1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/module.h> 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/skbuff.h> 12 #include <linux/netlink.h> 13 #include <linux/vmalloc.h> 14 #include <linux/rhashtable.h> 15 #include <linux/audit.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nfnetlink.h> 18 #include <linux/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_flow_table.h> 20 #include <net/netfilter/nf_tables_core.h> 21 #include <net/netfilter/nf_tables.h> 22 #include <net/netfilter/nf_tables_offload.h> 23 #include <net/net_namespace.h> 24 #include <net/sock.h> 25 26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) 27 28 unsigned int nf_tables_net_id __read_mostly; 29 30 static LIST_HEAD(nf_tables_expressions); 31 static LIST_HEAD(nf_tables_objects); 32 static LIST_HEAD(nf_tables_flowtables); 33 static LIST_HEAD(nf_tables_destroy_list); 34 static LIST_HEAD(nf_tables_gc_list); 35 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock); 36 static DEFINE_SPINLOCK(nf_tables_gc_list_lock); 37 38 enum { 39 NFT_VALIDATE_SKIP = 0, 40 NFT_VALIDATE_NEED, 41 NFT_VALIDATE_DO, 42 }; 43 44 static struct rhltable nft_objname_ht; 45 46 static u32 nft_chain_hash(const void *data, u32 len, u32 seed); 47 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed); 48 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *); 49 50 static u32 nft_objname_hash(const void *data, u32 len, u32 seed); 51 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed); 52 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *); 53 54 static const struct rhashtable_params nft_chain_ht_params = { 55 .head_offset = offsetof(struct nft_chain, rhlhead), 56 .key_offset = offsetof(struct nft_chain, name), 57 .hashfn = nft_chain_hash, 58 .obj_hashfn = nft_chain_hash_obj, 59 .obj_cmpfn = nft_chain_hash_cmp, 60 .automatic_shrinking = true, 61 }; 62 63 static const struct rhashtable_params nft_objname_ht_params = { 64 .head_offset = offsetof(struct nft_object, rhlhead), 65 .key_offset = offsetof(struct nft_object, key), 66 .hashfn = nft_objname_hash, 67 .obj_hashfn = nft_objname_hash_obj, 68 .obj_cmpfn = nft_objname_hash_cmp, 69 .automatic_shrinking = true, 70 }; 71 72 struct nft_audit_data { 73 struct nft_table *table; 74 int entries; 75 int op; 76 struct list_head list; 77 }; 78 79 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types 80 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, 81 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, 82 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, 83 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, 84 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, 85 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, 86 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, 87 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, 88 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, 89 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, 90 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, 91 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, 92 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, 93 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, 94 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, 95 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, 96 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, 97 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, 98 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, 99 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, 100 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, 101 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, 102 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, 103 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, 104 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 105 [NFT_MSG_GETSETELEM_RESET] = AUDIT_NFT_OP_SETELEM_RESET, 106 }; 107 108 static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state) 109 { 110 switch (table->validate_state) { 111 case NFT_VALIDATE_SKIP: 112 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); 113 break; 114 case NFT_VALIDATE_NEED: 115 break; 116 case NFT_VALIDATE_DO: 117 if (new_validate_state == NFT_VALIDATE_NEED) 118 return; 119 } 120 121 table->validate_state = new_validate_state; 122 } 123 static void nf_tables_trans_destroy_work(struct work_struct *w); 124 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work); 125 126 static void nft_trans_gc_work(struct work_struct *work); 127 static DECLARE_WORK(trans_gc_work, nft_trans_gc_work); 128 129 static void nft_ctx_init(struct nft_ctx *ctx, 130 struct net *net, 131 const struct sk_buff *skb, 132 const struct nlmsghdr *nlh, 133 u8 family, 134 struct nft_table *table, 135 struct nft_chain *chain, 136 const struct nlattr * const *nla) 137 { 138 ctx->net = net; 139 ctx->family = family; 140 ctx->level = 0; 141 ctx->table = table; 142 ctx->chain = chain; 143 ctx->nla = nla; 144 ctx->portid = NETLINK_CB(skb).portid; 145 ctx->report = nlmsg_report(nlh); 146 ctx->flags = nlh->nlmsg_flags; 147 ctx->seq = nlh->nlmsg_seq; 148 } 149 150 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, 151 int msg_type, u32 size, gfp_t gfp) 152 { 153 struct nft_trans *trans; 154 155 trans = kzalloc(sizeof(struct nft_trans) + size, gfp); 156 if (trans == NULL) 157 return NULL; 158 159 INIT_LIST_HEAD(&trans->list); 160 INIT_LIST_HEAD(&trans->binding_list); 161 trans->msg_type = msg_type; 162 trans->ctx = *ctx; 163 164 return trans; 165 } 166 167 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, 168 int msg_type, u32 size) 169 { 170 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL); 171 } 172 173 static void nft_trans_list_del(struct nft_trans *trans) 174 { 175 list_del(&trans->list); 176 list_del(&trans->binding_list); 177 } 178 179 static void nft_trans_destroy(struct nft_trans *trans) 180 { 181 nft_trans_list_del(trans); 182 kfree(trans); 183 } 184 185 static void __nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set, 186 bool bind) 187 { 188 struct nftables_pernet *nft_net; 189 struct net *net = ctx->net; 190 struct nft_trans *trans; 191 192 if (!nft_set_is_anonymous(set)) 193 return; 194 195 nft_net = nft_pernet(net); 196 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 197 switch (trans->msg_type) { 198 case NFT_MSG_NEWSET: 199 if (nft_trans_set(trans) == set) 200 nft_trans_set_bound(trans) = bind; 201 break; 202 case NFT_MSG_NEWSETELEM: 203 if (nft_trans_elem_set(trans) == set) 204 nft_trans_elem_set_bound(trans) = bind; 205 break; 206 } 207 } 208 } 209 210 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) 211 { 212 return __nft_set_trans_bind(ctx, set, true); 213 } 214 215 static void nft_set_trans_unbind(const struct nft_ctx *ctx, struct nft_set *set) 216 { 217 return __nft_set_trans_bind(ctx, set, false); 218 } 219 220 static void __nft_chain_trans_bind(const struct nft_ctx *ctx, 221 struct nft_chain *chain, bool bind) 222 { 223 struct nftables_pernet *nft_net; 224 struct net *net = ctx->net; 225 struct nft_trans *trans; 226 227 if (!nft_chain_binding(chain)) 228 return; 229 230 nft_net = nft_pernet(net); 231 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 232 switch (trans->msg_type) { 233 case NFT_MSG_NEWCHAIN: 234 if (nft_trans_chain(trans) == chain) 235 nft_trans_chain_bound(trans) = bind; 236 break; 237 case NFT_MSG_NEWRULE: 238 if (trans->ctx.chain == chain) 239 nft_trans_rule_bound(trans) = bind; 240 break; 241 } 242 } 243 } 244 245 static void nft_chain_trans_bind(const struct nft_ctx *ctx, 246 struct nft_chain *chain) 247 { 248 __nft_chain_trans_bind(ctx, chain, true); 249 } 250 251 int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain) 252 { 253 if (!nft_chain_binding(chain)) 254 return 0; 255 256 if (nft_chain_binding(ctx->chain)) 257 return -EOPNOTSUPP; 258 259 if (chain->bound) 260 return -EBUSY; 261 262 if (!nft_use_inc(&chain->use)) 263 return -EMFILE; 264 265 chain->bound = true; 266 nft_chain_trans_bind(ctx, chain); 267 268 return 0; 269 } 270 271 void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain) 272 { 273 __nft_chain_trans_bind(ctx, chain, false); 274 } 275 276 static int nft_netdev_register_hooks(struct net *net, 277 struct list_head *hook_list) 278 { 279 struct nft_hook *hook; 280 int err, j; 281 282 j = 0; 283 list_for_each_entry(hook, hook_list, list) { 284 err = nf_register_net_hook(net, &hook->ops); 285 if (err < 0) 286 goto err_register; 287 288 j++; 289 } 290 return 0; 291 292 err_register: 293 list_for_each_entry(hook, hook_list, list) { 294 if (j-- <= 0) 295 break; 296 297 nf_unregister_net_hook(net, &hook->ops); 298 } 299 return err; 300 } 301 302 static void nft_netdev_unregister_hooks(struct net *net, 303 struct list_head *hook_list, 304 bool release_netdev) 305 { 306 struct nft_hook *hook, *next; 307 308 list_for_each_entry_safe(hook, next, hook_list, list) { 309 nf_unregister_net_hook(net, &hook->ops); 310 if (release_netdev) { 311 list_del(&hook->list); 312 kfree_rcu(hook, rcu); 313 } 314 } 315 } 316 317 static int nf_tables_register_hook(struct net *net, 318 const struct nft_table *table, 319 struct nft_chain *chain) 320 { 321 struct nft_base_chain *basechain; 322 const struct nf_hook_ops *ops; 323 324 if (table->flags & NFT_TABLE_F_DORMANT || 325 !nft_is_base_chain(chain)) 326 return 0; 327 328 basechain = nft_base_chain(chain); 329 ops = &basechain->ops; 330 331 if (basechain->type->ops_register) 332 return basechain->type->ops_register(net, ops); 333 334 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 335 return nft_netdev_register_hooks(net, &basechain->hook_list); 336 337 return nf_register_net_hook(net, &basechain->ops); 338 } 339 340 static void __nf_tables_unregister_hook(struct net *net, 341 const struct nft_table *table, 342 struct nft_chain *chain, 343 bool release_netdev) 344 { 345 struct nft_base_chain *basechain; 346 const struct nf_hook_ops *ops; 347 348 if (table->flags & NFT_TABLE_F_DORMANT || 349 !nft_is_base_chain(chain)) 350 return; 351 basechain = nft_base_chain(chain); 352 ops = &basechain->ops; 353 354 if (basechain->type->ops_unregister) 355 return basechain->type->ops_unregister(net, ops); 356 357 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 358 nft_netdev_unregister_hooks(net, &basechain->hook_list, 359 release_netdev); 360 else 361 nf_unregister_net_hook(net, &basechain->ops); 362 } 363 364 static void nf_tables_unregister_hook(struct net *net, 365 const struct nft_table *table, 366 struct nft_chain *chain) 367 { 368 return __nf_tables_unregister_hook(net, table, chain, false); 369 } 370 371 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans) 372 { 373 struct nftables_pernet *nft_net = nft_pernet(net); 374 375 switch (trans->msg_type) { 376 case NFT_MSG_NEWSET: 377 if (!nft_trans_set_update(trans) && 378 nft_set_is_anonymous(nft_trans_set(trans))) 379 list_add_tail(&trans->binding_list, &nft_net->binding_list); 380 break; 381 case NFT_MSG_NEWCHAIN: 382 if (!nft_trans_chain_update(trans) && 383 nft_chain_binding(nft_trans_chain(trans))) 384 list_add_tail(&trans->binding_list, &nft_net->binding_list); 385 break; 386 } 387 388 list_add_tail(&trans->list, &nft_net->commit_list); 389 } 390 391 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 392 { 393 struct nft_trans *trans; 394 395 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 396 if (trans == NULL) 397 return -ENOMEM; 398 399 if (msg_type == NFT_MSG_NEWTABLE) 400 nft_activate_next(ctx->net, ctx->table); 401 402 nft_trans_commit_list_add_tail(ctx->net, trans); 403 return 0; 404 } 405 406 static int nft_deltable(struct nft_ctx *ctx) 407 { 408 int err; 409 410 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 411 if (err < 0) 412 return err; 413 414 nft_deactivate_next(ctx->net, ctx->table); 415 return err; 416 } 417 418 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 419 { 420 struct nft_trans *trans; 421 422 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 423 if (trans == NULL) 424 return ERR_PTR(-ENOMEM); 425 426 if (msg_type == NFT_MSG_NEWCHAIN) { 427 nft_activate_next(ctx->net, ctx->chain); 428 429 if (ctx->nla[NFTA_CHAIN_ID]) { 430 nft_trans_chain_id(trans) = 431 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID])); 432 } 433 } 434 nft_trans_chain(trans) = ctx->chain; 435 nft_trans_commit_list_add_tail(ctx->net, trans); 436 437 return trans; 438 } 439 440 static int nft_delchain(struct nft_ctx *ctx) 441 { 442 struct nft_trans *trans; 443 444 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 445 if (IS_ERR(trans)) 446 return PTR_ERR(trans); 447 448 nft_use_dec(&ctx->table->use); 449 nft_deactivate_next(ctx->net, ctx->chain); 450 451 return 0; 452 } 453 454 void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule) 455 { 456 struct nft_expr *expr; 457 458 expr = nft_expr_first(rule); 459 while (nft_expr_more(rule, expr)) { 460 if (expr->ops->activate) 461 expr->ops->activate(ctx, expr); 462 463 expr = nft_expr_next(expr); 464 } 465 } 466 467 void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule, 468 enum nft_trans_phase phase) 469 { 470 struct nft_expr *expr; 471 472 expr = nft_expr_first(rule); 473 while (nft_expr_more(rule, expr)) { 474 if (expr->ops->deactivate) 475 expr->ops->deactivate(ctx, expr, phase); 476 477 expr = nft_expr_next(expr); 478 } 479 } 480 481 static int 482 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 483 { 484 /* You cannot delete the same rule twice */ 485 if (nft_is_active_next(ctx->net, rule)) { 486 nft_deactivate_next(ctx->net, rule); 487 nft_use_dec(&ctx->chain->use); 488 return 0; 489 } 490 return -ENOENT; 491 } 492 493 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 494 struct nft_rule *rule) 495 { 496 struct nft_trans *trans; 497 498 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 499 if (trans == NULL) 500 return NULL; 501 502 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) { 503 nft_trans_rule_id(trans) = 504 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); 505 } 506 nft_trans_rule(trans) = rule; 507 nft_trans_commit_list_add_tail(ctx->net, trans); 508 509 return trans; 510 } 511 512 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 513 { 514 struct nft_flow_rule *flow; 515 struct nft_trans *trans; 516 int err; 517 518 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 519 if (trans == NULL) 520 return -ENOMEM; 521 522 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) { 523 flow = nft_flow_rule_create(ctx->net, rule); 524 if (IS_ERR(flow)) { 525 nft_trans_destroy(trans); 526 return PTR_ERR(flow); 527 } 528 529 nft_trans_flow_rule(trans) = flow; 530 } 531 532 err = nf_tables_delrule_deactivate(ctx, rule); 533 if (err < 0) { 534 nft_trans_destroy(trans); 535 return err; 536 } 537 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE); 538 539 return 0; 540 } 541 542 static int nft_delrule_by_chain(struct nft_ctx *ctx) 543 { 544 struct nft_rule *rule; 545 int err; 546 547 list_for_each_entry(rule, &ctx->chain->rules, list) { 548 if (!nft_is_active_next(ctx->net, rule)) 549 continue; 550 551 err = nft_delrule(ctx, rule); 552 if (err < 0) 553 return err; 554 } 555 return 0; 556 } 557 558 static int __nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 559 struct nft_set *set, 560 const struct nft_set_desc *desc) 561 { 562 struct nft_trans *trans; 563 564 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 565 if (trans == NULL) 566 return -ENOMEM; 567 568 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] && !desc) { 569 nft_trans_set_id(trans) = 570 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 571 nft_activate_next(ctx->net, set); 572 } 573 nft_trans_set(trans) = set; 574 if (desc) { 575 nft_trans_set_update(trans) = true; 576 nft_trans_set_gc_int(trans) = desc->gc_int; 577 nft_trans_set_timeout(trans) = desc->timeout; 578 nft_trans_set_size(trans) = desc->size; 579 } 580 nft_trans_commit_list_add_tail(ctx->net, trans); 581 582 return 0; 583 } 584 585 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 586 struct nft_set *set) 587 { 588 return __nft_trans_set_add(ctx, msg_type, set, NULL); 589 } 590 591 static int nft_mapelem_deactivate(const struct nft_ctx *ctx, 592 struct nft_set *set, 593 const struct nft_set_iter *iter, 594 struct nft_set_elem *elem) 595 { 596 nft_setelem_data_deactivate(ctx->net, set, elem); 597 598 return 0; 599 } 600 601 struct nft_set_elem_catchall { 602 struct list_head list; 603 struct rcu_head rcu; 604 void *elem; 605 }; 606 607 static void nft_map_catchall_deactivate(const struct nft_ctx *ctx, 608 struct nft_set *set) 609 { 610 u8 genmask = nft_genmask_next(ctx->net); 611 struct nft_set_elem_catchall *catchall; 612 struct nft_set_elem elem; 613 struct nft_set_ext *ext; 614 615 list_for_each_entry(catchall, &set->catchall_list, list) { 616 ext = nft_set_elem_ext(set, catchall->elem); 617 if (!nft_set_elem_active(ext, genmask)) 618 continue; 619 620 elem.priv = catchall->elem; 621 nft_setelem_data_deactivate(ctx->net, set, &elem); 622 break; 623 } 624 } 625 626 static void nft_map_deactivate(const struct nft_ctx *ctx, struct nft_set *set) 627 { 628 struct nft_set_iter iter = { 629 .genmask = nft_genmask_next(ctx->net), 630 .fn = nft_mapelem_deactivate, 631 }; 632 633 set->ops->walk(ctx, set, &iter); 634 WARN_ON_ONCE(iter.err); 635 636 nft_map_catchall_deactivate(ctx, set); 637 } 638 639 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set) 640 { 641 int err; 642 643 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 644 if (err < 0) 645 return err; 646 647 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 648 nft_map_deactivate(ctx, set); 649 650 nft_deactivate_next(ctx->net, set); 651 nft_use_dec(&ctx->table->use); 652 653 return err; 654 } 655 656 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, 657 struct nft_object *obj) 658 { 659 struct nft_trans *trans; 660 661 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj)); 662 if (trans == NULL) 663 return -ENOMEM; 664 665 if (msg_type == NFT_MSG_NEWOBJ) 666 nft_activate_next(ctx->net, obj); 667 668 nft_trans_obj(trans) = obj; 669 nft_trans_commit_list_add_tail(ctx->net, trans); 670 671 return 0; 672 } 673 674 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj) 675 { 676 int err; 677 678 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj); 679 if (err < 0) 680 return err; 681 682 nft_deactivate_next(ctx->net, obj); 683 nft_use_dec(&ctx->table->use); 684 685 return err; 686 } 687 688 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, 689 struct nft_flowtable *flowtable) 690 { 691 struct nft_trans *trans; 692 693 trans = nft_trans_alloc(ctx, msg_type, 694 sizeof(struct nft_trans_flowtable)); 695 if (trans == NULL) 696 return -ENOMEM; 697 698 if (msg_type == NFT_MSG_NEWFLOWTABLE) 699 nft_activate_next(ctx->net, flowtable); 700 701 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 702 nft_trans_flowtable(trans) = flowtable; 703 nft_trans_commit_list_add_tail(ctx->net, trans); 704 705 return 0; 706 } 707 708 static int nft_delflowtable(struct nft_ctx *ctx, 709 struct nft_flowtable *flowtable) 710 { 711 int err; 712 713 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); 714 if (err < 0) 715 return err; 716 717 nft_deactivate_next(ctx->net, flowtable); 718 nft_use_dec(&ctx->table->use); 719 720 return err; 721 } 722 723 static void __nft_reg_track_clobber(struct nft_regs_track *track, u8 dreg) 724 { 725 int i; 726 727 for (i = track->regs[dreg].num_reg; i > 0; i--) 728 __nft_reg_track_cancel(track, dreg - i); 729 } 730 731 static void __nft_reg_track_update(struct nft_regs_track *track, 732 const struct nft_expr *expr, 733 u8 dreg, u8 num_reg) 734 { 735 track->regs[dreg].selector = expr; 736 track->regs[dreg].bitwise = NULL; 737 track->regs[dreg].num_reg = num_reg; 738 } 739 740 void nft_reg_track_update(struct nft_regs_track *track, 741 const struct nft_expr *expr, u8 dreg, u8 len) 742 { 743 unsigned int regcount; 744 int i; 745 746 __nft_reg_track_clobber(track, dreg); 747 748 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 749 for (i = 0; i < regcount; i++, dreg++) 750 __nft_reg_track_update(track, expr, dreg, i); 751 } 752 EXPORT_SYMBOL_GPL(nft_reg_track_update); 753 754 void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len) 755 { 756 unsigned int regcount; 757 int i; 758 759 __nft_reg_track_clobber(track, dreg); 760 761 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 762 for (i = 0; i < regcount; i++, dreg++) 763 __nft_reg_track_cancel(track, dreg); 764 } 765 EXPORT_SYMBOL_GPL(nft_reg_track_cancel); 766 767 void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg) 768 { 769 track->regs[dreg].selector = NULL; 770 track->regs[dreg].bitwise = NULL; 771 track->regs[dreg].num_reg = 0; 772 } 773 EXPORT_SYMBOL_GPL(__nft_reg_track_cancel); 774 775 /* 776 * Tables 777 */ 778 779 static struct nft_table *nft_table_lookup(const struct net *net, 780 const struct nlattr *nla, 781 u8 family, u8 genmask, u32 nlpid) 782 { 783 struct nftables_pernet *nft_net; 784 struct nft_table *table; 785 786 if (nla == NULL) 787 return ERR_PTR(-EINVAL); 788 789 nft_net = nft_pernet(net); 790 list_for_each_entry_rcu(table, &nft_net->tables, list, 791 lockdep_is_held(&nft_net->commit_mutex)) { 792 if (!nla_strcmp(nla, table->name) && 793 table->family == family && 794 nft_active_genmask(table, genmask)) { 795 if (nft_table_has_owner(table) && 796 nlpid && table->nlpid != nlpid) 797 return ERR_PTR(-EPERM); 798 799 return table; 800 } 801 } 802 803 return ERR_PTR(-ENOENT); 804 } 805 806 static struct nft_table *nft_table_lookup_byhandle(const struct net *net, 807 const struct nlattr *nla, 808 u8 genmask, u32 nlpid) 809 { 810 struct nftables_pernet *nft_net; 811 struct nft_table *table; 812 813 nft_net = nft_pernet(net); 814 list_for_each_entry(table, &nft_net->tables, list) { 815 if (be64_to_cpu(nla_get_be64(nla)) == table->handle && 816 nft_active_genmask(table, genmask)) { 817 if (nft_table_has_owner(table) && 818 nlpid && table->nlpid != nlpid) 819 return ERR_PTR(-EPERM); 820 821 return table; 822 } 823 } 824 825 return ERR_PTR(-ENOENT); 826 } 827 828 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 829 { 830 return ++table->hgenerator; 831 } 832 833 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; 834 835 static const struct nft_chain_type * 836 __nft_chain_type_get(u8 family, enum nft_chain_types type) 837 { 838 if (family >= NFPROTO_NUMPROTO || 839 type >= NFT_CHAIN_T_MAX) 840 return NULL; 841 842 return chain_type[family][type]; 843 } 844 845 static const struct nft_chain_type * 846 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) 847 { 848 const struct nft_chain_type *type; 849 int i; 850 851 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 852 type = __nft_chain_type_get(family, i); 853 if (!type) 854 continue; 855 if (!nla_strcmp(nla, type->name)) 856 return type; 857 } 858 return NULL; 859 } 860 861 struct nft_module_request { 862 struct list_head list; 863 char module[MODULE_NAME_LEN]; 864 bool done; 865 }; 866 867 #ifdef CONFIG_MODULES 868 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, 869 ...) 870 { 871 char module_name[MODULE_NAME_LEN]; 872 struct nftables_pernet *nft_net; 873 struct nft_module_request *req; 874 va_list args; 875 int ret; 876 877 va_start(args, fmt); 878 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); 879 va_end(args); 880 if (ret >= MODULE_NAME_LEN) 881 return 0; 882 883 nft_net = nft_pernet(net); 884 list_for_each_entry(req, &nft_net->module_list, list) { 885 if (!strcmp(req->module, module_name)) { 886 if (req->done) 887 return 0; 888 889 /* A request to load this module already exists. */ 890 return -EAGAIN; 891 } 892 } 893 894 req = kmalloc(sizeof(*req), GFP_KERNEL); 895 if (!req) 896 return -ENOMEM; 897 898 req->done = false; 899 strscpy(req->module, module_name, MODULE_NAME_LEN); 900 list_add_tail(&req->list, &nft_net->module_list); 901 902 return -EAGAIN; 903 } 904 EXPORT_SYMBOL_GPL(nft_request_module); 905 #endif 906 907 static void lockdep_nfnl_nft_mutex_not_held(void) 908 { 909 #ifdef CONFIG_PROVE_LOCKING 910 if (debug_locks) 911 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES)); 912 #endif 913 } 914 915 static const struct nft_chain_type * 916 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, 917 u8 family, bool autoload) 918 { 919 const struct nft_chain_type *type; 920 921 type = __nf_tables_chain_type_lookup(nla, family); 922 if (type != NULL) 923 return type; 924 925 lockdep_nfnl_nft_mutex_not_held(); 926 #ifdef CONFIG_MODULES 927 if (autoload) { 928 if (nft_request_module(net, "nft-chain-%u-%.*s", family, 929 nla_len(nla), 930 (const char *)nla_data(nla)) == -EAGAIN) 931 return ERR_PTR(-EAGAIN); 932 } 933 #endif 934 return ERR_PTR(-ENOENT); 935 } 936 937 static __be16 nft_base_seq(const struct net *net) 938 { 939 struct nftables_pernet *nft_net = nft_pernet(net); 940 941 return htons(nft_net->base_seq & 0xffff); 942 } 943 944 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 945 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 946 .len = NFT_TABLE_MAXNAMELEN - 1 }, 947 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 948 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, 949 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY, 950 .len = NFT_USERDATA_MAXLEN } 951 }; 952 953 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 954 u32 portid, u32 seq, int event, u32 flags, 955 int family, const struct nft_table *table) 956 { 957 struct nlmsghdr *nlh; 958 959 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 960 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 961 NFNETLINK_V0, nft_base_seq(net)); 962 if (!nlh) 963 goto nla_put_failure; 964 965 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 966 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || 967 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), 968 NFTA_TABLE_PAD)) 969 goto nla_put_failure; 970 971 if (event == NFT_MSG_DELTABLE) { 972 nlmsg_end(skb, nlh); 973 return 0; 974 } 975 976 if (nla_put_be32(skb, NFTA_TABLE_FLAGS, 977 htonl(table->flags & NFT_TABLE_F_MASK))) 978 goto nla_put_failure; 979 980 if (nft_table_has_owner(table) && 981 nla_put_be32(skb, NFTA_TABLE_OWNER, htonl(table->nlpid))) 982 goto nla_put_failure; 983 984 if (table->udata) { 985 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata)) 986 goto nla_put_failure; 987 } 988 989 nlmsg_end(skb, nlh); 990 return 0; 991 992 nla_put_failure: 993 nlmsg_trim(skb, nlh); 994 return -1; 995 } 996 997 struct nftnl_skb_parms { 998 bool report; 999 }; 1000 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb)) 1001 1002 static void nft_notify_enqueue(struct sk_buff *skb, bool report, 1003 struct list_head *notify_list) 1004 { 1005 NFT_CB(skb).report = report; 1006 list_add_tail(&skb->list, notify_list); 1007 } 1008 1009 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) 1010 { 1011 struct nftables_pernet *nft_net; 1012 struct sk_buff *skb; 1013 u16 flags = 0; 1014 int err; 1015 1016 if (!ctx->report && 1017 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1018 return; 1019 1020 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1021 if (skb == NULL) 1022 goto err; 1023 1024 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 1025 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 1026 1027 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 1028 event, flags, ctx->family, ctx->table); 1029 if (err < 0) { 1030 kfree_skb(skb); 1031 goto err; 1032 } 1033 1034 nft_net = nft_pernet(ctx->net); 1035 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 1036 return; 1037 err: 1038 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1039 } 1040 1041 static int nf_tables_dump_tables(struct sk_buff *skb, 1042 struct netlink_callback *cb) 1043 { 1044 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1045 struct nftables_pernet *nft_net; 1046 const struct nft_table *table; 1047 unsigned int idx = 0, s_idx = cb->args[0]; 1048 struct net *net = sock_net(skb->sk); 1049 int family = nfmsg->nfgen_family; 1050 1051 rcu_read_lock(); 1052 nft_net = nft_pernet(net); 1053 cb->seq = READ_ONCE(nft_net->base_seq); 1054 1055 list_for_each_entry_rcu(table, &nft_net->tables, list) { 1056 if (family != NFPROTO_UNSPEC && family != table->family) 1057 continue; 1058 1059 if (idx < s_idx) 1060 goto cont; 1061 if (idx > s_idx) 1062 memset(&cb->args[1], 0, 1063 sizeof(cb->args) - sizeof(cb->args[0])); 1064 if (!nft_is_active(net, table)) 1065 continue; 1066 if (nf_tables_fill_table_info(skb, net, 1067 NETLINK_CB(cb->skb).portid, 1068 cb->nlh->nlmsg_seq, 1069 NFT_MSG_NEWTABLE, NLM_F_MULTI, 1070 table->family, table) < 0) 1071 goto done; 1072 1073 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1074 cont: 1075 idx++; 1076 } 1077 done: 1078 rcu_read_unlock(); 1079 cb->args[0] = idx; 1080 return skb->len; 1081 } 1082 1083 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb, 1084 const struct nlmsghdr *nlh, 1085 struct netlink_dump_control *c) 1086 { 1087 int err; 1088 1089 if (!try_module_get(THIS_MODULE)) 1090 return -EINVAL; 1091 1092 rcu_read_unlock(); 1093 err = netlink_dump_start(nlsk, skb, nlh, c); 1094 rcu_read_lock(); 1095 module_put(THIS_MODULE); 1096 1097 return err; 1098 } 1099 1100 /* called with rcu_read_lock held */ 1101 static int nf_tables_gettable(struct sk_buff *skb, const struct nfnl_info *info, 1102 const struct nlattr * const nla[]) 1103 { 1104 struct netlink_ext_ack *extack = info->extack; 1105 u8 genmask = nft_genmask_cur(info->net); 1106 u8 family = info->nfmsg->nfgen_family; 1107 const struct nft_table *table; 1108 struct net *net = info->net; 1109 struct sk_buff *skb2; 1110 int err; 1111 1112 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1113 struct netlink_dump_control c = { 1114 .dump = nf_tables_dump_tables, 1115 .module = THIS_MODULE, 1116 }; 1117 1118 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 1119 } 1120 1121 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask, 0); 1122 if (IS_ERR(table)) { 1123 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]); 1124 return PTR_ERR(table); 1125 } 1126 1127 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 1128 if (!skb2) 1129 return -ENOMEM; 1130 1131 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 1132 info->nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 1133 0, family, table); 1134 if (err < 0) 1135 goto err_fill_table_info; 1136 1137 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 1138 1139 err_fill_table_info: 1140 kfree_skb(skb2); 1141 return err; 1142 } 1143 1144 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) 1145 { 1146 struct nft_chain *chain; 1147 u32 i = 0; 1148 1149 list_for_each_entry(chain, &table->chains, list) { 1150 if (!nft_is_active_next(net, chain)) 1151 continue; 1152 if (!nft_is_base_chain(chain)) 1153 continue; 1154 1155 if (cnt && i++ == cnt) 1156 break; 1157 1158 nf_tables_unregister_hook(net, table, chain); 1159 } 1160 } 1161 1162 static int nf_tables_table_enable(struct net *net, struct nft_table *table) 1163 { 1164 struct nft_chain *chain; 1165 int err, i = 0; 1166 1167 list_for_each_entry(chain, &table->chains, list) { 1168 if (!nft_is_active_next(net, chain)) 1169 continue; 1170 if (!nft_is_base_chain(chain)) 1171 continue; 1172 1173 err = nf_tables_register_hook(net, table, chain); 1174 if (err < 0) 1175 goto err_register_hooks; 1176 1177 i++; 1178 } 1179 return 0; 1180 1181 err_register_hooks: 1182 if (i) 1183 nft_table_disable(net, table, i); 1184 return err; 1185 } 1186 1187 static void nf_tables_table_disable(struct net *net, struct nft_table *table) 1188 { 1189 table->flags &= ~NFT_TABLE_F_DORMANT; 1190 nft_table_disable(net, table, 0); 1191 table->flags |= NFT_TABLE_F_DORMANT; 1192 } 1193 1194 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1) 1195 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0) 1196 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1) 1197 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ 1198 __NFT_TABLE_F_WAS_AWAKEN) 1199 1200 static int nf_tables_updtable(struct nft_ctx *ctx) 1201 { 1202 struct nft_trans *trans; 1203 u32 flags; 1204 int ret; 1205 1206 if (!ctx->nla[NFTA_TABLE_FLAGS]) 1207 return 0; 1208 1209 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 1210 if (flags & ~NFT_TABLE_F_MASK) 1211 return -EOPNOTSUPP; 1212 1213 if (flags == ctx->table->flags) 1214 return 0; 1215 1216 if ((nft_table_has_owner(ctx->table) && 1217 !(flags & NFT_TABLE_F_OWNER)) || 1218 (!nft_table_has_owner(ctx->table) && 1219 flags & NFT_TABLE_F_OWNER)) 1220 return -EOPNOTSUPP; 1221 1222 /* No dormant off/on/off/on games in single transaction */ 1223 if (ctx->table->flags & __NFT_TABLE_F_UPDATE) 1224 return -EINVAL; 1225 1226 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 1227 sizeof(struct nft_trans_table)); 1228 if (trans == NULL) 1229 return -ENOMEM; 1230 1231 if ((flags & NFT_TABLE_F_DORMANT) && 1232 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 1233 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1234 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) 1235 ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN; 1236 } else if (!(flags & NFT_TABLE_F_DORMANT) && 1237 ctx->table->flags & NFT_TABLE_F_DORMANT) { 1238 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 1239 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) { 1240 ret = nf_tables_table_enable(ctx->net, ctx->table); 1241 if (ret < 0) 1242 goto err_register_hooks; 1243 1244 ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT; 1245 } 1246 } 1247 1248 nft_trans_table_update(trans) = true; 1249 nft_trans_commit_list_add_tail(ctx->net, trans); 1250 1251 return 0; 1252 1253 err_register_hooks: 1254 nft_trans_destroy(trans); 1255 return ret; 1256 } 1257 1258 static u32 nft_chain_hash(const void *data, u32 len, u32 seed) 1259 { 1260 const char *name = data; 1261 1262 return jhash(name, strlen(name), seed); 1263 } 1264 1265 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed) 1266 { 1267 const struct nft_chain *chain = data; 1268 1269 return nft_chain_hash(chain->name, 0, seed); 1270 } 1271 1272 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg, 1273 const void *ptr) 1274 { 1275 const struct nft_chain *chain = ptr; 1276 const char *name = arg->key; 1277 1278 return strcmp(chain->name, name); 1279 } 1280 1281 static u32 nft_objname_hash(const void *data, u32 len, u32 seed) 1282 { 1283 const struct nft_object_hash_key *k = data; 1284 1285 seed ^= hash_ptr(k->table, 32); 1286 1287 return jhash(k->name, strlen(k->name), seed); 1288 } 1289 1290 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed) 1291 { 1292 const struct nft_object *obj = data; 1293 1294 return nft_objname_hash(&obj->key, 0, seed); 1295 } 1296 1297 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg, 1298 const void *ptr) 1299 { 1300 const struct nft_object_hash_key *k = arg->key; 1301 const struct nft_object *obj = ptr; 1302 1303 if (obj->key.table != k->table) 1304 return -1; 1305 1306 return strcmp(obj->key.name, k->name); 1307 } 1308 1309 static bool nft_supported_family(u8 family) 1310 { 1311 return false 1312 #ifdef CONFIG_NF_TABLES_INET 1313 || family == NFPROTO_INET 1314 #endif 1315 #ifdef CONFIG_NF_TABLES_IPV4 1316 || family == NFPROTO_IPV4 1317 #endif 1318 #ifdef CONFIG_NF_TABLES_ARP 1319 || family == NFPROTO_ARP 1320 #endif 1321 #ifdef CONFIG_NF_TABLES_NETDEV 1322 || family == NFPROTO_NETDEV 1323 #endif 1324 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) 1325 || family == NFPROTO_BRIDGE 1326 #endif 1327 #ifdef CONFIG_NF_TABLES_IPV6 1328 || family == NFPROTO_IPV6 1329 #endif 1330 ; 1331 } 1332 1333 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 1334 const struct nlattr * const nla[]) 1335 { 1336 struct nftables_pernet *nft_net = nft_pernet(info->net); 1337 struct netlink_ext_ack *extack = info->extack; 1338 u8 genmask = nft_genmask_next(info->net); 1339 u8 family = info->nfmsg->nfgen_family; 1340 struct net *net = info->net; 1341 const struct nlattr *attr; 1342 struct nft_table *table; 1343 struct nft_ctx ctx; 1344 u32 flags = 0; 1345 int err; 1346 1347 if (!nft_supported_family(family)) 1348 return -EOPNOTSUPP; 1349 1350 lockdep_assert_held(&nft_net->commit_mutex); 1351 attr = nla[NFTA_TABLE_NAME]; 1352 table = nft_table_lookup(net, attr, family, genmask, 1353 NETLINK_CB(skb).portid); 1354 if (IS_ERR(table)) { 1355 if (PTR_ERR(table) != -ENOENT) 1356 return PTR_ERR(table); 1357 } else { 1358 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 1359 NL_SET_BAD_ATTR(extack, attr); 1360 return -EEXIST; 1361 } 1362 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 1363 return -EOPNOTSUPP; 1364 1365 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1366 1367 return nf_tables_updtable(&ctx); 1368 } 1369 1370 if (nla[NFTA_TABLE_FLAGS]) { 1371 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 1372 if (flags & ~NFT_TABLE_F_MASK) 1373 return -EOPNOTSUPP; 1374 } 1375 1376 err = -ENOMEM; 1377 table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT); 1378 if (table == NULL) 1379 goto err_kzalloc; 1380 1381 table->validate_state = nft_net->validate_state; 1382 table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); 1383 if (table->name == NULL) 1384 goto err_strdup; 1385 1386 if (nla[NFTA_TABLE_USERDATA]) { 1387 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT); 1388 if (table->udata == NULL) 1389 goto err_table_udata; 1390 1391 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]); 1392 } 1393 1394 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params); 1395 if (err) 1396 goto err_chain_ht; 1397 1398 INIT_LIST_HEAD(&table->chains); 1399 INIT_LIST_HEAD(&table->sets); 1400 INIT_LIST_HEAD(&table->objects); 1401 INIT_LIST_HEAD(&table->flowtables); 1402 table->family = family; 1403 table->flags = flags; 1404 table->handle = ++nft_net->table_handle; 1405 if (table->flags & NFT_TABLE_F_OWNER) 1406 table->nlpid = NETLINK_CB(skb).portid; 1407 1408 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1409 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 1410 if (err < 0) 1411 goto err_trans; 1412 1413 list_add_tail_rcu(&table->list, &nft_net->tables); 1414 return 0; 1415 err_trans: 1416 rhltable_destroy(&table->chains_ht); 1417 err_chain_ht: 1418 kfree(table->udata); 1419 err_table_udata: 1420 kfree(table->name); 1421 err_strdup: 1422 kfree(table); 1423 err_kzalloc: 1424 return err; 1425 } 1426 1427 static int nft_flush_table(struct nft_ctx *ctx) 1428 { 1429 struct nft_flowtable *flowtable, *nft; 1430 struct nft_chain *chain, *nc; 1431 struct nft_object *obj, *ne; 1432 struct nft_set *set, *ns; 1433 int err; 1434 1435 list_for_each_entry(chain, &ctx->table->chains, list) { 1436 if (!nft_is_active_next(ctx->net, chain)) 1437 continue; 1438 1439 if (nft_chain_binding(chain)) 1440 continue; 1441 1442 ctx->chain = chain; 1443 1444 err = nft_delrule_by_chain(ctx); 1445 if (err < 0) 1446 goto out; 1447 } 1448 1449 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 1450 if (!nft_is_active_next(ctx->net, set)) 1451 continue; 1452 1453 if (nft_set_is_anonymous(set)) 1454 continue; 1455 1456 err = nft_delset(ctx, set); 1457 if (err < 0) 1458 goto out; 1459 } 1460 1461 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { 1462 if (!nft_is_active_next(ctx->net, flowtable)) 1463 continue; 1464 1465 err = nft_delflowtable(ctx, flowtable); 1466 if (err < 0) 1467 goto out; 1468 } 1469 1470 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { 1471 if (!nft_is_active_next(ctx->net, obj)) 1472 continue; 1473 1474 err = nft_delobj(ctx, obj); 1475 if (err < 0) 1476 goto out; 1477 } 1478 1479 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 1480 if (!nft_is_active_next(ctx->net, chain)) 1481 continue; 1482 1483 if (nft_chain_binding(chain)) 1484 continue; 1485 1486 ctx->chain = chain; 1487 1488 err = nft_delchain(ctx); 1489 if (err < 0) 1490 goto out; 1491 } 1492 1493 err = nft_deltable(ctx); 1494 out: 1495 return err; 1496 } 1497 1498 static int nft_flush(struct nft_ctx *ctx, int family) 1499 { 1500 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1501 const struct nlattr * const *nla = ctx->nla; 1502 struct nft_table *table, *nt; 1503 int err = 0; 1504 1505 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 1506 if (family != AF_UNSPEC && table->family != family) 1507 continue; 1508 1509 ctx->family = table->family; 1510 1511 if (!nft_is_active_next(ctx->net, table)) 1512 continue; 1513 1514 if (nft_table_has_owner(table) && table->nlpid != ctx->portid) 1515 continue; 1516 1517 if (nla[NFTA_TABLE_NAME] && 1518 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 1519 continue; 1520 1521 ctx->table = table; 1522 1523 err = nft_flush_table(ctx); 1524 if (err < 0) 1525 goto out; 1526 } 1527 out: 1528 return err; 1529 } 1530 1531 static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, 1532 const struct nlattr * const nla[]) 1533 { 1534 struct netlink_ext_ack *extack = info->extack; 1535 u8 genmask = nft_genmask_next(info->net); 1536 u8 family = info->nfmsg->nfgen_family; 1537 struct net *net = info->net; 1538 const struct nlattr *attr; 1539 struct nft_table *table; 1540 struct nft_ctx ctx; 1541 1542 nft_ctx_init(&ctx, net, skb, info->nlh, 0, NULL, NULL, nla); 1543 if (family == AF_UNSPEC || 1544 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) 1545 return nft_flush(&ctx, family); 1546 1547 if (nla[NFTA_TABLE_HANDLE]) { 1548 attr = nla[NFTA_TABLE_HANDLE]; 1549 table = nft_table_lookup_byhandle(net, attr, genmask, 1550 NETLINK_CB(skb).portid); 1551 } else { 1552 attr = nla[NFTA_TABLE_NAME]; 1553 table = nft_table_lookup(net, attr, family, genmask, 1554 NETLINK_CB(skb).portid); 1555 } 1556 1557 if (IS_ERR(table)) { 1558 if (PTR_ERR(table) == -ENOENT && 1559 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYTABLE) 1560 return 0; 1561 1562 NL_SET_BAD_ATTR(extack, attr); 1563 return PTR_ERR(table); 1564 } 1565 1566 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 1567 table->use > 0) 1568 return -EBUSY; 1569 1570 ctx.family = family; 1571 ctx.table = table; 1572 1573 return nft_flush_table(&ctx); 1574 } 1575 1576 static void nf_tables_table_destroy(struct nft_ctx *ctx) 1577 { 1578 if (WARN_ON(ctx->table->use > 0)) 1579 return; 1580 1581 rhltable_destroy(&ctx->table->chains_ht); 1582 kfree(ctx->table->name); 1583 kfree(ctx->table->udata); 1584 kfree(ctx->table); 1585 } 1586 1587 void nft_register_chain_type(const struct nft_chain_type *ctype) 1588 { 1589 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1590 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) { 1591 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1592 return; 1593 } 1594 chain_type[ctype->family][ctype->type] = ctype; 1595 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1596 } 1597 EXPORT_SYMBOL_GPL(nft_register_chain_type); 1598 1599 void nft_unregister_chain_type(const struct nft_chain_type *ctype) 1600 { 1601 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1602 chain_type[ctype->family][ctype->type] = NULL; 1603 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1604 } 1605 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 1606 1607 /* 1608 * Chains 1609 */ 1610 1611 static struct nft_chain * 1612 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask) 1613 { 1614 struct nft_chain *chain; 1615 1616 list_for_each_entry(chain, &table->chains, list) { 1617 if (chain->handle == handle && 1618 nft_active_genmask(chain, genmask)) 1619 return chain; 1620 } 1621 1622 return ERR_PTR(-ENOENT); 1623 } 1624 1625 static bool lockdep_commit_lock_is_held(const struct net *net) 1626 { 1627 #ifdef CONFIG_PROVE_LOCKING 1628 struct nftables_pernet *nft_net = nft_pernet(net); 1629 1630 return lockdep_is_held(&nft_net->commit_mutex); 1631 #else 1632 return true; 1633 #endif 1634 } 1635 1636 static struct nft_chain *nft_chain_lookup(struct net *net, 1637 struct nft_table *table, 1638 const struct nlattr *nla, u8 genmask) 1639 { 1640 char search[NFT_CHAIN_MAXNAMELEN + 1]; 1641 struct rhlist_head *tmp, *list; 1642 struct nft_chain *chain; 1643 1644 if (nla == NULL) 1645 return ERR_PTR(-EINVAL); 1646 1647 nla_strscpy(search, nla, sizeof(search)); 1648 1649 WARN_ON(!rcu_read_lock_held() && 1650 !lockdep_commit_lock_is_held(net)); 1651 1652 chain = ERR_PTR(-ENOENT); 1653 rcu_read_lock(); 1654 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params); 1655 if (!list) 1656 goto out_unlock; 1657 1658 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 1659 if (nft_active_genmask(chain, genmask)) 1660 goto out_unlock; 1661 } 1662 chain = ERR_PTR(-ENOENT); 1663 out_unlock: 1664 rcu_read_unlock(); 1665 return chain; 1666 } 1667 1668 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 1669 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING, 1670 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1671 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 1672 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 1673 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1674 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 1675 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 1676 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING, 1677 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 1678 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 1679 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 }, 1680 [NFTA_CHAIN_ID] = { .type = NLA_U32 }, 1681 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY, 1682 .len = NFT_USERDATA_MAXLEN }, 1683 }; 1684 1685 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 1686 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 1687 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 1688 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 1689 .len = IFNAMSIZ - 1 }, 1690 }; 1691 1692 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 1693 { 1694 struct nft_stats *cpu_stats, total; 1695 struct nlattr *nest; 1696 unsigned int seq; 1697 u64 pkts, bytes; 1698 int cpu; 1699 1700 if (!stats) 1701 return 0; 1702 1703 memset(&total, 0, sizeof(total)); 1704 for_each_possible_cpu(cpu) { 1705 cpu_stats = per_cpu_ptr(stats, cpu); 1706 do { 1707 seq = u64_stats_fetch_begin(&cpu_stats->syncp); 1708 pkts = cpu_stats->pkts; 1709 bytes = cpu_stats->bytes; 1710 } while (u64_stats_fetch_retry(&cpu_stats->syncp, seq)); 1711 total.pkts += pkts; 1712 total.bytes += bytes; 1713 } 1714 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS); 1715 if (nest == NULL) 1716 goto nla_put_failure; 1717 1718 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts), 1719 NFTA_COUNTER_PAD) || 1720 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 1721 NFTA_COUNTER_PAD)) 1722 goto nla_put_failure; 1723 1724 nla_nest_end(skb, nest); 1725 return 0; 1726 1727 nla_put_failure: 1728 return -ENOSPC; 1729 } 1730 1731 static int nft_dump_basechain_hook(struct sk_buff *skb, int family, 1732 const struct nft_base_chain *basechain, 1733 const struct list_head *hook_list) 1734 { 1735 const struct nf_hook_ops *ops = &basechain->ops; 1736 struct nft_hook *hook, *first = NULL; 1737 struct nlattr *nest, *nest_devs; 1738 int n = 0; 1739 1740 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK); 1741 if (nest == NULL) 1742 goto nla_put_failure; 1743 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 1744 goto nla_put_failure; 1745 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 1746 goto nla_put_failure; 1747 1748 if (nft_base_chain_netdev(family, ops->hooknum)) { 1749 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS); 1750 if (!nest_devs) 1751 goto nla_put_failure; 1752 1753 if (!hook_list) 1754 hook_list = &basechain->hook_list; 1755 1756 list_for_each_entry(hook, hook_list, list) { 1757 if (!first) 1758 first = hook; 1759 1760 if (nla_put_string(skb, NFTA_DEVICE_NAME, 1761 hook->ops.dev->name)) 1762 goto nla_put_failure; 1763 n++; 1764 } 1765 nla_nest_end(skb, nest_devs); 1766 1767 if (n == 1 && 1768 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name)) 1769 goto nla_put_failure; 1770 } 1771 nla_nest_end(skb, nest); 1772 1773 return 0; 1774 nla_put_failure: 1775 return -1; 1776 } 1777 1778 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 1779 u32 portid, u32 seq, int event, u32 flags, 1780 int family, const struct nft_table *table, 1781 const struct nft_chain *chain, 1782 const struct list_head *hook_list) 1783 { 1784 struct nlmsghdr *nlh; 1785 1786 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 1787 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 1788 NFNETLINK_V0, nft_base_seq(net)); 1789 if (!nlh) 1790 goto nla_put_failure; 1791 1792 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name) || 1793 nla_put_string(skb, NFTA_CHAIN_NAME, chain->name) || 1794 nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), 1795 NFTA_CHAIN_PAD)) 1796 goto nla_put_failure; 1797 1798 if (event == NFT_MSG_DELCHAIN && !hook_list) { 1799 nlmsg_end(skb, nlh); 1800 return 0; 1801 } 1802 1803 if (nft_is_base_chain(chain)) { 1804 const struct nft_base_chain *basechain = nft_base_chain(chain); 1805 struct nft_stats __percpu *stats; 1806 1807 if (nft_dump_basechain_hook(skb, family, basechain, hook_list)) 1808 goto nla_put_failure; 1809 1810 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 1811 htonl(basechain->policy))) 1812 goto nla_put_failure; 1813 1814 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 1815 goto nla_put_failure; 1816 1817 stats = rcu_dereference_check(basechain->stats, 1818 lockdep_commit_lock_is_held(net)); 1819 if (nft_dump_stats(skb, stats)) 1820 goto nla_put_failure; 1821 } 1822 1823 if (chain->flags && 1824 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags))) 1825 goto nla_put_failure; 1826 1827 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 1828 goto nla_put_failure; 1829 1830 if (chain->udata && 1831 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata)) 1832 goto nla_put_failure; 1833 1834 nlmsg_end(skb, nlh); 1835 return 0; 1836 1837 nla_put_failure: 1838 nlmsg_trim(skb, nlh); 1839 return -1; 1840 } 1841 1842 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, 1843 const struct list_head *hook_list) 1844 { 1845 struct nftables_pernet *nft_net; 1846 struct sk_buff *skb; 1847 u16 flags = 0; 1848 int err; 1849 1850 if (!ctx->report && 1851 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1852 return; 1853 1854 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1855 if (skb == NULL) 1856 goto err; 1857 1858 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 1859 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 1860 1861 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 1862 event, flags, ctx->family, ctx->table, 1863 ctx->chain, hook_list); 1864 if (err < 0) { 1865 kfree_skb(skb); 1866 goto err; 1867 } 1868 1869 nft_net = nft_pernet(ctx->net); 1870 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 1871 return; 1872 err: 1873 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1874 } 1875 1876 static int nf_tables_dump_chains(struct sk_buff *skb, 1877 struct netlink_callback *cb) 1878 { 1879 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1880 unsigned int idx = 0, s_idx = cb->args[0]; 1881 struct net *net = sock_net(skb->sk); 1882 int family = nfmsg->nfgen_family; 1883 struct nftables_pernet *nft_net; 1884 const struct nft_table *table; 1885 const struct nft_chain *chain; 1886 1887 rcu_read_lock(); 1888 nft_net = nft_pernet(net); 1889 cb->seq = READ_ONCE(nft_net->base_seq); 1890 1891 list_for_each_entry_rcu(table, &nft_net->tables, list) { 1892 if (family != NFPROTO_UNSPEC && family != table->family) 1893 continue; 1894 1895 list_for_each_entry_rcu(chain, &table->chains, list) { 1896 if (idx < s_idx) 1897 goto cont; 1898 if (idx > s_idx) 1899 memset(&cb->args[1], 0, 1900 sizeof(cb->args) - sizeof(cb->args[0])); 1901 if (!nft_is_active(net, chain)) 1902 continue; 1903 if (nf_tables_fill_chain_info(skb, net, 1904 NETLINK_CB(cb->skb).portid, 1905 cb->nlh->nlmsg_seq, 1906 NFT_MSG_NEWCHAIN, 1907 NLM_F_MULTI, 1908 table->family, table, 1909 chain, NULL) < 0) 1910 goto done; 1911 1912 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1913 cont: 1914 idx++; 1915 } 1916 } 1917 done: 1918 rcu_read_unlock(); 1919 cb->args[0] = idx; 1920 return skb->len; 1921 } 1922 1923 /* called with rcu_read_lock held */ 1924 static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, 1925 const struct nlattr * const nla[]) 1926 { 1927 struct netlink_ext_ack *extack = info->extack; 1928 u8 genmask = nft_genmask_cur(info->net); 1929 u8 family = info->nfmsg->nfgen_family; 1930 const struct nft_chain *chain; 1931 struct net *net = info->net; 1932 struct nft_table *table; 1933 struct sk_buff *skb2; 1934 int err; 1935 1936 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1937 struct netlink_dump_control c = { 1938 .dump = nf_tables_dump_chains, 1939 .module = THIS_MODULE, 1940 }; 1941 1942 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 1943 } 1944 1945 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 0); 1946 if (IS_ERR(table)) { 1947 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 1948 return PTR_ERR(table); 1949 } 1950 1951 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask); 1952 if (IS_ERR(chain)) { 1953 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 1954 return PTR_ERR(chain); 1955 } 1956 1957 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 1958 if (!skb2) 1959 return -ENOMEM; 1960 1961 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 1962 info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 1963 0, family, table, chain, NULL); 1964 if (err < 0) 1965 goto err_fill_chain_info; 1966 1967 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 1968 1969 err_fill_chain_info: 1970 kfree_skb(skb2); 1971 return err; 1972 } 1973 1974 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 1975 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 1976 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 1977 }; 1978 1979 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 1980 { 1981 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 1982 struct nft_stats __percpu *newstats; 1983 struct nft_stats *stats; 1984 int err; 1985 1986 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr, 1987 nft_counter_policy, NULL); 1988 if (err < 0) 1989 return ERR_PTR(err); 1990 1991 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 1992 return ERR_PTR(-EINVAL); 1993 1994 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 1995 if (newstats == NULL) 1996 return ERR_PTR(-ENOMEM); 1997 1998 /* Restore old counters on this cpu, no problem. Per-cpu statistics 1999 * are not exposed to userspace. 2000 */ 2001 preempt_disable(); 2002 stats = this_cpu_ptr(newstats); 2003 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 2004 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 2005 preempt_enable(); 2006 2007 return newstats; 2008 } 2009 2010 static void nft_chain_stats_replace(struct nft_trans *trans) 2011 { 2012 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain); 2013 2014 if (!nft_trans_chain_stats(trans)) 2015 return; 2016 2017 nft_trans_chain_stats(trans) = 2018 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans), 2019 lockdep_commit_lock_is_held(trans->ctx.net)); 2020 2021 if (!nft_trans_chain_stats(trans)) 2022 static_branch_inc(&nft_counters_enabled); 2023 } 2024 2025 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) 2026 { 2027 struct nft_rule_blob *g0 = rcu_dereference_raw(chain->blob_gen_0); 2028 struct nft_rule_blob *g1 = rcu_dereference_raw(chain->blob_gen_1); 2029 2030 if (g0 != g1) 2031 kvfree(g1); 2032 kvfree(g0); 2033 2034 /* should be NULL either via abort or via successful commit */ 2035 WARN_ON_ONCE(chain->blob_next); 2036 kvfree(chain->blob_next); 2037 } 2038 2039 void nf_tables_chain_destroy(struct nft_ctx *ctx) 2040 { 2041 struct nft_chain *chain = ctx->chain; 2042 struct nft_hook *hook, *next; 2043 2044 if (WARN_ON(chain->use > 0)) 2045 return; 2046 2047 /* no concurrent access possible anymore */ 2048 nf_tables_chain_free_chain_rules(chain); 2049 2050 if (nft_is_base_chain(chain)) { 2051 struct nft_base_chain *basechain = nft_base_chain(chain); 2052 2053 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 2054 list_for_each_entry_safe(hook, next, 2055 &basechain->hook_list, list) { 2056 list_del_rcu(&hook->list); 2057 kfree_rcu(hook, rcu); 2058 } 2059 } 2060 module_put(basechain->type->owner); 2061 if (rcu_access_pointer(basechain->stats)) { 2062 static_branch_dec(&nft_counters_enabled); 2063 free_percpu(rcu_dereference_raw(basechain->stats)); 2064 } 2065 kfree(chain->name); 2066 kfree(chain->udata); 2067 kfree(basechain); 2068 } else { 2069 kfree(chain->name); 2070 kfree(chain->udata); 2071 kfree(chain); 2072 } 2073 } 2074 2075 static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 2076 const struct nlattr *attr) 2077 { 2078 struct net_device *dev; 2079 char ifname[IFNAMSIZ]; 2080 struct nft_hook *hook; 2081 int err; 2082 2083 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT); 2084 if (!hook) { 2085 err = -ENOMEM; 2086 goto err_hook_alloc; 2087 } 2088 2089 nla_strscpy(ifname, attr, IFNAMSIZ); 2090 /* nf_tables_netdev_event() is called under rtnl_mutex, this is 2091 * indirectly serializing all the other holders of the commit_mutex with 2092 * the rtnl_mutex. 2093 */ 2094 dev = __dev_get_by_name(net, ifname); 2095 if (!dev) { 2096 err = -ENOENT; 2097 goto err_hook_dev; 2098 } 2099 hook->ops.dev = dev; 2100 2101 return hook; 2102 2103 err_hook_dev: 2104 kfree(hook); 2105 err_hook_alloc: 2106 return ERR_PTR(err); 2107 } 2108 2109 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, 2110 const struct nft_hook *this) 2111 { 2112 struct nft_hook *hook; 2113 2114 list_for_each_entry(hook, hook_list, list) { 2115 if (this->ops.dev == hook->ops.dev) 2116 return hook; 2117 } 2118 2119 return NULL; 2120 } 2121 2122 static int nf_tables_parse_netdev_hooks(struct net *net, 2123 const struct nlattr *attr, 2124 struct list_head *hook_list, 2125 struct netlink_ext_ack *extack) 2126 { 2127 struct nft_hook *hook, *next; 2128 const struct nlattr *tmp; 2129 int rem, n = 0, err; 2130 2131 nla_for_each_nested(tmp, attr, rem) { 2132 if (nla_type(tmp) != NFTA_DEVICE_NAME) { 2133 err = -EINVAL; 2134 goto err_hook; 2135 } 2136 2137 hook = nft_netdev_hook_alloc(net, tmp); 2138 if (IS_ERR(hook)) { 2139 NL_SET_BAD_ATTR(extack, tmp); 2140 err = PTR_ERR(hook); 2141 goto err_hook; 2142 } 2143 if (nft_hook_list_find(hook_list, hook)) { 2144 NL_SET_BAD_ATTR(extack, tmp); 2145 kfree(hook); 2146 err = -EEXIST; 2147 goto err_hook; 2148 } 2149 list_add_tail(&hook->list, hook_list); 2150 n++; 2151 2152 if (n == NFT_NETDEVICE_MAX) { 2153 err = -EFBIG; 2154 goto err_hook; 2155 } 2156 } 2157 2158 return 0; 2159 2160 err_hook: 2161 list_for_each_entry_safe(hook, next, hook_list, list) { 2162 list_del(&hook->list); 2163 kfree(hook); 2164 } 2165 return err; 2166 } 2167 2168 struct nft_chain_hook { 2169 u32 num; 2170 s32 priority; 2171 const struct nft_chain_type *type; 2172 struct list_head list; 2173 }; 2174 2175 static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[], 2176 struct list_head *hook_list, 2177 struct netlink_ext_ack *extack, u32 flags) 2178 { 2179 struct nft_hook *hook; 2180 int err; 2181 2182 if (tb[NFTA_HOOK_DEV]) { 2183 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]); 2184 if (IS_ERR(hook)) { 2185 NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]); 2186 return PTR_ERR(hook); 2187 } 2188 2189 list_add_tail(&hook->list, hook_list); 2190 } else if (tb[NFTA_HOOK_DEVS]) { 2191 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS], 2192 hook_list, extack); 2193 if (err < 0) 2194 return err; 2195 2196 } 2197 2198 if (flags & NFT_CHAIN_HW_OFFLOAD && 2199 list_empty(hook_list)) 2200 return -EINVAL; 2201 2202 return 0; 2203 } 2204 2205 static int nft_chain_parse_hook(struct net *net, 2206 struct nft_base_chain *basechain, 2207 const struct nlattr * const nla[], 2208 struct nft_chain_hook *hook, u8 family, 2209 u32 flags, struct netlink_ext_ack *extack) 2210 { 2211 struct nftables_pernet *nft_net = nft_pernet(net); 2212 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 2213 const struct nft_chain_type *type; 2214 int err; 2215 2216 lockdep_assert_held(&nft_net->commit_mutex); 2217 lockdep_nfnl_nft_mutex_not_held(); 2218 2219 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX, 2220 nla[NFTA_CHAIN_HOOK], 2221 nft_hook_policy, NULL); 2222 if (err < 0) 2223 return err; 2224 2225 if (!basechain) { 2226 if (!ha[NFTA_HOOK_HOOKNUM] || 2227 !ha[NFTA_HOOK_PRIORITY]) { 2228 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2229 return -ENOENT; 2230 } 2231 2232 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2233 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2234 2235 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT); 2236 if (!type) 2237 return -EOPNOTSUPP; 2238 2239 if (nla[NFTA_CHAIN_TYPE]) { 2240 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE], 2241 family, true); 2242 if (IS_ERR(type)) { 2243 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2244 return PTR_ERR(type); 2245 } 2246 } 2247 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num))) 2248 return -EOPNOTSUPP; 2249 2250 if (type->type == NFT_CHAIN_T_NAT && 2251 hook->priority <= NF_IP_PRI_CONNTRACK) 2252 return -EOPNOTSUPP; 2253 } else { 2254 if (ha[NFTA_HOOK_HOOKNUM]) { 2255 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2256 if (hook->num != basechain->ops.hooknum) 2257 return -EOPNOTSUPP; 2258 } 2259 if (ha[NFTA_HOOK_PRIORITY]) { 2260 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2261 if (hook->priority != basechain->ops.priority) 2262 return -EOPNOTSUPP; 2263 } 2264 2265 type = basechain->type; 2266 } 2267 2268 if (!try_module_get(type->owner)) { 2269 if (nla[NFTA_CHAIN_TYPE]) 2270 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2271 return -ENOENT; 2272 } 2273 2274 hook->type = type; 2275 2276 INIT_LIST_HEAD(&hook->list); 2277 if (nft_base_chain_netdev(family, hook->num)) { 2278 err = nft_chain_parse_netdev(net, ha, &hook->list, extack, flags); 2279 if (err < 0) { 2280 module_put(type->owner); 2281 return err; 2282 } 2283 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) { 2284 module_put(type->owner); 2285 return -EOPNOTSUPP; 2286 } 2287 2288 return 0; 2289 } 2290 2291 static void nft_chain_release_hook(struct nft_chain_hook *hook) 2292 { 2293 struct nft_hook *h, *next; 2294 2295 list_for_each_entry_safe(h, next, &hook->list, list) { 2296 list_del(&h->list); 2297 kfree(h); 2298 } 2299 module_put(hook->type->owner); 2300 } 2301 2302 static void nft_last_rule(const struct nft_chain *chain, const void *ptr) 2303 { 2304 struct nft_rule_dp_last *lrule; 2305 2306 BUILD_BUG_ON(offsetof(struct nft_rule_dp_last, end) != 0); 2307 2308 lrule = (struct nft_rule_dp_last *)ptr; 2309 lrule->end.is_last = 1; 2310 lrule->chain = chain; 2311 /* blob size does not include the trailer rule */ 2312 } 2313 2314 static struct nft_rule_blob *nf_tables_chain_alloc_rules(const struct nft_chain *chain, 2315 unsigned int size) 2316 { 2317 struct nft_rule_blob *blob; 2318 2319 if (size > INT_MAX) 2320 return NULL; 2321 2322 size += sizeof(struct nft_rule_blob) + sizeof(struct nft_rule_dp_last); 2323 2324 blob = kvmalloc(size, GFP_KERNEL_ACCOUNT); 2325 if (!blob) 2326 return NULL; 2327 2328 blob->size = 0; 2329 nft_last_rule(chain, blob->data); 2330 2331 return blob; 2332 } 2333 2334 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family, 2335 const struct nft_chain_hook *hook, 2336 struct nft_chain *chain) 2337 { 2338 ops->pf = family; 2339 ops->hooknum = hook->num; 2340 ops->priority = hook->priority; 2341 ops->priv = chain; 2342 ops->hook = hook->type->hooks[ops->hooknum]; 2343 ops->hook_ops_type = NF_HOOK_OP_NF_TABLES; 2344 } 2345 2346 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, 2347 struct nft_chain_hook *hook, u32 flags) 2348 { 2349 struct nft_chain *chain; 2350 struct nft_hook *h; 2351 2352 basechain->type = hook->type; 2353 INIT_LIST_HEAD(&basechain->hook_list); 2354 chain = &basechain->chain; 2355 2356 if (nft_base_chain_netdev(family, hook->num)) { 2357 list_splice_init(&hook->list, &basechain->hook_list); 2358 list_for_each_entry(h, &basechain->hook_list, list) 2359 nft_basechain_hook_init(&h->ops, family, hook, chain); 2360 } 2361 nft_basechain_hook_init(&basechain->ops, family, hook, chain); 2362 2363 chain->flags |= NFT_CHAIN_BASE | flags; 2364 basechain->policy = NF_ACCEPT; 2365 if (chain->flags & NFT_CHAIN_HW_OFFLOAD && 2366 !nft_chain_offload_support(basechain)) { 2367 list_splice_init(&basechain->hook_list, &hook->list); 2368 return -EOPNOTSUPP; 2369 } 2370 2371 flow_block_init(&basechain->flow_block); 2372 2373 return 0; 2374 } 2375 2376 int nft_chain_add(struct nft_table *table, struct nft_chain *chain) 2377 { 2378 int err; 2379 2380 err = rhltable_insert_key(&table->chains_ht, chain->name, 2381 &chain->rhlhead, nft_chain_ht_params); 2382 if (err) 2383 return err; 2384 2385 list_add_tail_rcu(&chain->list, &table->chains); 2386 2387 return 0; 2388 } 2389 2390 static u64 chain_id; 2391 2392 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 2393 u8 policy, u32 flags, 2394 struct netlink_ext_ack *extack) 2395 { 2396 const struct nlattr * const *nla = ctx->nla; 2397 struct nft_table *table = ctx->table; 2398 struct nft_base_chain *basechain; 2399 struct net *net = ctx->net; 2400 char name[NFT_NAME_MAXLEN]; 2401 struct nft_rule_blob *blob; 2402 struct nft_trans *trans; 2403 struct nft_chain *chain; 2404 int err; 2405 2406 if (nla[NFTA_CHAIN_HOOK]) { 2407 struct nft_stats __percpu *stats = NULL; 2408 struct nft_chain_hook hook = {}; 2409 2410 if (flags & NFT_CHAIN_BINDING) 2411 return -EOPNOTSUPP; 2412 2413 err = nft_chain_parse_hook(net, NULL, nla, &hook, family, flags, 2414 extack); 2415 if (err < 0) 2416 return err; 2417 2418 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT); 2419 if (basechain == NULL) { 2420 nft_chain_release_hook(&hook); 2421 return -ENOMEM; 2422 } 2423 chain = &basechain->chain; 2424 2425 if (nla[NFTA_CHAIN_COUNTERS]) { 2426 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2427 if (IS_ERR(stats)) { 2428 nft_chain_release_hook(&hook); 2429 kfree(basechain); 2430 return PTR_ERR(stats); 2431 } 2432 rcu_assign_pointer(basechain->stats, stats); 2433 } 2434 2435 err = nft_basechain_init(basechain, family, &hook, flags); 2436 if (err < 0) { 2437 nft_chain_release_hook(&hook); 2438 kfree(basechain); 2439 free_percpu(stats); 2440 return err; 2441 } 2442 if (stats) 2443 static_branch_inc(&nft_counters_enabled); 2444 } else { 2445 if (flags & NFT_CHAIN_BASE) 2446 return -EINVAL; 2447 if (flags & NFT_CHAIN_HW_OFFLOAD) 2448 return -EOPNOTSUPP; 2449 2450 chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT); 2451 if (chain == NULL) 2452 return -ENOMEM; 2453 2454 chain->flags = flags; 2455 } 2456 ctx->chain = chain; 2457 2458 INIT_LIST_HEAD(&chain->rules); 2459 chain->handle = nf_tables_alloc_handle(table); 2460 chain->table = table; 2461 2462 if (nla[NFTA_CHAIN_NAME]) { 2463 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2464 } else { 2465 if (!(flags & NFT_CHAIN_BINDING)) { 2466 err = -EINVAL; 2467 goto err_destroy_chain; 2468 } 2469 2470 snprintf(name, sizeof(name), "__chain%llu", ++chain_id); 2471 chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT); 2472 } 2473 2474 if (!chain->name) { 2475 err = -ENOMEM; 2476 goto err_destroy_chain; 2477 } 2478 2479 if (nla[NFTA_CHAIN_USERDATA]) { 2480 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT); 2481 if (chain->udata == NULL) { 2482 err = -ENOMEM; 2483 goto err_destroy_chain; 2484 } 2485 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]); 2486 } 2487 2488 blob = nf_tables_chain_alloc_rules(chain, 0); 2489 if (!blob) { 2490 err = -ENOMEM; 2491 goto err_destroy_chain; 2492 } 2493 2494 RCU_INIT_POINTER(chain->blob_gen_0, blob); 2495 RCU_INIT_POINTER(chain->blob_gen_1, blob); 2496 2497 err = nf_tables_register_hook(net, table, chain); 2498 if (err < 0) 2499 goto err_destroy_chain; 2500 2501 if (!nft_use_inc(&table->use)) { 2502 err = -EMFILE; 2503 goto err_use; 2504 } 2505 2506 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN); 2507 if (IS_ERR(trans)) { 2508 err = PTR_ERR(trans); 2509 goto err_unregister_hook; 2510 } 2511 2512 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET; 2513 if (nft_is_base_chain(chain)) 2514 nft_trans_chain_policy(trans) = policy; 2515 2516 err = nft_chain_add(table, chain); 2517 if (err < 0) { 2518 nft_trans_destroy(trans); 2519 goto err_unregister_hook; 2520 } 2521 2522 return 0; 2523 2524 err_unregister_hook: 2525 nft_use_dec_restore(&table->use); 2526 err_use: 2527 nf_tables_unregister_hook(net, table, chain); 2528 err_destroy_chain: 2529 nf_tables_chain_destroy(ctx); 2530 2531 return err; 2532 } 2533 2534 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 2535 u32 flags, const struct nlattr *attr, 2536 struct netlink_ext_ack *extack) 2537 { 2538 const struct nlattr * const *nla = ctx->nla; 2539 struct nft_base_chain *basechain = NULL; 2540 struct nft_table *table = ctx->table; 2541 struct nft_chain *chain = ctx->chain; 2542 struct nft_chain_hook hook = {}; 2543 struct nft_stats *stats = NULL; 2544 struct nft_hook *h, *next; 2545 struct nf_hook_ops *ops; 2546 struct nft_trans *trans; 2547 bool unregister = false; 2548 int err; 2549 2550 if (chain->flags ^ flags) 2551 return -EOPNOTSUPP; 2552 2553 INIT_LIST_HEAD(&hook.list); 2554 2555 if (nla[NFTA_CHAIN_HOOK]) { 2556 if (!nft_is_base_chain(chain)) { 2557 NL_SET_BAD_ATTR(extack, attr); 2558 return -EEXIST; 2559 } 2560 2561 basechain = nft_base_chain(chain); 2562 err = nft_chain_parse_hook(ctx->net, basechain, nla, &hook, 2563 ctx->family, flags, extack); 2564 if (err < 0) 2565 return err; 2566 2567 if (basechain->type != hook.type) { 2568 nft_chain_release_hook(&hook); 2569 NL_SET_BAD_ATTR(extack, attr); 2570 return -EEXIST; 2571 } 2572 2573 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 2574 list_for_each_entry_safe(h, next, &hook.list, list) { 2575 h->ops.pf = basechain->ops.pf; 2576 h->ops.hooknum = basechain->ops.hooknum; 2577 h->ops.priority = basechain->ops.priority; 2578 h->ops.priv = basechain->ops.priv; 2579 h->ops.hook = basechain->ops.hook; 2580 2581 if (nft_hook_list_find(&basechain->hook_list, h)) { 2582 list_del(&h->list); 2583 kfree(h); 2584 } 2585 } 2586 } else { 2587 ops = &basechain->ops; 2588 if (ops->hooknum != hook.num || 2589 ops->priority != hook.priority) { 2590 nft_chain_release_hook(&hook); 2591 NL_SET_BAD_ATTR(extack, attr); 2592 return -EEXIST; 2593 } 2594 } 2595 } 2596 2597 if (nla[NFTA_CHAIN_HANDLE] && 2598 nla[NFTA_CHAIN_NAME]) { 2599 struct nft_chain *chain2; 2600 2601 chain2 = nft_chain_lookup(ctx->net, table, 2602 nla[NFTA_CHAIN_NAME], genmask); 2603 if (!IS_ERR(chain2)) { 2604 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2605 err = -EEXIST; 2606 goto err_hooks; 2607 } 2608 } 2609 2610 if (nla[NFTA_CHAIN_COUNTERS]) { 2611 if (!nft_is_base_chain(chain)) { 2612 err = -EOPNOTSUPP; 2613 goto err_hooks; 2614 } 2615 2616 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2617 if (IS_ERR(stats)) { 2618 err = PTR_ERR(stats); 2619 goto err_hooks; 2620 } 2621 } 2622 2623 if (!(table->flags & NFT_TABLE_F_DORMANT) && 2624 nft_is_base_chain(chain) && 2625 !list_empty(&hook.list)) { 2626 basechain = nft_base_chain(chain); 2627 ops = &basechain->ops; 2628 2629 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { 2630 err = nft_netdev_register_hooks(ctx->net, &hook.list); 2631 if (err < 0) 2632 goto err_hooks; 2633 } 2634 } 2635 2636 unregister = true; 2637 err = -ENOMEM; 2638 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, 2639 sizeof(struct nft_trans_chain)); 2640 if (trans == NULL) 2641 goto err_trans; 2642 2643 nft_trans_chain_stats(trans) = stats; 2644 nft_trans_chain_update(trans) = true; 2645 2646 if (nla[NFTA_CHAIN_POLICY]) 2647 nft_trans_chain_policy(trans) = policy; 2648 else 2649 nft_trans_chain_policy(trans) = -1; 2650 2651 if (nla[NFTA_CHAIN_HANDLE] && 2652 nla[NFTA_CHAIN_NAME]) { 2653 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 2654 struct nft_trans *tmp; 2655 char *name; 2656 2657 err = -ENOMEM; 2658 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2659 if (!name) 2660 goto err_trans; 2661 2662 err = -EEXIST; 2663 list_for_each_entry(tmp, &nft_net->commit_list, list) { 2664 if (tmp->msg_type == NFT_MSG_NEWCHAIN && 2665 tmp->ctx.table == table && 2666 nft_trans_chain_update(tmp) && 2667 nft_trans_chain_name(tmp) && 2668 strcmp(name, nft_trans_chain_name(tmp)) == 0) { 2669 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2670 kfree(name); 2671 goto err_trans; 2672 } 2673 } 2674 2675 nft_trans_chain_name(trans) = name; 2676 } 2677 2678 nft_trans_basechain(trans) = basechain; 2679 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 2680 list_splice(&hook.list, &nft_trans_chain_hooks(trans)); 2681 if (nla[NFTA_CHAIN_HOOK]) 2682 module_put(hook.type->owner); 2683 2684 nft_trans_commit_list_add_tail(ctx->net, trans); 2685 2686 return 0; 2687 2688 err_trans: 2689 free_percpu(stats); 2690 kfree(trans); 2691 err_hooks: 2692 if (nla[NFTA_CHAIN_HOOK]) { 2693 list_for_each_entry_safe(h, next, &hook.list, list) { 2694 if (unregister) 2695 nf_unregister_net_hook(ctx->net, &h->ops); 2696 list_del(&h->list); 2697 kfree_rcu(h, rcu); 2698 } 2699 module_put(hook.type->owner); 2700 } 2701 2702 return err; 2703 } 2704 2705 static struct nft_chain *nft_chain_lookup_byid(const struct net *net, 2706 const struct nft_table *table, 2707 const struct nlattr *nla, u8 genmask) 2708 { 2709 struct nftables_pernet *nft_net = nft_pernet(net); 2710 u32 id = ntohl(nla_get_be32(nla)); 2711 struct nft_trans *trans; 2712 2713 list_for_each_entry(trans, &nft_net->commit_list, list) { 2714 struct nft_chain *chain = trans->ctx.chain; 2715 2716 if (trans->msg_type == NFT_MSG_NEWCHAIN && 2717 chain->table == table && 2718 id == nft_trans_chain_id(trans) && 2719 nft_active_genmask(chain, genmask)) 2720 return chain; 2721 } 2722 return ERR_PTR(-ENOENT); 2723 } 2724 2725 static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, 2726 const struct nlattr * const nla[]) 2727 { 2728 struct nftables_pernet *nft_net = nft_pernet(info->net); 2729 struct netlink_ext_ack *extack = info->extack; 2730 u8 genmask = nft_genmask_next(info->net); 2731 u8 family = info->nfmsg->nfgen_family; 2732 struct nft_chain *chain = NULL; 2733 struct net *net = info->net; 2734 const struct nlattr *attr; 2735 struct nft_table *table; 2736 u8 policy = NF_ACCEPT; 2737 struct nft_ctx ctx; 2738 u64 handle = 0; 2739 u32 flags = 0; 2740 2741 lockdep_assert_held(&nft_net->commit_mutex); 2742 2743 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2744 NETLINK_CB(skb).portid); 2745 if (IS_ERR(table)) { 2746 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2747 return PTR_ERR(table); 2748 } 2749 2750 chain = NULL; 2751 attr = nla[NFTA_CHAIN_NAME]; 2752 2753 if (nla[NFTA_CHAIN_HANDLE]) { 2754 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 2755 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2756 if (IS_ERR(chain)) { 2757 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]); 2758 return PTR_ERR(chain); 2759 } 2760 attr = nla[NFTA_CHAIN_HANDLE]; 2761 } else if (nla[NFTA_CHAIN_NAME]) { 2762 chain = nft_chain_lookup(net, table, attr, genmask); 2763 if (IS_ERR(chain)) { 2764 if (PTR_ERR(chain) != -ENOENT) { 2765 NL_SET_BAD_ATTR(extack, attr); 2766 return PTR_ERR(chain); 2767 } 2768 chain = NULL; 2769 } 2770 } else if (!nla[NFTA_CHAIN_ID]) { 2771 return -EINVAL; 2772 } 2773 2774 if (nla[NFTA_CHAIN_POLICY]) { 2775 if (chain != NULL && 2776 !nft_is_base_chain(chain)) { 2777 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2778 return -EOPNOTSUPP; 2779 } 2780 2781 if (chain == NULL && 2782 nla[NFTA_CHAIN_HOOK] == NULL) { 2783 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2784 return -EOPNOTSUPP; 2785 } 2786 2787 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 2788 switch (policy) { 2789 case NF_DROP: 2790 case NF_ACCEPT: 2791 break; 2792 default: 2793 return -EINVAL; 2794 } 2795 } 2796 2797 if (nla[NFTA_CHAIN_FLAGS]) 2798 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS])); 2799 else if (chain) 2800 flags = chain->flags; 2801 2802 if (flags & ~NFT_CHAIN_FLAGS) 2803 return -EOPNOTSUPP; 2804 2805 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2806 2807 if (chain != NULL) { 2808 if (chain->flags & NFT_CHAIN_BINDING) 2809 return -EINVAL; 2810 2811 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 2812 NL_SET_BAD_ATTR(extack, attr); 2813 return -EEXIST; 2814 } 2815 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 2816 return -EOPNOTSUPP; 2817 2818 flags |= chain->flags & NFT_CHAIN_BASE; 2819 return nf_tables_updchain(&ctx, genmask, policy, flags, attr, 2820 extack); 2821 } 2822 2823 return nf_tables_addchain(&ctx, family, genmask, policy, flags, extack); 2824 } 2825 2826 static int nft_delchain_hook(struct nft_ctx *ctx, 2827 struct nft_base_chain *basechain, 2828 struct netlink_ext_ack *extack) 2829 { 2830 const struct nft_chain *chain = &basechain->chain; 2831 const struct nlattr * const *nla = ctx->nla; 2832 struct nft_chain_hook chain_hook = {}; 2833 struct nft_hook *this, *hook; 2834 LIST_HEAD(chain_del_list); 2835 struct nft_trans *trans; 2836 int err; 2837 2838 err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook, 2839 ctx->family, chain->flags, extack); 2840 if (err < 0) 2841 return err; 2842 2843 list_for_each_entry(this, &chain_hook.list, list) { 2844 hook = nft_hook_list_find(&basechain->hook_list, this); 2845 if (!hook) { 2846 err = -ENOENT; 2847 goto err_chain_del_hook; 2848 } 2849 list_move(&hook->list, &chain_del_list); 2850 } 2851 2852 trans = nft_trans_alloc(ctx, NFT_MSG_DELCHAIN, 2853 sizeof(struct nft_trans_chain)); 2854 if (!trans) { 2855 err = -ENOMEM; 2856 goto err_chain_del_hook; 2857 } 2858 2859 nft_trans_basechain(trans) = basechain; 2860 nft_trans_chain_update(trans) = true; 2861 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 2862 list_splice(&chain_del_list, &nft_trans_chain_hooks(trans)); 2863 nft_chain_release_hook(&chain_hook); 2864 2865 nft_trans_commit_list_add_tail(ctx->net, trans); 2866 2867 return 0; 2868 2869 err_chain_del_hook: 2870 list_splice(&chain_del_list, &basechain->hook_list); 2871 nft_chain_release_hook(&chain_hook); 2872 2873 return err; 2874 } 2875 2876 static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, 2877 const struct nlattr * const nla[]) 2878 { 2879 struct netlink_ext_ack *extack = info->extack; 2880 u8 genmask = nft_genmask_next(info->net); 2881 u8 family = info->nfmsg->nfgen_family; 2882 struct net *net = info->net; 2883 const struct nlattr *attr; 2884 struct nft_table *table; 2885 struct nft_chain *chain; 2886 struct nft_rule *rule; 2887 struct nft_ctx ctx; 2888 u64 handle; 2889 u32 use; 2890 int err; 2891 2892 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2893 NETLINK_CB(skb).portid); 2894 if (IS_ERR(table)) { 2895 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2896 return PTR_ERR(table); 2897 } 2898 2899 if (nla[NFTA_CHAIN_HANDLE]) { 2900 attr = nla[NFTA_CHAIN_HANDLE]; 2901 handle = be64_to_cpu(nla_get_be64(attr)); 2902 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2903 } else { 2904 attr = nla[NFTA_CHAIN_NAME]; 2905 chain = nft_chain_lookup(net, table, attr, genmask); 2906 } 2907 if (IS_ERR(chain)) { 2908 if (PTR_ERR(chain) == -ENOENT && 2909 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN) 2910 return 0; 2911 2912 NL_SET_BAD_ATTR(extack, attr); 2913 return PTR_ERR(chain); 2914 } 2915 2916 if (nft_chain_binding(chain)) 2917 return -EOPNOTSUPP; 2918 2919 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2920 2921 if (nla[NFTA_CHAIN_HOOK]) { 2922 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 2923 return -EOPNOTSUPP; 2924 2925 if (nft_is_base_chain(chain)) { 2926 struct nft_base_chain *basechain = nft_base_chain(chain); 2927 2928 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 2929 return nft_delchain_hook(&ctx, basechain, extack); 2930 } 2931 } 2932 2933 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 2934 chain->use > 0) 2935 return -EBUSY; 2936 2937 use = chain->use; 2938 list_for_each_entry(rule, &chain->rules, list) { 2939 if (!nft_is_active_next(net, rule)) 2940 continue; 2941 use--; 2942 2943 err = nft_delrule(&ctx, rule); 2944 if (err < 0) 2945 return err; 2946 } 2947 2948 /* There are rules and elements that are still holding references to us, 2949 * we cannot do a recursive removal in this case. 2950 */ 2951 if (use > 0) { 2952 NL_SET_BAD_ATTR(extack, attr); 2953 return -EBUSY; 2954 } 2955 2956 return nft_delchain(&ctx); 2957 } 2958 2959 /* 2960 * Expressions 2961 */ 2962 2963 /** 2964 * nft_register_expr - register nf_tables expr type 2965 * @type: expr type 2966 * 2967 * Registers the expr type for use with nf_tables. Returns zero on 2968 * success or a negative errno code otherwise. 2969 */ 2970 int nft_register_expr(struct nft_expr_type *type) 2971 { 2972 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2973 if (type->family == NFPROTO_UNSPEC) 2974 list_add_tail_rcu(&type->list, &nf_tables_expressions); 2975 else 2976 list_add_rcu(&type->list, &nf_tables_expressions); 2977 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2978 return 0; 2979 } 2980 EXPORT_SYMBOL_GPL(nft_register_expr); 2981 2982 /** 2983 * nft_unregister_expr - unregister nf_tables expr type 2984 * @type: expr type 2985 * 2986 * Unregisters the expr typefor use with nf_tables. 2987 */ 2988 void nft_unregister_expr(struct nft_expr_type *type) 2989 { 2990 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2991 list_del_rcu(&type->list); 2992 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2993 } 2994 EXPORT_SYMBOL_GPL(nft_unregister_expr); 2995 2996 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 2997 struct nlattr *nla) 2998 { 2999 const struct nft_expr_type *type, *candidate = NULL; 3000 3001 list_for_each_entry(type, &nf_tables_expressions, list) { 3002 if (!nla_strcmp(nla, type->name)) { 3003 if (!type->family && !candidate) 3004 candidate = type; 3005 else if (type->family == family) 3006 candidate = type; 3007 } 3008 } 3009 return candidate; 3010 } 3011 3012 #ifdef CONFIG_MODULES 3013 static int nft_expr_type_request_module(struct net *net, u8 family, 3014 struct nlattr *nla) 3015 { 3016 if (nft_request_module(net, "nft-expr-%u-%.*s", family, 3017 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN) 3018 return -EAGAIN; 3019 3020 return 0; 3021 } 3022 #endif 3023 3024 static const struct nft_expr_type *nft_expr_type_get(struct net *net, 3025 u8 family, 3026 struct nlattr *nla) 3027 { 3028 const struct nft_expr_type *type; 3029 3030 if (nla == NULL) 3031 return ERR_PTR(-EINVAL); 3032 3033 type = __nft_expr_type_get(family, nla); 3034 if (type != NULL && try_module_get(type->owner)) 3035 return type; 3036 3037 lockdep_nfnl_nft_mutex_not_held(); 3038 #ifdef CONFIG_MODULES 3039 if (type == NULL) { 3040 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN) 3041 return ERR_PTR(-EAGAIN); 3042 3043 if (nft_request_module(net, "nft-expr-%.*s", 3044 nla_len(nla), 3045 (char *)nla_data(nla)) == -EAGAIN) 3046 return ERR_PTR(-EAGAIN); 3047 } 3048 #endif 3049 return ERR_PTR(-ENOENT); 3050 } 3051 3052 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 3053 [NFTA_EXPR_NAME] = { .type = NLA_STRING, 3054 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 3055 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 3056 }; 3057 3058 static int nf_tables_fill_expr_info(struct sk_buff *skb, 3059 const struct nft_expr *expr, bool reset) 3060 { 3061 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 3062 goto nla_put_failure; 3063 3064 if (expr->ops->dump) { 3065 struct nlattr *data = nla_nest_start_noflag(skb, 3066 NFTA_EXPR_DATA); 3067 if (data == NULL) 3068 goto nla_put_failure; 3069 if (expr->ops->dump(skb, expr, reset) < 0) 3070 goto nla_put_failure; 3071 nla_nest_end(skb, data); 3072 } 3073 3074 return skb->len; 3075 3076 nla_put_failure: 3077 return -1; 3078 }; 3079 3080 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 3081 const struct nft_expr *expr, bool reset) 3082 { 3083 struct nlattr *nest; 3084 3085 nest = nla_nest_start_noflag(skb, attr); 3086 if (!nest) 3087 goto nla_put_failure; 3088 if (nf_tables_fill_expr_info(skb, expr, reset) < 0) 3089 goto nla_put_failure; 3090 nla_nest_end(skb, nest); 3091 return 0; 3092 3093 nla_put_failure: 3094 return -1; 3095 } 3096 3097 struct nft_expr_info { 3098 const struct nft_expr_ops *ops; 3099 const struct nlattr *attr; 3100 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 3101 }; 3102 3103 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 3104 const struct nlattr *nla, 3105 struct nft_expr_info *info) 3106 { 3107 const struct nft_expr_type *type; 3108 const struct nft_expr_ops *ops; 3109 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3110 int err; 3111 3112 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3113 nft_expr_policy, NULL); 3114 if (err < 0) 3115 return err; 3116 3117 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]); 3118 if (IS_ERR(type)) 3119 return PTR_ERR(type); 3120 3121 if (tb[NFTA_EXPR_DATA]) { 3122 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3123 tb[NFTA_EXPR_DATA], 3124 type->policy, NULL); 3125 if (err < 0) 3126 goto err1; 3127 } else 3128 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 3129 3130 if (type->select_ops != NULL) { 3131 ops = type->select_ops(ctx, 3132 (const struct nlattr * const *)info->tb); 3133 if (IS_ERR(ops)) { 3134 err = PTR_ERR(ops); 3135 #ifdef CONFIG_MODULES 3136 if (err == -EAGAIN) 3137 if (nft_expr_type_request_module(ctx->net, 3138 ctx->family, 3139 tb[NFTA_EXPR_NAME]) != -EAGAIN) 3140 err = -ENOENT; 3141 #endif 3142 goto err1; 3143 } 3144 } else 3145 ops = type->ops; 3146 3147 info->attr = nla; 3148 info->ops = ops; 3149 3150 return 0; 3151 3152 err1: 3153 module_put(type->owner); 3154 return err; 3155 } 3156 3157 int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, 3158 struct nft_expr_info *info) 3159 { 3160 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3161 const struct nft_expr_type *type; 3162 int err; 3163 3164 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3165 nft_expr_policy, NULL); 3166 if (err < 0) 3167 return err; 3168 3169 if (!tb[NFTA_EXPR_DATA]) 3170 return -EINVAL; 3171 3172 type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); 3173 if (!type) 3174 return -ENOENT; 3175 3176 if (!type->inner_ops) 3177 return -EOPNOTSUPP; 3178 3179 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3180 tb[NFTA_EXPR_DATA], 3181 type->policy, NULL); 3182 if (err < 0) 3183 goto err_nla_parse; 3184 3185 info->attr = nla; 3186 info->ops = type->inner_ops; 3187 3188 return 0; 3189 3190 err_nla_parse: 3191 return err; 3192 } 3193 3194 static int nf_tables_newexpr(const struct nft_ctx *ctx, 3195 const struct nft_expr_info *expr_info, 3196 struct nft_expr *expr) 3197 { 3198 const struct nft_expr_ops *ops = expr_info->ops; 3199 int err; 3200 3201 expr->ops = ops; 3202 if (ops->init) { 3203 err = ops->init(ctx, expr, (const struct nlattr **)expr_info->tb); 3204 if (err < 0) 3205 goto err1; 3206 } 3207 3208 return 0; 3209 err1: 3210 expr->ops = NULL; 3211 return err; 3212 } 3213 3214 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 3215 struct nft_expr *expr) 3216 { 3217 const struct nft_expr_type *type = expr->ops->type; 3218 3219 if (expr->ops->destroy) 3220 expr->ops->destroy(ctx, expr); 3221 module_put(type->owner); 3222 } 3223 3224 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 3225 const struct nlattr *nla) 3226 { 3227 struct nft_expr_info expr_info; 3228 struct nft_expr *expr; 3229 struct module *owner; 3230 int err; 3231 3232 err = nf_tables_expr_parse(ctx, nla, &expr_info); 3233 if (err < 0) 3234 goto err_expr_parse; 3235 3236 err = -EOPNOTSUPP; 3237 if (!(expr_info.ops->type->flags & NFT_EXPR_STATEFUL)) 3238 goto err_expr_stateful; 3239 3240 err = -ENOMEM; 3241 expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT); 3242 if (expr == NULL) 3243 goto err_expr_stateful; 3244 3245 err = nf_tables_newexpr(ctx, &expr_info, expr); 3246 if (err < 0) 3247 goto err_expr_new; 3248 3249 return expr; 3250 err_expr_new: 3251 kfree(expr); 3252 err_expr_stateful: 3253 owner = expr_info.ops->type->owner; 3254 if (expr_info.ops->type->release_ops) 3255 expr_info.ops->type->release_ops(expr_info.ops); 3256 3257 module_put(owner); 3258 err_expr_parse: 3259 return ERR_PTR(err); 3260 } 3261 3262 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) 3263 { 3264 int err; 3265 3266 if (src->ops->clone) { 3267 dst->ops = src->ops; 3268 err = src->ops->clone(dst, src); 3269 if (err < 0) 3270 return err; 3271 } else { 3272 memcpy(dst, src, src->ops->size); 3273 } 3274 3275 __module_get(src->ops->type->owner); 3276 3277 return 0; 3278 } 3279 3280 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 3281 { 3282 nf_tables_expr_destroy(ctx, expr); 3283 kfree(expr); 3284 } 3285 3286 /* 3287 * Rules 3288 */ 3289 3290 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain, 3291 u64 handle) 3292 { 3293 struct nft_rule *rule; 3294 3295 // FIXME: this sucks 3296 list_for_each_entry_rcu(rule, &chain->rules, list) { 3297 if (handle == rule->handle) 3298 return rule; 3299 } 3300 3301 return ERR_PTR(-ENOENT); 3302 } 3303 3304 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain, 3305 const struct nlattr *nla) 3306 { 3307 if (nla == NULL) 3308 return ERR_PTR(-EINVAL); 3309 3310 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla))); 3311 } 3312 3313 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 3314 [NFTA_RULE_TABLE] = { .type = NLA_STRING, 3315 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3316 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 3317 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 3318 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 3319 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED }, 3320 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 3321 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 3322 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 3323 .len = NFT_USERDATA_MAXLEN }, 3324 [NFTA_RULE_ID] = { .type = NLA_U32 }, 3325 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 }, 3326 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 }, 3327 }; 3328 3329 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 3330 u32 portid, u32 seq, int event, 3331 u32 flags, int family, 3332 const struct nft_table *table, 3333 const struct nft_chain *chain, 3334 const struct nft_rule *rule, u64 handle, 3335 bool reset) 3336 { 3337 struct nlmsghdr *nlh; 3338 const struct nft_expr *expr, *next; 3339 struct nlattr *list; 3340 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 3341 3342 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, 3343 nft_base_seq(net)); 3344 if (!nlh) 3345 goto nla_put_failure; 3346 3347 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 3348 goto nla_put_failure; 3349 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 3350 goto nla_put_failure; 3351 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle), 3352 NFTA_RULE_PAD)) 3353 goto nla_put_failure; 3354 3355 if (event != NFT_MSG_DELRULE && handle) { 3356 if (nla_put_be64(skb, NFTA_RULE_POSITION, cpu_to_be64(handle), 3357 NFTA_RULE_PAD)) 3358 goto nla_put_failure; 3359 } 3360 3361 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 3362 nft_flow_rule_stats(chain, rule); 3363 3364 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS); 3365 if (list == NULL) 3366 goto nla_put_failure; 3367 nft_rule_for_each_expr(expr, next, rule) { 3368 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 3369 goto nla_put_failure; 3370 } 3371 nla_nest_end(skb, list); 3372 3373 if (rule->udata) { 3374 struct nft_userdata *udata = nft_userdata(rule); 3375 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 3376 udata->data) < 0) 3377 goto nla_put_failure; 3378 } 3379 3380 nlmsg_end(skb, nlh); 3381 return 0; 3382 3383 nla_put_failure: 3384 nlmsg_trim(skb, nlh); 3385 return -1; 3386 } 3387 3388 static void nf_tables_rule_notify(const struct nft_ctx *ctx, 3389 const struct nft_rule *rule, int event) 3390 { 3391 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3392 const struct nft_rule *prule; 3393 struct sk_buff *skb; 3394 u64 handle = 0; 3395 u16 flags = 0; 3396 int err; 3397 3398 if (!ctx->report && 3399 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 3400 return; 3401 3402 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3403 if (skb == NULL) 3404 goto err; 3405 3406 if (event == NFT_MSG_NEWRULE && 3407 !list_is_first(&rule->list, &ctx->chain->rules) && 3408 !list_is_last(&rule->list, &ctx->chain->rules)) { 3409 prule = list_prev_entry(rule, list); 3410 handle = prule->handle; 3411 } 3412 if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) 3413 flags |= NLM_F_APPEND; 3414 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 3415 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 3416 3417 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 3418 event, flags, ctx->family, ctx->table, 3419 ctx->chain, rule, handle, false); 3420 if (err < 0) { 3421 kfree_skb(skb); 3422 goto err; 3423 } 3424 3425 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 3426 return; 3427 err: 3428 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 3429 } 3430 3431 static void audit_log_rule_reset(const struct nft_table *table, 3432 unsigned int base_seq, 3433 unsigned int nentries) 3434 { 3435 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", 3436 table->name, base_seq); 3437 3438 audit_log_nfcfg(buf, table->family, nentries, 3439 AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC); 3440 kfree(buf); 3441 } 3442 3443 struct nft_rule_dump_ctx { 3444 char *table; 3445 char *chain; 3446 }; 3447 3448 static int __nf_tables_dump_rules(struct sk_buff *skb, 3449 unsigned int *idx, 3450 struct netlink_callback *cb, 3451 const struct nft_table *table, 3452 const struct nft_chain *chain, 3453 bool reset) 3454 { 3455 struct net *net = sock_net(skb->sk); 3456 const struct nft_rule *rule, *prule; 3457 unsigned int s_idx = cb->args[0]; 3458 unsigned int entries = 0; 3459 int ret = 0; 3460 u64 handle; 3461 3462 prule = NULL; 3463 list_for_each_entry_rcu(rule, &chain->rules, list) { 3464 if (!nft_is_active(net, rule)) 3465 goto cont_skip; 3466 if (*idx < s_idx) 3467 goto cont; 3468 if (*idx > s_idx) { 3469 memset(&cb->args[1], 0, 3470 sizeof(cb->args) - sizeof(cb->args[0])); 3471 } 3472 if (prule) 3473 handle = prule->handle; 3474 else 3475 handle = 0; 3476 3477 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 3478 cb->nlh->nlmsg_seq, 3479 NFT_MSG_NEWRULE, 3480 NLM_F_MULTI | NLM_F_APPEND, 3481 table->family, 3482 table, chain, rule, handle, reset) < 0) { 3483 ret = 1; 3484 break; 3485 } 3486 entries++; 3487 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 3488 cont: 3489 prule = rule; 3490 cont_skip: 3491 (*idx)++; 3492 } 3493 3494 if (reset && entries) 3495 audit_log_rule_reset(table, cb->seq, entries); 3496 3497 return ret; 3498 } 3499 3500 static int nf_tables_dump_rules(struct sk_buff *skb, 3501 struct netlink_callback *cb) 3502 { 3503 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3504 const struct nft_rule_dump_ctx *ctx = cb->data; 3505 struct nft_table *table; 3506 const struct nft_chain *chain; 3507 unsigned int idx = 0; 3508 struct net *net = sock_net(skb->sk); 3509 int family = nfmsg->nfgen_family; 3510 struct nftables_pernet *nft_net; 3511 bool reset = false; 3512 3513 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3514 reset = true; 3515 3516 rcu_read_lock(); 3517 nft_net = nft_pernet(net); 3518 cb->seq = READ_ONCE(nft_net->base_seq); 3519 3520 list_for_each_entry_rcu(table, &nft_net->tables, list) { 3521 if (family != NFPROTO_UNSPEC && family != table->family) 3522 continue; 3523 3524 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0) 3525 continue; 3526 3527 if (ctx && ctx->table && ctx->chain) { 3528 struct rhlist_head *list, *tmp; 3529 3530 list = rhltable_lookup(&table->chains_ht, ctx->chain, 3531 nft_chain_ht_params); 3532 if (!list) 3533 goto done; 3534 3535 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 3536 if (!nft_is_active(net, chain)) 3537 continue; 3538 __nf_tables_dump_rules(skb, &idx, 3539 cb, table, chain, reset); 3540 break; 3541 } 3542 goto done; 3543 } 3544 3545 list_for_each_entry_rcu(chain, &table->chains, list) { 3546 if (__nf_tables_dump_rules(skb, &idx, 3547 cb, table, chain, reset)) 3548 goto done; 3549 } 3550 3551 if (ctx && ctx->table) 3552 break; 3553 } 3554 done: 3555 rcu_read_unlock(); 3556 3557 cb->args[0] = idx; 3558 return skb->len; 3559 } 3560 3561 static int nf_tables_dump_rules_start(struct netlink_callback *cb) 3562 { 3563 const struct nlattr * const *nla = cb->data; 3564 struct nft_rule_dump_ctx *ctx = NULL; 3565 3566 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) { 3567 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC); 3568 if (!ctx) 3569 return -ENOMEM; 3570 3571 if (nla[NFTA_RULE_TABLE]) { 3572 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE], 3573 GFP_ATOMIC); 3574 if (!ctx->table) { 3575 kfree(ctx); 3576 return -ENOMEM; 3577 } 3578 } 3579 if (nla[NFTA_RULE_CHAIN]) { 3580 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN], 3581 GFP_ATOMIC); 3582 if (!ctx->chain) { 3583 kfree(ctx->table); 3584 kfree(ctx); 3585 return -ENOMEM; 3586 } 3587 } 3588 } 3589 3590 cb->data = ctx; 3591 return 0; 3592 } 3593 3594 static int nf_tables_dump_rules_done(struct netlink_callback *cb) 3595 { 3596 struct nft_rule_dump_ctx *ctx = cb->data; 3597 3598 if (ctx) { 3599 kfree(ctx->table); 3600 kfree(ctx->chain); 3601 kfree(ctx); 3602 } 3603 return 0; 3604 } 3605 3606 /* called with rcu_read_lock held */ 3607 static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, 3608 const struct nlattr * const nla[]) 3609 { 3610 struct netlink_ext_ack *extack = info->extack; 3611 u8 genmask = nft_genmask_cur(info->net); 3612 u8 family = info->nfmsg->nfgen_family; 3613 const struct nft_chain *chain; 3614 const struct nft_rule *rule; 3615 struct net *net = info->net; 3616 struct nft_table *table; 3617 struct sk_buff *skb2; 3618 bool reset = false; 3619 int err; 3620 3621 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3622 struct netlink_dump_control c = { 3623 .start= nf_tables_dump_rules_start, 3624 .dump = nf_tables_dump_rules, 3625 .done = nf_tables_dump_rules_done, 3626 .module = THIS_MODULE, 3627 .data = (void *)nla, 3628 }; 3629 3630 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 3631 } 3632 3633 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0); 3634 if (IS_ERR(table)) { 3635 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3636 return PTR_ERR(table); 3637 } 3638 3639 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask); 3640 if (IS_ERR(chain)) { 3641 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3642 return PTR_ERR(chain); 3643 } 3644 3645 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 3646 if (IS_ERR(rule)) { 3647 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3648 return PTR_ERR(rule); 3649 } 3650 3651 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 3652 if (!skb2) 3653 return -ENOMEM; 3654 3655 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3656 reset = true; 3657 3658 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid, 3659 info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 3660 family, table, chain, rule, 0, reset); 3661 if (err < 0) 3662 goto err_fill_rule_info; 3663 3664 if (reset) 3665 audit_log_rule_reset(table, nft_pernet(net)->base_seq, 1); 3666 3667 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 3668 3669 err_fill_rule_info: 3670 kfree_skb(skb2); 3671 return err; 3672 } 3673 3674 void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule) 3675 { 3676 struct nft_expr *expr, *next; 3677 3678 /* 3679 * Careful: some expressions might not be initialized in case this 3680 * is called on error from nf_tables_newrule(). 3681 */ 3682 expr = nft_expr_first(rule); 3683 while (nft_expr_more(rule, expr)) { 3684 next = nft_expr_next(expr); 3685 nf_tables_expr_destroy(ctx, expr); 3686 expr = next; 3687 } 3688 kfree(rule); 3689 } 3690 3691 static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) 3692 { 3693 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); 3694 nf_tables_rule_destroy(ctx, rule); 3695 } 3696 3697 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) 3698 { 3699 struct nft_expr *expr, *last; 3700 const struct nft_data *data; 3701 struct nft_rule *rule; 3702 int err; 3703 3704 if (ctx->level == NFT_JUMP_STACK_SIZE) 3705 return -EMLINK; 3706 3707 list_for_each_entry(rule, &chain->rules, list) { 3708 if (fatal_signal_pending(current)) 3709 return -EINTR; 3710 3711 if (!nft_is_active_next(ctx->net, rule)) 3712 continue; 3713 3714 nft_rule_for_each_expr(expr, last, rule) { 3715 if (!expr->ops->validate) 3716 continue; 3717 3718 err = expr->ops->validate(ctx, expr, &data); 3719 if (err < 0) 3720 return err; 3721 } 3722 } 3723 3724 return 0; 3725 } 3726 EXPORT_SYMBOL_GPL(nft_chain_validate); 3727 3728 static int nft_table_validate(struct net *net, const struct nft_table *table) 3729 { 3730 struct nft_chain *chain; 3731 struct nft_ctx ctx = { 3732 .net = net, 3733 .family = table->family, 3734 }; 3735 int err; 3736 3737 list_for_each_entry(chain, &table->chains, list) { 3738 if (!nft_is_base_chain(chain)) 3739 continue; 3740 3741 ctx.chain = chain; 3742 err = nft_chain_validate(&ctx, chain); 3743 if (err < 0) 3744 return err; 3745 3746 cond_resched(); 3747 } 3748 3749 return 0; 3750 } 3751 3752 int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, 3753 const struct nft_set_iter *iter, 3754 struct nft_set_elem *elem) 3755 { 3756 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 3757 struct nft_ctx *pctx = (struct nft_ctx *)ctx; 3758 const struct nft_data *data; 3759 int err; 3760 3761 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 3762 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 3763 return 0; 3764 3765 data = nft_set_ext_data(ext); 3766 switch (data->verdict.code) { 3767 case NFT_JUMP: 3768 case NFT_GOTO: 3769 pctx->level++; 3770 err = nft_chain_validate(ctx, data->verdict.chain); 3771 if (err < 0) 3772 return err; 3773 pctx->level--; 3774 break; 3775 default: 3776 break; 3777 } 3778 3779 return 0; 3780 } 3781 3782 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set) 3783 { 3784 u8 genmask = nft_genmask_next(ctx->net); 3785 struct nft_set_elem_catchall *catchall; 3786 struct nft_set_elem elem; 3787 struct nft_set_ext *ext; 3788 int ret = 0; 3789 3790 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 3791 ext = nft_set_elem_ext(set, catchall->elem); 3792 if (!nft_set_elem_active(ext, genmask)) 3793 continue; 3794 3795 elem.priv = catchall->elem; 3796 ret = nft_setelem_validate(ctx, set, NULL, &elem); 3797 if (ret < 0) 3798 return ret; 3799 } 3800 3801 return ret; 3802 } 3803 3804 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 3805 const struct nft_chain *chain, 3806 const struct nlattr *nla); 3807 3808 #define NFT_RULE_MAXEXPRS 128 3809 3810 static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 3811 const struct nlattr * const nla[]) 3812 { 3813 struct nftables_pernet *nft_net = nft_pernet(info->net); 3814 struct netlink_ext_ack *extack = info->extack; 3815 unsigned int size, i, n, ulen = 0, usize = 0; 3816 u8 genmask = nft_genmask_next(info->net); 3817 struct nft_rule *rule, *old_rule = NULL; 3818 struct nft_expr_info *expr_info = NULL; 3819 u8 family = info->nfmsg->nfgen_family; 3820 struct nft_flow_rule *flow = NULL; 3821 struct net *net = info->net; 3822 struct nft_userdata *udata; 3823 struct nft_table *table; 3824 struct nft_chain *chain; 3825 struct nft_trans *trans; 3826 u64 handle, pos_handle; 3827 struct nft_expr *expr; 3828 struct nft_ctx ctx; 3829 struct nlattr *tmp; 3830 int err, rem; 3831 3832 lockdep_assert_held(&nft_net->commit_mutex); 3833 3834 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 3835 NETLINK_CB(skb).portid); 3836 if (IS_ERR(table)) { 3837 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3838 return PTR_ERR(table); 3839 } 3840 3841 if (nla[NFTA_RULE_CHAIN]) { 3842 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 3843 genmask); 3844 if (IS_ERR(chain)) { 3845 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3846 return PTR_ERR(chain); 3847 } 3848 3849 } else if (nla[NFTA_RULE_CHAIN_ID]) { 3850 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID], 3851 genmask); 3852 if (IS_ERR(chain)) { 3853 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]); 3854 return PTR_ERR(chain); 3855 } 3856 } else { 3857 return -EINVAL; 3858 } 3859 3860 if (nft_chain_is_bound(chain)) 3861 return -EOPNOTSUPP; 3862 3863 if (nla[NFTA_RULE_HANDLE]) { 3864 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 3865 rule = __nft_rule_lookup(chain, handle); 3866 if (IS_ERR(rule)) { 3867 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3868 return PTR_ERR(rule); 3869 } 3870 3871 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 3872 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3873 return -EEXIST; 3874 } 3875 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 3876 old_rule = rule; 3877 else 3878 return -EOPNOTSUPP; 3879 } else { 3880 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE) || 3881 info->nlh->nlmsg_flags & NLM_F_REPLACE) 3882 return -EINVAL; 3883 handle = nf_tables_alloc_handle(table); 3884 3885 if (nla[NFTA_RULE_POSITION]) { 3886 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 3887 old_rule = __nft_rule_lookup(chain, pos_handle); 3888 if (IS_ERR(old_rule)) { 3889 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); 3890 return PTR_ERR(old_rule); 3891 } 3892 } else if (nla[NFTA_RULE_POSITION_ID]) { 3893 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]); 3894 if (IS_ERR(old_rule)) { 3895 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); 3896 return PTR_ERR(old_rule); 3897 } 3898 } 3899 } 3900 3901 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3902 3903 n = 0; 3904 size = 0; 3905 if (nla[NFTA_RULE_EXPRESSIONS]) { 3906 expr_info = kvmalloc_array(NFT_RULE_MAXEXPRS, 3907 sizeof(struct nft_expr_info), 3908 GFP_KERNEL); 3909 if (!expr_info) 3910 return -ENOMEM; 3911 3912 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 3913 err = -EINVAL; 3914 if (nla_type(tmp) != NFTA_LIST_ELEM) 3915 goto err_release_expr; 3916 if (n == NFT_RULE_MAXEXPRS) 3917 goto err_release_expr; 3918 err = nf_tables_expr_parse(&ctx, tmp, &expr_info[n]); 3919 if (err < 0) { 3920 NL_SET_BAD_ATTR(extack, tmp); 3921 goto err_release_expr; 3922 } 3923 size += expr_info[n].ops->size; 3924 n++; 3925 } 3926 } 3927 /* Check for overflow of dlen field */ 3928 err = -EFBIG; 3929 if (size >= 1 << 12) 3930 goto err_release_expr; 3931 3932 if (nla[NFTA_RULE_USERDATA]) { 3933 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 3934 if (ulen > 0) 3935 usize = sizeof(struct nft_userdata) + ulen; 3936 } 3937 3938 err = -ENOMEM; 3939 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT); 3940 if (rule == NULL) 3941 goto err_release_expr; 3942 3943 nft_activate_next(net, rule); 3944 3945 rule->handle = handle; 3946 rule->dlen = size; 3947 rule->udata = ulen ? 1 : 0; 3948 3949 if (ulen) { 3950 udata = nft_userdata(rule); 3951 udata->len = ulen - 1; 3952 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 3953 } 3954 3955 expr = nft_expr_first(rule); 3956 for (i = 0; i < n; i++) { 3957 err = nf_tables_newexpr(&ctx, &expr_info[i], expr); 3958 if (err < 0) { 3959 NL_SET_BAD_ATTR(extack, expr_info[i].attr); 3960 goto err_release_rule; 3961 } 3962 3963 if (expr_info[i].ops->validate) 3964 nft_validate_state_update(table, NFT_VALIDATE_NEED); 3965 3966 expr_info[i].ops = NULL; 3967 expr = nft_expr_next(expr); 3968 } 3969 3970 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { 3971 flow = nft_flow_rule_create(net, rule); 3972 if (IS_ERR(flow)) { 3973 err = PTR_ERR(flow); 3974 goto err_release_rule; 3975 } 3976 } 3977 3978 if (!nft_use_inc(&chain->use)) { 3979 err = -EMFILE; 3980 goto err_release_rule; 3981 } 3982 3983 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) { 3984 if (nft_chain_binding(chain)) { 3985 err = -EOPNOTSUPP; 3986 goto err_destroy_flow_rule; 3987 } 3988 3989 err = nft_delrule(&ctx, old_rule); 3990 if (err < 0) 3991 goto err_destroy_flow_rule; 3992 3993 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 3994 if (trans == NULL) { 3995 err = -ENOMEM; 3996 goto err_destroy_flow_rule; 3997 } 3998 list_add_tail_rcu(&rule->list, &old_rule->list); 3999 } else { 4000 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 4001 if (!trans) { 4002 err = -ENOMEM; 4003 goto err_destroy_flow_rule; 4004 } 4005 4006 if (info->nlh->nlmsg_flags & NLM_F_APPEND) { 4007 if (old_rule) 4008 list_add_rcu(&rule->list, &old_rule->list); 4009 else 4010 list_add_tail_rcu(&rule->list, &chain->rules); 4011 } else { 4012 if (old_rule) 4013 list_add_tail_rcu(&rule->list, &old_rule->list); 4014 else 4015 list_add_rcu(&rule->list, &chain->rules); 4016 } 4017 } 4018 kvfree(expr_info); 4019 4020 if (flow) 4021 nft_trans_flow_rule(trans) = flow; 4022 4023 if (table->validate_state == NFT_VALIDATE_DO) 4024 return nft_table_validate(net, table); 4025 4026 return 0; 4027 4028 err_destroy_flow_rule: 4029 nft_use_dec_restore(&chain->use); 4030 if (flow) 4031 nft_flow_rule_destroy(flow); 4032 err_release_rule: 4033 nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR); 4034 nf_tables_rule_destroy(&ctx, rule); 4035 err_release_expr: 4036 for (i = 0; i < n; i++) { 4037 if (expr_info[i].ops) { 4038 module_put(expr_info[i].ops->type->owner); 4039 if (expr_info[i].ops->type->release_ops) 4040 expr_info[i].ops->type->release_ops(expr_info[i].ops); 4041 } 4042 } 4043 kvfree(expr_info); 4044 4045 return err; 4046 } 4047 4048 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 4049 const struct nft_chain *chain, 4050 const struct nlattr *nla) 4051 { 4052 struct nftables_pernet *nft_net = nft_pernet(net); 4053 u32 id = ntohl(nla_get_be32(nla)); 4054 struct nft_trans *trans; 4055 4056 list_for_each_entry(trans, &nft_net->commit_list, list) { 4057 if (trans->msg_type == NFT_MSG_NEWRULE && 4058 trans->ctx.chain == chain && 4059 id == nft_trans_rule_id(trans)) 4060 return nft_trans_rule(trans); 4061 } 4062 return ERR_PTR(-ENOENT); 4063 } 4064 4065 static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 4066 const struct nlattr * const nla[]) 4067 { 4068 struct netlink_ext_ack *extack = info->extack; 4069 u8 genmask = nft_genmask_next(info->net); 4070 u8 family = info->nfmsg->nfgen_family; 4071 struct nft_chain *chain = NULL; 4072 struct net *net = info->net; 4073 struct nft_table *table; 4074 struct nft_rule *rule; 4075 struct nft_ctx ctx; 4076 int err = 0; 4077 4078 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 4079 NETLINK_CB(skb).portid); 4080 if (IS_ERR(table)) { 4081 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 4082 return PTR_ERR(table); 4083 } 4084 4085 if (nla[NFTA_RULE_CHAIN]) { 4086 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 4087 genmask); 4088 if (IS_ERR(chain)) { 4089 if (PTR_ERR(chain) == -ENOENT && 4090 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 4091 return 0; 4092 4093 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 4094 return PTR_ERR(chain); 4095 } 4096 if (nft_chain_binding(chain)) 4097 return -EOPNOTSUPP; 4098 } 4099 4100 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 4101 4102 if (chain) { 4103 if (nla[NFTA_RULE_HANDLE]) { 4104 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 4105 if (IS_ERR(rule)) { 4106 if (PTR_ERR(rule) == -ENOENT && 4107 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 4108 return 0; 4109 4110 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 4111 return PTR_ERR(rule); 4112 } 4113 4114 err = nft_delrule(&ctx, rule); 4115 } else if (nla[NFTA_RULE_ID]) { 4116 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); 4117 if (IS_ERR(rule)) { 4118 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); 4119 return PTR_ERR(rule); 4120 } 4121 4122 err = nft_delrule(&ctx, rule); 4123 } else { 4124 err = nft_delrule_by_chain(&ctx); 4125 } 4126 } else { 4127 list_for_each_entry(chain, &table->chains, list) { 4128 if (!nft_is_active_next(net, chain)) 4129 continue; 4130 if (nft_chain_binding(chain)) 4131 continue; 4132 4133 ctx.chain = chain; 4134 err = nft_delrule_by_chain(&ctx); 4135 if (err < 0) 4136 break; 4137 } 4138 } 4139 4140 return err; 4141 } 4142 4143 /* 4144 * Sets 4145 */ 4146 static const struct nft_set_type *nft_set_types[] = { 4147 &nft_set_hash_fast_type, 4148 &nft_set_hash_type, 4149 &nft_set_rhash_type, 4150 &nft_set_bitmap_type, 4151 &nft_set_rbtree_type, 4152 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML) 4153 &nft_set_pipapo_avx2_type, 4154 #endif 4155 &nft_set_pipapo_type, 4156 }; 4157 4158 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ 4159 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \ 4160 NFT_SET_EVAL) 4161 4162 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags) 4163 { 4164 return (flags & type->features) == (flags & NFT_SET_FEATURES); 4165 } 4166 4167 /* 4168 * Select a set implementation based on the data characteristics and the 4169 * given policy. The total memory use might not be known if no size is 4170 * given, in that case the amount of memory per element is used. 4171 */ 4172 static const struct nft_set_ops * 4173 nft_select_set_ops(const struct nft_ctx *ctx, 4174 const struct nlattr * const nla[], 4175 const struct nft_set_desc *desc) 4176 { 4177 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4178 const struct nft_set_ops *ops, *bops; 4179 struct nft_set_estimate est, best; 4180 const struct nft_set_type *type; 4181 u32 flags = 0; 4182 int i; 4183 4184 lockdep_assert_held(&nft_net->commit_mutex); 4185 lockdep_nfnl_nft_mutex_not_held(); 4186 4187 if (nla[NFTA_SET_FLAGS] != NULL) 4188 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 4189 4190 bops = NULL; 4191 best.size = ~0; 4192 best.lookup = ~0; 4193 best.space = ~0; 4194 4195 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) { 4196 type = nft_set_types[i]; 4197 ops = &type->ops; 4198 4199 if (!nft_set_ops_candidate(type, flags)) 4200 continue; 4201 if (!ops->estimate(desc, flags, &est)) 4202 continue; 4203 4204 switch (desc->policy) { 4205 case NFT_SET_POL_PERFORMANCE: 4206 if (est.lookup < best.lookup) 4207 break; 4208 if (est.lookup == best.lookup && 4209 est.space < best.space) 4210 break; 4211 continue; 4212 case NFT_SET_POL_MEMORY: 4213 if (!desc->size) { 4214 if (est.space < best.space) 4215 break; 4216 if (est.space == best.space && 4217 est.lookup < best.lookup) 4218 break; 4219 } else if (est.size < best.size || !bops) { 4220 break; 4221 } 4222 continue; 4223 default: 4224 break; 4225 } 4226 4227 bops = ops; 4228 best = est; 4229 } 4230 4231 if (bops != NULL) 4232 return bops; 4233 4234 return ERR_PTR(-EOPNOTSUPP); 4235 } 4236 4237 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 4238 [NFTA_SET_TABLE] = { .type = NLA_STRING, 4239 .len = NFT_TABLE_MAXNAMELEN - 1 }, 4240 [NFTA_SET_NAME] = { .type = NLA_STRING, 4241 .len = NFT_SET_MAXNAMELEN - 1 }, 4242 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 4243 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 4244 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 4245 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 4246 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 4247 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 4248 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 4249 [NFTA_SET_ID] = { .type = NLA_U32 }, 4250 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 4251 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 4252 [NFTA_SET_USERDATA] = { .type = NLA_BINARY, 4253 .len = NFT_USERDATA_MAXLEN }, 4254 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, 4255 [NFTA_SET_HANDLE] = { .type = NLA_U64 }, 4256 [NFTA_SET_EXPR] = { .type = NLA_NESTED }, 4257 [NFTA_SET_EXPRESSIONS] = { .type = NLA_NESTED }, 4258 }; 4259 4260 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 4261 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 4262 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED }, 4263 }; 4264 4265 static struct nft_set *nft_set_lookup(const struct nft_table *table, 4266 const struct nlattr *nla, u8 genmask) 4267 { 4268 struct nft_set *set; 4269 4270 if (nla == NULL) 4271 return ERR_PTR(-EINVAL); 4272 4273 list_for_each_entry_rcu(set, &table->sets, list) { 4274 if (!nla_strcmp(nla, set->name) && 4275 nft_active_genmask(set, genmask)) 4276 return set; 4277 } 4278 return ERR_PTR(-ENOENT); 4279 } 4280 4281 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, 4282 const struct nlattr *nla, 4283 u8 genmask) 4284 { 4285 struct nft_set *set; 4286 4287 list_for_each_entry(set, &table->sets, list) { 4288 if (be64_to_cpu(nla_get_be64(nla)) == set->handle && 4289 nft_active_genmask(set, genmask)) 4290 return set; 4291 } 4292 return ERR_PTR(-ENOENT); 4293 } 4294 4295 static struct nft_set *nft_set_lookup_byid(const struct net *net, 4296 const struct nft_table *table, 4297 const struct nlattr *nla, u8 genmask) 4298 { 4299 struct nftables_pernet *nft_net = nft_pernet(net); 4300 u32 id = ntohl(nla_get_be32(nla)); 4301 struct nft_trans *trans; 4302 4303 list_for_each_entry(trans, &nft_net->commit_list, list) { 4304 if (trans->msg_type == NFT_MSG_NEWSET) { 4305 struct nft_set *set = nft_trans_set(trans); 4306 4307 if (id == nft_trans_set_id(trans) && 4308 set->table == table && 4309 nft_active_genmask(set, genmask)) 4310 return set; 4311 } 4312 } 4313 return ERR_PTR(-ENOENT); 4314 } 4315 4316 struct nft_set *nft_set_lookup_global(const struct net *net, 4317 const struct nft_table *table, 4318 const struct nlattr *nla_set_name, 4319 const struct nlattr *nla_set_id, 4320 u8 genmask) 4321 { 4322 struct nft_set *set; 4323 4324 set = nft_set_lookup(table, nla_set_name, genmask); 4325 if (IS_ERR(set)) { 4326 if (!nla_set_id) 4327 return set; 4328 4329 set = nft_set_lookup_byid(net, table, nla_set_id, genmask); 4330 } 4331 return set; 4332 } 4333 EXPORT_SYMBOL_GPL(nft_set_lookup_global); 4334 4335 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 4336 const char *name) 4337 { 4338 const struct nft_set *i; 4339 const char *p; 4340 unsigned long *inuse; 4341 unsigned int n = 0, min = 0; 4342 4343 p = strchr(name, '%'); 4344 if (p != NULL) { 4345 if (p[1] != 'd' || strchr(p + 2, '%')) 4346 return -EINVAL; 4347 4348 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 4349 if (inuse == NULL) 4350 return -ENOMEM; 4351 cont: 4352 list_for_each_entry(i, &ctx->table->sets, list) { 4353 int tmp; 4354 4355 if (!nft_is_active_next(ctx->net, i)) 4356 continue; 4357 if (!sscanf(i->name, name, &tmp)) 4358 continue; 4359 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 4360 continue; 4361 4362 set_bit(tmp - min, inuse); 4363 } 4364 4365 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 4366 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 4367 min += BITS_PER_BYTE * PAGE_SIZE; 4368 memset(inuse, 0, PAGE_SIZE); 4369 goto cont; 4370 } 4371 free_page((unsigned long)inuse); 4372 } 4373 4374 set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n); 4375 if (!set->name) 4376 return -ENOMEM; 4377 4378 list_for_each_entry(i, &ctx->table->sets, list) { 4379 if (!nft_is_active_next(ctx->net, i)) 4380 continue; 4381 if (!strcmp(set->name, i->name)) { 4382 kfree(set->name); 4383 set->name = NULL; 4384 return -ENFILE; 4385 } 4386 } 4387 return 0; 4388 } 4389 4390 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) 4391 { 4392 u64 ms = be64_to_cpu(nla_get_be64(nla)); 4393 u64 max = (u64)(~((u64)0)); 4394 4395 max = div_u64(max, NSEC_PER_MSEC); 4396 if (ms >= max) 4397 return -ERANGE; 4398 4399 ms *= NSEC_PER_MSEC; 4400 *result = nsecs_to_jiffies64(ms); 4401 return 0; 4402 } 4403 4404 __be64 nf_jiffies64_to_msecs(u64 input) 4405 { 4406 return cpu_to_be64(jiffies64_to_msecs(input)); 4407 } 4408 4409 static int nf_tables_fill_set_concat(struct sk_buff *skb, 4410 const struct nft_set *set) 4411 { 4412 struct nlattr *concat, *field; 4413 int i; 4414 4415 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT); 4416 if (!concat) 4417 return -ENOMEM; 4418 4419 for (i = 0; i < set->field_count; i++) { 4420 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 4421 if (!field) 4422 return -ENOMEM; 4423 4424 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN, 4425 htonl(set->field_len[i]))) 4426 return -ENOMEM; 4427 4428 nla_nest_end(skb, field); 4429 } 4430 4431 nla_nest_end(skb, concat); 4432 4433 return 0; 4434 } 4435 4436 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 4437 const struct nft_set *set, u16 event, u16 flags) 4438 { 4439 u64 timeout = READ_ONCE(set->timeout); 4440 u32 gc_int = READ_ONCE(set->gc_int); 4441 u32 portid = ctx->portid; 4442 struct nlmsghdr *nlh; 4443 struct nlattr *nest; 4444 u32 seq = ctx->seq; 4445 int i; 4446 4447 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 4448 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 4449 NFNETLINK_V0, nft_base_seq(ctx->net)); 4450 if (!nlh) 4451 goto nla_put_failure; 4452 4453 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 4454 goto nla_put_failure; 4455 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 4456 goto nla_put_failure; 4457 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), 4458 NFTA_SET_PAD)) 4459 goto nla_put_failure; 4460 4461 if (event == NFT_MSG_DELSET) { 4462 nlmsg_end(skb, nlh); 4463 return 0; 4464 } 4465 4466 if (set->flags != 0) 4467 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 4468 goto nla_put_failure; 4469 4470 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 4471 goto nla_put_failure; 4472 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 4473 goto nla_put_failure; 4474 if (set->flags & NFT_SET_MAP) { 4475 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 4476 goto nla_put_failure; 4477 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 4478 goto nla_put_failure; 4479 } 4480 if (set->flags & NFT_SET_OBJECT && 4481 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype))) 4482 goto nla_put_failure; 4483 4484 if (timeout && 4485 nla_put_be64(skb, NFTA_SET_TIMEOUT, 4486 nf_jiffies64_to_msecs(timeout), 4487 NFTA_SET_PAD)) 4488 goto nla_put_failure; 4489 if (gc_int && 4490 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(gc_int))) 4491 goto nla_put_failure; 4492 4493 if (set->policy != NFT_SET_POL_PERFORMANCE) { 4494 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 4495 goto nla_put_failure; 4496 } 4497 4498 if (set->udata && 4499 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) 4500 goto nla_put_failure; 4501 4502 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC); 4503 if (!nest) 4504 goto nla_put_failure; 4505 if (set->size && 4506 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) 4507 goto nla_put_failure; 4508 4509 if (set->field_count > 1 && 4510 nf_tables_fill_set_concat(skb, set)) 4511 goto nla_put_failure; 4512 4513 nla_nest_end(skb, nest); 4514 4515 if (set->num_exprs == 1) { 4516 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR); 4517 if (nf_tables_fill_expr_info(skb, set->exprs[0], false) < 0) 4518 goto nla_put_failure; 4519 4520 nla_nest_end(skb, nest); 4521 } else if (set->num_exprs > 1) { 4522 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPRESSIONS); 4523 if (nest == NULL) 4524 goto nla_put_failure; 4525 4526 for (i = 0; i < set->num_exprs; i++) { 4527 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 4528 set->exprs[i], false) < 0) 4529 goto nla_put_failure; 4530 } 4531 nla_nest_end(skb, nest); 4532 } 4533 4534 nlmsg_end(skb, nlh); 4535 return 0; 4536 4537 nla_put_failure: 4538 nlmsg_trim(skb, nlh); 4539 return -1; 4540 } 4541 4542 static void nf_tables_set_notify(const struct nft_ctx *ctx, 4543 const struct nft_set *set, int event, 4544 gfp_t gfp_flags) 4545 { 4546 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4547 u32 portid = ctx->portid; 4548 struct sk_buff *skb; 4549 u16 flags = 0; 4550 int err; 4551 4552 if (!ctx->report && 4553 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 4554 return; 4555 4556 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 4557 if (skb == NULL) 4558 goto err; 4559 4560 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 4561 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 4562 4563 err = nf_tables_fill_set(skb, ctx, set, event, flags); 4564 if (err < 0) { 4565 kfree_skb(skb); 4566 goto err; 4567 } 4568 4569 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 4570 return; 4571 err: 4572 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 4573 } 4574 4575 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 4576 { 4577 const struct nft_set *set; 4578 unsigned int idx, s_idx = cb->args[0]; 4579 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 4580 struct net *net = sock_net(skb->sk); 4581 struct nft_ctx *ctx = cb->data, ctx_set; 4582 struct nftables_pernet *nft_net; 4583 4584 if (cb->args[1]) 4585 return skb->len; 4586 4587 rcu_read_lock(); 4588 nft_net = nft_pernet(net); 4589 cb->seq = READ_ONCE(nft_net->base_seq); 4590 4591 list_for_each_entry_rcu(table, &nft_net->tables, list) { 4592 if (ctx->family != NFPROTO_UNSPEC && 4593 ctx->family != table->family) 4594 continue; 4595 4596 if (ctx->table && ctx->table != table) 4597 continue; 4598 4599 if (cur_table) { 4600 if (cur_table != table) 4601 continue; 4602 4603 cur_table = NULL; 4604 } 4605 idx = 0; 4606 list_for_each_entry_rcu(set, &table->sets, list) { 4607 if (idx < s_idx) 4608 goto cont; 4609 if (!nft_is_active(net, set)) 4610 goto cont; 4611 4612 ctx_set = *ctx; 4613 ctx_set.table = table; 4614 ctx_set.family = table->family; 4615 4616 if (nf_tables_fill_set(skb, &ctx_set, set, 4617 NFT_MSG_NEWSET, 4618 NLM_F_MULTI) < 0) { 4619 cb->args[0] = idx; 4620 cb->args[2] = (unsigned long) table; 4621 goto done; 4622 } 4623 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 4624 cont: 4625 idx++; 4626 } 4627 if (s_idx) 4628 s_idx = 0; 4629 } 4630 cb->args[1] = 1; 4631 done: 4632 rcu_read_unlock(); 4633 return skb->len; 4634 } 4635 4636 static int nf_tables_dump_sets_start(struct netlink_callback *cb) 4637 { 4638 struct nft_ctx *ctx_dump = NULL; 4639 4640 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC); 4641 if (ctx_dump == NULL) 4642 return -ENOMEM; 4643 4644 cb->data = ctx_dump; 4645 return 0; 4646 } 4647 4648 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 4649 { 4650 kfree(cb->data); 4651 return 0; 4652 } 4653 4654 /* called with rcu_read_lock held */ 4655 static int nf_tables_getset(struct sk_buff *skb, const struct nfnl_info *info, 4656 const struct nlattr * const nla[]) 4657 { 4658 struct netlink_ext_ack *extack = info->extack; 4659 u8 genmask = nft_genmask_cur(info->net); 4660 u8 family = info->nfmsg->nfgen_family; 4661 struct nft_table *table = NULL; 4662 struct net *net = info->net; 4663 const struct nft_set *set; 4664 struct sk_buff *skb2; 4665 struct nft_ctx ctx; 4666 int err; 4667 4668 if (nla[NFTA_SET_TABLE]) { 4669 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 4670 genmask, 0); 4671 if (IS_ERR(table)) { 4672 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4673 return PTR_ERR(table); 4674 } 4675 } 4676 4677 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4678 4679 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 4680 struct netlink_dump_control c = { 4681 .start = nf_tables_dump_sets_start, 4682 .dump = nf_tables_dump_sets, 4683 .done = nf_tables_dump_sets_done, 4684 .data = &ctx, 4685 .module = THIS_MODULE, 4686 }; 4687 4688 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4689 } 4690 4691 /* Only accept unspec with dump */ 4692 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 4693 return -EAFNOSUPPORT; 4694 if (!nla[NFTA_SET_TABLE]) 4695 return -EINVAL; 4696 4697 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 4698 if (IS_ERR(set)) 4699 return PTR_ERR(set); 4700 4701 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 4702 if (skb2 == NULL) 4703 return -ENOMEM; 4704 4705 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 4706 if (err < 0) 4707 goto err_fill_set_info; 4708 4709 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 4710 4711 err_fill_set_info: 4712 kfree_skb(skb2); 4713 return err; 4714 } 4715 4716 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = { 4717 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 }, 4718 }; 4719 4720 static int nft_set_desc_concat_parse(const struct nlattr *attr, 4721 struct nft_set_desc *desc) 4722 { 4723 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1]; 4724 u32 len; 4725 int err; 4726 4727 if (desc->field_count >= ARRAY_SIZE(desc->field_len)) 4728 return -E2BIG; 4729 4730 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, 4731 nft_concat_policy, NULL); 4732 if (err < 0) 4733 return err; 4734 4735 if (!tb[NFTA_SET_FIELD_LEN]) 4736 return -EINVAL; 4737 4738 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); 4739 if (!len || len > U8_MAX) 4740 return -EINVAL; 4741 4742 desc->field_len[desc->field_count++] = len; 4743 4744 return 0; 4745 } 4746 4747 static int nft_set_desc_concat(struct nft_set_desc *desc, 4748 const struct nlattr *nla) 4749 { 4750 struct nlattr *attr; 4751 u32 num_regs = 0; 4752 int rem, err, i; 4753 4754 nla_for_each_nested(attr, nla, rem) { 4755 if (nla_type(attr) != NFTA_LIST_ELEM) 4756 return -EINVAL; 4757 4758 err = nft_set_desc_concat_parse(attr, desc); 4759 if (err < 0) 4760 return err; 4761 } 4762 4763 for (i = 0; i < desc->field_count; i++) 4764 num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); 4765 4766 if (num_regs > NFT_REG32_COUNT) 4767 return -E2BIG; 4768 4769 return 0; 4770 } 4771 4772 static int nf_tables_set_desc_parse(struct nft_set_desc *desc, 4773 const struct nlattr *nla) 4774 { 4775 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 4776 int err; 4777 4778 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla, 4779 nft_set_desc_policy, NULL); 4780 if (err < 0) 4781 return err; 4782 4783 if (da[NFTA_SET_DESC_SIZE] != NULL) 4784 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 4785 if (da[NFTA_SET_DESC_CONCAT]) 4786 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]); 4787 4788 return err; 4789 } 4790 4791 static int nft_set_expr_alloc(struct nft_ctx *ctx, struct nft_set *set, 4792 const struct nlattr * const *nla, 4793 struct nft_expr **exprs, int *num_exprs, 4794 u32 flags) 4795 { 4796 struct nft_expr *expr; 4797 int err, i; 4798 4799 if (nla[NFTA_SET_EXPR]) { 4800 expr = nft_set_elem_expr_alloc(ctx, set, nla[NFTA_SET_EXPR]); 4801 if (IS_ERR(expr)) { 4802 err = PTR_ERR(expr); 4803 goto err_set_expr_alloc; 4804 } 4805 exprs[0] = expr; 4806 (*num_exprs)++; 4807 } else if (nla[NFTA_SET_EXPRESSIONS]) { 4808 struct nlattr *tmp; 4809 int left; 4810 4811 if (!(flags & NFT_SET_EXPR)) { 4812 err = -EINVAL; 4813 goto err_set_expr_alloc; 4814 } 4815 i = 0; 4816 nla_for_each_nested(tmp, nla[NFTA_SET_EXPRESSIONS], left) { 4817 if (i == NFT_SET_EXPR_MAX) { 4818 err = -E2BIG; 4819 goto err_set_expr_alloc; 4820 } 4821 if (nla_type(tmp) != NFTA_LIST_ELEM) { 4822 err = -EINVAL; 4823 goto err_set_expr_alloc; 4824 } 4825 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 4826 if (IS_ERR(expr)) { 4827 err = PTR_ERR(expr); 4828 goto err_set_expr_alloc; 4829 } 4830 exprs[i++] = expr; 4831 (*num_exprs)++; 4832 } 4833 } 4834 4835 return 0; 4836 4837 err_set_expr_alloc: 4838 for (i = 0; i < *num_exprs; i++) 4839 nft_expr_destroy(ctx, exprs[i]); 4840 4841 return err; 4842 } 4843 4844 static bool nft_set_is_same(const struct nft_set *set, 4845 const struct nft_set_desc *desc, 4846 struct nft_expr *exprs[], u32 num_exprs, u32 flags) 4847 { 4848 int i; 4849 4850 if (set->ktype != desc->ktype || 4851 set->dtype != desc->dtype || 4852 set->flags != flags || 4853 set->klen != desc->klen || 4854 set->dlen != desc->dlen || 4855 set->field_count != desc->field_count || 4856 set->num_exprs != num_exprs) 4857 return false; 4858 4859 for (i = 0; i < desc->field_count; i++) { 4860 if (set->field_len[i] != desc->field_len[i]) 4861 return false; 4862 } 4863 4864 for (i = 0; i < num_exprs; i++) { 4865 if (set->exprs[i]->ops != exprs[i]->ops) 4866 return false; 4867 } 4868 4869 return true; 4870 } 4871 4872 static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 4873 const struct nlattr * const nla[]) 4874 { 4875 struct netlink_ext_ack *extack = info->extack; 4876 u8 genmask = nft_genmask_next(info->net); 4877 u8 family = info->nfmsg->nfgen_family; 4878 const struct nft_set_ops *ops; 4879 struct net *net = info->net; 4880 struct nft_set_desc desc; 4881 struct nft_table *table; 4882 unsigned char *udata; 4883 struct nft_set *set; 4884 struct nft_ctx ctx; 4885 size_t alloc_size; 4886 int num_exprs = 0; 4887 char *name; 4888 int err, i; 4889 u16 udlen; 4890 u32 flags; 4891 u64 size; 4892 4893 if (nla[NFTA_SET_TABLE] == NULL || 4894 nla[NFTA_SET_NAME] == NULL || 4895 nla[NFTA_SET_KEY_LEN] == NULL || 4896 nla[NFTA_SET_ID] == NULL) 4897 return -EINVAL; 4898 4899 memset(&desc, 0, sizeof(desc)); 4900 4901 desc.ktype = NFT_DATA_VALUE; 4902 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 4903 desc.ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 4904 if ((desc.ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 4905 return -EINVAL; 4906 } 4907 4908 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 4909 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 4910 return -EINVAL; 4911 4912 flags = 0; 4913 if (nla[NFTA_SET_FLAGS] != NULL) { 4914 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 4915 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 4916 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 4917 NFT_SET_MAP | NFT_SET_EVAL | 4918 NFT_SET_OBJECT | NFT_SET_CONCAT | NFT_SET_EXPR)) 4919 return -EOPNOTSUPP; 4920 /* Only one of these operations is supported */ 4921 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) == 4922 (NFT_SET_MAP | NFT_SET_OBJECT)) 4923 return -EOPNOTSUPP; 4924 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == 4925 (NFT_SET_EVAL | NFT_SET_OBJECT)) 4926 return -EOPNOTSUPP; 4927 } 4928 4929 desc.dtype = 0; 4930 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 4931 if (!(flags & NFT_SET_MAP)) 4932 return -EINVAL; 4933 4934 desc.dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 4935 if ((desc.dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 4936 desc.dtype != NFT_DATA_VERDICT) 4937 return -EINVAL; 4938 4939 if (desc.dtype != NFT_DATA_VERDICT) { 4940 if (nla[NFTA_SET_DATA_LEN] == NULL) 4941 return -EINVAL; 4942 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 4943 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 4944 return -EINVAL; 4945 } else 4946 desc.dlen = sizeof(struct nft_verdict); 4947 } else if (flags & NFT_SET_MAP) 4948 return -EINVAL; 4949 4950 if (nla[NFTA_SET_OBJ_TYPE] != NULL) { 4951 if (!(flags & NFT_SET_OBJECT)) 4952 return -EINVAL; 4953 4954 desc.objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE])); 4955 if (desc.objtype == NFT_OBJECT_UNSPEC || 4956 desc.objtype > NFT_OBJECT_MAX) 4957 return -EOPNOTSUPP; 4958 } else if (flags & NFT_SET_OBJECT) 4959 return -EINVAL; 4960 else 4961 desc.objtype = NFT_OBJECT_UNSPEC; 4962 4963 desc.timeout = 0; 4964 if (nla[NFTA_SET_TIMEOUT] != NULL) { 4965 if (!(flags & NFT_SET_TIMEOUT)) 4966 return -EINVAL; 4967 4968 if (flags & NFT_SET_ANONYMOUS) 4969 return -EOPNOTSUPP; 4970 4971 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &desc.timeout); 4972 if (err) 4973 return err; 4974 } 4975 desc.gc_int = 0; 4976 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 4977 if (!(flags & NFT_SET_TIMEOUT)) 4978 return -EINVAL; 4979 4980 if (flags & NFT_SET_ANONYMOUS) 4981 return -EOPNOTSUPP; 4982 4983 desc.gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 4984 } 4985 4986 desc.policy = NFT_SET_POL_PERFORMANCE; 4987 if (nla[NFTA_SET_POLICY] != NULL) 4988 desc.policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 4989 4990 if (nla[NFTA_SET_DESC] != NULL) { 4991 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); 4992 if (err < 0) 4993 return err; 4994 4995 if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT)) 4996 return -EINVAL; 4997 } else if (flags & NFT_SET_CONCAT) { 4998 return -EINVAL; 4999 } 5000 5001 if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS]) 5002 desc.expr = true; 5003 5004 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask, 5005 NETLINK_CB(skb).portid); 5006 if (IS_ERR(table)) { 5007 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5008 return PTR_ERR(table); 5009 } 5010 5011 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5012 5013 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 5014 if (IS_ERR(set)) { 5015 if (PTR_ERR(set) != -ENOENT) { 5016 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5017 return PTR_ERR(set); 5018 } 5019 } else { 5020 struct nft_expr *exprs[NFT_SET_EXPR_MAX] = {}; 5021 5022 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 5023 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5024 return -EEXIST; 5025 } 5026 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 5027 return -EOPNOTSUPP; 5028 5029 if (nft_set_is_anonymous(set)) 5030 return -EOPNOTSUPP; 5031 5032 err = nft_set_expr_alloc(&ctx, set, nla, exprs, &num_exprs, flags); 5033 if (err < 0) 5034 return err; 5035 5036 err = 0; 5037 if (!nft_set_is_same(set, &desc, exprs, num_exprs, flags)) { 5038 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5039 err = -EEXIST; 5040 } 5041 5042 for (i = 0; i < num_exprs; i++) 5043 nft_expr_destroy(&ctx, exprs[i]); 5044 5045 if (err < 0) 5046 return err; 5047 5048 return __nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set, &desc); 5049 } 5050 5051 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE)) 5052 return -ENOENT; 5053 5054 ops = nft_select_set_ops(&ctx, nla, &desc); 5055 if (IS_ERR(ops)) 5056 return PTR_ERR(ops); 5057 5058 udlen = 0; 5059 if (nla[NFTA_SET_USERDATA]) 5060 udlen = nla_len(nla[NFTA_SET_USERDATA]); 5061 5062 size = 0; 5063 if (ops->privsize != NULL) 5064 size = ops->privsize(nla, &desc); 5065 alloc_size = sizeof(*set) + size + udlen; 5066 if (alloc_size < size || alloc_size > INT_MAX) 5067 return -ENOMEM; 5068 5069 if (!nft_use_inc(&table->use)) 5070 return -EMFILE; 5071 5072 set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT); 5073 if (!set) { 5074 err = -ENOMEM; 5075 goto err_alloc; 5076 } 5077 5078 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT); 5079 if (!name) { 5080 err = -ENOMEM; 5081 goto err_set_name; 5082 } 5083 5084 err = nf_tables_set_alloc_name(&ctx, set, name); 5085 kfree(name); 5086 if (err < 0) 5087 goto err_set_name; 5088 5089 udata = NULL; 5090 if (udlen) { 5091 udata = set->data + size; 5092 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen); 5093 } 5094 5095 INIT_LIST_HEAD(&set->bindings); 5096 INIT_LIST_HEAD(&set->catchall_list); 5097 refcount_set(&set->refs, 1); 5098 set->table = table; 5099 write_pnet(&set->net, net); 5100 set->ops = ops; 5101 set->ktype = desc.ktype; 5102 set->klen = desc.klen; 5103 set->dtype = desc.dtype; 5104 set->objtype = desc.objtype; 5105 set->dlen = desc.dlen; 5106 set->flags = flags; 5107 set->size = desc.size; 5108 set->policy = desc.policy; 5109 set->udlen = udlen; 5110 set->udata = udata; 5111 set->timeout = desc.timeout; 5112 set->gc_int = desc.gc_int; 5113 5114 set->field_count = desc.field_count; 5115 for (i = 0; i < desc.field_count; i++) 5116 set->field_len[i] = desc.field_len[i]; 5117 5118 err = ops->init(set, &desc, nla); 5119 if (err < 0) 5120 goto err_set_init; 5121 5122 err = nft_set_expr_alloc(&ctx, set, nla, set->exprs, &num_exprs, flags); 5123 if (err < 0) 5124 goto err_set_destroy; 5125 5126 set->num_exprs = num_exprs; 5127 set->handle = nf_tables_alloc_handle(table); 5128 INIT_LIST_HEAD(&set->pending_update); 5129 5130 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 5131 if (err < 0) 5132 goto err_set_expr_alloc; 5133 5134 list_add_tail_rcu(&set->list, &table->sets); 5135 5136 return 0; 5137 5138 err_set_expr_alloc: 5139 for (i = 0; i < set->num_exprs; i++) 5140 nft_expr_destroy(&ctx, set->exprs[i]); 5141 err_set_destroy: 5142 ops->destroy(&ctx, set); 5143 err_set_init: 5144 kfree(set->name); 5145 err_set_name: 5146 kvfree(set); 5147 err_alloc: 5148 nft_use_dec_restore(&table->use); 5149 5150 return err; 5151 } 5152 5153 static void nft_set_catchall_destroy(const struct nft_ctx *ctx, 5154 struct nft_set *set) 5155 { 5156 struct nft_set_elem_catchall *next, *catchall; 5157 5158 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 5159 list_del_rcu(&catchall->list); 5160 nf_tables_set_elem_destroy(ctx, set, catchall->elem); 5161 kfree_rcu(catchall, rcu); 5162 } 5163 } 5164 5165 static void nft_set_put(struct nft_set *set) 5166 { 5167 if (refcount_dec_and_test(&set->refs)) { 5168 kfree(set->name); 5169 kvfree(set); 5170 } 5171 } 5172 5173 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 5174 { 5175 int i; 5176 5177 if (WARN_ON(set->use > 0)) 5178 return; 5179 5180 for (i = 0; i < set->num_exprs; i++) 5181 nft_expr_destroy(ctx, set->exprs[i]); 5182 5183 set->ops->destroy(ctx, set); 5184 nft_set_catchall_destroy(ctx, set); 5185 nft_set_put(set); 5186 } 5187 5188 static int nf_tables_delset(struct sk_buff *skb, const struct nfnl_info *info, 5189 const struct nlattr * const nla[]) 5190 { 5191 struct netlink_ext_ack *extack = info->extack; 5192 u8 genmask = nft_genmask_next(info->net); 5193 u8 family = info->nfmsg->nfgen_family; 5194 struct net *net = info->net; 5195 const struct nlattr *attr; 5196 struct nft_table *table; 5197 struct nft_set *set; 5198 struct nft_ctx ctx; 5199 5200 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 5201 return -EAFNOSUPPORT; 5202 5203 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 5204 genmask, NETLINK_CB(skb).portid); 5205 if (IS_ERR(table)) { 5206 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5207 return PTR_ERR(table); 5208 } 5209 5210 if (nla[NFTA_SET_HANDLE]) { 5211 attr = nla[NFTA_SET_HANDLE]; 5212 set = nft_set_lookup_byhandle(table, attr, genmask); 5213 } else { 5214 attr = nla[NFTA_SET_NAME]; 5215 set = nft_set_lookup(table, attr, genmask); 5216 } 5217 5218 if (IS_ERR(set)) { 5219 if (PTR_ERR(set) == -ENOENT && 5220 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSET) 5221 return 0; 5222 5223 NL_SET_BAD_ATTR(extack, attr); 5224 return PTR_ERR(set); 5225 } 5226 if (set->use || 5227 (info->nlh->nlmsg_flags & NLM_F_NONREC && 5228 atomic_read(&set->nelems) > 0)) { 5229 NL_SET_BAD_ATTR(extack, attr); 5230 return -EBUSY; 5231 } 5232 5233 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5234 5235 return nft_delset(&ctx, set); 5236 } 5237 5238 static int nft_validate_register_store(const struct nft_ctx *ctx, 5239 enum nft_registers reg, 5240 const struct nft_data *data, 5241 enum nft_data_types type, 5242 unsigned int len); 5243 5244 static int nft_setelem_data_validate(const struct nft_ctx *ctx, 5245 struct nft_set *set, 5246 struct nft_set_elem *elem) 5247 { 5248 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5249 enum nft_registers dreg; 5250 5251 dreg = nft_type_to_reg(set->dtype); 5252 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 5253 set->dtype == NFT_DATA_VERDICT ? 5254 NFT_DATA_VERDICT : NFT_DATA_VALUE, 5255 set->dlen); 5256 } 5257 5258 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 5259 struct nft_set *set, 5260 const struct nft_set_iter *iter, 5261 struct nft_set_elem *elem) 5262 { 5263 return nft_setelem_data_validate(ctx, set, elem); 5264 } 5265 5266 static int nft_set_catchall_bind_check(const struct nft_ctx *ctx, 5267 struct nft_set *set) 5268 { 5269 u8 genmask = nft_genmask_next(ctx->net); 5270 struct nft_set_elem_catchall *catchall; 5271 struct nft_set_elem elem; 5272 struct nft_set_ext *ext; 5273 int ret = 0; 5274 5275 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5276 ext = nft_set_elem_ext(set, catchall->elem); 5277 if (!nft_set_elem_active(ext, genmask)) 5278 continue; 5279 5280 elem.priv = catchall->elem; 5281 ret = nft_setelem_data_validate(ctx, set, &elem); 5282 if (ret < 0) 5283 break; 5284 } 5285 5286 return ret; 5287 } 5288 5289 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 5290 struct nft_set_binding *binding) 5291 { 5292 struct nft_set_binding *i; 5293 struct nft_set_iter iter; 5294 5295 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5296 return -EBUSY; 5297 5298 if (binding->flags & NFT_SET_MAP) { 5299 /* If the set is already bound to the same chain all 5300 * jumps are already validated for that chain. 5301 */ 5302 list_for_each_entry(i, &set->bindings, list) { 5303 if (i->flags & NFT_SET_MAP && 5304 i->chain == binding->chain) 5305 goto bind; 5306 } 5307 5308 iter.genmask = nft_genmask_next(ctx->net); 5309 iter.skip = 0; 5310 iter.count = 0; 5311 iter.err = 0; 5312 iter.fn = nf_tables_bind_check_setelem; 5313 5314 set->ops->walk(ctx, set, &iter); 5315 if (!iter.err) 5316 iter.err = nft_set_catchall_bind_check(ctx, set); 5317 5318 if (iter.err < 0) 5319 return iter.err; 5320 } 5321 bind: 5322 if (!nft_use_inc(&set->use)) 5323 return -EMFILE; 5324 5325 binding->chain = ctx->chain; 5326 list_add_tail_rcu(&binding->list, &set->bindings); 5327 nft_set_trans_bind(ctx, set); 5328 5329 return 0; 5330 } 5331 EXPORT_SYMBOL_GPL(nf_tables_bind_set); 5332 5333 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 5334 struct nft_set_binding *binding, bool event) 5335 { 5336 list_del_rcu(&binding->list); 5337 5338 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { 5339 list_del_rcu(&set->list); 5340 if (event) 5341 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, 5342 GFP_KERNEL); 5343 } 5344 } 5345 5346 static void nft_setelem_data_activate(const struct net *net, 5347 const struct nft_set *set, 5348 struct nft_set_elem *elem); 5349 5350 static int nft_mapelem_activate(const struct nft_ctx *ctx, 5351 struct nft_set *set, 5352 const struct nft_set_iter *iter, 5353 struct nft_set_elem *elem) 5354 { 5355 nft_setelem_data_activate(ctx->net, set, elem); 5356 5357 return 0; 5358 } 5359 5360 static void nft_map_catchall_activate(const struct nft_ctx *ctx, 5361 struct nft_set *set) 5362 { 5363 u8 genmask = nft_genmask_next(ctx->net); 5364 struct nft_set_elem_catchall *catchall; 5365 struct nft_set_elem elem; 5366 struct nft_set_ext *ext; 5367 5368 list_for_each_entry(catchall, &set->catchall_list, list) { 5369 ext = nft_set_elem_ext(set, catchall->elem); 5370 if (!nft_set_elem_active(ext, genmask)) 5371 continue; 5372 5373 elem.priv = catchall->elem; 5374 nft_setelem_data_activate(ctx->net, set, &elem); 5375 break; 5376 } 5377 } 5378 5379 static void nft_map_activate(const struct nft_ctx *ctx, struct nft_set *set) 5380 { 5381 struct nft_set_iter iter = { 5382 .genmask = nft_genmask_next(ctx->net), 5383 .fn = nft_mapelem_activate, 5384 }; 5385 5386 set->ops->walk(ctx, set, &iter); 5387 WARN_ON_ONCE(iter.err); 5388 5389 nft_map_catchall_activate(ctx, set); 5390 } 5391 5392 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) 5393 { 5394 if (nft_set_is_anonymous(set)) { 5395 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5396 nft_map_activate(ctx, set); 5397 5398 nft_clear(ctx->net, set); 5399 } 5400 5401 nft_use_inc_restore(&set->use); 5402 } 5403 EXPORT_SYMBOL_GPL(nf_tables_activate_set); 5404 5405 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, 5406 struct nft_set_binding *binding, 5407 enum nft_trans_phase phase) 5408 { 5409 switch (phase) { 5410 case NFT_TRANS_PREPARE_ERROR: 5411 nft_set_trans_unbind(ctx, set); 5412 if (nft_set_is_anonymous(set)) 5413 nft_deactivate_next(ctx->net, set); 5414 else 5415 list_del_rcu(&binding->list); 5416 5417 nft_use_dec(&set->use); 5418 break; 5419 case NFT_TRANS_PREPARE: 5420 if (nft_set_is_anonymous(set)) { 5421 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5422 nft_map_deactivate(ctx, set); 5423 5424 nft_deactivate_next(ctx->net, set); 5425 } 5426 nft_use_dec(&set->use); 5427 return; 5428 case NFT_TRANS_ABORT: 5429 case NFT_TRANS_RELEASE: 5430 if (nft_set_is_anonymous(set) && 5431 set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5432 nft_map_deactivate(ctx, set); 5433 5434 nft_use_dec(&set->use); 5435 fallthrough; 5436 default: 5437 nf_tables_unbind_set(ctx, set, binding, 5438 phase == NFT_TRANS_COMMIT); 5439 } 5440 } 5441 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set); 5442 5443 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set) 5444 { 5445 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5446 nft_set_destroy(ctx, set); 5447 } 5448 EXPORT_SYMBOL_GPL(nf_tables_destroy_set); 5449 5450 const struct nft_set_ext_type nft_set_ext_types[] = { 5451 [NFT_SET_EXT_KEY] = { 5452 .align = __alignof__(u32), 5453 }, 5454 [NFT_SET_EXT_DATA] = { 5455 .align = __alignof__(u32), 5456 }, 5457 [NFT_SET_EXT_EXPRESSIONS] = { 5458 .align = __alignof__(struct nft_set_elem_expr), 5459 }, 5460 [NFT_SET_EXT_OBJREF] = { 5461 .len = sizeof(struct nft_object *), 5462 .align = __alignof__(struct nft_object *), 5463 }, 5464 [NFT_SET_EXT_FLAGS] = { 5465 .len = sizeof(u8), 5466 .align = __alignof__(u8), 5467 }, 5468 [NFT_SET_EXT_TIMEOUT] = { 5469 .len = sizeof(u64), 5470 .align = __alignof__(u64), 5471 }, 5472 [NFT_SET_EXT_EXPIRATION] = { 5473 .len = sizeof(u64), 5474 .align = __alignof__(u64), 5475 }, 5476 [NFT_SET_EXT_USERDATA] = { 5477 .len = sizeof(struct nft_userdata), 5478 .align = __alignof__(struct nft_userdata), 5479 }, 5480 [NFT_SET_EXT_KEY_END] = { 5481 .align = __alignof__(u32), 5482 }, 5483 }; 5484 5485 /* 5486 * Set elements 5487 */ 5488 5489 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 5490 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 5491 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 5492 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 5493 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 5494 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 }, 5495 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 5496 .len = NFT_USERDATA_MAXLEN }, 5497 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, 5498 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING, 5499 .len = NFT_OBJ_MAXNAMELEN - 1 }, 5500 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED }, 5501 [NFTA_SET_ELEM_EXPRESSIONS] = { .type = NLA_NESTED }, 5502 }; 5503 5504 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 5505 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING, 5506 .len = NFT_TABLE_MAXNAMELEN - 1 }, 5507 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING, 5508 .len = NFT_SET_MAXNAMELEN - 1 }, 5509 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED }, 5510 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 5511 }; 5512 5513 static int nft_set_elem_expr_dump(struct sk_buff *skb, 5514 const struct nft_set *set, 5515 const struct nft_set_ext *ext, 5516 bool reset) 5517 { 5518 struct nft_set_elem_expr *elem_expr; 5519 u32 size, num_exprs = 0; 5520 struct nft_expr *expr; 5521 struct nlattr *nest; 5522 5523 elem_expr = nft_set_ext_expr(ext); 5524 nft_setelem_expr_foreach(expr, elem_expr, size) 5525 num_exprs++; 5526 5527 if (num_exprs == 1) { 5528 expr = nft_setelem_expr_at(elem_expr, 0); 5529 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, reset) < 0) 5530 return -1; 5531 5532 return 0; 5533 } else if (num_exprs > 1) { 5534 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_EXPRESSIONS); 5535 if (nest == NULL) 5536 goto nla_put_failure; 5537 5538 nft_setelem_expr_foreach(expr, elem_expr, size) { 5539 expr = nft_setelem_expr_at(elem_expr, size); 5540 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 5541 goto nla_put_failure; 5542 } 5543 nla_nest_end(skb, nest); 5544 } 5545 return 0; 5546 5547 nla_put_failure: 5548 return -1; 5549 } 5550 5551 static int nf_tables_fill_setelem(struct sk_buff *skb, 5552 const struct nft_set *set, 5553 const struct nft_set_elem *elem, 5554 bool reset) 5555 { 5556 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5557 unsigned char *b = skb_tail_pointer(skb); 5558 struct nlattr *nest; 5559 u64 timeout = 0; 5560 5561 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 5562 if (nest == NULL) 5563 goto nla_put_failure; 5564 5565 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 5566 nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 5567 NFT_DATA_VALUE, set->klen) < 0) 5568 goto nla_put_failure; 5569 5570 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 5571 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext), 5572 NFT_DATA_VALUE, set->klen) < 0) 5573 goto nla_put_failure; 5574 5575 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 5576 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 5577 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, 5578 set->dlen) < 0) 5579 goto nla_put_failure; 5580 5581 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && 5582 nft_set_elem_expr_dump(skb, set, ext, reset)) 5583 goto nla_put_failure; 5584 5585 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 5586 nla_put_string(skb, NFTA_SET_ELEM_OBJREF, 5587 (*nft_set_ext_obj(ext))->key.name) < 0) 5588 goto nla_put_failure; 5589 5590 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 5591 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 5592 htonl(*nft_set_ext_flags(ext)))) 5593 goto nla_put_failure; 5594 5595 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) { 5596 timeout = *nft_set_ext_timeout(ext); 5597 if (nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, 5598 nf_jiffies64_to_msecs(timeout), 5599 NFTA_SET_ELEM_PAD)) 5600 goto nla_put_failure; 5601 } else if (set->flags & NFT_SET_TIMEOUT) { 5602 timeout = READ_ONCE(set->timeout); 5603 } 5604 5605 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 5606 u64 expires, now = get_jiffies_64(); 5607 5608 expires = *nft_set_ext_expiration(ext); 5609 if (time_before64(now, expires)) 5610 expires -= now; 5611 else 5612 expires = 0; 5613 5614 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 5615 nf_jiffies64_to_msecs(expires), 5616 NFTA_SET_ELEM_PAD)) 5617 goto nla_put_failure; 5618 5619 if (reset) 5620 *nft_set_ext_expiration(ext) = now + timeout; 5621 } 5622 5623 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 5624 struct nft_userdata *udata; 5625 5626 udata = nft_set_ext_userdata(ext); 5627 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 5628 udata->len + 1, udata->data)) 5629 goto nla_put_failure; 5630 } 5631 5632 nla_nest_end(skb, nest); 5633 return 0; 5634 5635 nla_put_failure: 5636 nlmsg_trim(skb, b); 5637 return -EMSGSIZE; 5638 } 5639 5640 struct nft_set_dump_args { 5641 const struct netlink_callback *cb; 5642 struct nft_set_iter iter; 5643 struct sk_buff *skb; 5644 bool reset; 5645 }; 5646 5647 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 5648 struct nft_set *set, 5649 const struct nft_set_iter *iter, 5650 struct nft_set_elem *elem) 5651 { 5652 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5653 struct nft_set_dump_args *args; 5654 5655 if (nft_set_elem_expired(ext)) 5656 return 0; 5657 5658 args = container_of(iter, struct nft_set_dump_args, iter); 5659 return nf_tables_fill_setelem(args->skb, set, elem, args->reset); 5660 } 5661 5662 static void audit_log_nft_set_reset(const struct nft_table *table, 5663 unsigned int base_seq, 5664 unsigned int nentries) 5665 { 5666 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq); 5667 5668 audit_log_nfcfg(buf, table->family, nentries, 5669 AUDIT_NFT_OP_SETELEM_RESET, GFP_ATOMIC); 5670 kfree(buf); 5671 } 5672 5673 struct nft_set_dump_ctx { 5674 const struct nft_set *set; 5675 struct nft_ctx ctx; 5676 }; 5677 5678 static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb, 5679 const struct nft_set *set, bool reset, 5680 unsigned int base_seq) 5681 { 5682 struct nft_set_elem_catchall *catchall; 5683 u8 genmask = nft_genmask_cur(net); 5684 struct nft_set_elem elem; 5685 struct nft_set_ext *ext; 5686 int ret = 0; 5687 5688 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5689 ext = nft_set_elem_ext(set, catchall->elem); 5690 if (!nft_set_elem_active(ext, genmask) || 5691 nft_set_elem_expired(ext)) 5692 continue; 5693 5694 elem.priv = catchall->elem; 5695 ret = nf_tables_fill_setelem(skb, set, &elem, reset); 5696 if (reset && !ret) 5697 audit_log_nft_set_reset(set->table, base_seq, 1); 5698 break; 5699 } 5700 5701 return ret; 5702 } 5703 5704 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 5705 { 5706 struct nft_set_dump_ctx *dump_ctx = cb->data; 5707 struct net *net = sock_net(skb->sk); 5708 struct nftables_pernet *nft_net; 5709 struct nft_table *table; 5710 struct nft_set *set; 5711 struct nft_set_dump_args args; 5712 bool set_found = false; 5713 struct nlmsghdr *nlh; 5714 struct nlattr *nest; 5715 bool reset = false; 5716 u32 portid, seq; 5717 int event; 5718 5719 rcu_read_lock(); 5720 nft_net = nft_pernet(net); 5721 cb->seq = READ_ONCE(nft_net->base_seq); 5722 5723 list_for_each_entry_rcu(table, &nft_net->tables, list) { 5724 if (dump_ctx->ctx.family != NFPROTO_UNSPEC && 5725 dump_ctx->ctx.family != table->family) 5726 continue; 5727 5728 if (table != dump_ctx->ctx.table) 5729 continue; 5730 5731 list_for_each_entry_rcu(set, &table->sets, list) { 5732 if (set == dump_ctx->set) { 5733 set_found = true; 5734 break; 5735 } 5736 } 5737 break; 5738 } 5739 5740 if (!set_found) { 5741 rcu_read_unlock(); 5742 return -ENOENT; 5743 } 5744 5745 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM); 5746 portid = NETLINK_CB(cb->skb).portid; 5747 seq = cb->nlh->nlmsg_seq; 5748 5749 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, 5750 table->family, NFNETLINK_V0, nft_base_seq(net)); 5751 if (!nlh) 5752 goto nla_put_failure; 5753 5754 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) 5755 goto nla_put_failure; 5756 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 5757 goto nla_put_failure; 5758 5759 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5760 if (nest == NULL) 5761 goto nla_put_failure; 5762 5763 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETSETELEM_RESET) 5764 reset = true; 5765 5766 args.cb = cb; 5767 args.skb = skb; 5768 args.reset = reset; 5769 args.iter.genmask = nft_genmask_cur(net); 5770 args.iter.skip = cb->args[0]; 5771 args.iter.count = 0; 5772 args.iter.err = 0; 5773 args.iter.fn = nf_tables_dump_setelem; 5774 set->ops->walk(&dump_ctx->ctx, set, &args.iter); 5775 5776 if (!args.iter.err && args.iter.count == cb->args[0]) 5777 args.iter.err = nft_set_catchall_dump(net, skb, set, 5778 reset, cb->seq); 5779 nla_nest_end(skb, nest); 5780 nlmsg_end(skb, nlh); 5781 5782 if (reset && args.iter.count > args.iter.skip) 5783 audit_log_nft_set_reset(table, cb->seq, 5784 args.iter.count - args.iter.skip); 5785 5786 rcu_read_unlock(); 5787 5788 if (args.iter.err && args.iter.err != -EMSGSIZE) 5789 return args.iter.err; 5790 if (args.iter.count == cb->args[0]) 5791 return 0; 5792 5793 cb->args[0] = args.iter.count; 5794 return skb->len; 5795 5796 nla_put_failure: 5797 rcu_read_unlock(); 5798 return -ENOSPC; 5799 } 5800 5801 static int nf_tables_dump_set_start(struct netlink_callback *cb) 5802 { 5803 struct nft_set_dump_ctx *dump_ctx = cb->data; 5804 5805 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC); 5806 5807 return cb->data ? 0 : -ENOMEM; 5808 } 5809 5810 static int nf_tables_dump_set_done(struct netlink_callback *cb) 5811 { 5812 kfree(cb->data); 5813 return 0; 5814 } 5815 5816 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 5817 const struct nft_ctx *ctx, u32 seq, 5818 u32 portid, int event, u16 flags, 5819 const struct nft_set *set, 5820 const struct nft_set_elem *elem, 5821 bool reset) 5822 { 5823 struct nlmsghdr *nlh; 5824 struct nlattr *nest; 5825 int err; 5826 5827 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 5828 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 5829 NFNETLINK_V0, nft_base_seq(ctx->net)); 5830 if (!nlh) 5831 goto nla_put_failure; 5832 5833 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 5834 goto nla_put_failure; 5835 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 5836 goto nla_put_failure; 5837 5838 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5839 if (nest == NULL) 5840 goto nla_put_failure; 5841 5842 err = nf_tables_fill_setelem(skb, set, elem, reset); 5843 if (err < 0) 5844 goto nla_put_failure; 5845 5846 nla_nest_end(skb, nest); 5847 5848 nlmsg_end(skb, nlh); 5849 return 0; 5850 5851 nla_put_failure: 5852 nlmsg_trim(skb, nlh); 5853 return -1; 5854 } 5855 5856 static int nft_setelem_parse_flags(const struct nft_set *set, 5857 const struct nlattr *attr, u32 *flags) 5858 { 5859 if (attr == NULL) 5860 return 0; 5861 5862 *flags = ntohl(nla_get_be32(attr)); 5863 if (*flags & ~(NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5864 return -EOPNOTSUPP; 5865 if (!(set->flags & NFT_SET_INTERVAL) && 5866 *flags & NFT_SET_ELEM_INTERVAL_END) 5867 return -EINVAL; 5868 if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == 5869 (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5870 return -EINVAL; 5871 5872 return 0; 5873 } 5874 5875 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set, 5876 struct nft_data *key, struct nlattr *attr) 5877 { 5878 struct nft_data_desc desc = { 5879 .type = NFT_DATA_VALUE, 5880 .size = NFT_DATA_VALUE_MAXLEN, 5881 .len = set->klen, 5882 }; 5883 5884 return nft_data_init(ctx, key, &desc, attr); 5885 } 5886 5887 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, 5888 struct nft_data_desc *desc, 5889 struct nft_data *data, 5890 struct nlattr *attr) 5891 { 5892 u32 dtype; 5893 5894 if (set->dtype == NFT_DATA_VERDICT) 5895 dtype = NFT_DATA_VERDICT; 5896 else 5897 dtype = NFT_DATA_VALUE; 5898 5899 desc->type = dtype; 5900 desc->size = NFT_DATA_VALUE_MAXLEN; 5901 desc->len = set->dlen; 5902 desc->flags = NFT_DATA_DESC_SETELEM; 5903 5904 return nft_data_init(ctx, data, desc, attr); 5905 } 5906 5907 static void *nft_setelem_catchall_get(const struct net *net, 5908 const struct nft_set *set) 5909 { 5910 struct nft_set_elem_catchall *catchall; 5911 u8 genmask = nft_genmask_cur(net); 5912 struct nft_set_ext *ext; 5913 void *priv = NULL; 5914 5915 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5916 ext = nft_set_elem_ext(set, catchall->elem); 5917 if (!nft_set_elem_active(ext, genmask) || 5918 nft_set_elem_expired(ext)) 5919 continue; 5920 5921 priv = catchall->elem; 5922 break; 5923 } 5924 5925 return priv; 5926 } 5927 5928 static int nft_setelem_get(struct nft_ctx *ctx, struct nft_set *set, 5929 struct nft_set_elem *elem, u32 flags) 5930 { 5931 void *priv; 5932 5933 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 5934 priv = set->ops->get(ctx->net, set, elem, flags); 5935 if (IS_ERR(priv)) 5936 return PTR_ERR(priv); 5937 } else { 5938 priv = nft_setelem_catchall_get(ctx->net, set); 5939 if (!priv) 5940 return -ENOENT; 5941 } 5942 elem->priv = priv; 5943 5944 return 0; 5945 } 5946 5947 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, 5948 const struct nlattr *attr, bool reset) 5949 { 5950 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 5951 struct nft_set_elem elem; 5952 struct sk_buff *skb; 5953 uint32_t flags = 0; 5954 int err; 5955 5956 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 5957 nft_set_elem_policy, NULL); 5958 if (err < 0) 5959 return err; 5960 5961 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 5962 if (err < 0) 5963 return err; 5964 5965 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 5966 return -EINVAL; 5967 5968 if (nla[NFTA_SET_ELEM_KEY]) { 5969 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 5970 nla[NFTA_SET_ELEM_KEY]); 5971 if (err < 0) 5972 return err; 5973 } 5974 5975 if (nla[NFTA_SET_ELEM_KEY_END]) { 5976 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 5977 nla[NFTA_SET_ELEM_KEY_END]); 5978 if (err < 0) 5979 return err; 5980 } 5981 5982 err = nft_setelem_get(ctx, set, &elem, flags); 5983 if (err < 0) 5984 return err; 5985 5986 err = -ENOMEM; 5987 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 5988 if (skb == NULL) 5989 return err; 5990 5991 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, 5992 NFT_MSG_NEWSETELEM, 0, set, &elem, 5993 reset); 5994 if (err < 0) 5995 goto err_fill_setelem; 5996 5997 return nfnetlink_unicast(skb, ctx->net, ctx->portid); 5998 5999 err_fill_setelem: 6000 kfree_skb(skb); 6001 return err; 6002 } 6003 6004 /* called with rcu_read_lock held */ 6005 static int nf_tables_getsetelem(struct sk_buff *skb, 6006 const struct nfnl_info *info, 6007 const struct nlattr * const nla[]) 6008 { 6009 struct netlink_ext_ack *extack = info->extack; 6010 u8 genmask = nft_genmask_cur(info->net); 6011 u8 family = info->nfmsg->nfgen_family; 6012 int rem, err = 0, nelems = 0; 6013 struct net *net = info->net; 6014 struct nft_table *table; 6015 struct nft_set *set; 6016 struct nlattr *attr; 6017 struct nft_ctx ctx; 6018 bool reset = false; 6019 6020 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6021 genmask, 0); 6022 if (IS_ERR(table)) { 6023 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6024 return PTR_ERR(table); 6025 } 6026 6027 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 6028 if (IS_ERR(set)) 6029 return PTR_ERR(set); 6030 6031 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6032 6033 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 6034 struct netlink_dump_control c = { 6035 .start = nf_tables_dump_set_start, 6036 .dump = nf_tables_dump_set, 6037 .done = nf_tables_dump_set_done, 6038 .module = THIS_MODULE, 6039 }; 6040 struct nft_set_dump_ctx dump_ctx = { 6041 .set = set, 6042 .ctx = ctx, 6043 }; 6044 6045 c.data = &dump_ctx; 6046 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 6047 } 6048 6049 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6050 return -EINVAL; 6051 6052 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETSETELEM_RESET) 6053 reset = true; 6054 6055 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6056 err = nft_get_set_elem(&ctx, set, attr, reset); 6057 if (err < 0) { 6058 NL_SET_BAD_ATTR(extack, attr); 6059 break; 6060 } 6061 nelems++; 6062 } 6063 6064 if (reset) 6065 audit_log_nft_set_reset(table, nft_pernet(net)->base_seq, 6066 nelems); 6067 6068 return err; 6069 } 6070 6071 static void nf_tables_setelem_notify(const struct nft_ctx *ctx, 6072 const struct nft_set *set, 6073 const struct nft_set_elem *elem, 6074 int event) 6075 { 6076 struct nftables_pernet *nft_net; 6077 struct net *net = ctx->net; 6078 u32 portid = ctx->portid; 6079 struct sk_buff *skb; 6080 u16 flags = 0; 6081 int err; 6082 6083 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 6084 return; 6085 6086 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 6087 if (skb == NULL) 6088 goto err; 6089 6090 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 6091 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 6092 6093 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 6094 set, elem, false); 6095 if (err < 0) { 6096 kfree_skb(skb); 6097 goto err; 6098 } 6099 6100 nft_net = nft_pernet(net); 6101 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 6102 return; 6103 err: 6104 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 6105 } 6106 6107 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx, 6108 int msg_type, 6109 struct nft_set *set) 6110 { 6111 struct nft_trans *trans; 6112 6113 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem)); 6114 if (trans == NULL) 6115 return NULL; 6116 6117 nft_trans_elem_set(trans) = set; 6118 return trans; 6119 } 6120 6121 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, 6122 const struct nft_set *set, 6123 const struct nlattr *attr) 6124 { 6125 struct nft_expr *expr; 6126 int err; 6127 6128 expr = nft_expr_init(ctx, attr); 6129 if (IS_ERR(expr)) 6130 return expr; 6131 6132 err = -EOPNOTSUPP; 6133 if (expr->ops->type->flags & NFT_EXPR_GC) { 6134 if (set->flags & NFT_SET_TIMEOUT) 6135 goto err_set_elem_expr; 6136 if (!set->ops->gc_init) 6137 goto err_set_elem_expr; 6138 set->ops->gc_init(set); 6139 } 6140 6141 return expr; 6142 6143 err_set_elem_expr: 6144 nft_expr_destroy(ctx, expr); 6145 return ERR_PTR(err); 6146 } 6147 6148 static int nft_set_ext_check(const struct nft_set_ext_tmpl *tmpl, u8 id, u32 len) 6149 { 6150 len += nft_set_ext_types[id].len; 6151 if (len > tmpl->ext_len[id] || 6152 len > U8_MAX) 6153 return -1; 6154 6155 return 0; 6156 } 6157 6158 static int nft_set_ext_memcpy(const struct nft_set_ext_tmpl *tmpl, u8 id, 6159 void *to, const void *from, u32 len) 6160 { 6161 if (nft_set_ext_check(tmpl, id, len) < 0) 6162 return -1; 6163 6164 memcpy(to, from, len); 6165 6166 return 0; 6167 } 6168 6169 void *nft_set_elem_init(const struct nft_set *set, 6170 const struct nft_set_ext_tmpl *tmpl, 6171 const u32 *key, const u32 *key_end, 6172 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp) 6173 { 6174 struct nft_set_ext *ext; 6175 void *elem; 6176 6177 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 6178 if (elem == NULL) 6179 return ERR_PTR(-ENOMEM); 6180 6181 ext = nft_set_elem_ext(set, elem); 6182 nft_set_ext_init(ext, tmpl); 6183 6184 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 6185 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY, 6186 nft_set_ext_key(ext), key, set->klen) < 0) 6187 goto err_ext_check; 6188 6189 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 6190 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY_END, 6191 nft_set_ext_key_end(ext), key_end, set->klen) < 0) 6192 goto err_ext_check; 6193 6194 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6195 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_DATA, 6196 nft_set_ext_data(ext), data, set->dlen) < 0) 6197 goto err_ext_check; 6198 6199 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 6200 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration; 6201 if (expiration == 0) 6202 *nft_set_ext_expiration(ext) += timeout; 6203 } 6204 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) 6205 *nft_set_ext_timeout(ext) = timeout; 6206 6207 return elem; 6208 6209 err_ext_check: 6210 kfree(elem); 6211 6212 return ERR_PTR(-EINVAL); 6213 } 6214 6215 static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 6216 struct nft_expr *expr) 6217 { 6218 if (expr->ops->destroy_clone) { 6219 expr->ops->destroy_clone(ctx, expr); 6220 module_put(expr->ops->type->owner); 6221 } else { 6222 nf_tables_expr_destroy(ctx, expr); 6223 } 6224 } 6225 6226 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 6227 struct nft_set_elem_expr *elem_expr) 6228 { 6229 struct nft_expr *expr; 6230 u32 size; 6231 6232 nft_setelem_expr_foreach(expr, elem_expr, size) 6233 __nft_set_elem_expr_destroy(ctx, expr); 6234 } 6235 6236 /* Drop references and destroy. Called from gc, dynset and abort path. */ 6237 void nft_set_elem_destroy(const struct nft_set *set, void *elem, 6238 bool destroy_expr) 6239 { 6240 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 6241 struct nft_ctx ctx = { 6242 .net = read_pnet(&set->net), 6243 .family = set->table->family, 6244 }; 6245 6246 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE); 6247 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6248 nft_data_release(nft_set_ext_data(ext), set->dtype); 6249 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 6250 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext)); 6251 6252 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6253 nft_use_dec(&(*nft_set_ext_obj(ext))->use); 6254 kfree(elem); 6255 } 6256 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 6257 6258 /* Destroy element. References have been already dropped in the preparation 6259 * path via nft_setelem_data_deactivate(). 6260 */ 6261 void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, 6262 const struct nft_set *set, void *elem) 6263 { 6264 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 6265 6266 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 6267 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 6268 6269 kfree(elem); 6270 } 6271 6272 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 6273 struct nft_expr *expr_array[]) 6274 { 6275 struct nft_expr *expr; 6276 int err, i, k; 6277 6278 for (i = 0; i < set->num_exprs; i++) { 6279 expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT); 6280 if (!expr) 6281 goto err_expr; 6282 6283 err = nft_expr_clone(expr, set->exprs[i]); 6284 if (err < 0) { 6285 kfree(expr); 6286 goto err_expr; 6287 } 6288 expr_array[i] = expr; 6289 } 6290 6291 return 0; 6292 6293 err_expr: 6294 for (k = i - 1; k >= 0; k--) 6295 nft_expr_destroy(ctx, expr_array[k]); 6296 6297 return -ENOMEM; 6298 } 6299 6300 static int nft_set_elem_expr_setup(struct nft_ctx *ctx, 6301 const struct nft_set_ext_tmpl *tmpl, 6302 const struct nft_set_ext *ext, 6303 struct nft_expr *expr_array[], 6304 u32 num_exprs) 6305 { 6306 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 6307 u32 len = sizeof(struct nft_set_elem_expr); 6308 struct nft_expr *expr; 6309 int i, err; 6310 6311 if (num_exprs == 0) 6312 return 0; 6313 6314 for (i = 0; i < num_exprs; i++) 6315 len += expr_array[i]->ops->size; 6316 6317 if (nft_set_ext_check(tmpl, NFT_SET_EXT_EXPRESSIONS, len) < 0) 6318 return -EINVAL; 6319 6320 for (i = 0; i < num_exprs; i++) { 6321 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 6322 err = nft_expr_clone(expr, expr_array[i]); 6323 if (err < 0) 6324 goto err_elem_expr_setup; 6325 6326 elem_expr->size += expr_array[i]->ops->size; 6327 nft_expr_destroy(ctx, expr_array[i]); 6328 expr_array[i] = NULL; 6329 } 6330 6331 return 0; 6332 6333 err_elem_expr_setup: 6334 for (; i < num_exprs; i++) { 6335 nft_expr_destroy(ctx, expr_array[i]); 6336 expr_array[i] = NULL; 6337 } 6338 6339 return -ENOMEM; 6340 } 6341 6342 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, 6343 const struct nft_set *set) 6344 { 6345 struct nft_set_elem_catchall *catchall; 6346 u8 genmask = nft_genmask_cur(net); 6347 struct nft_set_ext *ext; 6348 6349 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6350 ext = nft_set_elem_ext(set, catchall->elem); 6351 if (nft_set_elem_active(ext, genmask) && 6352 !nft_set_elem_expired(ext) && 6353 !nft_set_elem_is_dead(ext)) 6354 return ext; 6355 } 6356 6357 return NULL; 6358 } 6359 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup); 6360 6361 static int nft_setelem_catchall_insert(const struct net *net, 6362 struct nft_set *set, 6363 const struct nft_set_elem *elem, 6364 struct nft_set_ext **pext) 6365 { 6366 struct nft_set_elem_catchall *catchall; 6367 u8 genmask = nft_genmask_next(net); 6368 struct nft_set_ext *ext; 6369 6370 list_for_each_entry(catchall, &set->catchall_list, list) { 6371 ext = nft_set_elem_ext(set, catchall->elem); 6372 if (nft_set_elem_active(ext, genmask)) { 6373 *pext = ext; 6374 return -EEXIST; 6375 } 6376 } 6377 6378 catchall = kmalloc(sizeof(*catchall), GFP_KERNEL); 6379 if (!catchall) 6380 return -ENOMEM; 6381 6382 catchall->elem = elem->priv; 6383 list_add_tail_rcu(&catchall->list, &set->catchall_list); 6384 6385 return 0; 6386 } 6387 6388 static int nft_setelem_insert(const struct net *net, 6389 struct nft_set *set, 6390 const struct nft_set_elem *elem, 6391 struct nft_set_ext **ext, unsigned int flags) 6392 { 6393 int ret; 6394 6395 if (flags & NFT_SET_ELEM_CATCHALL) 6396 ret = nft_setelem_catchall_insert(net, set, elem, ext); 6397 else 6398 ret = set->ops->insert(net, set, elem, ext); 6399 6400 return ret; 6401 } 6402 6403 static bool nft_setelem_is_catchall(const struct nft_set *set, 6404 const struct nft_set_elem *elem) 6405 { 6406 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6407 6408 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 6409 *nft_set_ext_flags(ext) & NFT_SET_ELEM_CATCHALL) 6410 return true; 6411 6412 return false; 6413 } 6414 6415 static void nft_setelem_activate(struct net *net, struct nft_set *set, 6416 struct nft_set_elem *elem) 6417 { 6418 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6419 6420 if (nft_setelem_is_catchall(set, elem)) { 6421 nft_set_elem_change_active(net, set, ext); 6422 } else { 6423 set->ops->activate(net, set, elem); 6424 } 6425 } 6426 6427 static int nft_setelem_catchall_deactivate(const struct net *net, 6428 struct nft_set *set, 6429 struct nft_set_elem *elem) 6430 { 6431 struct nft_set_elem_catchall *catchall; 6432 struct nft_set_ext *ext; 6433 6434 list_for_each_entry(catchall, &set->catchall_list, list) { 6435 ext = nft_set_elem_ext(set, catchall->elem); 6436 if (!nft_is_active(net, ext)) 6437 continue; 6438 6439 kfree(elem->priv); 6440 elem->priv = catchall->elem; 6441 nft_set_elem_change_active(net, set, ext); 6442 return 0; 6443 } 6444 6445 return -ENOENT; 6446 } 6447 6448 static int __nft_setelem_deactivate(const struct net *net, 6449 struct nft_set *set, 6450 struct nft_set_elem *elem) 6451 { 6452 void *priv; 6453 6454 priv = set->ops->deactivate(net, set, elem); 6455 if (!priv) 6456 return -ENOENT; 6457 6458 kfree(elem->priv); 6459 elem->priv = priv; 6460 set->ndeact++; 6461 6462 return 0; 6463 } 6464 6465 static int nft_setelem_deactivate(const struct net *net, 6466 struct nft_set *set, 6467 struct nft_set_elem *elem, u32 flags) 6468 { 6469 int ret; 6470 6471 if (flags & NFT_SET_ELEM_CATCHALL) 6472 ret = nft_setelem_catchall_deactivate(net, set, elem); 6473 else 6474 ret = __nft_setelem_deactivate(net, set, elem); 6475 6476 return ret; 6477 } 6478 6479 static void nft_setelem_catchall_remove(const struct net *net, 6480 const struct nft_set *set, 6481 const struct nft_set_elem *elem) 6482 { 6483 struct nft_set_elem_catchall *catchall, *next; 6484 6485 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 6486 if (catchall->elem == elem->priv) { 6487 list_del_rcu(&catchall->list); 6488 kfree_rcu(catchall, rcu); 6489 break; 6490 } 6491 } 6492 } 6493 6494 static void nft_setelem_remove(const struct net *net, 6495 const struct nft_set *set, 6496 const struct nft_set_elem *elem) 6497 { 6498 if (nft_setelem_is_catchall(set, elem)) 6499 nft_setelem_catchall_remove(net, set, elem); 6500 else 6501 set->ops->remove(net, set, elem); 6502 } 6503 6504 static bool nft_setelem_valid_key_end(const struct nft_set *set, 6505 struct nlattr **nla, u32 flags) 6506 { 6507 if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) == 6508 (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { 6509 if (flags & NFT_SET_ELEM_INTERVAL_END) 6510 return false; 6511 6512 if (nla[NFTA_SET_ELEM_KEY_END] && 6513 flags & NFT_SET_ELEM_CATCHALL) 6514 return false; 6515 } else { 6516 if (nla[NFTA_SET_ELEM_KEY_END]) 6517 return false; 6518 } 6519 6520 return true; 6521 } 6522 6523 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 6524 const struct nlattr *attr, u32 nlmsg_flags) 6525 { 6526 struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {}; 6527 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6528 u8 genmask = nft_genmask_next(ctx->net); 6529 u32 flags = 0, size = 0, num_exprs = 0; 6530 struct nft_set_ext_tmpl tmpl; 6531 struct nft_set_ext *ext, *ext2; 6532 struct nft_set_elem elem; 6533 struct nft_set_binding *binding; 6534 struct nft_object *obj = NULL; 6535 struct nft_userdata *udata; 6536 struct nft_data_desc desc; 6537 enum nft_registers dreg; 6538 struct nft_trans *trans; 6539 u64 timeout; 6540 u64 expiration; 6541 int err, i; 6542 u8 ulen; 6543 6544 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6545 nft_set_elem_policy, NULL); 6546 if (err < 0) 6547 return err; 6548 6549 nft_set_ext_prepare(&tmpl); 6550 6551 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6552 if (err < 0) 6553 return err; 6554 6555 if (((flags & NFT_SET_ELEM_CATCHALL) && nla[NFTA_SET_ELEM_KEY]) || 6556 (!(flags & NFT_SET_ELEM_CATCHALL) && !nla[NFTA_SET_ELEM_KEY])) 6557 return -EINVAL; 6558 6559 if (flags != 0) { 6560 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 6561 if (err < 0) 6562 return err; 6563 } 6564 6565 if (set->flags & NFT_SET_MAP) { 6566 if (nla[NFTA_SET_ELEM_DATA] == NULL && 6567 !(flags & NFT_SET_ELEM_INTERVAL_END)) 6568 return -EINVAL; 6569 } else { 6570 if (nla[NFTA_SET_ELEM_DATA] != NULL) 6571 return -EINVAL; 6572 } 6573 6574 if (set->flags & NFT_SET_OBJECT) { 6575 if (!nla[NFTA_SET_ELEM_OBJREF] && 6576 !(flags & NFT_SET_ELEM_INTERVAL_END)) 6577 return -EINVAL; 6578 } else { 6579 if (nla[NFTA_SET_ELEM_OBJREF]) 6580 return -EINVAL; 6581 } 6582 6583 if (!nft_setelem_valid_key_end(set, nla, flags)) 6584 return -EINVAL; 6585 6586 if ((flags & NFT_SET_ELEM_INTERVAL_END) && 6587 (nla[NFTA_SET_ELEM_DATA] || 6588 nla[NFTA_SET_ELEM_OBJREF] || 6589 nla[NFTA_SET_ELEM_TIMEOUT] || 6590 nla[NFTA_SET_ELEM_EXPIRATION] || 6591 nla[NFTA_SET_ELEM_USERDATA] || 6592 nla[NFTA_SET_ELEM_EXPR] || 6593 nla[NFTA_SET_ELEM_KEY_END] || 6594 nla[NFTA_SET_ELEM_EXPRESSIONS])) 6595 return -EINVAL; 6596 6597 timeout = 0; 6598 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 6599 if (!(set->flags & NFT_SET_TIMEOUT)) 6600 return -EINVAL; 6601 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT], 6602 &timeout); 6603 if (err) 6604 return err; 6605 } else if (set->flags & NFT_SET_TIMEOUT && 6606 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6607 timeout = READ_ONCE(set->timeout); 6608 } 6609 6610 expiration = 0; 6611 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) { 6612 if (!(set->flags & NFT_SET_TIMEOUT)) 6613 return -EINVAL; 6614 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION], 6615 &expiration); 6616 if (err) 6617 return err; 6618 } 6619 6620 if (nla[NFTA_SET_ELEM_EXPR]) { 6621 struct nft_expr *expr; 6622 6623 if (set->num_exprs && set->num_exprs != 1) 6624 return -EOPNOTSUPP; 6625 6626 expr = nft_set_elem_expr_alloc(ctx, set, 6627 nla[NFTA_SET_ELEM_EXPR]); 6628 if (IS_ERR(expr)) 6629 return PTR_ERR(expr); 6630 6631 expr_array[0] = expr; 6632 num_exprs = 1; 6633 6634 if (set->num_exprs && set->exprs[0]->ops != expr->ops) { 6635 err = -EOPNOTSUPP; 6636 goto err_set_elem_expr; 6637 } 6638 } else if (nla[NFTA_SET_ELEM_EXPRESSIONS]) { 6639 struct nft_expr *expr; 6640 struct nlattr *tmp; 6641 int left; 6642 6643 i = 0; 6644 nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) { 6645 if (i == NFT_SET_EXPR_MAX || 6646 (set->num_exprs && set->num_exprs == i)) { 6647 err = -E2BIG; 6648 goto err_set_elem_expr; 6649 } 6650 if (nla_type(tmp) != NFTA_LIST_ELEM) { 6651 err = -EINVAL; 6652 goto err_set_elem_expr; 6653 } 6654 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 6655 if (IS_ERR(expr)) { 6656 err = PTR_ERR(expr); 6657 goto err_set_elem_expr; 6658 } 6659 expr_array[i] = expr; 6660 num_exprs++; 6661 6662 if (set->num_exprs && expr->ops != set->exprs[i]->ops) { 6663 err = -EOPNOTSUPP; 6664 goto err_set_elem_expr; 6665 } 6666 i++; 6667 } 6668 if (set->num_exprs && set->num_exprs != i) { 6669 err = -EOPNOTSUPP; 6670 goto err_set_elem_expr; 6671 } 6672 } else if (set->num_exprs > 0 && 6673 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6674 err = nft_set_elem_expr_clone(ctx, set, expr_array); 6675 if (err < 0) 6676 goto err_set_elem_expr_clone; 6677 6678 num_exprs = set->num_exprs; 6679 } 6680 6681 if (nla[NFTA_SET_ELEM_KEY]) { 6682 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6683 nla[NFTA_SET_ELEM_KEY]); 6684 if (err < 0) 6685 goto err_set_elem_expr; 6686 6687 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 6688 if (err < 0) 6689 goto err_parse_key; 6690 } 6691 6692 if (nla[NFTA_SET_ELEM_KEY_END]) { 6693 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6694 nla[NFTA_SET_ELEM_KEY_END]); 6695 if (err < 0) 6696 goto err_parse_key; 6697 6698 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 6699 if (err < 0) 6700 goto err_parse_key_end; 6701 } 6702 6703 if (timeout > 0) { 6704 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); 6705 if (err < 0) 6706 goto err_parse_key_end; 6707 6708 if (timeout != READ_ONCE(set->timeout)) { 6709 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 6710 if (err < 0) 6711 goto err_parse_key_end; 6712 } 6713 } 6714 6715 if (num_exprs) { 6716 for (i = 0; i < num_exprs; i++) 6717 size += expr_array[i]->ops->size; 6718 6719 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, 6720 sizeof(struct nft_set_elem_expr) + size); 6721 if (err < 0) 6722 goto err_parse_key_end; 6723 } 6724 6725 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { 6726 obj = nft_obj_lookup(ctx->net, ctx->table, 6727 nla[NFTA_SET_ELEM_OBJREF], 6728 set->objtype, genmask); 6729 if (IS_ERR(obj)) { 6730 err = PTR_ERR(obj); 6731 obj = NULL; 6732 goto err_parse_key_end; 6733 } 6734 6735 if (!nft_use_inc(&obj->use)) { 6736 err = -EMFILE; 6737 obj = NULL; 6738 goto err_parse_key_end; 6739 } 6740 6741 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); 6742 if (err < 0) 6743 goto err_parse_key_end; 6744 } 6745 6746 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 6747 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val, 6748 nla[NFTA_SET_ELEM_DATA]); 6749 if (err < 0) 6750 goto err_parse_key_end; 6751 6752 dreg = nft_type_to_reg(set->dtype); 6753 list_for_each_entry(binding, &set->bindings, list) { 6754 struct nft_ctx bind_ctx = { 6755 .net = ctx->net, 6756 .family = ctx->family, 6757 .table = ctx->table, 6758 .chain = (struct nft_chain *)binding->chain, 6759 }; 6760 6761 if (!(binding->flags & NFT_SET_MAP)) 6762 continue; 6763 6764 err = nft_validate_register_store(&bind_ctx, dreg, 6765 &elem.data.val, 6766 desc.type, desc.len); 6767 if (err < 0) 6768 goto err_parse_data; 6769 6770 if (desc.type == NFT_DATA_VERDICT && 6771 (elem.data.val.verdict.code == NFT_GOTO || 6772 elem.data.val.verdict.code == NFT_JUMP)) 6773 nft_validate_state_update(ctx->table, 6774 NFT_VALIDATE_NEED); 6775 } 6776 6777 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); 6778 if (err < 0) 6779 goto err_parse_data; 6780 } 6781 6782 /* The full maximum length of userdata can exceed the maximum 6783 * offset value (U8_MAX) for following extensions, therefor it 6784 * must be the last extension added. 6785 */ 6786 ulen = 0; 6787 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 6788 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 6789 if (ulen > 0) { 6790 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 6791 ulen); 6792 if (err < 0) 6793 goto err_parse_data; 6794 } 6795 } 6796 6797 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 6798 elem.key_end.val.data, elem.data.val.data, 6799 timeout, expiration, GFP_KERNEL_ACCOUNT); 6800 if (IS_ERR(elem.priv)) { 6801 err = PTR_ERR(elem.priv); 6802 goto err_parse_data; 6803 } 6804 6805 ext = nft_set_elem_ext(set, elem.priv); 6806 if (flags) 6807 *nft_set_ext_flags(ext) = flags; 6808 6809 if (obj) 6810 *nft_set_ext_obj(ext) = obj; 6811 6812 if (ulen > 0) { 6813 if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) { 6814 err = -EINVAL; 6815 goto err_elem_free; 6816 } 6817 udata = nft_set_ext_userdata(ext); 6818 udata->len = ulen - 1; 6819 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 6820 } 6821 err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs); 6822 if (err < 0) 6823 goto err_elem_free; 6824 6825 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 6826 if (trans == NULL) { 6827 err = -ENOMEM; 6828 goto err_elem_free; 6829 } 6830 6831 ext->genmask = nft_genmask_cur(ctx->net); 6832 6833 err = nft_setelem_insert(ctx->net, set, &elem, &ext2, flags); 6834 if (err) { 6835 if (err == -EEXIST) { 6836 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ 6837 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || 6838 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ 6839 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) 6840 goto err_element_clash; 6841 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6842 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && 6843 memcmp(nft_set_ext_data(ext), 6844 nft_set_ext_data(ext2), set->dlen) != 0) || 6845 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 6846 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) && 6847 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) 6848 goto err_element_clash; 6849 else if (!(nlmsg_flags & NLM_F_EXCL)) 6850 err = 0; 6851 } else if (err == -ENOTEMPTY) { 6852 /* ENOTEMPTY reports overlapping between this element 6853 * and an existing one. 6854 */ 6855 err = -EEXIST; 6856 } 6857 goto err_element_clash; 6858 } 6859 6860 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 6861 unsigned int max = set->size ? set->size + set->ndeact : UINT_MAX; 6862 6863 if (!atomic_add_unless(&set->nelems, 1, max)) { 6864 err = -ENFILE; 6865 goto err_set_full; 6866 } 6867 } 6868 6869 nft_trans_elem(trans) = elem; 6870 nft_trans_commit_list_add_tail(ctx->net, trans); 6871 return 0; 6872 6873 err_set_full: 6874 nft_setelem_remove(ctx->net, set, &elem); 6875 err_element_clash: 6876 kfree(trans); 6877 err_elem_free: 6878 nf_tables_set_elem_destroy(ctx, set, elem.priv); 6879 err_parse_data: 6880 if (nla[NFTA_SET_ELEM_DATA] != NULL) 6881 nft_data_release(&elem.data.val, desc.type); 6882 err_parse_key_end: 6883 if (obj) 6884 nft_use_dec_restore(&obj->use); 6885 6886 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 6887 err_parse_key: 6888 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 6889 err_set_elem_expr: 6890 for (i = 0; i < num_exprs && expr_array[i]; i++) 6891 nft_expr_destroy(ctx, expr_array[i]); 6892 err_set_elem_expr_clone: 6893 return err; 6894 } 6895 6896 static int nf_tables_newsetelem(struct sk_buff *skb, 6897 const struct nfnl_info *info, 6898 const struct nlattr * const nla[]) 6899 { 6900 struct netlink_ext_ack *extack = info->extack; 6901 u8 genmask = nft_genmask_next(info->net); 6902 u8 family = info->nfmsg->nfgen_family; 6903 struct net *net = info->net; 6904 const struct nlattr *attr; 6905 struct nft_table *table; 6906 struct nft_set *set; 6907 struct nft_ctx ctx; 6908 int rem, err; 6909 6910 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 6911 return -EINVAL; 6912 6913 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6914 genmask, NETLINK_CB(skb).portid); 6915 if (IS_ERR(table)) { 6916 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6917 return PTR_ERR(table); 6918 } 6919 6920 set = nft_set_lookup_global(net, table, nla[NFTA_SET_ELEM_LIST_SET], 6921 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask); 6922 if (IS_ERR(set)) 6923 return PTR_ERR(set); 6924 6925 if (!list_empty(&set->bindings) && 6926 (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS))) 6927 return -EBUSY; 6928 6929 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6930 6931 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6932 err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags); 6933 if (err < 0) { 6934 NL_SET_BAD_ATTR(extack, attr); 6935 return err; 6936 } 6937 } 6938 6939 if (table->validate_state == NFT_VALIDATE_DO) 6940 return nft_table_validate(net, table); 6941 6942 return 0; 6943 } 6944 6945 /** 6946 * nft_data_hold - hold a nft_data item 6947 * 6948 * @data: struct nft_data to release 6949 * @type: type of data 6950 * 6951 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded, 6952 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and 6953 * NFT_GOTO verdicts. This function must be called on active data objects 6954 * from the second phase of the commit protocol. 6955 */ 6956 void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 6957 { 6958 struct nft_chain *chain; 6959 6960 if (type == NFT_DATA_VERDICT) { 6961 switch (data->verdict.code) { 6962 case NFT_JUMP: 6963 case NFT_GOTO: 6964 chain = data->verdict.chain; 6965 nft_use_inc_restore(&chain->use); 6966 break; 6967 } 6968 } 6969 } 6970 6971 static void nft_setelem_data_activate(const struct net *net, 6972 const struct nft_set *set, 6973 struct nft_set_elem *elem) 6974 { 6975 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6976 6977 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6978 nft_data_hold(nft_set_ext_data(ext), set->dtype); 6979 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6980 nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use); 6981 } 6982 6983 void nft_setelem_data_deactivate(const struct net *net, 6984 const struct nft_set *set, 6985 struct nft_set_elem *elem) 6986 { 6987 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6988 6989 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6990 nft_data_release(nft_set_ext_data(ext), set->dtype); 6991 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6992 nft_use_dec(&(*nft_set_ext_obj(ext))->use); 6993 } 6994 6995 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 6996 const struct nlattr *attr) 6997 { 6998 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6999 struct nft_set_ext_tmpl tmpl; 7000 struct nft_set_elem elem; 7001 struct nft_set_ext *ext; 7002 struct nft_trans *trans; 7003 u32 flags = 0; 7004 int err; 7005 7006 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 7007 nft_set_elem_policy, NULL); 7008 if (err < 0) 7009 return err; 7010 7011 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 7012 if (err < 0) 7013 return err; 7014 7015 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 7016 return -EINVAL; 7017 7018 if (!nft_setelem_valid_key_end(set, nla, flags)) 7019 return -EINVAL; 7020 7021 nft_set_ext_prepare(&tmpl); 7022 7023 if (flags != 0) { 7024 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 7025 if (err < 0) 7026 return err; 7027 } 7028 7029 if (nla[NFTA_SET_ELEM_KEY]) { 7030 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 7031 nla[NFTA_SET_ELEM_KEY]); 7032 if (err < 0) 7033 return err; 7034 7035 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 7036 if (err < 0) 7037 goto fail_elem; 7038 } 7039 7040 if (nla[NFTA_SET_ELEM_KEY_END]) { 7041 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 7042 nla[NFTA_SET_ELEM_KEY_END]); 7043 if (err < 0) 7044 goto fail_elem; 7045 7046 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 7047 if (err < 0) 7048 goto fail_elem_key_end; 7049 } 7050 7051 err = -ENOMEM; 7052 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 7053 elem.key_end.val.data, NULL, 0, 0, 7054 GFP_KERNEL_ACCOUNT); 7055 if (IS_ERR(elem.priv)) { 7056 err = PTR_ERR(elem.priv); 7057 goto fail_elem_key_end; 7058 } 7059 7060 ext = nft_set_elem_ext(set, elem.priv); 7061 if (flags) 7062 *nft_set_ext_flags(ext) = flags; 7063 7064 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 7065 if (trans == NULL) 7066 goto fail_trans; 7067 7068 err = nft_setelem_deactivate(ctx->net, set, &elem, flags); 7069 if (err < 0) 7070 goto fail_ops; 7071 7072 nft_setelem_data_deactivate(ctx->net, set, &elem); 7073 7074 nft_trans_elem(trans) = elem; 7075 nft_trans_commit_list_add_tail(ctx->net, trans); 7076 return 0; 7077 7078 fail_ops: 7079 kfree(trans); 7080 fail_trans: 7081 kfree(elem.priv); 7082 fail_elem_key_end: 7083 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 7084 fail_elem: 7085 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 7086 return err; 7087 } 7088 7089 static int nft_setelem_flush(const struct nft_ctx *ctx, 7090 struct nft_set *set, 7091 const struct nft_set_iter *iter, 7092 struct nft_set_elem *elem) 7093 { 7094 struct nft_trans *trans; 7095 int err; 7096 7097 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 7098 sizeof(struct nft_trans_elem), GFP_ATOMIC); 7099 if (!trans) 7100 return -ENOMEM; 7101 7102 if (!set->ops->flush(ctx->net, set, elem->priv)) { 7103 err = -ENOENT; 7104 goto err1; 7105 } 7106 set->ndeact++; 7107 7108 nft_setelem_data_deactivate(ctx->net, set, elem); 7109 nft_trans_elem_set(trans) = set; 7110 nft_trans_elem(trans) = *elem; 7111 nft_trans_commit_list_add_tail(ctx->net, trans); 7112 7113 return 0; 7114 err1: 7115 kfree(trans); 7116 return err; 7117 } 7118 7119 static int __nft_set_catchall_flush(const struct nft_ctx *ctx, 7120 struct nft_set *set, 7121 struct nft_set_elem *elem) 7122 { 7123 struct nft_trans *trans; 7124 7125 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 7126 sizeof(struct nft_trans_elem), GFP_KERNEL); 7127 if (!trans) 7128 return -ENOMEM; 7129 7130 nft_setelem_data_deactivate(ctx->net, set, elem); 7131 nft_trans_elem_set(trans) = set; 7132 nft_trans_elem(trans) = *elem; 7133 nft_trans_commit_list_add_tail(ctx->net, trans); 7134 7135 return 0; 7136 } 7137 7138 static int nft_set_catchall_flush(const struct nft_ctx *ctx, 7139 struct nft_set *set) 7140 { 7141 u8 genmask = nft_genmask_next(ctx->net); 7142 struct nft_set_elem_catchall *catchall; 7143 struct nft_set_elem elem; 7144 struct nft_set_ext *ext; 7145 int ret = 0; 7146 7147 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 7148 ext = nft_set_elem_ext(set, catchall->elem); 7149 if (!nft_set_elem_active(ext, genmask)) 7150 continue; 7151 7152 elem.priv = catchall->elem; 7153 ret = __nft_set_catchall_flush(ctx, set, &elem); 7154 if (ret < 0) 7155 break; 7156 nft_set_elem_change_active(ctx->net, set, ext); 7157 } 7158 7159 return ret; 7160 } 7161 7162 static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) 7163 { 7164 struct nft_set_iter iter = { 7165 .genmask = genmask, 7166 .fn = nft_setelem_flush, 7167 }; 7168 7169 set->ops->walk(ctx, set, &iter); 7170 if (!iter.err) 7171 iter.err = nft_set_catchall_flush(ctx, set); 7172 7173 return iter.err; 7174 } 7175 7176 static int nf_tables_delsetelem(struct sk_buff *skb, 7177 const struct nfnl_info *info, 7178 const struct nlattr * const nla[]) 7179 { 7180 struct netlink_ext_ack *extack = info->extack; 7181 u8 genmask = nft_genmask_next(info->net); 7182 u8 family = info->nfmsg->nfgen_family; 7183 struct net *net = info->net; 7184 const struct nlattr *attr; 7185 struct nft_table *table; 7186 struct nft_set *set; 7187 struct nft_ctx ctx; 7188 int rem, err = 0; 7189 7190 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 7191 genmask, NETLINK_CB(skb).portid); 7192 if (IS_ERR(table)) { 7193 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 7194 return PTR_ERR(table); 7195 } 7196 7197 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 7198 if (IS_ERR(set)) 7199 return PTR_ERR(set); 7200 7201 if (nft_set_is_anonymous(set)) 7202 return -EOPNOTSUPP; 7203 7204 if (!list_empty(&set->bindings) && (set->flags & NFT_SET_CONSTANT)) 7205 return -EBUSY; 7206 7207 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7208 7209 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 7210 return nft_set_flush(&ctx, set, genmask); 7211 7212 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 7213 err = nft_del_setelem(&ctx, set, attr); 7214 if (err == -ENOENT && 7215 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSETELEM) 7216 continue; 7217 7218 if (err < 0) { 7219 NL_SET_BAD_ATTR(extack, attr); 7220 break; 7221 } 7222 } 7223 return err; 7224 } 7225 7226 /* 7227 * Stateful objects 7228 */ 7229 7230 /** 7231 * nft_register_obj- register nf_tables stateful object type 7232 * @obj_type: object type 7233 * 7234 * Registers the object type for use with nf_tables. Returns zero on 7235 * success or a negative errno code otherwise. 7236 */ 7237 int nft_register_obj(struct nft_object_type *obj_type) 7238 { 7239 if (obj_type->type == NFT_OBJECT_UNSPEC) 7240 return -EINVAL; 7241 7242 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7243 list_add_rcu(&obj_type->list, &nf_tables_objects); 7244 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7245 return 0; 7246 } 7247 EXPORT_SYMBOL_GPL(nft_register_obj); 7248 7249 /** 7250 * nft_unregister_obj - unregister nf_tables object type 7251 * @obj_type: object type 7252 * 7253 * Unregisters the object type for use with nf_tables. 7254 */ 7255 void nft_unregister_obj(struct nft_object_type *obj_type) 7256 { 7257 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7258 list_del_rcu(&obj_type->list); 7259 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7260 } 7261 EXPORT_SYMBOL_GPL(nft_unregister_obj); 7262 7263 struct nft_object *nft_obj_lookup(const struct net *net, 7264 const struct nft_table *table, 7265 const struct nlattr *nla, u32 objtype, 7266 u8 genmask) 7267 { 7268 struct nft_object_hash_key k = { .table = table }; 7269 char search[NFT_OBJ_MAXNAMELEN]; 7270 struct rhlist_head *tmp, *list; 7271 struct nft_object *obj; 7272 7273 nla_strscpy(search, nla, sizeof(search)); 7274 k.name = search; 7275 7276 WARN_ON_ONCE(!rcu_read_lock_held() && 7277 !lockdep_commit_lock_is_held(net)); 7278 7279 rcu_read_lock(); 7280 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params); 7281 if (!list) 7282 goto out; 7283 7284 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) { 7285 if (objtype == obj->ops->type->type && 7286 nft_active_genmask(obj, genmask)) { 7287 rcu_read_unlock(); 7288 return obj; 7289 } 7290 } 7291 out: 7292 rcu_read_unlock(); 7293 return ERR_PTR(-ENOENT); 7294 } 7295 EXPORT_SYMBOL_GPL(nft_obj_lookup); 7296 7297 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table, 7298 const struct nlattr *nla, 7299 u32 objtype, u8 genmask) 7300 { 7301 struct nft_object *obj; 7302 7303 list_for_each_entry(obj, &table->objects, list) { 7304 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && 7305 objtype == obj->ops->type->type && 7306 nft_active_genmask(obj, genmask)) 7307 return obj; 7308 } 7309 return ERR_PTR(-ENOENT); 7310 } 7311 7312 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 7313 [NFTA_OBJ_TABLE] = { .type = NLA_STRING, 7314 .len = NFT_TABLE_MAXNAMELEN - 1 }, 7315 [NFTA_OBJ_NAME] = { .type = NLA_STRING, 7316 .len = NFT_OBJ_MAXNAMELEN - 1 }, 7317 [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, 7318 [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, 7319 [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, 7320 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY, 7321 .len = NFT_USERDATA_MAXLEN }, 7322 }; 7323 7324 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 7325 const struct nft_object_type *type, 7326 const struct nlattr *attr) 7327 { 7328 struct nlattr **tb; 7329 const struct nft_object_ops *ops; 7330 struct nft_object *obj; 7331 int err = -ENOMEM; 7332 7333 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL); 7334 if (!tb) 7335 goto err1; 7336 7337 if (attr) { 7338 err = nla_parse_nested_deprecated(tb, type->maxattr, attr, 7339 type->policy, NULL); 7340 if (err < 0) 7341 goto err2; 7342 } else { 7343 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); 7344 } 7345 7346 if (type->select_ops) { 7347 ops = type->select_ops(ctx, (const struct nlattr * const *)tb); 7348 if (IS_ERR(ops)) { 7349 err = PTR_ERR(ops); 7350 goto err2; 7351 } 7352 } else { 7353 ops = type->ops; 7354 } 7355 7356 err = -ENOMEM; 7357 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT); 7358 if (!obj) 7359 goto err2; 7360 7361 err = ops->init(ctx, (const struct nlattr * const *)tb, obj); 7362 if (err < 0) 7363 goto err3; 7364 7365 obj->ops = ops; 7366 7367 kfree(tb); 7368 return obj; 7369 err3: 7370 kfree(obj); 7371 err2: 7372 kfree(tb); 7373 err1: 7374 return ERR_PTR(err); 7375 } 7376 7377 static int nft_object_dump(struct sk_buff *skb, unsigned int attr, 7378 struct nft_object *obj, bool reset) 7379 { 7380 struct nlattr *nest; 7381 7382 nest = nla_nest_start_noflag(skb, attr); 7383 if (!nest) 7384 goto nla_put_failure; 7385 if (obj->ops->dump(skb, obj, reset) < 0) 7386 goto nla_put_failure; 7387 nla_nest_end(skb, nest); 7388 return 0; 7389 7390 nla_put_failure: 7391 return -1; 7392 } 7393 7394 static const struct nft_object_type *__nft_obj_type_get(u32 objtype) 7395 { 7396 const struct nft_object_type *type; 7397 7398 list_for_each_entry(type, &nf_tables_objects, list) { 7399 if (objtype == type->type) 7400 return type; 7401 } 7402 return NULL; 7403 } 7404 7405 static const struct nft_object_type * 7406 nft_obj_type_get(struct net *net, u32 objtype) 7407 { 7408 const struct nft_object_type *type; 7409 7410 type = __nft_obj_type_get(objtype); 7411 if (type != NULL && try_module_get(type->owner)) 7412 return type; 7413 7414 lockdep_nfnl_nft_mutex_not_held(); 7415 #ifdef CONFIG_MODULES 7416 if (type == NULL) { 7417 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN) 7418 return ERR_PTR(-EAGAIN); 7419 } 7420 #endif 7421 return ERR_PTR(-ENOENT); 7422 } 7423 7424 static int nf_tables_updobj(const struct nft_ctx *ctx, 7425 const struct nft_object_type *type, 7426 const struct nlattr *attr, 7427 struct nft_object *obj) 7428 { 7429 struct nft_object *newobj; 7430 struct nft_trans *trans; 7431 int err = -ENOMEM; 7432 7433 if (!try_module_get(type->owner)) 7434 return -ENOENT; 7435 7436 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, 7437 sizeof(struct nft_trans_obj)); 7438 if (!trans) 7439 goto err_trans; 7440 7441 newobj = nft_obj_init(ctx, type, attr); 7442 if (IS_ERR(newobj)) { 7443 err = PTR_ERR(newobj); 7444 goto err_free_trans; 7445 } 7446 7447 nft_trans_obj(trans) = obj; 7448 nft_trans_obj_update(trans) = true; 7449 nft_trans_obj_newobj(trans) = newobj; 7450 nft_trans_commit_list_add_tail(ctx->net, trans); 7451 7452 return 0; 7453 7454 err_free_trans: 7455 kfree(trans); 7456 err_trans: 7457 module_put(type->owner); 7458 return err; 7459 } 7460 7461 static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, 7462 const struct nlattr * const nla[]) 7463 { 7464 struct netlink_ext_ack *extack = info->extack; 7465 u8 genmask = nft_genmask_next(info->net); 7466 u8 family = info->nfmsg->nfgen_family; 7467 const struct nft_object_type *type; 7468 struct net *net = info->net; 7469 struct nft_table *table; 7470 struct nft_object *obj; 7471 struct nft_ctx ctx; 7472 u32 objtype; 7473 int err; 7474 7475 if (!nla[NFTA_OBJ_TYPE] || 7476 !nla[NFTA_OBJ_NAME] || 7477 !nla[NFTA_OBJ_DATA]) 7478 return -EINVAL; 7479 7480 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 7481 NETLINK_CB(skb).portid); 7482 if (IS_ERR(table)) { 7483 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7484 return PTR_ERR(table); 7485 } 7486 7487 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7488 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 7489 if (IS_ERR(obj)) { 7490 err = PTR_ERR(obj); 7491 if (err != -ENOENT) { 7492 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7493 return err; 7494 } 7495 } else { 7496 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 7497 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7498 return -EEXIST; 7499 } 7500 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 7501 return -EOPNOTSUPP; 7502 7503 type = __nft_obj_type_get(objtype); 7504 if (WARN_ON_ONCE(!type)) 7505 return -ENOENT; 7506 7507 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7508 7509 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); 7510 } 7511 7512 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7513 7514 if (!nft_use_inc(&table->use)) 7515 return -EMFILE; 7516 7517 type = nft_obj_type_get(net, objtype); 7518 if (IS_ERR(type)) { 7519 err = PTR_ERR(type); 7520 goto err_type; 7521 } 7522 7523 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]); 7524 if (IS_ERR(obj)) { 7525 err = PTR_ERR(obj); 7526 goto err_init; 7527 } 7528 obj->key.table = table; 7529 obj->handle = nf_tables_alloc_handle(table); 7530 7531 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT); 7532 if (!obj->key.name) { 7533 err = -ENOMEM; 7534 goto err_strdup; 7535 } 7536 7537 if (nla[NFTA_OBJ_USERDATA]) { 7538 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL_ACCOUNT); 7539 if (obj->udata == NULL) 7540 goto err_userdata; 7541 7542 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]); 7543 } 7544 7545 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj); 7546 if (err < 0) 7547 goto err_trans; 7548 7549 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead, 7550 nft_objname_ht_params); 7551 if (err < 0) 7552 goto err_obj_ht; 7553 7554 list_add_tail_rcu(&obj->list, &table->objects); 7555 7556 return 0; 7557 err_obj_ht: 7558 /* queued in transaction log */ 7559 INIT_LIST_HEAD(&obj->list); 7560 return err; 7561 err_trans: 7562 kfree(obj->udata); 7563 err_userdata: 7564 kfree(obj->key.name); 7565 err_strdup: 7566 if (obj->ops->destroy) 7567 obj->ops->destroy(&ctx, obj); 7568 kfree(obj); 7569 err_init: 7570 module_put(type->owner); 7571 err_type: 7572 nft_use_dec_restore(&table->use); 7573 7574 return err; 7575 } 7576 7577 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 7578 u32 portid, u32 seq, int event, u32 flags, 7579 int family, const struct nft_table *table, 7580 struct nft_object *obj, bool reset) 7581 { 7582 struct nlmsghdr *nlh; 7583 7584 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 7585 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 7586 NFNETLINK_V0, nft_base_seq(net)); 7587 if (!nlh) 7588 goto nla_put_failure; 7589 7590 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || 7591 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || 7592 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), 7593 NFTA_OBJ_PAD)) 7594 goto nla_put_failure; 7595 7596 if (event == NFT_MSG_DELOBJ) { 7597 nlmsg_end(skb, nlh); 7598 return 0; 7599 } 7600 7601 if (nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || 7602 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || 7603 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset)) 7604 goto nla_put_failure; 7605 7606 if (obj->udata && 7607 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata)) 7608 goto nla_put_failure; 7609 7610 nlmsg_end(skb, nlh); 7611 return 0; 7612 7613 nla_put_failure: 7614 nlmsg_trim(skb, nlh); 7615 return -1; 7616 } 7617 7618 struct nft_obj_filter { 7619 char *table; 7620 u32 type; 7621 }; 7622 7623 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) 7624 { 7625 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 7626 const struct nft_table *table; 7627 unsigned int idx = 0, s_idx = cb->args[0]; 7628 struct nft_obj_filter *filter = cb->data; 7629 struct net *net = sock_net(skb->sk); 7630 int family = nfmsg->nfgen_family; 7631 struct nftables_pernet *nft_net; 7632 struct nft_object *obj; 7633 bool reset = false; 7634 7635 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7636 reset = true; 7637 7638 rcu_read_lock(); 7639 nft_net = nft_pernet(net); 7640 cb->seq = READ_ONCE(nft_net->base_seq); 7641 7642 list_for_each_entry_rcu(table, &nft_net->tables, list) { 7643 if (family != NFPROTO_UNSPEC && family != table->family) 7644 continue; 7645 7646 list_for_each_entry_rcu(obj, &table->objects, list) { 7647 if (!nft_is_active(net, obj)) 7648 goto cont; 7649 if (idx < s_idx) 7650 goto cont; 7651 if (idx > s_idx) 7652 memset(&cb->args[1], 0, 7653 sizeof(cb->args) - sizeof(cb->args[0])); 7654 if (filter && filter->table && 7655 strcmp(filter->table, table->name)) 7656 goto cont; 7657 if (filter && 7658 filter->type != NFT_OBJECT_UNSPEC && 7659 obj->ops->type->type != filter->type) 7660 goto cont; 7661 if (reset) { 7662 char *buf = kasprintf(GFP_ATOMIC, 7663 "%s:%u", 7664 table->name, 7665 nft_net->base_seq); 7666 7667 audit_log_nfcfg(buf, 7668 family, 7669 obj->handle, 7670 AUDIT_NFT_OP_OBJ_RESET, 7671 GFP_ATOMIC); 7672 kfree(buf); 7673 } 7674 7675 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, 7676 cb->nlh->nlmsg_seq, 7677 NFT_MSG_NEWOBJ, 7678 NLM_F_MULTI | NLM_F_APPEND, 7679 table->family, table, 7680 obj, reset) < 0) 7681 goto done; 7682 7683 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 7684 cont: 7685 idx++; 7686 } 7687 } 7688 done: 7689 rcu_read_unlock(); 7690 7691 cb->args[0] = idx; 7692 return skb->len; 7693 } 7694 7695 static int nf_tables_dump_obj_start(struct netlink_callback *cb) 7696 { 7697 const struct nlattr * const *nla = cb->data; 7698 struct nft_obj_filter *filter = NULL; 7699 7700 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) { 7701 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 7702 if (!filter) 7703 return -ENOMEM; 7704 7705 if (nla[NFTA_OBJ_TABLE]) { 7706 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC); 7707 if (!filter->table) { 7708 kfree(filter); 7709 return -ENOMEM; 7710 } 7711 } 7712 7713 if (nla[NFTA_OBJ_TYPE]) 7714 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7715 } 7716 7717 cb->data = filter; 7718 return 0; 7719 } 7720 7721 static int nf_tables_dump_obj_done(struct netlink_callback *cb) 7722 { 7723 struct nft_obj_filter *filter = cb->data; 7724 7725 if (filter) { 7726 kfree(filter->table); 7727 kfree(filter); 7728 } 7729 7730 return 0; 7731 } 7732 7733 /* called with rcu_read_lock held */ 7734 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, 7735 const struct nlattr * const nla[]) 7736 { 7737 struct netlink_ext_ack *extack = info->extack; 7738 u8 genmask = nft_genmask_cur(info->net); 7739 u8 family = info->nfmsg->nfgen_family; 7740 const struct nft_table *table; 7741 struct net *net = info->net; 7742 struct nft_object *obj; 7743 struct sk_buff *skb2; 7744 bool reset = false; 7745 u32 objtype; 7746 int err; 7747 7748 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 7749 struct netlink_dump_control c = { 7750 .start = nf_tables_dump_obj_start, 7751 .dump = nf_tables_dump_obj, 7752 .done = nf_tables_dump_obj_done, 7753 .module = THIS_MODULE, 7754 .data = (void *)nla, 7755 }; 7756 7757 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 7758 } 7759 7760 if (!nla[NFTA_OBJ_NAME] || 7761 !nla[NFTA_OBJ_TYPE]) 7762 return -EINVAL; 7763 7764 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0); 7765 if (IS_ERR(table)) { 7766 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7767 return PTR_ERR(table); 7768 } 7769 7770 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7771 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 7772 if (IS_ERR(obj)) { 7773 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7774 return PTR_ERR(obj); 7775 } 7776 7777 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 7778 if (!skb2) 7779 return -ENOMEM; 7780 7781 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7782 reset = true; 7783 7784 if (reset) { 7785 const struct nftables_pernet *nft_net; 7786 char *buf; 7787 7788 nft_net = nft_pernet(net); 7789 buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq); 7790 7791 audit_log_nfcfg(buf, 7792 family, 7793 obj->handle, 7794 AUDIT_NFT_OP_OBJ_RESET, 7795 GFP_ATOMIC); 7796 kfree(buf); 7797 } 7798 7799 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid, 7800 info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 7801 family, table, obj, reset); 7802 if (err < 0) 7803 goto err_fill_obj_info; 7804 7805 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 7806 7807 err_fill_obj_info: 7808 kfree_skb(skb2); 7809 return err; 7810 } 7811 7812 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) 7813 { 7814 if (obj->ops->destroy) 7815 obj->ops->destroy(ctx, obj); 7816 7817 module_put(obj->ops->type->owner); 7818 kfree(obj->key.name); 7819 kfree(obj->udata); 7820 kfree(obj); 7821 } 7822 7823 static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info, 7824 const struct nlattr * const nla[]) 7825 { 7826 struct netlink_ext_ack *extack = info->extack; 7827 u8 genmask = nft_genmask_next(info->net); 7828 u8 family = info->nfmsg->nfgen_family; 7829 struct net *net = info->net; 7830 const struct nlattr *attr; 7831 struct nft_table *table; 7832 struct nft_object *obj; 7833 struct nft_ctx ctx; 7834 u32 objtype; 7835 7836 if (!nla[NFTA_OBJ_TYPE] || 7837 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) 7838 return -EINVAL; 7839 7840 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 7841 NETLINK_CB(skb).portid); 7842 if (IS_ERR(table)) { 7843 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7844 return PTR_ERR(table); 7845 } 7846 7847 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7848 if (nla[NFTA_OBJ_HANDLE]) { 7849 attr = nla[NFTA_OBJ_HANDLE]; 7850 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask); 7851 } else { 7852 attr = nla[NFTA_OBJ_NAME]; 7853 obj = nft_obj_lookup(net, table, attr, objtype, genmask); 7854 } 7855 7856 if (IS_ERR(obj)) { 7857 if (PTR_ERR(obj) == -ENOENT && 7858 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYOBJ) 7859 return 0; 7860 7861 NL_SET_BAD_ATTR(extack, attr); 7862 return PTR_ERR(obj); 7863 } 7864 if (obj->use > 0) { 7865 NL_SET_BAD_ATTR(extack, attr); 7866 return -EBUSY; 7867 } 7868 7869 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7870 7871 return nft_delobj(&ctx, obj); 7872 } 7873 7874 void nft_obj_notify(struct net *net, const struct nft_table *table, 7875 struct nft_object *obj, u32 portid, u32 seq, int event, 7876 u16 flags, int family, int report, gfp_t gfp) 7877 { 7878 struct nftables_pernet *nft_net = nft_pernet(net); 7879 struct sk_buff *skb; 7880 int err; 7881 char *buf = kasprintf(gfp, "%s:%u", 7882 table->name, nft_net->base_seq); 7883 7884 audit_log_nfcfg(buf, 7885 family, 7886 obj->handle, 7887 event == NFT_MSG_NEWOBJ ? 7888 AUDIT_NFT_OP_OBJ_REGISTER : 7889 AUDIT_NFT_OP_OBJ_UNREGISTER, 7890 gfp); 7891 kfree(buf); 7892 7893 if (!report && 7894 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 7895 return; 7896 7897 skb = nlmsg_new(NLMSG_GOODSIZE, gfp); 7898 if (skb == NULL) 7899 goto err; 7900 7901 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 7902 flags & (NLM_F_CREATE | NLM_F_EXCL), 7903 family, table, obj, false); 7904 if (err < 0) { 7905 kfree_skb(skb); 7906 goto err; 7907 } 7908 7909 nft_notify_enqueue(skb, report, &nft_net->notify_list); 7910 return; 7911 err: 7912 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 7913 } 7914 EXPORT_SYMBOL_GPL(nft_obj_notify); 7915 7916 static void nf_tables_obj_notify(const struct nft_ctx *ctx, 7917 struct nft_object *obj, int event) 7918 { 7919 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, 7920 ctx->flags, ctx->family, ctx->report, GFP_KERNEL); 7921 } 7922 7923 /* 7924 * Flow tables 7925 */ 7926 void nft_register_flowtable_type(struct nf_flowtable_type *type) 7927 { 7928 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7929 list_add_tail_rcu(&type->list, &nf_tables_flowtables); 7930 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7931 } 7932 EXPORT_SYMBOL_GPL(nft_register_flowtable_type); 7933 7934 void nft_unregister_flowtable_type(struct nf_flowtable_type *type) 7935 { 7936 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7937 list_del_rcu(&type->list); 7938 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7939 } 7940 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); 7941 7942 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 7943 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, 7944 .len = NFT_NAME_MAXLEN - 1 }, 7945 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, 7946 .len = NFT_NAME_MAXLEN - 1 }, 7947 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, 7948 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, 7949 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 }, 7950 }; 7951 7952 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table, 7953 const struct nlattr *nla, u8 genmask) 7954 { 7955 struct nft_flowtable *flowtable; 7956 7957 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 7958 if (!nla_strcmp(nla, flowtable->name) && 7959 nft_active_genmask(flowtable, genmask)) 7960 return flowtable; 7961 } 7962 return ERR_PTR(-ENOENT); 7963 } 7964 EXPORT_SYMBOL_GPL(nft_flowtable_lookup); 7965 7966 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, 7967 struct nft_flowtable *flowtable, 7968 enum nft_trans_phase phase) 7969 { 7970 switch (phase) { 7971 case NFT_TRANS_PREPARE_ERROR: 7972 case NFT_TRANS_PREPARE: 7973 case NFT_TRANS_ABORT: 7974 case NFT_TRANS_RELEASE: 7975 nft_use_dec(&flowtable->use); 7976 fallthrough; 7977 default: 7978 return; 7979 } 7980 } 7981 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable); 7982 7983 static struct nft_flowtable * 7984 nft_flowtable_lookup_byhandle(const struct nft_table *table, 7985 const struct nlattr *nla, u8 genmask) 7986 { 7987 struct nft_flowtable *flowtable; 7988 7989 list_for_each_entry(flowtable, &table->flowtables, list) { 7990 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && 7991 nft_active_genmask(flowtable, genmask)) 7992 return flowtable; 7993 } 7994 return ERR_PTR(-ENOENT); 7995 } 7996 7997 struct nft_flowtable_hook { 7998 u32 num; 7999 int priority; 8000 struct list_head list; 8001 }; 8002 8003 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { 8004 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, 8005 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, 8006 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, 8007 }; 8008 8009 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx, 8010 const struct nlattr * const nla[], 8011 struct nft_flowtable_hook *flowtable_hook, 8012 struct nft_flowtable *flowtable, 8013 struct netlink_ext_ack *extack, bool add) 8014 { 8015 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; 8016 struct nft_hook *hook; 8017 int hooknum, priority; 8018 int err; 8019 8020 INIT_LIST_HEAD(&flowtable_hook->list); 8021 8022 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, 8023 nla[NFTA_FLOWTABLE_HOOK], 8024 nft_flowtable_hook_policy, NULL); 8025 if (err < 0) 8026 return err; 8027 8028 if (add) { 8029 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || 8030 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 8031 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8032 return -ENOENT; 8033 } 8034 8035 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 8036 if (hooknum != NF_NETDEV_INGRESS) 8037 return -EOPNOTSUPP; 8038 8039 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 8040 8041 flowtable_hook->priority = priority; 8042 flowtable_hook->num = hooknum; 8043 } else { 8044 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) { 8045 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 8046 if (hooknum != flowtable->hooknum) 8047 return -EOPNOTSUPP; 8048 } 8049 8050 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 8051 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 8052 if (priority != flowtable->data.priority) 8053 return -EOPNOTSUPP; 8054 } 8055 8056 flowtable_hook->priority = flowtable->data.priority; 8057 flowtable_hook->num = flowtable->hooknum; 8058 } 8059 8060 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) { 8061 err = nf_tables_parse_netdev_hooks(ctx->net, 8062 tb[NFTA_FLOWTABLE_HOOK_DEVS], 8063 &flowtable_hook->list, 8064 extack); 8065 if (err < 0) 8066 return err; 8067 } 8068 8069 list_for_each_entry(hook, &flowtable_hook->list, list) { 8070 hook->ops.pf = NFPROTO_NETDEV; 8071 hook->ops.hooknum = flowtable_hook->num; 8072 hook->ops.priority = flowtable_hook->priority; 8073 hook->ops.priv = &flowtable->data; 8074 hook->ops.hook = flowtable->data.type->hook; 8075 } 8076 8077 return err; 8078 } 8079 8080 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) 8081 { 8082 const struct nf_flowtable_type *type; 8083 8084 list_for_each_entry(type, &nf_tables_flowtables, list) { 8085 if (family == type->family) 8086 return type; 8087 } 8088 return NULL; 8089 } 8090 8091 static const struct nf_flowtable_type * 8092 nft_flowtable_type_get(struct net *net, u8 family) 8093 { 8094 const struct nf_flowtable_type *type; 8095 8096 type = __nft_flowtable_type_get(family); 8097 if (type != NULL && try_module_get(type->owner)) 8098 return type; 8099 8100 lockdep_nfnl_nft_mutex_not_held(); 8101 #ifdef CONFIG_MODULES 8102 if (type == NULL) { 8103 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN) 8104 return ERR_PTR(-EAGAIN); 8105 } 8106 #endif 8107 return ERR_PTR(-ENOENT); 8108 } 8109 8110 /* Only called from error and netdev event paths. */ 8111 static void nft_unregister_flowtable_hook(struct net *net, 8112 struct nft_flowtable *flowtable, 8113 struct nft_hook *hook) 8114 { 8115 nf_unregister_net_hook(net, &hook->ops); 8116 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 8117 FLOW_BLOCK_UNBIND); 8118 } 8119 8120 static void __nft_unregister_flowtable_net_hooks(struct net *net, 8121 struct list_head *hook_list, 8122 bool release_netdev) 8123 { 8124 struct nft_hook *hook, *next; 8125 8126 list_for_each_entry_safe(hook, next, hook_list, list) { 8127 nf_unregister_net_hook(net, &hook->ops); 8128 if (release_netdev) { 8129 list_del(&hook->list); 8130 kfree_rcu(hook, rcu); 8131 } 8132 } 8133 } 8134 8135 static void nft_unregister_flowtable_net_hooks(struct net *net, 8136 struct list_head *hook_list) 8137 { 8138 __nft_unregister_flowtable_net_hooks(net, hook_list, false); 8139 } 8140 8141 static int nft_register_flowtable_net_hooks(struct net *net, 8142 struct nft_table *table, 8143 struct list_head *hook_list, 8144 struct nft_flowtable *flowtable) 8145 { 8146 struct nft_hook *hook, *hook2, *next; 8147 struct nft_flowtable *ft; 8148 int err, i = 0; 8149 8150 list_for_each_entry(hook, hook_list, list) { 8151 list_for_each_entry(ft, &table->flowtables, list) { 8152 if (!nft_is_active_next(net, ft)) 8153 continue; 8154 8155 list_for_each_entry(hook2, &ft->hook_list, list) { 8156 if (hook->ops.dev == hook2->ops.dev && 8157 hook->ops.pf == hook2->ops.pf) { 8158 err = -EEXIST; 8159 goto err_unregister_net_hooks; 8160 } 8161 } 8162 } 8163 8164 err = flowtable->data.type->setup(&flowtable->data, 8165 hook->ops.dev, 8166 FLOW_BLOCK_BIND); 8167 if (err < 0) 8168 goto err_unregister_net_hooks; 8169 8170 err = nf_register_net_hook(net, &hook->ops); 8171 if (err < 0) { 8172 flowtable->data.type->setup(&flowtable->data, 8173 hook->ops.dev, 8174 FLOW_BLOCK_UNBIND); 8175 goto err_unregister_net_hooks; 8176 } 8177 8178 i++; 8179 } 8180 8181 return 0; 8182 8183 err_unregister_net_hooks: 8184 list_for_each_entry_safe(hook, next, hook_list, list) { 8185 if (i-- <= 0) 8186 break; 8187 8188 nft_unregister_flowtable_hook(net, flowtable, hook); 8189 list_del_rcu(&hook->list); 8190 kfree_rcu(hook, rcu); 8191 } 8192 8193 return err; 8194 } 8195 8196 static void nft_hooks_destroy(struct list_head *hook_list) 8197 { 8198 struct nft_hook *hook, *next; 8199 8200 list_for_each_entry_safe(hook, next, hook_list, list) { 8201 list_del_rcu(&hook->list); 8202 kfree_rcu(hook, rcu); 8203 } 8204 } 8205 8206 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, 8207 struct nft_flowtable *flowtable, 8208 struct netlink_ext_ack *extack) 8209 { 8210 const struct nlattr * const *nla = ctx->nla; 8211 struct nft_flowtable_hook flowtable_hook; 8212 struct nft_hook *hook, *next; 8213 struct nft_trans *trans; 8214 bool unregister = false; 8215 u32 flags; 8216 int err; 8217 8218 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 8219 extack, false); 8220 if (err < 0) 8221 return err; 8222 8223 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 8224 if (nft_hook_list_find(&flowtable->hook_list, hook)) { 8225 list_del(&hook->list); 8226 kfree(hook); 8227 } 8228 } 8229 8230 if (nla[NFTA_FLOWTABLE_FLAGS]) { 8231 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 8232 if (flags & ~NFT_FLOWTABLE_MASK) { 8233 err = -EOPNOTSUPP; 8234 goto err_flowtable_update_hook; 8235 } 8236 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ 8237 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) { 8238 err = -EOPNOTSUPP; 8239 goto err_flowtable_update_hook; 8240 } 8241 } else { 8242 flags = flowtable->data.flags; 8243 } 8244 8245 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, 8246 &flowtable_hook.list, flowtable); 8247 if (err < 0) 8248 goto err_flowtable_update_hook; 8249 8250 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE, 8251 sizeof(struct nft_trans_flowtable)); 8252 if (!trans) { 8253 unregister = true; 8254 err = -ENOMEM; 8255 goto err_flowtable_update_hook; 8256 } 8257 8258 nft_trans_flowtable_flags(trans) = flags; 8259 nft_trans_flowtable(trans) = flowtable; 8260 nft_trans_flowtable_update(trans) = true; 8261 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 8262 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans)); 8263 8264 nft_trans_commit_list_add_tail(ctx->net, trans); 8265 8266 return 0; 8267 8268 err_flowtable_update_hook: 8269 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 8270 if (unregister) 8271 nft_unregister_flowtable_hook(ctx->net, flowtable, hook); 8272 list_del_rcu(&hook->list); 8273 kfree_rcu(hook, rcu); 8274 } 8275 8276 return err; 8277 8278 } 8279 8280 static int nf_tables_newflowtable(struct sk_buff *skb, 8281 const struct nfnl_info *info, 8282 const struct nlattr * const nla[]) 8283 { 8284 struct netlink_ext_ack *extack = info->extack; 8285 struct nft_flowtable_hook flowtable_hook; 8286 u8 genmask = nft_genmask_next(info->net); 8287 u8 family = info->nfmsg->nfgen_family; 8288 const struct nf_flowtable_type *type; 8289 struct nft_flowtable *flowtable; 8290 struct nft_hook *hook, *next; 8291 struct net *net = info->net; 8292 struct nft_table *table; 8293 struct nft_ctx ctx; 8294 int err; 8295 8296 if (!nla[NFTA_FLOWTABLE_TABLE] || 8297 !nla[NFTA_FLOWTABLE_NAME] || 8298 !nla[NFTA_FLOWTABLE_HOOK]) 8299 return -EINVAL; 8300 8301 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8302 genmask, NETLINK_CB(skb).portid); 8303 if (IS_ERR(table)) { 8304 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 8305 return PTR_ERR(table); 8306 } 8307 8308 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 8309 genmask); 8310 if (IS_ERR(flowtable)) { 8311 err = PTR_ERR(flowtable); 8312 if (err != -ENOENT) { 8313 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8314 return err; 8315 } 8316 } else { 8317 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 8318 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8319 return -EEXIST; 8320 } 8321 8322 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8323 8324 return nft_flowtable_update(&ctx, info->nlh, flowtable, extack); 8325 } 8326 8327 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8328 8329 if (!nft_use_inc(&table->use)) 8330 return -EMFILE; 8331 8332 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT); 8333 if (!flowtable) { 8334 err = -ENOMEM; 8335 goto flowtable_alloc; 8336 } 8337 8338 flowtable->table = table; 8339 flowtable->handle = nf_tables_alloc_handle(table); 8340 INIT_LIST_HEAD(&flowtable->hook_list); 8341 8342 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT); 8343 if (!flowtable->name) { 8344 err = -ENOMEM; 8345 goto err1; 8346 } 8347 8348 type = nft_flowtable_type_get(net, family); 8349 if (IS_ERR(type)) { 8350 err = PTR_ERR(type); 8351 goto err2; 8352 } 8353 8354 if (nla[NFTA_FLOWTABLE_FLAGS]) { 8355 flowtable->data.flags = 8356 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 8357 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { 8358 err = -EOPNOTSUPP; 8359 goto err3; 8360 } 8361 } 8362 8363 write_pnet(&flowtable->data.net, net); 8364 flowtable->data.type = type; 8365 err = type->init(&flowtable->data); 8366 if (err < 0) 8367 goto err3; 8368 8369 err = nft_flowtable_parse_hook(&ctx, nla, &flowtable_hook, flowtable, 8370 extack, true); 8371 if (err < 0) 8372 goto err4; 8373 8374 list_splice(&flowtable_hook.list, &flowtable->hook_list); 8375 flowtable->data.priority = flowtable_hook.priority; 8376 flowtable->hooknum = flowtable_hook.num; 8377 8378 err = nft_register_flowtable_net_hooks(ctx.net, table, 8379 &flowtable->hook_list, 8380 flowtable); 8381 if (err < 0) { 8382 nft_hooks_destroy(&flowtable->hook_list); 8383 goto err4; 8384 } 8385 8386 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); 8387 if (err < 0) 8388 goto err5; 8389 8390 list_add_tail_rcu(&flowtable->list, &table->flowtables); 8391 8392 return 0; 8393 err5: 8394 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 8395 nft_unregister_flowtable_hook(net, flowtable, hook); 8396 list_del_rcu(&hook->list); 8397 kfree_rcu(hook, rcu); 8398 } 8399 err4: 8400 flowtable->data.type->free(&flowtable->data); 8401 err3: 8402 module_put(type->owner); 8403 err2: 8404 kfree(flowtable->name); 8405 err1: 8406 kfree(flowtable); 8407 flowtable_alloc: 8408 nft_use_dec_restore(&table->use); 8409 8410 return err; 8411 } 8412 8413 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook) 8414 { 8415 struct nft_hook *this, *next; 8416 8417 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) { 8418 list_del(&this->list); 8419 kfree(this); 8420 } 8421 } 8422 8423 static int nft_delflowtable_hook(struct nft_ctx *ctx, 8424 struct nft_flowtable *flowtable, 8425 struct netlink_ext_ack *extack) 8426 { 8427 const struct nlattr * const *nla = ctx->nla; 8428 struct nft_flowtable_hook flowtable_hook; 8429 LIST_HEAD(flowtable_del_list); 8430 struct nft_hook *this, *hook; 8431 struct nft_trans *trans; 8432 int err; 8433 8434 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 8435 extack, false); 8436 if (err < 0) 8437 return err; 8438 8439 list_for_each_entry(this, &flowtable_hook.list, list) { 8440 hook = nft_hook_list_find(&flowtable->hook_list, this); 8441 if (!hook) { 8442 err = -ENOENT; 8443 goto err_flowtable_del_hook; 8444 } 8445 list_move(&hook->list, &flowtable_del_list); 8446 } 8447 8448 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE, 8449 sizeof(struct nft_trans_flowtable)); 8450 if (!trans) { 8451 err = -ENOMEM; 8452 goto err_flowtable_del_hook; 8453 } 8454 8455 nft_trans_flowtable(trans) = flowtable; 8456 nft_trans_flowtable_update(trans) = true; 8457 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 8458 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans)); 8459 nft_flowtable_hook_release(&flowtable_hook); 8460 8461 nft_trans_commit_list_add_tail(ctx->net, trans); 8462 8463 return 0; 8464 8465 err_flowtable_del_hook: 8466 list_splice(&flowtable_del_list, &flowtable->hook_list); 8467 nft_flowtable_hook_release(&flowtable_hook); 8468 8469 return err; 8470 } 8471 8472 static int nf_tables_delflowtable(struct sk_buff *skb, 8473 const struct nfnl_info *info, 8474 const struct nlattr * const nla[]) 8475 { 8476 struct netlink_ext_ack *extack = info->extack; 8477 u8 genmask = nft_genmask_next(info->net); 8478 u8 family = info->nfmsg->nfgen_family; 8479 struct nft_flowtable *flowtable; 8480 struct net *net = info->net; 8481 const struct nlattr *attr; 8482 struct nft_table *table; 8483 struct nft_ctx ctx; 8484 8485 if (!nla[NFTA_FLOWTABLE_TABLE] || 8486 (!nla[NFTA_FLOWTABLE_NAME] && 8487 !nla[NFTA_FLOWTABLE_HANDLE])) 8488 return -EINVAL; 8489 8490 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8491 genmask, NETLINK_CB(skb).portid); 8492 if (IS_ERR(table)) { 8493 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 8494 return PTR_ERR(table); 8495 } 8496 8497 if (nla[NFTA_FLOWTABLE_HANDLE]) { 8498 attr = nla[NFTA_FLOWTABLE_HANDLE]; 8499 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask); 8500 } else { 8501 attr = nla[NFTA_FLOWTABLE_NAME]; 8502 flowtable = nft_flowtable_lookup(table, attr, genmask); 8503 } 8504 8505 if (IS_ERR(flowtable)) { 8506 if (PTR_ERR(flowtable) == -ENOENT && 8507 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYFLOWTABLE) 8508 return 0; 8509 8510 NL_SET_BAD_ATTR(extack, attr); 8511 return PTR_ERR(flowtable); 8512 } 8513 8514 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8515 8516 if (nla[NFTA_FLOWTABLE_HOOK]) 8517 return nft_delflowtable_hook(&ctx, flowtable, extack); 8518 8519 if (flowtable->use > 0) { 8520 NL_SET_BAD_ATTR(extack, attr); 8521 return -EBUSY; 8522 } 8523 8524 return nft_delflowtable(&ctx, flowtable); 8525 } 8526 8527 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 8528 u32 portid, u32 seq, int event, 8529 u32 flags, int family, 8530 struct nft_flowtable *flowtable, 8531 struct list_head *hook_list) 8532 { 8533 struct nlattr *nest, *nest_devs; 8534 struct nft_hook *hook; 8535 struct nlmsghdr *nlh; 8536 8537 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 8538 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 8539 NFNETLINK_V0, nft_base_seq(net)); 8540 if (!nlh) 8541 goto nla_put_failure; 8542 8543 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || 8544 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || 8545 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), 8546 NFTA_FLOWTABLE_PAD)) 8547 goto nla_put_failure; 8548 8549 if (event == NFT_MSG_DELFLOWTABLE && !hook_list) { 8550 nlmsg_end(skb, nlh); 8551 return 0; 8552 } 8553 8554 if (nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || 8555 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) 8556 goto nla_put_failure; 8557 8558 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK); 8559 if (!nest) 8560 goto nla_put_failure; 8561 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || 8562 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority))) 8563 goto nla_put_failure; 8564 8565 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS); 8566 if (!nest_devs) 8567 goto nla_put_failure; 8568 8569 if (!hook_list) 8570 hook_list = &flowtable->hook_list; 8571 8572 list_for_each_entry_rcu(hook, hook_list, list) { 8573 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name)) 8574 goto nla_put_failure; 8575 } 8576 nla_nest_end(skb, nest_devs); 8577 nla_nest_end(skb, nest); 8578 8579 nlmsg_end(skb, nlh); 8580 return 0; 8581 8582 nla_put_failure: 8583 nlmsg_trim(skb, nlh); 8584 return -1; 8585 } 8586 8587 struct nft_flowtable_filter { 8588 char *table; 8589 }; 8590 8591 static int nf_tables_dump_flowtable(struct sk_buff *skb, 8592 struct netlink_callback *cb) 8593 { 8594 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 8595 struct nft_flowtable_filter *filter = cb->data; 8596 unsigned int idx = 0, s_idx = cb->args[0]; 8597 struct net *net = sock_net(skb->sk); 8598 int family = nfmsg->nfgen_family; 8599 struct nft_flowtable *flowtable; 8600 struct nftables_pernet *nft_net; 8601 const struct nft_table *table; 8602 8603 rcu_read_lock(); 8604 nft_net = nft_pernet(net); 8605 cb->seq = READ_ONCE(nft_net->base_seq); 8606 8607 list_for_each_entry_rcu(table, &nft_net->tables, list) { 8608 if (family != NFPROTO_UNSPEC && family != table->family) 8609 continue; 8610 8611 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 8612 if (!nft_is_active(net, flowtable)) 8613 goto cont; 8614 if (idx < s_idx) 8615 goto cont; 8616 if (idx > s_idx) 8617 memset(&cb->args[1], 0, 8618 sizeof(cb->args) - sizeof(cb->args[0])); 8619 if (filter && filter->table && 8620 strcmp(filter->table, table->name)) 8621 goto cont; 8622 8623 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, 8624 cb->nlh->nlmsg_seq, 8625 NFT_MSG_NEWFLOWTABLE, 8626 NLM_F_MULTI | NLM_F_APPEND, 8627 table->family, 8628 flowtable, NULL) < 0) 8629 goto done; 8630 8631 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 8632 cont: 8633 idx++; 8634 } 8635 } 8636 done: 8637 rcu_read_unlock(); 8638 8639 cb->args[0] = idx; 8640 return skb->len; 8641 } 8642 8643 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb) 8644 { 8645 const struct nlattr * const *nla = cb->data; 8646 struct nft_flowtable_filter *filter = NULL; 8647 8648 if (nla[NFTA_FLOWTABLE_TABLE]) { 8649 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 8650 if (!filter) 8651 return -ENOMEM; 8652 8653 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], 8654 GFP_ATOMIC); 8655 if (!filter->table) { 8656 kfree(filter); 8657 return -ENOMEM; 8658 } 8659 } 8660 8661 cb->data = filter; 8662 return 0; 8663 } 8664 8665 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) 8666 { 8667 struct nft_flowtable_filter *filter = cb->data; 8668 8669 if (!filter) 8670 return 0; 8671 8672 kfree(filter->table); 8673 kfree(filter); 8674 8675 return 0; 8676 } 8677 8678 /* called with rcu_read_lock held */ 8679 static int nf_tables_getflowtable(struct sk_buff *skb, 8680 const struct nfnl_info *info, 8681 const struct nlattr * const nla[]) 8682 { 8683 u8 genmask = nft_genmask_cur(info->net); 8684 u8 family = info->nfmsg->nfgen_family; 8685 struct nft_flowtable *flowtable; 8686 const struct nft_table *table; 8687 struct net *net = info->net; 8688 struct sk_buff *skb2; 8689 int err; 8690 8691 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8692 struct netlink_dump_control c = { 8693 .start = nf_tables_dump_flowtable_start, 8694 .dump = nf_tables_dump_flowtable, 8695 .done = nf_tables_dump_flowtable_done, 8696 .module = THIS_MODULE, 8697 .data = (void *)nla, 8698 }; 8699 8700 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8701 } 8702 8703 if (!nla[NFTA_FLOWTABLE_NAME]) 8704 return -EINVAL; 8705 8706 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8707 genmask, 0); 8708 if (IS_ERR(table)) 8709 return PTR_ERR(table); 8710 8711 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 8712 genmask); 8713 if (IS_ERR(flowtable)) 8714 return PTR_ERR(flowtable); 8715 8716 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8717 if (!skb2) 8718 return -ENOMEM; 8719 8720 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, 8721 info->nlh->nlmsg_seq, 8722 NFT_MSG_NEWFLOWTABLE, 0, family, 8723 flowtable, NULL); 8724 if (err < 0) 8725 goto err_fill_flowtable_info; 8726 8727 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 8728 8729 err_fill_flowtable_info: 8730 kfree_skb(skb2); 8731 return err; 8732 } 8733 8734 static void nf_tables_flowtable_notify(struct nft_ctx *ctx, 8735 struct nft_flowtable *flowtable, 8736 struct list_head *hook_list, int event) 8737 { 8738 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 8739 struct sk_buff *skb; 8740 u16 flags = 0; 8741 int err; 8742 8743 if (!ctx->report && 8744 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 8745 return; 8746 8747 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8748 if (skb == NULL) 8749 goto err; 8750 8751 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 8752 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 8753 8754 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, 8755 ctx->seq, event, flags, 8756 ctx->family, flowtable, hook_list); 8757 if (err < 0) { 8758 kfree_skb(skb); 8759 goto err; 8760 } 8761 8762 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 8763 return; 8764 err: 8765 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 8766 } 8767 8768 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 8769 { 8770 struct nft_hook *hook, *next; 8771 8772 flowtable->data.type->free(&flowtable->data); 8773 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 8774 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 8775 FLOW_BLOCK_UNBIND); 8776 list_del_rcu(&hook->list); 8777 kfree(hook); 8778 } 8779 kfree(flowtable->name); 8780 module_put(flowtable->data.type->owner); 8781 kfree(flowtable); 8782 } 8783 8784 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 8785 u32 portid, u32 seq) 8786 { 8787 struct nftables_pernet *nft_net = nft_pernet(net); 8788 struct nlmsghdr *nlh; 8789 char buf[TASK_COMM_LEN]; 8790 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); 8791 8792 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, 8793 NFNETLINK_V0, nft_base_seq(net)); 8794 if (!nlh) 8795 goto nla_put_failure; 8796 8797 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) || 8798 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || 8799 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) 8800 goto nla_put_failure; 8801 8802 nlmsg_end(skb, nlh); 8803 return 0; 8804 8805 nla_put_failure: 8806 nlmsg_trim(skb, nlh); 8807 return -EMSGSIZE; 8808 } 8809 8810 static void nft_flowtable_event(unsigned long event, struct net_device *dev, 8811 struct nft_flowtable *flowtable) 8812 { 8813 struct nft_hook *hook; 8814 8815 list_for_each_entry(hook, &flowtable->hook_list, list) { 8816 if (hook->ops.dev != dev) 8817 continue; 8818 8819 /* flow_offload_netdev_event() cleans up entries for us. */ 8820 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook); 8821 list_del_rcu(&hook->list); 8822 kfree_rcu(hook, rcu); 8823 break; 8824 } 8825 } 8826 8827 static int nf_tables_flowtable_event(struct notifier_block *this, 8828 unsigned long event, void *ptr) 8829 { 8830 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 8831 struct nft_flowtable *flowtable; 8832 struct nftables_pernet *nft_net; 8833 struct nft_table *table; 8834 struct net *net; 8835 8836 if (event != NETDEV_UNREGISTER) 8837 return 0; 8838 8839 net = dev_net(dev); 8840 nft_net = nft_pernet(net); 8841 mutex_lock(&nft_net->commit_mutex); 8842 list_for_each_entry(table, &nft_net->tables, list) { 8843 list_for_each_entry(flowtable, &table->flowtables, list) { 8844 nft_flowtable_event(event, dev, flowtable); 8845 } 8846 } 8847 mutex_unlock(&nft_net->commit_mutex); 8848 8849 return NOTIFY_DONE; 8850 } 8851 8852 static struct notifier_block nf_tables_flowtable_notifier = { 8853 .notifier_call = nf_tables_flowtable_event, 8854 }; 8855 8856 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, 8857 int event) 8858 { 8859 struct nlmsghdr *nlh = nlmsg_hdr(skb); 8860 struct sk_buff *skb2; 8861 int err; 8862 8863 if (!nlmsg_report(nlh) && 8864 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 8865 return; 8866 8867 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8868 if (skb2 == NULL) 8869 goto err; 8870 8871 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 8872 nlh->nlmsg_seq); 8873 if (err < 0) { 8874 kfree_skb(skb2); 8875 goto err; 8876 } 8877 8878 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8879 nlmsg_report(nlh), GFP_KERNEL); 8880 return; 8881 err: 8882 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8883 -ENOBUFS); 8884 } 8885 8886 static int nf_tables_getgen(struct sk_buff *skb, const struct nfnl_info *info, 8887 const struct nlattr * const nla[]) 8888 { 8889 struct sk_buff *skb2; 8890 int err; 8891 8892 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8893 if (skb2 == NULL) 8894 return -ENOMEM; 8895 8896 err = nf_tables_fill_gen_info(skb2, info->net, NETLINK_CB(skb).portid, 8897 info->nlh->nlmsg_seq); 8898 if (err < 0) 8899 goto err_fill_gen_info; 8900 8901 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 8902 8903 err_fill_gen_info: 8904 kfree_skb(skb2); 8905 return err; 8906 } 8907 8908 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 8909 [NFT_MSG_NEWTABLE] = { 8910 .call = nf_tables_newtable, 8911 .type = NFNL_CB_BATCH, 8912 .attr_count = NFTA_TABLE_MAX, 8913 .policy = nft_table_policy, 8914 }, 8915 [NFT_MSG_GETTABLE] = { 8916 .call = nf_tables_gettable, 8917 .type = NFNL_CB_RCU, 8918 .attr_count = NFTA_TABLE_MAX, 8919 .policy = nft_table_policy, 8920 }, 8921 [NFT_MSG_DELTABLE] = { 8922 .call = nf_tables_deltable, 8923 .type = NFNL_CB_BATCH, 8924 .attr_count = NFTA_TABLE_MAX, 8925 .policy = nft_table_policy, 8926 }, 8927 [NFT_MSG_DESTROYTABLE] = { 8928 .call = nf_tables_deltable, 8929 .type = NFNL_CB_BATCH, 8930 .attr_count = NFTA_TABLE_MAX, 8931 .policy = nft_table_policy, 8932 }, 8933 [NFT_MSG_NEWCHAIN] = { 8934 .call = nf_tables_newchain, 8935 .type = NFNL_CB_BATCH, 8936 .attr_count = NFTA_CHAIN_MAX, 8937 .policy = nft_chain_policy, 8938 }, 8939 [NFT_MSG_GETCHAIN] = { 8940 .call = nf_tables_getchain, 8941 .type = NFNL_CB_RCU, 8942 .attr_count = NFTA_CHAIN_MAX, 8943 .policy = nft_chain_policy, 8944 }, 8945 [NFT_MSG_DELCHAIN] = { 8946 .call = nf_tables_delchain, 8947 .type = NFNL_CB_BATCH, 8948 .attr_count = NFTA_CHAIN_MAX, 8949 .policy = nft_chain_policy, 8950 }, 8951 [NFT_MSG_DESTROYCHAIN] = { 8952 .call = nf_tables_delchain, 8953 .type = NFNL_CB_BATCH, 8954 .attr_count = NFTA_CHAIN_MAX, 8955 .policy = nft_chain_policy, 8956 }, 8957 [NFT_MSG_NEWRULE] = { 8958 .call = nf_tables_newrule, 8959 .type = NFNL_CB_BATCH, 8960 .attr_count = NFTA_RULE_MAX, 8961 .policy = nft_rule_policy, 8962 }, 8963 [NFT_MSG_GETRULE] = { 8964 .call = nf_tables_getrule, 8965 .type = NFNL_CB_RCU, 8966 .attr_count = NFTA_RULE_MAX, 8967 .policy = nft_rule_policy, 8968 }, 8969 [NFT_MSG_GETRULE_RESET] = { 8970 .call = nf_tables_getrule, 8971 .type = NFNL_CB_RCU, 8972 .attr_count = NFTA_RULE_MAX, 8973 .policy = nft_rule_policy, 8974 }, 8975 [NFT_MSG_DELRULE] = { 8976 .call = nf_tables_delrule, 8977 .type = NFNL_CB_BATCH, 8978 .attr_count = NFTA_RULE_MAX, 8979 .policy = nft_rule_policy, 8980 }, 8981 [NFT_MSG_DESTROYRULE] = { 8982 .call = nf_tables_delrule, 8983 .type = NFNL_CB_BATCH, 8984 .attr_count = NFTA_RULE_MAX, 8985 .policy = nft_rule_policy, 8986 }, 8987 [NFT_MSG_NEWSET] = { 8988 .call = nf_tables_newset, 8989 .type = NFNL_CB_BATCH, 8990 .attr_count = NFTA_SET_MAX, 8991 .policy = nft_set_policy, 8992 }, 8993 [NFT_MSG_GETSET] = { 8994 .call = nf_tables_getset, 8995 .type = NFNL_CB_RCU, 8996 .attr_count = NFTA_SET_MAX, 8997 .policy = nft_set_policy, 8998 }, 8999 [NFT_MSG_DELSET] = { 9000 .call = nf_tables_delset, 9001 .type = NFNL_CB_BATCH, 9002 .attr_count = NFTA_SET_MAX, 9003 .policy = nft_set_policy, 9004 }, 9005 [NFT_MSG_DESTROYSET] = { 9006 .call = nf_tables_delset, 9007 .type = NFNL_CB_BATCH, 9008 .attr_count = NFTA_SET_MAX, 9009 .policy = nft_set_policy, 9010 }, 9011 [NFT_MSG_NEWSETELEM] = { 9012 .call = nf_tables_newsetelem, 9013 .type = NFNL_CB_BATCH, 9014 .attr_count = NFTA_SET_ELEM_LIST_MAX, 9015 .policy = nft_set_elem_list_policy, 9016 }, 9017 [NFT_MSG_GETSETELEM] = { 9018 .call = nf_tables_getsetelem, 9019 .type = NFNL_CB_RCU, 9020 .attr_count = NFTA_SET_ELEM_LIST_MAX, 9021 .policy = nft_set_elem_list_policy, 9022 }, 9023 [NFT_MSG_GETSETELEM_RESET] = { 9024 .call = nf_tables_getsetelem, 9025 .type = NFNL_CB_RCU, 9026 .attr_count = NFTA_SET_ELEM_LIST_MAX, 9027 .policy = nft_set_elem_list_policy, 9028 }, 9029 [NFT_MSG_DELSETELEM] = { 9030 .call = nf_tables_delsetelem, 9031 .type = NFNL_CB_BATCH, 9032 .attr_count = NFTA_SET_ELEM_LIST_MAX, 9033 .policy = nft_set_elem_list_policy, 9034 }, 9035 [NFT_MSG_DESTROYSETELEM] = { 9036 .call = nf_tables_delsetelem, 9037 .type = NFNL_CB_BATCH, 9038 .attr_count = NFTA_SET_ELEM_LIST_MAX, 9039 .policy = nft_set_elem_list_policy, 9040 }, 9041 [NFT_MSG_GETGEN] = { 9042 .call = nf_tables_getgen, 9043 .type = NFNL_CB_RCU, 9044 }, 9045 [NFT_MSG_NEWOBJ] = { 9046 .call = nf_tables_newobj, 9047 .type = NFNL_CB_BATCH, 9048 .attr_count = NFTA_OBJ_MAX, 9049 .policy = nft_obj_policy, 9050 }, 9051 [NFT_MSG_GETOBJ] = { 9052 .call = nf_tables_getobj, 9053 .type = NFNL_CB_RCU, 9054 .attr_count = NFTA_OBJ_MAX, 9055 .policy = nft_obj_policy, 9056 }, 9057 [NFT_MSG_DELOBJ] = { 9058 .call = nf_tables_delobj, 9059 .type = NFNL_CB_BATCH, 9060 .attr_count = NFTA_OBJ_MAX, 9061 .policy = nft_obj_policy, 9062 }, 9063 [NFT_MSG_DESTROYOBJ] = { 9064 .call = nf_tables_delobj, 9065 .type = NFNL_CB_BATCH, 9066 .attr_count = NFTA_OBJ_MAX, 9067 .policy = nft_obj_policy, 9068 }, 9069 [NFT_MSG_GETOBJ_RESET] = { 9070 .call = nf_tables_getobj, 9071 .type = NFNL_CB_RCU, 9072 .attr_count = NFTA_OBJ_MAX, 9073 .policy = nft_obj_policy, 9074 }, 9075 [NFT_MSG_NEWFLOWTABLE] = { 9076 .call = nf_tables_newflowtable, 9077 .type = NFNL_CB_BATCH, 9078 .attr_count = NFTA_FLOWTABLE_MAX, 9079 .policy = nft_flowtable_policy, 9080 }, 9081 [NFT_MSG_GETFLOWTABLE] = { 9082 .call = nf_tables_getflowtable, 9083 .type = NFNL_CB_RCU, 9084 .attr_count = NFTA_FLOWTABLE_MAX, 9085 .policy = nft_flowtable_policy, 9086 }, 9087 [NFT_MSG_DELFLOWTABLE] = { 9088 .call = nf_tables_delflowtable, 9089 .type = NFNL_CB_BATCH, 9090 .attr_count = NFTA_FLOWTABLE_MAX, 9091 .policy = nft_flowtable_policy, 9092 }, 9093 [NFT_MSG_DESTROYFLOWTABLE] = { 9094 .call = nf_tables_delflowtable, 9095 .type = NFNL_CB_BATCH, 9096 .attr_count = NFTA_FLOWTABLE_MAX, 9097 .policy = nft_flowtable_policy, 9098 }, 9099 }; 9100 9101 static int nf_tables_validate(struct net *net) 9102 { 9103 struct nftables_pernet *nft_net = nft_pernet(net); 9104 struct nft_table *table; 9105 9106 list_for_each_entry(table, &nft_net->tables, list) { 9107 switch (table->validate_state) { 9108 case NFT_VALIDATE_SKIP: 9109 continue; 9110 case NFT_VALIDATE_NEED: 9111 nft_validate_state_update(table, NFT_VALIDATE_DO); 9112 fallthrough; 9113 case NFT_VALIDATE_DO: 9114 if (nft_table_validate(net, table) < 0) 9115 return -EAGAIN; 9116 9117 nft_validate_state_update(table, NFT_VALIDATE_SKIP); 9118 break; 9119 } 9120 } 9121 9122 return 0; 9123 } 9124 9125 /* a drop policy has to be deferred until all rules have been activated, 9126 * otherwise a large ruleset that contains a drop-policy base chain will 9127 * cause all packets to get dropped until the full transaction has been 9128 * processed. 9129 * 9130 * We defer the drop policy until the transaction has been finalized. 9131 */ 9132 static void nft_chain_commit_drop_policy(struct nft_trans *trans) 9133 { 9134 struct nft_base_chain *basechain; 9135 9136 if (nft_trans_chain_policy(trans) != NF_DROP) 9137 return; 9138 9139 if (!nft_is_base_chain(trans->ctx.chain)) 9140 return; 9141 9142 basechain = nft_base_chain(trans->ctx.chain); 9143 basechain->policy = NF_DROP; 9144 } 9145 9146 static void nft_chain_commit_update(struct nft_trans *trans) 9147 { 9148 struct nft_base_chain *basechain; 9149 9150 if (nft_trans_chain_name(trans)) { 9151 rhltable_remove(&trans->ctx.table->chains_ht, 9152 &trans->ctx.chain->rhlhead, 9153 nft_chain_ht_params); 9154 swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); 9155 rhltable_insert_key(&trans->ctx.table->chains_ht, 9156 trans->ctx.chain->name, 9157 &trans->ctx.chain->rhlhead, 9158 nft_chain_ht_params); 9159 } 9160 9161 if (!nft_is_base_chain(trans->ctx.chain)) 9162 return; 9163 9164 nft_chain_stats_replace(trans); 9165 9166 basechain = nft_base_chain(trans->ctx.chain); 9167 9168 switch (nft_trans_chain_policy(trans)) { 9169 case NF_DROP: 9170 case NF_ACCEPT: 9171 basechain->policy = nft_trans_chain_policy(trans); 9172 break; 9173 } 9174 } 9175 9176 static void nft_obj_commit_update(struct nft_trans *trans) 9177 { 9178 struct nft_object *newobj; 9179 struct nft_object *obj; 9180 9181 obj = nft_trans_obj(trans); 9182 newobj = nft_trans_obj_newobj(trans); 9183 9184 if (obj->ops->update) 9185 obj->ops->update(obj, newobj); 9186 9187 nft_obj_destroy(&trans->ctx, newobj); 9188 } 9189 9190 static void nft_commit_release(struct nft_trans *trans) 9191 { 9192 switch (trans->msg_type) { 9193 case NFT_MSG_DELTABLE: 9194 case NFT_MSG_DESTROYTABLE: 9195 nf_tables_table_destroy(&trans->ctx); 9196 break; 9197 case NFT_MSG_NEWCHAIN: 9198 free_percpu(nft_trans_chain_stats(trans)); 9199 kfree(nft_trans_chain_name(trans)); 9200 break; 9201 case NFT_MSG_DELCHAIN: 9202 case NFT_MSG_DESTROYCHAIN: 9203 if (nft_trans_chain_update(trans)) 9204 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 9205 else 9206 nf_tables_chain_destroy(&trans->ctx); 9207 break; 9208 case NFT_MSG_DELRULE: 9209 case NFT_MSG_DESTROYRULE: 9210 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 9211 break; 9212 case NFT_MSG_DELSET: 9213 case NFT_MSG_DESTROYSET: 9214 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 9215 break; 9216 case NFT_MSG_DELSETELEM: 9217 case NFT_MSG_DESTROYSETELEM: 9218 nf_tables_set_elem_destroy(&trans->ctx, 9219 nft_trans_elem_set(trans), 9220 nft_trans_elem(trans).priv); 9221 break; 9222 case NFT_MSG_DELOBJ: 9223 case NFT_MSG_DESTROYOBJ: 9224 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 9225 break; 9226 case NFT_MSG_DELFLOWTABLE: 9227 case NFT_MSG_DESTROYFLOWTABLE: 9228 if (nft_trans_flowtable_update(trans)) 9229 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 9230 else 9231 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 9232 break; 9233 } 9234 9235 if (trans->put_net) 9236 put_net(trans->ctx.net); 9237 9238 kfree(trans); 9239 } 9240 9241 static void nf_tables_trans_destroy_work(struct work_struct *w) 9242 { 9243 struct nft_trans *trans, *next; 9244 LIST_HEAD(head); 9245 9246 spin_lock(&nf_tables_destroy_list_lock); 9247 list_splice_init(&nf_tables_destroy_list, &head); 9248 spin_unlock(&nf_tables_destroy_list_lock); 9249 9250 if (list_empty(&head)) 9251 return; 9252 9253 synchronize_rcu(); 9254 9255 list_for_each_entry_safe(trans, next, &head, list) { 9256 nft_trans_list_del(trans); 9257 nft_commit_release(trans); 9258 } 9259 } 9260 9261 void nf_tables_trans_destroy_flush_work(void) 9262 { 9263 flush_work(&trans_destroy_work); 9264 } 9265 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); 9266 9267 static bool nft_expr_reduce(struct nft_regs_track *track, 9268 const struct nft_expr *expr) 9269 { 9270 return false; 9271 } 9272 9273 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain) 9274 { 9275 const struct nft_expr *expr, *last; 9276 struct nft_regs_track track = {}; 9277 unsigned int size, data_size; 9278 void *data, *data_boundary; 9279 struct nft_rule_dp *prule; 9280 struct nft_rule *rule; 9281 9282 /* already handled or inactive chain? */ 9283 if (chain->blob_next || !nft_is_active_next(net, chain)) 9284 return 0; 9285 9286 data_size = 0; 9287 list_for_each_entry(rule, &chain->rules, list) { 9288 if (nft_is_active_next(net, rule)) { 9289 data_size += sizeof(*prule) + rule->dlen; 9290 if (data_size > INT_MAX) 9291 return -ENOMEM; 9292 } 9293 } 9294 9295 chain->blob_next = nf_tables_chain_alloc_rules(chain, data_size); 9296 if (!chain->blob_next) 9297 return -ENOMEM; 9298 9299 data = (void *)chain->blob_next->data; 9300 data_boundary = data + data_size; 9301 size = 0; 9302 9303 list_for_each_entry(rule, &chain->rules, list) { 9304 if (!nft_is_active_next(net, rule)) 9305 continue; 9306 9307 prule = (struct nft_rule_dp *)data; 9308 data += offsetof(struct nft_rule_dp, data); 9309 if (WARN_ON_ONCE(data > data_boundary)) 9310 return -ENOMEM; 9311 9312 size = 0; 9313 track.last = nft_expr_last(rule); 9314 nft_rule_for_each_expr(expr, last, rule) { 9315 track.cur = expr; 9316 9317 if (nft_expr_reduce(&track, expr)) { 9318 expr = track.cur; 9319 continue; 9320 } 9321 9322 if (WARN_ON_ONCE(data + size + expr->ops->size > data_boundary)) 9323 return -ENOMEM; 9324 9325 memcpy(data + size, expr, expr->ops->size); 9326 size += expr->ops->size; 9327 } 9328 if (WARN_ON_ONCE(size >= 1 << 12)) 9329 return -ENOMEM; 9330 9331 prule->handle = rule->handle; 9332 prule->dlen = size; 9333 prule->is_last = 0; 9334 9335 data += size; 9336 size = 0; 9337 chain->blob_next->size += (unsigned long)(data - (void *)prule); 9338 } 9339 9340 if (WARN_ON_ONCE(data > data_boundary)) 9341 return -ENOMEM; 9342 9343 prule = (struct nft_rule_dp *)data; 9344 nft_last_rule(chain, prule); 9345 9346 return 0; 9347 } 9348 9349 static void nf_tables_commit_chain_prepare_cancel(struct net *net) 9350 { 9351 struct nftables_pernet *nft_net = nft_pernet(net); 9352 struct nft_trans *trans, *next; 9353 9354 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9355 struct nft_chain *chain = trans->ctx.chain; 9356 9357 if (trans->msg_type == NFT_MSG_NEWRULE || 9358 trans->msg_type == NFT_MSG_DELRULE) { 9359 kvfree(chain->blob_next); 9360 chain->blob_next = NULL; 9361 } 9362 } 9363 } 9364 9365 static void __nf_tables_commit_chain_free_rules(struct rcu_head *h) 9366 { 9367 struct nft_rule_dp_last *l = container_of(h, struct nft_rule_dp_last, h); 9368 9369 kvfree(l->blob); 9370 } 9371 9372 static void nf_tables_commit_chain_free_rules_old(struct nft_rule_blob *blob) 9373 { 9374 struct nft_rule_dp_last *last; 9375 9376 /* last rule trailer is after end marker */ 9377 last = (void *)blob + sizeof(*blob) + blob->size; 9378 last->blob = blob; 9379 9380 call_rcu(&last->h, __nf_tables_commit_chain_free_rules); 9381 } 9382 9383 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain) 9384 { 9385 struct nft_rule_blob *g0, *g1; 9386 bool next_genbit; 9387 9388 next_genbit = nft_gencursor_next(net); 9389 9390 g0 = rcu_dereference_protected(chain->blob_gen_0, 9391 lockdep_commit_lock_is_held(net)); 9392 g1 = rcu_dereference_protected(chain->blob_gen_1, 9393 lockdep_commit_lock_is_held(net)); 9394 9395 /* No changes to this chain? */ 9396 if (chain->blob_next == NULL) { 9397 /* chain had no change in last or next generation */ 9398 if (g0 == g1) 9399 return; 9400 /* 9401 * chain had no change in this generation; make sure next 9402 * one uses same rules as current generation. 9403 */ 9404 if (next_genbit) { 9405 rcu_assign_pointer(chain->blob_gen_1, g0); 9406 nf_tables_commit_chain_free_rules_old(g1); 9407 } else { 9408 rcu_assign_pointer(chain->blob_gen_0, g1); 9409 nf_tables_commit_chain_free_rules_old(g0); 9410 } 9411 9412 return; 9413 } 9414 9415 if (next_genbit) 9416 rcu_assign_pointer(chain->blob_gen_1, chain->blob_next); 9417 else 9418 rcu_assign_pointer(chain->blob_gen_0, chain->blob_next); 9419 9420 chain->blob_next = NULL; 9421 9422 if (g0 == g1) 9423 return; 9424 9425 if (next_genbit) 9426 nf_tables_commit_chain_free_rules_old(g1); 9427 else 9428 nf_tables_commit_chain_free_rules_old(g0); 9429 } 9430 9431 static void nft_obj_del(struct nft_object *obj) 9432 { 9433 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params); 9434 list_del_rcu(&obj->list); 9435 } 9436 9437 void nft_chain_del(struct nft_chain *chain) 9438 { 9439 struct nft_table *table = chain->table; 9440 9441 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead, 9442 nft_chain_ht_params)); 9443 list_del_rcu(&chain->list); 9444 } 9445 9446 static void nft_trans_gc_setelem_remove(struct nft_ctx *ctx, 9447 struct nft_trans_gc *trans) 9448 { 9449 void **priv = trans->priv; 9450 unsigned int i; 9451 9452 for (i = 0; i < trans->count; i++) { 9453 struct nft_set_elem elem = { 9454 .priv = priv[i], 9455 }; 9456 9457 nft_setelem_data_deactivate(ctx->net, trans->set, &elem); 9458 nft_setelem_remove(ctx->net, trans->set, &elem); 9459 } 9460 } 9461 9462 void nft_trans_gc_destroy(struct nft_trans_gc *trans) 9463 { 9464 nft_set_put(trans->set); 9465 put_net(trans->net); 9466 kfree(trans); 9467 } 9468 9469 static void nft_trans_gc_trans_free(struct rcu_head *rcu) 9470 { 9471 struct nft_set_elem elem = {}; 9472 struct nft_trans_gc *trans; 9473 struct nft_ctx ctx = {}; 9474 unsigned int i; 9475 9476 trans = container_of(rcu, struct nft_trans_gc, rcu); 9477 ctx.net = read_pnet(&trans->set->net); 9478 9479 for (i = 0; i < trans->count; i++) { 9480 elem.priv = trans->priv[i]; 9481 if (!nft_setelem_is_catchall(trans->set, &elem)) 9482 atomic_dec(&trans->set->nelems); 9483 9484 nf_tables_set_elem_destroy(&ctx, trans->set, elem.priv); 9485 } 9486 9487 nft_trans_gc_destroy(trans); 9488 } 9489 9490 static bool nft_trans_gc_work_done(struct nft_trans_gc *trans) 9491 { 9492 struct nftables_pernet *nft_net; 9493 struct nft_ctx ctx = {}; 9494 9495 nft_net = nft_pernet(trans->net); 9496 9497 mutex_lock(&nft_net->commit_mutex); 9498 9499 /* Check for race with transaction, otherwise this batch refers to 9500 * stale objects that might not be there anymore. Skip transaction if 9501 * set has been destroyed from control plane transaction in case gc 9502 * worker loses race. 9503 */ 9504 if (READ_ONCE(nft_net->gc_seq) != trans->seq || trans->set->dead) { 9505 mutex_unlock(&nft_net->commit_mutex); 9506 return false; 9507 } 9508 9509 ctx.net = trans->net; 9510 ctx.table = trans->set->table; 9511 9512 nft_trans_gc_setelem_remove(&ctx, trans); 9513 mutex_unlock(&nft_net->commit_mutex); 9514 9515 return true; 9516 } 9517 9518 static void nft_trans_gc_work(struct work_struct *work) 9519 { 9520 struct nft_trans_gc *trans, *next; 9521 LIST_HEAD(trans_gc_list); 9522 9523 spin_lock(&nf_tables_gc_list_lock); 9524 list_splice_init(&nf_tables_gc_list, &trans_gc_list); 9525 spin_unlock(&nf_tables_gc_list_lock); 9526 9527 list_for_each_entry_safe(trans, next, &trans_gc_list, list) { 9528 list_del(&trans->list); 9529 if (!nft_trans_gc_work_done(trans)) { 9530 nft_trans_gc_destroy(trans); 9531 continue; 9532 } 9533 call_rcu(&trans->rcu, nft_trans_gc_trans_free); 9534 } 9535 } 9536 9537 struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set, 9538 unsigned int gc_seq, gfp_t gfp) 9539 { 9540 struct net *net = read_pnet(&set->net); 9541 struct nft_trans_gc *trans; 9542 9543 trans = kzalloc(sizeof(*trans), gfp); 9544 if (!trans) 9545 return NULL; 9546 9547 trans->net = maybe_get_net(net); 9548 if (!trans->net) { 9549 kfree(trans); 9550 return NULL; 9551 } 9552 9553 refcount_inc(&set->refs); 9554 trans->set = set; 9555 trans->seq = gc_seq; 9556 9557 return trans; 9558 } 9559 9560 void nft_trans_gc_elem_add(struct nft_trans_gc *trans, void *priv) 9561 { 9562 trans->priv[trans->count++] = priv; 9563 } 9564 9565 static void nft_trans_gc_queue_work(struct nft_trans_gc *trans) 9566 { 9567 spin_lock(&nf_tables_gc_list_lock); 9568 list_add_tail(&trans->list, &nf_tables_gc_list); 9569 spin_unlock(&nf_tables_gc_list_lock); 9570 9571 schedule_work(&trans_gc_work); 9572 } 9573 9574 static int nft_trans_gc_space(struct nft_trans_gc *trans) 9575 { 9576 return NFT_TRANS_GC_BATCHCOUNT - trans->count; 9577 } 9578 9579 struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc, 9580 unsigned int gc_seq, gfp_t gfp) 9581 { 9582 struct nft_set *set; 9583 9584 if (nft_trans_gc_space(gc)) 9585 return gc; 9586 9587 set = gc->set; 9588 nft_trans_gc_queue_work(gc); 9589 9590 return nft_trans_gc_alloc(set, gc_seq, gfp); 9591 } 9592 9593 void nft_trans_gc_queue_async_done(struct nft_trans_gc *trans) 9594 { 9595 if (trans->count == 0) { 9596 nft_trans_gc_destroy(trans); 9597 return; 9598 } 9599 9600 nft_trans_gc_queue_work(trans); 9601 } 9602 9603 struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp) 9604 { 9605 struct nft_set *set; 9606 9607 if (WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc->net))) 9608 return NULL; 9609 9610 if (nft_trans_gc_space(gc)) 9611 return gc; 9612 9613 set = gc->set; 9614 call_rcu(&gc->rcu, nft_trans_gc_trans_free); 9615 9616 return nft_trans_gc_alloc(set, 0, gfp); 9617 } 9618 9619 void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans) 9620 { 9621 WARN_ON_ONCE(!lockdep_commit_lock_is_held(trans->net)); 9622 9623 if (trans->count == 0) { 9624 nft_trans_gc_destroy(trans); 9625 return; 9626 } 9627 9628 call_rcu(&trans->rcu, nft_trans_gc_trans_free); 9629 } 9630 9631 static struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc, 9632 unsigned int gc_seq, 9633 bool sync) 9634 { 9635 struct nft_set_elem_catchall *catchall; 9636 const struct nft_set *set = gc->set; 9637 struct nft_set_ext *ext; 9638 9639 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 9640 ext = nft_set_elem_ext(set, catchall->elem); 9641 9642 if (!nft_set_elem_expired(ext)) 9643 continue; 9644 if (nft_set_elem_is_dead(ext)) 9645 goto dead_elem; 9646 9647 nft_set_elem_dead(ext); 9648 dead_elem: 9649 if (sync) 9650 gc = nft_trans_gc_queue_sync(gc, GFP_ATOMIC); 9651 else 9652 gc = nft_trans_gc_queue_async(gc, gc_seq, GFP_ATOMIC); 9653 9654 if (!gc) 9655 return NULL; 9656 9657 nft_trans_gc_elem_add(gc, catchall->elem); 9658 } 9659 9660 return gc; 9661 } 9662 9663 struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc, 9664 unsigned int gc_seq) 9665 { 9666 return nft_trans_gc_catchall(gc, gc_seq, false); 9667 } 9668 9669 struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc) 9670 { 9671 return nft_trans_gc_catchall(gc, 0, true); 9672 } 9673 9674 static void nf_tables_module_autoload_cleanup(struct net *net) 9675 { 9676 struct nftables_pernet *nft_net = nft_pernet(net); 9677 struct nft_module_request *req, *next; 9678 9679 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 9680 list_for_each_entry_safe(req, next, &nft_net->module_list, list) { 9681 WARN_ON_ONCE(!req->done); 9682 list_del(&req->list); 9683 kfree(req); 9684 } 9685 } 9686 9687 static void nf_tables_commit_release(struct net *net) 9688 { 9689 struct nftables_pernet *nft_net = nft_pernet(net); 9690 struct nft_trans *trans; 9691 9692 /* all side effects have to be made visible. 9693 * For example, if a chain named 'foo' has been deleted, a 9694 * new transaction must not find it anymore. 9695 * 9696 * Memory reclaim happens asynchronously from work queue 9697 * to prevent expensive synchronize_rcu() in commit phase. 9698 */ 9699 if (list_empty(&nft_net->commit_list)) { 9700 nf_tables_module_autoload_cleanup(net); 9701 mutex_unlock(&nft_net->commit_mutex); 9702 return; 9703 } 9704 9705 trans = list_last_entry(&nft_net->commit_list, 9706 struct nft_trans, list); 9707 get_net(trans->ctx.net); 9708 WARN_ON_ONCE(trans->put_net); 9709 9710 trans->put_net = true; 9711 spin_lock(&nf_tables_destroy_list_lock); 9712 list_splice_tail_init(&nft_net->commit_list, &nf_tables_destroy_list); 9713 spin_unlock(&nf_tables_destroy_list_lock); 9714 9715 nf_tables_module_autoload_cleanup(net); 9716 schedule_work(&trans_destroy_work); 9717 9718 mutex_unlock(&nft_net->commit_mutex); 9719 } 9720 9721 static void nft_commit_notify(struct net *net, u32 portid) 9722 { 9723 struct nftables_pernet *nft_net = nft_pernet(net); 9724 struct sk_buff *batch_skb = NULL, *nskb, *skb; 9725 unsigned char *data; 9726 int len; 9727 9728 list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) { 9729 if (!batch_skb) { 9730 new_batch: 9731 batch_skb = skb; 9732 len = NLMSG_GOODSIZE - skb->len; 9733 list_del(&skb->list); 9734 continue; 9735 } 9736 len -= skb->len; 9737 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) { 9738 data = skb_put(batch_skb, skb->len); 9739 memcpy(data, skb->data, skb->len); 9740 list_del(&skb->list); 9741 kfree_skb(skb); 9742 continue; 9743 } 9744 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 9745 NFT_CB(batch_skb).report, GFP_KERNEL); 9746 goto new_batch; 9747 } 9748 9749 if (batch_skb) { 9750 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 9751 NFT_CB(batch_skb).report, GFP_KERNEL); 9752 } 9753 9754 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 9755 } 9756 9757 static int nf_tables_commit_audit_alloc(struct list_head *adl, 9758 struct nft_table *table) 9759 { 9760 struct nft_audit_data *adp; 9761 9762 list_for_each_entry(adp, adl, list) { 9763 if (adp->table == table) 9764 return 0; 9765 } 9766 adp = kzalloc(sizeof(*adp), GFP_KERNEL); 9767 if (!adp) 9768 return -ENOMEM; 9769 adp->table = table; 9770 list_add(&adp->list, adl); 9771 return 0; 9772 } 9773 9774 static void nf_tables_commit_audit_free(struct list_head *adl) 9775 { 9776 struct nft_audit_data *adp, *adn; 9777 9778 list_for_each_entry_safe(adp, adn, adl, list) { 9779 list_del(&adp->list); 9780 kfree(adp); 9781 } 9782 } 9783 9784 static void nf_tables_commit_audit_collect(struct list_head *adl, 9785 struct nft_table *table, u32 op) 9786 { 9787 struct nft_audit_data *adp; 9788 9789 list_for_each_entry(adp, adl, list) { 9790 if (adp->table == table) 9791 goto found; 9792 } 9793 WARN_ONCE(1, "table=%s not expected in commit list", table->name); 9794 return; 9795 found: 9796 adp->entries++; 9797 if (!adp->op || adp->op > op) 9798 adp->op = op; 9799 } 9800 9801 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22) 9802 9803 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation) 9804 { 9805 struct nft_audit_data *adp, *adn; 9806 char aubuf[AUNFTABLENAMELEN]; 9807 9808 list_for_each_entry_safe(adp, adn, adl, list) { 9809 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name, 9810 generation); 9811 audit_log_nfcfg(aubuf, adp->table->family, adp->entries, 9812 nft2audit_op[adp->op], GFP_KERNEL); 9813 list_del(&adp->list); 9814 kfree(adp); 9815 } 9816 } 9817 9818 static void nft_set_commit_update(struct list_head *set_update_list) 9819 { 9820 struct nft_set *set, *next; 9821 9822 list_for_each_entry_safe(set, next, set_update_list, pending_update) { 9823 list_del_init(&set->pending_update); 9824 9825 if (!set->ops->commit) 9826 continue; 9827 9828 set->ops->commit(set); 9829 } 9830 } 9831 9832 static unsigned int nft_gc_seq_begin(struct nftables_pernet *nft_net) 9833 { 9834 unsigned int gc_seq; 9835 9836 /* Bump gc counter, it becomes odd, this is the busy mark. */ 9837 gc_seq = READ_ONCE(nft_net->gc_seq); 9838 WRITE_ONCE(nft_net->gc_seq, ++gc_seq); 9839 9840 return gc_seq; 9841 } 9842 9843 static void nft_gc_seq_end(struct nftables_pernet *nft_net, unsigned int gc_seq) 9844 { 9845 WRITE_ONCE(nft_net->gc_seq, ++gc_seq); 9846 } 9847 9848 static int nf_tables_commit(struct net *net, struct sk_buff *skb) 9849 { 9850 struct nftables_pernet *nft_net = nft_pernet(net); 9851 struct nft_trans *trans, *next; 9852 unsigned int base_seq, gc_seq; 9853 LIST_HEAD(set_update_list); 9854 struct nft_trans_elem *te; 9855 struct nft_chain *chain; 9856 struct nft_table *table; 9857 LIST_HEAD(adl); 9858 int err; 9859 9860 if (list_empty(&nft_net->commit_list)) { 9861 mutex_unlock(&nft_net->commit_mutex); 9862 return 0; 9863 } 9864 9865 list_for_each_entry(trans, &nft_net->binding_list, binding_list) { 9866 switch (trans->msg_type) { 9867 case NFT_MSG_NEWSET: 9868 if (!nft_trans_set_update(trans) && 9869 nft_set_is_anonymous(nft_trans_set(trans)) && 9870 !nft_trans_set_bound(trans)) { 9871 pr_warn_once("nftables ruleset with unbound set\n"); 9872 return -EINVAL; 9873 } 9874 break; 9875 case NFT_MSG_NEWCHAIN: 9876 if (!nft_trans_chain_update(trans) && 9877 nft_chain_binding(nft_trans_chain(trans)) && 9878 !nft_trans_chain_bound(trans)) { 9879 pr_warn_once("nftables ruleset with unbound chain\n"); 9880 return -EINVAL; 9881 } 9882 break; 9883 } 9884 } 9885 9886 /* 0. Validate ruleset, otherwise roll back for error reporting. */ 9887 if (nf_tables_validate(net) < 0) { 9888 nft_net->validate_state = NFT_VALIDATE_DO; 9889 return -EAGAIN; 9890 } 9891 9892 err = nft_flow_rule_offload_commit(net); 9893 if (err < 0) 9894 return err; 9895 9896 /* 1. Allocate space for next generation rules_gen_X[] */ 9897 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9898 int ret; 9899 9900 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); 9901 if (ret) { 9902 nf_tables_commit_chain_prepare_cancel(net); 9903 nf_tables_commit_audit_free(&adl); 9904 return ret; 9905 } 9906 if (trans->msg_type == NFT_MSG_NEWRULE || 9907 trans->msg_type == NFT_MSG_DELRULE) { 9908 chain = trans->ctx.chain; 9909 9910 ret = nf_tables_commit_chain_prepare(net, chain); 9911 if (ret < 0) { 9912 nf_tables_commit_chain_prepare_cancel(net); 9913 nf_tables_commit_audit_free(&adl); 9914 return ret; 9915 } 9916 } 9917 } 9918 9919 /* step 2. Make rules_gen_X visible to packet path */ 9920 list_for_each_entry(table, &nft_net->tables, list) { 9921 list_for_each_entry(chain, &table->chains, list) 9922 nf_tables_commit_chain(net, chain); 9923 } 9924 9925 /* 9926 * Bump generation counter, invalidate any dump in progress. 9927 * Cannot fail after this point. 9928 */ 9929 base_seq = READ_ONCE(nft_net->base_seq); 9930 while (++base_seq == 0) 9931 ; 9932 9933 WRITE_ONCE(nft_net->base_seq, base_seq); 9934 9935 gc_seq = nft_gc_seq_begin(nft_net); 9936 9937 /* step 3. Start new generation, rules_gen_X now in use. */ 9938 net->nft.gencursor = nft_gencursor_next(net); 9939 9940 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9941 nf_tables_commit_audit_collect(&adl, trans->ctx.table, 9942 trans->msg_type); 9943 switch (trans->msg_type) { 9944 case NFT_MSG_NEWTABLE: 9945 if (nft_trans_table_update(trans)) { 9946 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 9947 nft_trans_destroy(trans); 9948 break; 9949 } 9950 if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT) 9951 nf_tables_table_disable(net, trans->ctx.table); 9952 9953 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 9954 } else { 9955 nft_clear(net, trans->ctx.table); 9956 } 9957 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE); 9958 nft_trans_destroy(trans); 9959 break; 9960 case NFT_MSG_DELTABLE: 9961 case NFT_MSG_DESTROYTABLE: 9962 list_del_rcu(&trans->ctx.table->list); 9963 nf_tables_table_notify(&trans->ctx, trans->msg_type); 9964 break; 9965 case NFT_MSG_NEWCHAIN: 9966 if (nft_trans_chain_update(trans)) { 9967 nft_chain_commit_update(trans); 9968 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, 9969 &nft_trans_chain_hooks(trans)); 9970 list_splice(&nft_trans_chain_hooks(trans), 9971 &nft_trans_basechain(trans)->hook_list); 9972 /* trans destroyed after rcu grace period */ 9973 } else { 9974 nft_chain_commit_drop_policy(trans); 9975 nft_clear(net, trans->ctx.chain); 9976 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, NULL); 9977 nft_trans_destroy(trans); 9978 } 9979 break; 9980 case NFT_MSG_DELCHAIN: 9981 case NFT_MSG_DESTROYCHAIN: 9982 if (nft_trans_chain_update(trans)) { 9983 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, 9984 &nft_trans_chain_hooks(trans)); 9985 nft_netdev_unregister_hooks(net, 9986 &nft_trans_chain_hooks(trans), 9987 true); 9988 } else { 9989 nft_chain_del(trans->ctx.chain); 9990 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, 9991 NULL); 9992 nf_tables_unregister_hook(trans->ctx.net, 9993 trans->ctx.table, 9994 trans->ctx.chain); 9995 } 9996 break; 9997 case NFT_MSG_NEWRULE: 9998 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 9999 nf_tables_rule_notify(&trans->ctx, 10000 nft_trans_rule(trans), 10001 NFT_MSG_NEWRULE); 10002 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 10003 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 10004 10005 nft_trans_destroy(trans); 10006 break; 10007 case NFT_MSG_DELRULE: 10008 case NFT_MSG_DESTROYRULE: 10009 list_del_rcu(&nft_trans_rule(trans)->list); 10010 nf_tables_rule_notify(&trans->ctx, 10011 nft_trans_rule(trans), 10012 trans->msg_type); 10013 nft_rule_expr_deactivate(&trans->ctx, 10014 nft_trans_rule(trans), 10015 NFT_TRANS_COMMIT); 10016 10017 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 10018 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 10019 break; 10020 case NFT_MSG_NEWSET: 10021 if (nft_trans_set_update(trans)) { 10022 struct nft_set *set = nft_trans_set(trans); 10023 10024 WRITE_ONCE(set->timeout, nft_trans_set_timeout(trans)); 10025 WRITE_ONCE(set->gc_int, nft_trans_set_gc_int(trans)); 10026 10027 if (nft_trans_set_size(trans)) 10028 WRITE_ONCE(set->size, nft_trans_set_size(trans)); 10029 } else { 10030 nft_clear(net, nft_trans_set(trans)); 10031 /* This avoids hitting -EBUSY when deleting the table 10032 * from the transaction. 10033 */ 10034 if (nft_set_is_anonymous(nft_trans_set(trans)) && 10035 !list_empty(&nft_trans_set(trans)->bindings)) 10036 nft_use_dec(&trans->ctx.table->use); 10037 } 10038 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 10039 NFT_MSG_NEWSET, GFP_KERNEL); 10040 nft_trans_destroy(trans); 10041 break; 10042 case NFT_MSG_DELSET: 10043 case NFT_MSG_DESTROYSET: 10044 nft_trans_set(trans)->dead = 1; 10045 list_del_rcu(&nft_trans_set(trans)->list); 10046 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 10047 trans->msg_type, GFP_KERNEL); 10048 break; 10049 case NFT_MSG_NEWSETELEM: 10050 te = (struct nft_trans_elem *)trans->data; 10051 10052 nft_setelem_activate(net, te->set, &te->elem); 10053 nf_tables_setelem_notify(&trans->ctx, te->set, 10054 &te->elem, 10055 NFT_MSG_NEWSETELEM); 10056 if (te->set->ops->commit && 10057 list_empty(&te->set->pending_update)) { 10058 list_add_tail(&te->set->pending_update, 10059 &set_update_list); 10060 } 10061 nft_trans_destroy(trans); 10062 break; 10063 case NFT_MSG_DELSETELEM: 10064 case NFT_MSG_DESTROYSETELEM: 10065 te = (struct nft_trans_elem *)trans->data; 10066 10067 nf_tables_setelem_notify(&trans->ctx, te->set, 10068 &te->elem, 10069 trans->msg_type); 10070 nft_setelem_remove(net, te->set, &te->elem); 10071 if (!nft_setelem_is_catchall(te->set, &te->elem)) { 10072 atomic_dec(&te->set->nelems); 10073 te->set->ndeact--; 10074 } 10075 if (te->set->ops->commit && 10076 list_empty(&te->set->pending_update)) { 10077 list_add_tail(&te->set->pending_update, 10078 &set_update_list); 10079 } 10080 break; 10081 case NFT_MSG_NEWOBJ: 10082 if (nft_trans_obj_update(trans)) { 10083 nft_obj_commit_update(trans); 10084 nf_tables_obj_notify(&trans->ctx, 10085 nft_trans_obj(trans), 10086 NFT_MSG_NEWOBJ); 10087 } else { 10088 nft_clear(net, nft_trans_obj(trans)); 10089 nf_tables_obj_notify(&trans->ctx, 10090 nft_trans_obj(trans), 10091 NFT_MSG_NEWOBJ); 10092 nft_trans_destroy(trans); 10093 } 10094 break; 10095 case NFT_MSG_DELOBJ: 10096 case NFT_MSG_DESTROYOBJ: 10097 nft_obj_del(nft_trans_obj(trans)); 10098 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans), 10099 trans->msg_type); 10100 break; 10101 case NFT_MSG_NEWFLOWTABLE: 10102 if (nft_trans_flowtable_update(trans)) { 10103 nft_trans_flowtable(trans)->data.flags = 10104 nft_trans_flowtable_flags(trans); 10105 nf_tables_flowtable_notify(&trans->ctx, 10106 nft_trans_flowtable(trans), 10107 &nft_trans_flowtable_hooks(trans), 10108 NFT_MSG_NEWFLOWTABLE); 10109 list_splice(&nft_trans_flowtable_hooks(trans), 10110 &nft_trans_flowtable(trans)->hook_list); 10111 } else { 10112 nft_clear(net, nft_trans_flowtable(trans)); 10113 nf_tables_flowtable_notify(&trans->ctx, 10114 nft_trans_flowtable(trans), 10115 NULL, 10116 NFT_MSG_NEWFLOWTABLE); 10117 } 10118 nft_trans_destroy(trans); 10119 break; 10120 case NFT_MSG_DELFLOWTABLE: 10121 case NFT_MSG_DESTROYFLOWTABLE: 10122 if (nft_trans_flowtable_update(trans)) { 10123 nf_tables_flowtable_notify(&trans->ctx, 10124 nft_trans_flowtable(trans), 10125 &nft_trans_flowtable_hooks(trans), 10126 trans->msg_type); 10127 nft_unregister_flowtable_net_hooks(net, 10128 &nft_trans_flowtable_hooks(trans)); 10129 } else { 10130 list_del_rcu(&nft_trans_flowtable(trans)->list); 10131 nf_tables_flowtable_notify(&trans->ctx, 10132 nft_trans_flowtable(trans), 10133 NULL, 10134 trans->msg_type); 10135 nft_unregister_flowtable_net_hooks(net, 10136 &nft_trans_flowtable(trans)->hook_list); 10137 } 10138 break; 10139 } 10140 } 10141 10142 nft_set_commit_update(&set_update_list); 10143 10144 nft_commit_notify(net, NETLINK_CB(skb).portid); 10145 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 10146 nf_tables_commit_audit_log(&adl, nft_net->base_seq); 10147 10148 nft_gc_seq_end(nft_net, gc_seq); 10149 nft_net->validate_state = NFT_VALIDATE_SKIP; 10150 nf_tables_commit_release(net); 10151 10152 return 0; 10153 } 10154 10155 static void nf_tables_module_autoload(struct net *net) 10156 { 10157 struct nftables_pernet *nft_net = nft_pernet(net); 10158 struct nft_module_request *req, *next; 10159 LIST_HEAD(module_list); 10160 10161 list_splice_init(&nft_net->module_list, &module_list); 10162 mutex_unlock(&nft_net->commit_mutex); 10163 list_for_each_entry_safe(req, next, &module_list, list) { 10164 request_module("%s", req->module); 10165 req->done = true; 10166 } 10167 mutex_lock(&nft_net->commit_mutex); 10168 list_splice(&module_list, &nft_net->module_list); 10169 } 10170 10171 static void nf_tables_abort_release(struct nft_trans *trans) 10172 { 10173 switch (trans->msg_type) { 10174 case NFT_MSG_NEWTABLE: 10175 nf_tables_table_destroy(&trans->ctx); 10176 break; 10177 case NFT_MSG_NEWCHAIN: 10178 if (nft_trans_chain_update(trans)) 10179 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 10180 else 10181 nf_tables_chain_destroy(&trans->ctx); 10182 break; 10183 case NFT_MSG_NEWRULE: 10184 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 10185 break; 10186 case NFT_MSG_NEWSET: 10187 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 10188 break; 10189 case NFT_MSG_NEWSETELEM: 10190 nft_set_elem_destroy(nft_trans_elem_set(trans), 10191 nft_trans_elem(trans).priv, true); 10192 break; 10193 case NFT_MSG_NEWOBJ: 10194 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 10195 break; 10196 case NFT_MSG_NEWFLOWTABLE: 10197 if (nft_trans_flowtable_update(trans)) 10198 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 10199 else 10200 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 10201 break; 10202 } 10203 kfree(trans); 10204 } 10205 10206 static void nft_set_abort_update(struct list_head *set_update_list) 10207 { 10208 struct nft_set *set, *next; 10209 10210 list_for_each_entry_safe(set, next, set_update_list, pending_update) { 10211 list_del_init(&set->pending_update); 10212 10213 if (!set->ops->abort) 10214 continue; 10215 10216 set->ops->abort(set); 10217 } 10218 } 10219 10220 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 10221 { 10222 struct nftables_pernet *nft_net = nft_pernet(net); 10223 struct nft_trans *trans, *next; 10224 LIST_HEAD(set_update_list); 10225 struct nft_trans_elem *te; 10226 10227 if (action == NFNL_ABORT_VALIDATE && 10228 nf_tables_validate(net) < 0) 10229 return -EAGAIN; 10230 10231 list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, 10232 list) { 10233 switch (trans->msg_type) { 10234 case NFT_MSG_NEWTABLE: 10235 if (nft_trans_table_update(trans)) { 10236 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 10237 nft_trans_destroy(trans); 10238 break; 10239 } 10240 if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) { 10241 nf_tables_table_disable(net, trans->ctx.table); 10242 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 10243 } else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) { 10244 trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT; 10245 } 10246 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 10247 nft_trans_destroy(trans); 10248 } else { 10249 list_del_rcu(&trans->ctx.table->list); 10250 } 10251 break; 10252 case NFT_MSG_DELTABLE: 10253 case NFT_MSG_DESTROYTABLE: 10254 nft_clear(trans->ctx.net, trans->ctx.table); 10255 nft_trans_destroy(trans); 10256 break; 10257 case NFT_MSG_NEWCHAIN: 10258 if (nft_trans_chain_update(trans)) { 10259 nft_netdev_unregister_hooks(net, 10260 &nft_trans_chain_hooks(trans), 10261 true); 10262 free_percpu(nft_trans_chain_stats(trans)); 10263 kfree(nft_trans_chain_name(trans)); 10264 nft_trans_destroy(trans); 10265 } else { 10266 if (nft_trans_chain_bound(trans)) { 10267 nft_trans_destroy(trans); 10268 break; 10269 } 10270 nft_use_dec_restore(&trans->ctx.table->use); 10271 nft_chain_del(trans->ctx.chain); 10272 nf_tables_unregister_hook(trans->ctx.net, 10273 trans->ctx.table, 10274 trans->ctx.chain); 10275 } 10276 break; 10277 case NFT_MSG_DELCHAIN: 10278 case NFT_MSG_DESTROYCHAIN: 10279 if (nft_trans_chain_update(trans)) { 10280 list_splice(&nft_trans_chain_hooks(trans), 10281 &nft_trans_basechain(trans)->hook_list); 10282 } else { 10283 nft_use_inc_restore(&trans->ctx.table->use); 10284 nft_clear(trans->ctx.net, trans->ctx.chain); 10285 } 10286 nft_trans_destroy(trans); 10287 break; 10288 case NFT_MSG_NEWRULE: 10289 if (nft_trans_rule_bound(trans)) { 10290 nft_trans_destroy(trans); 10291 break; 10292 } 10293 nft_use_dec_restore(&trans->ctx.chain->use); 10294 list_del_rcu(&nft_trans_rule(trans)->list); 10295 nft_rule_expr_deactivate(&trans->ctx, 10296 nft_trans_rule(trans), 10297 NFT_TRANS_ABORT); 10298 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 10299 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 10300 break; 10301 case NFT_MSG_DELRULE: 10302 case NFT_MSG_DESTROYRULE: 10303 nft_use_inc_restore(&trans->ctx.chain->use); 10304 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 10305 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans)); 10306 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 10307 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 10308 10309 nft_trans_destroy(trans); 10310 break; 10311 case NFT_MSG_NEWSET: 10312 if (nft_trans_set_update(trans)) { 10313 nft_trans_destroy(trans); 10314 break; 10315 } 10316 nft_use_dec_restore(&trans->ctx.table->use); 10317 if (nft_trans_set_bound(trans)) { 10318 nft_trans_destroy(trans); 10319 break; 10320 } 10321 list_del_rcu(&nft_trans_set(trans)->list); 10322 break; 10323 case NFT_MSG_DELSET: 10324 case NFT_MSG_DESTROYSET: 10325 nft_use_inc_restore(&trans->ctx.table->use); 10326 nft_clear(trans->ctx.net, nft_trans_set(trans)); 10327 if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 10328 nft_map_activate(&trans->ctx, nft_trans_set(trans)); 10329 10330 nft_trans_destroy(trans); 10331 break; 10332 case NFT_MSG_NEWSETELEM: 10333 if (nft_trans_elem_set_bound(trans)) { 10334 nft_trans_destroy(trans); 10335 break; 10336 } 10337 te = (struct nft_trans_elem *)trans->data; 10338 nft_setelem_remove(net, te->set, &te->elem); 10339 if (!nft_setelem_is_catchall(te->set, &te->elem)) 10340 atomic_dec(&te->set->nelems); 10341 10342 if (te->set->ops->abort && 10343 list_empty(&te->set->pending_update)) { 10344 list_add_tail(&te->set->pending_update, 10345 &set_update_list); 10346 } 10347 break; 10348 case NFT_MSG_DELSETELEM: 10349 case NFT_MSG_DESTROYSETELEM: 10350 te = (struct nft_trans_elem *)trans->data; 10351 10352 nft_setelem_data_activate(net, te->set, &te->elem); 10353 nft_setelem_activate(net, te->set, &te->elem); 10354 if (!nft_setelem_is_catchall(te->set, &te->elem)) 10355 te->set->ndeact--; 10356 10357 if (te->set->ops->abort && 10358 list_empty(&te->set->pending_update)) { 10359 list_add_tail(&te->set->pending_update, 10360 &set_update_list); 10361 } 10362 nft_trans_destroy(trans); 10363 break; 10364 case NFT_MSG_NEWOBJ: 10365 if (nft_trans_obj_update(trans)) { 10366 nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); 10367 nft_trans_destroy(trans); 10368 } else { 10369 nft_use_dec_restore(&trans->ctx.table->use); 10370 nft_obj_del(nft_trans_obj(trans)); 10371 } 10372 break; 10373 case NFT_MSG_DELOBJ: 10374 case NFT_MSG_DESTROYOBJ: 10375 nft_use_inc_restore(&trans->ctx.table->use); 10376 nft_clear(trans->ctx.net, nft_trans_obj(trans)); 10377 nft_trans_destroy(trans); 10378 break; 10379 case NFT_MSG_NEWFLOWTABLE: 10380 if (nft_trans_flowtable_update(trans)) { 10381 nft_unregister_flowtable_net_hooks(net, 10382 &nft_trans_flowtable_hooks(trans)); 10383 } else { 10384 nft_use_dec_restore(&trans->ctx.table->use); 10385 list_del_rcu(&nft_trans_flowtable(trans)->list); 10386 nft_unregister_flowtable_net_hooks(net, 10387 &nft_trans_flowtable(trans)->hook_list); 10388 } 10389 break; 10390 case NFT_MSG_DELFLOWTABLE: 10391 case NFT_MSG_DESTROYFLOWTABLE: 10392 if (nft_trans_flowtable_update(trans)) { 10393 list_splice(&nft_trans_flowtable_hooks(trans), 10394 &nft_trans_flowtable(trans)->hook_list); 10395 } else { 10396 nft_use_inc_restore(&trans->ctx.table->use); 10397 nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); 10398 } 10399 nft_trans_destroy(trans); 10400 break; 10401 } 10402 } 10403 10404 nft_set_abort_update(&set_update_list); 10405 10406 synchronize_rcu(); 10407 10408 list_for_each_entry_safe_reverse(trans, next, 10409 &nft_net->commit_list, list) { 10410 nft_trans_list_del(trans); 10411 nf_tables_abort_release(trans); 10412 } 10413 10414 if (action == NFNL_ABORT_AUTOLOAD) 10415 nf_tables_module_autoload(net); 10416 else 10417 nf_tables_module_autoload_cleanup(net); 10418 10419 return 0; 10420 } 10421 10422 static int nf_tables_abort(struct net *net, struct sk_buff *skb, 10423 enum nfnl_abort_action action) 10424 { 10425 struct nftables_pernet *nft_net = nft_pernet(net); 10426 unsigned int gc_seq; 10427 int ret; 10428 10429 gc_seq = nft_gc_seq_begin(nft_net); 10430 ret = __nf_tables_abort(net, action); 10431 nft_gc_seq_end(nft_net, gc_seq); 10432 mutex_unlock(&nft_net->commit_mutex); 10433 10434 return ret; 10435 } 10436 10437 static bool nf_tables_valid_genid(struct net *net, u32 genid) 10438 { 10439 struct nftables_pernet *nft_net = nft_pernet(net); 10440 bool genid_ok; 10441 10442 mutex_lock(&nft_net->commit_mutex); 10443 10444 genid_ok = genid == 0 || nft_net->base_seq == genid; 10445 if (!genid_ok) 10446 mutex_unlock(&nft_net->commit_mutex); 10447 10448 /* else, commit mutex has to be released by commit or abort function */ 10449 return genid_ok; 10450 } 10451 10452 static const struct nfnetlink_subsystem nf_tables_subsys = { 10453 .name = "nf_tables", 10454 .subsys_id = NFNL_SUBSYS_NFTABLES, 10455 .cb_count = NFT_MSG_MAX, 10456 .cb = nf_tables_cb, 10457 .commit = nf_tables_commit, 10458 .abort = nf_tables_abort, 10459 .valid_genid = nf_tables_valid_genid, 10460 .owner = THIS_MODULE, 10461 }; 10462 10463 int nft_chain_validate_dependency(const struct nft_chain *chain, 10464 enum nft_chain_types type) 10465 { 10466 const struct nft_base_chain *basechain; 10467 10468 if (nft_is_base_chain(chain)) { 10469 basechain = nft_base_chain(chain); 10470 if (basechain->type->type != type) 10471 return -EOPNOTSUPP; 10472 } 10473 return 0; 10474 } 10475 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 10476 10477 int nft_chain_validate_hooks(const struct nft_chain *chain, 10478 unsigned int hook_flags) 10479 { 10480 struct nft_base_chain *basechain; 10481 10482 if (nft_is_base_chain(chain)) { 10483 basechain = nft_base_chain(chain); 10484 10485 if ((1 << basechain->ops.hooknum) & hook_flags) 10486 return 0; 10487 10488 return -EOPNOTSUPP; 10489 } 10490 10491 return 0; 10492 } 10493 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 10494 10495 /* 10496 * Loop detection - walk through the ruleset beginning at the destination chain 10497 * of a new jump until either the source chain is reached (loop) or all 10498 * reachable chains have been traversed. 10499 * 10500 * The loop check is performed whenever a new jump verdict is added to an 10501 * expression or verdict map or a verdict map is bound to a new chain. 10502 */ 10503 10504 static int nf_tables_check_loops(const struct nft_ctx *ctx, 10505 const struct nft_chain *chain); 10506 10507 static int nft_check_loops(const struct nft_ctx *ctx, 10508 const struct nft_set_ext *ext) 10509 { 10510 const struct nft_data *data; 10511 int ret; 10512 10513 data = nft_set_ext_data(ext); 10514 switch (data->verdict.code) { 10515 case NFT_JUMP: 10516 case NFT_GOTO: 10517 ret = nf_tables_check_loops(ctx, data->verdict.chain); 10518 break; 10519 default: 10520 ret = 0; 10521 break; 10522 } 10523 10524 return ret; 10525 } 10526 10527 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, 10528 struct nft_set *set, 10529 const struct nft_set_iter *iter, 10530 struct nft_set_elem *elem) 10531 { 10532 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 10533 10534 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 10535 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 10536 return 0; 10537 10538 return nft_check_loops(ctx, ext); 10539 } 10540 10541 static int nft_set_catchall_loops(const struct nft_ctx *ctx, 10542 struct nft_set *set) 10543 { 10544 u8 genmask = nft_genmask_next(ctx->net); 10545 struct nft_set_elem_catchall *catchall; 10546 struct nft_set_ext *ext; 10547 int ret = 0; 10548 10549 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 10550 ext = nft_set_elem_ext(set, catchall->elem); 10551 if (!nft_set_elem_active(ext, genmask)) 10552 continue; 10553 10554 ret = nft_check_loops(ctx, ext); 10555 if (ret < 0) 10556 return ret; 10557 } 10558 10559 return ret; 10560 } 10561 10562 static int nf_tables_check_loops(const struct nft_ctx *ctx, 10563 const struct nft_chain *chain) 10564 { 10565 const struct nft_rule *rule; 10566 const struct nft_expr *expr, *last; 10567 struct nft_set *set; 10568 struct nft_set_binding *binding; 10569 struct nft_set_iter iter; 10570 10571 if (ctx->chain == chain) 10572 return -ELOOP; 10573 10574 if (fatal_signal_pending(current)) 10575 return -EINTR; 10576 10577 list_for_each_entry(rule, &chain->rules, list) { 10578 nft_rule_for_each_expr(expr, last, rule) { 10579 struct nft_immediate_expr *priv; 10580 const struct nft_data *data; 10581 int err; 10582 10583 if (strcmp(expr->ops->type->name, "immediate")) 10584 continue; 10585 10586 priv = nft_expr_priv(expr); 10587 if (priv->dreg != NFT_REG_VERDICT) 10588 continue; 10589 10590 data = &priv->data; 10591 switch (data->verdict.code) { 10592 case NFT_JUMP: 10593 case NFT_GOTO: 10594 err = nf_tables_check_loops(ctx, 10595 data->verdict.chain); 10596 if (err < 0) 10597 return err; 10598 break; 10599 default: 10600 break; 10601 } 10602 } 10603 } 10604 10605 list_for_each_entry(set, &ctx->table->sets, list) { 10606 if (!nft_is_active_next(ctx->net, set)) 10607 continue; 10608 if (!(set->flags & NFT_SET_MAP) || 10609 set->dtype != NFT_DATA_VERDICT) 10610 continue; 10611 10612 list_for_each_entry(binding, &set->bindings, list) { 10613 if (!(binding->flags & NFT_SET_MAP) || 10614 binding->chain != chain) 10615 continue; 10616 10617 iter.genmask = nft_genmask_next(ctx->net); 10618 iter.skip = 0; 10619 iter.count = 0; 10620 iter.err = 0; 10621 iter.fn = nf_tables_loop_check_setelem; 10622 10623 set->ops->walk(ctx, set, &iter); 10624 if (!iter.err) 10625 iter.err = nft_set_catchall_loops(ctx, set); 10626 10627 if (iter.err < 0) 10628 return iter.err; 10629 } 10630 } 10631 10632 return 0; 10633 } 10634 10635 /** 10636 * nft_parse_u32_check - fetch u32 attribute and check for maximum value 10637 * 10638 * @attr: netlink attribute to fetch value from 10639 * @max: maximum value to be stored in dest 10640 * @dest: pointer to the variable 10641 * 10642 * Parse, check and store a given u32 netlink attribute into variable. 10643 * This function returns -ERANGE if the value goes over maximum value. 10644 * Otherwise a 0 is returned and the attribute value is stored in the 10645 * destination variable. 10646 */ 10647 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 10648 { 10649 u32 val; 10650 10651 val = ntohl(nla_get_be32(attr)); 10652 if (val > max) 10653 return -ERANGE; 10654 10655 *dest = val; 10656 return 0; 10657 } 10658 EXPORT_SYMBOL_GPL(nft_parse_u32_check); 10659 10660 static int nft_parse_register(const struct nlattr *attr, u32 *preg) 10661 { 10662 unsigned int reg; 10663 10664 reg = ntohl(nla_get_be32(attr)); 10665 switch (reg) { 10666 case NFT_REG_VERDICT...NFT_REG_4: 10667 *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; 10668 break; 10669 case NFT_REG32_00...NFT_REG32_15: 10670 *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 10671 break; 10672 default: 10673 return -ERANGE; 10674 } 10675 10676 return 0; 10677 } 10678 10679 /** 10680 * nft_dump_register - dump a register value to a netlink attribute 10681 * 10682 * @skb: socket buffer 10683 * @attr: attribute number 10684 * @reg: register number 10685 * 10686 * Construct a netlink attribute containing the register number. For 10687 * compatibility reasons, register numbers being a multiple of 4 are 10688 * translated to the corresponding 128 bit register numbers. 10689 */ 10690 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 10691 { 10692 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 10693 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 10694 else 10695 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 10696 10697 return nla_put_be32(skb, attr, htonl(reg)); 10698 } 10699 EXPORT_SYMBOL_GPL(nft_dump_register); 10700 10701 static int nft_validate_register_load(enum nft_registers reg, unsigned int len) 10702 { 10703 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 10704 return -EINVAL; 10705 if (len == 0) 10706 return -EINVAL; 10707 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data)) 10708 return -ERANGE; 10709 10710 return 0; 10711 } 10712 10713 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len) 10714 { 10715 u32 reg; 10716 int err; 10717 10718 err = nft_parse_register(attr, ®); 10719 if (err < 0) 10720 return err; 10721 10722 err = nft_validate_register_load(reg, len); 10723 if (err < 0) 10724 return err; 10725 10726 *sreg = reg; 10727 return 0; 10728 } 10729 EXPORT_SYMBOL_GPL(nft_parse_register_load); 10730 10731 static int nft_validate_register_store(const struct nft_ctx *ctx, 10732 enum nft_registers reg, 10733 const struct nft_data *data, 10734 enum nft_data_types type, 10735 unsigned int len) 10736 { 10737 int err; 10738 10739 switch (reg) { 10740 case NFT_REG_VERDICT: 10741 if (type != NFT_DATA_VERDICT) 10742 return -EINVAL; 10743 10744 if (data != NULL && 10745 (data->verdict.code == NFT_GOTO || 10746 data->verdict.code == NFT_JUMP)) { 10747 err = nf_tables_check_loops(ctx, data->verdict.chain); 10748 if (err < 0) 10749 return err; 10750 } 10751 10752 return 0; 10753 default: 10754 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 10755 return -EINVAL; 10756 if (len == 0) 10757 return -EINVAL; 10758 if (reg * NFT_REG32_SIZE + len > 10759 sizeof_field(struct nft_regs, data)) 10760 return -ERANGE; 10761 10762 if (data != NULL && type != NFT_DATA_VALUE) 10763 return -EINVAL; 10764 return 0; 10765 } 10766 } 10767 10768 int nft_parse_register_store(const struct nft_ctx *ctx, 10769 const struct nlattr *attr, u8 *dreg, 10770 const struct nft_data *data, 10771 enum nft_data_types type, unsigned int len) 10772 { 10773 int err; 10774 u32 reg; 10775 10776 err = nft_parse_register(attr, ®); 10777 if (err < 0) 10778 return err; 10779 10780 err = nft_validate_register_store(ctx, reg, data, type, len); 10781 if (err < 0) 10782 return err; 10783 10784 *dreg = reg; 10785 return 0; 10786 } 10787 EXPORT_SYMBOL_GPL(nft_parse_register_store); 10788 10789 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 10790 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 10791 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 10792 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 10793 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 }, 10794 }; 10795 10796 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 10797 struct nft_data_desc *desc, const struct nlattr *nla) 10798 { 10799 u8 genmask = nft_genmask_next(ctx->net); 10800 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 10801 struct nft_chain *chain; 10802 int err; 10803 10804 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla, 10805 nft_verdict_policy, NULL); 10806 if (err < 0) 10807 return err; 10808 10809 if (!tb[NFTA_VERDICT_CODE]) 10810 return -EINVAL; 10811 10812 /* zero padding hole for memcmp */ 10813 memset(data, 0, sizeof(*data)); 10814 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 10815 10816 switch (data->verdict.code) { 10817 default: 10818 switch (data->verdict.code & NF_VERDICT_MASK) { 10819 case NF_ACCEPT: 10820 case NF_DROP: 10821 case NF_QUEUE: 10822 break; 10823 default: 10824 return -EINVAL; 10825 } 10826 fallthrough; 10827 case NFT_CONTINUE: 10828 case NFT_BREAK: 10829 case NFT_RETURN: 10830 break; 10831 case NFT_JUMP: 10832 case NFT_GOTO: 10833 if (tb[NFTA_VERDICT_CHAIN]) { 10834 chain = nft_chain_lookup(ctx->net, ctx->table, 10835 tb[NFTA_VERDICT_CHAIN], 10836 genmask); 10837 } else if (tb[NFTA_VERDICT_CHAIN_ID]) { 10838 chain = nft_chain_lookup_byid(ctx->net, ctx->table, 10839 tb[NFTA_VERDICT_CHAIN_ID], 10840 genmask); 10841 if (IS_ERR(chain)) 10842 return PTR_ERR(chain); 10843 } else { 10844 return -EINVAL; 10845 } 10846 10847 if (IS_ERR(chain)) 10848 return PTR_ERR(chain); 10849 if (nft_is_base_chain(chain)) 10850 return -EOPNOTSUPP; 10851 if (nft_chain_is_bound(chain)) 10852 return -EINVAL; 10853 if (desc->flags & NFT_DATA_DESC_SETELEM && 10854 chain->flags & NFT_CHAIN_BINDING) 10855 return -EINVAL; 10856 if (!nft_use_inc(&chain->use)) 10857 return -EMFILE; 10858 10859 data->verdict.chain = chain; 10860 break; 10861 } 10862 10863 desc->len = sizeof(data->verdict); 10864 10865 return 0; 10866 } 10867 10868 static void nft_verdict_uninit(const struct nft_data *data) 10869 { 10870 struct nft_chain *chain; 10871 10872 switch (data->verdict.code) { 10873 case NFT_JUMP: 10874 case NFT_GOTO: 10875 chain = data->verdict.chain; 10876 nft_use_dec(&chain->use); 10877 break; 10878 } 10879 } 10880 10881 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v) 10882 { 10883 struct nlattr *nest; 10884 10885 nest = nla_nest_start_noflag(skb, type); 10886 if (!nest) 10887 goto nla_put_failure; 10888 10889 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code))) 10890 goto nla_put_failure; 10891 10892 switch (v->code) { 10893 case NFT_JUMP: 10894 case NFT_GOTO: 10895 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 10896 v->chain->name)) 10897 goto nla_put_failure; 10898 } 10899 nla_nest_end(skb, nest); 10900 return 0; 10901 10902 nla_put_failure: 10903 return -1; 10904 } 10905 10906 static int nft_value_init(const struct nft_ctx *ctx, 10907 struct nft_data *data, struct nft_data_desc *desc, 10908 const struct nlattr *nla) 10909 { 10910 unsigned int len; 10911 10912 len = nla_len(nla); 10913 if (len == 0) 10914 return -EINVAL; 10915 if (len > desc->size) 10916 return -EOVERFLOW; 10917 if (desc->len) { 10918 if (len != desc->len) 10919 return -EINVAL; 10920 } else { 10921 desc->len = len; 10922 } 10923 10924 nla_memcpy(data->data, nla, len); 10925 10926 return 0; 10927 } 10928 10929 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 10930 unsigned int len) 10931 { 10932 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 10933 } 10934 10935 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 10936 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 10937 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 10938 }; 10939 10940 /** 10941 * nft_data_init - parse nf_tables data netlink attributes 10942 * 10943 * @ctx: context of the expression using the data 10944 * @data: destination struct nft_data 10945 * @desc: data description 10946 * @nla: netlink attribute containing data 10947 * 10948 * Parse the netlink data attributes and initialize a struct nft_data. 10949 * The type and length of data are returned in the data description. 10950 * 10951 * The caller can indicate that it only wants to accept data of type 10952 * NFT_DATA_VALUE by passing NULL for the ctx argument. 10953 */ 10954 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, 10955 struct nft_data_desc *desc, const struct nlattr *nla) 10956 { 10957 struct nlattr *tb[NFTA_DATA_MAX + 1]; 10958 int err; 10959 10960 if (WARN_ON_ONCE(!desc->size)) 10961 return -EINVAL; 10962 10963 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla, 10964 nft_data_policy, NULL); 10965 if (err < 0) 10966 return err; 10967 10968 if (tb[NFTA_DATA_VALUE]) { 10969 if (desc->type != NFT_DATA_VALUE) 10970 return -EINVAL; 10971 10972 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]); 10973 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) { 10974 if (desc->type != NFT_DATA_VERDICT) 10975 return -EINVAL; 10976 10977 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 10978 } else { 10979 err = -EINVAL; 10980 } 10981 10982 return err; 10983 } 10984 EXPORT_SYMBOL_GPL(nft_data_init); 10985 10986 /** 10987 * nft_data_release - release a nft_data item 10988 * 10989 * @data: struct nft_data to release 10990 * @type: type of data 10991 * 10992 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 10993 * all others need to be released by calling this function. 10994 */ 10995 void nft_data_release(const struct nft_data *data, enum nft_data_types type) 10996 { 10997 if (type < NFT_DATA_VERDICT) 10998 return; 10999 switch (type) { 11000 case NFT_DATA_VERDICT: 11001 return nft_verdict_uninit(data); 11002 default: 11003 WARN_ON(1); 11004 } 11005 } 11006 EXPORT_SYMBOL_GPL(nft_data_release); 11007 11008 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 11009 enum nft_data_types type, unsigned int len) 11010 { 11011 struct nlattr *nest; 11012 int err; 11013 11014 nest = nla_nest_start_noflag(skb, attr); 11015 if (nest == NULL) 11016 return -1; 11017 11018 switch (type) { 11019 case NFT_DATA_VALUE: 11020 err = nft_value_dump(skb, data, len); 11021 break; 11022 case NFT_DATA_VERDICT: 11023 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict); 11024 break; 11025 default: 11026 err = -EINVAL; 11027 WARN_ON(1); 11028 } 11029 11030 nla_nest_end(skb, nest); 11031 return err; 11032 } 11033 EXPORT_SYMBOL_GPL(nft_data_dump); 11034 11035 int __nft_release_basechain(struct nft_ctx *ctx) 11036 { 11037 struct nft_rule *rule, *nr; 11038 11039 if (WARN_ON(!nft_is_base_chain(ctx->chain))) 11040 return 0; 11041 11042 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); 11043 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { 11044 list_del(&rule->list); 11045 nft_use_dec(&ctx->chain->use); 11046 nf_tables_rule_release(ctx, rule); 11047 } 11048 nft_chain_del(ctx->chain); 11049 nft_use_dec(&ctx->table->use); 11050 nf_tables_chain_destroy(ctx); 11051 11052 return 0; 11053 } 11054 EXPORT_SYMBOL_GPL(__nft_release_basechain); 11055 11056 static void __nft_release_hook(struct net *net, struct nft_table *table) 11057 { 11058 struct nft_flowtable *flowtable; 11059 struct nft_chain *chain; 11060 11061 list_for_each_entry(chain, &table->chains, list) 11062 __nf_tables_unregister_hook(net, table, chain, true); 11063 list_for_each_entry(flowtable, &table->flowtables, list) 11064 __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list, 11065 true); 11066 } 11067 11068 static void __nft_release_hooks(struct net *net) 11069 { 11070 struct nftables_pernet *nft_net = nft_pernet(net); 11071 struct nft_table *table; 11072 11073 list_for_each_entry(table, &nft_net->tables, list) { 11074 if (nft_table_has_owner(table)) 11075 continue; 11076 11077 __nft_release_hook(net, table); 11078 } 11079 } 11080 11081 static void __nft_release_table(struct net *net, struct nft_table *table) 11082 { 11083 struct nft_flowtable *flowtable, *nf; 11084 struct nft_chain *chain, *nc; 11085 struct nft_object *obj, *ne; 11086 struct nft_rule *rule, *nr; 11087 struct nft_set *set, *ns; 11088 struct nft_ctx ctx = { 11089 .net = net, 11090 .family = NFPROTO_NETDEV, 11091 }; 11092 11093 ctx.family = table->family; 11094 ctx.table = table; 11095 list_for_each_entry(chain, &table->chains, list) { 11096 if (nft_chain_binding(chain)) 11097 continue; 11098 11099 ctx.chain = chain; 11100 list_for_each_entry_safe(rule, nr, &chain->rules, list) { 11101 list_del(&rule->list); 11102 nft_use_dec(&chain->use); 11103 nf_tables_rule_release(&ctx, rule); 11104 } 11105 } 11106 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 11107 list_del(&flowtable->list); 11108 nft_use_dec(&table->use); 11109 nf_tables_flowtable_destroy(flowtable); 11110 } 11111 list_for_each_entry_safe(set, ns, &table->sets, list) { 11112 list_del(&set->list); 11113 nft_use_dec(&table->use); 11114 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11115 nft_map_deactivate(&ctx, set); 11116 11117 nft_set_destroy(&ctx, set); 11118 } 11119 list_for_each_entry_safe(obj, ne, &table->objects, list) { 11120 nft_obj_del(obj); 11121 nft_use_dec(&table->use); 11122 nft_obj_destroy(&ctx, obj); 11123 } 11124 list_for_each_entry_safe(chain, nc, &table->chains, list) { 11125 ctx.chain = chain; 11126 nft_chain_del(chain); 11127 nft_use_dec(&table->use); 11128 nf_tables_chain_destroy(&ctx); 11129 } 11130 nf_tables_table_destroy(&ctx); 11131 } 11132 11133 static void __nft_release_tables(struct net *net) 11134 { 11135 struct nftables_pernet *nft_net = nft_pernet(net); 11136 struct nft_table *table, *nt; 11137 11138 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 11139 if (nft_table_has_owner(table)) 11140 continue; 11141 11142 list_del(&table->list); 11143 11144 __nft_release_table(net, table); 11145 } 11146 } 11147 11148 static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, 11149 void *ptr) 11150 { 11151 struct nft_table *table, *to_delete[8]; 11152 struct nftables_pernet *nft_net; 11153 struct netlink_notify *n = ptr; 11154 struct net *net = n->net; 11155 unsigned int deleted; 11156 bool restart = false; 11157 unsigned int gc_seq; 11158 11159 if (event != NETLINK_URELEASE || n->protocol != NETLINK_NETFILTER) 11160 return NOTIFY_DONE; 11161 11162 nft_net = nft_pernet(net); 11163 deleted = 0; 11164 mutex_lock(&nft_net->commit_mutex); 11165 11166 gc_seq = nft_gc_seq_begin(nft_net); 11167 11168 if (!list_empty(&nf_tables_destroy_list)) 11169 nf_tables_trans_destroy_flush_work(); 11170 again: 11171 list_for_each_entry(table, &nft_net->tables, list) { 11172 if (nft_table_has_owner(table) && 11173 n->portid == table->nlpid) { 11174 __nft_release_hook(net, table); 11175 list_del_rcu(&table->list); 11176 to_delete[deleted++] = table; 11177 if (deleted >= ARRAY_SIZE(to_delete)) 11178 break; 11179 } 11180 } 11181 if (deleted) { 11182 restart = deleted >= ARRAY_SIZE(to_delete); 11183 synchronize_rcu(); 11184 while (deleted) 11185 __nft_release_table(net, to_delete[--deleted]); 11186 11187 if (restart) 11188 goto again; 11189 } 11190 nft_gc_seq_end(nft_net, gc_seq); 11191 11192 mutex_unlock(&nft_net->commit_mutex); 11193 11194 return NOTIFY_DONE; 11195 } 11196 11197 static struct notifier_block nft_nl_notifier = { 11198 .notifier_call = nft_rcv_nl_event, 11199 }; 11200 11201 static int __net_init nf_tables_init_net(struct net *net) 11202 { 11203 struct nftables_pernet *nft_net = nft_pernet(net); 11204 11205 INIT_LIST_HEAD(&nft_net->tables); 11206 INIT_LIST_HEAD(&nft_net->commit_list); 11207 INIT_LIST_HEAD(&nft_net->binding_list); 11208 INIT_LIST_HEAD(&nft_net->module_list); 11209 INIT_LIST_HEAD(&nft_net->notify_list); 11210 mutex_init(&nft_net->commit_mutex); 11211 nft_net->base_seq = 1; 11212 nft_net->gc_seq = 0; 11213 nft_net->validate_state = NFT_VALIDATE_SKIP; 11214 11215 return 0; 11216 } 11217 11218 static void __net_exit nf_tables_pre_exit_net(struct net *net) 11219 { 11220 struct nftables_pernet *nft_net = nft_pernet(net); 11221 11222 mutex_lock(&nft_net->commit_mutex); 11223 __nft_release_hooks(net); 11224 mutex_unlock(&nft_net->commit_mutex); 11225 } 11226 11227 static void __net_exit nf_tables_exit_net(struct net *net) 11228 { 11229 struct nftables_pernet *nft_net = nft_pernet(net); 11230 unsigned int gc_seq; 11231 11232 mutex_lock(&nft_net->commit_mutex); 11233 11234 gc_seq = nft_gc_seq_begin(nft_net); 11235 11236 if (!list_empty(&nft_net->commit_list) || 11237 !list_empty(&nft_net->module_list)) 11238 __nf_tables_abort(net, NFNL_ABORT_NONE); 11239 11240 __nft_release_tables(net); 11241 11242 nft_gc_seq_end(nft_net, gc_seq); 11243 11244 mutex_unlock(&nft_net->commit_mutex); 11245 WARN_ON_ONCE(!list_empty(&nft_net->tables)); 11246 WARN_ON_ONCE(!list_empty(&nft_net->module_list)); 11247 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 11248 } 11249 11250 static void nf_tables_exit_batch(struct list_head *net_exit_list) 11251 { 11252 flush_work(&trans_gc_work); 11253 } 11254 11255 static struct pernet_operations nf_tables_net_ops = { 11256 .init = nf_tables_init_net, 11257 .pre_exit = nf_tables_pre_exit_net, 11258 .exit = nf_tables_exit_net, 11259 .exit_batch = nf_tables_exit_batch, 11260 .id = &nf_tables_net_id, 11261 .size = sizeof(struct nftables_pernet), 11262 }; 11263 11264 static int __init nf_tables_module_init(void) 11265 { 11266 int err; 11267 11268 err = register_pernet_subsys(&nf_tables_net_ops); 11269 if (err < 0) 11270 return err; 11271 11272 err = nft_chain_filter_init(); 11273 if (err < 0) 11274 goto err_chain_filter; 11275 11276 err = nf_tables_core_module_init(); 11277 if (err < 0) 11278 goto err_core_module; 11279 11280 err = register_netdevice_notifier(&nf_tables_flowtable_notifier); 11281 if (err < 0) 11282 goto err_netdev_notifier; 11283 11284 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params); 11285 if (err < 0) 11286 goto err_rht_objname; 11287 11288 err = nft_offload_init(); 11289 if (err < 0) 11290 goto err_offload; 11291 11292 err = netlink_register_notifier(&nft_nl_notifier); 11293 if (err < 0) 11294 goto err_netlink_notifier; 11295 11296 /* must be last */ 11297 err = nfnetlink_subsys_register(&nf_tables_subsys); 11298 if (err < 0) 11299 goto err_nfnl_subsys; 11300 11301 nft_chain_route_init(); 11302 11303 return err; 11304 11305 err_nfnl_subsys: 11306 netlink_unregister_notifier(&nft_nl_notifier); 11307 err_netlink_notifier: 11308 nft_offload_exit(); 11309 err_offload: 11310 rhltable_destroy(&nft_objname_ht); 11311 err_rht_objname: 11312 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 11313 err_netdev_notifier: 11314 nf_tables_core_module_exit(); 11315 err_core_module: 11316 nft_chain_filter_fini(); 11317 err_chain_filter: 11318 unregister_pernet_subsys(&nf_tables_net_ops); 11319 return err; 11320 } 11321 11322 static void __exit nf_tables_module_exit(void) 11323 { 11324 nfnetlink_subsys_unregister(&nf_tables_subsys); 11325 netlink_unregister_notifier(&nft_nl_notifier); 11326 nft_offload_exit(); 11327 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 11328 nft_chain_filter_fini(); 11329 nft_chain_route_fini(); 11330 unregister_pernet_subsys(&nf_tables_net_ops); 11331 cancel_work_sync(&trans_gc_work); 11332 cancel_work_sync(&trans_destroy_work); 11333 rcu_barrier(); 11334 rhltable_destroy(&nft_objname_ht); 11335 nf_tables_core_module_exit(); 11336 } 11337 11338 module_init(nf_tables_module_init); 11339 module_exit(nf_tables_module_exit); 11340 11341 MODULE_LICENSE("GPL"); 11342 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 11343 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 11344