771 } 5772 5773 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx, 5774 int msg_type, 5775 struct nft_set *set) 5776 { 5777 struct nft_trans *trans; 5778 5779 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem)); 5780 if (trans == NULL) 5781 return NULL; 5782 5783 nft_trans_elem_set(trans) = set; 5784 return trans; 5785 } 5786 5787 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, 5788 const struct nft_set *set, 5789 const struct nlattr *attr) 5790 { 5791 struct nft_expr *expr; 5792 int err; 5793 5794 expr = nft_expr_init(ctx, attr); 5795 if (IS_ERR(expr)) 5796 return expr; 5797 5798 err = -EOPNOTSUPP; 5799 if (expr->ops->type->flags & NFT_EXPR_GC) { 5800 if (set->flags & NFT_SET_TIMEOUT) 5801 goto err_set_elem_expr; 5802 if (!set->ops->gc_init) 5803 goto err_set_elem_expr; 5804 set->ops->gc_init(set); 5805 } 5806 5807 return expr; 5808 5809 err_set_elem_expr: 5810 nft_expr_destroy(ctx, expr); 5811 return ERR_PTR(err); 5812 } 5813 5814 static int nft_set_ext_check(const struct nft_set_ext_tmpl *tmpl, u8 id, u32 len) 5815 { 5816 len += nft_set_ext_types[id].len; 5817 if (len > tmpl->ext_len[id] || 5818 len > U8_MAX) 5819 return -1; 5820 5821 return 0; 5822 } 5823 5824 static int nft_set_ext_memcpy(const struct nft_set_ext_tmpl *tmpl, u8 id, 5825 void *to, const void *from, u32 len) 5826 { 5827 if (nft_set_ext_check(tmpl, id, len) < 0) 5828 return -1; 5829 5830 memcpy(to, from, len); 5831 5832 return 0; 5833 } 5834 5835 void *nft_set_elem_init(const struct nft_set *set, 5836 const struct nft_set_ext_tmpl *tmpl, 5837 const u32 *key, const u32 *key_end, 5838 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp) 5839 { 5840 struct nft_set_ext *ext; 5841 void *elem; 5842 5843 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 5844 if (elem == NULL) 5845 return ERR_PTR(-ENOMEM); 5846 5847 ext = nft_set_elem_ext(set, elem); 5848 nft_set_ext_init(ext, tmpl); 5849 5850 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 5851 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY, 5852 nft_set_ext_key(ext), key, set->klen) < 0) 5853 goto err_ext_check; 5854 5855 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 5856 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY_END, 5857 nft_set_ext_key_end(ext), key_end, set->klen) < 0) 5858 goto err_ext_check; 5859 5860 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 5861 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_DATA, 5862 nft_set_ext_data(ext), data, set->dlen) < 0) 5863 goto err_ext_check; 5864 5865 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 5866 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration; 5867 if (expiration == 0) 5868 *nft_set_ext_expiration(ext) += timeout; 5869 } 5870 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) 5871 *nft_set_ext_timeout(ext) = timeout; 5872 5873 return elem; 5874 5875 err_ext_check: 5876 kfree(elem); 5877 5878 return ERR_PTR(-EINVAL); 5879 } 5880 5881 static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 5882 struct nft_expr *expr) 5883 { 5884 if (expr->ops->destroy_clone) { 5885 expr->ops->destroy_clone(ctx, expr); 5886 module_put(expr->ops->type->owner); 5887 } else { 5888 nf_tables_expr_destroy(ctx, expr); 5889 } 5890 } 5891 5892 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 5893 struct nft_set_elem_expr *elem_expr) 5894 { 5895 struct nft_expr *expr; 5896 u32 size; 5897 5898 nft_setelem_expr_foreach(expr, elem_expr, size) 5899 __nft_set_elem_expr_destroy(ctx, expr); 5900 } 5901 5902 void nft_set_elem_destroy(const struct nft_set *set, void *elem, 5903 bool destroy_expr) 5904 { 5905 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 5906 struct nft_ctx ctx = { 5907 .net = read_pnet(&set->net), 5908 .family = set->table->family, 5909 }; 5910 5911 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE); 5912 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 5913 nft_data_release(nft_set_ext_data(ext), set->dtype); 5914 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 5915 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext)); 5916 5917 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 5918 (*nft_set_ext_obj(ext))->use--; 5919 kfree(elem); 5920 } 5921 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 5922 5923 /* Only called from commit path, nft_setelem_data_deactivate() already deals 5924 * with the refcounting from the preparation phase. 5925 */ 5926 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, 5927 const struct nft_set *set, void *elem) 5928 { 5929 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 5930 5931 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 5932 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 5933 5934 kfree(elem); 5935 } 5936 5937 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 5938 struct nft_expr *expr_array[]) 5939 { 5940 struct nft_expr *expr; 5941 int err, i, k; 5942 5943 for (i = 0; i < set->num_exprs; i++) { 5944 expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT); 5945 if (!expr) 5946 goto err_expr; 5947 5948 err = nft_expr_clone(expr, set->exprs[i]); 5949 if (err < 0) { 5950 kfree(expr); 5951 goto err_expr; 5952 } 5953 expr_array[i] = expr; 5954 } 5955 5956 return 0; 5957 5958 err_expr: 5959 for (k = i - 1; k >= 0; k--) 5960 nft_expr_destroy(ctx, expr_array[k]); 5961 5962 return -ENOMEM; 5963 } 5964 5965 static int nft_set_elem_expr_setup(struct nft_ctx *ctx, 5966 const struct nft_set_ext_tmpl *tmpl, 5967 const struct nft_set_ext *ext, 5968 struct nft_expr *expr_array[], 5969 u32 num_exprs) 5970 { 5971 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 5972 u32 len = sizeof(struct nft_set_elem_expr); 5973 struct nft_expr *expr; 5974 int i, err; 5975 5976 if (num_exprs == 0) 5977 return 0; 5978 5979 for (i = 0; i < num_exprs; i++) 5980 len += expr_array[i]->ops->size; 5981 5982 if (nft_set_ext_check(tmpl, NFT_SET_EXT_EXPRESSIONS, len) < 0) 5983 return -EINVAL; 5984 5985 for (i = 0; i < num_exprs; i++) { 5986 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 5987 err = nft_expr_clone(expr, expr_array[i]); 5988 if (err < 0) 5989 goto err_elem_expr_setup; 5990 5991 elem_expr->size += expr_array[i]->ops->size; 5992 nft_expr_destroy(ctx, expr_array[i]); 5993 expr_array[i] = NULL; 5994 } 5995 5996 return 0; 5997 5998 err_elem_expr_setup: 5999 for (; i < num_exprs; i++) { 6000 nft_expr_destroy(ctx, expr_array[i]); 6001 expr_array[i] = NULL; 6002 } 6003 6004 return -ENOMEM; 6005 } 6006 6007 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, 6008 const struct nft_set *set) 6009 { 6010 struct nft_set_elem_catchall *catchall; 6011 u8 genmask = nft_genmask_cur(net); 6012 struct nft_set_ext *ext; 6013 6014 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6015 ext = nft_set_elem_ext(set, catchall->elem); 6016 if (nft_set_elem_active(ext, genmask) && 6017 !nft_set_elem_expired(ext)) 6018 return ext; 6019 } 6020 6021 return NULL; 6022 } 6023 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup); 6024 6025 void *nft_set_catchall_gc(const struct nft_set *set) 6026 { 6027 struct nft_set_elem_catchall *catchall, *next; 6028 struct nft_set_ext *ext; 6029 void *elem = NULL; 6030 6031 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 6032 ext = nft_set_elem_ext(set, catchall->elem); 6033 6034 if (!nft_set_elem_expired(ext) || 6035 nft_set_elem_mark_busy(ext)) 6036 continue; 6037 6038 elem = catchall->elem; 6039 list_del_rcu(&catchall->list); 6040 kfree_rcu(catchall, rcu); 6041 break; 6042 } 6043 6044 return elem; 6045 } 6046 EXPORT_SYMBOL_GPL(nft_set_catchall_gc); 6047 6048 static int nft_setelem_catchall_insert(const struct net *net, 6049 struct nft_set *set, 6050 const struct nft_set_elem *elem, 6051 struct nft_set_ext **pext) 6052 { 6053 struct nft_set_elem_catchall *catchall; 6054 u8 genmask = nft_genmask_next(net); 6055 struct nft_set_ext *ext; 6056 6057 list_for_each_entry(catchall, &set->catchall_list, list) { 6058 ext = nft_set_elem_ext(set, catchall->elem); 6059 if (nft_set_elem_active(ext, genmask)) { 6060 *pext = ext; 6061 return -EEXIST; 6062 } 6063 } 6064 6065 catchall = kmalloc(sizeof(*catchall), GFP_KERNEL); 6066 if (!catchall) 6067 return -ENOMEM; 6068 6069 catchall->elem = elem->priv; 6070 list_add_tail_rcu(&catchall->list, &set->catchall_list); 6071 6072 return 0; 6073 } 6074 6075 static int nft_setelem_insert(const struct net *net, 6076 struct nft_set *set, 6077 const struct nft_set_elem *elem, 6078 struct nft_set_ext **ext, unsigned int flags) 6079 { 6080 int ret; 6081 6082 if (flags & NFT_SET_ELEM_CATCHALL) 6083 ret = nft_setelem_catchall_insert(net, set, elem, ext); 6084 else 6085 ret = set->ops->insert(net, set, elem, ext); 6086 6087 return ret; 6088 } 6089 6090 static bool nft_setelem_is_catchall(const struct nft_set *set, 6091 const struct nft_set_elem *elem) 6092 { 6093 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6094 6095 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 6096 *nft_set_ext_flags(ext) & NFT_SET_ELEM_CATCHALL) 6097 return true; 6098 6099 return false; 6100 } 6101 6102 static void nft_setelem_activate(struct net *net, struct nft_set *set, 6103 struct nft_set_elem *elem) 6104 { 6105 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6106 6107 if (nft_setelem_is_catchall(set, elem)) { 6108 nft_set_elem_change_active(net, set, ext); 6109 nft_set_elem_clear_busy(ext); 6110 } else { 6111 set->ops->activate(net, set, elem); 6112 } 6113 } 6114 6115 static int nft_setelem_catchall_deactivate(const struct net *net, 6116 struct nft_set *set, 6117 struct nft_set_elem *elem) 6118 { 6119 struct nft_set_elem_catchall *catchall; 6120 struct nft_set_ext *ext; 6121 6122 list_for_each_entry(catchall, &set->catchall_list, list) { 6123 ext = nft_set_elem_ext(set, catchall->elem); 6124 if (!nft_is_active(net, ext) || 6125 nft_set_elem_mark_busy(ext)) 6126 continue; 6127 6128 kfree(elem->priv); 6129 elem->priv = catchall->elem; 6130 nft_set_elem_change_active(net, set, ext); 6131 return 0; 6132 } 6133 6134 return -ENOENT; 6135 } 6136 6137 static int __nft_setelem_deactivate(const struct net *net, 6138 struct nft_set *set, 6139 struct nft_set_elem *elem) 6140 { 6141 void *priv; 6142 6143 priv = set->ops->deactivate(net, set, elem); 6144 if (!priv) 6145 return -ENOENT; 6146 6147 kfree(elem->priv); 6148 elem->priv = priv; 6149 set->ndeact++; 6150 6151 return 0; 6152 } 6153 6154 static int nft_setelem_deactivate(const struct net *net, 6155 struct nft_set *set, 6156 struct nft_set_elem *elem, u32 flags) 6157 { 6158 int ret; 6159 6160 if (flags & NFT_SET_ELEM_CATCHALL) 6161 ret = nft_setelem_catchall_deactivate(net, set, elem); 6162 else 6163 ret = __nft_setelem_deactivate(net, set, elem); 6164 6165 return ret; 6166 } 6167 6168 static void nft_setelem_catchall_remove(const struct net *net, 6169 const struct nft_set *set, 6170 const struct nft_set_elem *elem) 6171 { 6172 struct nft_set_elem_catchall *catchall, *next; 6173 6174 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 6175 if (catchall->elem == elem->priv) { 6176 list_del_rcu(&catchall->list); 6177 kfree_rcu(catchall, rcu); 6178 break; 6179 } 6180 } 6181 } 6182 6183 static void nft_setelem_remove(const struct net *net, 6184 const struct nft_set *set, 6185 const struct nft_set_elem *elem) 6186 { 6187 if (nft_setelem_is_catchall(set, elem)) 6188 nft_setelem_catchall_remove(net, set, elem); 6189 else 6190 set->ops->remove(net, set, elem); 6191 } 6192 6193 static bool nft_setelem_valid_key_end(const struct nft_set *set, 6194 struct nlattr **nla, u32 flags) 6195 { 6196 if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) == 6197 (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { 6198 if (flags & NFT_SET_ELEM_INTERVAL_END) 6199 return false; 6200 6201 if (nla[NFTA_SET_ELEM_KEY_END] && 6202 flags & NFT_SET_ELEM_CATCHALL) 6203 return false; 6204 } else { 6205 if (nla[NFTA_SET_ELEM_KEY_END]) 6206 return false; 6207 } 6208 6209 return true; 6210 } 6211 6212 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 6213 const struct nlattr *attr, u32 nlmsg_flags) 6214 { 6215 struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {}; 6216 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6217 u8 genmask = nft_genmask_next(ctx->net); 6218 u32 flags = 0, size = 0, num_exprs = 0; 6219 struct nft_set_ext_tmpl tmpl; 6220 struct nft_set_ext *ext, *ext2; 6221 struct nft_set_elem elem; 6222 struct nft_set_binding *binding; 6223 struct nft_object *obj = NULL; 6224 struct nft_userdata *udata; 6225 struct nft_data_desc desc; 6226 enum nft_registers dreg; 6227 struct nft_trans *trans; 6228 u64 timeout; 6229 u64 expiration; 6230 int err, i; 6231 u8 ulen; 6232 6233 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6234 nft_set_elem_policy, NULL); 6235 if (err < 0) 6236 return err; 6237 6238 nft_set_ext_prepare(&tmpl); 6239 6240 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6241 if (err < 0) 6242 return err; 6243 6244 if (((flags & NFT_SET_ELEM_CATCHALL) && nla[NFTA_SET_ELEM_KEY]) || 6245 (!(flags & NFT_SET_ELEM_CATCHALL) && !nla[NFTA_SET_ELEM_KEY])) 6246 return -EINVAL; 6247 6248 if (flags != 0) { 6249 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 6250 if (err < 0) 6251 return err; 6252 } 6253 6254 if (set->flags & NFT_SET_MAP) { 6255 if (nla[NFTA_SET_ELEM_DATA] == NULL && 6256 !(flags & NFT_SET_ELEM_INTERVAL_END)) 6257 return -EINVAL; 6258 } else { 6259 if (nla[NFTA_SET_ELEM_DATA] != NULL) 6260 return -EINVAL; 6261 } 6262 6263 if (set->flags & NFT_SET_OBJECT) { 6264 if (!nla[NFTA_SET_ELEM_OBJREF] && 6265 !(flags & NFT_SET_ELEM_INTERVAL_END)) 6266 return -EINVAL; 6267 } else { 6268 if (nla[NFTA_SET_ELEM_OBJREF]) 6269 return -EINVAL; 6270 } 6271 6272 if (!nft_setelem_valid_key_end(set, nla, flags)) 6273 return -EINVAL; 6274 6275 if ((flags & NFT_SET_ELEM_INTERVAL_END) && 6276 (nla[NFTA_SET_ELEM_DATA] || 6277 nla[NFTA_SET_ELEM_OBJREF] || 6278 nla[NFTA_SET_ELEM_TIMEOUT] || 6279 nla[NFTA_SET_ELEM_EXPIRATION] || 6280 nla[NFTA_SET_ELEM_USERDATA] || 6281 nla[NFTA_SET_ELEM_EXPR] || 6282 nla[NFTA_SET_ELEM_KEY_END] || 6283 nla[NFTA_SET_ELEM_EXPRESSIONS])) 6284 return -EINVAL; 6285 6286 timeout = 0; 6287 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 6288 if (!(set->flags & NFT_SET_TIMEOUT)) 6289 return -EINVAL; 6290 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT], 6291 &timeout); 6292 if (err) 6293 return err; 6294 } else if (set->flags & NFT_SET_TIMEOUT && 6295 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6296 timeout = READ_ONCE(set->timeout); 6297 } 6298 6299 expiration = 0; 6300 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) { 6301 if (!(set->flags & NFT_SET_TIMEOUT)) 6302 return -EINVAL; 6303 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION], 6304 &expiration); 6305 if (err) 6306 return err; 6307 } 6308 6309 if (nla[NFTA_SET_ELEM_EXPR]) { 6310 struct nft_expr *expr; 6311 6312 if (set->num_exprs && set->num_exprs != 1) 6313 return -EOPNOTSUPP; 6314 6315 expr = nft_set_elem_expr_alloc(ctx, set, 6316 nla[NFTA_SET_ELEM_EXPR]); 6317 if (IS_ERR(expr)) 6318 return PTR_ERR(expr); 6319 6320 expr_array[0] = expr; 6321 num_exprs = 1; 6322 6323 if (set->num_exprs && set->exprs[0]->ops != expr->ops) { 6324 err = -EOPNOTSUPP; 6325 goto err_set_elem_expr; 6326 } 6327 } else if (nla[NFTA_SET_ELEM_EXPRESSIONS]) { 6328 struct nft_expr *expr; 6329 struct nlattr *tmp; 6330 int left; 6331 6332 i = 0; 6333 nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) { 6334 if (i == NFT_SET_EXPR_MAX || 6335 (set->num_exprs && set->num_exprs == i)) { 6336 err = -E2BIG; 6337 goto err_set_elem_expr; 6338 } 6339 if (nla_type(tmp) != NFTA_LIST_ELEM) { 6340 err = -EINVAL; 6341 goto err_set_elem_expr; 6342 } 6343 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 6344 if (IS_ERR(expr)) { 6345 err = PTR_ERR(expr); 6346 goto err_set_elem_expr; 6347 } 6348 expr_array[i] = expr; 6349 num_exprs++; 6350 6351 if (set->num_exprs && expr->ops != set->exprs[i]->ops) { 6352 err = -EOPNOTSUPP; 6353 goto err_set_elem_expr; 6354 } 6355 i++; 6356 } 6357 if (set->num_exprs && set->num_exprs != i) { 6358 err = -EOPNOTSUPP; 6359 goto err_set_elem_expr; 6360 } 6361 } else if (set->num_exprs > 0 && 6362 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6363 err = nft_set_elem_expr_clone(ctx, set, expr_array); 6364 if (err < 0) 6365 goto err_set_elem_expr_clone; 6366 6367 num_exprs = set->num_exprs; 6368 } 6369 6370 if (nla[NFTA_SET_ELEM_KEY]) { 6371 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6372 nla[NFTA_SET_ELEM_KEY]); 6373 if (err < 0) 6374 goto err_set_elem_expr; 6375 6376 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 6377 if (err < 0) 6378 goto err_parse_key; 6379 } 6380 6381 if (nla[NFTA_SET_ELEM_KEY_END]) { 6382 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6383 nla[NFTA_SET_ELEM_KEY_END]); 6384 if (err < 0) 6385 goto err_parse_key; 6386 6387 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 6388 if (err < 0) 6389 goto err_parse_key_end; 6390 } 6391 6392 if (timeout > 0) { 6393 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); 6394 if (err < 0) 6395 goto err_parse_key_end; 6396 6397 if (timeout != READ_ONCE(set->timeout)) { 6398 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 6399 if (err < 0) 6400 goto err_parse_key_end; 6401 } 6402 } 6403 6404 if (num_exprs) { 6405 for (i = 0; i < num_exprs; i++) 6406 size += expr_array[i]->ops->size; 6407 6408 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, 6409 sizeof(struct nft_set_elem_expr) + size); 6410 if (err < 0) 6411 goto err_parse_key_end; 6412 } 6413 6414 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { 6415 obj = nft_obj_lookup(ctx->net, ctx->table, 6416 nla[NFTA_SET_ELEM_OBJREF], 6417 set->objtype, genmask); 6418 if (IS_ERR(obj)) { 6419 err = PTR_ERR(obj); 6420 goto err_parse_key_end; 6421 } 6422 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); 6423 if (err < 0) 6424 goto err_parse_key_end; 6425 } 6426 6427 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 6428 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val, 6429 nla[NFTA_SET_ELEM_DATA]); 6430 if (err < 0) 6431 goto err_parse_key_end; 6432 6433 dreg = nft_type_to_reg(set->dtype); 6434 list_for_each_entry(binding, &set->bindings, list) { 6435 struct nft_ctx bind_ctx = { 6436 .net = ctx->net, 6437 .family = ctx->family, 6438 .table = ctx->table, 6439 .chain = (struct nft_chain *)binding->chain, 6440 }; 6441 6442 if (!(binding->flags & NFT_SET_MAP)) 6443 continue; 6444 6445 err = nft_validate_register_store(&bind_ctx, dreg, 6446 &elem.data.val, 6447 desc.type, desc.len); 6448 if (err < 0) 6449 goto err_parse_data; 6450 6451 if (desc.type == NFT_DATA_VERDICT && 6452 (elem.data.val.verdict.code == NFT_GOTO || 6453 elem.data.val.verdict.code == NFT_JUMP)) 6454 nft_validate_state_update(ctx->table, 6455 NFT_VALIDATE_NEED); 6456 } 6457 6458 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); 6459 if (err < 0) 6460 goto err_parse_data; 6461 } 6462 6463 /* The full maximum length of userdata can exceed the maximum 6464 * offset value (U8_MAX) for following extensions, therefor it 6465 * must be the last extension added. 6466 */ 6467 ulen = 0; 6468 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 6469 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 6470 if (ulen > 0) { 6471 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 6472 ulen); 6473 if (err < 0) 6474 goto err_parse_data; 6475 } 6476 } 6477 6478 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 6479 elem.key_end.val.data, elem.data.val.data, 6480 timeout, expiration, GFP_KERNEL_ACCOUNT); 6481 if (IS_ERR(elem.priv)) { 6482 err = PTR_ERR(elem.priv); 6483 goto err_parse_data; 6484 } 6485 6486 ext = nft_set_elem_ext(set, elem.priv); 6487 if (flags) 6488 *nft_set_ext_flags(ext) = flags; 6489 6490 if (ulen > 0) { 6491 if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) { 6492 err = -EINVAL; 6493 goto err_elem_userdata; 6494 } 6495 udata = nft_set_ext_userdata(ext); 6496 udata->len = ulen - 1; 6497 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 6498 } 6499 if (obj) { 6500 *nft_set_ext_obj(ext) = obj; 6501 obj->use++; 6502 } 6503 err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs); 6504 if (err < 0) 6505 goto err_elem_free; 6506 6507 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 6508 if (trans == NULL) { 6509 err = -ENOMEM; 6510 goto err_elem_free; 6511 } 6512 6513 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK; 6514 6515 err = nft_setelem_insert(ctx->net, set, &elem, &ext2, flags); 6516 if (err) { 6517 if (err == -EEXIST) { 6518 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ 6519 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || 6520 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ 6521 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) 6522 goto err_element_clash; 6523 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6524 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && 6525 memcmp(nft_set_ext_data(ext), 6526 nft_set_ext_data(ext2), set->dlen) != 0) || 6527 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 6528 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) && 6529 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) 6530 goto err_element_clash; 6531 else if (!(nlmsg_flags & NLM_F_EXCL)) 6532 err = 0; 6533 } else if (err == -ENOTEMPTY) { 6534 /* ENOTEMPTY reports overlapping between this element 6535 * and an existing one. 6536 */ 6537 err = -EEXIST; 6538 } 6539 goto err_element_clash; 6540 } 6541 6542 if (!(flags & NFT_SET_ELEM_CATCHALL) && set->size && 6543 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) { 6544 err = -ENFILE; 6545 goto err_set_full; 6546 } 6547 6548 nft_trans_elem(trans) = elem; 6549 nft_trans_commit_list_add_tail(ctx->net, trans); 6550 return 0; 6551 6552 err_set_full: 6553 nft_setelem_remove(ctx->net, set, &elem); 6554 err_element_clash: 6555 kfree(trans); 6556 err_elem_free: 6557 if (obj) 6558 obj->use--; 6559 err_elem_userdata: 6560 nf_tables_set_elem_destroy(ctx, set, elem.priv); 6561 err_parse_data: 6562 if (nla[NFTA_SET_ELEM_DATA] != NULL) 6563 nft_data_release(&elem.data.val, desc.type); 6564 err_parse_key_end: 6565 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 6566 err_parse_key: 6567 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 6568 err_set_elem_expr: 6569 for (i = 0; i < num_exprs && expr_array[i]; i++) 6570 nft_expr_destroy(ctx, expr_array[i]); 6571 err_set_elem_expr_clone: 6572 return err; 6573 } 6574 6575 static int nf_tables_newsetelem(struct sk_buff *skb, 6576 const struct nfnl_info *info, 6577 const struct nlattr * const nla[]) 6578 { 6579 struct netlink_ext_ack *extack = info->extack; 6580 u8 genmask = nft_genmask_next(info->net); 6581 u8 family = info->nfmsg->nfgen_family; 6582 struct net *net = info->net; 6583 const struct nlattr *attr; 6584 struct nft_table *table; 6585 struct nft_set *set; 6586 struct nft_ctx ctx; 6587 int rem, err; 6588 6589 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 6590 return -EINVAL; 6591 6592 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6593 genmask, NETLINK_CB(skb).portid); 6594 if (IS_ERR(table)) { 6595 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6596 return PTR_ERR(table); 6597 } 6598 6599 set = nft_set_lookup_global(net, table, nla[NFTA_SET_ELEM_LIST_SET], 6600 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask); 6601 if (IS_ERR(set)) 6602 return PTR_ERR(set); 6603 6604 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 6605 return -EBUSY; 6606 6607 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6608 6609 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6610 err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags); 6611 if (err < 0) { 6612 NL_SET_BAD_ATTR(extack, attr); 6613 return err; 6614 } 6615 } 6616 6617 if (table->validate_state == NFT_VALIDATE_DO) 6618 return nft_table_validate(net, table); 6619 6620 return 0; 6621 } 6622 6623 /** 6624 * nft_data_hold - hold a nft_data item 6625 * 6626 * @data: struct nft_data to release 6627 * @type: type of data 6628 * 6629 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded, 6630 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and 6631 * NFT_GOTO verdicts. This function must be called on active data objects 6632 * from the second phase of the commit protocol. 6633 */ 6634 void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 6635 { 6636 struct nft_chain *chain; 6637 struct nft_rule *rule; 6638 6639 if (type == NFT_DATA_VERDICT) { 6640 switch (data->verdict.code) { 6641 case NFT_JUMP: 6642 case NFT_GOTO: 6643 chain = data->verdict.chain; 6644 chain->use++; 6645 6646 if (!nft_chain_is_bound(chain)) 6647 break; 6648 6649 chain->table->use++; 6650 list_for_each_entry(rule, &chain->rules, list) 6651 chain->use++; 6652 6653 nft_chain_add(chain->table, chain); 6654 break; 6655 } 6656 } 6657 } 6658 6659 static void nft_setelem_data_activate(const struct net *net, 6660 const struct nft_set *set, 6661 struct nft_set_elem *elem) 6662 { 6663 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6664 6665 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6666 nft_data_hold(nft_set_ext_data(ext), set->dtype); 6667 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6668 (*nft_set_ext_obj(ext))->use++; 6669 } 6670 6671 static void nft_setelem_data_deactivate(const struct net *net, 6672 const struct nft_set *set, 6673 struct nft_set_elem *elem) 6674 { 6675 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6676 6677 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6678 nft_data_release(nft_set_ext_data(ext), set->dtype); 6679 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6680 (*nft_set_ext_obj(ext))->use--; 6681 } 6682 6683 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 6684 const struct nlattr *attr) 6685 { 6686 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6687 struct nft_set_ext_tmpl tmpl; 6688 struct nft_set_elem elem; 6689 struct nft_set_ext *ext; 6690 struct nft_trans *trans; 6691 u32 flags = 0; 6692 int err; 6693 6694 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6695 nft_set_elem_policy, NULL); 6696 if (err < 0) 6697 return err; 6698 6699 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6700 if (err < 0) 6701 return err; 6702 6703 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 6704 return -EINVAL; 6705 6706 if (!nft_setelem_valid_key_end(set, nla, flags)) 6707 return -EINVAL; 6708 6709 nft_set_ext_prepare(&tmpl); 6710 6711 if (flags != 0) { 6712 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 6713 if (err < 0) 6714 return err; 6715 } 6716 6717 if (nla[NFTA_SET_ELEM_KEY]) { 6718 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6719 nla[NFTA_SET_ELEM_KEY]); 6720 if (err < 0) 6721 return err; 6722 6723 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 6724 if (err < 0) 6725 goto fail_elem; 6726 } 6727 6728 if (nla[NFTA_SET_ELEM_KEY_END]) { 6729 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6730 nla[NFTA_SET_ELEM_KEY_END]); 6731 if (err < 0) 6732 goto fail_elem; 6733 6734 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 6735 if (err < 0) 6736 goto fail_elem_key_end; 6737 } 6738 6739 err = -ENOMEM; 6740 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 6741 elem.key_end.val.data, NULL, 0, 0, 6742 GFP_KERNEL_ACCOUNT); 6743 if (IS_ERR(elem.priv)) { 6744 err = PTR_ERR(elem.priv); 6745 goto fail_elem_key_end; 6746 } 6747 6748 ext = nft_set_elem_ext(set, elem.priv); 6749 if (flags) 6750 *nft_set_ext_flags(ext) = flags; 6751 6752 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 6753 if (trans == NULL) 6754 goto fail_trans; 6755 6756 err = nft_setelem_deactivate(ctx->net, set, &elem, flags); 6757 if (err < 0) 6758 goto fail_ops; 6759 6760 nft_setelem_data_deactivate(ctx->net, set, &elem); 6761 6762 nft_trans_elem(trans) = elem; 6763 nft_trans_commit_list_add_tail(ctx->net, trans); 6764 return 0; 6765 6766 fail_ops: 6767 kfree(trans); 6768 fail_trans: 6769 kfree(elem.priv); 6770 fail_elem_key_end: 6771 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 6772 fail_elem: 6773 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 6774 return err; 6775 } 6776 6777 static int nft_setelem_flush(const struct nft_ctx *ctx, 6778 struct nft_set *set, 6779 const struct nft_set_iter *iter, 6780 struct nft_set_elem *elem) 6781 { 6782 struct nft_trans *trans; 6783 int err; 6784 6785 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 6786 sizeof(struct nft_trans_elem), GFP_ATOMIC); 6787 if (!trans) 6788 return -ENOMEM; 6789 6790 if (!set->ops->flush(ctx->net, set, elem->priv)) { 6791 err = -ENOENT; 6792 goto err1; 6793 } 6794 set->ndeact++; 6795 6796 nft_setelem_data_deactivate(ctx->net, set, elem); 6797 nft_trans_elem_set(trans) = set; 6798 nft_trans_elem(trans) = *elem; 6799 nft_trans_commit_list_add_tail(ctx->net, trans); 6800 6801 return 0; 6802 err1: 6803 kfree(trans); 6804 return err; 6805 } 6806 6807 static int __nft_set_catchall_flush(const struct nft_ctx *ctx, 6808 struct nft_set *set, 6809 struct nft_set_elem *elem) 6810 { 6811 struct nft_trans *trans; 6812 6813 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 6814 sizeof(struct nft_trans_elem), GFP_KERNEL); 6815 if (!trans) 6816 return -ENOMEM; 6817 6818 nft_setelem_data_deactivate(ctx->net, set, elem); 6819 nft_trans_elem_set(trans) = set; 6820 nft_trans_elem(trans) = *elem; 6821 nft_trans_commit_list_add_tail(ctx->net, trans); 6822 6823 return 0; 6824 } 6825 6826 static int nft_set_catchall_flush(const struct nft_ctx *ctx, 6827 struct nft_set *set) 6828 { 6829 u8 genmask = nft_genmask_next(ctx->net); 6830 struct nft_set_elem_catchall *catchall; 6831 struct nft_set_elem elem; 6832 struct nft_set_ext *ext; 6833 int ret = 0; 6834 6835 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6836 ext = nft_set_elem_ext(set, catchall->elem); 6837 if (!nft_set_elem_active(ext, genmask) || 6838 nft_set_elem_mark_busy(ext)) 6839 continue; 6840 6841 elem.priv = catchall->elem; 6842 ret = __nft_set_catchall_flush(ctx, set, &elem); 6843 if (ret < 0) 6844 break; 6845 } 6846 6847 return ret; 6848 } 6849 6850 static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) 6851 { 6852 struct nft_set_iter iter = { 6853 .genmask = genmask, 6854 .fn = nft_setelem_flush, 6855 }; 6856 6857 set->ops->walk(ctx, set, &iter); 6858 if (!iter.err) 6859 iter.err = nft_set_catchall_flush(ctx, set); 6860 6861 return iter.err; 6862 } 6863 6864 static int nf_tables_delsetelem(struct sk_buff *skb, 6865 const struct nfnl_info *info, 6866 const struct nlattr * const nla[]) 6867 { 6868 struct netlink_ext_ack *extack = info->extack; 6869 u8 genmask = nft_genmask_next(info->net); 6870 u8 family = info->nfmsg->nfgen_family; 6871 struct net *net = info->net; 6872 const struct nlattr *attr; 6873 struct nft_table *table; 6874 struct nft_set *set; 6875 struct nft_ctx ctx; 6876 int rem, err = 0; 6877 6878 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6879 genmask, NETLINK_CB(skb).portid); 6880 if (IS_ERR(table)) { 6881 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6882 return PTR_ERR(table); 6883 } 6884 6885 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 6886 if (IS_ERR(set)) 6887 return PTR_ERR(set); 6888 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 6889 return -EBUSY; 6890 6891 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6892 6893 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6894 return nft_set_flush(&ctx, set, genmask); 6895 6896 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6897 err = nft_del_setelem(&ctx, set, attr); 6898 if (err == -ENOENT && 6899 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSETELEM) 6900 continue; 6901 6902 if (err < 0) { 6903 NL_SET_BAD_ATTR(extack, attr); 6904 break; 6905 } 6906 } 6907 return err; 6908 } 6909 6910 void nft_set_gc_batch_release(struct rcu_head *rcu) 6911 { 6912 struct nft_set_gc_batch *gcb; 6913 unsigned int i; 6914 6915 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu); 6916 for (i = 0; i < gcb->head.cnt; i++) 6917 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true); 6918 kfree(gcb); 6919 } 6920 6921 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set, 6922 gfp_t gfp) 6923 { 6924 struct nft_set_gc_batch *gcb; 6925 6926 gcb = kzalloc(sizeof(*gcb), gfp); 6927 if (gcb == NULL) 6928 return gcb; 6929 gcb->head.set = set; 6930 return gcb; 6931 } 6932 6933 /* 6934 * Stateful objects 6935 */ 6936 6937 /** 6938 * nft_register_obj- register nf_tables stateful object type 6939 * @obj_type: object type 6940 * 6941 * Registers the object type for use with nf_tables. Returns zero on 6942 * success or a negative errno code otherwise. 6943 */ 6944 int nft_register_obj(struct nft_object_type *obj_type) 6945 { 6946 if (obj_type->type == NFT_OBJECT_UNSPEC) 6947 return -EINVAL; 6948 6949 nfnl_lock(NFNL_SUBSYS_NFTABLES); 6950 list_add_rcu(&obj_type->list, &nf_tables_objects); 6951 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 6952 return 0; 6953 } 6954 EXPORT_SYMBOL_GPL(nft_register_obj); 6955 6956 /** 6957 * nft_unregister_obj - unregister nf_tables object type 6958 * @obj_type: object type 6959 * 6960 * Unregisters the object type for use with nf_tables. 6961 */ 6962 void nft_unregister_obj(struct nft_object_type *obj_type) 6963 { 6964 nfnl_lock(NFNL_SUBSYS_NFTABLES); 6965 list_del_rcu(&obj_type->list); 6966 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 6967 } 6968 EXPORT_SYMBOL_GPL(nft_unregister_obj); 6969 6970 struct nft_object *nft_obj_lookup(const struct net *net, 6971 const struct nft_table *table, 6972 const struct nlattr *nla, u32 objtype, 6973 u8 genmask) 6974 { 6975 struct nft_object_hash_key k = { .table = table }; 6976 char search[NFT_OBJ_MAXNAMELEN]; 6977 struct rhlist_head *tmp, *list; 6978 struct nft_object *obj; 6979 6980 nla_strscpy(search, nla, sizeof(search)); 6981 k.name = search; 6982 6983 WARN_ON_ONCE(!rcu_read_lock_held() && 6984 !lockdep_commit_lock_is_held(net)); 6985 6986 rcu_read_lock(); 6987 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params); 6988 if (!list) 6989 goto out; 6990 6991 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) { 6992 if (objtype == obj->ops->type->type && 6993 nft_active_genmask(obj, genmask)) { 6994 rcu_read_unlock(); 6995 return obj; 6996 } 6997 } 6998 out: 6999 rcu_read_unlock(); 7000 return ERR_PTR(-ENOENT); 7001 } 7002 EXPORT_SYMBOL_GPL(nft_obj_lookup); 7003 7004 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table, 7005 const struct nlattr *nla, 7006 u32 objtype, u8 genmask) 7007 { 7008 struct nft_object *obj; 7009 7010 list_for_each_entry(obj, &table->objects, list) { 7011 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && 7012 objtype == obj->ops->type->type && 7013 nft_active_genmask(obj, genmask)) 7014 return obj; 7015 } 7016 return ERR_PTR(-ENOENT); 7017 } 7018 7019 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 7020 [NFTA_OBJ_TABLE] = { .type = NLA_STRING, 7021 .len = NFT_TABLE_MAXNAMELEN - 1 }, 7022 [NFTA_OBJ_NAME] = { .type = NLA_STRING, 7023 .len = NFT_OBJ_MAXNAMELEN - 1 }, 7024 [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, 7025 [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, 7026 [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, 7027 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY, 7028 .len = NFT_USERDATA_MAXLEN }, 7029 }; 7030 7031 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 7032 const struct nft_object_type *type, 7033 const struct nlattr *attr) 7034 { 7035 struct nlattr **tb; 7036 const struct nft_object_ops *ops; 7037 struct nft_object *obj; 7038 int err = -ENOMEM; 7039 7040 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL); 7041 if (!tb) 7042 goto err1; 7043 7044 if (attr) { 7045 err = nla_parse_nested_deprecated(tb, type->maxattr, attr, 7046 type->policy, NULL); 7047 if (err < 0) 7048 goto err2; 7049 } else { 7050 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); 7051 } 7052 7053 if (type->select_ops) { 7054 ops = type->select_ops(ctx, (const struct nlattr * const *)tb); 7055 if (IS_ERR(ops)) { 7056 err = PTR_ERR(ops); 7057 goto err2; 7058 } 7059 } else { 7060 ops = type->ops; 7061 } 7062 7063 err = -ENOMEM; 7064 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT); 7065 if (!obj) 7066 goto err2; 7067 7068 err = ops->init(ctx, (const struct nlattr * const *)tb, obj); 7069 if (err < 0) 7070 goto err3; 7071 7072 obj->ops = ops; 7073 7074 kfree(tb); 7075 return obj; 7076 err3: 7077 kfree(obj); 7078 err2: 7079 kfree(tb); 7080 err1: 7081 return ERR_PTR(err); 7082 } 7083 7084 static int nft_object_dump(struct sk_buff *skb, unsigned int attr, 7085 struct nft_object *obj, bool reset) 7086 { 7087 struct nlattr *nest; 7088 7089 nest = nla_nest_start_noflag(skb, attr); 7090 if (!nest) 7091 goto nla_put_failure; 7092 if (obj->ops->dump(skb, obj, reset) < 0) 7093 goto nla_put_failure; 7094 nla_nest_end(skb, nest); 7095 return 0; 7096 7097 nla_put_failure: 7098 return -1; 7099 } 7100 7101 static const struct nft_object_type *__nft_obj_type_get(u32 objtype) 7102 { 7103 const struct nft_object_type *type; 7104 7105 list_for_each_entry(type, &nf_tables_objects, list) { 7106 if (objtype == type->type) 7107 return type; 7108 } 7109 return NULL; 7110 } 7111 7112 static const struct nft_object_type * 7113 nft_obj_type_get(struct net *net, u32 objtype) 7114 { 7115 const struct nft_object_type *type; 7116 7117 type = __nft_obj_type_get(objtype); 7118 if (type != NULL && try_module_get(type->owner)) 7119 return type; 7120 7121 lockdep_nfnl_nft_mutex_not_held(); 7122 #ifdef CONFIG_MODULES 7123 if (type == NULL) { 7124 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN) 7125 return ERR_PTR(-EAGAIN); 7126 } 7127 #endif 7128 return ERR_PTR(-ENOENT); 7129 } 7130 7131 static int nf_tables_updobj(const struct nft_ctx *ctx, 7132 const struct nft_object_type *type, 7133 const struct nlattr *attr, 7134 struct nft_object *obj) 7135 { 7136 struct nft_object *newobj; 7137 struct nft_trans *trans; 7138 int err = -ENOMEM; 7139 7140 if (!try_module_get(type->owner)) 7141 return -ENOENT; 7142 7143 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, 7144 sizeof(struct nft_trans_obj)); 7145 if (!trans) 7146 goto err_trans; 7147 7148 newobj = nft_obj_init(ctx, type, attr); 7149 if (IS_ERR(newobj)) { 7150 err = PTR_ERR(newobj); 7151 goto err_free_trans; 7152 } 7153 7154 nft_trans_obj(trans) = obj; 7155 nft_trans_obj_update(trans) = true; 7156 nft_trans_obj_newobj(trans) = newobj; 7157 nft_trans_commit_list_add_tail(ctx->net, trans); 7158 7159 return 0; 7160 7161 err_free_trans: 7162 kfree(trans); 7163 err_trans: 7164 module_put(type->owner); 7165 return err; 7166 } 7167 7168 static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, 7169 const struct nlattr * const nla[]) 7170 { 7171 struct netlink_ext_ack *extack = info->extack; 7172 u8 genmask = nft_genmask_next(info->net); 7173 u8 family = info->nfmsg->nfgen_family; 7174 const struct nft_object_type *type; 7175 struct net *net = info->net; 7176 struct nft_table *table; 7177 struct nft_object *obj; 7178 struct nft_ctx ctx; 7179 u32 objtype; 7180 int err; 7181 7182 if (!nla[NFTA_OBJ_TYPE] || 7183 !nla[NFTA_OBJ_NAME] || 7184 !nla[NFTA_OBJ_DATA]) 7185 return -EINVAL; 7186 7187 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 7188 NETLINK_CB(skb).portid); 7189 if (IS_ERR(table)) { 7190 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7191 return PTR_ERR(table); 7192 } 7193 7194 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7195 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 7196 if (IS_ERR(obj)) { 7197 err = PTR_ERR(obj); 7198 if (err != -ENOENT) { 7199 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7200 return err; 7201 } 7202 } else { 7203 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 7204 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7205 return -EEXIST; 7206 } 7207 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 7208 return -EOPNOTSUPP; 7209 7210 type = __nft_obj_type_get(objtype); 7211 if (WARN_ON_ONCE(!type)) 7212 return -ENOENT; 7213 7214 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7215 7216 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); 7217 } 7218 7219 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7220 7221 type = nft_obj_type_get(net, objtype); 7222 if (IS_ERR(type)) 7223 return PTR_ERR(type); 7224 7225 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]); 7226 if (IS_ERR(obj)) { 7227 err = PTR_ERR(obj); 7228 goto err_init; 7229 } 7230 obj->key.table = table; 7231 obj->handle = nf_tables_alloc_handle(table); 7232 7233 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT); 7234 if (!obj->key.name) { 7235 err = -ENOMEM; 7236 goto err_strdup; 7237 } 7238 7239 if (nla[NFTA_OBJ_USERDATA]) { 7240 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL_ACCOUNT); 7241 if (obj->udata == NULL) 7242 goto err_userdata; 7243 7244 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]); 7245 } 7246 7247 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj); 7248 if (err < 0) 7249 goto err_trans; 7250 7251 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead, 7252 nft_objname_ht_params); 7253 if (err < 0) 7254 goto err_obj_ht; 7255 7256 list_add_tail_rcu(&obj->list, &table->objects); 7257 table->use++; 7258 return 0; 7259 err_obj_ht: 7260 /* queued in transaction log */ 7261 INIT_LIST_HEAD(&obj->list); 7262 return err; 7263 err_trans: 7264 kfree(obj->udata); 7265 err_userdata: 7266 kfree(obj->key.name); 7267 err_strdup: 7268 if (obj->ops->destroy) 7269 obj->ops->destroy(&ctx, obj); 7270 kfree(obj); 7271 err_init: 7272 module_put(type->owner); 7273 return err; 7274 } 7275 7276 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 7277 u32 portid, u32 seq, int event, u32 flags, 7278 int family, const struct nft_table *table, 7279 struct nft_object *obj, bool reset) 7280 { 7281 struct nlmsghdr *nlh; 7282 7283 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 7284 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 7285 NFNETLINK_V0, nft_base_seq(net)); 7286 if (!nlh) 7287 goto nla_put_failure; 7288 7289 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || 7290 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || 7291 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), 7292 NFTA_OBJ_PAD)) 7293 goto nla_put_failure; 7294 7295 if (event == NFT_MSG_DELOBJ) { 7296 nlmsg_end(skb, nlh); 7297 return 0; 7298 } 7299 7300 if (nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || 7301 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || 7302 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset)) 7303 goto nla_put_failure; 7304 7305 if (obj->udata && 7306 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata)) 7307 goto nla_put_failure; 7308 7309 nlmsg_end(skb, nlh); 7310 return 0; 7311 7312 nla_put_failure: 7313 nlmsg_trim(skb, nlh); 7314 return -1; 7315 } 7316 7317 struct nft_obj_filter { 7318 char *table; 7319 u32 type; 7320 }; 7321 7322 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) 7323 { 7324 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 7325 const struct nft_table *table; 7326 unsigned int idx = 0, s_idx = cb->args[0]; 7327 struct nft_obj_filter *filter = cb->data; 7328 struct net *net = sock_net(skb->sk); 7329 int family = nfmsg->nfgen_family; 7330 struct nftables_pernet *nft_net; 7331 struct nft_object *obj; 7332 bool reset = false; 7333 7334 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7335 reset = true; 7336 7337 rcu_read_lock(); 7338 nft_net = nft_pernet(net); 7339 cb->seq = READ_ONCE(nft_net->base_seq); 7340 7341 list_for_each_entry_rcu(table, &nft_net->tables, list) { 7342 if (family != NFPROTO_UNSPEC && family != table->family) 7343 continue; 7344 7345 list_for_each_entry_rcu(obj, &table->objects, list) { 7346 if (!nft_is_active(net, obj)) 7347 goto cont; 7348 if (idx < s_idx) 7349 goto cont; 7350 if (idx > s_idx) 7351 memset(&cb->args[1], 0, 7352 sizeof(cb->args) - sizeof(cb->args[0])); 7353 if (filter && filter->table && 7354 strcmp(filter->table, table->name)) 7355 goto cont; 7356 if (filter && 7357 filter->type != NFT_OBJECT_UNSPEC && 7358 obj->ops->type->type != filter->type) 7359 goto cont; 7360 if (reset) { 7361 char *buf = kasprintf(GFP_ATOMIC, 7362 "%s:%u", 7363 table->name, 7364 nft_net->base_seq); 7365 7366 audit_log_nfcfg(buf, 7367 family, 7368 obj->handle, 7369 AUDIT_NFT_OP_OBJ_RESET, 7370 GFP_ATOMIC); 7371 kfree(buf); 7372 } 7373 7374 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, 7375 cb->nlh->nlmsg_seq, 7376 NFT_MSG_NEWOBJ, 7377 NLM_F_MULTI | NLM_F_APPEND, 7378 table->family, table, 7379 obj, reset) < 0) 7380 goto done; 7381 7382 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 7383 cont: 7384 idx++; 7385 } 7386 } 7387 done: 7388 rcu_read_unlock(); 7389 7390 cb->args[0] = idx; 7391 return skb->len; 7392 } 7393 7394 static int nf_tables_dump_obj_start(struct netlink_callback *cb) 7395 { 7396 const struct nlattr * const *nla = cb->data; 7397 struct nft_obj_filter *filter = NULL; 7398 7399 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) { 7400 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 7401 if (!filter) 7402 return -ENOMEM; 7403 7404 if (nla[NFTA_OBJ_TABLE]) { 7405 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC); 7406 if (!filter->table) { 7407 kfree(filter); 7408 return -ENOMEM; 7409 } 7410 } 7411 7412 if (nla[NFTA_OBJ_TYPE]) 7413 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7414 } 7415 7416 cb->data = filter; 7417 return 0; 7418 } 7419 7420 static int nf_tables_dump_obj_done(struct netlink_callback *cb) 7421 { 7422 struct nft_obj_filter *filter = cb->data; 7423 7424 if (filter) { 7425 kfree(filter->table); 7426 kfree(filter); 7427 } 7428 7429 return 0; 7430 } 7431 7432 /* called with rcu_read_lock held */ 7433 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, 7434 const struct nlattr * const nla[]) 7435 { 7436 struct netlink_ext_ack *extack = info->extack; 7437 u8 genmask = nft_genmask_cur(info->net); 7438 u8 family = info->nfmsg->nfgen_family; 7439 const struct nft_table *table; 7440 struct net *net = info->net; 7441 struct nft_object *obj; 7442 struct sk_buff *skb2; 7443 bool reset = false; 7444 u32 objtype; 7445 int err; 7446 7447 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 7448 struct netlink_dump_control c = { 7449 .start = nf_tables_dump_obj_start, 7450 .dump = nf_tables_dump_obj, 7451 .done = nf_tables_dump_obj_done, 7452 .module = THIS_MODULE, 7453 .data = (void *)nla, 7454 }; 7455 7456 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 7457 } 7458 7459 if (!nla[NFTA_OBJ_NAME] || 7460 !nla[NFTA_OBJ_TYPE]) 7461 return -EINVAL; 7462 7463 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0); 7464 if (IS_ERR(table)) { 7465 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7466 return PTR_ERR(table); 7467 } 7468 7469 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7470 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 7471 if (IS_ERR(obj)) { 7472 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7473 return PTR_ERR(obj); 7474 } 7475 7476 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 7477 if (!skb2) 7478 return -ENOMEM; 7479 7480 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7481 reset = true; 7482 7483 if (reset) { 7484 const struct nftables_pernet *nft_net; 7485 char *buf; 7486 7487 nft_net = nft_pernet(net); 7488 buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq); 7489 7490 audit_log_nfcfg(buf, 7491 family, 7492 obj->handle, 7493 AUDIT_NFT_OP_OBJ_RESET, 7494 GFP_ATOMIC); 7495 kfree(buf); 7496 } 7497 7498 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid, 7499 info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 7500 family, table, obj, reset); 7501 if (err < 0) 7502 goto err_fill_obj_info; 7503 7504 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 7505 7506 err_fill_obj_info: 7507 kfree_skb(skb2); 7508 return err; 7509 } 7510 7511 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) 7512 { 7513 if (obj->ops->destroy) 7514 obj->ops->destroy(ctx, obj); 7515 7516 module_put(obj->ops->type->owner); 7517 kfree(obj->key.name); 7518 kfree(obj->udata); 7519 kfree(obj); 7520 } 7521 7522 static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info, 7523 const struct nlattr * const nla[]) 7524 { 7525 struct netlink_ext_ack *extack = info->extack; 7526 u8 genmask = nft_genmask_next(info->net); 7527 u8 family = info->nfmsg->nfgen_family; 7528 struct net *net = info->net; 7529 const struct nlattr *attr; 7530 struct nft_table *table; 7531 struct nft_object *obj; 7532 struct nft_ctx ctx; 7533 u32 objtype; 7534 7535 if (!nla[NFTA_OBJ_TYPE] || 7536 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) 7537 return -EINVAL; 7538 7539 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 7540 NETLINK_CB(skb).portid); 7541 if (IS_ERR(table)) { 7542 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7543 return PTR_ERR(table); 7544 } 7545 7546 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7547 if (nla[NFTA_OBJ_HANDLE]) { 7548 attr = nla[NFTA_OBJ_HANDLE]; 7549 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask); 7550 } else { 7551 attr = nla[NFTA_OBJ_NAME]; 7552 obj = nft_obj_lookup(net, table, attr, objtype, genmask); 7553 } 7554 7555 if (IS_ERR(obj)) { 7556 if (PTR_ERR(obj) == -ENOENT && 7557 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYOBJ) 7558 return 0; 7559 7560 NL_SET_BAD_ATTR(extack, attr); 7561 return PTR_ERR(obj); 7562 } 7563 if (obj->use > 0) { 7564 NL_SET_BAD_ATTR(extack, attr); 7565 return -EBUSY; 7566 } 7567 7568 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7569 7570 return nft_delobj(&ctx, obj); 7571 } 7572 7573 void nft_obj_notify(struct net *net, const struct nft_table *table, 7574 struct nft_object *obj, u32 portid, u32 seq, int event, 7575 u16 flags, int family, int report, gfp_t gfp) 7576 { 7577 struct nftables_pernet *nft_net = nft_pernet(net); 7578 struct sk_buff *skb; 7579 int err; 7580 char *buf = kasprintf(gfp, "%s:%u", 7581 table->name, nft_net->base_seq); 7582 7583 audit_log_nfcfg(buf, 7584 family, 7585 obj->handle, 7586 event == NFT_MSG_NEWOBJ ? 7587 AUDIT_NFT_OP_OBJ_REGISTER : 7588 AUDIT_NFT_OP_OBJ_UNREGISTER, 7589 gfp); 7590 kfree(buf); 7591 7592 if (!report && 7593 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 7594 return; 7595 7596 skb = nlmsg_new(NLMSG_GOODSIZE, gfp); 7597 if (skb == NULL) 7598 goto err; 7599 7600 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 7601 flags & (NLM_F_CREATE | NLM_F_EXCL), 7602 family, table, obj, false); 7603 if (err < 0) { 7604 kfree_skb(skb); 7605 goto err; 7606 } 7607 7608 nft_notify_enqueue(skb, report, &nft_net->notify_list); 7609 return; 7610 err: 7611 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 7612 } 7613 EXPORT_SYMBOL_GPL(nft_obj_notify); 7614 7615 static void nf_tables_obj_notify(const struct nft_ctx *ctx, 7616 struct nft_object *obj, int event) 7617 { 7618 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, 7619 ctx->flags, ctx->family, ctx->report, GFP_KERNEL); 7620 } 7621 7622 /* 7623 * Flow tables 7624 */ 7625 void nft_register_flowtable_type(struct nf_flowtable_type *type) 7626 { 7627 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7628 list_add_tail_rcu(&type->list, &nf_tables_flowtables); 7629 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7630 } 7631 EXPORT_SYMBOL_GPL(nft_register_flowtable_type); 7632 7633 void nft_unregister_flowtable_type(struct nf_flowtable_type *type) 7634 { 7635 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7636 list_del_rcu(&type->list); 7637 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7638 } 7639 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); 7640 7641 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 7642 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, 7643 .len = NFT_NAME_MAXLEN - 1 }, 7644 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, 7645 .len = NFT_NAME_MAXLEN - 1 }, 7646 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, 7647 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, 7648 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 }, 7649 }; 7650 7651 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table, 7652 const struct nlattr *nla, u8 genmask) 7653 { 7654 struct nft_flowtable *flowtable; 7655 7656 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 7657 if (!nla_strcmp(nla, flowtable->name) && 7658 nft_active_genmask(flowtable, genmask)) 7659 return flowtable; 7660 } 7661 return ERR_PTR(-ENOENT); 7662 } 7663 EXPORT_SYMBOL_GPL(nft_flowtable_lookup); 7664 7665 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, 7666 struct nft_flowtable *flowtable, 7667 enum nft_trans_phase phase) 7668 { 7669 switch (phase) { 7670 case NFT_TRANS_PREPARE: 7671 case NFT_TRANS_ABORT: 7672 case NFT_TRANS_RELEASE: 7673 flowtable->use--; 7674 fallthrough; 7675 default: 7676 return; 7677 } 7678 } 7679 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable); 7680 7681 static struct nft_flowtable * 7682 nft_flowtable_lookup_byhandle(const struct nft_table *table, 7683 const struct nlattr *nla, u8 genmask) 7684 { 7685 struct nft_flowtable *flowtable; 7686 7687 list_for_each_entry(flowtable, &table->flowtables, list) { 7688 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && 7689 nft_active_genmask(flowtable, genmask)) 7690 return flowtable; 7691 } 7692 return ERR_PTR(-ENOENT); 7693 } 7694 7695 struct nft_flowtable_hook { 7696 u32 num; 7697 int priority; 7698 struct list_head list; 7699 }; 7700 7701 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { 7702 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, 7703 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, 7704 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, 7705 }; 7706 7707 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx, 7708 const struct nlattr * const nla[], 7709 struct nft_flowtable_hook *flowtable_hook, 7710 struct nft_flowtable *flowtable, 7711 struct netlink_ext_ack *extack, bool add) 7712 { 7713 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; 7714 struct nft_hook *hook; 7715 int hooknum, priority; 7716 int err; 7717 7718 INIT_LIST_HEAD(&flowtable_hook->list); 7719 7720 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, 7721 nla[NFTA_FLOWTABLE_HOOK], 7722 nft_flowtable_hook_policy, NULL); 7723 if (err < 0) 7724 return err; 7725 7726 if (add) { 7727 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || 7728 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 7729 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 7730 return -ENOENT; 7731 } 7732 7733 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 7734 if (hooknum != NF_NETDEV_INGRESS) 7735 return -EOPNOTSUPP; 7736 7737 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 7738 7739 flowtable_hook->priority = priority; 7740 flowtable_hook->num = hooknum; 7741 } else { 7742 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) { 7743 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 7744 if (hooknum != flowtable->hooknum) 7745 return -EOPNOTSUPP; 7746 } 7747 7748 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 7749 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 7750 if (priority != flowtable->data.priority) 7751 return -EOPNOTSUPP; 7752 } 7753 7754 flowtable_hook->priority = flowtable->data.priority; 7755 flowtable_hook->num = flowtable->hooknum; 7756 } 7757 7758 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) { 7759 err = nf_tables_parse_netdev_hooks(ctx->net, 7760 tb[NFTA_FLOWTABLE_HOOK_DEVS], 7761 &flowtable_hook->list, 7762 extack); 7763 if (err < 0) 7764 return err; 7765 } 7766 7767 list_for_each_entry(hook, &flowtable_hook->list, list) { 7768 hook->ops.pf = NFPROTO_NETDEV; 7769 hook->ops.hooknum = flowtable_hook->num; 7770 hook->ops.priority = flowtable_hook->priority; 7771 hook->ops.priv = &flowtable->data; 7772 hook->ops.hook = flowtable->data.type->hook; 7773 } 7774 7775 return err; 7776 } 7777 7778 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) 7779 { 7780 const struct nf_flowtable_type *type; 7781 7782 list_for_each_entry(type, &nf_tables_flowtables, list) { 7783 if (family == type->family) 7784 return type; 7785 } 7786 return NULL; 7787 } 7788 7789 static const struct nf_flowtable_type * 7790 nft_flowtable_type_get(struct net *net, u8 family) 7791 { 7792 const struct nf_flowtable_type *type; 7793 7794 type = __nft_flowtable_type_get(family); 7795 if (type != NULL && try_module_get(type->owner)) 7796 return type; 7797 7798 lockdep_nfnl_nft_mutex_not_held(); 7799 #ifdef CONFIG_MODULES 7800 if (type == NULL) { 7801 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN) 7802 return ERR_PTR(-EAGAIN); 7803 } 7804 #endif 7805 return ERR_PTR(-ENOENT); 7806 } 7807 7808 /* Only called from error and netdev event paths. */ 7809 static void nft_unregister_flowtable_hook(struct net *net, 7810 struct nft_flowtable *flowtable, 7811 struct nft_hook *hook) 7812 { 7813 nf_unregister_net_hook(net, &hook->ops); 7814 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 7815 FLOW_BLOCK_UNBIND); 7816 } 7817 7818 static void __nft_unregister_flowtable_net_hooks(struct net *net, 7819 struct list_head *hook_list, 7820 bool release_netdev) 7821 { 7822 struct nft_hook *hook, *next; 7823 7824 list_for_each_entry_safe(hook, next, hook_list, list) { 7825 nf_unregister_net_hook(net, &hook->ops); 7826 if (release_netdev) { 7827 list_del(&hook->list); 7828 kfree_rcu(hook, rcu); 7829 } 7830 } 7831 } 7832 7833 static void nft_unregister_flowtable_net_hooks(struct net *net, 7834 struct list_head *hook_list) 7835 { 7836 __nft_unregister_flowtable_net_hooks(net, hook_list, false); 7837 } 7838 7839 static int nft_register_flowtable_net_hooks(struct net *net, 7840 struct nft_table *table, 7841 struct list_head *hook_list, 7842 struct nft_flowtable *flowtable) 7843 { 7844 struct nft_hook *hook, *hook2, *next; 7845 struct nft_flowtable *ft; 7846 int err, i = 0; 7847 7848 list_for_each_entry(hook, hook_list, list) { 7849 list_for_each_entry(ft, &table->flowtables, list) { 7850 if (!nft_is_active_next(net, ft)) 7851 continue; 7852 7853 list_for_each_entry(hook2, &ft->hook_list, list) { 7854 if (hook->ops.dev == hook2->ops.dev && 7855 hook->ops.pf == hook2->ops.pf) { 7856 err = -EEXIST; 7857 goto err_unregister_net_hooks; 7858 } 7859 } 7860 } 7861 7862 err = flowtable->data.type->setup(&flowtable->data, 7863 hook->ops.dev, 7864 FLOW_BLOCK_BIND); 7865 if (err < 0) 7866 goto err_unregister_net_hooks; 7867 7868 err = nf_register_net_hook(net, &hook->ops); 7869 if (err < 0) { 7870 flowtable->data.type->setup(&flowtable->data, 7871 hook->ops.dev, 7872 FLOW_BLOCK_UNBIND); 7873 goto err_unregister_net_hooks; 7874 } 7875 7876 i++; 7877 } 7878 7879 return 0; 7880 7881 err_unregister_net_hooks: 7882 list_for_each_entry_safe(hook, next, hook_list, list) { 7883 if (i-- <= 0) 7884 break; 7885 7886 nft_unregister_flowtable_hook(net, flowtable, hook); 7887 list_del_rcu(&hook->list); 7888 kfree_rcu(hook, rcu); 7889 } 7890 7891 return err; 7892 } 7893 7894 static void nft_hooks_destroy(struct list_head *hook_list) 7895 { 7896 struct nft_hook *hook, *next; 7897 7898 list_for_each_entry_safe(hook, next, hook_list, list) { 7899 list_del_rcu(&hook->list); 7900 kfree_rcu(hook, rcu); 7901 } 7902 } 7903 7904 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, 7905 struct nft_flowtable *flowtable, 7906 struct netlink_ext_ack *extack) 7907 { 7908 const struct nlattr * const *nla = ctx->nla; 7909 struct nft_flowtable_hook flowtable_hook; 7910 struct nft_hook *hook, *next; 7911 struct nft_trans *trans; 7912 bool unregister = false; 7913 u32 flags; 7914 int err; 7915 7916 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 7917 extack, false); 7918 if (err < 0) 7919 return err; 7920 7921 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 7922 if (nft_hook_list_find(&flowtable->hook_list, hook)) { 7923 list_del(&hook->list); 7924 kfree(hook); 7925 } 7926 } 7927 7928 if (nla[NFTA_FLOWTABLE_FLAGS]) { 7929 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 7930 if (flags & ~NFT_FLOWTABLE_MASK) { 7931 err = -EOPNOTSUPP; 7932 goto err_flowtable_update_hook; 7933 } 7934 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ 7935 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) { 7936 err = -EOPNOTSUPP; 7937 goto err_flowtable_update_hook; 7938 } 7939 } else { 7940 flags = flowtable->data.flags; 7941 } 7942 7943 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, 7944 &flowtable_hook.list, flowtable); 7945 if (err < 0) 7946 goto err_flowtable_update_hook; 7947 7948 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE, 7949 sizeof(struct nft_trans_flowtable)); 7950 if (!trans) { 7951 unregister = true; 7952 err = -ENOMEM; 7953 goto err_flowtable_update_hook; 7954 } 7955 7956 nft_trans_flowtable_flags(trans) = flags; 7957 nft_trans_flowtable(trans) = flowtable; 7958 nft_trans_flowtable_update(trans) = true; 7959 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 7960 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans)); 7961 7962 nft_trans_commit_list_add_tail(ctx->net, trans); 7963 7964 return 0; 7965 7966 err_flowtable_update_hook: 7967 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 7968 if (unregister) 7969 nft_unregister_flowtable_hook(ctx->net, flowtable, hook); 7970 list_del_rcu(&hook->list); 7971 kfree_rcu(hook, rcu); 7972 } 7973 7974 return err; 7975 7976 } 7977 7978 static int nf_tables_newflowtable(struct sk_buff *skb, 7979 const struct nfnl_info *info, 7980 const struct nlattr * const nla[]) 7981 { 7982 struct netlink_ext_ack *extack = info->extack; 7983 struct nft_flowtable_hook flowtable_hook; 7984 u8 genmask = nft_genmask_next(info->net); 7985 u8 family = info->nfmsg->nfgen_family; 7986 const struct nf_flowtable_type *type; 7987 struct nft_flowtable *flowtable; 7988 struct nft_hook *hook, *next; 7989 struct net *net = info->net; 7990 struct nft_table *table; 7991 struct nft_ctx ctx; 7992 int err; 7993 7994 if (!nla[NFTA_FLOWTABLE_TABLE] || 7995 !nla[NFTA_FLOWTABLE_NAME] || 7996 !nla[NFTA_FLOWTABLE_HOOK]) 7997 return -EINVAL; 7998 7999 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8000 genmask, NETLINK_CB(skb).portid); 8001 if (IS_ERR(table)) { 8002 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 8003 return PTR_ERR(table); 8004 } 8005 8006 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 8007 genmask); 8008 if (IS_ERR(flowtable)) { 8009 err = PTR_ERR(flowtable); 8010 if (err != -ENOENT) { 8011 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8012 return err; 8013 } 8014 } else { 8015 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 8016 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8017 return -EEXIST; 8018 } 8019 8020 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8021 8022 return nft_flowtable_update(&ctx, info->nlh, flowtable, extack); 8023 } 8024 8025 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8026 8027 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT); 8028 if (!flowtable) 8029 return -ENOMEM; 8030 8031 flowtable->table = table; 8032 flowtable->handle = nf_tables_alloc_handle(table); 8033 INIT_LIST_HEAD(&flowtable->hook_list); 8034 8035 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT); 8036 if (!flowtable->name) { 8037 err = -ENOMEM; 8038 goto err1; 8039 } 8040 8041 type = nft_flowtable_type_get(net, family); 8042 if (IS_ERR(type)) { 8043 err = PTR_ERR(type); 8044 goto err2; 8045 } 8046 8047 if (nla[NFTA_FLOWTABLE_FLAGS]) { 8048 flowtable->data.flags = 8049 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 8050 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { 8051 err = -EOPNOTSUPP; 8052 goto err3; 8053 } 8054 } 8055 8056 write_pnet(&flowtable->data.net, net); 8057 flowtable->data.type = type; 8058 err = type->init(&flowtable->data); 8059 if (err < 0) 8060 goto err3; 8061 8062 err = nft_flowtable_parse_hook(&ctx, nla, &flowtable_hook, flowtable, 8063 extack, true); 8064 if (err < 0) 8065 goto err4; 8066 8067 list_splice(&flowtable_hook.list, &flowtable->hook_list); 8068 flowtable->data.priority = flowtable_hook.priority; 8069 flowtable->hooknum = flowtable_hook.num; 8070 8071 err = nft_register_flowtable_net_hooks(ctx.net, table, 8072 &flowtable->hook_list, 8073 flowtable); 8074 if (err < 0) { 8075 nft_hooks_destroy(&flowtable->hook_list); 8076 goto err4; 8077 } 8078 8079 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); 8080 if (err < 0) 8081 goto err5; 8082 8083 list_add_tail_rcu(&flowtable->list, &table->flowtables); 8084 table->use++; 8085 8086 return 0; 8087 err5: 8088 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 8089 nft_unregister_flowtable_hook(net, flowtable, hook); 8090 list_del_rcu(&hook->list); 8091 kfree_rcu(hook, rcu); 8092 } 8093 err4: 8094 flowtable->data.type->free(&flowtable->data); 8095 err3: 8096 module_put(type->owner); 8097 err2: 8098 kfree(flowtable->name); 8099 err1: 8100 kfree(flowtable); 8101 return err; 8102 } 8103 8104 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook) 8105 { 8106 struct nft_hook *this, *next; 8107 8108 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) { 8109 list_del(&this->list); 8110 kfree(this); 8111 } 8112 } 8113 8114 static int nft_delflowtable_hook(struct nft_ctx *ctx, 8115 struct nft_flowtable *flowtable, 8116 struct netlink_ext_ack *extack) 8117 { 8118 const struct nlattr * const *nla = ctx->nla; 8119 struct nft_flowtable_hook flowtable_hook; 8120 LIST_HEAD(flowtable_del_list); 8121 struct nft_hook *this, *hook; 8122 struct nft_trans *trans; 8123 int err; 8124 8125 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 8126 extack, false); 8127 if (err < 0) 8128 return err; 8129 8130 list_for_each_entry(this, &flowtable_hook.list, list) { 8131 hook = nft_hook_list_find(&flowtable->hook_list, this); 8132 if (!hook) { 8133 err = -ENOENT; 8134 goto err_flowtable_del_hook; 8135 } 8136 list_move(&hook->list, &flowtable_del_list); 8137 } 8138 8139 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE, 8140 sizeof(struct nft_trans_flowtable)); 8141 if (!trans) { 8142 err = -ENOMEM; 8143 goto err_flowtable_del_hook; 8144 } 8145 8146 nft_trans_flowtable(trans) = flowtable; 8147 nft_trans_flowtable_update(trans) = true; 8148 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 8149 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans)); 8150 nft_flowtable_hook_release(&flowtable_hook); 8151 8152 nft_trans_commit_list_add_tail(ctx->net, trans); 8153 8154 return 0; 8155 8156 err_flowtable_del_hook: 8157 list_splice(&flowtable_del_list, &flowtable->hook_list); 8158 nft_flowtable_hook_release(&flowtable_hook); 8159 8160 return err; 8161 } 8162 8163 static int nf_tables_delflowtable(struct sk_buff *skb, 8164 const struct nfnl_info *info, 8165 const struct nlattr * const nla[]) 8166 { 8167 struct netlink_ext_ack *extack = info->extack; 8168 u8 genmask = nft_genmask_next(info->net); 8169 u8 family = info->nfmsg->nfgen_family; 8170 struct nft_flowtable *flowtable; 8171 struct net *net = info->net; 8172 const struct nlattr *attr; 8173 struct nft_table *table; 8174 struct nft_ctx ctx; 8175 8176 if (!nla[NFTA_FLOWTABLE_TABLE] || 8177 (!nla[NFTA_FLOWTABLE_NAME] && 8178 !nla[NFTA_FLOWTABLE_HANDLE])) 8179 return -EINVAL; 8180 8181 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8182 genmask, NETLINK_CB(skb).portid); 8183 if (IS_ERR(table)) { 8184 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 8185 return PTR_ERR(table); 8186 } 8187 8188 if (nla[NFTA_FLOWTABLE_HANDLE]) { 8189 attr = nla[NFTA_FLOWTABLE_HANDLE]; 8190 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask); 8191 } else { 8192 attr = nla[NFTA_FLOWTABLE_NAME]; 8193 flowtable = nft_flowtable_lookup(table, attr, genmask); 8194 } 8195 8196 if (IS_ERR(flowtable)) { 8197 if (PTR_ERR(flowtable) == -ENOENT && 8198 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYFLOWTABLE) 8199 return 0; 8200 8201 NL_SET_BAD_ATTR(extack, attr); 8202 return PTR_ERR(flowtable); 8203 } 8204 8205 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8206 8207 if (nla[NFTA_FLOWTABLE_HOOK]) 8208 return nft_delflowtable_hook(&ctx, flowtable, extack); 8209 8210 if (flowtable->use > 0) { 8211 NL_SET_BAD_ATTR(extack, attr); 8212 return -EBUSY; 8213 } 8214 8215 return nft_delflowtable(&ctx, flowtable); 8216 } 8217 8218 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 8219 u32 portid, u32 seq, int event, 8220 u32 flags, int family, 8221 struct nft_flowtable *flowtable, 8222 struct list_head *hook_list) 8223 { 8224 struct nlattr *nest, *nest_devs; 8225 struct nft_hook *hook; 8226 struct nlmsghdr *nlh; 8227 8228 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 8229 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 8230 NFNETLINK_V0, nft_base_seq(net)); 8231 if (!nlh) 8232 goto nla_put_failure; 8233 8234 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || 8235 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || 8236 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), 8237 NFTA_FLOWTABLE_PAD)) 8238 goto nla_put_failure; 8239 8240 if (event == NFT_MSG_DELFLOWTABLE && !hook_list) { 8241 nlmsg_end(skb, nlh); 8242 return 0; 8243 } 8244 8245 if (nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || 8246 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) 8247 goto nla_put_failure; 8248 8249 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK); 8250 if (!nest) 8251 goto nla_put_failure; 8252 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || 8253 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority))) 8254 goto nla_put_failure; 8255 8256 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS); 8257 if (!nest_devs) 8258 goto nla_put_failure; 8259 8260 if (!hook_list) 8261 hook_list = &flowtable->hook_list; 8262 8263 list_for_each_entry_rcu(hook, hook_list, list) { 8264 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name)) 8265 goto nla_put_failure; 8266 } 8267 nla_nest_end(skb, nest_devs); 8268 nla_nest_end(skb, nest); 8269 8270 nlmsg_end(skb, nlh); 8271 return 0; 8272 8273 nla_put_failure: 8274 nlmsg_trim(skb, nlh); 8275 return -1; 8276 } 8277 8278 struct nft_flowtable_filter { 8279 char *table; 8280 }; 8281 8282 static int nf_tables_dump_flowtable(struct sk_buff *skb, 8283 struct netlink_callback *cb) 8284 { 8285 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 8286 struct nft_flowtable_filter *filter = cb->data; 8287 unsigned int idx = 0, s_idx = cb->args[0]; 8288 struct net *net = sock_net(skb->sk); 8289 int family = nfmsg->nfgen_family; 8290 struct nft_flowtable *flowtable; 8291 struct nftables_pernet *nft_net; 8292 const struct nft_table *table; 8293 8294 rcu_read_lock(); 8295 nft_net = nft_pernet(net); 8296 cb->seq = READ_ONCE(nft_net->base_seq); 8297 8298 list_for_each_entry_rcu(table, &nft_net->tables, list) { 8299 if (family != NFPROTO_UNSPEC && family != table->family) 8300 continue; 8301 8302 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 8303 if (!nft_is_active(net, flowtable)) 8304 goto cont; 8305 if (idx < s_idx) 8306 goto cont; 8307 if (idx > s_idx) 8308 memset(&cb->args[1], 0, 8309 sizeof(cb->args) - sizeof(cb->args[0])); 8310 if (filter && filter->table && 8311 strcmp(filter->table, table->name)) 8312 goto cont; 8313 8314 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, 8315 cb->nlh->nlmsg_seq, 8316 NFT_MSG_NEWFLOWTABLE, 8317 NLM_F_MULTI | NLM_F_APPEND, 8318 table->family, 8319 flowtable, NULL) < 0) 8320 goto done; 8321 8322 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 8323 cont: 8324 idx++; 8325 } 8326 } 8327 done: 8328 rcu_read_unlock(); 8329 8330 cb->args[0] = idx; 8331 return skb->len; 8332 } 8333 8334 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb) 8335 { 8336 const struct nlattr * const *nla = cb->data; 8337 struct nft_flowtable_filter *filter = NULL; 8338 8339 if (nla[NFTA_FLOWTABLE_TABLE]) { 8340 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 8341 if (!filter) 8342 return -ENOMEM; 8343 8344 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], 8345 GFP_ATOMIC); 8346 if (!filter->table) { 8347 kfree(filter); 8348 return -ENOMEM; 8349 } 8350 } 8351 8352 cb->data = filter; 8353 return 0; 8354 } 8355 8356 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) 8357 { 8358 struct nft_flowtable_filter *filter = cb->data; 8359 8360 if (!filter) 8361 return 0; 8362 8363 kfree(filter->table); 8364 kfree(filter); 8365 8366 return 0; 8367 } 8368 8369 /* called with rcu_read_lock held */ 8370 static int nf_tables_getflowtable(struct sk_buff *skb, 8371 const struct nfnl_info *info, 8372 const struct nlattr * const nla[]) 8373 { 8374 u8 genmask = nft_genmask_cur(info->net); 8375 u8 family = info->nfmsg->nfgen_family; 8376 struct nft_flowtable *flowtable; 8377 const struct nft_table *table; 8378 struct net *net = info->net; 8379 struct sk_buff *skb2; 8380 int err; 8381 8382 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8383 struct netlink_dump_control c = { 8384 .start = nf_tables_dump_flowtable_start, 8385 .dump = nf_tables_dump_flowtable, 8386 .done = nf_tables_dump_flowtable_done, 8387 .module = THIS_MODULE, 8388 .data = (void *)nla, 8389 }; 8390 8391 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8392 } 8393 8394 if (!nla[NFTA_FLOWTABLE_NAME]) 8395 return -EINVAL; 8396 8397 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8398 genmask, 0); 8399 if (IS_ERR(table)) 8400 return PTR_ERR(table); 8401 8402 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 8403 genmask); 8404 if (IS_ERR(flowtable)) 8405 return PTR_ERR(flowtable); 8406 8407 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8408 if (!skb2) 8409 return -ENOMEM; 8410 8411 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, 8412 info->nlh->nlmsg_seq, 8413 NFT_MSG_NEWFLOWTABLE, 0, family, 8414 flowtable, NULL); 8415 if (err < 0) 8416 goto err_fill_flowtable_info; 8417 8418 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 8419 8420 err_fill_flowtable_info: 8421 kfree_skb(skb2); 8422 return err; 8423 } 8424 8425 static void nf_tables_flowtable_notify(struct nft_ctx *ctx, 8426 struct nft_flowtable *flowtable, 8427 struct list_head *hook_list, int event) 8428 { 8429 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 8430 struct sk_buff *skb; 8431 u16 flags = 0; 8432 int err; 8433 8434 if (!ctx->report && 8435 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 8436 return; 8437 8438 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8439 if (skb == NULL) 8440 goto err; 8441 8442 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 8443 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 8444 8445 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, 8446 ctx->seq, event, flags, 8447 ctx->family, flowtable, hook_list); 8448 if (err < 0) { 8449 kfree_skb(skb); 8450 goto err; 8451 } 8452 8453 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 8454 return; 8455 err: 8456 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 8457 } 8458 8459 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 8460 { 8461 struct nft_hook *hook, *next; 8462 8463 flowtable->data.type->free(&flowtable->data); 8464 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 8465 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 8466 FLOW_BLOCK_UNBIND); 8467 list_del_rcu(&hook->list); 8468 kfree(hook); 8469 } 8470 kfree(flowtable->name); 8471 module_put(flowtable->data.type->owner); 8472 kfree(flowtable); 8473 } 8474 8475 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 8476 u32 portid, u32 seq) 8477 { 8478 struct nftables_pernet *nft_net = nft_pernet(net); 8479 struct nlmsghdr *nlh; 8480 char buf[TASK_COMM_LEN]; 8481 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); 8482 8483 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, 8484 NFNETLINK_V0, nft_base_seq(net)); 8485 if (!nlh) 8486 goto nla_put_failure; 8487 8488 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) || 8489 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || 8490 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) 8491 goto nla_put_failure; 8492 8493 nlmsg_end(skb, nlh); 8494 return 0; 8495 8496 nla_put_failure: 8497 nlmsg_trim(skb, nlh); 8498 return -EMSGSIZE; 8499 } 8500 8501 static void nft_flowtable_event(unsigned long event, struct net_device *dev, 8502 struct nft_flowtable *flowtable) 8503 { 8504 struct nft_hook *hook; 8505 8506 list_for_each_entry(hook, &flowtable->hook_list, list) { 8507 if (hook->ops.dev != dev) 8508 continue; 8509 8510 /* flow_offload_netdev_event() cleans up entries for us. */ 8511 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook); 8512 list_del_rcu(&hook->list); 8513 kfree_rcu(hook, rcu); 8514 break; 8515 } 8516 } 8517 8518 static int nf_tables_flowtable_event(struct notifier_block *this, 8519 unsigned long event, void *ptr) 8520 { 8521 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 8522 struct nft_flowtable *flowtable; 8523 struct nftables_pernet *nft_net; 8524 struct nft_table *table; 8525 struct net *net; 8526 8527 if (event != NETDEV_UNREGISTER) 8528 return 0; 8529 8530 net = dev_net(dev); 8531 nft_net = nft_pernet(net); 8532 mutex_lock(&nft_net->commit_mutex); 8533 list_for_each_entry(table, &nft_net->tables, list) { 8534 list_for_each_entry(flowtable, &table->flowtables, list) { 8535 nft_flowtable_event(event, dev, flowtable); 8536 } 8537 } 8538 mutex_unlock(&nft_net->commit_mutex); 8539 8540 return NOTIFY_DONE; 8541 } 8542 8543 static struct notifier_block nf_tables_flowtable_notifier = { 8544 .notifier_call = nf_tables_flowtable_event, 8545 }; 8546 8547 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, 8548 int event) 8549 { 8550 struct nlmsghdr *nlh = nlmsg_hdr(skb); 8551 struct sk_buff *skb2; 8552 int err; 8553 8554 if (!nlmsg_report(nlh) && 8555 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 8556 return; 8557 8558 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8559 if (skb2 == NULL) 8560 goto err; 8561 8562 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 8563 nlh->nlmsg_seq); 8564 if (err < 0) { 8565 kfree_skb(skb2); 8566 goto err; 8567 } 8568 8569 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8570 nlmsg_report(nlh), GFP_KERNEL); 8571 return; 8572 err: 8573 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8574 -ENOBUFS); 8575 } 8576 8577 static int nf_tables_getgen(struct sk_buff *skb, const struct nfnl_info *info, 8578 const struct nlattr * const nla[]) 8579 { 8580 struct sk_buff *skb2; 8581 int err; 8582 8583 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8584 if (skb2 == NULL) 8585 return -ENOMEM; 8586 8587 err = nf_tables_fill_gen_info(skb2, info->net, NETLINK_CB(skb).portid, 8588 info->nlh->nlmsg_seq); 8589 if (err < 0) 8590 goto err_fill_gen_info; 8591 8592 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 8593 8594 err_fill_gen_info: 8595 kfree_skb(skb2); 8596 return err; 8597 } 8598 8599 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 8600 [NFT_MSG_NEWTABLE] = { 8601 .call = nf_tables_newtable, 8602 .type = NFNL_CB_BATCH, 8603 .attr_count = NFTA_TABLE_MAX, 8604 .policy = nft_table_policy, 8605 }, 8606 [NFT_MSG_GETTABLE] = { 8607 .call = nf_tables_gettable, 8608 .type = NFNL_CB_RCU, 8609 .attr_count = NFTA_TABLE_MAX, 8610 .policy = nft_table_policy, 8611 }, 8612 [NFT_MSG_DELTABLE] = { 8613 .call = nf_tables_deltable, 8614 .type = NFNL_CB_BATCH, 8615 .attr_count = NFTA_TABLE_MAX, 8616 .policy = nft_table_policy, 8617 }, 8618 [NFT_MSG_DESTROYTABLE] = { 8619 .call = nf_tables_deltable, 8620 .type = NFNL_CB_BATCH, 8621 .attr_count = NFTA_TABLE_MAX, 8622 .policy = nft_table_policy, 8623 }, 8624 [NFT_MSG_NEWCHAIN] = { 8625 .call = nf_tables_newchain, 8626 .type = NFNL_CB_BATCH, 8627 .attr_count = NFTA_CHAIN_MAX, 8628 .policy = nft_chain_policy, 8629 }, 8630 [NFT_MSG_GETCHAIN] = { 8631 .call = nf_tables_getchain, 8632 .type = NFNL_CB_RCU, 8633 .attr_count = NFTA_CHAIN_MAX, 8634 .policy = nft_chain_policy, 8635 }, 8636 [NFT_MSG_DELCHAIN] = { 8637 .call = nf_tables_delchain, 8638 .type = NFNL_CB_BATCH, 8639 .attr_count = NFTA_CHAIN_MAX, 8640 .policy = nft_chain_policy, 8641 }, 8642 [NFT_MSG_DESTROYCHAIN] = { 8643 .call = nf_tables_delchain, 8644 .type = NFNL_CB_BATCH, 8645 .attr_count = NFTA_CHAIN_MAX, 8646 .policy = nft_chain_policy, 8647 }, 8648 [NFT_MSG_NEWRULE] = { 8649 .call = nf_tables_newrule, 8650 .type = NFNL_CB_BATCH, 8651 .attr_count = NFTA_RULE_MAX, 8652 .policy = nft_rule_policy, 8653 }, 8654 [NFT_MSG_GETRULE] = { 8655 .call = nf_tables_getrule, 8656 .type = NFNL_CB_RCU, 8657 .attr_count = NFTA_RULE_MAX, 8658 .policy = nft_rule_policy, 8659 }, 8660 [NFT_MSG_GETRULE_RESET] = { 8661 .call = nf_tables_getrule, 8662 .type = NFNL_CB_RCU, 8663 .attr_count = NFTA_RULE_MAX, 8664 .policy = nft_rule_policy, 8665 }, 8666 [NFT_MSG_DELRULE] = { 8667 .call = nf_tables_delrule, 8668 .type = NFNL_CB_BATCH, 8669 .attr_count = NFTA_RULE_MAX, 8670 .policy = nft_rule_policy, 8671 }, 8672 [NFT_MSG_DESTROYRULE] = { 8673 .call = nf_tables_delrule, 8674 .type = NFNL_CB_BATCH, 8675 .attr_count = NFTA_RULE_MAX, 8676 .policy = nft_rule_policy, 8677 }, 8678 [NFT_MSG_NEWSET] = { 8679 .call = nf_tables_newset, 8680 .type = NFNL_CB_BATCH, 8681 .attr_count = NFTA_SET_MAX, 8682 .policy = nft_set_policy, 8683 }, 8684 [NFT_MSG_GETSET] = { 8685 .call = nf_tables_getset, 8686 .type = NFNL_CB_RCU, 8687 .attr_count = NFTA_SET_MAX, 8688 .policy = nft_set_policy, 8689 }, 8690 [NFT_MSG_DELSET] = { 8691 .call = nf_tables_delset, 8692 .type = NFNL_CB_BATCH, 8693 .attr_count = NFTA_SET_MAX, 8694 .policy = nft_set_policy, 8695 }, 8696 [NFT_MSG_DESTROYSET] = { 8697 .call = nf_tables_delset, 8698 .type = NFNL_CB_BATCH, 8699 .attr_count = NFTA_SET_MAX, 8700 .policy = nft_set_policy, 8701 }, 8702 [NFT_MSG_NEWSETELEM] = { 8703 .call = nf_tables_newsetelem, 8704 .type = NFNL_CB_BATCH, 8705 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8706 .policy = nft_set_elem_list_policy, 8707 }, 8708 [NFT_MSG_GETSETELEM] = { 8709 .call = nf_tables_getsetelem, 8710 .type = NFNL_CB_RCU, 8711 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8712 .policy = nft_set_elem_list_policy, 8713 }, 8714 [NFT_MSG_DELSETELEM] = { 8715 .call = nf_tables_delsetelem, 8716 .type = NFNL_CB_BATCH, 8717 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8718 .policy = nft_set_elem_list_policy, 8719 }, 8720 [NFT_MSG_DESTROYSETELEM] = { 8721 .call = nf_tables_delsetelem, 8722 .type = NFNL_CB_BATCH, 8723 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8724 .policy = nft_set_elem_list_policy, 8725 }, 8726 [NFT_MSG_GETGEN] = { 8727 .call = nf_tables_getgen, 8728 .type = NFNL_CB_RCU, 8729 }, 8730 [NFT_MSG_NEWOBJ] = { 8731 .call = nf_tables_newobj, 8732 .type = NFNL_CB_BATCH, 8733 .attr_count = NFTA_OBJ_MAX, 8734 .policy = nft_obj_policy, 8735 }, 8736 [NFT_MSG_GETOBJ] = { 8737 .call = nf_tables_getobj, 8738 .type = NFNL_CB_RCU, 8739 .attr_count = NFTA_OBJ_MAX, 8740 .policy = nft_obj_policy, 8741 }, 8742 [NFT_MSG_DELOBJ] = { 8743 .call = nf_tables_delobj, 8744 .type = NFNL_CB_BATCH, 8745 .attr_count = NFTA_OBJ_MAX, 8746 .policy = nft_obj_policy, 8747 }, 8748 [NFT_MSG_DESTROYOBJ] = { 8749 .call = nf_tables_delobj, 8750 .type = NFNL_CB_BATCH, 8751 .attr_count = NFTA_OBJ_MAX, 8752 .policy = nft_obj_policy, 8753 }, 8754 [NFT_MSG_GETOBJ_RESET] = { 8755 .call = nf_tables_getobj, 8756 .type = NFNL_CB_RCU, 8757 .attr_count = NFTA_OBJ_MAX, 8758 .policy = nft_obj_policy, 8759 }, 8760 [NFT_MSG_NEWFLOWTABLE] = { 8761 .call = nf_tables_newflowtable, 8762 .type = NFNL_CB_BATCH, 8763 .attr_count = NFTA_FLOWTABLE_MAX, 8764 .policy = nft_flowtable_policy, 8765 }, 8766 [NFT_MSG_GETFLOWTABLE] = { 8767 .call = nf_tables_getflowtable, 8768 .type = NFNL_CB_RCU, 8769 .attr_count = NFTA_FLOWTABLE_MAX, 8770 .policy = nft_flowtable_policy, 8771 }, 8772 [NFT_MSG_DELFLOWTABLE] = { 8773 .call = nf_tables_delflowtable, 8774 .type = NFNL_CB_BATCH, 8775 .attr_count = NFTA_FLOWTABLE_MAX, 8776 .policy = nft_flowtable_policy, 8777 }, 8778 [NFT_MSG_DESTROYFLOWTABLE] = { 8779 .call = nf_tables_delflowtable, 8780 .type = NFNL_CB_BATCH, 8781 .attr_count = NFTA_FLOWTABLE_MAX, 8782 .policy = nft_flowtable_policy, 8783 }, 8784 }; 8785 8786 static int nf_tables_validate(struct net *net) 8787 { 8788 struct nftables_pernet *nft_net = nft_pernet(net); 8789 struct nft_table *table; 8790 8791 list_for_each_entry(table, &nft_net->tables, list) { 8792 switch (table->validate_state) { 8793 case NFT_VALIDATE_SKIP: 8794 continue; 8795 case NFT_VALIDATE_NEED: 8796 nft_validate_state_update(table, NFT_VALIDATE_DO); 8797 fallthrough; 8798 case NFT_VALIDATE_DO: 8799 if (nft_table_validate(net, table) < 0) 8800 return -EAGAIN; 8801 8802 nft_validate_state_update(table, NFT_VALIDATE_SKIP); 8803 } 8804 8805 break; 8806 } 8807 8808 return 0; 8809 } 8810 8811 /* a drop policy has to be deferred until all rules have been activated, 8812 * otherwise a large ruleset that contains a drop-policy base chain will 8813 * cause all packets to get dropped until the full transaction has been 8814 * processed. 8815 * 8816 * We defer the drop policy until the transaction has been finalized. 8817 */ 8818 static void nft_chain_commit_drop_policy(struct nft_trans *trans) 8819 { 8820 struct nft_base_chain *basechain; 8821 8822 if (nft_trans_chain_policy(trans) != NF_DROP) 8823 return; 8824 8825 if (!nft_is_base_chain(trans->ctx.chain)) 8826 return; 8827 8828 basechain = nft_base_chain(trans->ctx.chain); 8829 basechain->policy = NF_DROP; 8830 } 8831 8832 static void nft_chain_commit_update(struct nft_trans *trans) 8833 { 8834 struct nft_base_chain *basechain; 8835 8836 if (nft_trans_chain_name(trans)) { 8837 rhltable_remove(&trans->ctx.table->chains_ht, 8838 &trans->ctx.chain->rhlhead, 8839 nft_chain_ht_params); 8840 swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); 8841 rhltable_insert_key(&trans->ctx.table->chains_ht, 8842 trans->ctx.chain->name, 8843 &trans->ctx.chain->rhlhead, 8844 nft_chain_ht_params); 8845 } 8846 8847 if (!nft_is_base_chain(trans->ctx.chain)) 8848 return; 8849 8850 nft_chain_stats_replace(trans); 8851 8852 basechain = nft_base_chain(trans->ctx.chain); 8853 8854 switch (nft_trans_chain_policy(trans)) { 8855 case NF_DROP: 8856 case NF_ACCEPT: 8857 basechain->policy = nft_trans_chain_policy(trans); 8858 break; 8859 } 8860 } 8861 8862 static void nft_obj_commit_update(struct nft_trans *trans) 8863 { 8864 struct nft_object *newobj; 8865 struct nft_object *obj; 8866 8867 obj = nft_trans_obj(trans); 8868 newobj = nft_trans_obj_newobj(trans); 8869 8870 if (obj->ops->update) 8871 obj->ops->update(obj, newobj); 8872 8873 nft_obj_destroy(&trans->ctx, newobj); 8874 } 8875 8876 static void nft_commit_release(struct nft_trans *trans) 8877 { 8878 switch (trans->msg_type) { 8879 case NFT_MSG_DELTABLE: 8880 case NFT_MSG_DESTROYTABLE: 8881 nf_tables_table_destroy(&trans->ctx); 8882 break; 8883 case NFT_MSG_NEWCHAIN: 8884 free_percpu(nft_trans_chain_stats(trans)); 8885 kfree(nft_trans_chain_name(trans)); 8886 break; 8887 case NFT_MSG_DELCHAIN: 8888 case NFT_MSG_DESTROYCHAIN: 8889 if (nft_trans_chain_update(trans)) 8890 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 8891 else 8892 nf_tables_chain_destroy(&trans->ctx); 8893 break; 8894 case NFT_MSG_DELRULE: 8895 case NFT_MSG_DESTROYRULE: 8896 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 8897 break; 8898 case NFT_MSG_DELSET: 8899 case NFT_MSG_DESTROYSET: 8900 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 8901 break; 8902 case NFT_MSG_DELSETELEM: 8903 case NFT_MSG_DESTROYSETELEM: 8904 nf_tables_set_elem_destroy(&trans->ctx, 8905 nft_trans_elem_set(trans), 8906 nft_trans_elem(trans).priv); 8907 break; 8908 case NFT_MSG_DELOBJ: 8909 case NFT_MSG_DESTROYOBJ: 8910 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 8911 break; 8912 case NFT_MSG_DELFLOWTABLE: 8913 case NFT_MSG_DESTROYFLOWTABLE: 8914 if (nft_trans_flowtable_update(trans)) 8915 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 8916 else 8917 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 8918 break; 8919 } 8920 8921 if (trans->put_net) 8922 put_net(trans->ctx.net); 8923 8924 kfree(trans); 8925 } 8926 8927 static void nf_tables_trans_destroy_work(struct work_struct *w) 8928 { 8929 struct nft_trans *trans, *next; 8930 LIST_HEAD(head); 8931 8932 spin_lock(&nf_tables_destroy_list_lock); 8933 list_splice_init(&nf_tables_destroy_list, &head); 8934 spin_unlock(&nf_tables_destroy_list_lock); 8935 8936 if (list_empty(&head)) 8937 return; 8938 8939 synchronize_rcu(); 8940 8941 list_for_each_entry_safe(trans, next, &head, list) { 8942 list_del(&trans->list); 8943 nft_commit_release(trans); 8944 } 8945 } 8946 8947 void nf_tables_trans_destroy_flush_work(void) 8948 { 8949 flush_work(&trans_destroy_work); 8950 } 8951 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); 8952 8953 static bool nft_expr_reduce(struct nft_regs_track *track, 8954 const struct nft_expr *expr) 8955 { 8956 return false; 8957 } 8958 8959 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain) 8960 { 8961 const struct nft_expr *expr, *last; 8962 struct nft_regs_track track = {}; 8963 unsigned int size, data_size; 8964 void *data, *data_boundary; 8965 struct nft_rule_dp *prule; 8966 struct nft_rule *rule; 8967 8968 /* already handled or inactive chain? */ 8969 if (chain->blob_next || !nft_is_active_next(net, chain)) 8970 return 0; 8971 8972 data_size = 0; 8973 list_for_each_entry(rule, &chain->rules, list) { 8974 if (nft_is_active_next(net, rule)) { 8975 data_size += sizeof(*prule) + rule->dlen; 8976 if (data_size > INT_MAX) 8977 return -ENOMEM; 8978 } 8979 } 8980 8981 chain->blob_next = nf_tables_chain_alloc_rules(chain, data_size); 8982 if (!chain->blob_next) 8983 return -ENOMEM; 8984 8985 data = (void *)chain->blob_next->data; 8986 data_boundary = data + data_size; 8987 size = 0; 8988 8989 list_for_each_entry(rule, &chain->rules, list) { 8990 if (!nft_is_active_next(net, rule)) 8991 continue; 8992 8993 prule = (struct nft_rule_dp *)data; 8994 data += offsetof(struct nft_rule_dp, data); 8995 if (WARN_ON_ONCE(data > data_boundary)) 8996 return -ENOMEM; 8997 8998 size = 0; 8999 track.last = nft_expr_last(rule); 9000 nft_rule_for_each_expr(expr, last, rule) { 9001 track.cur = expr; 9002 9003 if (nft_expr_reduce(&track, expr)) { 9004 expr = track.cur; 9005 continue; 9006 } 9007 9008 if (WARN_ON_ONCE(data + expr->ops->size > data_boundary)) 9009 return -ENOMEM; 9010 9011 memcpy(data + size, expr, expr->ops->size); 9012 size += expr->ops->size; 9013 } 9014 if (WARN_ON_ONCE(size >= 1 << 12)) 9015 return -ENOMEM; 9016 9017 prule->handle = rule->handle; 9018 prule->dlen = size; 9019 prule->is_last = 0; 9020 9021 data += size; 9022 size = 0; 9023 chain->blob_next->size += (unsigned long)(data - (void *)prule); 9024 } 9025 9026 if (WARN_ON_ONCE(data > data_boundary)) 9027 return -ENOMEM; 9028 9029 prule = (struct nft_rule_dp *)data; 9030 nft_last_rule(chain, prule); 9031 9032 return 0; 9033 } 9034 9035 static void nf_tables_commit_chain_prepare_cancel(struct net *net) 9036 { 9037 struct nftables_pernet *nft_net = nft_pernet(net); 9038 struct nft_trans *trans, *next; 9039 9040 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9041 struct nft_chain *chain = trans->ctx.chain; 9042 9043 if (trans->msg_type == NFT_MSG_NEWRULE || 9044 trans->msg_type == NFT_MSG_DELRULE) { 9045 kvfree(chain->blob_next); 9046 chain->blob_next = NULL; 9047 } 9048 } 9049 } 9050 9051 static void __nf_tables_commit_chain_free_rules(struct rcu_head *h) 9052 { 9053 struct nft_rule_dp_last *l = container_of(h, struct nft_rule_dp_last, h); 9054 9055 kvfree(l->blob); 9056 } 9057 9058 static void nf_tables_commit_chain_free_rules_old(struct nft_rule_blob *blob) 9059 { 9060 struct nft_rule_dp_last *last; 9061 9062 /* last rule trailer is after end marker */ 9063 last = (void *)blob + sizeof(*blob) + blob->size; 9064 last->blob = blob; 9065 9066 call_rcu(&last->h, __nf_tables_commit_chain_free_rules); 9067 } 9068 9069 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain) 9070 { 9071 struct nft_rule_blob *g0, *g1; 9072 bool next_genbit; 9073 9074 next_genbit = nft_gencursor_next(net); 9075 9076 g0 = rcu_dereference_protected(chain->blob_gen_0, 9077 lockdep_commit_lock_is_held(net)); 9078 g1 = rcu_dereference_protected(chain->blob_gen_1, 9079 lockdep_commit_lock_is_held(net)); 9080 9081 /* No changes to this chain? */ 9082 if (chain->blob_next == NULL) { 9083 /* chain had no change in last or next generation */ 9084 if (g0 == g1) 9085 return; 9086 /* 9087 * chain had no change in this generation; make sure next 9088 * one uses same rules as current generation. 9089 */ 9090 if (next_genbit) { 9091 rcu_assign_pointer(chain->blob_gen_1, g0); 9092 nf_tables_commit_chain_free_rules_old(g1); 9093 } else { 9094 rcu_assign_pointer(chain->blob_gen_0, g1); 9095 nf_tables_commit_chain_free_rules_old(g0); 9096 } 9097 9098 return; 9099 } 9100 9101 if (next_genbit) 9102 rcu_assign_pointer(chain->blob_gen_1, chain->blob_next); 9103 else 9104 rcu_assign_pointer(chain->blob_gen_0, chain->blob_next); 9105 9106 chain->blob_next = NULL; 9107 9108 if (g0 == g1) 9109 return; 9110 9111 if (next_genbit) 9112 nf_tables_commit_chain_free_rules_old(g1); 9113 else 9114 nf_tables_commit_chain_free_rules_old(g0); 9115 } 9116 9117 static void nft_obj_del(struct nft_object *obj) 9118 { 9119 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params); 9120 list_del_rcu(&obj->list); 9121 } 9122 9123 void nft_chain_del(struct nft_chain *chain) 9124 { 9125 struct nft_table *table = chain->table; 9126 9127 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead, 9128 nft_chain_ht_params)); 9129 list_del_rcu(&chain->list); 9130 } 9131 9132 static void nf_tables_module_autoload_cleanup(struct net *net) 9133 { 9134 struct nftables_pernet *nft_net = nft_pernet(net); 9135 struct nft_module_request *req, *next; 9136 9137 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 9138 list_for_each_entry_safe(req, next, &nft_net->module_list, list) { 9139 WARN_ON_ONCE(!req->done); 9140 list_del(&req->list); 9141 kfree(req); 9142 } 9143 } 9144 9145 static void nf_tables_commit_release(struct net *net) 9146 { 9147 struct nftables_pernet *nft_net = nft_pernet(net); 9148 struct nft_trans *trans; 9149 9150 /* all side effects have to be made visible. 9151 * For example, if a chain named 'foo' has been deleted, a 9152 * new transaction must not find it anymore. 9153 * 9154 * Memory reclaim happens asynchronously from work queue 9155 * to prevent expensive synchronize_rcu() in commit phase. 9156 */ 9157 if (list_empty(&nft_net->commit_list)) { 9158 nf_tables_module_autoload_cleanup(net); 9159 mutex_unlock(&nft_net->commit_mutex); 9160 return; 9161 } 9162 9163 trans = list_last_entry(&nft_net->commit_list, 9164 struct nft_trans, list); 9165 get_net(trans->ctx.net); 9166 WARN_ON_ONCE(trans->put_net); 9167 9168 trans->put_net = true; 9169 spin_lock(&nf_tables_destroy_list_lock); 9170 list_splice_tail_init(&nft_net->commit_list, &nf_tables_destroy_list); 9171 spin_unlock(&nf_tables_destroy_list_lock); 9172 9173 nf_tables_module_autoload_cleanup(net); 9174 schedule_work(&trans_destroy_work); 9175 9176 mutex_unlock(&nft_net->commit_mutex); 9177 } 9178 9179 static void nft_commit_notify(struct net *net, u32 portid) 9180 { 9181 struct nftables_pernet *nft_net = nft_pernet(net); 9182 struct sk_buff *batch_skb = NULL, *nskb, *skb; 9183 unsigned char *data; 9184 int len; 9185 9186 list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) { 9187 if (!batch_skb) { 9188 new_batch: 9189 batch_skb = skb; 9190 len = NLMSG_GOODSIZE - skb->len; 9191 list_del(&skb->list); 9192 continue; 9193 } 9194 len -= skb->len; 9195 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) { 9196 data = skb_put(batch_skb, skb->len); 9197 memcpy(data, skb->data, skb->len); 9198 list_del(&skb->list); 9199 kfree_skb(skb); 9200 continue; 9201 } 9202 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 9203 NFT_CB(batch_skb).report, GFP_KERNEL); 9204 goto new_batch; 9205 } 9206 9207 if (batch_skb) { 9208 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 9209 NFT_CB(batch_skb).report, GFP_KERNEL); 9210 } 9211 9212 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 9213 } 9214 9215 static int nf_tables_commit_audit_alloc(struct list_head *adl, 9216 struct nft_table *table) 9217 { 9218 struct nft_audit_data *adp; 9219 9220 list_for_each_entry(adp, adl, list) { 9221 if (adp->table == table) 9222 return 0; 9223 } 9224 adp = kzalloc(sizeof(*adp), GFP_KERNEL); 9225 if (!adp) 9226 return -ENOMEM; 9227 adp->table = table; 9228 list_add(&adp->list, adl); 9229 return 0; 9230 } 9231 9232 static void nf_tables_commit_audit_free(struct list_head *adl) 9233 { 9234 struct nft_audit_data *adp, *adn; 9235 9236 list_for_each_entry_safe(adp, adn, adl, list) { 9237 list_del(&adp->list); 9238 kfree(adp); 9239 } 9240 } 9241 9242 static void nf_tables_commit_audit_collect(struct list_head *adl, 9243 struct nft_table *table, u32 op) 9244 { 9245 struct nft_audit_data *adp; 9246 9247 list_for_each_entry(adp, adl, list) { 9248 if (adp->table == table) 9249 goto found; 9250 } 9251 WARN_ONCE(1, "table=%s not expected in commit list", table->name); 9252 return; 9253 found: 9254 adp->entries++; 9255 if (!adp->op || adp->op > op) 9256 adp->op = op; 9257 } 9258 9259 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22) 9260 9261 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation) 9262 { 9263 struct nft_audit_data *adp, *adn; 9264 char aubuf[AUNFTABLENAMELEN]; 9265 9266 list_for_each_entry_safe(adp, adn, adl, list) { 9267 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name, 9268 generation); 9269 audit_log_nfcfg(aubuf, adp->table->family, adp->entries, 9270 nft2audit_op[adp->op], GFP_KERNEL); 9271 list_del(&adp->list); 9272 kfree(adp); 9273 } 9274 } 9275 9276 static int nf_tables_commit(struct net *net, struct sk_buff *skb) 9277 { 9278 struct nftables_pernet *nft_net = nft_pernet(net); 9279 struct nft_trans *trans, *next; 9280 struct nft_trans_elem *te; 9281 struct nft_chain *chain; 9282 struct nft_table *table; 9283 unsigned int base_seq; 9284 LIST_HEAD(adl); 9285 int err; 9286 9287 if (list_empty(&nft_net->commit_list)) { 9288 mutex_unlock(&nft_net->commit_mutex); 9289 return 0; 9290 } 9291 9292 /* 0. Validate ruleset, otherwise roll back for error reporting. */ 9293 if (nf_tables_validate(net) < 0) 9294 return -EAGAIN; 9295 9296 err = nft_flow_rule_offload_commit(net); 9297 if (err < 0) 9298 return err; 9299 9300 /* 1. Allocate space for next generation rules_gen_X[] */ 9301 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9302 int ret; 9303 9304 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); 9305 if (ret) { 9306 nf_tables_commit_chain_prepare_cancel(net); 9307 nf_tables_commit_audit_free(&adl); 9308 return ret; 9309 } 9310 if (trans->msg_type == NFT_MSG_NEWRULE || 9311 trans->msg_type == NFT_MSG_DELRULE) { 9312 chain = trans->ctx.chain; 9313 9314 ret = nf_tables_commit_chain_prepare(net, chain); 9315 if (ret < 0) { 9316 nf_tables_commit_chain_prepare_cancel(net); 9317 nf_tables_commit_audit_free(&adl); 9318 return ret; 9319 } 9320 } 9321 } 9322 9323 /* step 2. Make rules_gen_X visible to packet path */ 9324 list_for_each_entry(table, &nft_net->tables, list) { 9325 list_for_each_entry(chain, &table->chains, list) 9326 nf_tables_commit_chain(net, chain); 9327 } 9328 9329 /* 9330 * Bump generation counter, invalidate any dump in progress. 9331 * Cannot fail after this point. 9332 */ 9333 base_seq = READ_ONCE(nft_net->base_seq); 9334 while (++base_seq == 0) 9335 ; 9336 9337 WRITE_ONCE(nft_net->base_seq, base_seq); 9338 9339 /* step 3. Start new generation, rules_gen_X now in use. */ 9340 net->nft.gencursor = nft_gencursor_next(net); 9341 9342 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9343 nf_tables_commit_audit_collect(&adl, trans->ctx.table, 9344 trans->msg_type); 9345 switch (trans->msg_type) { 9346 case NFT_MSG_NEWTABLE: 9347 if (nft_trans_table_update(trans)) { 9348 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 9349 nft_trans_destroy(trans); 9350 break; 9351 } 9352 if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT) 9353 nf_tables_table_disable(net, trans->ctx.table); 9354 9355 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 9356 } else { 9357 nft_clear(net, trans->ctx.table); 9358 } 9359 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE); 9360 nft_trans_destroy(trans); 9361 break; 9362 case NFT_MSG_DELTABLE: 9363 case NFT_MSG_DESTROYTABLE: 9364 list_del_rcu(&trans->ctx.table->list); 9365 nf_tables_table_notify(&trans->ctx, trans->msg_type); 9366 break; 9367 case NFT_MSG_NEWCHAIN: 9368 if (nft_trans_chain_update(trans)) { 9369 nft_chain_commit_update(trans); 9370 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, 9371 &nft_trans_chain_hooks(trans)); 9372 list_splice(&nft_trans_chain_hooks(trans), 9373 &nft_trans_basechain(trans)->hook_list); 9374 /* trans destroyed after rcu grace period */ 9375 } else { 9376 nft_chain_commit_drop_policy(trans); 9377 nft_clear(net, trans->ctx.chain); 9378 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, NULL); 9379 nft_trans_destroy(trans); 9380 } 9381 break; 9382 case NFT_MSG_DELCHAIN: 9383 case NFT_MSG_DESTROYCHAIN: 9384 if (nft_trans_chain_update(trans)) { 9385 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, 9386 &nft_trans_chain_hooks(trans)); 9387 nft_netdev_unregister_hooks(net, 9388 &nft_trans_chain_hooks(trans), 9389 true); 9390 } else { 9391 nft_chain_del(trans->ctx.chain); 9392 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, 9393 NULL); 9394 nf_tables_unregister_hook(trans->ctx.net, 9395 trans->ctx.table, 9396 trans->ctx.chain); 9397 } 9398 break; 9399 case NFT_MSG_NEWRULE: 9400 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 9401 nf_tables_rule_notify(&trans->ctx, 9402 nft_trans_rule(trans), 9403 NFT_MSG_NEWRULE); 9404 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9405 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9406 9407 nft_trans_destroy(trans); 9408 break; 9409 case NFT_MSG_DELRULE: 9410 case NFT_MSG_DESTROYRULE: 9411 list_del_rcu(&nft_trans_rule(trans)->list); 9412 nf_tables_rule_notify(&trans->ctx, 9413 nft_trans_rule(trans), 9414 trans->msg_type); 9415 nft_rule_expr_deactivate(&trans->ctx, 9416 nft_trans_rule(trans), 9417 NFT_TRANS_COMMIT); 9418 9419 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9420 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9421 break; 9422 case NFT_MSG_NEWSET: 9423 if (nft_trans_set_update(trans)) { 9424 struct nft_set *set = nft_trans_set(trans); 9425 9426 WRITE_ONCE(set->timeout, nft_trans_set_timeout(trans)); 9427 WRITE_ONCE(set->gc_int, nft_trans_set_gc_int(trans)); 9428 } else { 9429 nft_clear(net, nft_trans_set(trans)); 9430 /* This avoids hitting -EBUSY when deleting the table 9431 * from the transaction. 9432 */ 9433 if (nft_set_is_anonymous(nft_trans_set(trans)) && 9434 !list_empty(&nft_trans_set(trans)->bindings)) 9435 trans->ctx.table->use--; 9436 } 9437 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 9438 NFT_MSG_NEWSET, GFP_KERNEL); 9439 nft_trans_destroy(trans); 9440 break; 9441 case NFT_MSG_DELSET: 9442 case NFT_MSG_DESTROYSET: 9443 list_del_rcu(&nft_trans_set(trans)->list); 9444 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 9445 trans->msg_type, GFP_KERNEL); 9446 break; 9447 case NFT_MSG_NEWSETELEM: 9448 te = (struct nft_trans_elem *)trans->data; 9449 9450 nft_setelem_activate(net, te->set, &te->elem); 9451 nf_tables_setelem_notify(&trans->ctx, te->set, 9452 &te->elem, 9453 NFT_MSG_NEWSETELEM); 9454 nft_trans_destroy(trans); 9455 break; 9456 case NFT_MSG_DELSETELEM: 9457 case NFT_MSG_DESTROYSETELEM: 9458 te = (struct nft_trans_elem *)trans->data; 9459 9460 nf_tables_setelem_notify(&trans->ctx, te->set, 9461 &te->elem, 9462 trans->msg_type); 9463 nft_setelem_remove(net, te->set, &te->elem); 9464 if (!nft_setelem_is_catchall(te->set, &te->elem)) { 9465 atomic_dec(&te->set->nelems); 9466 te->set->ndeact--; 9467 } 9468 break; 9469 case NFT_MSG_NEWOBJ: 9470 if (nft_trans_obj_update(trans)) { 9471 nft_obj_commit_update(trans); 9472 nf_tables_obj_notify(&trans->ctx, 9473 nft_trans_obj(trans), 9474 NFT_MSG_NEWOBJ); 9475 } else { 9476 nft_clear(net, nft_trans_obj(trans)); 9477 nf_tables_obj_notify(&trans->ctx, 9478 nft_trans_obj(trans), 9479 NFT_MSG_NEWOBJ); 9480 nft_trans_destroy(trans); 9481 } 9482 break; 9483 case NFT_MSG_DELOBJ: 9484 case NFT_MSG_DESTROYOBJ: 9485 nft_obj_del(nft_trans_obj(trans)); 9486 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans), 9487 trans->msg_type); 9488 break; 9489 case NFT_MSG_NEWFLOWTABLE: 9490 if (nft_trans_flowtable_update(trans)) { 9491 nft_trans_flowtable(trans)->data.flags = 9492 nft_trans_flowtable_flags(trans); 9493 nf_tables_flowtable_notify(&trans->ctx, 9494 nft_trans_flowtable(trans), 9495 &nft_trans_flowtable_hooks(trans), 9496 NFT_MSG_NEWFLOWTABLE); 9497 list_splice(&nft_trans_flowtable_hooks(trans), 9498 &nft_trans_flowtable(trans)->hook_list); 9499 } else { 9500 nft_clear(net, nft_trans_flowtable(trans)); 9501 nf_tables_flowtable_notify(&trans->ctx, 9502 nft_trans_flowtable(trans), 9503 NULL, 9504 NFT_MSG_NEWFLOWTABLE); 9505 } 9506 nft_trans_destroy(trans); 9507 break; 9508 case NFT_MSG_DELFLOWTABLE: 9509 case NFT_MSG_DESTROYFLOWTABLE: 9510 if (nft_trans_flowtable_update(trans)) { 9511 nf_tables_flowtable_notify(&trans->ctx, 9512 nft_trans_flowtable(trans), 9513 &nft_trans_flowtable_hooks(trans), 9514 trans->msg_type); 9515 nft_unregister_flowtable_net_hooks(net, 9516 &nft_trans_flowtable_hooks(trans)); 9517 } else { 9518 list_del_rcu(&nft_trans_flowtable(trans)->list); 9519 nf_tables_flowtable_notify(&trans->ctx, 9520 nft_trans_flowtable(trans), 9521 NULL, 9522 trans->msg_type); 9523 nft_unregister_flowtable_net_hooks(net, 9524 &nft_trans_flowtable(trans)->hook_list); 9525 } 9526 break; 9527 } 9528 } 9529 9530 nft_commit_notify(net, NETLINK_CB(skb).portid); 9531 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 9532 nf_tables_commit_audit_log(&adl, nft_net->base_seq); 9533 nf_tables_commit_release(net); 9534 9535 return 0; 9536 } 9537 9538 static void nf_tables_module_autoload(struct net *net) 9539 { 9540 struct nftables_pernet *nft_net = nft_pernet(net); 9541 struct nft_module_request *req, *next; 9542 LIST_HEAD(module_list); 9543 9544 list_splice_init(&nft_net->module_list, &module_list); 9545 mutex_unlock(&nft_net->commit_mutex); 9546 list_for_each_entry_safe(req, next, &module_list, list) { 9547 request_module("%s", req->module); 9548 req->done = true; 9549 } 9550 mutex_lock(&nft_net->commit_mutex); 9551 list_splice(&module_list, &nft_net->module_list); 9552 } 9553 9554 static void nf_tables_abort_release(struct nft_trans *trans) 9555 { 9556 switch (trans->msg_type) { 9557 case NFT_MSG_NEWTABLE: 9558 nf_tables_table_destroy(&trans->ctx); 9559 break; 9560 case NFT_MSG_NEWCHAIN: 9561 if (nft_trans_chain_update(trans)) 9562 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 9563 else 9564 nf_tables_chain_destroy(&trans->ctx); 9565 break; 9566 case NFT_MSG_NEWRULE: 9567 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 9568 break; 9569 case NFT_MSG_NEWSET: 9570 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 9571 break; 9572 case NFT_MSG_NEWSETELEM: 9573 nft_set_elem_destroy(nft_trans_elem_set(trans), 9574 nft_trans_elem(trans).priv, true); 9575 break; 9576 case NFT_MSG_NEWOBJ: 9577 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 9578 break; 9579 case NFT_MSG_NEWFLOWTABLE: 9580 if (nft_trans_flowtable_update(trans)) 9581 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 9582 else 9583 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 9584 break; 9585 } 9586 kfree(trans); 9587 } 9588 9589 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 9590 { 9591 struct nftables_pernet *nft_net = nft_pernet(net); 9592 struct nft_trans *trans, *next; 9593 struct nft_trans_elem *te; 9594 9595 if (action == NFNL_ABORT_VALIDATE && 9596 nf_tables_validate(net) < 0) 9597 return -EAGAIN; 9598 9599 list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, 9600 list) { 9601 switch (trans->msg_type) { 9602 case NFT_MSG_NEWTABLE: 9603 if (nft_trans_table_update(trans)) { 9604 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 9605 nft_trans_destroy(trans); 9606 break; 9607 } 9608 if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) { 9609 nf_tables_table_disable(net, trans->ctx.table); 9610 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 9611 } else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) { 9612 trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT; 9613 } 9614 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 9615 nft_trans_destroy(trans); 9616 } else { 9617 list_del_rcu(&trans->ctx.table->list); 9618 } 9619 break; 9620 case NFT_MSG_DELTABLE: 9621 case NFT_MSG_DESTROYTABLE: 9622 nft_clear(trans->ctx.net, trans->ctx.table); 9623 nft_trans_destroy(trans); 9624 break; 9625 case NFT_MSG_NEWCHAIN: 9626 if (nft_trans_chain_update(trans)) { 9627 nft_netdev_unregister_hooks(net, 9628 &nft_trans_chain_hooks(trans), 9629 true); 9630 free_percpu(nft_trans_chain_stats(trans)); 9631 kfree(nft_trans_chain_name(trans)); 9632 nft_trans_destroy(trans); 9633 } else { 9634 if (nft_chain_is_bound(trans->ctx.chain)) { 9635 nft_trans_destroy(trans); 9636 break; 9637 } 9638 trans->ctx.table->use--; 9639 nft_chain_del(trans->ctx.chain); 9640 nf_tables_unregister_hook(trans->ctx.net, 9641 trans->ctx.table, 9642 trans->ctx.chain); 9643 } 9644 break; 9645 case NFT_MSG_DELCHAIN: 9646 case NFT_MSG_DESTROYCHAIN: 9647 if (nft_trans_chain_update(trans)) { 9648 list_splice(&nft_trans_chain_hooks(trans), 9649 &nft_trans_basechain(trans)->hook_list); 9650 } else { 9651 trans->ctx.table->use++; 9652 nft_clear(trans->ctx.net, trans->ctx.chain); 9653 } 9654 nft_trans_destroy(trans); 9655 break; 9656 case NFT_MSG_NEWRULE: 9657 trans->ctx.chain->use--; 9658 list_del_rcu(&nft_trans_rule(trans)->list); 9659 nft_rule_expr_deactivate(&trans->ctx, 9660 nft_trans_rule(trans), 9661 NFT_TRANS_ABORT); 9662 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9663 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9664 break; 9665 case NFT_MSG_DELRULE: 9666 case NFT_MSG_DESTROYRULE: 9667 trans->ctx.chain->use++; 9668 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 9669 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans)); 9670 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9671 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9672 9673 nft_trans_destroy(trans); 9674 break; 9675 case NFT_MSG_NEWSET: 9676 if (nft_trans_set_update(trans)) { 9677 nft_trans_destroy(trans); 9678 break; 9679 } 9680 trans->ctx.table->use--; 9681 if (nft_trans_set_bound(trans)) { 9682 nft_trans_destroy(trans); 9683 break; 9684 } 9685 list_del_rcu(&nft_trans_set(trans)->list); 9686 break; 9687 case NFT_MSG_DELSET: 9688 case NFT_MSG_DESTROYSET: 9689 trans->ctx.table->use++; 9690 nft_clear(trans->ctx.net, nft_trans_set(trans)); 9691 nft_trans_destroy(trans); 9692 break; 9693 case NFT_MSG_NEWSETELEM: 9694 if (nft_trans_elem_set_bound(trans)) { 9695 nft_trans_destroy(trans); 9696 break; 9697 } 9698 te = (struct nft_trans_elem *)trans->data; 9699 nft_setelem_remove(net, te->set, &te->elem); 9700 if (!nft_setelem_is_catchall(te->set, &te->elem)) 9701 atomic_dec(&te->set->nelems); 9702 break; 9703 case NFT_MSG_DELSETELEM: 9704 case NFT_MSG_DESTROYSETELEM: 9705 te = (struct nft_trans_elem *)trans->data; 9706 9707 nft_setelem_data_activate(net, te->set, &te->elem); 9708 nft_setelem_activate(net, te->set, &te->elem); 9709 if (!nft_setelem_is_catchall(te->set, &te->elem)) 9710 te->set->ndeact--; 9711 9712 nft_trans_destroy(trans); 9713 break; 9714 case NFT_MSG_NEWOBJ: 9715 if (nft_trans_obj_update(trans)) { 9716 nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); 9717 nft_trans_destroy(trans); 9718 } else { 9719 trans->ctx.table->use--; 9720 nft_obj_del(nft_trans_obj(trans)); 9721 } 9722 break; 9723 case NFT_MSG_DELOBJ: 9724 case NFT_MSG_DESTROYOBJ: 9725 trans->ctx.table->use++; 9726 nft_clear(trans->ctx.net, nft_trans_obj(trans)); 9727 nft_trans_destroy(trans); 9728 break; 9729 case NFT_MSG_NEWFLOWTABLE: 9730 if (nft_trans_flowtable_update(trans)) { 9731 nft_unregister_flowtable_net_hooks(net, 9732 &nft_trans_flowtable_hooks(trans)); 9733 } else { 9734 trans->ctx.table->use--; 9735 list_del_rcu(&nft_trans_flowtable(trans)->list); 9736 nft_unregister_flowtable_net_hooks(net, 9737 &nft_trans_flowtable(trans)->hook_list); 9738 } 9739 break; 9740 case NFT_MSG_DELFLOWTABLE: 9741 case NFT_MSG_DESTROYFLOWTABLE: 9742 if (nft_trans_flowtable_update(trans)) { 9743 list_splice(&nft_trans_flowtable_hooks(trans), 9744 &nft_trans_flowtable(trans)->hook_list); 9745 } else { 9746 trans->ctx.table->use++; 9747 nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); 9748 } 9749 nft_trans_destroy(trans); 9750 break; 9751 } 9752 } 9753 9754 synchronize_rcu(); 9755 9756 list_for_each_entry_safe_reverse(trans, next, 9757 &nft_net->commit_list, list) { 9758 list_del(&trans->list); 9759 nf_tables_abort_release(trans); 9760 } 9761 9762 if (action == NFNL_ABORT_AUTOLOAD) 9763 nf_tables_module_autoload(net); 9764 else 9765 nf_tables_module_autoload_cleanup(net); 9766 9767 return 0; 9768 } 9769 9770 static int nf_tables_abort(struct net *net, struct sk_buff *skb, 9771 enum nfnl_abort_action action) 9772 { 9773 struct nftables_pernet *nft_net = nft_pernet(net); 9774 int ret = __nf_tables_abort(net, action); 9775 9776 mutex_unlock(&nft_net->commit_mutex); 9777 9778 return ret; 9779 } 9780 9781 static bool nf_tables_valid_genid(struct net *net, u32 genid) 9782 { 9783 struct nftables_pernet *nft_net = nft_pernet(net); 9784 bool genid_ok; 9785 9786 mutex_lock(&nft_net->commit_mutex); 9787 9788 genid_ok = genid == 0 || nft_net->base_seq == genid; 9789 if (!genid_ok) 9790 mutex_unlock(&nft_net->commit_mutex); 9791 9792 /* else, commit mutex has to be released by commit or abort function */ 9793 return genid_ok; 9794 } 9795 9796 static const struct nfnetlink_subsystem nf_tables_subsys = { 9797 .name = "nf_tables", 9798 .subsys_id = NFNL_SUBSYS_NFTABLES, 9799 .cb_count = NFT_MSG_MAX, 9800 .cb = nf_tables_cb, 9801 .commit = nf_tables_commit, 9802 .abort = nf_tables_abort, 9803 .valid_genid = nf_tables_valid_genid, 9804 .owner = THIS_MODULE, 9805 }; 9806 9807 int nft_chain_validate_dependency(const struct nft_chain *chain, 9808 enum nft_chain_types type) 9809 { 9810 const struct nft_base_chain *basechain; 9811 9812 if (nft_is_base_chain(chain)) { 9813 basechain = nft_base_chain(chain); 9814 if (basechain->type->type != type) 9815 return -EOPNOTSUPP; 9816 } 9817 return 0; 9818 } 9819 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 9820 9821 int nft_chain_validate_hooks(const struct nft_chain *chain, 9822 unsigned int hook_flags) 9823 { 9824 struct nft_base_chain *basechain; 9825 9826 if (nft_is_base_chain(chain)) { 9827 basechain = nft_base_chain(chain); 9828 9829 if ((1 << basechain->ops.hooknum) & hook_flags) 9830 return 0; 9831 9832 return -EOPNOTSUPP; 9833 } 9834 9835 return 0; 9836 } 9837 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 9838 9839 /* 9840 * Loop detection - walk through the ruleset beginning at the destination chain 9841 * of a new jump until either the source chain is reached (loop) or all 9842 * reachable chains have been traversed. 9843 * 9844 * The loop check is performed whenever a new jump verdict is added to an 9845 * expression or verdict map or a verdict map is bound to a new chain. 9846 */ 9847 9848 static int nf_tables_check_loops(const struct nft_ctx *ctx, 9849 const struct nft_chain *chain); 9850 9851 static int nft_check_loops(const struct nft_ctx *ctx, 9852 const struct nft_set_ext *ext) 9853 { 9854 const struct nft_data *data; 9855 int ret; 9856 9857 data = nft_set_ext_data(ext); 9858 switch (data->verdict.code) { 9859 case NFT_JUMP: 9860 case NFT_GOTO: 9861 ret = nf_tables_check_loops(ctx, data->verdict.chain); 9862 break; 9863 default: 9864 ret = 0; 9865 break; 9866 } 9867 9868 return ret; 9869 } 9870 9871 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, 9872 struct nft_set *set, 9873 const struct nft_set_iter *iter, 9874 struct nft_set_elem *elem) 9875 { 9876 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 9877 9878 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 9879 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 9880 return 0; 9881 9882 return nft_check_loops(ctx, ext); 9883 } 9884 9885 static int nft_set_catchall_loops(const struct nft_ctx *ctx, 9886 struct nft_set *set) 9887 { 9888 u8 genmask = nft_genmask_next(ctx->net); 9889 struct nft_set_elem_catchall *catchall; 9890 struct nft_set_ext *ext; 9891 int ret = 0; 9892 9893 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 9894 ext = nft_set_elem_ext(set, catchall->elem); 9895 if (!nft_set_elem_active(ext, genmask)) 9896 continue; 9897 9898 ret = nft_check_loops(ctx, ext); 9899 if (ret < 0) 9900 return ret; 9901 } 9902 9903 return ret; 9904 } 9905 9906 static int nf_tables_check_loops(const struct nft_ctx *ctx, 9907 const struct nft_chain *chain) 9908 { 9909 const struct nft_rule *rule; 9910 const struct nft_expr *expr, *last; 9911 struct nft_set *set; 9912 struct nft_set_binding *binding; 9913 struct nft_set_iter iter; 9914 9915 if (ctx->chain == chain) 9916 return -ELOOP; 9917 9918 list_for_each_entry(rule, &chain->rules, list) { 9919 nft_rule_for_each_expr(expr, last, rule) { 9920 struct nft_immediate_expr *priv; 9921 const struct nft_data *data; 9922 int err; 9923 9924 if (strcmp(expr->ops->type->name, "immediate")) 9925 continue; 9926 9927 priv = nft_expr_priv(expr); 9928 if (priv->dreg != NFT_REG_VERDICT) 9929 continue; 9930 9931 data = &priv->data; 9932 switch (data->verdict.code) { 9933 case NFT_JUMP: 9934 case NFT_GOTO: 9935 err = nf_tables_check_loops(ctx, 9936 data->verdict.chain); 9937 if (err < 0) 9938 return err; 9939 break; 9940 default: 9941 break; 9942 } 9943 } 9944 } 9945 9946 list_for_each_entry(set, &ctx->table->sets, list) { 9947 if (!nft_is_active_next(ctx->net, set)) 9948 continue; 9949 if (!(set->flags & NFT_SET_MAP) || 9950 set->dtype != NFT_DATA_VERDICT) 9951 continue; 9952 9953 list_for_each_entry(binding, &set->bindings, list) { 9954 if (!(binding->flags & NFT_SET_MAP) || 9955 binding->chain != chain) 9956 continue; 9957 9958 iter.genmask = nft_genmask_next(ctx->net); 9959 iter.skip = 0; 9960 iter.count = 0; 9961 iter.err = 0; 9962 iter.fn = nf_tables_loop_check_setelem; 9963 9964 set->ops->walk(ctx, set, &iter); 9965 if (!iter.err) 9966 iter.err = nft_set_catchall_loops(ctx, set); 9967 9968 if (iter.err < 0) 9969 return iter.err; 9970 } 9971 } 9972 9973 return 0; 9974 } 9975 9976 /** 9977 * nft_parse_u32_check - fetch u32 attribute and check for maximum value 9978 * 9979 * @attr: netlink attribute to fetch value from 9980 * @max: maximum value to be stored in dest 9981 * @dest: pointer to the variable 9982 * 9983 * Parse, check and store a given u32 netlink attribute into variable. 9984 * This function returns -ERANGE if the value goes over maximum value. 9985 * Otherwise a 0 is returned and the attribute value is stored in the 9986 * destination variable. 9987 */ 9988 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 9989 { 9990 u32 val; 9991 9992 val = ntohl(nla_get_be32(attr)); 9993 if (val > max) 9994 return -ERANGE; 9995 9996 *dest = val; 9997 return 0; 9998 } 9999 EXPORT_SYMBOL_GPL(nft_parse_u32_check); 10000 10001 static int nft_parse_register(const struct nlattr *attr, u32 *preg) 10002 { 10003 unsigned int reg; 10004 10005 reg = ntohl(nla_get_be32(attr)); 10006 switch (reg) { 10007 case NFT_REG_VERDICT...NFT_REG_4: 10008 *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; 10009 break; 10010 case NFT_REG32_00...NFT_REG32_15: 10011 *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 10012 break; 10013 default: 10014 return -ERANGE; 10015 } 10016 10017 return 0; 10018 } 10019 10020 /** 10021 * nft_dump_register - dump a register value to a netlink attribute 10022 * 10023 * @skb: socket buffer 10024 * @attr: attribute number 10025 * @reg: register number 10026 * 10027 * Construct a netlink attribute containing the register number. For 10028 * compatibility reasons, register numbers being a multiple of 4 are 10029 * translated to the corresponding 128 bit register numbers. 10030 */ 10031 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 10032 { 10033 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 10034 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 10035 else 10036 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 10037 10038 return nla_put_be32(skb, attr, htonl(reg)); 10039 } 10040 EXPORT_SYMBOL_GPL(nft_dump_register); 10041 10042 static int nft_validate_register_load(enum nft_registers reg, unsigned int len) 10043 { 10044 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 10045 return -EINVAL; 10046 if (len == 0) 10047 return -EINVAL; 10048 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data)) 10049 return -ERANGE; 10050 10051 return 0; 10052 } 10053 10054 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len) 10055 { 10056 u32 reg; 10057 int err; 10058 10059 err = nft_parse_register(attr, ®); 10060 if (err < 0) 10061 return err; 10062 10063 err = nft_validate_register_load(reg, len); 10064 if (err < 0) 10065 return err; 10066 10067 *sreg = reg; 10068 return 0; 10069 } 10070 EXPORT_SYMBOL_GPL(nft_parse_register_load); 10071 10072 static int nft_validate_register_store(const struct nft_ctx *ctx, 10073 enum nft_registers reg, 10074 const struct nft_data *data, 10075 enum nft_data_types type, 10076 unsigned int len) 10077 { 10078 int err; 10079 10080 switch (reg) { 10081 case NFT_REG_VERDICT: 10082 if (type != NFT_DATA_VERDICT) 10083 return -EINVAL; 10084 10085 if (data != NULL && 10086 (data->verdict.code == NFT_GOTO || 10087 data->verdict.code == NFT_JUMP)) { 10088 err = nf_tables_check_loops(ctx, data->verdict.chain); 10089 if (err < 0) 10090 return err; 10091 } 10092 10093 return 0; 10094 default: 10095 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 10096 return -EINVAL; 10097 if (len == 0) 10098 return -EINVAL; 10099 if (reg * NFT_REG32_SIZE + len > 10100 sizeof_field(struct nft_regs, data)) 10101 return -ERANGE; 10102 10103 if (data != NULL && type != NFT_DATA_VALUE) 10104 return -EINVAL; 10105 return 0; 10106 } 10107 } 10108 10109 int nft_parse_register_store(const struct nft_ctx *ctx, 10110 const struct nlattr *attr, u8 *dreg, 10111 const struct nft_data *data, 10112 enum nft_data_types type, unsigned int len) 10113 { 10114 int err; 10115 u32 reg; 10116 10117 err = nft_parse_register(attr, ®); 10118 if (err < 0) 10119 return err; 10120 10121 err = nft_validate_register_store(ctx, reg, data, type, len); 10122 if (err < 0) 10123 return err; 10124 10125 *dreg = reg; 10126 return 0; 10127 } 10128 EXPORT_SYMBOL_GPL(nft_parse_register_store); 10129 10130 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 10131 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 10132 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 10133 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 10134 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 }, 10135 }; 10136 10137 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 10138 struct nft_data_desc *desc, const struct nlattr *nla) 10139 { 10140 u8 genmask = nft_genmask_next(ctx->net); 10141 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 10142 struct nft_chain *chain; 10143 int err; 10144 10145 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla, 10146 nft_verdict_policy, NULL); 10147 if (err < 0) 10148 return err; 10149 10150 if (!tb[NFTA_VERDICT_CODE]) 10151 return -EINVAL; 10152 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 10153 10154 switch (data->verdict.code) { 10155 default: 10156 switch (data->verdict.code & NF_VERDICT_MASK) { 10157 case NF_ACCEPT: 10158 case NF_DROP: 10159 case NF_QUEUE: 10160 break; 10161 default: 10162 return -EINVAL; 10163 } 10164 fallthrough; 10165 case NFT_CONTINUE: 10166 case NFT_BREAK: 10167 case NFT_RETURN: 10168 break; 10169 case NFT_JUMP: 10170 case NFT_GOTO: 10171 if (tb[NFTA_VERDICT_CHAIN]) { 10172 chain = nft_chain_lookup(ctx->net, ctx->table, 10173 tb[NFTA_VERDICT_CHAIN], 10174 genmask); 10175 } else if (tb[NFTA_VERDICT_CHAIN_ID]) { 10176 chain = nft_chain_lookup_byid(ctx->net, ctx->table, 10177 tb[NFTA_VERDICT_CHAIN_ID]); 10178 if (IS_ERR(chain)) 10179 return PTR_ERR(chain); 10180 } else { 10181 return -EINVAL; 10182 } 10183 10184 if (IS_ERR(chain)) 10185 return PTR_ERR(chain); 10186 if (nft_is_base_chain(chain)) 10187 return -EOPNOTSUPP; 10188 if (nft_chain_is_bound(chain)) 10189 return -EINVAL; 10190 if (desc->flags & NFT_DATA_DESC_SETELEM && 10191 chain->flags & NFT_CHAIN_BINDING) 10192 return -EINVAL; 10193 10194 chain->use++; 10195 data->verdict.chain = chain; 10196 break; 10197 } 10198 10199 desc->len = sizeof(data->verdict); 10200 10201 return 0; 10202 } 10203 10204 static void nft_verdict_uninit(const struct nft_data *data) 10205 { 10206 struct nft_chain *chain; 10207 struct nft_rule *rule; 10208 10209 switch (data->verdict.code) { 10210 case NFT_JUMP: 10211 case NFT_GOTO: 10212 chain = data->verdict.chain; 10213 chain->use--; 10214 10215 if (!nft_chain_is_bound(chain)) 10216 break; 10217 10218 chain->table->use--; 10219 list_for_each_entry(rule, &chain->rules, list) 10220 chain->use--; 10221 10222 nft_chain_del(chain); 10223 break; 10224 } 10225 } 10226 10227 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v) 10228 { 10229 struct nlattr *nest; 10230 10231 nest = nla_nest_start_noflag(skb, type); 10232 if (!nest) 10233 goto nla_put_failure; 10234 10235 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code))) 10236 goto nla_put_failure; 10237 10238 switch (v->code) { 10239 case NFT_JUMP: 10240 case NFT_GOTO: 10241 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 10242 v->chain->name)) 10243 goto nla_put_failure; 10244 } 10245 nla_nest_end(skb, nest); 10246 return 0; 10247 10248 nla_put_failure: 10249 return -1; 10250 } 10251 10252 static int nft_value_init(const struct nft_ctx *ctx, 10253 struct nft_data *data, struct nft_data_desc *desc, 10254 const struct nlattr *nla) 10255 { 10256 unsigned int len; 10257 10258 len = nla_len(nla); 10259 if (len == 0) 10260 return -EINVAL; 10261 if (len > desc->size) 10262 return -EOVERFLOW; 10263 if (desc->len) { 10264 if (len != desc->len) 10265 return -EINVAL; 10266 } else { 10267 desc->len = len; 10268 } 10269 10270 nla_memcpy(data->data, nla, len); 10271 10272 return 0; 10273 } 10274 10275 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 10276 unsigned int len) 10277 { 10278 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 10279 } 10280 10281 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 10282 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 10283 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 10284 }; 10285 10286 /** 10287 * nft_data_init - parse nf_tables data netlink attributes 10288 * 10289 * @ctx: context of the expression using the data 10290 * @data: destination struct nft_data 10291 * @desc: data description 10292 * @nla: netlink attribute containing data 10293 * 10294 * Parse the netlink data attributes and initialize a struct nft_data. 10295 * The type and length of data are returned in the data description. 10296 * 10297 * The caller can indicate that it only wants to accept data of type 10298 * NFT_DATA_VALUE by passing NULL for the ctx argument. 10299 */ 10300 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, 10301 struct nft_data_desc *desc, const struct nlattr *nla) 10302 { 10303 struct nlattr *tb[NFTA_DATA_MAX + 1]; 10304 int err; 10305 10306 if (WARN_ON_ONCE(!desc->size)) 10307 return -EINVAL; 10308 10309 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla, 10310 nft_data_policy, NULL); 10311 if (err < 0) 10312 return err; 10313 10314 if (tb[NFTA_DATA_VALUE]) { 10315 if (desc->type != NFT_DATA_VALUE) 10316 return -EINVAL; 10317 10318 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]); 10319 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) { 10320 if (desc->type != NFT_DATA_VERDICT) 10321 return -EINVAL; 10322 10323 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 10324 } else { 10325 err = -EINVAL; 10326 } 10327 10328 return err; 10329 } 10330 EXPORT_SYMBOL_GPL(nft_data_init); 10331 10332 /** 10333 * nft_data_release - release a nft_data item 10334 * 10335 * @data: struct nft_data to release 10336 * @type: type of data 10337 * 10338 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 10339 * all others need to be released by calling this function. 10340 */ 10341 void nft_data_release(const struct nft_data *data, enum nft_data_types type) 10342 { 10343 if (type < NFT_DATA_VERDICT) 10344 return; 10345 switch (type) { 10346 case NFT_DATA_VERDICT: 10347 return nft_verdict_uninit(data); 10348 default: 10349 WARN_ON(1); 10350 } 10351 } 10352 EXPORT_SYMBOL_GPL(nft_data_release); 10353 10354 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 10355 enum nft_data_types type, unsigned int len) 10356 { 10357 struct nlattr *nest; 10358 int err; 10359 10360 nest = nla_nest_start_noflag(skb, attr); 10361 if (nest == NULL) 10362 return -1; 10363 10364 switch (type) { 10365 case NFT_DATA_VALUE: 10366 err = nft_value_dump(skb, data, len); 10367 break; 10368 case NFT_DATA_VERDICT: 10369 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict); 10370 break; 10371 default: 10372 err = -EINVAL; 10373 WARN_ON(1); 10374 } 10375 10376 nla_nest_end(skb, nest); 10377 return err; 10378 } 10379 EXPORT_SYMBOL_GPL(nft_data_dump); 10380 10381 int __nft_release_basechain(struct nft_ctx *ctx) 10382 { 10383 struct nft_rule *rule, *nr; 10384 10385 if (WARN_ON(!nft_is_base_chain(ctx->chain))) 10386 return 0; 10387 10388 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); 10389 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { 10390 list_del(&rule->list); 10391 ctx->chain->use--; 10392 nf_tables_rule_release(ctx, rule); 10393 } 10394 nft_chain_del(ctx->chain); 10395 ctx->table->use--; 10396 nf_tables_chain_destroy(ctx); 10397 10398 return 0; 10399 } 10400 EXPORT_SYMBOL_GPL(__nft_release_basechain); 10401 10402 static void __nft_release_hook(struct net *net, struct nft_table *table) 10403 { 10404 struct nft_flowtable *flowtable; 10405 struct nft_chain *chain; 10406 10407 list_for_each_entry(chain, &table->chains, list) 10408 __nf_tables_unregister_hook(net, table, chain, true); 10409 list_for_each_entry(flowtable, &table->flowtables, list) 10410 __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list, 10411 true); 10412 } 10413 10414 static void __nft_release_hooks(struct net *net) 10415 { 10416 struct nftables_pernet *nft_net = nft_pernet(net); 10417 struct nft_table *table; 10418 10419 list_for_each_entry(table, &nft_net->tables, list) { 10420 if (nft_table_has_owner(table)) 10421 continue; 10422 10423 __nft_release_hook(net, table); 10424 } 10425 } 10426 10427 static void __nft_release_table(struct net *net, struct nft_table *table) 10428 { 10429 struct nft_flowtable *flowtable, *nf; 10430 struct nft_chain *chain, *nc; 10431 struct nft_object *obj, *ne; 10432 struct nft_rule *rule, *nr; 10433 struct nft_set *set, *ns; 10434 struct nft_ctx ctx = { 10435 .net = net, 10436 .family = NFPROTO_NETDEV, 10437 }; 10438 10439 ctx.family = table->family; 10440 ctx.table = table; 10441 list_for_each_entry(chain, &table->chains, list) { 10442 ctx.chain = chain; 10443 list_for_each_entry_safe(rule, nr, &chain->rules, list) { 10444 list_del(&rule->list); 10445 chain->use--; 10446 nf_tables_rule_release(&ctx, rule); 10447 } 10448 } 10449 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 10450 list_del(&flowtable->list); 10451 table->use--; 10452 nf_tables_flowtable_destroy(flowtable); 10453 } 10454 list_for_each_entry_safe(set, ns, &table->sets, list) { 10455 list_del(&set->list); 10456 table->use--; 10457 nft_set_destroy(&ctx, set); 10458 } 10459 list_for_each_entry_safe(obj, ne, &table->objects, list) { 10460 nft_obj_del(obj); 10461 table->use--; 10462 nft_obj_destroy(&ctx, obj); 10463 } 10464 list_for_each_entry_safe(chain, nc, &table->chains, list) { 10465 ctx.chain = chain; 10466 nft_chain_del(chain); 10467 table->use--; 10468 nf_tables_chain_destroy(&ctx); 10469 } 10470 nf_tables_table_destroy(&ctx); 10471 } 10472 10473 static void __nft_release_tables(struct net *net) 10474 { 10475 struct nftables_pernet *nft_net = nft_pernet(net); 10476 struct nft_table *table, *nt; 10477 10478 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 10479 if (nft_table_has_owner(table)) 10480 continue; 10481 10482 list_del(&table->list); 10483 10484 __nft_release_table(net, table); 10485 } 10486 } 10487 10488 static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, 10489 void *ptr) 10490 { 10491 struct nft_table *table, *to_delete[8]; 10492 struct nftables_pernet *nft_net; 10493 struct netlink_notify *n = ptr; 10494 struct net *net = n->net; 10495 unsigned int deleted; 10496 bool restart = false; 10497 10498 if (event != NETLINK_URELEASE || n->protocol != NETLINK_NETFILTER) 10499 return NOTIFY_DONE; 10500 10501 nft_net = nft_pernet(net); 10502 deleted = 0; 10503 mutex_lock(&nft_net->commit_mutex); 10504 if (!list_empty(&nf_tables_destroy_list)) 10505 rcu_barrier(); 10506 again: 10507 list_for_each_entry(table, &nft_net->tables, list) { 10508 if (nft_table_has_owner(table) && 10509 n->portid == table->nlpid) { 10510 __nft_release_hook(net, table); 10511 list_del_rcu(&table->list); 10512 to_delete[deleted++] = table; 10513 if (deleted >= ARRAY_SIZE(to_delete)) 10514 break; 10515 } 10516 } 10517 if (deleted) { 10518 restart = deleted >= ARRAY_SIZE(to_delete); 10519 synchronize_rcu(); 10520 while (deleted) 10521 __nft_release_table(net, to_delete[--deleted]); 10522 10523 if (restart) 10524 goto again; 10525 } 10526 mutex_unlock(&nft_net->commit_mutex); 10527 10528 return NOTIFY_DONE; 10529 } 10530 10531 static struct notifier_block nft_nl_notifier = { 10532 .notifier_call = nft_rcv_nl_event, 10533 }; 10534 10535 static int __net_init nf_tables_init_net(struct net *net) 10536 { 10537 struct nftables_pernet *nft_net = nft_pernet(net); 10538 10539 INIT_LIST_HEAD(&nft_net->tables); 10540 INIT_LIST_HEAD(&nft_net->commit_list); 10541 INIT_LIST_HEAD(&nft_net->module_list); 10542 INIT_LIST_HEAD(&nft_net->notify_list); 10543 mutex_init(&nft_net->commit_mutex); 10544 nft_net->base_seq = 1; 10545 10546 return 0; 10547 } 10548 10549 static void __net_exit nf_tables_pre_exit_net(struct net *net) 10550 { 10551 struct nftables_pernet *nft_net = nft_pernet(net); 10552 10553 mutex_lock(&nft_net->commit_mutex); 10554 __nft_release_hooks(net); 10555 mutex_unlock(&nft_net->commit_mutex); 10556 } 10557 10558 static void __net_exit nf_tables_exit_net(struct net *net) 10559 { 10560 struct nftables_pernet *nft_net = nft_pernet(net); 10561 10562 mutex_lock(&nft_net->commit_mutex); 10563 if (!list_empty(&nft_net->commit_list) || 10564 !list_empty(&nft_net->module_list)) 10565 __nf_tables_abort(net, NFNL_ABORT_NONE); 10566 __nft_release_tables(net); 10567 mutex_unlock(&nft_net->commit_mutex); 10568 WARN_ON_ONCE(!list_empty(&nft_net->tables)); 10569 WARN_ON_ONCE(!list_empty(&nft_net->module_list)); 10570 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 10571 } 10572 10573 static struct pernet_operations nf_tables_net_ops = { 10574 .init = nf_tables_init_net, 10575 .pre_exit = nf_tables_pre_exit_net, 10576 .exit = nf_tables_exit_net, 10577 .id = &nf_tables_net_id, 10578 .size = sizeof(struct nftables_pernet), 10579 }; 10580 10581 static int __init nf_tables_module_init(void) 10582 { 10583 int err; 10584 10585 err = register_pernet_subsys(&nf_tables_net_ops); 10586 if (err < 0) 10587 return err; 10588 10589 err = nft_chain_filter_init(); 10590 if (err < 0) 10591 goto err_chain_filter; 10592 10593 err = nf_tables_core_module_init(); 10594 if (err < 0) 10595 goto err_core_module; 10596 10597 err = register_netdevice_notifier(&nf_tables_flowtable_notifier); 10598 if (err < 0) 10599 goto err_netdev_notifier; 10600 10601 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params); 10602 if (err < 0) 10603 goto err_rht_objname; 10604 10605 err = nft_offload_init(); 10606 if (err < 0) 10607 goto err_offload; 10608 10609 err = netlink_register_notifier(&nft_nl_notifier); 10610 if (err < 0) 10611 goto err_netlink_notifier; 10612 10613 /* must be last */ 10614 err = nfnetlink_subsys_register(&nf_tables_subsys); 10615 if (err < 0) 10616 goto err_nfnl_subsys; 10617 10618 nft_chain_route_init(); 10619 10620 return err; 10621 10622 err_nfnl_subsys: 10623 netlink_unregister_notifier(&nft_nl_notifier); 10624 err_netlink_notifier: 10625 nft_offload_exit(); 10626 err_offload: 10627 rhltable_destroy(&nft_objname_ht); 10628 err_rht_objname: 10629 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 10630 err_netdev_notifier: 10631 nf_tables_core_module_exit(); 10632 err_core_module: 10633 nft_chain_filter_fini(); 10634 err_chain_filter: 10635 unregister_pernet_subsys(&nf_tables_net_ops); 10636 return err; 10637 } 10638 10639 static void __exit nf_tables_module_exit(void) 10640 { 10641 nfnetlink_subsys_unregister(&nf_tables_subsys); 10642 netlink_unregister_notifier(&nft_nl_notifier); 10643 nft_offload_exit(); 10644 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 10645 nft_chain_filter_fini(); 10646 nft_chain_route_fini(); 10647 unregister_pernet_subsys(&nf_tables_net_ops); 10648 cancel_work_sync(&trans_destroy_work); 10649 rcu_barrier(); 10650 rhltable_destroy(&nft_objname_ht); 10651 nf_tables_core_module_exit(); 10652 } 10653 10654 module_init(nf_tables_module_init); 10655 module_exit(nf_tables_module_exit); 10656 10657 MODULE_LICENSE("GPL"); 10658 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 10659 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 10660