xref: /linux/net/netfilter/nft_compat.c (revision dd093fb0) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4  *
5  * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
6  */
7 
8 #include <linux/kernel.h>
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/netlink.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter/nfnetlink.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <linux/netfilter/nf_tables_compat.h>
16 #include <linux/netfilter/x_tables.h>
17 #include <linux/netfilter_ipv4/ip_tables.h>
18 #include <linux/netfilter_ipv6/ip6_tables.h>
19 #include <linux/netfilter_bridge/ebtables.h>
20 #include <linux/netfilter_arp/arp_tables.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_log.h>
23 
24 /* Used for matches where *info is larger than X byte */
25 #define NFT_MATCH_LARGE_THRESH	192
26 
27 struct nft_xt_match_priv {
28 	void *info;
29 };
30 
31 static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
32 						const char *tablename)
33 {
34 	enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
35 	const struct nft_chain *chain = ctx->chain;
36 	const struct nft_base_chain *basechain;
37 
38 	if (!tablename ||
39 	    !nft_is_base_chain(chain))
40 		return 0;
41 
42 	basechain = nft_base_chain(chain);
43 	if (strcmp(tablename, "nat") == 0) {
44 		if (ctx->family != NFPROTO_BRIDGE)
45 			type = NFT_CHAIN_T_NAT;
46 		if (basechain->type->type != type)
47 			return -EINVAL;
48 	}
49 
50 	return 0;
51 }
52 
53 union nft_entry {
54 	struct ipt_entry e4;
55 	struct ip6t_entry e6;
56 	struct ebt_entry ebt;
57 	struct arpt_entry arp;
58 };
59 
60 static inline void
61 nft_compat_set_par(struct xt_action_param *par,
62 		   const struct nft_pktinfo *pkt,
63 		   const void *xt, const void *xt_info)
64 {
65 	par->state	= pkt->state;
66 	par->thoff	= nft_thoff(pkt);
67 	par->fragoff	= pkt->fragoff;
68 	par->target	= xt;
69 	par->targinfo	= xt_info;
70 	par->hotdrop	= false;
71 }
72 
73 static void nft_target_eval_xt(const struct nft_expr *expr,
74 			       struct nft_regs *regs,
75 			       const struct nft_pktinfo *pkt)
76 {
77 	void *info = nft_expr_priv(expr);
78 	struct xt_target *target = expr->ops->data;
79 	struct sk_buff *skb = pkt->skb;
80 	struct xt_action_param xt;
81 	int ret;
82 
83 	nft_compat_set_par(&xt, pkt, target, info);
84 
85 	ret = target->target(skb, &xt);
86 
87 	if (xt.hotdrop)
88 		ret = NF_DROP;
89 
90 	switch (ret) {
91 	case XT_CONTINUE:
92 		regs->verdict.code = NFT_CONTINUE;
93 		break;
94 	default:
95 		regs->verdict.code = ret;
96 		break;
97 	}
98 }
99 
100 static void nft_target_eval_bridge(const struct nft_expr *expr,
101 				   struct nft_regs *regs,
102 				   const struct nft_pktinfo *pkt)
103 {
104 	void *info = nft_expr_priv(expr);
105 	struct xt_target *target = expr->ops->data;
106 	struct sk_buff *skb = pkt->skb;
107 	struct xt_action_param xt;
108 	int ret;
109 
110 	nft_compat_set_par(&xt, pkt, target, info);
111 
112 	ret = target->target(skb, &xt);
113 
114 	if (xt.hotdrop)
115 		ret = NF_DROP;
116 
117 	switch (ret) {
118 	case EBT_ACCEPT:
119 		regs->verdict.code = NF_ACCEPT;
120 		break;
121 	case EBT_DROP:
122 		regs->verdict.code = NF_DROP;
123 		break;
124 	case EBT_CONTINUE:
125 		regs->verdict.code = NFT_CONTINUE;
126 		break;
127 	case EBT_RETURN:
128 		regs->verdict.code = NFT_RETURN;
129 		break;
130 	default:
131 		regs->verdict.code = ret;
132 		break;
133 	}
134 }
135 
136 static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = {
137 	[NFTA_TARGET_NAME]	= { .type = NLA_NUL_STRING },
138 	[NFTA_TARGET_REV]	= { .type = NLA_U32 },
139 	[NFTA_TARGET_INFO]	= { .type = NLA_BINARY },
140 };
141 
142 static void
143 nft_target_set_tgchk_param(struct xt_tgchk_param *par,
144 			   const struct nft_ctx *ctx,
145 			   struct xt_target *target, void *info,
146 			   union nft_entry *entry, u16 proto, bool inv)
147 {
148 	par->net	= ctx->net;
149 	par->table	= ctx->table->name;
150 	switch (ctx->family) {
151 	case AF_INET:
152 		entry->e4.ip.proto = proto;
153 		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
154 		break;
155 	case AF_INET6:
156 		if (proto)
157 			entry->e6.ipv6.flags |= IP6T_F_PROTO;
158 
159 		entry->e6.ipv6.proto = proto;
160 		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
161 		break;
162 	case NFPROTO_BRIDGE:
163 		entry->ebt.ethproto = (__force __be16)proto;
164 		entry->ebt.invflags = inv ? EBT_IPROTO : 0;
165 		break;
166 	case NFPROTO_ARP:
167 		break;
168 	}
169 	par->entryinfo	= entry;
170 	par->target	= target;
171 	par->targinfo	= info;
172 	if (nft_is_base_chain(ctx->chain)) {
173 		const struct nft_base_chain *basechain =
174 						nft_base_chain(ctx->chain);
175 		const struct nf_hook_ops *ops = &basechain->ops;
176 
177 		par->hook_mask = 1 << ops->hooknum;
178 	} else {
179 		par->hook_mask = 0;
180 	}
181 	par->family	= ctx->family;
182 	par->nft_compat = true;
183 }
184 
185 static void target_compat_from_user(struct xt_target *t, void *in, void *out)
186 {
187 	int pad;
188 
189 	memcpy(out, in, t->targetsize);
190 	pad = XT_ALIGN(t->targetsize) - t->targetsize;
191 	if (pad > 0)
192 		memset(out + t->targetsize, 0, pad);
193 }
194 
195 static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = {
196 	[NFTA_RULE_COMPAT_PROTO]	= { .type = NLA_U32 },
197 	[NFTA_RULE_COMPAT_FLAGS]	= { .type = NLA_U32 },
198 };
199 
200 static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
201 {
202 	struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
203 	u32 flags;
204 	int err;
205 
206 	err = nla_parse_nested_deprecated(tb, NFTA_RULE_COMPAT_MAX, attr,
207 					  nft_rule_compat_policy, NULL);
208 	if (err < 0)
209 		return err;
210 
211 	if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS])
212 		return -EINVAL;
213 
214 	flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS]));
215 	if (flags & ~NFT_RULE_COMPAT_F_MASK)
216 		return -EINVAL;
217 	if (flags & NFT_RULE_COMPAT_F_INV)
218 		*inv = true;
219 
220 	*proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
221 	return 0;
222 }
223 
224 static void nft_compat_wait_for_destructors(void)
225 {
226 	/* xtables matches or targets can have side effects, e.g.
227 	 * creation/destruction of /proc files.
228 	 * The xt ->destroy functions are run asynchronously from
229 	 * work queue.  If we have pending invocations we thus
230 	 * need to wait for those to finish.
231 	 */
232 	nf_tables_trans_destroy_flush_work();
233 }
234 
235 static int
236 nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
237 		const struct nlattr * const tb[])
238 {
239 	void *info = nft_expr_priv(expr);
240 	struct xt_target *target = expr->ops->data;
241 	struct xt_tgchk_param par;
242 	size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
243 	u16 proto = 0;
244 	bool inv = false;
245 	union nft_entry e = {};
246 	int ret;
247 
248 	target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
249 
250 	if (ctx->nla[NFTA_RULE_COMPAT]) {
251 		ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
252 		if (ret < 0)
253 			return ret;
254 	}
255 
256 	nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
257 
258 	nft_compat_wait_for_destructors();
259 
260 	ret = xt_check_target(&par, size, proto, inv);
261 	if (ret < 0) {
262 		if (ret == -ENOENT) {
263 			const char *modname = NULL;
264 
265 			if (strcmp(target->name, "LOG") == 0)
266 				modname = "nf_log_syslog";
267 			else if (strcmp(target->name, "NFLOG") == 0)
268 				modname = "nfnetlink_log";
269 
270 			if (modname &&
271 			    nft_request_module(ctx->net, "%s", modname) == -EAGAIN)
272 				return -EAGAIN;
273 		}
274 
275 		return ret;
276 	}
277 
278 	/* The standard target cannot be used */
279 	if (!target->target)
280 		return -EINVAL;
281 
282 	return 0;
283 }
284 
285 static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr)
286 {
287 	module_put(me);
288 	kfree(expr->ops);
289 }
290 
291 static void
292 nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
293 {
294 	struct xt_target *target = expr->ops->data;
295 	void *info = nft_expr_priv(expr);
296 	struct module *me = target->me;
297 	struct xt_tgdtor_param par;
298 
299 	par.net = ctx->net;
300 	par.target = target;
301 	par.targinfo = info;
302 	par.family = ctx->family;
303 	if (par.target->destroy != NULL)
304 		par.target->destroy(&par);
305 
306 	__nft_mt_tg_destroy(me, expr);
307 }
308 
309 static int nft_extension_dump_info(struct sk_buff *skb, int attr,
310 				   const void *info,
311 				   unsigned int size, unsigned int user_size)
312 {
313 	unsigned int info_size, aligned_size = XT_ALIGN(size);
314 	struct nlattr *nla;
315 
316 	nla = nla_reserve(skb, attr, aligned_size);
317 	if (!nla)
318 		return -1;
319 
320 	info_size = user_size ? : size;
321 	memcpy(nla_data(nla), info, info_size);
322 	memset(nla_data(nla) + info_size, 0, aligned_size - info_size);
323 
324 	return 0;
325 }
326 
327 static int nft_target_dump(struct sk_buff *skb,
328 			   const struct nft_expr *expr, bool reset)
329 {
330 	const struct xt_target *target = expr->ops->data;
331 	void *info = nft_expr_priv(expr);
332 
333 	if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) ||
334 	    nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) ||
335 	    nft_extension_dump_info(skb, NFTA_TARGET_INFO, info,
336 				    target->targetsize, target->usersize))
337 		goto nla_put_failure;
338 
339 	return 0;
340 
341 nla_put_failure:
342 	return -1;
343 }
344 
345 static int nft_target_validate(const struct nft_ctx *ctx,
346 			       const struct nft_expr *expr,
347 			       const struct nft_data **data)
348 {
349 	struct xt_target *target = expr->ops->data;
350 	unsigned int hook_mask = 0;
351 	int ret;
352 
353 	if (nft_is_base_chain(ctx->chain)) {
354 		const struct nft_base_chain *basechain =
355 						nft_base_chain(ctx->chain);
356 		const struct nf_hook_ops *ops = &basechain->ops;
357 
358 		hook_mask = 1 << ops->hooknum;
359 		if (target->hooks && !(hook_mask & target->hooks))
360 			return -EINVAL;
361 
362 		ret = nft_compat_chain_validate_dependency(ctx, target->table);
363 		if (ret < 0)
364 			return ret;
365 	}
366 	return 0;
367 }
368 
369 static void __nft_match_eval(const struct nft_expr *expr,
370 			     struct nft_regs *regs,
371 			     const struct nft_pktinfo *pkt,
372 			     void *info)
373 {
374 	struct xt_match *match = expr->ops->data;
375 	struct sk_buff *skb = pkt->skb;
376 	struct xt_action_param xt;
377 	bool ret;
378 
379 	nft_compat_set_par(&xt, pkt, match, info);
380 
381 	ret = match->match(skb, &xt);
382 
383 	if (xt.hotdrop) {
384 		regs->verdict.code = NF_DROP;
385 		return;
386 	}
387 
388 	switch (ret ? 1 : 0) {
389 	case 1:
390 		regs->verdict.code = NFT_CONTINUE;
391 		break;
392 	case 0:
393 		regs->verdict.code = NFT_BREAK;
394 		break;
395 	}
396 }
397 
398 static void nft_match_large_eval(const struct nft_expr *expr,
399 				 struct nft_regs *regs,
400 				 const struct nft_pktinfo *pkt)
401 {
402 	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
403 
404 	__nft_match_eval(expr, regs, pkt, priv->info);
405 }
406 
407 static void nft_match_eval(const struct nft_expr *expr,
408 			   struct nft_regs *regs,
409 			   const struct nft_pktinfo *pkt)
410 {
411 	__nft_match_eval(expr, regs, pkt, nft_expr_priv(expr));
412 }
413 
414 static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
415 	[NFTA_MATCH_NAME]	= { .type = NLA_NUL_STRING },
416 	[NFTA_MATCH_REV]	= { .type = NLA_U32 },
417 	[NFTA_MATCH_INFO]	= { .type = NLA_BINARY },
418 };
419 
420 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
421 static void
422 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
423 			  struct xt_match *match, void *info,
424 			  union nft_entry *entry, u16 proto, bool inv)
425 {
426 	par->net	= ctx->net;
427 	par->table	= ctx->table->name;
428 	switch (ctx->family) {
429 	case AF_INET:
430 		entry->e4.ip.proto = proto;
431 		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
432 		break;
433 	case AF_INET6:
434 		if (proto)
435 			entry->e6.ipv6.flags |= IP6T_F_PROTO;
436 
437 		entry->e6.ipv6.proto = proto;
438 		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
439 		break;
440 	case NFPROTO_BRIDGE:
441 		entry->ebt.ethproto = (__force __be16)proto;
442 		entry->ebt.invflags = inv ? EBT_IPROTO : 0;
443 		break;
444 	case NFPROTO_ARP:
445 		break;
446 	}
447 	par->entryinfo	= entry;
448 	par->match	= match;
449 	par->matchinfo	= info;
450 	if (nft_is_base_chain(ctx->chain)) {
451 		const struct nft_base_chain *basechain =
452 						nft_base_chain(ctx->chain);
453 		const struct nf_hook_ops *ops = &basechain->ops;
454 
455 		par->hook_mask = 1 << ops->hooknum;
456 	} else {
457 		par->hook_mask = 0;
458 	}
459 	par->family	= ctx->family;
460 	par->nft_compat = true;
461 }
462 
463 static void match_compat_from_user(struct xt_match *m, void *in, void *out)
464 {
465 	int pad;
466 
467 	memcpy(out, in, m->matchsize);
468 	pad = XT_ALIGN(m->matchsize) - m->matchsize;
469 	if (pad > 0)
470 		memset(out + m->matchsize, 0, pad);
471 }
472 
473 static int
474 __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
475 		 const struct nlattr * const tb[],
476 		 void *info)
477 {
478 	struct xt_match *match = expr->ops->data;
479 	struct xt_mtchk_param par;
480 	size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
481 	u16 proto = 0;
482 	bool inv = false;
483 	union nft_entry e = {};
484 	int ret;
485 
486 	match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
487 
488 	if (ctx->nla[NFTA_RULE_COMPAT]) {
489 		ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
490 		if (ret < 0)
491 			return ret;
492 	}
493 
494 	nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
495 
496 	nft_compat_wait_for_destructors();
497 
498 	return xt_check_match(&par, size, proto, inv);
499 }
500 
501 static int
502 nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
503 	       const struct nlattr * const tb[])
504 {
505 	return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr));
506 }
507 
508 static int
509 nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
510 		     const struct nlattr * const tb[])
511 {
512 	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
513 	struct xt_match *m = expr->ops->data;
514 	int ret;
515 
516 	priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL);
517 	if (!priv->info)
518 		return -ENOMEM;
519 
520 	ret = __nft_match_init(ctx, expr, tb, priv->info);
521 	if (ret)
522 		kfree(priv->info);
523 	return ret;
524 }
525 
526 static void
527 __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
528 		    void *info)
529 {
530 	struct xt_match *match = expr->ops->data;
531 	struct module *me = match->me;
532 	struct xt_mtdtor_param par;
533 
534 	par.net = ctx->net;
535 	par.match = match;
536 	par.matchinfo = info;
537 	par.family = ctx->family;
538 	if (par.match->destroy != NULL)
539 		par.match->destroy(&par);
540 
541 	__nft_mt_tg_destroy(me, expr);
542 }
543 
544 static void
545 nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
546 {
547 	__nft_match_destroy(ctx, expr, nft_expr_priv(expr));
548 }
549 
550 static void
551 nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
552 {
553 	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
554 
555 	__nft_match_destroy(ctx, expr, priv->info);
556 	kfree(priv->info);
557 }
558 
559 static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr,
560 			    void *info)
561 {
562 	struct xt_match *match = expr->ops->data;
563 
564 	if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) ||
565 	    nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) ||
566 	    nft_extension_dump_info(skb, NFTA_MATCH_INFO, info,
567 				    match->matchsize, match->usersize))
568 		goto nla_put_failure;
569 
570 	return 0;
571 
572 nla_put_failure:
573 	return -1;
574 }
575 
576 static int nft_match_dump(struct sk_buff *skb,
577 			  const struct nft_expr *expr, bool reset)
578 {
579 	return __nft_match_dump(skb, expr, nft_expr_priv(expr));
580 }
581 
582 static int nft_match_large_dump(struct sk_buff *skb,
583 				const struct nft_expr *e, bool reset)
584 {
585 	struct nft_xt_match_priv *priv = nft_expr_priv(e);
586 
587 	return __nft_match_dump(skb, e, priv->info);
588 }
589 
590 static int nft_match_validate(const struct nft_ctx *ctx,
591 			      const struct nft_expr *expr,
592 			      const struct nft_data **data)
593 {
594 	struct xt_match *match = expr->ops->data;
595 	unsigned int hook_mask = 0;
596 	int ret;
597 
598 	if (nft_is_base_chain(ctx->chain)) {
599 		const struct nft_base_chain *basechain =
600 						nft_base_chain(ctx->chain);
601 		const struct nf_hook_ops *ops = &basechain->ops;
602 
603 		hook_mask = 1 << ops->hooknum;
604 		if (match->hooks && !(hook_mask & match->hooks))
605 			return -EINVAL;
606 
607 		ret = nft_compat_chain_validate_dependency(ctx, match->table);
608 		if (ret < 0)
609 			return ret;
610 	}
611 	return 0;
612 }
613 
614 static int
615 nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
616 		      int event, u16 family, const char *name,
617 		      int rev, int target)
618 {
619 	struct nlmsghdr *nlh;
620 	unsigned int flags = portid ? NLM_F_MULTI : 0;
621 
622 	event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event);
623 	nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
624 			   NFNETLINK_V0, 0);
625 	if (!nlh)
626 		goto nlmsg_failure;
627 
628 	if (nla_put_string(skb, NFTA_COMPAT_NAME, name) ||
629 	    nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) ||
630 	    nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target)))
631 		goto nla_put_failure;
632 
633 	nlmsg_end(skb, nlh);
634 	return skb->len;
635 
636 nlmsg_failure:
637 nla_put_failure:
638 	nlmsg_cancel(skb, nlh);
639 	return -1;
640 }
641 
642 static int nfnl_compat_get_rcu(struct sk_buff *skb,
643 			       const struct nfnl_info *info,
644 			       const struct nlattr * const tb[])
645 {
646 	u8 family = info->nfmsg->nfgen_family;
647 	const char *name, *fmt;
648 	struct sk_buff *skb2;
649 	int ret = 0, target;
650 	u32 rev;
651 
652 	if (tb[NFTA_COMPAT_NAME] == NULL ||
653 	    tb[NFTA_COMPAT_REV] == NULL ||
654 	    tb[NFTA_COMPAT_TYPE] == NULL)
655 		return -EINVAL;
656 
657 	name = nla_data(tb[NFTA_COMPAT_NAME]);
658 	rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV]));
659 	target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE]));
660 
661 	switch(family) {
662 	case AF_INET:
663 		fmt = "ipt_%s";
664 		break;
665 	case AF_INET6:
666 		fmt = "ip6t_%s";
667 		break;
668 	case NFPROTO_BRIDGE:
669 		fmt = "ebt_%s";
670 		break;
671 	case NFPROTO_ARP:
672 		fmt = "arpt_%s";
673 		break;
674 	default:
675 		pr_err("nft_compat: unsupported protocol %d\n", family);
676 		return -EINVAL;
677 	}
678 
679 	if (!try_module_get(THIS_MODULE))
680 		return -EINVAL;
681 
682 	rcu_read_unlock();
683 	try_then_request_module(xt_find_revision(family, name, rev, target, &ret),
684 				fmt, name);
685 	if (ret < 0)
686 		goto out_put;
687 
688 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
689 	if (skb2 == NULL) {
690 		ret = -ENOMEM;
691 		goto out_put;
692 	}
693 
694 	/* include the best revision for this extension in the message */
695 	if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid,
696 				  info->nlh->nlmsg_seq,
697 				  NFNL_MSG_TYPE(info->nlh->nlmsg_type),
698 				  NFNL_MSG_COMPAT_GET,
699 				  family, name, ret, target) <= 0) {
700 		kfree_skb(skb2);
701 		goto out_put;
702 	}
703 
704 	ret = nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid);
705 out_put:
706 	rcu_read_lock();
707 	module_put(THIS_MODULE);
708 
709 	return ret;
710 }
711 
712 static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = {
713 	[NFTA_COMPAT_NAME]	= { .type = NLA_NUL_STRING,
714 				    .len = NFT_COMPAT_NAME_MAX-1 },
715 	[NFTA_COMPAT_REV]	= { .type = NLA_U32 },
716 	[NFTA_COMPAT_TYPE]	= { .type = NLA_U32 },
717 };
718 
719 static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = {
720 	[NFNL_MSG_COMPAT_GET]	= {
721 		.call		= nfnl_compat_get_rcu,
722 		.type		= NFNL_CB_RCU,
723 		.attr_count	= NFTA_COMPAT_MAX,
724 		.policy		= nfnl_compat_policy_get
725 	},
726 };
727 
728 static const struct nfnetlink_subsystem nfnl_compat_subsys = {
729 	.name		= "nft-compat",
730 	.subsys_id	= NFNL_SUBSYS_NFT_COMPAT,
731 	.cb_count	= NFNL_MSG_COMPAT_MAX,
732 	.cb		= nfnl_nft_compat_cb,
733 };
734 
735 static struct nft_expr_type nft_match_type;
736 
737 static bool nft_match_reduce(struct nft_regs_track *track,
738 			     const struct nft_expr *expr)
739 {
740 	const struct xt_match *match = expr->ops->data;
741 
742 	return strcmp(match->name, "comment") == 0;
743 }
744 
745 static const struct nft_expr_ops *
746 nft_match_select_ops(const struct nft_ctx *ctx,
747 		     const struct nlattr * const tb[])
748 {
749 	struct nft_expr_ops *ops;
750 	struct xt_match *match;
751 	unsigned int matchsize;
752 	char *mt_name;
753 	u32 rev, family;
754 	int err;
755 
756 	if (tb[NFTA_MATCH_NAME] == NULL ||
757 	    tb[NFTA_MATCH_REV] == NULL ||
758 	    tb[NFTA_MATCH_INFO] == NULL)
759 		return ERR_PTR(-EINVAL);
760 
761 	mt_name = nla_data(tb[NFTA_MATCH_NAME]);
762 	rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
763 	family = ctx->family;
764 
765 	match = xt_request_find_match(family, mt_name, rev);
766 	if (IS_ERR(match))
767 		return ERR_PTR(-ENOENT);
768 
769 	if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) {
770 		err = -EINVAL;
771 		goto err;
772 	}
773 
774 	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
775 	if (!ops) {
776 		err = -ENOMEM;
777 		goto err;
778 	}
779 
780 	ops->type = &nft_match_type;
781 	ops->eval = nft_match_eval;
782 	ops->init = nft_match_init;
783 	ops->destroy = nft_match_destroy;
784 	ops->dump = nft_match_dump;
785 	ops->validate = nft_match_validate;
786 	ops->data = match;
787 	ops->reduce = nft_match_reduce;
788 
789 	matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
790 	if (matchsize > NFT_MATCH_LARGE_THRESH) {
791 		matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv));
792 
793 		ops->eval = nft_match_large_eval;
794 		ops->init = nft_match_large_init;
795 		ops->destroy = nft_match_large_destroy;
796 		ops->dump = nft_match_large_dump;
797 	}
798 
799 	ops->size = matchsize;
800 
801 	return ops;
802 err:
803 	module_put(match->me);
804 	return ERR_PTR(err);
805 }
806 
807 static void nft_match_release_ops(const struct nft_expr_ops *ops)
808 {
809 	struct xt_match *match = ops->data;
810 
811 	module_put(match->me);
812 	kfree(ops);
813 }
814 
815 static struct nft_expr_type nft_match_type __read_mostly = {
816 	.name		= "match",
817 	.select_ops	= nft_match_select_ops,
818 	.release_ops	= nft_match_release_ops,
819 	.policy		= nft_match_policy,
820 	.maxattr	= NFTA_MATCH_MAX,
821 	.owner		= THIS_MODULE,
822 };
823 
824 static struct nft_expr_type nft_target_type;
825 
826 static const struct nft_expr_ops *
827 nft_target_select_ops(const struct nft_ctx *ctx,
828 		      const struct nlattr * const tb[])
829 {
830 	struct nft_expr_ops *ops;
831 	struct xt_target *target;
832 	char *tg_name;
833 	u32 rev, family;
834 	int err;
835 
836 	if (tb[NFTA_TARGET_NAME] == NULL ||
837 	    tb[NFTA_TARGET_REV] == NULL ||
838 	    tb[NFTA_TARGET_INFO] == NULL)
839 		return ERR_PTR(-EINVAL);
840 
841 	tg_name = nla_data(tb[NFTA_TARGET_NAME]);
842 	rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
843 	family = ctx->family;
844 
845 	if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
846 	    strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
847 	    strcmp(tg_name, "standard") == 0)
848 		return ERR_PTR(-EINVAL);
849 
850 	target = xt_request_find_target(family, tg_name, rev);
851 	if (IS_ERR(target))
852 		return ERR_PTR(-ENOENT);
853 
854 	if (!target->target) {
855 		err = -EINVAL;
856 		goto err;
857 	}
858 
859 	if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
860 		err = -EINVAL;
861 		goto err;
862 	}
863 
864 	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
865 	if (!ops) {
866 		err = -ENOMEM;
867 		goto err;
868 	}
869 
870 	ops->type = &nft_target_type;
871 	ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
872 	ops->init = nft_target_init;
873 	ops->destroy = nft_target_destroy;
874 	ops->dump = nft_target_dump;
875 	ops->validate = nft_target_validate;
876 	ops->data = target;
877 	ops->reduce = NFT_REDUCE_READONLY;
878 
879 	if (family == NFPROTO_BRIDGE)
880 		ops->eval = nft_target_eval_bridge;
881 	else
882 		ops->eval = nft_target_eval_xt;
883 
884 	return ops;
885 err:
886 	module_put(target->me);
887 	return ERR_PTR(err);
888 }
889 
890 static void nft_target_release_ops(const struct nft_expr_ops *ops)
891 {
892 	struct xt_target *target = ops->data;
893 
894 	module_put(target->me);
895 	kfree(ops);
896 }
897 
898 static struct nft_expr_type nft_target_type __read_mostly = {
899 	.name		= "target",
900 	.select_ops	= nft_target_select_ops,
901 	.release_ops	= nft_target_release_ops,
902 	.policy		= nft_target_policy,
903 	.maxattr	= NFTA_TARGET_MAX,
904 	.owner		= THIS_MODULE,
905 };
906 
907 static int __init nft_compat_module_init(void)
908 {
909 	int ret;
910 
911 	ret = nft_register_expr(&nft_match_type);
912 	if (ret < 0)
913 		return ret;
914 
915 	ret = nft_register_expr(&nft_target_type);
916 	if (ret < 0)
917 		goto err_match;
918 
919 	ret = nfnetlink_subsys_register(&nfnl_compat_subsys);
920 	if (ret < 0) {
921 		pr_err("nft_compat: cannot register with nfnetlink.\n");
922 		goto err_target;
923 	}
924 
925 	return ret;
926 err_target:
927 	nft_unregister_expr(&nft_target_type);
928 err_match:
929 	nft_unregister_expr(&nft_match_type);
930 	return ret;
931 }
932 
933 static void __exit nft_compat_module_exit(void)
934 {
935 	nfnetlink_subsys_unregister(&nfnl_compat_subsys);
936 	nft_unregister_expr(&nft_target_type);
937 	nft_unregister_expr(&nft_match_type);
938 }
939 
940 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
941 
942 module_init(nft_compat_module_init);
943 module_exit(nft_compat_module_exit);
944 
945 MODULE_LICENSE("GPL");
946 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
947 MODULE_ALIAS_NFT_EXPR("match");
948 MODULE_ALIAS_NFT_EXPR("target");
949 MODULE_DESCRIPTION("x_tables over nftables support");
950