1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Patrick McHardy <kaber@trash.net> 4 */ 5 6 #include <linux/kernel.h> 7 #include <linux/module.h> 8 #include <linux/init.h> 9 #include <linux/netlink.h> 10 #include <linux/netfilter.h> 11 #include <linux/netfilter/nf_tables.h> 12 #include <net/netfilter/nf_tables.h> 13 #include <net/netfilter/nf_tables_core.h> 14 15 struct nft_dynset { 16 struct nft_set *set; 17 struct nft_set_ext_tmpl tmpl; 18 enum nft_dynset_ops op:8; 19 u8 sreg_key; 20 u8 sreg_data; 21 bool invert; 22 bool expr; 23 u8 num_exprs; 24 u64 timeout; 25 struct nft_expr *expr_array[NFT_SET_EXPR_MAX]; 26 struct nft_set_binding binding; 27 }; 28 29 static int nft_dynset_expr_setup(const struct nft_dynset *priv, 30 const struct nft_set_ext *ext) 31 { 32 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 33 struct nft_expr *expr; 34 int i; 35 36 for (i = 0; i < priv->num_exprs; i++) { 37 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 38 if (nft_expr_clone(expr, priv->expr_array[i]) < 0) 39 return -1; 40 41 elem_expr->size += priv->expr_array[i]->ops->size; 42 } 43 44 return 0; 45 } 46 47 static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr, 48 struct nft_regs *regs) 49 { 50 const struct nft_dynset *priv = nft_expr_priv(expr); 51 struct nft_set_ext *ext; 52 u64 timeout; 53 void *elem; 54 55 if (!atomic_add_unless(&set->nelems, 1, set->size)) 56 return NULL; 57 58 timeout = priv->timeout ? : set->timeout; 59 elem = nft_set_elem_init(set, &priv->tmpl, 60 ®s->data[priv->sreg_key], NULL, 61 ®s->data[priv->sreg_data], 62 timeout, 0, GFP_ATOMIC); 63 if (IS_ERR(elem)) 64 goto err1; 65 66 ext = nft_set_elem_ext(set, elem); 67 if (priv->num_exprs && nft_dynset_expr_setup(priv, ext) < 0) 68 goto err2; 69 70 return elem; 71 72 err2: 73 nft_set_elem_destroy(set, elem, false); 74 err1: 75 if (set->size) 76 atomic_dec(&set->nelems); 77 return NULL; 78 } 79 80 void nft_dynset_eval(const struct nft_expr *expr, 81 struct nft_regs *regs, const struct nft_pktinfo *pkt) 82 { 83 const struct nft_dynset *priv = nft_expr_priv(expr); 84 struct nft_set *set = priv->set; 85 const struct nft_set_ext *ext; 86 u64 timeout; 87 88 if (priv->op == NFT_DYNSET_OP_DELETE) { 89 set->ops->delete(set, ®s->data[priv->sreg_key]); 90 return; 91 } 92 93 if (set->ops->update(set, ®s->data[priv->sreg_key], nft_dynset_new, 94 expr, regs, &ext)) { 95 if (priv->op == NFT_DYNSET_OP_UPDATE && 96 nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 97 timeout = priv->timeout ? : set->timeout; 98 *nft_set_ext_expiration(ext) = get_jiffies_64() + timeout; 99 } 100 101 nft_set_elem_update_expr(ext, regs, pkt); 102 103 if (priv->invert) 104 regs->verdict.code = NFT_BREAK; 105 return; 106 } 107 108 if (!priv->invert) 109 regs->verdict.code = NFT_BREAK; 110 } 111 112 static void nft_dynset_ext_add_expr(struct nft_dynset *priv) 113 { 114 u8 size = 0; 115 int i; 116 117 for (i = 0; i < priv->num_exprs; i++) 118 size += priv->expr_array[i]->ops->size; 119 120 nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_EXPRESSIONS, 121 sizeof(struct nft_set_elem_expr) + size); 122 } 123 124 static struct nft_expr * 125 nft_dynset_expr_alloc(const struct nft_ctx *ctx, const struct nft_set *set, 126 const struct nlattr *attr, int pos) 127 { 128 struct nft_expr *expr; 129 int err; 130 131 expr = nft_set_elem_expr_alloc(ctx, set, attr); 132 if (IS_ERR(expr)) 133 return expr; 134 135 if (set->exprs[pos] && set->exprs[pos]->ops != expr->ops) { 136 err = -EOPNOTSUPP; 137 goto err_dynset_expr; 138 } 139 140 return expr; 141 142 err_dynset_expr: 143 nft_expr_destroy(ctx, expr); 144 return ERR_PTR(err); 145 } 146 147 static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = { 148 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING, 149 .len = NFT_SET_MAXNAMELEN - 1 }, 150 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 }, 151 [NFTA_DYNSET_OP] = NLA_POLICY_MAX(NLA_BE32, 255), 152 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 }, 153 [NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 }, 154 [NFTA_DYNSET_TIMEOUT] = { .type = NLA_U64 }, 155 [NFTA_DYNSET_EXPR] = { .type = NLA_NESTED }, 156 [NFTA_DYNSET_FLAGS] = { .type = NLA_U32 }, 157 [NFTA_DYNSET_EXPRESSIONS] = { .type = NLA_NESTED }, 158 }; 159 160 static int nft_dynset_init(const struct nft_ctx *ctx, 161 const struct nft_expr *expr, 162 const struct nlattr * const tb[]) 163 { 164 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 165 struct nft_dynset *priv = nft_expr_priv(expr); 166 u8 genmask = nft_genmask_next(ctx->net); 167 struct nft_set *set; 168 u64 timeout; 169 int err, i; 170 171 lockdep_assert_held(&nft_net->commit_mutex); 172 173 if (tb[NFTA_DYNSET_SET_NAME] == NULL || 174 tb[NFTA_DYNSET_OP] == NULL || 175 tb[NFTA_DYNSET_SREG_KEY] == NULL) 176 return -EINVAL; 177 178 if (tb[NFTA_DYNSET_FLAGS]) { 179 u32 flags = ntohl(nla_get_be32(tb[NFTA_DYNSET_FLAGS])); 180 if (flags & ~(NFT_DYNSET_F_INV | NFT_DYNSET_F_EXPR)) 181 return -EOPNOTSUPP; 182 if (flags & NFT_DYNSET_F_INV) 183 priv->invert = true; 184 if (flags & NFT_DYNSET_F_EXPR) 185 priv->expr = true; 186 } 187 188 set = nft_set_lookup_global(ctx->net, ctx->table, 189 tb[NFTA_DYNSET_SET_NAME], 190 tb[NFTA_DYNSET_SET_ID], genmask); 191 if (IS_ERR(set)) 192 return PTR_ERR(set); 193 194 if (set->flags & NFT_SET_OBJECT) 195 return -EOPNOTSUPP; 196 197 if (set->ops->update == NULL) 198 return -EOPNOTSUPP; 199 200 if (set->flags & NFT_SET_CONSTANT) 201 return -EBUSY; 202 203 priv->op = ntohl(nla_get_be32(tb[NFTA_DYNSET_OP])); 204 if (priv->op > NFT_DYNSET_OP_DELETE) 205 return -EOPNOTSUPP; 206 207 timeout = 0; 208 if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { 209 if (!(set->flags & NFT_SET_TIMEOUT)) 210 return -EOPNOTSUPP; 211 212 err = nf_msecs_to_jiffies64(tb[NFTA_DYNSET_TIMEOUT], &timeout); 213 if (err) 214 return err; 215 } 216 217 err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_KEY], &priv->sreg_key, 218 set->klen); 219 if (err < 0) 220 return err; 221 222 if (tb[NFTA_DYNSET_SREG_DATA] != NULL) { 223 if (!(set->flags & NFT_SET_MAP)) 224 return -EOPNOTSUPP; 225 if (set->dtype == NFT_DATA_VERDICT) 226 return -EOPNOTSUPP; 227 228 err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_DATA], 229 &priv->sreg_data, set->dlen); 230 if (err < 0) 231 return err; 232 } else if (set->flags & NFT_SET_MAP) 233 return -EINVAL; 234 235 if ((tb[NFTA_DYNSET_EXPR] || tb[NFTA_DYNSET_EXPRESSIONS]) && 236 !(set->flags & NFT_SET_EVAL)) 237 return -EINVAL; 238 239 if (tb[NFTA_DYNSET_EXPR]) { 240 struct nft_expr *dynset_expr; 241 242 dynset_expr = nft_dynset_expr_alloc(ctx, set, 243 tb[NFTA_DYNSET_EXPR], 0); 244 if (IS_ERR(dynset_expr)) 245 return PTR_ERR(dynset_expr); 246 247 priv->num_exprs++; 248 priv->expr_array[0] = dynset_expr; 249 250 if (set->num_exprs > 1 || 251 (set->num_exprs == 1 && 252 dynset_expr->ops != set->exprs[0]->ops)) { 253 err = -EOPNOTSUPP; 254 goto err_expr_free; 255 } 256 } else if (tb[NFTA_DYNSET_EXPRESSIONS]) { 257 struct nft_expr *dynset_expr; 258 struct nlattr *tmp; 259 int left; 260 261 if (!priv->expr) 262 return -EINVAL; 263 264 i = 0; 265 nla_for_each_nested(tmp, tb[NFTA_DYNSET_EXPRESSIONS], left) { 266 if (i == NFT_SET_EXPR_MAX) { 267 err = -E2BIG; 268 goto err_expr_free; 269 } 270 if (nla_type(tmp) != NFTA_LIST_ELEM) { 271 err = -EINVAL; 272 goto err_expr_free; 273 } 274 dynset_expr = nft_dynset_expr_alloc(ctx, set, tmp, i); 275 if (IS_ERR(dynset_expr)) { 276 err = PTR_ERR(dynset_expr); 277 goto err_expr_free; 278 } 279 priv->expr_array[i] = dynset_expr; 280 priv->num_exprs++; 281 282 if (set->num_exprs && 283 dynset_expr->ops != set->exprs[i]->ops) { 284 err = -EOPNOTSUPP; 285 goto err_expr_free; 286 } 287 i++; 288 } 289 if (set->num_exprs && set->num_exprs != i) { 290 err = -EOPNOTSUPP; 291 goto err_expr_free; 292 } 293 } else if (set->num_exprs > 0) { 294 err = nft_set_elem_expr_clone(ctx, set, priv->expr_array); 295 if (err < 0) 296 return err; 297 298 priv->num_exprs = set->num_exprs; 299 } 300 301 nft_set_ext_prepare(&priv->tmpl); 302 nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen); 303 if (set->flags & NFT_SET_MAP) 304 nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_DATA, set->dlen); 305 306 if (priv->num_exprs) 307 nft_dynset_ext_add_expr(priv); 308 309 if (set->flags & NFT_SET_TIMEOUT) { 310 if (timeout || set->timeout) { 311 nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT); 312 nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION); 313 } 314 } 315 316 priv->timeout = timeout; 317 318 err = nf_tables_bind_set(ctx, set, &priv->binding); 319 if (err < 0) 320 goto err_expr_free; 321 322 if (set->size == 0) 323 set->size = 0xffff; 324 325 priv->set = set; 326 return 0; 327 328 err_expr_free: 329 for (i = 0; i < priv->num_exprs; i++) 330 nft_expr_destroy(ctx, priv->expr_array[i]); 331 return err; 332 } 333 334 static void nft_dynset_deactivate(const struct nft_ctx *ctx, 335 const struct nft_expr *expr, 336 enum nft_trans_phase phase) 337 { 338 struct nft_dynset *priv = nft_expr_priv(expr); 339 340 nf_tables_deactivate_set(ctx, priv->set, &priv->binding, phase); 341 } 342 343 static void nft_dynset_activate(const struct nft_ctx *ctx, 344 const struct nft_expr *expr) 345 { 346 struct nft_dynset *priv = nft_expr_priv(expr); 347 348 nf_tables_activate_set(ctx, priv->set); 349 } 350 351 static void nft_dynset_destroy(const struct nft_ctx *ctx, 352 const struct nft_expr *expr) 353 { 354 struct nft_dynset *priv = nft_expr_priv(expr); 355 int i; 356 357 for (i = 0; i < priv->num_exprs; i++) 358 nft_expr_destroy(ctx, priv->expr_array[i]); 359 360 nf_tables_destroy_set(ctx, priv->set); 361 } 362 363 static int nft_dynset_dump(struct sk_buff *skb, 364 const struct nft_expr *expr, bool reset) 365 { 366 const struct nft_dynset *priv = nft_expr_priv(expr); 367 u32 flags = priv->invert ? NFT_DYNSET_F_INV : 0; 368 int i; 369 370 if (nft_dump_register(skb, NFTA_DYNSET_SREG_KEY, priv->sreg_key)) 371 goto nla_put_failure; 372 if (priv->set->flags & NFT_SET_MAP && 373 nft_dump_register(skb, NFTA_DYNSET_SREG_DATA, priv->sreg_data)) 374 goto nla_put_failure; 375 if (nla_put_be32(skb, NFTA_DYNSET_OP, htonl(priv->op))) 376 goto nla_put_failure; 377 if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name)) 378 goto nla_put_failure; 379 if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, 380 nf_jiffies64_to_msecs(priv->timeout), 381 NFTA_DYNSET_PAD)) 382 goto nla_put_failure; 383 if (priv->set->num_exprs == 0) { 384 if (priv->num_exprs == 1) { 385 if (nft_expr_dump(skb, NFTA_DYNSET_EXPR, 386 priv->expr_array[0], reset)) 387 goto nla_put_failure; 388 } else if (priv->num_exprs > 1) { 389 struct nlattr *nest; 390 391 nest = nla_nest_start_noflag(skb, NFTA_DYNSET_EXPRESSIONS); 392 if (!nest) 393 goto nla_put_failure; 394 395 for (i = 0; i < priv->num_exprs; i++) { 396 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 397 priv->expr_array[i], reset)) 398 goto nla_put_failure; 399 } 400 nla_nest_end(skb, nest); 401 } 402 } 403 if (nla_put_be32(skb, NFTA_DYNSET_FLAGS, htonl(flags))) 404 goto nla_put_failure; 405 return 0; 406 407 nla_put_failure: 408 return -1; 409 } 410 411 static const struct nft_expr_ops nft_dynset_ops = { 412 .type = &nft_dynset_type, 413 .size = NFT_EXPR_SIZE(sizeof(struct nft_dynset)), 414 .eval = nft_dynset_eval, 415 .init = nft_dynset_init, 416 .destroy = nft_dynset_destroy, 417 .activate = nft_dynset_activate, 418 .deactivate = nft_dynset_deactivate, 419 .dump = nft_dynset_dump, 420 .reduce = NFT_REDUCE_READONLY, 421 }; 422 423 struct nft_expr_type nft_dynset_type __read_mostly = { 424 .name = "dynset", 425 .ops = &nft_dynset_ops, 426 .policy = nft_dynset_policy, 427 .maxattr = NFTA_DYNSET_MAX, 428 .owner = THIS_MODULE, 429 }; 430