projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: nf_tables: use new transaction infrastructure to handle sets
[deliverable/linux.git] / net / netfilter / nf_tables_api.c
CommitLineData
96518518 1/*
20a69341 2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
96518518
PM		 3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 *
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/list.h>
14#include <linux/skbuff.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nfnetlink.h>
18#include <linux/netfilter/nf_tables.h>
19#include <net/netfilter/nf_tables_core.h>
20#include <net/netfilter/nf_tables.h>
99633ab2 21#include <net/net_namespace.h>
96518518
PM		 22#include <net/sock.h>
23
96518518
PM		 24static LIST_HEAD(nf_tables_expressions);
25
26/**
27 * nft_register_afinfo - register nf_tables address family info
28 *
29 * @afi: address family info to register
30 *
31 * Register the address family for use with nf_tables. Returns zero on
32 * success or a negative errno code otherwise.
33 */
99633ab2 34int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
96518518
PM		 35{
36 INIT_LIST_HEAD(&afi->tables);
37 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 38 list_add_tail(&afi->list, &net->nft.af_info);
96518518
PM		 39 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
40 return 0;
41}
42EXPORT_SYMBOL_GPL(nft_register_afinfo);
43
44/**
45 * nft_unregister_afinfo - unregister nf_tables address family info
46 *
47 * @afi: address family info to unregister
48 *
49 * Unregister the address family for use with nf_tables.
50 */
51void nft_unregister_afinfo(struct nft_af_info *afi)
52{
53 nfnl_lock(NFNL_SUBSYS_NFTABLES);
54 list_del(&afi->list);
55 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
56}
57EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
58
99633ab2 59static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
96518518
PM		 60{
61 struct nft_af_info *afi;
62
99633ab2 63 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 64 if (afi->family == family)
65 return afi;
66 }
67 return NULL;
68}
69
99633ab2
PNA		 70static struct nft_af_info *
71nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
96518518
PM		 72{
73 struct nft_af_info *afi;
74
99633ab2 75 afi = nft_afinfo_lookup(net, family);
96518518
PM		 76 if (afi != NULL)
77 return afi;
78#ifdef CONFIG_MODULES
79 if (autoload) {
80 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
81 request_module("nft-afinfo-%u", family);
82 nfnl_lock(NFNL_SUBSYS_NFTABLES);
99633ab2 83 afi = nft_afinfo_lookup(net, family);
96518518
PM		 84 if (afi != NULL)
85 return ERR_PTR(-EAGAIN);
86 }
87#endif
88 return ERR_PTR(-EAFNOSUPPORT);
89}
90
7c95f6d8
PNA		 91static void nft_ctx_init(struct nft_ctx *ctx,
92 const struct sk_buff *skb,
93 const struct nlmsghdr *nlh,
94 struct nft_af_info *afi,
95 struct nft_table *table,
96 struct nft_chain *chain,
97 const struct nlattr * const *nla)
98{
99 ctx->net = sock_net(skb->sk);
100 ctx->skb = skb;
101 ctx->nlh = nlh;
102 ctx->afi = afi;
103 ctx->table = table;
104 ctx->chain = chain;
105 ctx->nla = nla;
106}
107
b380e5c7
PNA		 108static struct nft_trans *nft_trans_alloc(struct nft_ctx *ctx, int msg_type,
109 u32 size)
1081d11b
PNA		 110{
111 struct nft_trans *trans;
112
113 trans = kzalloc(sizeof(struct nft_trans) + size, GFP_KERNEL);
114 if (trans == NULL)
115 return NULL;
116
b380e5c7 117 trans->msg_type = msg_type;
1081d11b
PNA		 118 trans->ctx = *ctx;
119
120 return trans;
121}
122
123static void nft_trans_destroy(struct nft_trans *trans)
124{
125 list_del(&trans->list);
126 kfree(trans);
127}
128
96518518
PM		 129/*
130 * Tables
131 */
132
133static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
134 const struct nlattr *nla)
135{
136 struct nft_table *table;
137
138 list_for_each_entry(table, &afi->tables, list) {
139 if (!nla_strcmp(nla, table->name))
140 return table;
141 }
142 return NULL;
143}
144
145static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
9370761c 146 const struct nlattr *nla)
96518518
PM		 147{
148 struct nft_table *table;
149
150 if (nla == NULL)
151 return ERR_PTR(-EINVAL);
152
153 table = nft_table_lookup(afi, nla);
154 if (table != NULL)
155 return table;
156
96518518
PM		 157 return ERR_PTR(-ENOENT);
158}
159
160static inline u64 nf_tables_alloc_handle(struct nft_table *table)
161{
162 return ++table->hgenerator;
163}
164
2a37d755 165static const struct nf_chain_type *chain_type[AF_MAX][NFT_CHAIN_T_MAX];
9370761c 166
2a37d755 167static const struct nf_chain_type *
baae3e62 168__nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
9370761c
PNA		 169{
170 int i;
171
baae3e62 172 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
9370761c
PNA		 173 if (chain_type[family][i] != NULL &&
174 !nla_strcmp(nla, chain_type[family][i]->name))
baae3e62 175 return chain_type[family][i];
9370761c 176 }
baae3e62 177 return NULL;
9370761c
PNA		 178}
179
2a37d755 180static const struct nf_chain_type *
baae3e62
PM		 181nf_tables_chain_type_lookup(const struct nft_af_info *afi,
182 const struct nlattr *nla,
183 bool autoload)
9370761c 184{
2a37d755 185 const struct nf_chain_type *type;
9370761c
PNA		 186
187 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 188 if (type != NULL)
189 return type;
9370761c 190#ifdef CONFIG_MODULES
93b0806f 191 if (autoload) {
9370761c
PNA		 192 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
193 request_module("nft-chain-%u-%*.s", afi->family,
194 nla_len(nla)-1, (const char *)nla_data(nla));
195 nfnl_lock(NFNL_SUBSYS_NFTABLES);
196 type = __nf_tables_chain_type_lookup(afi->family, nla);
93b0806f
PM		 197 if (type != NULL)
198 return ERR_PTR(-EAGAIN);
9370761c
PNA		 199 }
200#endif
93b0806f 201 return ERR_PTR(-ENOENT);
9370761c
PNA		 202}
203
96518518
PM		 204static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
205 [NFTA_TABLE_NAME] = { .type = NLA_STRING },
9ddf6323 206 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
96518518
PM		 207};
208
209static int nf_tables_fill_table_info(struct sk_buff *skb, u32 portid, u32 seq,
210 int event, u32 flags, int family,
211 const struct nft_table *table)
212{
213 struct nlmsghdr *nlh;
214 struct nfgenmsg *nfmsg;
215
216 event |= NFNL_SUBSYS_NFTABLES << 8;
217 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
218 if (nlh == NULL)
219 goto nla_put_failure;
220
221 nfmsg = nlmsg_data(nlh);
222 nfmsg->nfgen_family = family;
223 nfmsg->version = NFNETLINK_V0;
224 nfmsg->res_id = 0;
225
9ddf6323 226 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
d8bcc768
TB		 227 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
228 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
96518518
PM		 229 goto nla_put_failure;
230
231 return nlmsg_end(skb, nlh);
232
233nla_put_failure:
234 nlmsg_trim(skb, nlh);
235 return -1;
236}
237
238static int nf_tables_table_notify(const struct sk_buff *oskb,
239 const struct nlmsghdr *nlh,
240 const struct nft_table *table,
241 int event, int family)
242{
243 struct sk_buff *skb;
244 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
245 u32 seq = nlh ? nlh->nlmsg_seq : 0;
246 struct net *net = oskb ? sock_net(oskb->sk) : &init_net;
247 bool report;
248 int err;
249
250 report = nlh ? nlmsg_report(nlh) : false;
251 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
252 return 0;
253
254 err = -ENOBUFS;
255 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
256 if (skb == NULL)
257 goto err;
258
259 err = nf_tables_fill_table_info(skb, portid, seq, event, 0,
260 family, table);
261 if (err < 0) {
262 kfree_skb(skb);
263 goto err;
264 }
265
266 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
267 GFP_KERNEL);
268err:
269 if (err < 0)
270 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
271 return err;
272}
273
274static int nf_tables_dump_tables(struct sk_buff *skb,
275 struct netlink_callback *cb)
276{
277 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
278 const struct nft_af_info *afi;
279 const struct nft_table *table;
280 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 281 struct net *net = sock_net(skb->sk);
96518518
PM		 282 int family = nfmsg->nfgen_family;
283
99633ab2 284 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 285 if (family != NFPROTO_UNSPEC && family != afi->family)
286 continue;
287
288 list_for_each_entry(table, &afi->tables, list) {
289 if (idx < s_idx)
290 goto cont;
291 if (idx > s_idx)
292 memset(&cb->args[1], 0,
293 sizeof(cb->args) - sizeof(cb->args[0]));
294 if (nf_tables_fill_table_info(skb,
295 NETLINK_CB(cb->skb).portid,
296 cb->nlh->nlmsg_seq,
297 NFT_MSG_NEWTABLE,
298 NLM_F_MULTI,
299 afi->family, table) < 0)
300 goto done;
301cont:
302 idx++;
303 }
304 }
305done:
306 cb->args[0] = idx;
307 return skb->len;
308}
309
310static int nf_tables_gettable(struct sock *nlsk, struct sk_buff *skb,
311 const struct nlmsghdr *nlh,
312 const struct nlattr * const nla[])
313{
314 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
315 const struct nft_af_info *afi;
316 const struct nft_table *table;
317 struct sk_buff *skb2;
99633ab2 318 struct net *net = sock_net(skb->sk);
96518518
PM		 319 int family = nfmsg->nfgen_family;
320 int err;
321
322 if (nlh->nlmsg_flags & NLM_F_DUMP) {
323 struct netlink_dump_control c = {
324 .dump = nf_tables_dump_tables,
325 };
326 return netlink_dump_start(nlsk, skb, nlh, &c);
327 }
328
99633ab2 329 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 330 if (IS_ERR(afi))
331 return PTR_ERR(afi);
332
9370761c 333 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
96518518
PM		 334 if (IS_ERR(table))
335 return PTR_ERR(table);
336
337 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
338 if (!skb2)
339 return -ENOMEM;
340
341 err = nf_tables_fill_table_info(skb2, NETLINK_CB(skb).portid,
342 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
343 family, table);
344 if (err < 0)
345 goto err;
346
347 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
348
349err:
350 kfree_skb(skb2);
351 return err;
352}
353
115a60b1
PM		 354static int nf_tables_table_enable(const struct nft_af_info *afi,
355 struct nft_table *table)
9ddf6323
PNA		 356{
357 struct nft_chain *chain;
358 int err, i = 0;
359
360 list_for_each_entry(chain, &table->chains, list) {
d2012975
PNA		 361 if (!(chain->flags & NFT_BASE_CHAIN))
362 continue;
363
115a60b1 364 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
9ddf6323
PNA		 365 if (err < 0)
366 goto err;
367
368 i++;
369 }
370 return 0;
371err:
372 list_for_each_entry(chain, &table->chains, list) {
d2012975
PNA		 373 if (!(chain->flags & NFT_BASE_CHAIN))
374 continue;
375
9ddf6323
PNA		 376 if (i-- <= 0)
377 break;
378
115a60b1 379 nf_unregister_hooks(nft_base_chain(chain)->ops, afi->nops);
9ddf6323
PNA		 380 }
381 return err;
382}
383
115a60b1
PM		 384static int nf_tables_table_disable(const struct nft_af_info *afi,
385 struct nft_table *table)
9ddf6323
PNA		 386{
387 struct nft_chain *chain;
388
d2012975
PNA		 389 list_for_each_entry(chain, &table->chains, list) {
390 if (chain->flags & NFT_BASE_CHAIN)
115a60b1
PM		 391 nf_unregister_hooks(nft_base_chain(chain)->ops,
392 afi->nops);
d2012975 393 }
9ddf6323
PNA		 394
395 return 0;
396}
397
398static int nf_tables_updtable(struct sock *nlsk, struct sk_buff *skb,
399 const struct nlmsghdr *nlh,
400 const struct nlattr * const nla[],
401 struct nft_af_info *afi, struct nft_table *table)
402{
403 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
404 int family = nfmsg->nfgen_family, ret = 0;
405
406 if (nla[NFTA_TABLE_FLAGS]) {
c5c1f975 407 u32 flags;
9ddf6323
PNA		 408
409 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
410 if (flags & ~NFT_TABLE_F_DORMANT)
411 return -EINVAL;
412
413 if ((flags & NFT_TABLE_F_DORMANT) &&
414 !(table->flags & NFT_TABLE_F_DORMANT)) {
115a60b1 415 ret = nf_tables_table_disable(afi, table);
9ddf6323
PNA		 416 if (ret >= 0)
417 table->flags |= NFT_TABLE_F_DORMANT;
418 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
419 table->flags & NFT_TABLE_F_DORMANT) {
115a60b1 420 ret = nf_tables_table_enable(afi, table);
9ddf6323
PNA		 421 if (ret >= 0)
422 table->flags &= ~NFT_TABLE_F_DORMANT;
423 }
424 if (ret < 0)
425 goto err;
426 }
427
428 nf_tables_table_notify(skb, nlh, table, NFT_MSG_NEWTABLE, family);
429err:
430 return ret;
431}
432
96518518
PM		 433static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
434 const struct nlmsghdr *nlh,
435 const struct nlattr * const nla[])
436{
437 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
438 const struct nlattr *name;
439 struct nft_af_info *afi;
440 struct nft_table *table;
99633ab2 441 struct net *net = sock_net(skb->sk);
96518518 442 int family = nfmsg->nfgen_family;
c5c1f975 443 u32 flags = 0;
96518518 444
99633ab2 445 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 446 if (IS_ERR(afi))
447 return PTR_ERR(afi);
448
449 name = nla[NFTA_TABLE_NAME];
9370761c 450 table = nf_tables_table_lookup(afi, name);
96518518
PM		 451 if (IS_ERR(table)) {
452 if (PTR_ERR(table) != -ENOENT)
453 return PTR_ERR(table);
454 table = NULL;
455 }
456
457 if (table != NULL) {
458 if (nlh->nlmsg_flags & NLM_F_EXCL)
459 return -EEXIST;
460 if (nlh->nlmsg_flags & NLM_F_REPLACE)
461 return -EOPNOTSUPP;
9ddf6323 462 return nf_tables_updtable(nlsk, skb, nlh, nla, afi, table);
96518518
PM		 463 }
464
c5c1f975
PM		 465 if (nla[NFTA_TABLE_FLAGS]) {
466 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
467 if (flags & ~NFT_TABLE_F_DORMANT)
468 return -EINVAL;
469 }
470
7047f9d0
PM		 471 if (!try_module_get(afi->owner))
472 return -EAFNOSUPPORT;
473
96518518 474 table = kzalloc(sizeof(*table) + nla_len(name), GFP_KERNEL);
7047f9d0
PM		 475 if (table == NULL) {
476 module_put(afi->owner);
96518518 477 return -ENOMEM;
7047f9d0 478 }
96518518
PM		 479
480 nla_strlcpy(table->name, name, nla_len(name));
481 INIT_LIST_HEAD(&table->chains);
20a69341 482 INIT_LIST_HEAD(&table->sets);
c5c1f975 483 table->flags = flags;
9ddf6323 484
96518518
PM		 485 list_add_tail(&table->list, &afi->tables);
486 nf_tables_table_notify(skb, nlh, table, NFT_MSG_NEWTABLE, family);
487 return 0;
488}
489
490static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
491 const struct nlmsghdr *nlh,
492 const struct nlattr * const nla[])
493{
494 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
495 struct nft_af_info *afi;
496 struct nft_table *table;
99633ab2 497 struct net *net = sock_net(skb->sk);
96518518
PM		 498 int family = nfmsg->nfgen_family;
499
99633ab2 500 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 501 if (IS_ERR(afi))
502 return PTR_ERR(afi);
503
9370761c 504 table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
96518518
PM		 505 if (IS_ERR(table))
506 return PTR_ERR(table);
507
44a6f0df 508 if (!list_empty(&table->chains) || !list_empty(&table->sets))
96518518
PM		 509 return -EBUSY;
510
511 list_del(&table->list);
512 nf_tables_table_notify(skb, nlh, table, NFT_MSG_DELTABLE, family);
513 kfree(table);
7047f9d0 514 module_put(afi->owner);
96518518
PM		 515 return 0;
516}
517
2a37d755 518int nft_register_chain_type(const struct nf_chain_type *ctype)
96518518 519{
9370761c 520 int err = 0;
96518518
PM		 521
522 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c
PNA		 523 if (chain_type[ctype->family][ctype->type] != NULL) {
524 err = -EBUSY;
525 goto out;
96518518 526 }
9370761c
PNA		 527 chain_type[ctype->family][ctype->type] = ctype;
528out:
96518518
PM		 529 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
530 return err;
531}
9370761c 532EXPORT_SYMBOL_GPL(nft_register_chain_type);
96518518 533
2a37d755 534void nft_unregister_chain_type(const struct nf_chain_type *ctype)
96518518 535{
96518518 536 nfnl_lock(NFNL_SUBSYS_NFTABLES);
9370761c 537 chain_type[ctype->family][ctype->type] = NULL;
96518518
PM		 538 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
539}
9370761c 540EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
96518518
PM		 541
542/*
543 * Chains
544 */
545
546static struct nft_chain *
547nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle)
548{
549 struct nft_chain *chain;
550
551 list_for_each_entry(chain, &table->chains, list) {
552 if (chain->handle == handle)
553 return chain;
554 }
555
556 return ERR_PTR(-ENOENT);
557}
558
559static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
560 const struct nlattr *nla)
561{
562 struct nft_chain *chain;
563
564 if (nla == NULL)
565 return ERR_PTR(-EINVAL);
566
567 list_for_each_entry(chain, &table->chains, list) {
568 if (!nla_strcmp(nla, chain->name))
569 return chain;
570 }
571
572 return ERR_PTR(-ENOENT);
573}
574
575static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
576 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING },
577 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
578 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
579 .len = NFT_CHAIN_MAXNAMELEN - 1 },
580 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
0ca743a5 581 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
4c1f7818 582 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
0ca743a5 583 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
96518518
PM		 584};
585
586static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
587 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
588 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
589};
590
0ca743a5
PNA		 591static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
592{
593 struct nft_stats *cpu_stats, total;
594 struct nlattr *nest;
595 int cpu;
596
597 memset(&total, 0, sizeof(total));
598 for_each_possible_cpu(cpu) {
599 cpu_stats = per_cpu_ptr(stats, cpu);
600 total.pkts += cpu_stats->pkts;
601 total.bytes += cpu_stats->bytes;
602 }
603 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
604 if (nest == NULL)
605 goto nla_put_failure;
606
607 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts)) ||
608 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes)))
609 goto nla_put_failure;
610
611 nla_nest_end(skb, nest);
612 return 0;
613
614nla_put_failure:
615 return -ENOSPC;
616}
617
96518518
PM		 618static int nf_tables_fill_chain_info(struct sk_buff *skb, u32 portid, u32 seq,
619 int event, u32 flags, int family,
620 const struct nft_table *table,
621 const struct nft_chain *chain)
622{
623 struct nlmsghdr *nlh;
624 struct nfgenmsg *nfmsg;
625
626 event |= NFNL_SUBSYS_NFTABLES << 8;
627 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
628 if (nlh == NULL)
629 goto nla_put_failure;
630
631 nfmsg = nlmsg_data(nlh);
632 nfmsg->nfgen_family = family;
633 nfmsg->version = NFNETLINK_V0;
634 nfmsg->res_id = 0;
635
636 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
637 goto nla_put_failure;
638 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle)))
639 goto nla_put_failure;
640 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
641 goto nla_put_failure;
642
643 if (chain->flags & NFT_BASE_CHAIN) {
0ca743a5 644 const struct nft_base_chain *basechain = nft_base_chain(chain);
115a60b1 645 const struct nf_hook_ops *ops = &basechain->ops[0];
0ca743a5
PNA		 646 struct nlattr *nest;
647
648 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
96518518
PM		 649 if (nest == NULL)
650 goto nla_put_failure;
651 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
652 goto nla_put_failure;
653 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
654 goto nla_put_failure;
655 nla_nest_end(skb, nest);
9370761c 656
0ca743a5
PNA		 657 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
658 htonl(basechain->policy)))
659 goto nla_put_failure;
660
baae3e62
PM		 661 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
662 goto nla_put_failure;
0ca743a5
PNA		 663
664 if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
665 goto nla_put_failure;
96518518
PM		 666 }
667
0ca743a5
PNA		 668 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
669 goto nla_put_failure;
670
96518518
PM		 671 return nlmsg_end(skb, nlh);
672
673nla_put_failure:
674 nlmsg_trim(skb, nlh);
675 return -1;
676}
677
678static int nf_tables_chain_notify(const struct sk_buff *oskb,
679 const struct nlmsghdr *nlh,
680 const struct nft_table *table,
681 const struct nft_chain *chain,
682 int event, int family)
683{
684 struct sk_buff *skb;
685 u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
686 struct net *net = oskb ? sock_net(oskb->sk) : &init_net;
687 u32 seq = nlh ? nlh->nlmsg_seq : 0;
688 bool report;
689 int err;
690
691 report = nlh ? nlmsg_report(nlh) : false;
692 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
693 return 0;
694
695 err = -ENOBUFS;
696 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
697 if (skb == NULL)
698 goto err;
699
700 err = nf_tables_fill_chain_info(skb, portid, seq, event, 0, family,
701 table, chain);
702 if (err < 0) {
703 kfree_skb(skb);
704 goto err;
705 }
706
707 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
708 GFP_KERNEL);
709err:
710 if (err < 0)
711 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
712 return err;
713}
714
715static int nf_tables_dump_chains(struct sk_buff *skb,
716 struct netlink_callback *cb)
717{
718 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
719 const struct nft_af_info *afi;
720 const struct nft_table *table;
721 const struct nft_chain *chain;
722 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 723 struct net *net = sock_net(skb->sk);
96518518
PM		 724 int family = nfmsg->nfgen_family;
725
99633ab2 726 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 727 if (family != NFPROTO_UNSPEC && family != afi->family)
728 continue;
729
730 list_for_each_entry(table, &afi->tables, list) {
731 list_for_each_entry(chain, &table->chains, list) {
732 if (idx < s_idx)
733 goto cont;
734 if (idx > s_idx)
735 memset(&cb->args[1], 0,
736 sizeof(cb->args) - sizeof(cb->args[0]));
737 if (nf_tables_fill_chain_info(skb, NETLINK_CB(cb->skb).portid,
738 cb->nlh->nlmsg_seq,
739 NFT_MSG_NEWCHAIN,
740 NLM_F_MULTI,
741 afi->family, table, chain) < 0)
742 goto done;
743cont:
744 idx++;
745 }
746 }
747 }
748done:
749 cb->args[0] = idx;
750 return skb->len;
751}
752
753
754static int nf_tables_getchain(struct sock *nlsk, struct sk_buff *skb,
755 const struct nlmsghdr *nlh,
756 const struct nlattr * const nla[])
757{
758 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
759 const struct nft_af_info *afi;
760 const struct nft_table *table;
761 const struct nft_chain *chain;
762 struct sk_buff *skb2;
99633ab2 763 struct net *net = sock_net(skb->sk);
96518518
PM		 764 int family = nfmsg->nfgen_family;
765 int err;
766
767 if (nlh->nlmsg_flags & NLM_F_DUMP) {
768 struct netlink_dump_control c = {
769 .dump = nf_tables_dump_chains,
770 };
771 return netlink_dump_start(nlsk, skb, nlh, &c);
772 }
773
99633ab2 774 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 775 if (IS_ERR(afi))
776 return PTR_ERR(afi);
777
9370761c 778 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 779 if (IS_ERR(table))
780 return PTR_ERR(table);
781
782 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
783 if (IS_ERR(chain))
784 return PTR_ERR(chain);
785
786 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
787 if (!skb2)
788 return -ENOMEM;
789
790 err = nf_tables_fill_chain_info(skb2, NETLINK_CB(skb).portid,
791 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
792 family, table, chain);
793 if (err < 0)
794 goto err;
795
796 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
797
798err:
799 kfree_skb(skb2);
800 return err;
801}
802
0ca743a5
PNA		 803static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
804 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
805 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
806};
807
808static int
809nf_tables_counters(struct nft_base_chain *chain, const struct nlattr *attr)
810{
811 struct nlattr *tb[NFTA_COUNTER_MAX+1];
812 struct nft_stats __percpu *newstats;
813 struct nft_stats *stats;
814 int err;
815
816 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy);
817 if (err < 0)
818 return err;
819
820 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
821 return -EINVAL;
822
823 newstats = alloc_percpu(struct nft_stats);
824 if (newstats == NULL)
825 return -ENOMEM;
826
827 /* Restore old counters on this cpu, no problem. Per-cpu statistics
828 * are not exposed to userspace.
829 */
830 stats = this_cpu_ptr(newstats);
831 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
832 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
833
834 if (chain->stats) {
0ca743a5 835 struct nft_stats __percpu *oldstats =
67a8fc27 836 nft_dereference(chain->stats);
0ca743a5
PNA		 837
838 rcu_assign_pointer(chain->stats, newstats);
839 synchronize_rcu();
840 free_percpu(oldstats);
841 } else
842 rcu_assign_pointer(chain->stats, newstats);
843
844 return 0;
845}
846
96518518
PM		 847static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
848 const struct nlmsghdr *nlh,
849 const struct nlattr * const nla[])
850{
851 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
852 const struct nlattr * uninitialized_var(name);
7c95f6d8 853 struct nft_af_info *afi;
96518518
PM		 854 struct nft_table *table;
855 struct nft_chain *chain;
0ca743a5 856 struct nft_base_chain *basechain = NULL;
96518518 857 struct nlattr *ha[NFTA_HOOK_MAX + 1];
99633ab2 858 struct net *net = sock_net(skb->sk);
96518518 859 int family = nfmsg->nfgen_family;
57de2a0c 860 u8 policy = NF_ACCEPT;
96518518 861 u64 handle = 0;
115a60b1 862 unsigned int i;
96518518
PM		 863 int err;
864 bool create;
865
866 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
867
99633ab2 868 afi = nf_tables_afinfo_lookup(net, family, true);
96518518
PM		 869 if (IS_ERR(afi))
870 return PTR_ERR(afi);
871
9370761c 872 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 873 if (IS_ERR(table))
874 return PTR_ERR(table);
875
96518518
PM		 876 chain = NULL;
877 name = nla[NFTA_CHAIN_NAME];
878
879 if (nla[NFTA_CHAIN_HANDLE]) {
880 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
881 chain = nf_tables_chain_lookup_byhandle(table, handle);
882 if (IS_ERR(chain))
883 return PTR_ERR(chain);
884 } else {
885 chain = nf_tables_chain_lookup(table, name);
886 if (IS_ERR(chain)) {
887 if (PTR_ERR(chain) != -ENOENT)
888 return PTR_ERR(chain);
889 chain = NULL;
890 }
891 }
892
57de2a0c
PM		 893 if (nla[NFTA_CHAIN_POLICY]) {
894 if ((chain != NULL &&
895 !(chain->flags & NFT_BASE_CHAIN)) ||
896 nla[NFTA_CHAIN_HOOK] == NULL)
897 return -EOPNOTSUPP;
898
8f46df18 899 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
57de2a0c
PM		 900 switch (policy) {
901 case NF_DROP:
902 case NF_ACCEPT:
903 break;
904 default:
905 return -EINVAL;
906 }
907 }
908
96518518
PM		 909 if (chain != NULL) {
910 if (nlh->nlmsg_flags & NLM_F_EXCL)
911 return -EEXIST;
912 if (nlh->nlmsg_flags & NLM_F_REPLACE)
913 return -EOPNOTSUPP;
914
915 if (nla[NFTA_CHAIN_HANDLE] && name &&
916 !IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME])))
917 return -EEXIST;
918
0ca743a5
PNA		 919 if (nla[NFTA_CHAIN_COUNTERS]) {
920 if (!(chain->flags & NFT_BASE_CHAIN))
921 return -EOPNOTSUPP;
922
923 err = nf_tables_counters(nft_base_chain(chain),
924 nla[NFTA_CHAIN_COUNTERS]);
925 if (err < 0)
926 return err;
927 }
928
4401a862
PM		 929 if (nla[NFTA_CHAIN_POLICY])
930 nft_base_chain(chain)->policy = policy;
931
96518518
PM		 932 if (nla[NFTA_CHAIN_HANDLE] && name)
933 nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
934
935 goto notify;
936 }
937
75820676
PM		 938 if (table->use == UINT_MAX)
939 return -EOVERFLOW;
940
96518518 941 if (nla[NFTA_CHAIN_HOOK]) {
2a37d755 942 const struct nf_chain_type *type;
96518518 943 struct nf_hook_ops *ops;
9370761c 944 nf_hookfn *hookfn;
115a60b1 945 u32 hooknum, priority;
9370761c 946
baae3e62 947 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
9370761c
PNA		 948 if (nla[NFTA_CHAIN_TYPE]) {
949 type = nf_tables_chain_type_lookup(afi,
950 nla[NFTA_CHAIN_TYPE],
951 create);
93b0806f
PM		 952 if (IS_ERR(type))
953 return PTR_ERR(type);
9370761c 954 }
96518518
PM		 955
956 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
957 nft_hook_policy);
958 if (err < 0)
959 return err;
960 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
961 ha[NFTA_HOOK_PRIORITY] == NULL)
962 return -EINVAL;
9370761c
PNA		 963
964 hooknum = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
965 if (hooknum >= afi->nhooks)
96518518 966 return -EINVAL;
115a60b1 967 priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
96518518 968
baae3e62 969 if (!(type->hook_mask & (1 << hooknum)))
9370761c 970 return -EOPNOTSUPP;
fa2c1de0 971 if (!try_module_get(type->owner))
baae3e62 972 return -ENOENT;
fa2c1de0 973 hookfn = type->hooks[hooknum];
9370761c 974
96518518
PM		 975 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
976 if (basechain == NULL)
977 return -ENOMEM;
9370761c 978
4401a862
PM		 979 if (nla[NFTA_CHAIN_COUNTERS]) {
980 err = nf_tables_counters(basechain,
981 nla[NFTA_CHAIN_COUNTERS]);
982 if (err < 0) {
fa2c1de0 983 module_put(type->owner);
4401a862
PM		 984 kfree(basechain);
985 return err;
986 }
987 } else {
988 struct nft_stats __percpu *newstats;
989
990 newstats = alloc_percpu(struct nft_stats);
991 if (newstats == NULL) {
fa2c1de0 992 module_put(type->owner);
4401a862
PM		 993 kfree(basechain);
994 return -ENOMEM;
995 }
996 rcu_assign_pointer(basechain->stats, newstats);
997 }
998
9370761c 999 basechain->type = type;
96518518
PM		 1000 chain = &basechain->chain;
1001
115a60b1
PM		 1002 for (i = 0; i < afi->nops; i++) {
1003 ops = &basechain->ops[i];
1004 ops->pf = family;
1005 ops->owner = afi->owner;
1006 ops->hooknum = hooknum;
1007 ops->priority = priority;
1008 ops->priv = chain;
1009 ops->hook = afi->hooks[ops->hooknum];
1010 if (hookfn)
1011 ops->hook = hookfn;
1012 if (afi->hook_ops_init)
1013 afi->hook_ops_init(ops, i);
1014 }
96518518
PM		 1015
1016 chain->flags |= NFT_BASE_CHAIN;
57de2a0c 1017 basechain->policy = policy;
96518518
PM		 1018 } else {
1019 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1020 if (chain == NULL)
1021 return -ENOMEM;
1022 }
1023
1024 INIT_LIST_HEAD(&chain->rules);
1025 chain->handle = nf_tables_alloc_handle(table);
0628b123 1026 chain->net = net;
b5bc89bf 1027 chain->table = table;
96518518
PM		 1028 nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
1029
9ddf6323
PNA		 1030 if (!(table->flags & NFT_TABLE_F_DORMANT) &&
1031 chain->flags & NFT_BASE_CHAIN) {
115a60b1 1032 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
0ca743a5 1033 if (err < 0) {
fa2c1de0 1034 module_put(basechain->type->owner);
0ca743a5
PNA		 1035 free_percpu(basechain->stats);
1036 kfree(basechain);
1037 return err;
1038 }
1039 }
9ddf6323
PNA		 1040 list_add_tail(&chain->list, &table->chains);
1041 table->use++;
96518518
PM		 1042notify:
1043 nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_NEWCHAIN,
1044 family);
1045 return 0;
1046}
1047
0165d932 1048static void nf_tables_chain_destroy(struct nft_chain *chain)
96518518 1049{
96518518
PM		 1050 BUG_ON(chain->use > 0);
1051
0ca743a5 1052 if (chain->flags & NFT_BASE_CHAIN) {
fa2c1de0 1053 module_put(nft_base_chain(chain)->type->owner);
0ca743a5 1054 free_percpu(nft_base_chain(chain)->stats);
96518518 1055 kfree(nft_base_chain(chain));
0ca743a5 1056 } else
96518518
PM		 1057 kfree(chain);
1058}
1059
1060static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
1061 const struct nlmsghdr *nlh,
1062 const struct nlattr * const nla[])
1063{
1064 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1065 struct nft_af_info *afi;
96518518
PM		 1066 struct nft_table *table;
1067 struct nft_chain *chain;
99633ab2 1068 struct net *net = sock_net(skb->sk);
96518518
PM		 1069 int family = nfmsg->nfgen_family;
1070
99633ab2 1071 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1072 if (IS_ERR(afi))
1073 return PTR_ERR(afi);
1074
9370761c 1075 table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
96518518
PM		 1076 if (IS_ERR(table))
1077 return PTR_ERR(table);
1078
1079 chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
1080 if (IS_ERR(chain))
1081 return PTR_ERR(chain);
1082
3dd7279f 1083 if (!list_empty(&chain->rules) || chain->use > 0)
96518518
PM		 1084 return -EBUSY;
1085
1086 list_del(&chain->list);
1087 table->use--;
1088
9ddf6323
PNA		 1089 if (!(table->flags & NFT_TABLE_F_DORMANT) &&
1090 chain->flags & NFT_BASE_CHAIN)
115a60b1 1091 nf_unregister_hooks(nft_base_chain(chain)->ops, afi->nops);
96518518
PM		 1092
1093 nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_DELCHAIN,
1094 family);
1095
1096 /* Make sure all rule references are gone before this is released */
0165d932
PNA		 1097 synchronize_rcu();
1098
1099 nf_tables_chain_destroy(chain);
96518518
PM		 1100 return 0;
1101}
1102
96518518
PM		 1103/*
1104 * Expressions
1105 */
1106
1107/**
ef1f7df9
PM		 1108 * nft_register_expr - register nf_tables expr type
1109 * @ops: expr type
96518518 1110 *
ef1f7df9 1111 * Registers the expr type for use with nf_tables. Returns zero on
96518518
PM		 1112 * success or a negative errno code otherwise.
1113 */
ef1f7df9 1114int nft_register_expr(struct nft_expr_type *type)
96518518
PM		 1115{
1116 nfnl_lock(NFNL_SUBSYS_NFTABLES);
758dbcec
TB		 1117 if (type->family == NFPROTO_UNSPEC)
1118 list_add_tail(&type->list, &nf_tables_expressions);
1119 else
1120 list_add(&type->list, &nf_tables_expressions);
96518518
PM		 1121 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1122 return 0;
1123}
1124EXPORT_SYMBOL_GPL(nft_register_expr);
1125
1126/**
ef1f7df9
PM		 1127 * nft_unregister_expr - unregister nf_tables expr type
1128 * @ops: expr type
96518518 1129 *
ef1f7df9 1130 * Unregisters the expr typefor use with nf_tables.
96518518 1131 */
ef1f7df9 1132void nft_unregister_expr(struct nft_expr_type *type)
96518518
PM		 1133{
1134 nfnl_lock(NFNL_SUBSYS_NFTABLES);
ef1f7df9 1135 list_del(&type->list);
96518518
PM		 1136 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1137}
1138EXPORT_SYMBOL_GPL(nft_unregister_expr);
1139
64d46806
PM		 1140static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1141 struct nlattr *nla)
96518518 1142{
ef1f7df9 1143 const struct nft_expr_type *type;
96518518 1144
ef1f7df9 1145 list_for_each_entry(type, &nf_tables_expressions, list) {
64d46806
PM		 1146 if (!nla_strcmp(nla, type->name) &&
1147 (!type->family || type->family == family))
ef1f7df9 1148 return type;
96518518
PM		 1149 }
1150 return NULL;
1151}
1152
64d46806
PM		 1153static const struct nft_expr_type *nft_expr_type_get(u8 family,
1154 struct nlattr *nla)
96518518 1155{
ef1f7df9 1156 const struct nft_expr_type *type;
96518518
PM		 1157
1158 if (nla == NULL)
1159 return ERR_PTR(-EINVAL);
1160
64d46806 1161 type = __nft_expr_type_get(family, nla);
ef1f7df9
PM		 1162 if (type != NULL && try_module_get(type->owner))
1163 return type;
96518518
PM		 1164
1165#ifdef CONFIG_MODULES
ef1f7df9 1166 if (type == NULL) {
64d46806
PM		 1167 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1168 request_module("nft-expr-%u-%.*s", family,
1169 nla_len(nla), (char *)nla_data(nla));
1170 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1171 if (__nft_expr_type_get(family, nla))
1172 return ERR_PTR(-EAGAIN);
1173
96518518
PM		 1174 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1175 request_module("nft-expr-%.*s",
1176 nla_len(nla), (char *)nla_data(nla));
1177 nfnl_lock(NFNL_SUBSYS_NFTABLES);
64d46806 1178 if (__nft_expr_type_get(family, nla))
96518518
PM		 1179 return ERR_PTR(-EAGAIN);
1180 }
1181#endif
1182 return ERR_PTR(-ENOENT);
1183}
1184
1185static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1186 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1187 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1188};
1189
1190static int nf_tables_fill_expr_info(struct sk_buff *skb,
1191 const struct nft_expr *expr)
1192{
ef1f7df9 1193 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
96518518
PM		 1194 goto nla_put_failure;
1195
1196 if (expr->ops->dump) {
1197 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1198 if (data == NULL)
1199 goto nla_put_failure;
1200 if (expr->ops->dump(skb, expr) < 0)
1201 goto nla_put_failure;
1202 nla_nest_end(skb, data);
1203 }
1204
1205 return skb->len;
1206
1207nla_put_failure:
1208 return -1;
1209};
1210
1211struct nft_expr_info {
1212 const struct nft_expr_ops *ops;
ef1f7df9 1213 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
96518518
PM		 1214};
1215
0ca743a5
PNA		 1216static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1217 const struct nlattr *nla,
96518518
PM		 1218 struct nft_expr_info *info)
1219{
ef1f7df9 1220 const struct nft_expr_type *type;
96518518 1221 const struct nft_expr_ops *ops;
ef1f7df9 1222 struct nlattr *tb[NFTA_EXPR_MAX + 1];
96518518
PM		 1223 int err;
1224
ef1f7df9 1225 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy);
96518518
PM		 1226 if (err < 0)
1227 return err;
1228
64d46806 1229 type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
ef1f7df9
PM		 1230 if (IS_ERR(type))
1231 return PTR_ERR(type);
1232
1233 if (tb[NFTA_EXPR_DATA]) {
1234 err = nla_parse_nested(info->tb, type->maxattr,
1235 tb[NFTA_EXPR_DATA], type->policy);
1236 if (err < 0)
1237 goto err1;
1238 } else
1239 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1240
1241 if (type->select_ops != NULL) {
0ca743a5
PNA		 1242 ops = type->select_ops(ctx,
1243 (const struct nlattr * const *)info->tb);
ef1f7df9
PM		 1244 if (IS_ERR(ops)) {
1245 err = PTR_ERR(ops);
1246 goto err1;
1247 }
1248 } else
1249 ops = type->ops;
1250
96518518
PM		 1251 info->ops = ops;
1252 return 0;
ef1f7df9
PM		 1253
1254err1:
1255 module_put(type->owner);
1256 return err;
96518518
PM		 1257}
1258
1259static int nf_tables_newexpr(const struct nft_ctx *ctx,
ef1f7df9 1260 const struct nft_expr_info *info,
96518518
PM		 1261 struct nft_expr *expr)
1262{
1263 const struct nft_expr_ops *ops = info->ops;
1264 int err;
1265
1266 expr->ops = ops;
1267 if (ops->init) {
ef1f7df9 1268 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
96518518
PM		 1269 if (err < 0)
1270 goto err1;
1271 }
1272
96518518
PM		 1273 return 0;
1274
1275err1:
1276 expr->ops = NULL;
1277 return err;
1278}
1279
62472bce
PM		 1280static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1281 struct nft_expr *expr)
96518518
PM		 1282{
1283 if (expr->ops->destroy)
62472bce 1284 expr->ops->destroy(ctx, expr);
ef1f7df9 1285 module_put(expr->ops->type->owner);
96518518
PM		 1286}
1287
1288/*
1289 * Rules
1290 */
1291
1292static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1293 u64 handle)
1294{
1295 struct nft_rule *rule;
1296
1297 // FIXME: this sucks
1298 list_for_each_entry(rule, &chain->rules, list) {
1299 if (handle == rule->handle)
1300 return rule;
1301 }
1302
1303 return ERR_PTR(-ENOENT);
1304}
1305
1306static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1307 const struct nlattr *nla)
1308{
1309 if (nla == NULL)
1310 return ERR_PTR(-EINVAL);
1311
1312 return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1313}
1314
1315static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
1316 [NFTA_RULE_TABLE] = { .type = NLA_STRING },
1317 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
1318 .len = NFT_CHAIN_MAXNAMELEN - 1 },
1319 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
1320 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
0ca743a5 1321 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
5e948466 1322 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
0768b3b3
PNA		 1323 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
1324 .len = NFT_USERDATA_MAXLEN },
96518518
PM		 1325};
1326
1327static int nf_tables_fill_rule_info(struct sk_buff *skb, u32 portid, u32 seq,
1328 int event, u32 flags, int family,
1329 const struct nft_table *table,
1330 const struct nft_chain *chain,
1331 const struct nft_rule *rule)
1332{
1333 struct nlmsghdr *nlh;
1334 struct nfgenmsg *nfmsg;
1335 const struct nft_expr *expr, *next;
1336 struct nlattr *list;
5e948466
EL		 1337 const struct nft_rule *prule;
1338 int type = event | NFNL_SUBSYS_NFTABLES << 8;
96518518 1339
5e948466 1340 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg),
96518518
PM		 1341 flags);
1342 if (nlh == NULL)
1343 goto nla_put_failure;
1344
1345 nfmsg = nlmsg_data(nlh);
1346 nfmsg->nfgen_family = family;
1347 nfmsg->version = NFNETLINK_V0;
1348 nfmsg->res_id = 0;
1349
1350 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1351 goto nla_put_failure;
1352 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1353 goto nla_put_failure;
1354 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle)))
1355 goto nla_put_failure;
1356
5e948466
EL		 1357 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
1358 prule = list_entry(rule->list.prev, struct nft_rule, list);
1359 if (nla_put_be64(skb, NFTA_RULE_POSITION,
1360 cpu_to_be64(prule->handle)))
1361 goto nla_put_failure;
1362 }
1363
96518518
PM		 1364 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1365 if (list == NULL)
1366 goto nla_put_failure;
1367 nft_rule_for_each_expr(expr, next, rule) {
1368 struct nlattr *elem = nla_nest_start(skb, NFTA_LIST_ELEM);
1369 if (elem == NULL)
1370 goto nla_put_failure;
1371 if (nf_tables_fill_expr_info(skb, expr) < 0)
1372 goto nla_put_failure;
1373 nla_nest_end(skb, elem);
1374 }
1375 nla_nest_end(skb, list);
1376
0768b3b3
PNA		 1377 if (rule->ulen &&
1378 nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
1379 goto nla_put_failure;
1380
96518518
PM		 1381 return nlmsg_end(skb, nlh);
1382
1383nla_put_failure:
1384 nlmsg_trim(skb, nlh);
1385 return -1;
1386}
1387
1388static int nf_tables_rule_notify(const struct sk_buff *oskb,
1389 const struct nlmsghdr *nlh,
1390 const struct nft_table *table,
1391 const struct nft_chain *chain,
1392 const struct nft_rule *rule,
1393 int event, u32 flags, int family)
1394{
1395 struct sk_buff *skb;
1396 u32 portid = NETLINK_CB(oskb).portid;
1397 struct net *net = oskb ? sock_net(oskb->sk) : &init_net;
1398 u32 seq = nlh->nlmsg_seq;
1399 bool report;
1400 int err;
1401
1402 report = nlmsg_report(nlh);
1403 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
1404 return 0;
1405
1406 err = -ENOBUFS;
1407 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1408 if (skb == NULL)
1409 goto err;
1410
1411 err = nf_tables_fill_rule_info(skb, portid, seq, event, flags,
1412 family, table, chain, rule);
1413 if (err < 0) {
1414 kfree_skb(skb);
1415 goto err;
1416 }
1417
1418 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
1419 GFP_KERNEL);
1420err:
1421 if (err < 0)
1422 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
1423 return err;
1424}
1425
0628b123
PNA		 1426static inline bool
1427nft_rule_is_active(struct net *net, const struct nft_rule *rule)
1428{
1429 return (rule->genmask & (1 << net->nft.gencursor)) == 0;
1430}
1431
1432static inline int gencursor_next(struct net *net)
1433{
1434 return net->nft.gencursor+1 == 1 ? 1 : 0;
1435}
1436
1437static inline int
1438nft_rule_is_active_next(struct net *net, const struct nft_rule *rule)
1439{
1440 return (rule->genmask & (1 << gencursor_next(net))) == 0;
1441}
1442
1443static inline void
1444nft_rule_activate_next(struct net *net, struct nft_rule *rule)
1445{
1446 /* Now inactive, will be active in the future */
1447 rule->genmask = (1 << net->nft.gencursor);
1448}
1449
1450static inline void
1451nft_rule_disactivate_next(struct net *net, struct nft_rule *rule)
1452{
1453 rule->genmask = (1 << gencursor_next(net));
1454}
1455
1456static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
1457{
1458 rule->genmask = 0;
1459}
1460
96518518
PM		 1461static int nf_tables_dump_rules(struct sk_buff *skb,
1462 struct netlink_callback *cb)
1463{
1464 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1465 const struct nft_af_info *afi;
1466 const struct nft_table *table;
1467 const struct nft_chain *chain;
1468 const struct nft_rule *rule;
1469 unsigned int idx = 0, s_idx = cb->args[0];
99633ab2 1470 struct net *net = sock_net(skb->sk);
96518518 1471 int family = nfmsg->nfgen_family;
0628b123
PNA		 1472 u8 genctr = ACCESS_ONCE(net->nft.genctr);
1473 u8 gencursor = ACCESS_ONCE(net->nft.gencursor);
96518518 1474
99633ab2 1475 list_for_each_entry(afi, &net->nft.af_info, list) {
96518518
PM		 1476 if (family != NFPROTO_UNSPEC && family != afi->family)
1477 continue;
1478
1479 list_for_each_entry(table, &afi->tables, list) {
1480 list_for_each_entry(chain, &table->chains, list) {
1481 list_for_each_entry(rule, &chain->rules, list) {
0628b123
PNA		 1482 if (!nft_rule_is_active(net, rule))
1483 goto cont;
96518518
PM		 1484 if (idx < s_idx)
1485 goto cont;
1486 if (idx > s_idx)
1487 memset(&cb->args[1], 0,
1488 sizeof(cb->args) - sizeof(cb->args[0]));
1489 if (nf_tables_fill_rule_info(skb, NETLINK_CB(cb->skb).portid,
1490 cb->nlh->nlmsg_seq,
1491 NFT_MSG_NEWRULE,
1492 NLM_F_MULTI | NLM_F_APPEND,
1493 afi->family, table, chain, rule) < 0)
1494 goto done;
1495cont:
1496 idx++;
1497 }
1498 }
1499 }
1500 }
1501done:
0628b123
PNA		 1502 /* Invalidate this dump, a transition to the new generation happened */
1503 if (gencursor != net->nft.gencursor || genctr != net->nft.genctr)
1504 return -EBUSY;
1505
96518518
PM		 1506 cb->args[0] = idx;
1507 return skb->len;
1508}
1509
1510static int nf_tables_getrule(struct sock *nlsk, struct sk_buff *skb,
1511 const struct nlmsghdr *nlh,
1512 const struct nlattr * const nla[])
1513{
1514 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1515 const struct nft_af_info *afi;
1516 const struct nft_table *table;
1517 const struct nft_chain *chain;
1518 const struct nft_rule *rule;
1519 struct sk_buff *skb2;
99633ab2 1520 struct net *net = sock_net(skb->sk);
96518518
PM		 1521 int family = nfmsg->nfgen_family;
1522 int err;
1523
1524 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1525 struct netlink_dump_control c = {
1526 .dump = nf_tables_dump_rules,
1527 };
1528 return netlink_dump_start(nlsk, skb, nlh, &c);
1529 }
1530
99633ab2 1531 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1532 if (IS_ERR(afi))
1533 return PTR_ERR(afi);
1534
9370761c 1535 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1536 if (IS_ERR(table))
1537 return PTR_ERR(table);
1538
1539 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1540 if (IS_ERR(chain))
1541 return PTR_ERR(chain);
1542
1543 rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
1544 if (IS_ERR(rule))
1545 return PTR_ERR(rule);
1546
1547 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1548 if (!skb2)
1549 return -ENOMEM;
1550
1551 err = nf_tables_fill_rule_info(skb2, NETLINK_CB(skb).portid,
1552 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
1553 family, table, chain, rule);
1554 if (err < 0)
1555 goto err;
1556
1557 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1558
1559err:
1560 kfree_skb(skb2);
1561 return err;
1562}
1563
62472bce
PM		 1564static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
1565 struct nft_rule *rule)
96518518 1566{
96518518
PM		 1567 struct nft_expr *expr;
1568
1569 /*
1570 * Careful: some expressions might not be initialized in case this
1571 * is called on error from nf_tables_newrule().
1572 */
1573 expr = nft_expr_first(rule);
1574 while (expr->ops && expr != nft_expr_last(rule)) {
62472bce 1575 nf_tables_expr_destroy(ctx, expr);
96518518
PM		 1576 expr = nft_expr_next(expr);
1577 }
1578 kfree(rule);
1579}
1580
b380e5c7 1581static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
1081d11b 1582 struct nft_rule *rule)
0628b123 1583{
1081d11b 1584 struct nft_trans *trans;
0628b123 1585
b380e5c7 1586 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
1081d11b
PNA		 1587 if (trans == NULL)
1588 return NULL;
0628b123 1589
1081d11b
PNA		 1590 nft_trans_rule(trans) = rule;
1591 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
0628b123 1592
1081d11b 1593 return trans;
0628b123
PNA		 1594}
1595
1081d11b
PNA		 1596#define NFT_RULE_MAXEXPRS 128
1597
1598static struct nft_expr_info *info;
1599
96518518
PM		 1600static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
1601 const struct nlmsghdr *nlh,
1602 const struct nlattr * const nla[])
1603{
1604 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1605 struct nft_af_info *afi;
99633ab2 1606 struct net *net = sock_net(skb->sk);
96518518
PM		 1607 struct nft_table *table;
1608 struct nft_chain *chain;
1609 struct nft_rule *rule, *old_rule = NULL;
1081d11b 1610 struct nft_trans *trans = NULL;
96518518
PM		 1611 struct nft_expr *expr;
1612 struct nft_ctx ctx;
1613 struct nlattr *tmp;
0768b3b3 1614 unsigned int size, i, n, ulen = 0;
96518518
PM		 1615 int err, rem;
1616 bool create;
5e948466 1617 u64 handle, pos_handle;
96518518
PM		 1618
1619 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1620
99633ab2 1621 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
96518518
PM		 1622 if (IS_ERR(afi))
1623 return PTR_ERR(afi);
1624
9370761c 1625 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1626 if (IS_ERR(table))
1627 return PTR_ERR(table);
1628
1629 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1630 if (IS_ERR(chain))
1631 return PTR_ERR(chain);
1632
1633 if (nla[NFTA_RULE_HANDLE]) {
1634 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
1635 rule = __nf_tables_rule_lookup(chain, handle);
1636 if (IS_ERR(rule))
1637 return PTR_ERR(rule);
1638
1639 if (nlh->nlmsg_flags & NLM_F_EXCL)
1640 return -EEXIST;
1641 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1642 old_rule = rule;
1643 else
1644 return -EOPNOTSUPP;
1645 } else {
1646 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
1647 return -EINVAL;
1648 handle = nf_tables_alloc_handle(table);
1649 }
1650
5e948466
EL		 1651 if (nla[NFTA_RULE_POSITION]) {
1652 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
1653 return -EOPNOTSUPP;
1654
1655 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
1656 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
1657 if (IS_ERR(old_rule))
1658 return PTR_ERR(old_rule);
1659 }
1660
0ca743a5
PNA		 1661 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1662
96518518
PM		 1663 n = 0;
1664 size = 0;
1665 if (nla[NFTA_RULE_EXPRESSIONS]) {
1666 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
1667 err = -EINVAL;
1668 if (nla_type(tmp) != NFTA_LIST_ELEM)
1669 goto err1;
1670 if (n == NFT_RULE_MAXEXPRS)
1671 goto err1;
0ca743a5 1672 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
96518518
PM		 1673 if (err < 0)
1674 goto err1;
1675 size += info[n].ops->size;
1676 n++;
1677 }
1678 }
1679
0768b3b3
PNA		 1680 if (nla[NFTA_RULE_USERDATA])
1681 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
1682
96518518 1683 err = -ENOMEM;
0768b3b3 1684 rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
96518518
PM		 1685 if (rule == NULL)
1686 goto err1;
1687
0628b123
PNA		 1688 nft_rule_activate_next(net, rule);
1689
96518518
PM		 1690 rule->handle = handle;
1691 rule->dlen = size;
0768b3b3
PNA		 1692 rule->ulen = ulen;
1693
1694 if (ulen)
1695 nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
96518518 1696
96518518
PM		 1697 expr = nft_expr_first(rule);
1698 for (i = 0; i < n; i++) {
1699 err = nf_tables_newexpr(&ctx, &info[i], expr);
1700 if (err < 0)
1701 goto err2;
ef1f7df9 1702 info[i].ops = NULL;
96518518
PM		 1703 expr = nft_expr_next(expr);
1704 }
1705
96518518 1706 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
0628b123 1707 if (nft_rule_is_active_next(net, old_rule)) {
b380e5c7
PNA		 1708 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE,
1709 old_rule);
1081d11b 1710 if (trans == NULL) {
0628b123
PNA		 1711 err = -ENOMEM;
1712 goto err2;
1713 }
1714 nft_rule_disactivate_next(net, old_rule);
1715 list_add_tail(&rule->list, &old_rule->list);
1716 } else {
1717 err = -ENOENT;
1718 goto err2;
1719 }
96518518 1720 } else if (nlh->nlmsg_flags & NLM_F_APPEND)
5e948466
EL		 1721 if (old_rule)
1722 list_add_rcu(&rule->list, &old_rule->list);
1723 else
1724 list_add_tail_rcu(&rule->list, &chain->rules);
1725 else {
1726 if (old_rule)
1727 list_add_tail_rcu(&rule->list, &old_rule->list);
1728 else
1729 list_add_rcu(&rule->list, &chain->rules);
1730 }
96518518 1731
b380e5c7 1732 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
0628b123
PNA		 1733 err = -ENOMEM;
1734 goto err3;
1735 }
96518518
PM		 1736 return 0;
1737
0628b123
PNA		 1738err3:
1739 list_del_rcu(&rule->list);
1081d11b
PNA		 1740 if (trans) {
1741 list_del_rcu(&nft_trans_rule(trans)->list);
1742 nft_rule_clear(net, nft_trans_rule(trans));
1743 nft_trans_destroy(trans);
0628b123 1744 }
96518518 1745err2:
62472bce 1746 nf_tables_rule_destroy(&ctx, rule);
96518518
PM		 1747err1:
1748 for (i = 0; i < n; i++) {
1749 if (info[i].ops != NULL)
ef1f7df9 1750 module_put(info[i].ops->type->owner);
96518518
PM		 1751 }
1752 return err;
1753}
1754
0628b123
PNA		 1755static int
1756nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
1757{
1758 /* You cannot delete the same rule twice */
1759 if (nft_rule_is_active_next(ctx->net, rule)) {
b380e5c7 1760 if (nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule) == NULL)
0628b123
PNA		 1761 return -ENOMEM;
1762 nft_rule_disactivate_next(ctx->net, rule);
1763 return 0;
1764 }
1765 return -ENOENT;
1766}
1767
cf9dc09d
PNA		 1768static int nf_table_delrule_by_chain(struct nft_ctx *ctx)
1769{
1770 struct nft_rule *rule;
1771 int err;
1772
1773 list_for_each_entry(rule, &ctx->chain->rules, list) {
1774 err = nf_tables_delrule_one(ctx, rule);
1775 if (err < 0)
1776 return err;
1777 }
1778 return 0;
1779}
1780
96518518
PM		 1781static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
1782 const struct nlmsghdr *nlh,
1783 const struct nlattr * const nla[])
1784{
1785 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8 1786 struct nft_af_info *afi;
99633ab2 1787 struct net *net = sock_net(skb->sk);
7c95f6d8 1788 struct nft_table *table;
cf9dc09d
PNA		 1789 struct nft_chain *chain = NULL;
1790 struct nft_rule *rule;
0628b123
PNA		 1791 int family = nfmsg->nfgen_family, err = 0;
1792 struct nft_ctx ctx;
96518518 1793
99633ab2 1794 afi = nf_tables_afinfo_lookup(net, family, false);
96518518
PM		 1795 if (IS_ERR(afi))
1796 return PTR_ERR(afi);
1797
9370761c 1798 table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
96518518
PM		 1799 if (IS_ERR(table))
1800 return PTR_ERR(table);
1801
cf9dc09d
PNA		 1802 if (nla[NFTA_RULE_CHAIN]) {
1803 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1804 if (IS_ERR(chain))
1805 return PTR_ERR(chain);
1806 }
96518518 1807
0628b123
PNA		 1808 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1809
cf9dc09d
PNA		 1810 if (chain) {
1811 if (nla[NFTA_RULE_HANDLE]) {
1812 rule = nf_tables_rule_lookup(chain,
1813 nla[NFTA_RULE_HANDLE]);
1814 if (IS_ERR(rule))
1815 return PTR_ERR(rule);
96518518 1816
0628b123 1817 err = nf_tables_delrule_one(&ctx, rule);
cf9dc09d
PNA		 1818 } else {
1819 err = nf_table_delrule_by_chain(&ctx);
1820 }
1821 } else {
1822 list_for_each_entry(chain, &table->chains, list) {
1823 ctx.chain = chain;
1824 err = nf_table_delrule_by_chain(&ctx);
0628b123
PNA		 1825 if (err < 0)
1826 break;
1827 }
1828 }
1829
1830 return err;
1831}
1832
20a69341
PM		 1833/*
1834 * Sets
1835 */
1836
1837static LIST_HEAD(nf_tables_set_ops);
1838
1839int nft_register_set(struct nft_set_ops *ops)
1840{
1841 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1842 list_add_tail(&ops->list, &nf_tables_set_ops);
1843 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1844 return 0;
1845}
1846EXPORT_SYMBOL_GPL(nft_register_set);
1847
1848void nft_unregister_set(struct nft_set_ops *ops)
1849{
1850 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1851 list_del(&ops->list);
1852 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1853}
1854EXPORT_SYMBOL_GPL(nft_unregister_set);
1855
c50b960c
PM		 1856/*
1857 * Select a set implementation based on the data characteristics and the
1858 * given policy. The total memory use might not be known if no size is
1859 * given, in that case the amount of memory per element is used.
1860 */
1861static const struct nft_set_ops *
1862nft_select_set_ops(const struct nlattr * const nla[],
1863 const struct nft_set_desc *desc,
1864 enum nft_set_policies policy)
20a69341 1865{
c50b960c
PM		 1866 const struct nft_set_ops *ops, *bops;
1867 struct nft_set_estimate est, best;
20a69341
PM		 1868 u32 features;
1869
1870#ifdef CONFIG_MODULES
1871 if (list_empty(&nf_tables_set_ops)) {
1872 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1873 request_module("nft-set");
1874 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1875 if (!list_empty(&nf_tables_set_ops))
1876 return ERR_PTR(-EAGAIN);
1877 }
1878#endif
1879 features = 0;
1880 if (nla[NFTA_SET_FLAGS] != NULL) {
1881 features = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
1882 features &= NFT_SET_INTERVAL | NFT_SET_MAP;
1883 }
1884
c50b960c
PM		 1885 bops = NULL;
1886 best.size = ~0;
1887 best.class = ~0;
1888
20a69341
PM		 1889 list_for_each_entry(ops, &nf_tables_set_ops, list) {
1890 if ((ops->features & features) != features)
1891 continue;
c50b960c
PM		 1892 if (!ops->estimate(desc, features, &est))
1893 continue;
1894
1895 switch (policy) {
1896 case NFT_SET_POL_PERFORMANCE:
1897 if (est.class < best.class)
1898 break;
1899 if (est.class == best.class && est.size < best.size)
1900 break;
1901 continue;
1902 case NFT_SET_POL_MEMORY:
1903 if (est.size < best.size)
1904 break;
1905 if (est.size == best.size && est.class < best.class)
1906 break;
1907 continue;
1908 default:
1909 break;
1910 }
1911
20a69341
PM		 1912 if (!try_module_get(ops->owner))
1913 continue;
c50b960c
PM		 1914 if (bops != NULL)
1915 module_put(bops->owner);
1916
1917 bops = ops;
1918 best = est;
20a69341
PM		 1919 }
1920
c50b960c
PM		 1921 if (bops != NULL)
1922 return bops;
1923
20a69341
PM		 1924 return ERR_PTR(-EOPNOTSUPP);
1925}
1926
1927static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
1928 [NFTA_SET_TABLE] = { .type = NLA_STRING },
1929 [NFTA_SET_NAME] = { .type = NLA_STRING },
1930 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
1931 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
1932 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
1933 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
1934 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
c50b960c
PM		 1935 [NFTA_SET_POLICY] = { .type = NLA_U32 },
1936 [NFTA_SET_DESC] = { .type = NLA_NESTED },
958bee14 1937 [NFTA_SET_ID] = { .type = NLA_U32 },
c50b960c
PM		 1938};
1939
1940static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
1941 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
20a69341
PM		 1942};
1943
1944static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
1945 const struct sk_buff *skb,
1946 const struct nlmsghdr *nlh,
1947 const struct nlattr * const nla[])
1948{
99633ab2 1949 struct net *net = sock_net(skb->sk);
20a69341 1950 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 1951 struct nft_af_info *afi = NULL;
1952 struct nft_table *table = NULL;
20a69341 1953
c9c8e485
PNA		 1954 if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
1955 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
1956 if (IS_ERR(afi))
1957 return PTR_ERR(afi);
1958 }
20a69341
PM		 1959
1960 if (nla[NFTA_SET_TABLE] != NULL) {
ec2c9935
PM		 1961 if (afi == NULL)
1962 return -EAFNOSUPPORT;
1963
9370761c 1964 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
20a69341
PM		 1965 if (IS_ERR(table))
1966 return PTR_ERR(table);
1967 }
1968
0ca743a5 1969 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 1970 return 0;
1971}
1972
1973struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
1974 const struct nlattr *nla)
1975{
1976 struct nft_set *set;
1977
1978 if (nla == NULL)
1979 return ERR_PTR(-EINVAL);
1980
1981 list_for_each_entry(set, &table->sets, list) {
1982 if (!nla_strcmp(nla, set->name))
1983 return set;
1984 }
1985 return ERR_PTR(-ENOENT);
1986}
1987
958bee14
PNA		 1988struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
1989 const struct nlattr *nla)
1990{
1991 struct nft_trans *trans;
1992 u32 id = ntohl(nla_get_be32(nla));
1993
1994 list_for_each_entry(trans, &net->nft.commit_list, list) {
1995 if (trans->msg_type == NFT_MSG_NEWSET &&
1996 id == nft_trans_set_id(trans))
1997 return nft_trans_set(trans);
1998 }
1999 return ERR_PTR(-ENOENT);
2000}
2001
20a69341
PM		 2002static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2003 const char *name)
2004{
2005 const struct nft_set *i;
2006 const char *p;
2007 unsigned long *inuse;
60eb1894 2008 unsigned int n = 0, min = 0;
20a69341
PM		 2009
2010 p = strnchr(name, IFNAMSIZ, '%');
2011 if (p != NULL) {
2012 if (p[1] != 'd' || strchr(p + 2, '%'))
2013 return -EINVAL;
2014
2015 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2016 if (inuse == NULL)
2017 return -ENOMEM;
60eb1894 2018cont:
20a69341 2019 list_for_each_entry(i, &ctx->table->sets, list) {
14662917
DB		 2020 int tmp;
2021
2022 if (!sscanf(i->name, name, &tmp))
20a69341 2023 continue;
60eb1894 2024 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
20a69341 2025 continue;
14662917 2026
60eb1894 2027 set_bit(tmp - min, inuse);
20a69341
PM		 2028 }
2029
53b70287 2030 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
60eb1894
PM		 2031 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2032 min += BITS_PER_BYTE * PAGE_SIZE;
2033 memset(inuse, 0, PAGE_SIZE);
2034 goto cont;
2035 }
20a69341
PM		 2036 free_page((unsigned long)inuse);
2037 }
2038
60eb1894 2039 snprintf(set->name, sizeof(set->name), name, min + n);
20a69341
PM		 2040 list_for_each_entry(i, &ctx->table->sets, list) {
2041 if (!strcmp(set->name, i->name))
2042 return -ENFILE;
2043 }
2044 return 0;
2045}
2046
2047static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2048 const struct nft_set *set, u16 event, u16 flags)
2049{
2050 struct nfgenmsg *nfmsg;
2051 struct nlmsghdr *nlh;
c50b960c 2052 struct nlattr *desc;
20a69341
PM		 2053 u32 portid = NETLINK_CB(ctx->skb).portid;
2054 u32 seq = ctx->nlh->nlmsg_seq;
2055
2056 event |= NFNL_SUBSYS_NFTABLES << 8;
2057 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2058 flags);
2059 if (nlh == NULL)
2060 goto nla_put_failure;
2061
2062 nfmsg = nlmsg_data(nlh);
2063 nfmsg->nfgen_family = ctx->afi->family;
2064 nfmsg->version = NFNETLINK_V0;
2065 nfmsg->res_id = 0;
2066
2067 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2068 goto nla_put_failure;
2069 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2070 goto nla_put_failure;
2071 if (set->flags != 0)
2072 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2073 goto nla_put_failure;
2074
2075 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2076 goto nla_put_failure;
2077 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2078 goto nla_put_failure;
2079 if (set->flags & NFT_SET_MAP) {
2080 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2081 goto nla_put_failure;
2082 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2083 goto nla_put_failure;
2084 }
2085
c50b960c
PM		 2086 desc = nla_nest_start(skb, NFTA_SET_DESC);
2087 if (desc == NULL)
2088 goto nla_put_failure;
2089 if (set->size &&
2090 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2091 goto nla_put_failure;
2092 nla_nest_end(skb, desc);
2093
20a69341
PM		 2094 return nlmsg_end(skb, nlh);
2095
2096nla_put_failure:
2097 nlmsg_trim(skb, nlh);
2098 return -1;
2099}
2100
2101static int nf_tables_set_notify(const struct nft_ctx *ctx,
2102 const struct nft_set *set,
2103 int event)
2104{
2105 struct sk_buff *skb;
2106 u32 portid = NETLINK_CB(ctx->skb).portid;
20a69341
PM		 2107 bool report;
2108 int err;
2109
2110 report = nlmsg_report(ctx->nlh);
99633ab2 2111 if (!report && !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
20a69341
PM		 2112 return 0;
2113
2114 err = -ENOBUFS;
2115 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2116 if (skb == NULL)
2117 goto err;
2118
2119 err = nf_tables_fill_set(skb, ctx, set, event, 0);
2120 if (err < 0) {
2121 kfree_skb(skb);
2122 goto err;
2123 }
2124
99633ab2 2125 err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, report,
20a69341
PM		 2126 GFP_KERNEL);
2127err:
2128 if (err < 0)
99633ab2 2129 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err);
20a69341
PM		 2130 return err;
2131}
2132
2133static int nf_tables_dump_sets_table(struct nft_ctx *ctx, struct sk_buff *skb,
2134 struct netlink_callback *cb)
2135{
2136 const struct nft_set *set;
2137 unsigned int idx = 0, s_idx = cb->args[0];
2138
2139 if (cb->args[1])
2140 return skb->len;
2141
2142 list_for_each_entry(set, &ctx->table->sets, list) {
2143 if (idx < s_idx)
2144 goto cont;
2145 if (nf_tables_fill_set(skb, ctx, set, NFT_MSG_NEWSET,
2146 NLM_F_MULTI) < 0) {
2147 cb->args[0] = idx;
2148 goto done;
2149 }
2150cont:
2151 idx++;
2152 }
2153 cb->args[1] = 1;
2154done:
2155 return skb->len;
2156}
2157
c9c8e485
PNA		 2158static int nf_tables_dump_sets_family(struct nft_ctx *ctx, struct sk_buff *skb,
2159 struct netlink_callback *cb)
20a69341
PM		 2160{
2161 const struct nft_set *set;
e38195bf 2162 unsigned int idx, s_idx = cb->args[0];
20a69341
PM		 2163 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2164
2165 if (cb->args[1])
2166 return skb->len;
2167
2168 list_for_each_entry(table, &ctx->afi->tables, list) {
e38195bf
PNA		 2169 if (cur_table) {
2170 if (cur_table != table)
2171 continue;
20a69341 2172
e38195bf
PNA		 2173 cur_table = NULL;
2174 }
20a69341 2175 ctx->table = table;
e38195bf 2176 idx = 0;
20a69341
PM		 2177 list_for_each_entry(set, &ctx->table->sets, list) {
2178 if (idx < s_idx)
2179 goto cont;
2180 if (nf_tables_fill_set(skb, ctx, set, NFT_MSG_NEWSET,
2181 NLM_F_MULTI) < 0) {
2182 cb->args[0] = idx;
2183 cb->args[2] = (unsigned long) table;
2184 goto done;
2185 }
2186cont:
2187 idx++;
2188 }
2189 }
2190 cb->args[1] = 1;
2191done:
2192 return skb->len;
2193}
2194
c9c8e485
PNA		 2195static int nf_tables_dump_sets_all(struct nft_ctx *ctx, struct sk_buff *skb,
2196 struct netlink_callback *cb)
2197{
2198 const struct nft_set *set;
2199 unsigned int idx, s_idx = cb->args[0];
7c95f6d8 2200 struct nft_af_info *afi;
c9c8e485
PNA		 2201 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2202 struct net *net = sock_net(skb->sk);
2203 int cur_family = cb->args[3];
2204
2205 if (cb->args[1])
2206 return skb->len;
2207
2208 list_for_each_entry(afi, &net->nft.af_info, list) {
2209 if (cur_family) {
2210 if (afi->family != cur_family)
2211 continue;
2212
2213 cur_family = 0;
2214 }
2215
2216 list_for_each_entry(table, &afi->tables, list) {
2217 if (cur_table) {
2218 if (cur_table != table)
2219 continue;
2220
2221 cur_table = NULL;
2222 }
2223
2224 ctx->table = table;
2225 ctx->afi = afi;
2226 idx = 0;
2227 list_for_each_entry(set, &ctx->table->sets, list) {
2228 if (idx < s_idx)
2229 goto cont;
2230 if (nf_tables_fill_set(skb, ctx, set,
2231 NFT_MSG_NEWSET,
2232 NLM_F_MULTI) < 0) {
2233 cb->args[0] = idx;
2234 cb->args[2] = (unsigned long) table;
2235 cb->args[3] = afi->family;
2236 goto done;
2237 }
2238cont:
2239 idx++;
2240 }
2241 if (s_idx)
2242 s_idx = 0;
2243 }
2244 }
2245 cb->args[1] = 1;
2246done:
2247 return skb->len;
2248}
2249
20a69341
PM		 2250static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
2251{
2252 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2253 struct nlattr *nla[NFTA_SET_MAX + 1];
2254 struct nft_ctx ctx;
2255 int err, ret;
2256
2257 err = nlmsg_parse(cb->nlh, sizeof(*nfmsg), nla, NFTA_SET_MAX,
2258 nft_set_policy);
2259 if (err < 0)
2260 return err;
2261
2262 err = nft_ctx_init_from_setattr(&ctx, cb->skb, cb->nlh, (void *)nla);
2263 if (err < 0)
2264 return err;
2265
c9c8e485
PNA		 2266 if (ctx.table == NULL) {
2267 if (ctx.afi == NULL)
2268 ret = nf_tables_dump_sets_all(&ctx, skb, cb);
2269 else
2270 ret = nf_tables_dump_sets_family(&ctx, skb, cb);
2271 } else
20a69341
PM		 2272 ret = nf_tables_dump_sets_table(&ctx, skb, cb);
2273
2274 return ret;
2275}
2276
958bee14
PNA		 2277#define NFT_SET_INACTIVE (1 << 15) /* Internal set flag */
2278
20a69341
PM		 2279static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
2280 const struct nlmsghdr *nlh,
2281 const struct nlattr * const nla[])
2282{
2283 const struct nft_set *set;
2284 struct nft_ctx ctx;
2285 struct sk_buff *skb2;
c9c8e485 2286 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2287 int err;
2288
2289 /* Verify existance before starting dump */
2290 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2291 if (err < 0)
2292 return err;
2293
2294 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2295 struct netlink_dump_control c = {
2296 .dump = nf_tables_dump_sets,
2297 };
2298 return netlink_dump_start(nlsk, skb, nlh, &c);
2299 }
2300
c9c8e485
PNA		 2301 /* Only accept unspec with dump */
2302 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2303 return -EAFNOSUPPORT;
2304
20a69341
PM		 2305 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2306 if (IS_ERR(set))
2307 return PTR_ERR(set);
958bee14
PNA		 2308 if (set->flags & NFT_SET_INACTIVE)
2309 return -ENOENT;
20a69341
PM		 2310
2311 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2312 if (skb2 == NULL)
2313 return -ENOMEM;
2314
2315 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2316 if (err < 0)
2317 goto err;
2318
2319 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2320
2321err:
2322 kfree_skb(skb2);
2323 return err;
2324}
2325
c50b960c
PM		 2326static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2327 struct nft_set_desc *desc,
2328 const struct nlattr *nla)
2329{
2330 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2331 int err;
2332
2333 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla, nft_set_desc_policy);
2334 if (err < 0)
2335 return err;
2336
2337 if (da[NFTA_SET_DESC_SIZE] != NULL)
2338 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
2339
2340 return 0;
2341}
2342
958bee14
PNA		 2343static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
2344 struct nft_set *set)
2345{
2346 struct nft_trans *trans;
2347
2348 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
2349 if (trans == NULL)
2350 return -ENOMEM;
2351
2352 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
2353 nft_trans_set_id(trans) =
2354 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
2355 set->flags |= NFT_SET_INACTIVE;
2356 }
2357 nft_trans_set(trans) = set;
2358 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
2359
2360 return 0;
2361}
2362
20a69341
PM		 2363static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
2364 const struct nlmsghdr *nlh,
2365 const struct nlattr * const nla[])
2366{
2367 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2368 const struct nft_set_ops *ops;
7c95f6d8 2369 struct nft_af_info *afi;
99633ab2 2370 struct net *net = sock_net(skb->sk);
20a69341
PM		 2371 struct nft_table *table;
2372 struct nft_set *set;
2373 struct nft_ctx ctx;
2374 char name[IFNAMSIZ];
2375 unsigned int size;
2376 bool create;
c50b960c
PM		 2377 u32 ktype, dtype, flags, policy;
2378 struct nft_set_desc desc;
20a69341
PM		 2379 int err;
2380
2381 if (nla[NFTA_SET_TABLE] == NULL ||
2382 nla[NFTA_SET_NAME] == NULL ||
958bee14
PNA		 2383 nla[NFTA_SET_KEY_LEN] == NULL ||
2384 nla[NFTA_SET_ID] == NULL)
20a69341
PM		 2385 return -EINVAL;
2386
c50b960c
PM		 2387 memset(&desc, 0, sizeof(desc));
2388
20a69341
PM		 2389 ktype = NFT_DATA_VALUE;
2390 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
2391 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
2392 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
2393 return -EINVAL;
2394 }
2395
c50b960c
PM		 2396 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
2397 if (desc.klen == 0 || desc.klen > FIELD_SIZEOF(struct nft_data, data))
20a69341
PM		 2398 return -EINVAL;
2399
2400 flags = 0;
2401 if (nla[NFTA_SET_FLAGS] != NULL) {
2402 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2403 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
2404 NFT_SET_INTERVAL | NFT_SET_MAP))
2405 return -EINVAL;
2406 }
2407
2408 dtype = 0;
20a69341
PM		 2409 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
2410 if (!(flags & NFT_SET_MAP))
2411 return -EINVAL;
2412
2413 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
2414 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
2415 dtype != NFT_DATA_VERDICT)
2416 return -EINVAL;
2417
2418 if (dtype != NFT_DATA_VERDICT) {
2419 if (nla[NFTA_SET_DATA_LEN] == NULL)
2420 return -EINVAL;
c50b960c
PM		 2421 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
2422 if (desc.dlen == 0 ||
2423 desc.dlen > FIELD_SIZEOF(struct nft_data, data))
20a69341
PM		 2424 return -EINVAL;
2425 } else
c50b960c 2426 desc.dlen = sizeof(struct nft_data);
20a69341
PM		 2427 } else if (flags & NFT_SET_MAP)
2428 return -EINVAL;
2429
c50b960c
PM		 2430 policy = NFT_SET_POL_PERFORMANCE;
2431 if (nla[NFTA_SET_POLICY] != NULL)
2432 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
2433
2434 if (nla[NFTA_SET_DESC] != NULL) {
2435 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
2436 if (err < 0)
2437 return err;
2438 }
2439
20a69341
PM		 2440 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2441
99633ab2 2442 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
20a69341
PM		 2443 if (IS_ERR(afi))
2444 return PTR_ERR(afi);
2445
9370761c 2446 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
20a69341
PM		 2447 if (IS_ERR(table))
2448 return PTR_ERR(table);
2449
0ca743a5 2450 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2451
2452 set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME]);
2453 if (IS_ERR(set)) {
2454 if (PTR_ERR(set) != -ENOENT)
2455 return PTR_ERR(set);
2456 set = NULL;
2457 }
2458
2459 if (set != NULL) {
2460 if (nlh->nlmsg_flags & NLM_F_EXCL)
2461 return -EEXIST;
2462 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2463 return -EOPNOTSUPP;
2464 return 0;
2465 }
2466
2467 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2468 return -ENOENT;
2469
c50b960c 2470 ops = nft_select_set_ops(nla, &desc, policy);
20a69341
PM		 2471 if (IS_ERR(ops))
2472 return PTR_ERR(ops);
2473
2474 size = 0;
2475 if (ops->privsize != NULL)
2476 size = ops->privsize(nla);
2477
2478 err = -ENOMEM;
2479 set = kzalloc(sizeof(*set) + size, GFP_KERNEL);
2480 if (set == NULL)
2481 goto err1;
2482
2483 nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name));
2484 err = nf_tables_set_alloc_name(&ctx, set, name);
2485 if (err < 0)
2486 goto err2;
2487
2488 INIT_LIST_HEAD(&set->bindings);
2489 set->ops = ops;
2490 set->ktype = ktype;
c50b960c 2491 set->klen = desc.klen;
20a69341 2492 set->dtype = dtype;
c50b960c 2493 set->dlen = desc.dlen;
20a69341 2494 set->flags = flags;
c50b960c 2495 set->size = desc.size;
20a69341 2496
c50b960c 2497 err = ops->init(set, &desc, nla);
20a69341
PM		 2498 if (err < 0)
2499 goto err2;
2500
958bee14
PNA		 2501 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
2502 if (err < 0)
2503 goto err2;
2504
20a69341 2505 list_add_tail(&set->list, &table->sets);
20a69341
PM		 2506 return 0;
2507
2508err2:
2509 kfree(set);
2510err1:
2511 module_put(ops->owner);
2512 return err;
2513}
2514
958bee14 2515static void nft_set_destroy(struct nft_set *set)
20a69341 2516{
20a69341
PM		 2517 set->ops->destroy(set);
2518 module_put(set->ops->owner);
2519 kfree(set);
2520}
2521
958bee14
PNA		 2522static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
2523{
2524 list_del(&set->list);
2525 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET);
2526 nft_set_destroy(set);
2527}
2528
20a69341
PM		 2529static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
2530 const struct nlmsghdr *nlh,
2531 const struct nlattr * const nla[])
2532{
c9c8e485 2533 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
20a69341
PM		 2534 struct nft_set *set;
2535 struct nft_ctx ctx;
2536 int err;
2537
ec2c9935
PM		 2538 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2539 return -EAFNOSUPPORT;
20a69341
PM		 2540 if (nla[NFTA_SET_TABLE] == NULL)
2541 return -EINVAL;
2542
2543 err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2544 if (err < 0)
2545 return err;
2546
2547 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2548 if (IS_ERR(set))
2549 return PTR_ERR(set);
958bee14
PNA		 2550 if (set->flags & NFT_SET_INACTIVE)
2551 return -ENOENT;
20a69341
PM		 2552 if (!list_empty(&set->bindings))
2553 return -EBUSY;
2554
958bee14
PNA		 2555 err = nft_trans_set_add(&ctx, NFT_MSG_DELSET, set);
2556 if (err < 0)
2557 return err;
2558
2559 list_del(&set->list);
20a69341
PM		 2560 return 0;
2561}
2562
2563static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
2564 const struct nft_set *set,
2565 const struct nft_set_iter *iter,
2566 const struct nft_set_elem *elem)
2567{
2568 enum nft_registers dreg;
2569
2570 dreg = nft_type_to_reg(set->dtype);
2ee0d3c8
PNA		 2571 return nft_validate_data_load(ctx, dreg, &elem->data,
2572 set->dtype == NFT_DATA_VERDICT ?
2573 NFT_DATA_VERDICT : NFT_DATA_VALUE);
20a69341
PM		 2574}
2575
2576int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
2577 struct nft_set_binding *binding)
2578{
2579 struct nft_set_binding *i;
2580 struct nft_set_iter iter;
2581
2582 if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
2583 return -EBUSY;
2584
2585 if (set->flags & NFT_SET_MAP) {
2586 /* If the set is already bound to the same chain all
2587 * jumps are already validated for that chain.
2588 */
2589 list_for_each_entry(i, &set->bindings, list) {
2590 if (i->chain == binding->chain)
2591 goto bind;
2592 }
2593
2594 iter.skip = 0;
2595 iter.count = 0;
2596 iter.err = 0;
2597 iter.fn = nf_tables_bind_check_setelem;
2598
2599 set->ops->walk(ctx, set, &iter);
2600 if (iter.err < 0) {
2601 /* Destroy anonymous sets if binding fails */
2602 if (set->flags & NFT_SET_ANONYMOUS)
2603 nf_tables_set_destroy(ctx, set);
2604
2605 return iter.err;
2606 }
2607 }
2608bind:
2609 binding->chain = ctx->chain;
2610 list_add_tail(&binding->list, &set->bindings);
2611 return 0;
2612}
2613
2614void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
2615 struct nft_set_binding *binding)
2616{
2617 list_del(&binding->list);
2618
958bee14
PNA		 2619 if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS &&
2620 !(set->flags & NFT_SET_INACTIVE))
20a69341
PM		 2621 nf_tables_set_destroy(ctx, set);
2622}
2623
2624/*
2625 * Set elements
2626 */
2627
2628static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
2629 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
2630 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
2631 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
2632};
2633
2634static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
2635 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING },
2636 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING },
2637 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
958bee14 2638 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
20a69341
PM		 2639};
2640
2641static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx,
2642 const struct sk_buff *skb,
2643 const struct nlmsghdr *nlh,
2644 const struct nlattr * const nla[])
2645{
2646 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7c95f6d8
PNA		 2647 struct nft_af_info *afi;
2648 struct nft_table *table;
99633ab2 2649 struct net *net = sock_net(skb->sk);
20a69341 2650
99633ab2 2651 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
20a69341
PM		 2652 if (IS_ERR(afi))
2653 return PTR_ERR(afi);
2654
9370761c 2655 table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE]);
20a69341
PM		 2656 if (IS_ERR(table))
2657 return PTR_ERR(table);
2658
0ca743a5 2659 nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
20a69341
PM		 2660 return 0;
2661}
2662
2663static int nf_tables_fill_setelem(struct sk_buff *skb,
2664 const struct nft_set *set,
2665 const struct nft_set_elem *elem)
2666{
2667 unsigned char *b = skb_tail_pointer(skb);
2668 struct nlattr *nest;
2669
2670 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
2671 if (nest == NULL)
2672 goto nla_put_failure;
2673
2674 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, &elem->key, NFT_DATA_VALUE,
2675 set->klen) < 0)
2676 goto nla_put_failure;
2677
2678 if (set->flags & NFT_SET_MAP &&
2679 !(elem->flags & NFT_SET_ELEM_INTERVAL_END) &&
2680 nft_data_dump(skb, NFTA_SET_ELEM_DATA, &elem->data,
2681 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
2682 set->dlen) < 0)
2683 goto nla_put_failure;
2684
2685 if (elem->flags != 0)
2686 if (nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, htonl(elem->flags)))
2687 goto nla_put_failure;
2688
2689 nla_nest_end(skb, nest);
2690 return 0;
2691
2692nla_put_failure:
2693 nlmsg_trim(skb, b);
2694 return -EMSGSIZE;
2695}
2696
2697struct nft_set_dump_args {
2698 const struct netlink_callback *cb;
2699 struct nft_set_iter iter;
2700 struct sk_buff *skb;
2701};
2702
2703static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
2704 const struct nft_set *set,
2705 const struct nft_set_iter *iter,
2706 const struct nft_set_elem *elem)
2707{
2708 struct nft_set_dump_args *args;
2709
2710 args = container_of(iter, struct nft_set_dump_args, iter);
2711 return nf_tables_fill_setelem(args->skb, set, elem);
2712}
2713
2714static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
2715{
2716 const struct nft_set *set;
2717 struct nft_set_dump_args args;
2718 struct nft_ctx ctx;
2719 struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
2720 struct nfgenmsg *nfmsg;
2721 struct nlmsghdr *nlh;
2722 struct nlattr *nest;
2723 u32 portid, seq;
2724 int event, err;
2725
720e0dfa
MN		 2726 err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
2727 NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy);
20a69341
PM		 2728 if (err < 0)
2729 return err;
2730
2731 err = nft_ctx_init_from_elemattr(&ctx, cb->skb, cb->nlh, (void *)nla);
2732 if (err < 0)
2733 return err;
2734
2735 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2736 if (IS_ERR(set))
2737 return PTR_ERR(set);
958bee14
PNA		 2738 if (set->flags & NFT_SET_INACTIVE)
2739 return -ENOENT;
20a69341
PM		 2740
2741 event = NFT_MSG_NEWSETELEM;
2742 event |= NFNL_SUBSYS_NFTABLES << 8;
2743 portid = NETLINK_CB(cb->skb).portid;
2744 seq = cb->nlh->nlmsg_seq;
2745
2746 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2747 NLM_F_MULTI);
2748 if (nlh == NULL)
2749 goto nla_put_failure;
2750
2751 nfmsg = nlmsg_data(nlh);
2752 nfmsg->nfgen_family = NFPROTO_UNSPEC;
2753 nfmsg->version = NFNETLINK_V0;
2754 nfmsg->res_id = 0;
2755
2756 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
2757 goto nla_put_failure;
2758 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
2759 goto nla_put_failure;
2760
2761 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
2762 if (nest == NULL)
2763 goto nla_put_failure;
2764
2765 args.cb = cb;
2766 args.skb = skb;
2767 args.iter.skip = cb->args[0];
2768 args.iter.count = 0;
2769 args.iter.err = 0;
2770 args.iter.fn = nf_tables_dump_setelem;
2771 set->ops->walk(&ctx, set, &args.iter);
2772
2773 nla_nest_end(skb, nest);
2774 nlmsg_end(skb, nlh);
2775
2776 if (args.iter.err && args.iter.err != -EMSGSIZE)
2777 return args.iter.err;
2778 if (args.iter.count == cb->args[0])
2779 return 0;
2780
2781 cb->args[0] = args.iter.count;
2782 return skb->len;
2783
2784nla_put_failure:
2785 return -ENOSPC;
2786}
2787
2788static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
2789 const struct nlmsghdr *nlh,
2790 const struct nlattr * const nla[])
2791{
2792 const struct nft_set *set;
2793 struct nft_ctx ctx;
2794 int err;
2795
2796 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla);
2797 if (err < 0)
2798 return err;
2799
2800 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2801 if (IS_ERR(set))
2802 return PTR_ERR(set);
958bee14
PNA		 2803 if (set->flags & NFT_SET_INACTIVE)
2804 return -ENOENT;
20a69341
PM		 2805
2806 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2807 struct netlink_dump_control c = {
2808 .dump = nf_tables_dump_set,
2809 };
2810 return netlink_dump_start(nlsk, skb, nlh, &c);
2811 }
2812 return -EOPNOTSUPP;
2813}
2814
d60ce62f
AB		 2815static int nf_tables_fill_setelem_info(struct sk_buff *skb,
2816 const struct nft_ctx *ctx, u32 seq,
2817 u32 portid, int event, u16 flags,
2818 const struct nft_set *set,
2819 const struct nft_set_elem *elem)
2820{
2821 struct nfgenmsg *nfmsg;
2822 struct nlmsghdr *nlh;
2823 struct nlattr *nest;
2824 int err;
2825
2826 event |= NFNL_SUBSYS_NFTABLES << 8;
2827 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2828 flags);
2829 if (nlh == NULL)
2830 goto nla_put_failure;
2831
2832 nfmsg = nlmsg_data(nlh);
2833 nfmsg->nfgen_family = ctx->afi->family;
2834 nfmsg->version = NFNETLINK_V0;
2835 nfmsg->res_id = 0;
2836
2837 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2838 goto nla_put_failure;
2839 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2840 goto nla_put_failure;
2841
2842 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
2843 if (nest == NULL)
2844 goto nla_put_failure;
2845
2846 err = nf_tables_fill_setelem(skb, set, elem);
2847 if (err < 0)
2848 goto nla_put_failure;
2849
2850 nla_nest_end(skb, nest);
2851
2852 return nlmsg_end(skb, nlh);
2853
2854nla_put_failure:
2855 nlmsg_trim(skb, nlh);
2856 return -1;
2857}
2858
2859static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
2860 const struct nft_set *set,
2861 const struct nft_set_elem *elem,
2862 int event, u16 flags)
2863{
2864 const struct sk_buff *oskb = ctx->skb;
2865 struct net *net = sock_net(oskb->sk);
2866 u32 portid = NETLINK_CB(oskb).portid;
2867 bool report = nlmsg_report(ctx->nlh);
2868 struct sk_buff *skb;
2869 int err;
2870
2871 if (!report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
2872 return 0;
2873
2874 err = -ENOBUFS;
2875 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2876 if (skb == NULL)
2877 goto err;
2878
2879 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
2880 set, elem);
2881 if (err < 0) {
2882 kfree_skb(skb);
2883 goto err;
2884 }
2885
2886 err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report,
2887 GFP_KERNEL);
2888err:
2889 if (err < 0)
2890 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
2891 return err;
2892}
2893
20a69341
PM		 2894static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
2895 const struct nlattr *attr)
2896{
2897 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
2898 struct nft_data_desc d1, d2;
2899 struct nft_set_elem elem;
2900 struct nft_set_binding *binding;
2901 enum nft_registers dreg;
2902 int err;
2903
c50b960c
PM		 2904 if (set->size && set->nelems == set->size)
2905 return -ENFILE;
2906
20a69341
PM		 2907 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
2908 nft_set_elem_policy);
2909 if (err < 0)
2910 return err;
2911
2912 if (nla[NFTA_SET_ELEM_KEY] == NULL)
2913 return -EINVAL;
2914
2915 elem.flags = 0;
2916 if (nla[NFTA_SET_ELEM_FLAGS] != NULL) {
2917 elem.flags = ntohl(nla_get_be32(nla[NFTA_SET_ELEM_FLAGS]));
2918 if (elem.flags & ~NFT_SET_ELEM_INTERVAL_END)
2919 return -EINVAL;
2920 }
2921
2922 if (set->flags & NFT_SET_MAP) {
2923 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
2924 !(elem.flags & NFT_SET_ELEM_INTERVAL_END))
2925 return -EINVAL;
bd7fc645
PNA		 2926 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
2927 elem.flags & NFT_SET_ELEM_INTERVAL_END)
2928 return -EINVAL;
20a69341
PM		 2929 } else {
2930 if (nla[NFTA_SET_ELEM_DATA] != NULL)
2931 return -EINVAL;
2932 }
2933
2934 err = nft_data_init(ctx, &elem.key, &d1, nla[NFTA_SET_ELEM_KEY]);
2935 if (err < 0)
2936 goto err1;
2937 err = -EINVAL;
2938 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
2939 goto err2;
2940
2941 err = -EEXIST;
2942 if (set->ops->get(set, &elem) == 0)
2943 goto err2;
2944
2945 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
2946 err = nft_data_init(ctx, &elem.data, &d2, nla[NFTA_SET_ELEM_DATA]);
2947 if (err < 0)
2948 goto err2;
2949
2950 err = -EINVAL;
2951 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
2952 goto err3;
2953
2954 dreg = nft_type_to_reg(set->dtype);
2955 list_for_each_entry(binding, &set->bindings, list) {
2956 struct nft_ctx bind_ctx = {
2957 .afi = ctx->afi,
2958 .table = ctx->table,
7c95f6d8 2959 .chain = (struct nft_chain *)binding->chain,
20a69341
PM		 2960 };
2961
2962 err = nft_validate_data_load(&bind_ctx, dreg,
2963 &elem.data, d2.type);
2964 if (err < 0)
2965 goto err3;
2966 }
2967 }
2968
2969 err = set->ops->insert(set, &elem);
2970 if (err < 0)
2971 goto err3;
c50b960c 2972 set->nelems++;
20a69341 2973
d60ce62f 2974 nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_NEWSETELEM, 0);
20a69341
PM		 2975 return 0;
2976
2977err3:
2978 if (nla[NFTA_SET_ELEM_DATA] != NULL)
2979 nft_data_uninit(&elem.data, d2.type);
2980err2:
2981 nft_data_uninit(&elem.key, d1.type);
2982err1:
2983 return err;
2984}
2985
2986static int nf_tables_newsetelem(struct sock *nlsk, struct sk_buff *skb,
2987 const struct nlmsghdr *nlh,
2988 const struct nlattr * const nla[])
2989{
958bee14 2990 struct net *net = sock_net(skb->sk);
20a69341
PM		 2991 const struct nlattr *attr;
2992 struct nft_set *set;
2993 struct nft_ctx ctx;
2994 int rem, err;
2995
2996 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla);
2997 if (err < 0)
2998 return err;
2999
3000 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
958bee14
PNA		 3001 if (IS_ERR(set)) {
3002 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
3003 set = nf_tables_set_lookup_byid(net,
3004 nla[NFTA_SET_ELEM_LIST_SET_ID]);
3005 }
3006 if (IS_ERR(set))
3007 return PTR_ERR(set);
3008 }
3009
20a69341
PM		 3010 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3011 return -EBUSY;
3012
3013 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3014 err = nft_add_set_elem(&ctx, set, attr);
3015 if (err < 0)
3016 return err;
3017 }
3018 return 0;
3019}
3020
3021static int nft_del_setelem(const struct nft_ctx *ctx, struct nft_set *set,
3022 const struct nlattr *attr)
3023{
3024 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3025 struct nft_data_desc desc;
3026 struct nft_set_elem elem;
3027 int err;
3028
3029 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3030 nft_set_elem_policy);
3031 if (err < 0)
3032 goto err1;
3033
3034 err = -EINVAL;
3035 if (nla[NFTA_SET_ELEM_KEY] == NULL)
3036 goto err1;
3037
3038 err = nft_data_init(ctx, &elem.key, &desc, nla[NFTA_SET_ELEM_KEY]);
3039 if (err < 0)
3040 goto err1;
3041
3042 err = -EINVAL;
3043 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3044 goto err2;
3045
3046 err = set->ops->get(set, &elem);
3047 if (err < 0)
3048 goto err2;
3049
3050 set->ops->remove(set, &elem);
c50b960c 3051 set->nelems--;
20a69341 3052
d60ce62f
AB		 3053 nf_tables_setelem_notify(ctx, set, &elem, NFT_MSG_DELSETELEM, 0);
3054
20a69341
PM		 3055 nft_data_uninit(&elem.key, NFT_DATA_VALUE);
3056 if (set->flags & NFT_SET_MAP)
3057 nft_data_uninit(&elem.data, set->dtype);
3058
3059err2:
3060 nft_data_uninit(&elem.key, desc.type);
3061err1:
3062 return err;
3063}
3064
3065static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb,
3066 const struct nlmsghdr *nlh,
3067 const struct nlattr * const nla[])
3068{
3069 const struct nlattr *attr;
3070 struct nft_set *set;
3071 struct nft_ctx ctx;
3072 int rem, err;
3073
3074 err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla);
3075 if (err < 0)
3076 return err;
3077
3078 set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
3079 if (IS_ERR(set))
3080 return PTR_ERR(set);
3081 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3082 return -EBUSY;
3083
3084 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3085 err = nft_del_setelem(&ctx, set, attr);
3086 if (err < 0)
3087 return err;
3088 }
3089 return 0;
3090}
3091
96518518
PM		 3092static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
3093 [NFT_MSG_NEWTABLE] = {
3094 .call = nf_tables_newtable,
3095 .attr_count = NFTA_TABLE_MAX,
3096 .policy = nft_table_policy,
3097 },
3098 [NFT_MSG_GETTABLE] = {
3099 .call = nf_tables_gettable,
3100 .attr_count = NFTA_TABLE_MAX,
3101 .policy = nft_table_policy,
3102 },
3103 [NFT_MSG_DELTABLE] = {
3104 .call = nf_tables_deltable,
3105 .attr_count = NFTA_TABLE_MAX,
3106 .policy = nft_table_policy,
3107 },
3108 [NFT_MSG_NEWCHAIN] = {
3109 .call = nf_tables_newchain,
3110 .attr_count = NFTA_CHAIN_MAX,
3111 .policy = nft_chain_policy,
3112 },
3113 [NFT_MSG_GETCHAIN] = {
3114 .call = nf_tables_getchain,
3115 .attr_count = NFTA_CHAIN_MAX,
3116 .policy = nft_chain_policy,
3117 },
3118 [NFT_MSG_DELCHAIN] = {
3119 .call = nf_tables_delchain,
3120 .attr_count = NFTA_CHAIN_MAX,
3121 .policy = nft_chain_policy,
3122 },
3123 [NFT_MSG_NEWRULE] = {
0628b123 3124 .call_batch = nf_tables_newrule,
96518518
PM		 3125 .attr_count = NFTA_RULE_MAX,
3126 .policy = nft_rule_policy,
3127 },
3128 [NFT_MSG_GETRULE] = {
3129 .call = nf_tables_getrule,
3130 .attr_count = NFTA_RULE_MAX,
3131 .policy = nft_rule_policy,
3132 },
3133 [NFT_MSG_DELRULE] = {
0628b123 3134 .call_batch = nf_tables_delrule,
96518518
PM		 3135 .attr_count = NFTA_RULE_MAX,
3136 .policy = nft_rule_policy,
3137 },
20a69341 3138 [NFT_MSG_NEWSET] = {
958bee14 3139 .call_batch = nf_tables_newset,
20a69341
PM		 3140 .attr_count = NFTA_SET_MAX,
3141 .policy = nft_set_policy,
3142 },
3143 [NFT_MSG_GETSET] = {
3144 .call = nf_tables_getset,
3145 .attr_count = NFTA_SET_MAX,
3146 .policy = nft_set_policy,
3147 },
3148 [NFT_MSG_DELSET] = {
958bee14 3149 .call_batch = nf_tables_delset,
20a69341
PM		 3150 .attr_count = NFTA_SET_MAX,
3151 .policy = nft_set_policy,
3152 },
3153 [NFT_MSG_NEWSETELEM] = {
958bee14 3154 .call_batch = nf_tables_newsetelem,
20a69341
PM		 3155 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3156 .policy = nft_set_elem_list_policy,
3157 },
3158 [NFT_MSG_GETSETELEM] = {
3159 .call = nf_tables_getsetelem,
3160 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3161 .policy = nft_set_elem_list_policy,
3162 },
3163 [NFT_MSG_DELSETELEM] = {
958bee14 3164 .call_batch = nf_tables_delsetelem,
20a69341
PM		 3165 .attr_count = NFTA_SET_ELEM_LIST_MAX,
3166 .policy = nft_set_elem_list_policy,
3167 },
96518518
PM		 3168};
3169
37082f93
PNA		 3170static int nf_tables_commit(struct sk_buff *skb)
3171{
3172 struct net *net = sock_net(skb->sk);
3173 struct nft_trans *trans, *next;
3174
3175 /* Bump generation counter, invalidate any dump in progress */
3176 net->nft.genctr++;
3177
3178 /* A new generation has just started */
3179 net->nft.gencursor = gencursor_next(net);
3180
3181 /* Make sure all packets have left the previous generation before
3182 * purging old rules.
3183 */
3184 synchronize_rcu();
3185
3186 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3187 switch (trans->msg_type) {
3188 case NFT_MSG_NEWRULE:
3189 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
3190 nf_tables_rule_notify(trans->ctx.skb, trans->ctx.nlh,
37082f93
PNA		 3191 trans->ctx.table,
3192 trans->ctx.chain,
3193 nft_trans_rule(trans),
3194 NFT_MSG_NEWRULE, 0,
3195 trans->ctx.afi->family);
3196 nft_trans_destroy(trans);
b380e5c7
PNA		 3197 break;
3198 case NFT_MSG_DELRULE:
3199 list_del_rcu(&nft_trans_rule(trans)->list);
3200 nf_tables_rule_notify(trans->ctx.skb, trans->ctx.nlh,
3201 trans->ctx.table,
3202 trans->ctx.chain,
3203 nft_trans_rule(trans), NFT_MSG_DELRULE, 0,
3204 trans->ctx.afi->family);
3205 break;
958bee14
PNA		 3206 case NFT_MSG_NEWSET:
3207 nft_trans_set(trans)->flags &= ~NFT_SET_INACTIVE;
3208 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
3209 NFT_MSG_NEWSET);
3210 nft_trans_destroy(trans);
3211 break;
3212 case NFT_MSG_DELSET:
3213 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
3214 NFT_MSG_DELSET);
3215 break;
37082f93 3216 }
37082f93
PNA		 3217 }
3218
3219 /* Make sure we don't see any packet traversing old rules */
3220 synchronize_rcu();
3221
3222 /* Now we can safely release unused old rules */
3223 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3224 switch (trans->msg_type) {
3225 case NFT_MSG_DELRULE:
3226 nf_tables_rule_destroy(&trans->ctx,
3227 nft_trans_rule(trans));
958bee14
PNA		 3228 break;
3229 case NFT_MSG_DELSET:
3230 nft_set_destroy(nft_trans_set(trans));
b380e5c7
PNA		 3231 break;
3232 }
958bee14 3233 nft_trans_destroy(trans);
37082f93
PNA		 3234 }
3235
3236 return 0;
3237}
3238
3239static int nf_tables_abort(struct sk_buff *skb)
3240{
3241 struct net *net = sock_net(skb->sk);
3242 struct nft_trans *trans, *next;
3243
3244 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3245 switch (trans->msg_type) {
3246 case NFT_MSG_NEWRULE:
3247 list_del_rcu(&nft_trans_rule(trans)->list);
3248 break;
3249 case NFT_MSG_DELRULE:
3250 nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
37082f93 3251 nft_trans_destroy(trans);
b380e5c7 3252 break;
958bee14
PNA		 3253 case NFT_MSG_NEWSET:
3254 list_del(&nft_trans_set(trans)->list);
3255 break;
3256 case NFT_MSG_DELSET:
3257 list_add_tail(&nft_trans_set(trans)->list,
3258 &trans->ctx.table->sets);
3259 nft_trans_destroy(trans);
3260 break;
37082f93 3261 }
37082f93
PNA		 3262 }
3263
3264 /* Make sure we don't see any packet accessing aborted rules */
3265 synchronize_rcu();
3266
3267 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
b380e5c7
PNA		 3268 switch (trans->msg_type) {
3269 case NFT_MSG_NEWRULE:
3270 nf_tables_rule_destroy(&trans->ctx,
3271 nft_trans_rule(trans));
958bee14
PNA		 3272 break;
3273 case NFT_MSG_NEWSET:
3274 nft_set_destroy(nft_trans_set(trans));
b380e5c7
PNA		 3275 break;
3276 }
958bee14 3277 nft_trans_destroy(trans);
37082f93
PNA		 3278 }
3279
3280 return 0;
3281}
3282
96518518
PM		 3283static const struct nfnetlink_subsystem nf_tables_subsys = {
3284 .name = "nf_tables",
3285 .subsys_id = NFNL_SUBSYS_NFTABLES,
3286 .cb_count = NFT_MSG_MAX,
3287 .cb = nf_tables_cb,
0628b123
PNA		 3288 .commit = nf_tables_commit,
3289 .abort = nf_tables_abort,
96518518
PM		 3290};
3291
20a69341
PM		 3292/*
3293 * Loop detection - walk through the ruleset beginning at the destination chain
3294 * of a new jump until either the source chain is reached (loop) or all
3295 * reachable chains have been traversed.
3296 *
3297 * The loop check is performed whenever a new jump verdict is added to an
3298 * expression or verdict map or a verdict map is bound to a new chain.
3299 */
3300
3301static int nf_tables_check_loops(const struct nft_ctx *ctx,
3302 const struct nft_chain *chain);
3303
3304static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
3305 const struct nft_set *set,
3306 const struct nft_set_iter *iter,
3307 const struct nft_set_elem *elem)
3308{
62f9c8b4
PNA		 3309 if (elem->flags & NFT_SET_ELEM_INTERVAL_END)
3310 return 0;
3311
20a69341
PM		 3312 switch (elem->data.verdict) {
3313 case NFT_JUMP:
3314 case NFT_GOTO:
3315 return nf_tables_check_loops(ctx, elem->data.chain);
3316 default:
3317 return 0;
3318 }
3319}
3320
3321static int nf_tables_check_loops(const struct nft_ctx *ctx,
3322 const struct nft_chain *chain)
3323{
3324 const struct nft_rule *rule;
3325 const struct nft_expr *expr, *last;
20a69341
PM		 3326 const struct nft_set *set;
3327 struct nft_set_binding *binding;
3328 struct nft_set_iter iter;
20a69341
PM		 3329
3330 if (ctx->chain == chain)
3331 return -ELOOP;
3332
3333 list_for_each_entry(rule, &chain->rules, list) {
3334 nft_rule_for_each_expr(expr, last, rule) {
0ca743a5
PNA		 3335 const struct nft_data *data = NULL;
3336 int err;
3337
3338 if (!expr->ops->validate)
20a69341
PM		 3339 continue;
3340
0ca743a5
PNA		 3341 err = expr->ops->validate(ctx, expr, &data);
3342 if (err < 0)
3343 return err;
3344
20a69341 3345 if (data == NULL)
0ca743a5 3346 continue;
20a69341
PM		 3347
3348 switch (data->verdict) {
3349 case NFT_JUMP:
3350 case NFT_GOTO:
3351 err = nf_tables_check_loops(ctx, data->chain);
3352 if (err < 0)
3353 return err;
3354 default:
3355 break;
3356 }
3357 }
3358 }
3359
3360 list_for_each_entry(set, &ctx->table->sets, list) {
3361 if (!(set->flags & NFT_SET_MAP) ||
3362 set->dtype != NFT_DATA_VERDICT)
3363 continue;
3364
3365 list_for_each_entry(binding, &set->bindings, list) {
3366 if (binding->chain != chain)
3367 continue;
3368
3369 iter.skip = 0;
3370 iter.count = 0;
3371 iter.err = 0;
3372 iter.fn = nf_tables_loop_check_setelem;
3373
3374 set->ops->walk(ctx, set, &iter);
3375 if (iter.err < 0)
3376 return iter.err;
3377 }
3378 }
3379
3380 return 0;
3381}
3382
96518518
PM		 3383/**
3384 * nft_validate_input_register - validate an expressions' input register
3385 *
3386 * @reg: the register number
3387 *
3388 * Validate that the input register is one of the general purpose
3389 * registers.
3390 */
3391int nft_validate_input_register(enum nft_registers reg)
3392{
3393 if (reg <= NFT_REG_VERDICT)
3394 return -EINVAL;
3395 if (reg > NFT_REG_MAX)
3396 return -ERANGE;
3397 return 0;
3398}
3399EXPORT_SYMBOL_GPL(nft_validate_input_register);
3400
3401/**
3402 * nft_validate_output_register - validate an expressions' output register
3403 *
3404 * @reg: the register number
3405 *
3406 * Validate that the output register is one of the general purpose
3407 * registers or the verdict register.
3408 */
3409int nft_validate_output_register(enum nft_registers reg)
3410{
3411 if (reg < NFT_REG_VERDICT)
3412 return -EINVAL;
3413 if (reg > NFT_REG_MAX)
3414 return -ERANGE;
3415 return 0;
3416}
3417EXPORT_SYMBOL_GPL(nft_validate_output_register);
3418
3419/**
3420 * nft_validate_data_load - validate an expressions' data load
3421 *
3422 * @ctx: context of the expression performing the load
3423 * @reg: the destination register number
3424 * @data: the data to load
3425 * @type: the data type
3426 *
3427 * Validate that a data load uses the appropriate data type for
3428 * the destination register. A value of NULL for the data means
3429 * that its runtime gathered data, which is always of type
3430 * NFT_DATA_VALUE.
3431 */
3432int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
3433 const struct nft_data *data,
3434 enum nft_data_types type)
3435{
20a69341
PM		 3436 int err;
3437
96518518
PM		 3438 switch (reg) {
3439 case NFT_REG_VERDICT:
3440 if (data == NULL || type != NFT_DATA_VERDICT)
3441 return -EINVAL;
20a69341
PM		 3442
3443 if (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP) {
3444 err = nf_tables_check_loops(ctx, data->chain);
3445 if (err < 0)
3446 return err;
3447
3448 if (ctx->chain->level + 1 > data->chain->level) {
3449 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
3450 return -EMLINK;
3451 data->chain->level = ctx->chain->level + 1;
3452 }
3453 }
3454
96518518
PM		 3455 return 0;
3456 default:
3457 if (data != NULL && type != NFT_DATA_VALUE)
3458 return -EINVAL;
3459 return 0;
3460 }
3461}
3462EXPORT_SYMBOL_GPL(nft_validate_data_load);
3463
3464static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
3465 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
3466 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
3467 .len = NFT_CHAIN_MAXNAMELEN - 1 },
3468};
3469
3470static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
3471 struct nft_data_desc *desc, const struct nlattr *nla)
3472{
3473 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
3474 struct nft_chain *chain;
3475 int err;
3476
3477 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy);
3478 if (err < 0)
3479 return err;
3480
3481 if (!tb[NFTA_VERDICT_CODE])
3482 return -EINVAL;
3483 data->verdict = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
3484
3485 switch (data->verdict) {
e0abdadc
PM		 3486 default:
3487 switch (data->verdict & NF_VERDICT_MASK) {
3488 case NF_ACCEPT:
3489 case NF_DROP:
3490 case NF_QUEUE:
3491 break;
3492 default:
3493 return -EINVAL;
3494 }
3495 /* fall through */
96518518
PM		 3496 case NFT_CONTINUE:
3497 case NFT_BREAK:
3498 case NFT_RETURN:
3499 desc->len = sizeof(data->verdict);
3500 break;
3501 case NFT_JUMP:
3502 case NFT_GOTO:
3503 if (!tb[NFTA_VERDICT_CHAIN])
3504 return -EINVAL;
3505 chain = nf_tables_chain_lookup(ctx->table,
3506 tb[NFTA_VERDICT_CHAIN]);
3507 if (IS_ERR(chain))
3508 return PTR_ERR(chain);
3509 if (chain->flags & NFT_BASE_CHAIN)
3510 return -EOPNOTSUPP;
3511
96518518
PM		 3512 chain->use++;
3513 data->chain = chain;
3514 desc->len = sizeof(data);
3515 break;
96518518
PM		 3516 }
3517
3518 desc->type = NFT_DATA_VERDICT;
3519 return 0;
3520}
3521
3522static void nft_verdict_uninit(const struct nft_data *data)
3523{
3524 switch (data->verdict) {
3525 case NFT_JUMP:
3526 case NFT_GOTO:
3527 data->chain->use--;
3528 break;
3529 }
3530}
3531
3532static int nft_verdict_dump(struct sk_buff *skb, const struct nft_data *data)
3533{
3534 struct nlattr *nest;
3535
3536 nest = nla_nest_start(skb, NFTA_DATA_VERDICT);
3537 if (!nest)
3538 goto nla_put_failure;
3539
3540 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict)))
3541 goto nla_put_failure;
3542
3543 switch (data->verdict) {
3544 case NFT_JUMP:
3545 case NFT_GOTO:
3546 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, data->chain->name))
3547 goto nla_put_failure;
3548 }
3549 nla_nest_end(skb, nest);
3550 return 0;
3551
3552nla_put_failure:
3553 return -1;
3554}
3555
3556static int nft_value_init(const struct nft_ctx *ctx, struct nft_data *data,
3557 struct nft_data_desc *desc, const struct nlattr *nla)
3558{
3559 unsigned int len;
3560
3561 len = nla_len(nla);
3562 if (len == 0)
3563 return -EINVAL;
3564 if (len > sizeof(data->data))
3565 return -EOVERFLOW;
3566
3567 nla_memcpy(data->data, nla, sizeof(data->data));
3568 desc->type = NFT_DATA_VALUE;
3569 desc->len = len;
3570 return 0;
3571}
3572
3573static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
3574 unsigned int len)
3575{
3576 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
3577}
3578
3579static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
3580 [NFTA_DATA_VALUE] = { .type = NLA_BINARY,
3581 .len = FIELD_SIZEOF(struct nft_data, data) },
3582 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
3583};
3584
3585/**
3586 * nft_data_init - parse nf_tables data netlink attributes
3587 *
3588 * @ctx: context of the expression using the data
3589 * @data: destination struct nft_data
3590 * @desc: data description
3591 * @nla: netlink attribute containing data
3592 *
3593 * Parse the netlink data attributes and initialize a struct nft_data.
3594 * The type and length of data are returned in the data description.
3595 *
3596 * The caller can indicate that it only wants to accept data of type
3597 * NFT_DATA_VALUE by passing NULL for the ctx argument.
3598 */
3599int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
3600 struct nft_data_desc *desc, const struct nlattr *nla)
3601{
3602 struct nlattr *tb[NFTA_DATA_MAX + 1];
3603 int err;
3604
3605 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy);
3606 if (err < 0)
3607 return err;
3608
3609 if (tb[NFTA_DATA_VALUE])
3610 return nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]);
3611 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
3612 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
3613 return -EINVAL;
3614}
3615EXPORT_SYMBOL_GPL(nft_data_init);
3616
3617/**
3618 * nft_data_uninit - release a nft_data item
3619 *
3620 * @data: struct nft_data to release
3621 * @type: type of data
3622 *
3623 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
3624 * all others need to be released by calling this function.
3625 */
3626void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
3627{
3628 switch (type) {
3629 case NFT_DATA_VALUE:
3630 return;
3631 case NFT_DATA_VERDICT:
3632 return nft_verdict_uninit(data);
3633 default:
3634 WARN_ON(1);
3635 }
3636}
3637EXPORT_SYMBOL_GPL(nft_data_uninit);
3638
3639int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
3640 enum nft_data_types type, unsigned int len)
3641{
3642 struct nlattr *nest;
3643 int err;
3644
3645 nest = nla_nest_start(skb, attr);
3646 if (nest == NULL)
3647 return -1;
3648
3649 switch (type) {
3650 case NFT_DATA_VALUE:
3651 err = nft_value_dump(skb, data, len);
3652 break;
3653 case NFT_DATA_VERDICT:
3654 err = nft_verdict_dump(skb, data);
3655 break;
3656 default:
3657 err = -EINVAL;
3658 WARN_ON(1);
3659 }
3660
3661 nla_nest_end(skb, nest);
3662 return err;
3663}
3664EXPORT_SYMBOL_GPL(nft_data_dump);
3665
99633ab2
PNA		 3666static int nf_tables_init_net(struct net *net)
3667{
3668 INIT_LIST_HEAD(&net->nft.af_info);
0628b123 3669 INIT_LIST_HEAD(&net->nft.commit_list);
99633ab2
PNA		 3670 return 0;
3671}
3672
3673static struct pernet_operations nf_tables_net_ops = {
3674 .init = nf_tables_init_net,
3675};
3676
96518518
PM		 3677static int __init nf_tables_module_init(void)
3678{
3679 int err;
3680
3681 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
3682 GFP_KERNEL);
3683 if (info == NULL) {
3684 err = -ENOMEM;
3685 goto err1;
3686 }
3687
3688 err = nf_tables_core_module_init();
3689 if (err < 0)
3690 goto err2;
3691
3692 err = nfnetlink_subsys_register(&nf_tables_subsys);
3693 if (err < 0)
3694 goto err3;
3695
3696 pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
99633ab2 3697 return register_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 3698err3:
3699 nf_tables_core_module_exit();
3700err2:
3701 kfree(info);
3702err1:
3703 return err;
3704}
3705
3706static void __exit nf_tables_module_exit(void)
3707{
99633ab2 3708 unregister_pernet_subsys(&nf_tables_net_ops);
96518518
PM		 3709 nfnetlink_subsys_unregister(&nf_tables_subsys);
3710 nf_tables_core_module_exit();
3711 kfree(info);
3712}
3713
3714module_init(nf_tables_module_init);
3715module_exit(nf_tables_module_exit);
3716
3717MODULE_LICENSE("GPL");
3718MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
3719MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
Linux kernel - Deliverables
This page took 0.277381 seconds and 5 git commands to generate.