1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/module.h> 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/skbuff.h> 12 #include <linux/netlink.h> 13 #include <linux/vmalloc.h> 14 #include <linux/rhashtable.h> 15 #include <linux/audit.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nfnetlink.h> 18 #include <linux/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_flow_table.h> 20 #include <net/netfilter/nf_tables_core.h> 21 #include <net/netfilter/nf_tables.h> 22 #include <net/netfilter/nf_tables_offload.h> 23 #include <net/net_namespace.h> 24 #include <net/sock.h> 25 26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) 27 28 unsigned int nf_tables_net_id __read_mostly; 29 30 static LIST_HEAD(nf_tables_expressions); 31 static LIST_HEAD(nf_tables_objects); 32 static LIST_HEAD(nf_tables_flowtables); 33 static LIST_HEAD(nf_tables_destroy_list); 34 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock); 35 36 enum { 37 NFT_VALIDATE_SKIP = 0, 38 NFT_VALIDATE_NEED, 39 NFT_VALIDATE_DO, 40 }; 41 42 static struct rhltable nft_objname_ht; 43 44 static u32 nft_chain_hash(const void *data, u32 len, u32 seed); 45 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed); 46 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *); 47 48 static u32 nft_objname_hash(const void *data, u32 len, u32 seed); 49 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed); 50 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *); 51 52 static const struct rhashtable_params nft_chain_ht_params = { 53 .head_offset = offsetof(struct nft_chain, rhlhead), 54 .key_offset = offsetof(struct nft_chain, name), 55 .hashfn = nft_chain_hash, 56 .obj_hashfn = nft_chain_hash_obj, 57 .obj_cmpfn = nft_chain_hash_cmp, 58 .automatic_shrinking = true, 59 }; 60 61 static const struct rhashtable_params nft_objname_ht_params = { 62 .head_offset = offsetof(struct nft_object, rhlhead), 63 .key_offset = offsetof(struct nft_object, key), 64 .hashfn = nft_objname_hash, 65 .obj_hashfn = nft_objname_hash_obj, 66 .obj_cmpfn = nft_objname_hash_cmp, 67 .automatic_shrinking = true, 68 }; 69 70 struct nft_audit_data { 71 struct nft_table *table; 72 int entries; 73 int op; 74 struct list_head list; 75 }; 76 77 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types 78 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, 79 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, 80 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, 81 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, 82 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, 83 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, 84 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, 85 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, 86 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, 87 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, 88 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, 89 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, 90 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, 91 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, 92 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, 93 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, 94 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, 95 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, 96 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, 97 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, 98 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, 99 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, 100 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, 101 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, 102 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 103 }; 104 105 static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state) 106 { 107 switch (table->validate_state) { 108 case NFT_VALIDATE_SKIP: 109 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); 110 break; 111 case NFT_VALIDATE_NEED: 112 break; 113 case NFT_VALIDATE_DO: 114 if (new_validate_state == NFT_VALIDATE_NEED) 115 return; 116 } 117 118 table->validate_state = new_validate_state; 119 } 120 static void nf_tables_trans_destroy_work(struct work_struct *w); 121 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work); 122 123 static void nft_ctx_init(struct nft_ctx *ctx, 124 struct net *net, 125 const struct sk_buff *skb, 126 const struct nlmsghdr *nlh, 127 u8 family, 128 struct nft_table *table, 129 struct nft_chain *chain, 130 const struct nlattr * const *nla) 131 { 132 ctx->net = net; 133 ctx->family = family; 134 ctx->level = 0; 135 ctx->table = table; 136 ctx->chain = chain; 137 ctx->nla = nla; 138 ctx->portid = NETLINK_CB(skb).portid; 139 ctx->report = nlmsg_report(nlh); 140 ctx->flags = nlh->nlmsg_flags; 141 ctx->seq = nlh->nlmsg_seq; 142 } 143 144 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, 145 int msg_type, u32 size, gfp_t gfp) 146 { 147 struct nft_trans *trans; 148 149 trans = kzalloc(sizeof(struct nft_trans) + size, gfp); 150 if (trans == NULL) 151 return NULL; 152 153 INIT_LIST_HEAD(&trans->list); 154 trans->msg_type = msg_type; 155 trans->ctx = *ctx; 156 157 return trans; 158 } 159 160 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, 161 int msg_type, u32 size) 162 { 163 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL); 164 } 165 166 static void nft_trans_destroy(struct nft_trans *trans) 167 { 168 list_del(&trans->list); 169 kfree(trans); 170 } 171 172 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) 173 { 174 struct nftables_pernet *nft_net; 175 struct net *net = ctx->net; 176 struct nft_trans *trans; 177 178 if (!nft_set_is_anonymous(set)) 179 return; 180 181 nft_net = nft_pernet(net); 182 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 183 switch (trans->msg_type) { 184 case NFT_MSG_NEWSET: 185 if (nft_trans_set(trans) == set) 186 nft_trans_set_bound(trans) = true; 187 break; 188 case NFT_MSG_NEWSETELEM: 189 if (nft_trans_elem_set(trans) == set) 190 nft_trans_elem_set_bound(trans) = true; 191 break; 192 } 193 } 194 } 195 196 static int nft_netdev_register_hooks(struct net *net, 197 struct list_head *hook_list) 198 { 199 struct nft_hook *hook; 200 int err, j; 201 202 j = 0; 203 list_for_each_entry(hook, hook_list, list) { 204 err = nf_register_net_hook(net, &hook->ops); 205 if (err < 0) 206 goto err_register; 207 208 j++; 209 } 210 return 0; 211 212 err_register: 213 list_for_each_entry(hook, hook_list, list) { 214 if (j-- <= 0) 215 break; 216 217 nf_unregister_net_hook(net, &hook->ops); 218 } 219 return err; 220 } 221 222 static void nft_netdev_unregister_hooks(struct net *net, 223 struct list_head *hook_list, 224 bool release_netdev) 225 { 226 struct nft_hook *hook, *next; 227 228 list_for_each_entry_safe(hook, next, hook_list, list) { 229 nf_unregister_net_hook(net, &hook->ops); 230 if (release_netdev) { 231 list_del(&hook->list); 232 kfree_rcu(hook, rcu); 233 } 234 } 235 } 236 237 static int nf_tables_register_hook(struct net *net, 238 const struct nft_table *table, 239 struct nft_chain *chain) 240 { 241 struct nft_base_chain *basechain; 242 const struct nf_hook_ops *ops; 243 244 if (table->flags & NFT_TABLE_F_DORMANT || 245 !nft_is_base_chain(chain)) 246 return 0; 247 248 basechain = nft_base_chain(chain); 249 ops = &basechain->ops; 250 251 if (basechain->type->ops_register) 252 return basechain->type->ops_register(net, ops); 253 254 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 255 return nft_netdev_register_hooks(net, &basechain->hook_list); 256 257 return nf_register_net_hook(net, &basechain->ops); 258 } 259 260 static void __nf_tables_unregister_hook(struct net *net, 261 const struct nft_table *table, 262 struct nft_chain *chain, 263 bool release_netdev) 264 { 265 struct nft_base_chain *basechain; 266 const struct nf_hook_ops *ops; 267 268 if (table->flags & NFT_TABLE_F_DORMANT || 269 !nft_is_base_chain(chain)) 270 return; 271 basechain = nft_base_chain(chain); 272 ops = &basechain->ops; 273 274 if (basechain->type->ops_unregister) 275 return basechain->type->ops_unregister(net, ops); 276 277 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 278 nft_netdev_unregister_hooks(net, &basechain->hook_list, 279 release_netdev); 280 else 281 nf_unregister_net_hook(net, &basechain->ops); 282 } 283 284 static void nf_tables_unregister_hook(struct net *net, 285 const struct nft_table *table, 286 struct nft_chain *chain) 287 { 288 return __nf_tables_unregister_hook(net, table, chain, false); 289 } 290 291 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans) 292 { 293 struct nftables_pernet *nft_net = nft_pernet(net); 294 295 list_add_tail(&trans->list, &nft_net->commit_list); 296 } 297 298 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 299 { 300 struct nft_trans *trans; 301 302 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 303 if (trans == NULL) 304 return -ENOMEM; 305 306 if (msg_type == NFT_MSG_NEWTABLE) 307 nft_activate_next(ctx->net, ctx->table); 308 309 nft_trans_commit_list_add_tail(ctx->net, trans); 310 return 0; 311 } 312 313 static int nft_deltable(struct nft_ctx *ctx) 314 { 315 int err; 316 317 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 318 if (err < 0) 319 return err; 320 321 nft_deactivate_next(ctx->net, ctx->table); 322 return err; 323 } 324 325 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 326 { 327 struct nft_trans *trans; 328 329 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 330 if (trans == NULL) 331 return ERR_PTR(-ENOMEM); 332 333 if (msg_type == NFT_MSG_NEWCHAIN) { 334 nft_activate_next(ctx->net, ctx->chain); 335 336 if (ctx->nla[NFTA_CHAIN_ID]) { 337 nft_trans_chain_id(trans) = 338 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID])); 339 } 340 } 341 342 nft_trans_commit_list_add_tail(ctx->net, trans); 343 return trans; 344 } 345 346 static int nft_delchain(struct nft_ctx *ctx) 347 { 348 struct nft_trans *trans; 349 350 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 351 if (IS_ERR(trans)) 352 return PTR_ERR(trans); 353 354 ctx->table->use--; 355 nft_deactivate_next(ctx->net, ctx->chain); 356 357 return 0; 358 } 359 360 static void nft_rule_expr_activate(const struct nft_ctx *ctx, 361 struct nft_rule *rule) 362 { 363 struct nft_expr *expr; 364 365 expr = nft_expr_first(rule); 366 while (nft_expr_more(rule, expr)) { 367 if (expr->ops->activate) 368 expr->ops->activate(ctx, expr); 369 370 expr = nft_expr_next(expr); 371 } 372 } 373 374 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx, 375 struct nft_rule *rule, 376 enum nft_trans_phase phase) 377 { 378 struct nft_expr *expr; 379 380 expr = nft_expr_first(rule); 381 while (nft_expr_more(rule, expr)) { 382 if (expr->ops->deactivate) 383 expr->ops->deactivate(ctx, expr, phase); 384 385 expr = nft_expr_next(expr); 386 } 387 } 388 389 static int 390 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 391 { 392 /* You cannot delete the same rule twice */ 393 if (nft_is_active_next(ctx->net, rule)) { 394 nft_deactivate_next(ctx->net, rule); 395 ctx->chain->use--; 396 return 0; 397 } 398 return -ENOENT; 399 } 400 401 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 402 struct nft_rule *rule) 403 { 404 struct nft_trans *trans; 405 406 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 407 if (trans == NULL) 408 return NULL; 409 410 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) { 411 nft_trans_rule_id(trans) = 412 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); 413 } 414 nft_trans_rule(trans) = rule; 415 nft_trans_commit_list_add_tail(ctx->net, trans); 416 417 return trans; 418 } 419 420 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 421 { 422 struct nft_flow_rule *flow; 423 struct nft_trans *trans; 424 int err; 425 426 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 427 if (trans == NULL) 428 return -ENOMEM; 429 430 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) { 431 flow = nft_flow_rule_create(ctx->net, rule); 432 if (IS_ERR(flow)) { 433 nft_trans_destroy(trans); 434 return PTR_ERR(flow); 435 } 436 437 nft_trans_flow_rule(trans) = flow; 438 } 439 440 err = nf_tables_delrule_deactivate(ctx, rule); 441 if (err < 0) { 442 nft_trans_destroy(trans); 443 return err; 444 } 445 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE); 446 447 return 0; 448 } 449 450 static int nft_delrule_by_chain(struct nft_ctx *ctx) 451 { 452 struct nft_rule *rule; 453 int err; 454 455 list_for_each_entry(rule, &ctx->chain->rules, list) { 456 if (!nft_is_active_next(ctx->net, rule)) 457 continue; 458 459 err = nft_delrule(ctx, rule); 460 if (err < 0) 461 return err; 462 } 463 return 0; 464 } 465 466 static int __nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 467 struct nft_set *set, 468 const struct nft_set_desc *desc) 469 { 470 struct nft_trans *trans; 471 472 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 473 if (trans == NULL) 474 return -ENOMEM; 475 476 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] && !desc) { 477 nft_trans_set_id(trans) = 478 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 479 nft_activate_next(ctx->net, set); 480 } 481 nft_trans_set(trans) = set; 482 if (desc) { 483 nft_trans_set_update(trans) = true; 484 nft_trans_set_gc_int(trans) = desc->gc_int; 485 nft_trans_set_timeout(trans) = desc->timeout; 486 } 487 nft_trans_commit_list_add_tail(ctx->net, trans); 488 489 return 0; 490 } 491 492 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 493 struct nft_set *set) 494 { 495 return __nft_trans_set_add(ctx, msg_type, set, NULL); 496 } 497 498 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set) 499 { 500 int err; 501 502 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 503 if (err < 0) 504 return err; 505 506 nft_deactivate_next(ctx->net, set); 507 ctx->table->use--; 508 509 return err; 510 } 511 512 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, 513 struct nft_object *obj) 514 { 515 struct nft_trans *trans; 516 517 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj)); 518 if (trans == NULL) 519 return -ENOMEM; 520 521 if (msg_type == NFT_MSG_NEWOBJ) 522 nft_activate_next(ctx->net, obj); 523 524 nft_trans_obj(trans) = obj; 525 nft_trans_commit_list_add_tail(ctx->net, trans); 526 527 return 0; 528 } 529 530 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj) 531 { 532 int err; 533 534 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj); 535 if (err < 0) 536 return err; 537 538 nft_deactivate_next(ctx->net, obj); 539 ctx->table->use--; 540 541 return err; 542 } 543 544 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, 545 struct nft_flowtable *flowtable) 546 { 547 struct nft_trans *trans; 548 549 trans = nft_trans_alloc(ctx, msg_type, 550 sizeof(struct nft_trans_flowtable)); 551 if (trans == NULL) 552 return -ENOMEM; 553 554 if (msg_type == NFT_MSG_NEWFLOWTABLE) 555 nft_activate_next(ctx->net, flowtable); 556 557 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 558 nft_trans_flowtable(trans) = flowtable; 559 nft_trans_commit_list_add_tail(ctx->net, trans); 560 561 return 0; 562 } 563 564 static int nft_delflowtable(struct nft_ctx *ctx, 565 struct nft_flowtable *flowtable) 566 { 567 int err; 568 569 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); 570 if (err < 0) 571 return err; 572 573 nft_deactivate_next(ctx->net, flowtable); 574 ctx->table->use--; 575 576 return err; 577 } 578 579 static void __nft_reg_track_clobber(struct nft_regs_track *track, u8 dreg) 580 { 581 int i; 582 583 for (i = track->regs[dreg].num_reg; i > 0; i--) 584 __nft_reg_track_cancel(track, dreg - i); 585 } 586 587 static void __nft_reg_track_update(struct nft_regs_track *track, 588 const struct nft_expr *expr, 589 u8 dreg, u8 num_reg) 590 { 591 track->regs[dreg].selector = expr; 592 track->regs[dreg].bitwise = NULL; 593 track->regs[dreg].num_reg = num_reg; 594 } 595 596 void nft_reg_track_update(struct nft_regs_track *track, 597 const struct nft_expr *expr, u8 dreg, u8 len) 598 { 599 unsigned int regcount; 600 int i; 601 602 __nft_reg_track_clobber(track, dreg); 603 604 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 605 for (i = 0; i < regcount; i++, dreg++) 606 __nft_reg_track_update(track, expr, dreg, i); 607 } 608 EXPORT_SYMBOL_GPL(nft_reg_track_update); 609 610 void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len) 611 { 612 unsigned int regcount; 613 int i; 614 615 __nft_reg_track_clobber(track, dreg); 616 617 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 618 for (i = 0; i < regcount; i++, dreg++) 619 __nft_reg_track_cancel(track, dreg); 620 } 621 EXPORT_SYMBOL_GPL(nft_reg_track_cancel); 622 623 void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg) 624 { 625 track->regs[dreg].selector = NULL; 626 track->regs[dreg].bitwise = NULL; 627 track->regs[dreg].num_reg = 0; 628 } 629 EXPORT_SYMBOL_GPL(__nft_reg_track_cancel); 630 631 /* 632 * Tables 633 */ 634 635 static struct nft_table *nft_table_lookup(const struct net *net, 636 const struct nlattr *nla, 637 u8 family, u8 genmask, u32 nlpid) 638 { 639 struct nftables_pernet *nft_net; 640 struct nft_table *table; 641 642 if (nla == NULL) 643 return ERR_PTR(-EINVAL); 644 645 nft_net = nft_pernet(net); 646 list_for_each_entry_rcu(table, &nft_net->tables, list, 647 lockdep_is_held(&nft_net->commit_mutex)) { 648 if (!nla_strcmp(nla, table->name) && 649 table->family == family && 650 nft_active_genmask(table, genmask)) { 651 if (nft_table_has_owner(table) && 652 nlpid && table->nlpid != nlpid) 653 return ERR_PTR(-EPERM); 654 655 return table; 656 } 657 } 658 659 return ERR_PTR(-ENOENT); 660 } 661 662 static struct nft_table *nft_table_lookup_byhandle(const struct net *net, 663 const struct nlattr *nla, 664 u8 genmask, u32 nlpid) 665 { 666 struct nftables_pernet *nft_net; 667 struct nft_table *table; 668 669 nft_net = nft_pernet(net); 670 list_for_each_entry(table, &nft_net->tables, list) { 671 if (be64_to_cpu(nla_get_be64(nla)) == table->handle && 672 nft_active_genmask(table, genmask)) { 673 if (nft_table_has_owner(table) && 674 nlpid && table->nlpid != nlpid) 675 return ERR_PTR(-EPERM); 676 677 return table; 678 } 679 } 680 681 return ERR_PTR(-ENOENT); 682 } 683 684 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 685 { 686 return ++table->hgenerator; 687 } 688 689 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; 690 691 static const struct nft_chain_type * 692 __nft_chain_type_get(u8 family, enum nft_chain_types type) 693 { 694 if (family >= NFPROTO_NUMPROTO || 695 type >= NFT_CHAIN_T_MAX) 696 return NULL; 697 698 return chain_type[family][type]; 699 } 700 701 static const struct nft_chain_type * 702 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) 703 { 704 const struct nft_chain_type *type; 705 int i; 706 707 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 708 type = __nft_chain_type_get(family, i); 709 if (!type) 710 continue; 711 if (!nla_strcmp(nla, type->name)) 712 return type; 713 } 714 return NULL; 715 } 716 717 struct nft_module_request { 718 struct list_head list; 719 char module[MODULE_NAME_LEN]; 720 bool done; 721 }; 722 723 #ifdef CONFIG_MODULES 724 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, 725 ...) 726 { 727 char module_name[MODULE_NAME_LEN]; 728 struct nftables_pernet *nft_net; 729 struct nft_module_request *req; 730 va_list args; 731 int ret; 732 733 va_start(args, fmt); 734 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); 735 va_end(args); 736 if (ret >= MODULE_NAME_LEN) 737 return 0; 738 739 nft_net = nft_pernet(net); 740 list_for_each_entry(req, &nft_net->module_list, list) { 741 if (!strcmp(req->module, module_name)) { 742 if (req->done) 743 return 0; 744 745 /* A request to load this module already exists. */ 746 return -EAGAIN; 747 } 748 } 749 750 req = kmalloc(sizeof(*req), GFP_KERNEL); 751 if (!req) 752 return -ENOMEM; 753 754 req->done = false; 755 strscpy(req->module, module_name, MODULE_NAME_LEN); 756 list_add_tail(&req->list, &nft_net->module_list); 757 758 return -EAGAIN; 759 } 760 EXPORT_SYMBOL_GPL(nft_request_module); 761 #endif 762 763 static void lockdep_nfnl_nft_mutex_not_held(void) 764 { 765 #ifdef CONFIG_PROVE_LOCKING 766 if (debug_locks) 767 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES)); 768 #endif 769 } 770 771 static const struct nft_chain_type * 772 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, 773 u8 family, bool autoload) 774 { 775 const struct nft_chain_type *type; 776 777 type = __nf_tables_chain_type_lookup(nla, family); 778 if (type != NULL) 779 return type; 780 781 lockdep_nfnl_nft_mutex_not_held(); 782 #ifdef CONFIG_MODULES 783 if (autoload) { 784 if (nft_request_module(net, "nft-chain-%u-%.*s", family, 785 nla_len(nla), 786 (const char *)nla_data(nla)) == -EAGAIN) 787 return ERR_PTR(-EAGAIN); 788 } 789 #endif 790 return ERR_PTR(-ENOENT); 791 } 792 793 static __be16 nft_base_seq(const struct net *net) 794 { 795 struct nftables_pernet *nft_net = nft_pernet(net); 796 797 return htons(nft_net->base_seq & 0xffff); 798 } 799 800 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 801 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 802 .len = NFT_TABLE_MAXNAMELEN - 1 }, 803 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 804 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, 805 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY, 806 .len = NFT_USERDATA_MAXLEN } 807 }; 808 809 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 810 u32 portid, u32 seq, int event, u32 flags, 811 int family, const struct nft_table *table) 812 { 813 struct nlmsghdr *nlh; 814 815 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 816 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 817 NFNETLINK_V0, nft_base_seq(net)); 818 if (!nlh) 819 goto nla_put_failure; 820 821 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 822 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || 823 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), 824 NFTA_TABLE_PAD)) 825 goto nla_put_failure; 826 827 if (event == NFT_MSG_DELTABLE) { 828 nlmsg_end(skb, nlh); 829 return 0; 830 } 831 832 if (nla_put_be32(skb, NFTA_TABLE_FLAGS, 833 htonl(table->flags & NFT_TABLE_F_MASK))) 834 goto nla_put_failure; 835 836 if (nft_table_has_owner(table) && 837 nla_put_be32(skb, NFTA_TABLE_OWNER, htonl(table->nlpid))) 838 goto nla_put_failure; 839 840 if (table->udata) { 841 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata)) 842 goto nla_put_failure; 843 } 844 845 nlmsg_end(skb, nlh); 846 return 0; 847 848 nla_put_failure: 849 nlmsg_trim(skb, nlh); 850 return -1; 851 } 852 853 struct nftnl_skb_parms { 854 bool report; 855 }; 856 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb)) 857 858 static void nft_notify_enqueue(struct sk_buff *skb, bool report, 859 struct list_head *notify_list) 860 { 861 NFT_CB(skb).report = report; 862 list_add_tail(&skb->list, notify_list); 863 } 864 865 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) 866 { 867 struct nftables_pernet *nft_net; 868 struct sk_buff *skb; 869 u16 flags = 0; 870 int err; 871 872 if (!ctx->report && 873 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 874 return; 875 876 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 877 if (skb == NULL) 878 goto err; 879 880 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 881 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 882 883 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 884 event, flags, ctx->family, ctx->table); 885 if (err < 0) { 886 kfree_skb(skb); 887 goto err; 888 } 889 890 nft_net = nft_pernet(ctx->net); 891 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 892 return; 893 err: 894 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 895 } 896 897 static int nf_tables_dump_tables(struct sk_buff *skb, 898 struct netlink_callback *cb) 899 { 900 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 901 struct nftables_pernet *nft_net; 902 const struct nft_table *table; 903 unsigned int idx = 0, s_idx = cb->args[0]; 904 struct net *net = sock_net(skb->sk); 905 int family = nfmsg->nfgen_family; 906 907 rcu_read_lock(); 908 nft_net = nft_pernet(net); 909 cb->seq = READ_ONCE(nft_net->base_seq); 910 911 list_for_each_entry_rcu(table, &nft_net->tables, list) { 912 if (family != NFPROTO_UNSPEC && family != table->family) 913 continue; 914 915 if (idx < s_idx) 916 goto cont; 917 if (idx > s_idx) 918 memset(&cb->args[1], 0, 919 sizeof(cb->args) - sizeof(cb->args[0])); 920 if (!nft_is_active(net, table)) 921 continue; 922 if (nf_tables_fill_table_info(skb, net, 923 NETLINK_CB(cb->skb).portid, 924 cb->nlh->nlmsg_seq, 925 NFT_MSG_NEWTABLE, NLM_F_MULTI, 926 table->family, table) < 0) 927 goto done; 928 929 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 930 cont: 931 idx++; 932 } 933 done: 934 rcu_read_unlock(); 935 cb->args[0] = idx; 936 return skb->len; 937 } 938 939 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb, 940 const struct nlmsghdr *nlh, 941 struct netlink_dump_control *c) 942 { 943 int err; 944 945 if (!try_module_get(THIS_MODULE)) 946 return -EINVAL; 947 948 rcu_read_unlock(); 949 err = netlink_dump_start(nlsk, skb, nlh, c); 950 rcu_read_lock(); 951 module_put(THIS_MODULE); 952 953 return err; 954 } 955 956 /* called with rcu_read_lock held */ 957 static int nf_tables_gettable(struct sk_buff *skb, const struct nfnl_info *info, 958 const struct nlattr * const nla[]) 959 { 960 struct netlink_ext_ack *extack = info->extack; 961 u8 genmask = nft_genmask_cur(info->net); 962 u8 family = info->nfmsg->nfgen_family; 963 const struct nft_table *table; 964 struct net *net = info->net; 965 struct sk_buff *skb2; 966 int err; 967 968 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 969 struct netlink_dump_control c = { 970 .dump = nf_tables_dump_tables, 971 .module = THIS_MODULE, 972 }; 973 974 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 975 } 976 977 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask, 0); 978 if (IS_ERR(table)) { 979 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]); 980 return PTR_ERR(table); 981 } 982 983 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 984 if (!skb2) 985 return -ENOMEM; 986 987 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 988 info->nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 989 0, family, table); 990 if (err < 0) 991 goto err_fill_table_info; 992 993 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 994 995 err_fill_table_info: 996 kfree_skb(skb2); 997 return err; 998 } 999 1000 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) 1001 { 1002 struct nft_chain *chain; 1003 u32 i = 0; 1004 1005 list_for_each_entry(chain, &table->chains, list) { 1006 if (!nft_is_active_next(net, chain)) 1007 continue; 1008 if (!nft_is_base_chain(chain)) 1009 continue; 1010 1011 if (cnt && i++ == cnt) 1012 break; 1013 1014 nf_tables_unregister_hook(net, table, chain); 1015 } 1016 } 1017 1018 static int nf_tables_table_enable(struct net *net, struct nft_table *table) 1019 { 1020 struct nft_chain *chain; 1021 int err, i = 0; 1022 1023 list_for_each_entry(chain, &table->chains, list) { 1024 if (!nft_is_active_next(net, chain)) 1025 continue; 1026 if (!nft_is_base_chain(chain)) 1027 continue; 1028 1029 err = nf_tables_register_hook(net, table, chain); 1030 if (err < 0) 1031 goto err_register_hooks; 1032 1033 i++; 1034 } 1035 return 0; 1036 1037 err_register_hooks: 1038 if (i) 1039 nft_table_disable(net, table, i); 1040 return err; 1041 } 1042 1043 static void nf_tables_table_disable(struct net *net, struct nft_table *table) 1044 { 1045 table->flags &= ~NFT_TABLE_F_DORMANT; 1046 nft_table_disable(net, table, 0); 1047 table->flags |= NFT_TABLE_F_DORMANT; 1048 } 1049 1050 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1) 1051 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0) 1052 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1) 1053 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ 1054 __NFT_TABLE_F_WAS_AWAKEN) 1055 1056 static int nf_tables_updtable(struct nft_ctx *ctx) 1057 { 1058 struct nft_trans *trans; 1059 u32 flags; 1060 int ret; 1061 1062 if (!ctx->nla[NFTA_TABLE_FLAGS]) 1063 return 0; 1064 1065 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 1066 if (flags & ~NFT_TABLE_F_MASK) 1067 return -EOPNOTSUPP; 1068 1069 if (flags == ctx->table->flags) 1070 return 0; 1071 1072 if ((nft_table_has_owner(ctx->table) && 1073 !(flags & NFT_TABLE_F_OWNER)) || 1074 (!nft_table_has_owner(ctx->table) && 1075 flags & NFT_TABLE_F_OWNER)) 1076 return -EOPNOTSUPP; 1077 1078 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 1079 sizeof(struct nft_trans_table)); 1080 if (trans == NULL) 1081 return -ENOMEM; 1082 1083 if ((flags & NFT_TABLE_F_DORMANT) && 1084 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 1085 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1086 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) 1087 ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN; 1088 } else if (!(flags & NFT_TABLE_F_DORMANT) && 1089 ctx->table->flags & NFT_TABLE_F_DORMANT) { 1090 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 1091 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) { 1092 ret = nf_tables_table_enable(ctx->net, ctx->table); 1093 if (ret < 0) 1094 goto err_register_hooks; 1095 1096 ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT; 1097 } 1098 } 1099 1100 nft_trans_table_update(trans) = true; 1101 nft_trans_commit_list_add_tail(ctx->net, trans); 1102 1103 return 0; 1104 1105 err_register_hooks: 1106 nft_trans_destroy(trans); 1107 return ret; 1108 } 1109 1110 static u32 nft_chain_hash(const void *data, u32 len, u32 seed) 1111 { 1112 const char *name = data; 1113 1114 return jhash(name, strlen(name), seed); 1115 } 1116 1117 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed) 1118 { 1119 const struct nft_chain *chain = data; 1120 1121 return nft_chain_hash(chain->name, 0, seed); 1122 } 1123 1124 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg, 1125 const void *ptr) 1126 { 1127 const struct nft_chain *chain = ptr; 1128 const char *name = arg->key; 1129 1130 return strcmp(chain->name, name); 1131 } 1132 1133 static u32 nft_objname_hash(const void *data, u32 len, u32 seed) 1134 { 1135 const struct nft_object_hash_key *k = data; 1136 1137 seed ^= hash_ptr(k->table, 32); 1138 1139 return jhash(k->name, strlen(k->name), seed); 1140 } 1141 1142 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed) 1143 { 1144 const struct nft_object *obj = data; 1145 1146 return nft_objname_hash(&obj->key, 0, seed); 1147 } 1148 1149 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg, 1150 const void *ptr) 1151 { 1152 const struct nft_object_hash_key *k = arg->key; 1153 const struct nft_object *obj = ptr; 1154 1155 if (obj->key.table != k->table) 1156 return -1; 1157 1158 return strcmp(obj->key.name, k->name); 1159 } 1160 1161 static bool nft_supported_family(u8 family) 1162 { 1163 return false 1164 #ifdef CONFIG_NF_TABLES_INET 1165 || family == NFPROTO_INET 1166 #endif 1167 #ifdef CONFIG_NF_TABLES_IPV4 1168 || family == NFPROTO_IPV4 1169 #endif 1170 #ifdef CONFIG_NF_TABLES_ARP 1171 || family == NFPROTO_ARP 1172 #endif 1173 #ifdef CONFIG_NF_TABLES_NETDEV 1174 || family == NFPROTO_NETDEV 1175 #endif 1176 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) 1177 || family == NFPROTO_BRIDGE 1178 #endif 1179 #ifdef CONFIG_NF_TABLES_IPV6 1180 || family == NFPROTO_IPV6 1181 #endif 1182 ; 1183 } 1184 1185 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 1186 const struct nlattr * const nla[]) 1187 { 1188 struct nftables_pernet *nft_net = nft_pernet(info->net); 1189 struct netlink_ext_ack *extack = info->extack; 1190 u8 genmask = nft_genmask_next(info->net); 1191 u8 family = info->nfmsg->nfgen_family; 1192 struct net *net = info->net; 1193 const struct nlattr *attr; 1194 struct nft_table *table; 1195 struct nft_ctx ctx; 1196 u32 flags = 0; 1197 int err; 1198 1199 if (!nft_supported_family(family)) 1200 return -EOPNOTSUPP; 1201 1202 lockdep_assert_held(&nft_net->commit_mutex); 1203 attr = nla[NFTA_TABLE_NAME]; 1204 table = nft_table_lookup(net, attr, family, genmask, 1205 NETLINK_CB(skb).portid); 1206 if (IS_ERR(table)) { 1207 if (PTR_ERR(table) != -ENOENT) 1208 return PTR_ERR(table); 1209 } else { 1210 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 1211 NL_SET_BAD_ATTR(extack, attr); 1212 return -EEXIST; 1213 } 1214 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 1215 return -EOPNOTSUPP; 1216 1217 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1218 1219 return nf_tables_updtable(&ctx); 1220 } 1221 1222 if (nla[NFTA_TABLE_FLAGS]) { 1223 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 1224 if (flags & ~NFT_TABLE_F_MASK) 1225 return -EOPNOTSUPP; 1226 } 1227 1228 err = -ENOMEM; 1229 table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT); 1230 if (table == NULL) 1231 goto err_kzalloc; 1232 1233 table->validate_state = NFT_VALIDATE_SKIP; 1234 table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); 1235 if (table->name == NULL) 1236 goto err_strdup; 1237 1238 if (nla[NFTA_TABLE_USERDATA]) { 1239 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT); 1240 if (table->udata == NULL) 1241 goto err_table_udata; 1242 1243 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]); 1244 } 1245 1246 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params); 1247 if (err) 1248 goto err_chain_ht; 1249 1250 INIT_LIST_HEAD(&table->chains); 1251 INIT_LIST_HEAD(&table->sets); 1252 INIT_LIST_HEAD(&table->objects); 1253 INIT_LIST_HEAD(&table->flowtables); 1254 table->family = family; 1255 table->flags = flags; 1256 table->handle = ++nft_net->table_handle; 1257 if (table->flags & NFT_TABLE_F_OWNER) 1258 table->nlpid = NETLINK_CB(skb).portid; 1259 1260 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1261 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 1262 if (err < 0) 1263 goto err_trans; 1264 1265 list_add_tail_rcu(&table->list, &nft_net->tables); 1266 return 0; 1267 err_trans: 1268 rhltable_destroy(&table->chains_ht); 1269 err_chain_ht: 1270 kfree(table->udata); 1271 err_table_udata: 1272 kfree(table->name); 1273 err_strdup: 1274 kfree(table); 1275 err_kzalloc: 1276 return err; 1277 } 1278 1279 static int nft_flush_table(struct nft_ctx *ctx) 1280 { 1281 struct nft_flowtable *flowtable, *nft; 1282 struct nft_chain *chain, *nc; 1283 struct nft_object *obj, *ne; 1284 struct nft_set *set, *ns; 1285 int err; 1286 1287 list_for_each_entry(chain, &ctx->table->chains, list) { 1288 if (!nft_is_active_next(ctx->net, chain)) 1289 continue; 1290 1291 if (nft_chain_is_bound(chain)) 1292 continue; 1293 1294 ctx->chain = chain; 1295 1296 err = nft_delrule_by_chain(ctx); 1297 if (err < 0) 1298 goto out; 1299 } 1300 1301 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 1302 if (!nft_is_active_next(ctx->net, set)) 1303 continue; 1304 1305 if (nft_set_is_anonymous(set) && 1306 !list_empty(&set->bindings)) 1307 continue; 1308 1309 err = nft_delset(ctx, set); 1310 if (err < 0) 1311 goto out; 1312 } 1313 1314 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { 1315 if (!nft_is_active_next(ctx->net, flowtable)) 1316 continue; 1317 1318 err = nft_delflowtable(ctx, flowtable); 1319 if (err < 0) 1320 goto out; 1321 } 1322 1323 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { 1324 if (!nft_is_active_next(ctx->net, obj)) 1325 continue; 1326 1327 err = nft_delobj(ctx, obj); 1328 if (err < 0) 1329 goto out; 1330 } 1331 1332 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 1333 if (!nft_is_active_next(ctx->net, chain)) 1334 continue; 1335 1336 if (nft_chain_is_bound(chain)) 1337 continue; 1338 1339 ctx->chain = chain; 1340 1341 err = nft_delchain(ctx); 1342 if (err < 0) 1343 goto out; 1344 } 1345 1346 err = nft_deltable(ctx); 1347 out: 1348 return err; 1349 } 1350 1351 static int nft_flush(struct nft_ctx *ctx, int family) 1352 { 1353 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1354 const struct nlattr * const *nla = ctx->nla; 1355 struct nft_table *table, *nt; 1356 int err = 0; 1357 1358 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 1359 if (family != AF_UNSPEC && table->family != family) 1360 continue; 1361 1362 ctx->family = table->family; 1363 1364 if (!nft_is_active_next(ctx->net, table)) 1365 continue; 1366 1367 if (nft_table_has_owner(table) && table->nlpid != ctx->portid) 1368 continue; 1369 1370 if (nla[NFTA_TABLE_NAME] && 1371 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 1372 continue; 1373 1374 ctx->table = table; 1375 1376 err = nft_flush_table(ctx); 1377 if (err < 0) 1378 goto out; 1379 } 1380 out: 1381 return err; 1382 } 1383 1384 static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, 1385 const struct nlattr * const nla[]) 1386 { 1387 struct netlink_ext_ack *extack = info->extack; 1388 u8 genmask = nft_genmask_next(info->net); 1389 u8 family = info->nfmsg->nfgen_family; 1390 struct net *net = info->net; 1391 const struct nlattr *attr; 1392 struct nft_table *table; 1393 struct nft_ctx ctx; 1394 1395 nft_ctx_init(&ctx, net, skb, info->nlh, 0, NULL, NULL, nla); 1396 if (family == AF_UNSPEC || 1397 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) 1398 return nft_flush(&ctx, family); 1399 1400 if (nla[NFTA_TABLE_HANDLE]) { 1401 attr = nla[NFTA_TABLE_HANDLE]; 1402 table = nft_table_lookup_byhandle(net, attr, genmask, 1403 NETLINK_CB(skb).portid); 1404 } else { 1405 attr = nla[NFTA_TABLE_NAME]; 1406 table = nft_table_lookup(net, attr, family, genmask, 1407 NETLINK_CB(skb).portid); 1408 } 1409 1410 if (IS_ERR(table)) { 1411 if (PTR_ERR(table) == -ENOENT && 1412 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYTABLE) 1413 return 0; 1414 1415 NL_SET_BAD_ATTR(extack, attr); 1416 return PTR_ERR(table); 1417 } 1418 1419 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 1420 table->use > 0) 1421 return -EBUSY; 1422 1423 ctx.family = family; 1424 ctx.table = table; 1425 1426 return nft_flush_table(&ctx); 1427 } 1428 1429 static void nf_tables_table_destroy(struct nft_ctx *ctx) 1430 { 1431 if (WARN_ON(ctx->table->use > 0)) 1432 return; 1433 1434 rhltable_destroy(&ctx->table->chains_ht); 1435 kfree(ctx->table->name); 1436 kfree(ctx->table->udata); 1437 kfree(ctx->table); 1438 } 1439 1440 void nft_register_chain_type(const struct nft_chain_type *ctype) 1441 { 1442 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1443 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) { 1444 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1445 return; 1446 } 1447 chain_type[ctype->family][ctype->type] = ctype; 1448 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1449 } 1450 EXPORT_SYMBOL_GPL(nft_register_chain_type); 1451 1452 void nft_unregister_chain_type(const struct nft_chain_type *ctype) 1453 { 1454 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1455 chain_type[ctype->family][ctype->type] = NULL; 1456 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1457 } 1458 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 1459 1460 /* 1461 * Chains 1462 */ 1463 1464 static struct nft_chain * 1465 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask) 1466 { 1467 struct nft_chain *chain; 1468 1469 list_for_each_entry(chain, &table->chains, list) { 1470 if (chain->handle == handle && 1471 nft_active_genmask(chain, genmask)) 1472 return chain; 1473 } 1474 1475 return ERR_PTR(-ENOENT); 1476 } 1477 1478 static bool lockdep_commit_lock_is_held(const struct net *net) 1479 { 1480 #ifdef CONFIG_PROVE_LOCKING 1481 struct nftables_pernet *nft_net = nft_pernet(net); 1482 1483 return lockdep_is_held(&nft_net->commit_mutex); 1484 #else 1485 return true; 1486 #endif 1487 } 1488 1489 static struct nft_chain *nft_chain_lookup(struct net *net, 1490 struct nft_table *table, 1491 const struct nlattr *nla, u8 genmask) 1492 { 1493 char search[NFT_CHAIN_MAXNAMELEN + 1]; 1494 struct rhlist_head *tmp, *list; 1495 struct nft_chain *chain; 1496 1497 if (nla == NULL) 1498 return ERR_PTR(-EINVAL); 1499 1500 nla_strscpy(search, nla, sizeof(search)); 1501 1502 WARN_ON(!rcu_read_lock_held() && 1503 !lockdep_commit_lock_is_held(net)); 1504 1505 chain = ERR_PTR(-ENOENT); 1506 rcu_read_lock(); 1507 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params); 1508 if (!list) 1509 goto out_unlock; 1510 1511 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 1512 if (nft_active_genmask(chain, genmask)) 1513 goto out_unlock; 1514 } 1515 chain = ERR_PTR(-ENOENT); 1516 out_unlock: 1517 rcu_read_unlock(); 1518 return chain; 1519 } 1520 1521 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 1522 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING, 1523 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1524 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 1525 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 1526 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1527 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 1528 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 1529 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING, 1530 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 1531 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 1532 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 }, 1533 [NFTA_CHAIN_ID] = { .type = NLA_U32 }, 1534 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY, 1535 .len = NFT_USERDATA_MAXLEN }, 1536 }; 1537 1538 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 1539 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 1540 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 1541 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 1542 .len = IFNAMSIZ - 1 }, 1543 }; 1544 1545 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 1546 { 1547 struct nft_stats *cpu_stats, total; 1548 struct nlattr *nest; 1549 unsigned int seq; 1550 u64 pkts, bytes; 1551 int cpu; 1552 1553 if (!stats) 1554 return 0; 1555 1556 memset(&total, 0, sizeof(total)); 1557 for_each_possible_cpu(cpu) { 1558 cpu_stats = per_cpu_ptr(stats, cpu); 1559 do { 1560 seq = u64_stats_fetch_begin(&cpu_stats->syncp); 1561 pkts = cpu_stats->pkts; 1562 bytes = cpu_stats->bytes; 1563 } while (u64_stats_fetch_retry(&cpu_stats->syncp, seq)); 1564 total.pkts += pkts; 1565 total.bytes += bytes; 1566 } 1567 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS); 1568 if (nest == NULL) 1569 goto nla_put_failure; 1570 1571 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts), 1572 NFTA_COUNTER_PAD) || 1573 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 1574 NFTA_COUNTER_PAD)) 1575 goto nla_put_failure; 1576 1577 nla_nest_end(skb, nest); 1578 return 0; 1579 1580 nla_put_failure: 1581 return -ENOSPC; 1582 } 1583 1584 static int nft_dump_basechain_hook(struct sk_buff *skb, int family, 1585 const struct nft_base_chain *basechain, 1586 const struct list_head *hook_list) 1587 { 1588 const struct nf_hook_ops *ops = &basechain->ops; 1589 struct nft_hook *hook, *first = NULL; 1590 struct nlattr *nest, *nest_devs; 1591 int n = 0; 1592 1593 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK); 1594 if (nest == NULL) 1595 goto nla_put_failure; 1596 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 1597 goto nla_put_failure; 1598 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 1599 goto nla_put_failure; 1600 1601 if (nft_base_chain_netdev(family, ops->hooknum)) { 1602 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS); 1603 1604 if (!hook_list) 1605 hook_list = &basechain->hook_list; 1606 1607 list_for_each_entry(hook, hook_list, list) { 1608 if (!first) 1609 first = hook; 1610 1611 if (nla_put_string(skb, NFTA_DEVICE_NAME, 1612 hook->ops.dev->name)) 1613 goto nla_put_failure; 1614 n++; 1615 } 1616 nla_nest_end(skb, nest_devs); 1617 1618 if (n == 1 && 1619 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name)) 1620 goto nla_put_failure; 1621 } 1622 nla_nest_end(skb, nest); 1623 1624 return 0; 1625 nla_put_failure: 1626 return -1; 1627 } 1628 1629 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 1630 u32 portid, u32 seq, int event, u32 flags, 1631 int family, const struct nft_table *table, 1632 const struct nft_chain *chain, 1633 const struct list_head *hook_list) 1634 { 1635 struct nlmsghdr *nlh; 1636 1637 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 1638 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 1639 NFNETLINK_V0, nft_base_seq(net)); 1640 if (!nlh) 1641 goto nla_put_failure; 1642 1643 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name) || 1644 nla_put_string(skb, NFTA_CHAIN_NAME, chain->name) || 1645 nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), 1646 NFTA_CHAIN_PAD)) 1647 goto nla_put_failure; 1648 1649 if (event == NFT_MSG_DELCHAIN && !hook_list) { 1650 nlmsg_end(skb, nlh); 1651 return 0; 1652 } 1653 1654 if (nft_is_base_chain(chain)) { 1655 const struct nft_base_chain *basechain = nft_base_chain(chain); 1656 struct nft_stats __percpu *stats; 1657 1658 if (nft_dump_basechain_hook(skb, family, basechain, hook_list)) 1659 goto nla_put_failure; 1660 1661 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 1662 htonl(basechain->policy))) 1663 goto nla_put_failure; 1664 1665 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 1666 goto nla_put_failure; 1667 1668 stats = rcu_dereference_check(basechain->stats, 1669 lockdep_commit_lock_is_held(net)); 1670 if (nft_dump_stats(skb, stats)) 1671 goto nla_put_failure; 1672 } 1673 1674 if (chain->flags && 1675 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags))) 1676 goto nla_put_failure; 1677 1678 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 1679 goto nla_put_failure; 1680 1681 if (chain->udata && 1682 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata)) 1683 goto nla_put_failure; 1684 1685 nlmsg_end(skb, nlh); 1686 return 0; 1687 1688 nla_put_failure: 1689 nlmsg_trim(skb, nlh); 1690 return -1; 1691 } 1692 1693 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, 1694 const struct list_head *hook_list) 1695 { 1696 struct nftables_pernet *nft_net; 1697 struct sk_buff *skb; 1698 u16 flags = 0; 1699 int err; 1700 1701 if (!ctx->report && 1702 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1703 return; 1704 1705 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1706 if (skb == NULL) 1707 goto err; 1708 1709 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 1710 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 1711 1712 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 1713 event, flags, ctx->family, ctx->table, 1714 ctx->chain, hook_list); 1715 if (err < 0) { 1716 kfree_skb(skb); 1717 goto err; 1718 } 1719 1720 nft_net = nft_pernet(ctx->net); 1721 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 1722 return; 1723 err: 1724 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1725 } 1726 1727 static int nf_tables_dump_chains(struct sk_buff *skb, 1728 struct netlink_callback *cb) 1729 { 1730 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1731 unsigned int idx = 0, s_idx = cb->args[0]; 1732 struct net *net = sock_net(skb->sk); 1733 int family = nfmsg->nfgen_family; 1734 struct nftables_pernet *nft_net; 1735 const struct nft_table *table; 1736 const struct nft_chain *chain; 1737 1738 rcu_read_lock(); 1739 nft_net = nft_pernet(net); 1740 cb->seq = READ_ONCE(nft_net->base_seq); 1741 1742 list_for_each_entry_rcu(table, &nft_net->tables, list) { 1743 if (family != NFPROTO_UNSPEC && family != table->family) 1744 continue; 1745 1746 list_for_each_entry_rcu(chain, &table->chains, list) { 1747 if (idx < s_idx) 1748 goto cont; 1749 if (idx > s_idx) 1750 memset(&cb->args[1], 0, 1751 sizeof(cb->args) - sizeof(cb->args[0])); 1752 if (!nft_is_active(net, chain)) 1753 continue; 1754 if (nf_tables_fill_chain_info(skb, net, 1755 NETLINK_CB(cb->skb).portid, 1756 cb->nlh->nlmsg_seq, 1757 NFT_MSG_NEWCHAIN, 1758 NLM_F_MULTI, 1759 table->family, table, 1760 chain, NULL) < 0) 1761 goto done; 1762 1763 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1764 cont: 1765 idx++; 1766 } 1767 } 1768 done: 1769 rcu_read_unlock(); 1770 cb->args[0] = idx; 1771 return skb->len; 1772 } 1773 1774 /* called with rcu_read_lock held */ 1775 static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, 1776 const struct nlattr * const nla[]) 1777 { 1778 struct netlink_ext_ack *extack = info->extack; 1779 u8 genmask = nft_genmask_cur(info->net); 1780 u8 family = info->nfmsg->nfgen_family; 1781 const struct nft_chain *chain; 1782 struct net *net = info->net; 1783 struct nft_table *table; 1784 struct sk_buff *skb2; 1785 int err; 1786 1787 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1788 struct netlink_dump_control c = { 1789 .dump = nf_tables_dump_chains, 1790 .module = THIS_MODULE, 1791 }; 1792 1793 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 1794 } 1795 1796 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 0); 1797 if (IS_ERR(table)) { 1798 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 1799 return PTR_ERR(table); 1800 } 1801 1802 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask); 1803 if (IS_ERR(chain)) { 1804 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 1805 return PTR_ERR(chain); 1806 } 1807 1808 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 1809 if (!skb2) 1810 return -ENOMEM; 1811 1812 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 1813 info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 1814 0, family, table, chain, NULL); 1815 if (err < 0) 1816 goto err_fill_chain_info; 1817 1818 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 1819 1820 err_fill_chain_info: 1821 kfree_skb(skb2); 1822 return err; 1823 } 1824 1825 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 1826 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 1827 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 1828 }; 1829 1830 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 1831 { 1832 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 1833 struct nft_stats __percpu *newstats; 1834 struct nft_stats *stats; 1835 int err; 1836 1837 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr, 1838 nft_counter_policy, NULL); 1839 if (err < 0) 1840 return ERR_PTR(err); 1841 1842 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 1843 return ERR_PTR(-EINVAL); 1844 1845 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 1846 if (newstats == NULL) 1847 return ERR_PTR(-ENOMEM); 1848 1849 /* Restore old counters on this cpu, no problem. Per-cpu statistics 1850 * are not exposed to userspace. 1851 */ 1852 preempt_disable(); 1853 stats = this_cpu_ptr(newstats); 1854 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 1855 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 1856 preempt_enable(); 1857 1858 return newstats; 1859 } 1860 1861 static void nft_chain_stats_replace(struct nft_trans *trans) 1862 { 1863 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain); 1864 1865 if (!nft_trans_chain_stats(trans)) 1866 return; 1867 1868 nft_trans_chain_stats(trans) = 1869 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans), 1870 lockdep_commit_lock_is_held(trans->ctx.net)); 1871 1872 if (!nft_trans_chain_stats(trans)) 1873 static_branch_inc(&nft_counters_enabled); 1874 } 1875 1876 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) 1877 { 1878 struct nft_rule_blob *g0 = rcu_dereference_raw(chain->blob_gen_0); 1879 struct nft_rule_blob *g1 = rcu_dereference_raw(chain->blob_gen_1); 1880 1881 if (g0 != g1) 1882 kvfree(g1); 1883 kvfree(g0); 1884 1885 /* should be NULL either via abort or via successful commit */ 1886 WARN_ON_ONCE(chain->blob_next); 1887 kvfree(chain->blob_next); 1888 } 1889 1890 void nf_tables_chain_destroy(struct nft_ctx *ctx) 1891 { 1892 struct nft_chain *chain = ctx->chain; 1893 struct nft_hook *hook, *next; 1894 1895 if (WARN_ON(chain->use > 0)) 1896 return; 1897 1898 /* no concurrent access possible anymore */ 1899 nf_tables_chain_free_chain_rules(chain); 1900 1901 if (nft_is_base_chain(chain)) { 1902 struct nft_base_chain *basechain = nft_base_chain(chain); 1903 1904 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 1905 list_for_each_entry_safe(hook, next, 1906 &basechain->hook_list, list) { 1907 list_del_rcu(&hook->list); 1908 kfree_rcu(hook, rcu); 1909 } 1910 } 1911 module_put(basechain->type->owner); 1912 if (rcu_access_pointer(basechain->stats)) { 1913 static_branch_dec(&nft_counters_enabled); 1914 free_percpu(rcu_dereference_raw(basechain->stats)); 1915 } 1916 kfree(chain->name); 1917 kfree(chain->udata); 1918 kfree(basechain); 1919 } else { 1920 kfree(chain->name); 1921 kfree(chain->udata); 1922 kfree(chain); 1923 } 1924 } 1925 1926 static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 1927 const struct nlattr *attr) 1928 { 1929 struct net_device *dev; 1930 char ifname[IFNAMSIZ]; 1931 struct nft_hook *hook; 1932 int err; 1933 1934 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT); 1935 if (!hook) { 1936 err = -ENOMEM; 1937 goto err_hook_alloc; 1938 } 1939 1940 nla_strscpy(ifname, attr, IFNAMSIZ); 1941 /* nf_tables_netdev_event() is called under rtnl_mutex, this is 1942 * indirectly serializing all the other holders of the commit_mutex with 1943 * the rtnl_mutex. 1944 */ 1945 dev = __dev_get_by_name(net, ifname); 1946 if (!dev) { 1947 err = -ENOENT; 1948 goto err_hook_dev; 1949 } 1950 hook->ops.dev = dev; 1951 1952 return hook; 1953 1954 err_hook_dev: 1955 kfree(hook); 1956 err_hook_alloc: 1957 return ERR_PTR(err); 1958 } 1959 1960 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, 1961 const struct nft_hook *this) 1962 { 1963 struct nft_hook *hook; 1964 1965 list_for_each_entry(hook, hook_list, list) { 1966 if (this->ops.dev == hook->ops.dev) 1967 return hook; 1968 } 1969 1970 return NULL; 1971 } 1972 1973 static int nf_tables_parse_netdev_hooks(struct net *net, 1974 const struct nlattr *attr, 1975 struct list_head *hook_list, 1976 struct netlink_ext_ack *extack) 1977 { 1978 struct nft_hook *hook, *next; 1979 const struct nlattr *tmp; 1980 int rem, n = 0, err; 1981 1982 nla_for_each_nested(tmp, attr, rem) { 1983 if (nla_type(tmp) != NFTA_DEVICE_NAME) { 1984 err = -EINVAL; 1985 goto err_hook; 1986 } 1987 1988 hook = nft_netdev_hook_alloc(net, tmp); 1989 if (IS_ERR(hook)) { 1990 NL_SET_BAD_ATTR(extack, tmp); 1991 err = PTR_ERR(hook); 1992 goto err_hook; 1993 } 1994 if (nft_hook_list_find(hook_list, hook)) { 1995 NL_SET_BAD_ATTR(extack, tmp); 1996 kfree(hook); 1997 err = -EEXIST; 1998 goto err_hook; 1999 } 2000 list_add_tail(&hook->list, hook_list); 2001 n++; 2002 2003 if (n == NFT_NETDEVICE_MAX) { 2004 err = -EFBIG; 2005 goto err_hook; 2006 } 2007 } 2008 2009 return 0; 2010 2011 err_hook: 2012 list_for_each_entry_safe(hook, next, hook_list, list) { 2013 list_del(&hook->list); 2014 kfree(hook); 2015 } 2016 return err; 2017 } 2018 2019 struct nft_chain_hook { 2020 u32 num; 2021 s32 priority; 2022 const struct nft_chain_type *type; 2023 struct list_head list; 2024 }; 2025 2026 static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[], 2027 struct list_head *hook_list, 2028 struct netlink_ext_ack *extack, u32 flags) 2029 { 2030 struct nft_hook *hook; 2031 int err; 2032 2033 if (tb[NFTA_HOOK_DEV]) { 2034 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]); 2035 if (IS_ERR(hook)) { 2036 NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]); 2037 return PTR_ERR(hook); 2038 } 2039 2040 list_add_tail(&hook->list, hook_list); 2041 } else if (tb[NFTA_HOOK_DEVS]) { 2042 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS], 2043 hook_list, extack); 2044 if (err < 0) 2045 return err; 2046 2047 } 2048 2049 if (flags & NFT_CHAIN_HW_OFFLOAD && 2050 list_empty(hook_list)) 2051 return -EINVAL; 2052 2053 return 0; 2054 } 2055 2056 static int nft_chain_parse_hook(struct net *net, 2057 struct nft_base_chain *basechain, 2058 const struct nlattr * const nla[], 2059 struct nft_chain_hook *hook, u8 family, 2060 u32 flags, struct netlink_ext_ack *extack) 2061 { 2062 struct nftables_pernet *nft_net = nft_pernet(net); 2063 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 2064 const struct nft_chain_type *type; 2065 int err; 2066 2067 lockdep_assert_held(&nft_net->commit_mutex); 2068 lockdep_nfnl_nft_mutex_not_held(); 2069 2070 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX, 2071 nla[NFTA_CHAIN_HOOK], 2072 nft_hook_policy, NULL); 2073 if (err < 0) 2074 return err; 2075 2076 if (!basechain) { 2077 if (!ha[NFTA_HOOK_HOOKNUM] || 2078 !ha[NFTA_HOOK_PRIORITY]) { 2079 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2080 return -ENOENT; 2081 } 2082 2083 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2084 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2085 2086 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT); 2087 if (!type) 2088 return -EOPNOTSUPP; 2089 2090 if (nla[NFTA_CHAIN_TYPE]) { 2091 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE], 2092 family, true); 2093 if (IS_ERR(type)) { 2094 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2095 return PTR_ERR(type); 2096 } 2097 } 2098 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num))) 2099 return -EOPNOTSUPP; 2100 2101 if (type->type == NFT_CHAIN_T_NAT && 2102 hook->priority <= NF_IP_PRI_CONNTRACK) 2103 return -EOPNOTSUPP; 2104 } else { 2105 if (ha[NFTA_HOOK_HOOKNUM]) { 2106 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2107 if (hook->num != basechain->ops.hooknum) 2108 return -EOPNOTSUPP; 2109 } 2110 if (ha[NFTA_HOOK_PRIORITY]) { 2111 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2112 if (hook->priority != basechain->ops.priority) 2113 return -EOPNOTSUPP; 2114 } 2115 2116 type = basechain->type; 2117 } 2118 2119 if (!try_module_get(type->owner)) { 2120 if (nla[NFTA_CHAIN_TYPE]) 2121 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2122 return -ENOENT; 2123 } 2124 2125 hook->type = type; 2126 2127 INIT_LIST_HEAD(&hook->list); 2128 if (nft_base_chain_netdev(family, hook->num)) { 2129 err = nft_chain_parse_netdev(net, ha, &hook->list, extack, flags); 2130 if (err < 0) { 2131 module_put(type->owner); 2132 return err; 2133 } 2134 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) { 2135 module_put(type->owner); 2136 return -EOPNOTSUPP; 2137 } 2138 2139 return 0; 2140 } 2141 2142 static void nft_chain_release_hook(struct nft_chain_hook *hook) 2143 { 2144 struct nft_hook *h, *next; 2145 2146 list_for_each_entry_safe(h, next, &hook->list, list) { 2147 list_del(&h->list); 2148 kfree(h); 2149 } 2150 module_put(hook->type->owner); 2151 } 2152 2153 static void nft_last_rule(const struct nft_chain *chain, const void *ptr) 2154 { 2155 struct nft_rule_dp_last *lrule; 2156 2157 BUILD_BUG_ON(offsetof(struct nft_rule_dp_last, end) != 0); 2158 2159 lrule = (struct nft_rule_dp_last *)ptr; 2160 lrule->end.is_last = 1; 2161 lrule->chain = chain; 2162 /* blob size does not include the trailer rule */ 2163 } 2164 2165 static struct nft_rule_blob *nf_tables_chain_alloc_rules(const struct nft_chain *chain, 2166 unsigned int size) 2167 { 2168 struct nft_rule_blob *blob; 2169 2170 if (size > INT_MAX) 2171 return NULL; 2172 2173 size += sizeof(struct nft_rule_blob) + sizeof(struct nft_rule_dp_last); 2174 2175 blob = kvmalloc(size, GFP_KERNEL_ACCOUNT); 2176 if (!blob) 2177 return NULL; 2178 2179 blob->size = 0; 2180 nft_last_rule(chain, blob->data); 2181 2182 return blob; 2183 } 2184 2185 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family, 2186 const struct nft_chain_hook *hook, 2187 struct nft_chain *chain) 2188 { 2189 ops->pf = family; 2190 ops->hooknum = hook->num; 2191 ops->priority = hook->priority; 2192 ops->priv = chain; 2193 ops->hook = hook->type->hooks[ops->hooknum]; 2194 ops->hook_ops_type = NF_HOOK_OP_NF_TABLES; 2195 } 2196 2197 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, 2198 struct nft_chain_hook *hook, u32 flags) 2199 { 2200 struct nft_chain *chain; 2201 struct nft_hook *h; 2202 2203 basechain->type = hook->type; 2204 INIT_LIST_HEAD(&basechain->hook_list); 2205 chain = &basechain->chain; 2206 2207 if (nft_base_chain_netdev(family, hook->num)) { 2208 list_splice_init(&hook->list, &basechain->hook_list); 2209 list_for_each_entry(h, &basechain->hook_list, list) 2210 nft_basechain_hook_init(&h->ops, family, hook, chain); 2211 } 2212 nft_basechain_hook_init(&basechain->ops, family, hook, chain); 2213 2214 chain->flags |= NFT_CHAIN_BASE | flags; 2215 basechain->policy = NF_ACCEPT; 2216 if (chain->flags & NFT_CHAIN_HW_OFFLOAD && 2217 !nft_chain_offload_support(basechain)) { 2218 list_splice_init(&basechain->hook_list, &hook->list); 2219 return -EOPNOTSUPP; 2220 } 2221 2222 flow_block_init(&basechain->flow_block); 2223 2224 return 0; 2225 } 2226 2227 static int nft_chain_add(struct nft_table *table, struct nft_chain *chain) 2228 { 2229 int err; 2230 2231 err = rhltable_insert_key(&table->chains_ht, chain->name, 2232 &chain->rhlhead, nft_chain_ht_params); 2233 if (err) 2234 return err; 2235 2236 list_add_tail_rcu(&chain->list, &table->chains); 2237 2238 return 0; 2239 } 2240 2241 static u64 chain_id; 2242 2243 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 2244 u8 policy, u32 flags, 2245 struct netlink_ext_ack *extack) 2246 { 2247 const struct nlattr * const *nla = ctx->nla; 2248 struct nft_table *table = ctx->table; 2249 struct nft_base_chain *basechain; 2250 struct net *net = ctx->net; 2251 char name[NFT_NAME_MAXLEN]; 2252 struct nft_rule_blob *blob; 2253 struct nft_trans *trans; 2254 struct nft_chain *chain; 2255 int err; 2256 2257 if (table->use == UINT_MAX) 2258 return -EOVERFLOW; 2259 2260 if (nla[NFTA_CHAIN_HOOK]) { 2261 struct nft_stats __percpu *stats = NULL; 2262 struct nft_chain_hook hook = {}; 2263 2264 if (flags & NFT_CHAIN_BINDING) 2265 return -EOPNOTSUPP; 2266 2267 err = nft_chain_parse_hook(net, NULL, nla, &hook, family, flags, 2268 extack); 2269 if (err < 0) 2270 return err; 2271 2272 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT); 2273 if (basechain == NULL) { 2274 nft_chain_release_hook(&hook); 2275 return -ENOMEM; 2276 } 2277 chain = &basechain->chain; 2278 2279 if (nla[NFTA_CHAIN_COUNTERS]) { 2280 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2281 if (IS_ERR(stats)) { 2282 nft_chain_release_hook(&hook); 2283 kfree(basechain); 2284 return PTR_ERR(stats); 2285 } 2286 rcu_assign_pointer(basechain->stats, stats); 2287 } 2288 2289 err = nft_basechain_init(basechain, family, &hook, flags); 2290 if (err < 0) { 2291 nft_chain_release_hook(&hook); 2292 kfree(basechain); 2293 free_percpu(stats); 2294 return err; 2295 } 2296 if (stats) 2297 static_branch_inc(&nft_counters_enabled); 2298 } else { 2299 if (flags & NFT_CHAIN_BASE) 2300 return -EINVAL; 2301 if (flags & NFT_CHAIN_HW_OFFLOAD) 2302 return -EOPNOTSUPP; 2303 2304 chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT); 2305 if (chain == NULL) 2306 return -ENOMEM; 2307 2308 chain->flags = flags; 2309 } 2310 ctx->chain = chain; 2311 2312 INIT_LIST_HEAD(&chain->rules); 2313 chain->handle = nf_tables_alloc_handle(table); 2314 chain->table = table; 2315 2316 if (nla[NFTA_CHAIN_NAME]) { 2317 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2318 } else { 2319 if (!(flags & NFT_CHAIN_BINDING)) { 2320 err = -EINVAL; 2321 goto err_destroy_chain; 2322 } 2323 2324 snprintf(name, sizeof(name), "__chain%llu", ++chain_id); 2325 chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT); 2326 } 2327 2328 if (!chain->name) { 2329 err = -ENOMEM; 2330 goto err_destroy_chain; 2331 } 2332 2333 if (nla[NFTA_CHAIN_USERDATA]) { 2334 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT); 2335 if (chain->udata == NULL) { 2336 err = -ENOMEM; 2337 goto err_destroy_chain; 2338 } 2339 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]); 2340 } 2341 2342 blob = nf_tables_chain_alloc_rules(chain, 0); 2343 if (!blob) { 2344 err = -ENOMEM; 2345 goto err_destroy_chain; 2346 } 2347 2348 RCU_INIT_POINTER(chain->blob_gen_0, blob); 2349 RCU_INIT_POINTER(chain->blob_gen_1, blob); 2350 2351 err = nf_tables_register_hook(net, table, chain); 2352 if (err < 0) 2353 goto err_destroy_chain; 2354 2355 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN); 2356 if (IS_ERR(trans)) { 2357 err = PTR_ERR(trans); 2358 goto err_unregister_hook; 2359 } 2360 2361 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET; 2362 if (nft_is_base_chain(chain)) 2363 nft_trans_chain_policy(trans) = policy; 2364 2365 err = nft_chain_add(table, chain); 2366 if (err < 0) { 2367 nft_trans_destroy(trans); 2368 goto err_unregister_hook; 2369 } 2370 2371 table->use++; 2372 2373 return 0; 2374 err_unregister_hook: 2375 nf_tables_unregister_hook(net, table, chain); 2376 err_destroy_chain: 2377 nf_tables_chain_destroy(ctx); 2378 2379 return err; 2380 } 2381 2382 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 2383 u32 flags, const struct nlattr *attr, 2384 struct netlink_ext_ack *extack) 2385 { 2386 const struct nlattr * const *nla = ctx->nla; 2387 struct nft_base_chain *basechain = NULL; 2388 struct nft_table *table = ctx->table; 2389 struct nft_chain *chain = ctx->chain; 2390 struct nft_chain_hook hook = {}; 2391 struct nft_stats *stats = NULL; 2392 struct nft_hook *h, *next; 2393 struct nf_hook_ops *ops; 2394 struct nft_trans *trans; 2395 bool unregister = false; 2396 int err; 2397 2398 if (chain->flags ^ flags) 2399 return -EOPNOTSUPP; 2400 2401 INIT_LIST_HEAD(&hook.list); 2402 2403 if (nla[NFTA_CHAIN_HOOK]) { 2404 if (!nft_is_base_chain(chain)) { 2405 NL_SET_BAD_ATTR(extack, attr); 2406 return -EEXIST; 2407 } 2408 2409 basechain = nft_base_chain(chain); 2410 err = nft_chain_parse_hook(ctx->net, basechain, nla, &hook, 2411 ctx->family, flags, extack); 2412 if (err < 0) 2413 return err; 2414 2415 if (basechain->type != hook.type) { 2416 nft_chain_release_hook(&hook); 2417 NL_SET_BAD_ATTR(extack, attr); 2418 return -EEXIST; 2419 } 2420 2421 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 2422 list_for_each_entry_safe(h, next, &hook.list, list) { 2423 h->ops.pf = basechain->ops.pf; 2424 h->ops.hooknum = basechain->ops.hooknum; 2425 h->ops.priority = basechain->ops.priority; 2426 h->ops.priv = basechain->ops.priv; 2427 h->ops.hook = basechain->ops.hook; 2428 2429 if (nft_hook_list_find(&basechain->hook_list, h)) { 2430 list_del(&h->list); 2431 kfree(h); 2432 } 2433 } 2434 } else { 2435 ops = &basechain->ops; 2436 if (ops->hooknum != hook.num || 2437 ops->priority != hook.priority) { 2438 nft_chain_release_hook(&hook); 2439 NL_SET_BAD_ATTR(extack, attr); 2440 return -EEXIST; 2441 } 2442 } 2443 } 2444 2445 if (nla[NFTA_CHAIN_HANDLE] && 2446 nla[NFTA_CHAIN_NAME]) { 2447 struct nft_chain *chain2; 2448 2449 chain2 = nft_chain_lookup(ctx->net, table, 2450 nla[NFTA_CHAIN_NAME], genmask); 2451 if (!IS_ERR(chain2)) { 2452 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2453 err = -EEXIST; 2454 goto err_hooks; 2455 } 2456 } 2457 2458 if (nla[NFTA_CHAIN_COUNTERS]) { 2459 if (!nft_is_base_chain(chain)) { 2460 err = -EOPNOTSUPP; 2461 goto err_hooks; 2462 } 2463 2464 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2465 if (IS_ERR(stats)) { 2466 err = PTR_ERR(stats); 2467 goto err_hooks; 2468 } 2469 } 2470 2471 if (!(table->flags & NFT_TABLE_F_DORMANT) && 2472 nft_is_base_chain(chain) && 2473 !list_empty(&hook.list)) { 2474 basechain = nft_base_chain(chain); 2475 ops = &basechain->ops; 2476 2477 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { 2478 err = nft_netdev_register_hooks(ctx->net, &hook.list); 2479 if (err < 0) 2480 goto err_hooks; 2481 } 2482 } 2483 2484 unregister = true; 2485 err = -ENOMEM; 2486 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, 2487 sizeof(struct nft_trans_chain)); 2488 if (trans == NULL) 2489 goto err_trans; 2490 2491 nft_trans_chain_stats(trans) = stats; 2492 nft_trans_chain_update(trans) = true; 2493 2494 if (nla[NFTA_CHAIN_POLICY]) 2495 nft_trans_chain_policy(trans) = policy; 2496 else 2497 nft_trans_chain_policy(trans) = -1; 2498 2499 if (nla[NFTA_CHAIN_HANDLE] && 2500 nla[NFTA_CHAIN_NAME]) { 2501 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 2502 struct nft_trans *tmp; 2503 char *name; 2504 2505 err = -ENOMEM; 2506 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2507 if (!name) 2508 goto err_trans; 2509 2510 err = -EEXIST; 2511 list_for_each_entry(tmp, &nft_net->commit_list, list) { 2512 if (tmp->msg_type == NFT_MSG_NEWCHAIN && 2513 tmp->ctx.table == table && 2514 nft_trans_chain_update(tmp) && 2515 nft_trans_chain_name(tmp) && 2516 strcmp(name, nft_trans_chain_name(tmp)) == 0) { 2517 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2518 kfree(name); 2519 goto err_trans; 2520 } 2521 } 2522 2523 nft_trans_chain_name(trans) = name; 2524 } 2525 2526 nft_trans_basechain(trans) = basechain; 2527 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 2528 list_splice(&hook.list, &nft_trans_chain_hooks(trans)); 2529 2530 nft_trans_commit_list_add_tail(ctx->net, trans); 2531 2532 return 0; 2533 2534 err_trans: 2535 free_percpu(stats); 2536 kfree(trans); 2537 err_hooks: 2538 if (nla[NFTA_CHAIN_HOOK]) { 2539 list_for_each_entry_safe(h, next, &hook.list, list) { 2540 if (unregister) 2541 nf_unregister_net_hook(ctx->net, &h->ops); 2542 list_del(&h->list); 2543 kfree_rcu(h, rcu); 2544 } 2545 module_put(hook.type->owner); 2546 } 2547 2548 return err; 2549 } 2550 2551 static struct nft_chain *nft_chain_lookup_byid(const struct net *net, 2552 const struct nft_table *table, 2553 const struct nlattr *nla) 2554 { 2555 struct nftables_pernet *nft_net = nft_pernet(net); 2556 u32 id = ntohl(nla_get_be32(nla)); 2557 struct nft_trans *trans; 2558 2559 list_for_each_entry(trans, &nft_net->commit_list, list) { 2560 struct nft_chain *chain = trans->ctx.chain; 2561 2562 if (trans->msg_type == NFT_MSG_NEWCHAIN && 2563 chain->table == table && 2564 id == nft_trans_chain_id(trans)) 2565 return chain; 2566 } 2567 return ERR_PTR(-ENOENT); 2568 } 2569 2570 static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, 2571 const struct nlattr * const nla[]) 2572 { 2573 struct nftables_pernet *nft_net = nft_pernet(info->net); 2574 struct netlink_ext_ack *extack = info->extack; 2575 u8 genmask = nft_genmask_next(info->net); 2576 u8 family = info->nfmsg->nfgen_family; 2577 struct nft_chain *chain = NULL; 2578 struct net *net = info->net; 2579 const struct nlattr *attr; 2580 struct nft_table *table; 2581 u8 policy = NF_ACCEPT; 2582 struct nft_ctx ctx; 2583 u64 handle = 0; 2584 u32 flags = 0; 2585 2586 lockdep_assert_held(&nft_net->commit_mutex); 2587 2588 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2589 NETLINK_CB(skb).portid); 2590 if (IS_ERR(table)) { 2591 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2592 return PTR_ERR(table); 2593 } 2594 2595 chain = NULL; 2596 attr = nla[NFTA_CHAIN_NAME]; 2597 2598 if (nla[NFTA_CHAIN_HANDLE]) { 2599 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 2600 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2601 if (IS_ERR(chain)) { 2602 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]); 2603 return PTR_ERR(chain); 2604 } 2605 attr = nla[NFTA_CHAIN_HANDLE]; 2606 } else if (nla[NFTA_CHAIN_NAME]) { 2607 chain = nft_chain_lookup(net, table, attr, genmask); 2608 if (IS_ERR(chain)) { 2609 if (PTR_ERR(chain) != -ENOENT) { 2610 NL_SET_BAD_ATTR(extack, attr); 2611 return PTR_ERR(chain); 2612 } 2613 chain = NULL; 2614 } 2615 } else if (!nla[NFTA_CHAIN_ID]) { 2616 return -EINVAL; 2617 } 2618 2619 if (nla[NFTA_CHAIN_POLICY]) { 2620 if (chain != NULL && 2621 !nft_is_base_chain(chain)) { 2622 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2623 return -EOPNOTSUPP; 2624 } 2625 2626 if (chain == NULL && 2627 nla[NFTA_CHAIN_HOOK] == NULL) { 2628 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2629 return -EOPNOTSUPP; 2630 } 2631 2632 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 2633 switch (policy) { 2634 case NF_DROP: 2635 case NF_ACCEPT: 2636 break; 2637 default: 2638 return -EINVAL; 2639 } 2640 } 2641 2642 if (nla[NFTA_CHAIN_FLAGS]) 2643 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS])); 2644 else if (chain) 2645 flags = chain->flags; 2646 2647 if (flags & ~NFT_CHAIN_FLAGS) 2648 return -EOPNOTSUPP; 2649 2650 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2651 2652 if (chain != NULL) { 2653 if (chain->flags & NFT_CHAIN_BINDING) 2654 return -EINVAL; 2655 2656 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 2657 NL_SET_BAD_ATTR(extack, attr); 2658 return -EEXIST; 2659 } 2660 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 2661 return -EOPNOTSUPP; 2662 2663 flags |= chain->flags & NFT_CHAIN_BASE; 2664 return nf_tables_updchain(&ctx, genmask, policy, flags, attr, 2665 extack); 2666 } 2667 2668 return nf_tables_addchain(&ctx, family, genmask, policy, flags, extack); 2669 } 2670 2671 static int nft_delchain_hook(struct nft_ctx *ctx, struct nft_chain *chain, 2672 struct netlink_ext_ack *extack) 2673 { 2674 const struct nlattr * const *nla = ctx->nla; 2675 struct nft_chain_hook chain_hook = {}; 2676 struct nft_base_chain *basechain; 2677 struct nft_hook *this, *hook; 2678 LIST_HEAD(chain_del_list); 2679 struct nft_trans *trans; 2680 int err; 2681 2682 if (!nft_is_base_chain(chain)) 2683 return -EOPNOTSUPP; 2684 2685 basechain = nft_base_chain(chain); 2686 err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook, 2687 ctx->family, chain->flags, extack); 2688 if (err < 0) 2689 return err; 2690 2691 list_for_each_entry(this, &chain_hook.list, list) { 2692 hook = nft_hook_list_find(&basechain->hook_list, this); 2693 if (!hook) { 2694 err = -ENOENT; 2695 goto err_chain_del_hook; 2696 } 2697 list_move(&hook->list, &chain_del_list); 2698 } 2699 2700 trans = nft_trans_alloc(ctx, NFT_MSG_DELCHAIN, 2701 sizeof(struct nft_trans_chain)); 2702 if (!trans) { 2703 err = -ENOMEM; 2704 goto err_chain_del_hook; 2705 } 2706 2707 nft_trans_basechain(trans) = basechain; 2708 nft_trans_chain_update(trans) = true; 2709 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 2710 list_splice(&chain_del_list, &nft_trans_chain_hooks(trans)); 2711 nft_chain_release_hook(&chain_hook); 2712 2713 nft_trans_commit_list_add_tail(ctx->net, trans); 2714 2715 return 0; 2716 2717 err_chain_del_hook: 2718 list_splice(&chain_del_list, &basechain->hook_list); 2719 nft_chain_release_hook(&chain_hook); 2720 2721 return err; 2722 } 2723 2724 static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, 2725 const struct nlattr * const nla[]) 2726 { 2727 struct netlink_ext_ack *extack = info->extack; 2728 u8 genmask = nft_genmask_next(info->net); 2729 u8 family = info->nfmsg->nfgen_family; 2730 struct net *net = info->net; 2731 const struct nlattr *attr; 2732 struct nft_table *table; 2733 struct nft_chain *chain; 2734 struct nft_rule *rule; 2735 struct nft_ctx ctx; 2736 u64 handle; 2737 u32 use; 2738 int err; 2739 2740 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2741 NETLINK_CB(skb).portid); 2742 if (IS_ERR(table)) { 2743 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2744 return PTR_ERR(table); 2745 } 2746 2747 if (nla[NFTA_CHAIN_HANDLE]) { 2748 attr = nla[NFTA_CHAIN_HANDLE]; 2749 handle = be64_to_cpu(nla_get_be64(attr)); 2750 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2751 } else { 2752 attr = nla[NFTA_CHAIN_NAME]; 2753 chain = nft_chain_lookup(net, table, attr, genmask); 2754 } 2755 if (IS_ERR(chain)) { 2756 if (PTR_ERR(chain) == -ENOENT && 2757 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN) 2758 return 0; 2759 2760 NL_SET_BAD_ATTR(extack, attr); 2761 return PTR_ERR(chain); 2762 } 2763 2764 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2765 2766 if (nla[NFTA_CHAIN_HOOK]) { 2767 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 2768 return -EOPNOTSUPP; 2769 2770 return nft_delchain_hook(&ctx, chain, extack); 2771 } 2772 2773 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 2774 chain->use > 0) 2775 return -EBUSY; 2776 2777 use = chain->use; 2778 list_for_each_entry(rule, &chain->rules, list) { 2779 if (!nft_is_active_next(net, rule)) 2780 continue; 2781 use--; 2782 2783 err = nft_delrule(&ctx, rule); 2784 if (err < 0) 2785 return err; 2786 } 2787 2788 /* There are rules and elements that are still holding references to us, 2789 * we cannot do a recursive removal in this case. 2790 */ 2791 if (use > 0) { 2792 NL_SET_BAD_ATTR(extack, attr); 2793 return -EBUSY; 2794 } 2795 2796 return nft_delchain(&ctx); 2797 } 2798 2799 /* 2800 * Expressions 2801 */ 2802 2803 /** 2804 * nft_register_expr - register nf_tables expr type 2805 * @type: expr type 2806 * 2807 * Registers the expr type for use with nf_tables. Returns zero on 2808 * success or a negative errno code otherwise. 2809 */ 2810 int nft_register_expr(struct nft_expr_type *type) 2811 { 2812 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2813 if (type->family == NFPROTO_UNSPEC) 2814 list_add_tail_rcu(&type->list, &nf_tables_expressions); 2815 else 2816 list_add_rcu(&type->list, &nf_tables_expressions); 2817 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2818 return 0; 2819 } 2820 EXPORT_SYMBOL_GPL(nft_register_expr); 2821 2822 /** 2823 * nft_unregister_expr - unregister nf_tables expr type 2824 * @type: expr type 2825 * 2826 * Unregisters the expr typefor use with nf_tables. 2827 */ 2828 void nft_unregister_expr(struct nft_expr_type *type) 2829 { 2830 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2831 list_del_rcu(&type->list); 2832 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2833 } 2834 EXPORT_SYMBOL_GPL(nft_unregister_expr); 2835 2836 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 2837 struct nlattr *nla) 2838 { 2839 const struct nft_expr_type *type, *candidate = NULL; 2840 2841 list_for_each_entry(type, &nf_tables_expressions, list) { 2842 if (!nla_strcmp(nla, type->name)) { 2843 if (!type->family && !candidate) 2844 candidate = type; 2845 else if (type->family == family) 2846 candidate = type; 2847 } 2848 } 2849 return candidate; 2850 } 2851 2852 #ifdef CONFIG_MODULES 2853 static int nft_expr_type_request_module(struct net *net, u8 family, 2854 struct nlattr *nla) 2855 { 2856 if (nft_request_module(net, "nft-expr-%u-%.*s", family, 2857 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN) 2858 return -EAGAIN; 2859 2860 return 0; 2861 } 2862 #endif 2863 2864 static const struct nft_expr_type *nft_expr_type_get(struct net *net, 2865 u8 family, 2866 struct nlattr *nla) 2867 { 2868 const struct nft_expr_type *type; 2869 2870 if (nla == NULL) 2871 return ERR_PTR(-EINVAL); 2872 2873 type = __nft_expr_type_get(family, nla); 2874 if (type != NULL && try_module_get(type->owner)) 2875 return type; 2876 2877 lockdep_nfnl_nft_mutex_not_held(); 2878 #ifdef CONFIG_MODULES 2879 if (type == NULL) { 2880 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN) 2881 return ERR_PTR(-EAGAIN); 2882 2883 if (nft_request_module(net, "nft-expr-%.*s", 2884 nla_len(nla), 2885 (char *)nla_data(nla)) == -EAGAIN) 2886 return ERR_PTR(-EAGAIN); 2887 } 2888 #endif 2889 return ERR_PTR(-ENOENT); 2890 } 2891 2892 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 2893 [NFTA_EXPR_NAME] = { .type = NLA_STRING, 2894 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 2895 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 2896 }; 2897 2898 static int nf_tables_fill_expr_info(struct sk_buff *skb, 2899 const struct nft_expr *expr, bool reset) 2900 { 2901 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 2902 goto nla_put_failure; 2903 2904 if (expr->ops->dump) { 2905 struct nlattr *data = nla_nest_start_noflag(skb, 2906 NFTA_EXPR_DATA); 2907 if (data == NULL) 2908 goto nla_put_failure; 2909 if (expr->ops->dump(skb, expr, reset) < 0) 2910 goto nla_put_failure; 2911 nla_nest_end(skb, data); 2912 } 2913 2914 return skb->len; 2915 2916 nla_put_failure: 2917 return -1; 2918 }; 2919 2920 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 2921 const struct nft_expr *expr, bool reset) 2922 { 2923 struct nlattr *nest; 2924 2925 nest = nla_nest_start_noflag(skb, attr); 2926 if (!nest) 2927 goto nla_put_failure; 2928 if (nf_tables_fill_expr_info(skb, expr, reset) < 0) 2929 goto nla_put_failure; 2930 nla_nest_end(skb, nest); 2931 return 0; 2932 2933 nla_put_failure: 2934 return -1; 2935 } 2936 2937 struct nft_expr_info { 2938 const struct nft_expr_ops *ops; 2939 const struct nlattr *attr; 2940 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 2941 }; 2942 2943 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 2944 const struct nlattr *nla, 2945 struct nft_expr_info *info) 2946 { 2947 const struct nft_expr_type *type; 2948 const struct nft_expr_ops *ops; 2949 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 2950 int err; 2951 2952 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 2953 nft_expr_policy, NULL); 2954 if (err < 0) 2955 return err; 2956 2957 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]); 2958 if (IS_ERR(type)) 2959 return PTR_ERR(type); 2960 2961 if (tb[NFTA_EXPR_DATA]) { 2962 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 2963 tb[NFTA_EXPR_DATA], 2964 type->policy, NULL); 2965 if (err < 0) 2966 goto err1; 2967 } else 2968 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 2969 2970 if (type->select_ops != NULL) { 2971 ops = type->select_ops(ctx, 2972 (const struct nlattr * const *)info->tb); 2973 if (IS_ERR(ops)) { 2974 err = PTR_ERR(ops); 2975 #ifdef CONFIG_MODULES 2976 if (err == -EAGAIN) 2977 if (nft_expr_type_request_module(ctx->net, 2978 ctx->family, 2979 tb[NFTA_EXPR_NAME]) != -EAGAIN) 2980 err = -ENOENT; 2981 #endif 2982 goto err1; 2983 } 2984 } else 2985 ops = type->ops; 2986 2987 info->attr = nla; 2988 info->ops = ops; 2989 2990 return 0; 2991 2992 err1: 2993 module_put(type->owner); 2994 return err; 2995 } 2996 2997 int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, 2998 struct nft_expr_info *info) 2999 { 3000 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3001 const struct nft_expr_type *type; 3002 int err; 3003 3004 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3005 nft_expr_policy, NULL); 3006 if (err < 0) 3007 return err; 3008 3009 if (!tb[NFTA_EXPR_DATA]) 3010 return -EINVAL; 3011 3012 type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); 3013 if (!type) 3014 return -ENOENT; 3015 3016 if (!type->inner_ops) 3017 return -EOPNOTSUPP; 3018 3019 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3020 tb[NFTA_EXPR_DATA], 3021 type->policy, NULL); 3022 if (err < 0) 3023 goto err_nla_parse; 3024 3025 info->attr = nla; 3026 info->ops = type->inner_ops; 3027 3028 return 0; 3029 3030 err_nla_parse: 3031 return err; 3032 } 3033 3034 static int nf_tables_newexpr(const struct nft_ctx *ctx, 3035 const struct nft_expr_info *expr_info, 3036 struct nft_expr *expr) 3037 { 3038 const struct nft_expr_ops *ops = expr_info->ops; 3039 int err; 3040 3041 expr->ops = ops; 3042 if (ops->init) { 3043 err = ops->init(ctx, expr, (const struct nlattr **)expr_info->tb); 3044 if (err < 0) 3045 goto err1; 3046 } 3047 3048 return 0; 3049 err1: 3050 expr->ops = NULL; 3051 return err; 3052 } 3053 3054 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 3055 struct nft_expr *expr) 3056 { 3057 const struct nft_expr_type *type = expr->ops->type; 3058 3059 if (expr->ops->destroy) 3060 expr->ops->destroy(ctx, expr); 3061 module_put(type->owner); 3062 } 3063 3064 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 3065 const struct nlattr *nla) 3066 { 3067 struct nft_expr_info expr_info; 3068 struct nft_expr *expr; 3069 struct module *owner; 3070 int err; 3071 3072 err = nf_tables_expr_parse(ctx, nla, &expr_info); 3073 if (err < 0) 3074 goto err_expr_parse; 3075 3076 err = -EOPNOTSUPP; 3077 if (!(expr_info.ops->type->flags & NFT_EXPR_STATEFUL)) 3078 goto err_expr_stateful; 3079 3080 err = -ENOMEM; 3081 expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT); 3082 if (expr == NULL) 3083 goto err_expr_stateful; 3084 3085 err = nf_tables_newexpr(ctx, &expr_info, expr); 3086 if (err < 0) 3087 goto err_expr_new; 3088 3089 return expr; 3090 err_expr_new: 3091 kfree(expr); 3092 err_expr_stateful: 3093 owner = expr_info.ops->type->owner; 3094 if (expr_info.ops->type->release_ops) 3095 expr_info.ops->type->release_ops(expr_info.ops); 3096 3097 module_put(owner); 3098 err_expr_parse: 3099 return ERR_PTR(err); 3100 } 3101 3102 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) 3103 { 3104 int err; 3105 3106 if (src->ops->clone) { 3107 dst->ops = src->ops; 3108 err = src->ops->clone(dst, src); 3109 if (err < 0) 3110 return err; 3111 } else { 3112 memcpy(dst, src, src->ops->size); 3113 } 3114 3115 __module_get(src->ops->type->owner); 3116 3117 return 0; 3118 } 3119 3120 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 3121 { 3122 nf_tables_expr_destroy(ctx, expr); 3123 kfree(expr); 3124 } 3125 3126 /* 3127 * Rules 3128 */ 3129 3130 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain, 3131 u64 handle) 3132 { 3133 struct nft_rule *rule; 3134 3135 // FIXME: this sucks 3136 list_for_each_entry_rcu(rule, &chain->rules, list) { 3137 if (handle == rule->handle) 3138 return rule; 3139 } 3140 3141 return ERR_PTR(-ENOENT); 3142 } 3143 3144 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain, 3145 const struct nlattr *nla) 3146 { 3147 if (nla == NULL) 3148 return ERR_PTR(-EINVAL); 3149 3150 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla))); 3151 } 3152 3153 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 3154 [NFTA_RULE_TABLE] = { .type = NLA_STRING, 3155 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3156 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 3157 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 3158 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 3159 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED }, 3160 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 3161 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 3162 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 3163 .len = NFT_USERDATA_MAXLEN }, 3164 [NFTA_RULE_ID] = { .type = NLA_U32 }, 3165 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 }, 3166 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 }, 3167 }; 3168 3169 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 3170 u32 portid, u32 seq, int event, 3171 u32 flags, int family, 3172 const struct nft_table *table, 3173 const struct nft_chain *chain, 3174 const struct nft_rule *rule, u64 handle, 3175 bool reset) 3176 { 3177 struct nlmsghdr *nlh; 3178 const struct nft_expr *expr, *next; 3179 struct nlattr *list; 3180 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 3181 3182 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, 3183 nft_base_seq(net)); 3184 if (!nlh) 3185 goto nla_put_failure; 3186 3187 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 3188 goto nla_put_failure; 3189 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 3190 goto nla_put_failure; 3191 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle), 3192 NFTA_RULE_PAD)) 3193 goto nla_put_failure; 3194 3195 if (event != NFT_MSG_DELRULE && handle) { 3196 if (nla_put_be64(skb, NFTA_RULE_POSITION, cpu_to_be64(handle), 3197 NFTA_RULE_PAD)) 3198 goto nla_put_failure; 3199 } 3200 3201 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 3202 nft_flow_rule_stats(chain, rule); 3203 3204 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS); 3205 if (list == NULL) 3206 goto nla_put_failure; 3207 nft_rule_for_each_expr(expr, next, rule) { 3208 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 3209 goto nla_put_failure; 3210 } 3211 nla_nest_end(skb, list); 3212 3213 if (rule->udata) { 3214 struct nft_userdata *udata = nft_userdata(rule); 3215 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 3216 udata->data) < 0) 3217 goto nla_put_failure; 3218 } 3219 3220 nlmsg_end(skb, nlh); 3221 return 0; 3222 3223 nla_put_failure: 3224 nlmsg_trim(skb, nlh); 3225 return -1; 3226 } 3227 3228 static void nf_tables_rule_notify(const struct nft_ctx *ctx, 3229 const struct nft_rule *rule, int event) 3230 { 3231 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3232 const struct nft_rule *prule; 3233 struct sk_buff *skb; 3234 u64 handle = 0; 3235 u16 flags = 0; 3236 int err; 3237 3238 if (!ctx->report && 3239 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 3240 return; 3241 3242 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3243 if (skb == NULL) 3244 goto err; 3245 3246 if (event == NFT_MSG_NEWRULE && 3247 !list_is_first(&rule->list, &ctx->chain->rules) && 3248 !list_is_last(&rule->list, &ctx->chain->rules)) { 3249 prule = list_prev_entry(rule, list); 3250 handle = prule->handle; 3251 } 3252 if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) 3253 flags |= NLM_F_APPEND; 3254 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 3255 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 3256 3257 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 3258 event, flags, ctx->family, ctx->table, 3259 ctx->chain, rule, handle, false); 3260 if (err < 0) { 3261 kfree_skb(skb); 3262 goto err; 3263 } 3264 3265 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 3266 return; 3267 err: 3268 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 3269 } 3270 3271 struct nft_rule_dump_ctx { 3272 char *table; 3273 char *chain; 3274 }; 3275 3276 static int __nf_tables_dump_rules(struct sk_buff *skb, 3277 unsigned int *idx, 3278 struct netlink_callback *cb, 3279 const struct nft_table *table, 3280 const struct nft_chain *chain, 3281 bool reset) 3282 { 3283 struct net *net = sock_net(skb->sk); 3284 const struct nft_rule *rule, *prule; 3285 unsigned int s_idx = cb->args[0]; 3286 u64 handle; 3287 3288 prule = NULL; 3289 list_for_each_entry_rcu(rule, &chain->rules, list) { 3290 if (!nft_is_active(net, rule)) 3291 goto cont_skip; 3292 if (*idx < s_idx) 3293 goto cont; 3294 if (*idx > s_idx) { 3295 memset(&cb->args[1], 0, 3296 sizeof(cb->args) - sizeof(cb->args[0])); 3297 } 3298 if (prule) 3299 handle = prule->handle; 3300 else 3301 handle = 0; 3302 3303 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 3304 cb->nlh->nlmsg_seq, 3305 NFT_MSG_NEWRULE, 3306 NLM_F_MULTI | NLM_F_APPEND, 3307 table->family, 3308 table, chain, rule, handle, reset) < 0) 3309 return 1; 3310 3311 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 3312 cont: 3313 prule = rule; 3314 cont_skip: 3315 (*idx)++; 3316 } 3317 return 0; 3318 } 3319 3320 static int nf_tables_dump_rules(struct sk_buff *skb, 3321 struct netlink_callback *cb) 3322 { 3323 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3324 const struct nft_rule_dump_ctx *ctx = cb->data; 3325 struct nft_table *table; 3326 const struct nft_chain *chain; 3327 unsigned int idx = 0; 3328 struct net *net = sock_net(skb->sk); 3329 int family = nfmsg->nfgen_family; 3330 struct nftables_pernet *nft_net; 3331 bool reset = false; 3332 3333 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3334 reset = true; 3335 3336 rcu_read_lock(); 3337 nft_net = nft_pernet(net); 3338 cb->seq = READ_ONCE(nft_net->base_seq); 3339 3340 list_for_each_entry_rcu(table, &nft_net->tables, list) { 3341 if (family != NFPROTO_UNSPEC && family != table->family) 3342 continue; 3343 3344 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0) 3345 continue; 3346 3347 if (ctx && ctx->table && ctx->chain) { 3348 struct rhlist_head *list, *tmp; 3349 3350 list = rhltable_lookup(&table->chains_ht, ctx->chain, 3351 nft_chain_ht_params); 3352 if (!list) 3353 goto done; 3354 3355 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 3356 if (!nft_is_active(net, chain)) 3357 continue; 3358 __nf_tables_dump_rules(skb, &idx, 3359 cb, table, chain, reset); 3360 break; 3361 } 3362 goto done; 3363 } 3364 3365 list_for_each_entry_rcu(chain, &table->chains, list) { 3366 if (__nf_tables_dump_rules(skb, &idx, 3367 cb, table, chain, reset)) 3368 goto done; 3369 } 3370 3371 if (ctx && ctx->table) 3372 break; 3373 } 3374 done: 3375 rcu_read_unlock(); 3376 3377 cb->args[0] = idx; 3378 return skb->len; 3379 } 3380 3381 static int nf_tables_dump_rules_start(struct netlink_callback *cb) 3382 { 3383 const struct nlattr * const *nla = cb->data; 3384 struct nft_rule_dump_ctx *ctx = NULL; 3385 3386 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) { 3387 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC); 3388 if (!ctx) 3389 return -ENOMEM; 3390 3391 if (nla[NFTA_RULE_TABLE]) { 3392 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE], 3393 GFP_ATOMIC); 3394 if (!ctx->table) { 3395 kfree(ctx); 3396 return -ENOMEM; 3397 } 3398 } 3399 if (nla[NFTA_RULE_CHAIN]) { 3400 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN], 3401 GFP_ATOMIC); 3402 if (!ctx->chain) { 3403 kfree(ctx->table); 3404 kfree(ctx); 3405 return -ENOMEM; 3406 } 3407 } 3408 } 3409 3410 cb->data = ctx; 3411 return 0; 3412 } 3413 3414 static int nf_tables_dump_rules_done(struct netlink_callback *cb) 3415 { 3416 struct nft_rule_dump_ctx *ctx = cb->data; 3417 3418 if (ctx) { 3419 kfree(ctx->table); 3420 kfree(ctx->chain); 3421 kfree(ctx); 3422 } 3423 return 0; 3424 } 3425 3426 /* called with rcu_read_lock held */ 3427 static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, 3428 const struct nlattr * const nla[]) 3429 { 3430 struct netlink_ext_ack *extack = info->extack; 3431 u8 genmask = nft_genmask_cur(info->net); 3432 u8 family = info->nfmsg->nfgen_family; 3433 const struct nft_chain *chain; 3434 const struct nft_rule *rule; 3435 struct net *net = info->net; 3436 struct nft_table *table; 3437 struct sk_buff *skb2; 3438 bool reset = false; 3439 int err; 3440 3441 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3442 struct netlink_dump_control c = { 3443 .start= nf_tables_dump_rules_start, 3444 .dump = nf_tables_dump_rules, 3445 .done = nf_tables_dump_rules_done, 3446 .module = THIS_MODULE, 3447 .data = (void *)nla, 3448 }; 3449 3450 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 3451 } 3452 3453 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0); 3454 if (IS_ERR(table)) { 3455 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3456 return PTR_ERR(table); 3457 } 3458 3459 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask); 3460 if (IS_ERR(chain)) { 3461 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3462 return PTR_ERR(chain); 3463 } 3464 3465 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 3466 if (IS_ERR(rule)) { 3467 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3468 return PTR_ERR(rule); 3469 } 3470 3471 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 3472 if (!skb2) 3473 return -ENOMEM; 3474 3475 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3476 reset = true; 3477 3478 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid, 3479 info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 3480 family, table, chain, rule, 0, reset); 3481 if (err < 0) 3482 goto err_fill_rule_info; 3483 3484 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 3485 3486 err_fill_rule_info: 3487 kfree_skb(skb2); 3488 return err; 3489 } 3490 3491 static void nf_tables_rule_destroy(const struct nft_ctx *ctx, 3492 struct nft_rule *rule) 3493 { 3494 struct nft_expr *expr, *next; 3495 3496 /* 3497 * Careful: some expressions might not be initialized in case this 3498 * is called on error from nf_tables_newrule(). 3499 */ 3500 expr = nft_expr_first(rule); 3501 while (nft_expr_more(rule, expr)) { 3502 next = nft_expr_next(expr); 3503 nf_tables_expr_destroy(ctx, expr); 3504 expr = next; 3505 } 3506 kfree(rule); 3507 } 3508 3509 void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) 3510 { 3511 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); 3512 nf_tables_rule_destroy(ctx, rule); 3513 } 3514 3515 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) 3516 { 3517 struct nft_expr *expr, *last; 3518 const struct nft_data *data; 3519 struct nft_rule *rule; 3520 int err; 3521 3522 if (ctx->level == NFT_JUMP_STACK_SIZE) 3523 return -EMLINK; 3524 3525 list_for_each_entry(rule, &chain->rules, list) { 3526 if (!nft_is_active_next(ctx->net, rule)) 3527 continue; 3528 3529 nft_rule_for_each_expr(expr, last, rule) { 3530 if (!expr->ops->validate) 3531 continue; 3532 3533 err = expr->ops->validate(ctx, expr, &data); 3534 if (err < 0) 3535 return err; 3536 } 3537 3538 cond_resched(); 3539 } 3540 3541 return 0; 3542 } 3543 EXPORT_SYMBOL_GPL(nft_chain_validate); 3544 3545 static int nft_table_validate(struct net *net, const struct nft_table *table) 3546 { 3547 struct nft_chain *chain; 3548 struct nft_ctx ctx = { 3549 .net = net, 3550 .family = table->family, 3551 }; 3552 int err; 3553 3554 list_for_each_entry(chain, &table->chains, list) { 3555 if (!nft_is_base_chain(chain)) 3556 continue; 3557 3558 ctx.chain = chain; 3559 err = nft_chain_validate(&ctx, chain); 3560 if (err < 0) 3561 return err; 3562 } 3563 3564 return 0; 3565 } 3566 3567 int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, 3568 const struct nft_set_iter *iter, 3569 struct nft_set_elem *elem) 3570 { 3571 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 3572 struct nft_ctx *pctx = (struct nft_ctx *)ctx; 3573 const struct nft_data *data; 3574 int err; 3575 3576 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 3577 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 3578 return 0; 3579 3580 data = nft_set_ext_data(ext); 3581 switch (data->verdict.code) { 3582 case NFT_JUMP: 3583 case NFT_GOTO: 3584 pctx->level++; 3585 err = nft_chain_validate(ctx, data->verdict.chain); 3586 if (err < 0) 3587 return err; 3588 pctx->level--; 3589 break; 3590 default: 3591 break; 3592 } 3593 3594 return 0; 3595 } 3596 3597 struct nft_set_elem_catchall { 3598 struct list_head list; 3599 struct rcu_head rcu; 3600 void *elem; 3601 }; 3602 3603 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set) 3604 { 3605 u8 genmask = nft_genmask_next(ctx->net); 3606 struct nft_set_elem_catchall *catchall; 3607 struct nft_set_elem elem; 3608 struct nft_set_ext *ext; 3609 int ret = 0; 3610 3611 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 3612 ext = nft_set_elem_ext(set, catchall->elem); 3613 if (!nft_set_elem_active(ext, genmask)) 3614 continue; 3615 3616 elem.priv = catchall->elem; 3617 ret = nft_setelem_validate(ctx, set, NULL, &elem); 3618 if (ret < 0) 3619 return ret; 3620 } 3621 3622 return ret; 3623 } 3624 3625 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 3626 const struct nft_chain *chain, 3627 const struct nlattr *nla); 3628 3629 #define NFT_RULE_MAXEXPRS 128 3630 3631 static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 3632 const struct nlattr * const nla[]) 3633 { 3634 struct nftables_pernet *nft_net = nft_pernet(info->net); 3635 struct netlink_ext_ack *extack = info->extack; 3636 unsigned int size, i, n, ulen = 0, usize = 0; 3637 u8 genmask = nft_genmask_next(info->net); 3638 struct nft_rule *rule, *old_rule = NULL; 3639 struct nft_expr_info *expr_info = NULL; 3640 u8 family = info->nfmsg->nfgen_family; 3641 struct nft_flow_rule *flow = NULL; 3642 struct net *net = info->net; 3643 struct nft_userdata *udata; 3644 struct nft_table *table; 3645 struct nft_chain *chain; 3646 struct nft_trans *trans; 3647 u64 handle, pos_handle; 3648 struct nft_expr *expr; 3649 struct nft_ctx ctx; 3650 struct nlattr *tmp; 3651 int err, rem; 3652 3653 lockdep_assert_held(&nft_net->commit_mutex); 3654 3655 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 3656 NETLINK_CB(skb).portid); 3657 if (IS_ERR(table)) { 3658 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3659 return PTR_ERR(table); 3660 } 3661 3662 if (nla[NFTA_RULE_CHAIN]) { 3663 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 3664 genmask); 3665 if (IS_ERR(chain)) { 3666 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3667 return PTR_ERR(chain); 3668 } 3669 if (nft_chain_is_bound(chain)) 3670 return -EOPNOTSUPP; 3671 3672 } else if (nla[NFTA_RULE_CHAIN_ID]) { 3673 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID]); 3674 if (IS_ERR(chain)) { 3675 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]); 3676 return PTR_ERR(chain); 3677 } 3678 } else { 3679 return -EINVAL; 3680 } 3681 3682 if (nla[NFTA_RULE_HANDLE]) { 3683 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 3684 rule = __nft_rule_lookup(chain, handle); 3685 if (IS_ERR(rule)) { 3686 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3687 return PTR_ERR(rule); 3688 } 3689 3690 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 3691 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3692 return -EEXIST; 3693 } 3694 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 3695 old_rule = rule; 3696 else 3697 return -EOPNOTSUPP; 3698 } else { 3699 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE) || 3700 info->nlh->nlmsg_flags & NLM_F_REPLACE) 3701 return -EINVAL; 3702 handle = nf_tables_alloc_handle(table); 3703 3704 if (chain->use == UINT_MAX) 3705 return -EOVERFLOW; 3706 3707 if (nla[NFTA_RULE_POSITION]) { 3708 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 3709 old_rule = __nft_rule_lookup(chain, pos_handle); 3710 if (IS_ERR(old_rule)) { 3711 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); 3712 return PTR_ERR(old_rule); 3713 } 3714 } else if (nla[NFTA_RULE_POSITION_ID]) { 3715 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]); 3716 if (IS_ERR(old_rule)) { 3717 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); 3718 return PTR_ERR(old_rule); 3719 } 3720 } 3721 } 3722 3723 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3724 3725 n = 0; 3726 size = 0; 3727 if (nla[NFTA_RULE_EXPRESSIONS]) { 3728 expr_info = kvmalloc_array(NFT_RULE_MAXEXPRS, 3729 sizeof(struct nft_expr_info), 3730 GFP_KERNEL); 3731 if (!expr_info) 3732 return -ENOMEM; 3733 3734 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 3735 err = -EINVAL; 3736 if (nla_type(tmp) != NFTA_LIST_ELEM) 3737 goto err_release_expr; 3738 if (n == NFT_RULE_MAXEXPRS) 3739 goto err_release_expr; 3740 err = nf_tables_expr_parse(&ctx, tmp, &expr_info[n]); 3741 if (err < 0) { 3742 NL_SET_BAD_ATTR(extack, tmp); 3743 goto err_release_expr; 3744 } 3745 size += expr_info[n].ops->size; 3746 n++; 3747 } 3748 } 3749 /* Check for overflow of dlen field */ 3750 err = -EFBIG; 3751 if (size >= 1 << 12) 3752 goto err_release_expr; 3753 3754 if (nla[NFTA_RULE_USERDATA]) { 3755 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 3756 if (ulen > 0) 3757 usize = sizeof(struct nft_userdata) + ulen; 3758 } 3759 3760 err = -ENOMEM; 3761 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT); 3762 if (rule == NULL) 3763 goto err_release_expr; 3764 3765 nft_activate_next(net, rule); 3766 3767 rule->handle = handle; 3768 rule->dlen = size; 3769 rule->udata = ulen ? 1 : 0; 3770 3771 if (ulen) { 3772 udata = nft_userdata(rule); 3773 udata->len = ulen - 1; 3774 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 3775 } 3776 3777 expr = nft_expr_first(rule); 3778 for (i = 0; i < n; i++) { 3779 err = nf_tables_newexpr(&ctx, &expr_info[i], expr); 3780 if (err < 0) { 3781 NL_SET_BAD_ATTR(extack, expr_info[i].attr); 3782 goto err_release_rule; 3783 } 3784 3785 if (expr_info[i].ops->validate) 3786 nft_validate_state_update(table, NFT_VALIDATE_NEED); 3787 3788 expr_info[i].ops = NULL; 3789 expr = nft_expr_next(expr); 3790 } 3791 3792 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { 3793 flow = nft_flow_rule_create(net, rule); 3794 if (IS_ERR(flow)) { 3795 err = PTR_ERR(flow); 3796 goto err_release_rule; 3797 } 3798 } 3799 3800 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) { 3801 err = nft_delrule(&ctx, old_rule); 3802 if (err < 0) 3803 goto err_destroy_flow_rule; 3804 3805 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 3806 if (trans == NULL) { 3807 err = -ENOMEM; 3808 goto err_destroy_flow_rule; 3809 } 3810 list_add_tail_rcu(&rule->list, &old_rule->list); 3811 } else { 3812 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 3813 if (!trans) { 3814 err = -ENOMEM; 3815 goto err_destroy_flow_rule; 3816 } 3817 3818 if (info->nlh->nlmsg_flags & NLM_F_APPEND) { 3819 if (old_rule) 3820 list_add_rcu(&rule->list, &old_rule->list); 3821 else 3822 list_add_tail_rcu(&rule->list, &chain->rules); 3823 } else { 3824 if (old_rule) 3825 list_add_tail_rcu(&rule->list, &old_rule->list); 3826 else 3827 list_add_rcu(&rule->list, &chain->rules); 3828 } 3829 } 3830 kvfree(expr_info); 3831 chain->use++; 3832 3833 if (flow) 3834 nft_trans_flow_rule(trans) = flow; 3835 3836 if (table->validate_state == NFT_VALIDATE_DO) 3837 return nft_table_validate(net, table); 3838 3839 return 0; 3840 3841 err_destroy_flow_rule: 3842 if (flow) 3843 nft_flow_rule_destroy(flow); 3844 err_release_rule: 3845 nf_tables_rule_release(&ctx, rule); 3846 err_release_expr: 3847 for (i = 0; i < n; i++) { 3848 if (expr_info[i].ops) { 3849 module_put(expr_info[i].ops->type->owner); 3850 if (expr_info[i].ops->type->release_ops) 3851 expr_info[i].ops->type->release_ops(expr_info[i].ops); 3852 } 3853 } 3854 kvfree(expr_info); 3855 3856 return err; 3857 } 3858 3859 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 3860 const struct nft_chain *chain, 3861 const struct nlattr *nla) 3862 { 3863 struct nftables_pernet *nft_net = nft_pernet(net); 3864 u32 id = ntohl(nla_get_be32(nla)); 3865 struct nft_trans *trans; 3866 3867 list_for_each_entry(trans, &nft_net->commit_list, list) { 3868 struct nft_rule *rule = nft_trans_rule(trans); 3869 3870 if (trans->msg_type == NFT_MSG_NEWRULE && 3871 trans->ctx.chain == chain && 3872 id == nft_trans_rule_id(trans)) 3873 return rule; 3874 } 3875 return ERR_PTR(-ENOENT); 3876 } 3877 3878 static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 3879 const struct nlattr * const nla[]) 3880 { 3881 struct netlink_ext_ack *extack = info->extack; 3882 u8 genmask = nft_genmask_next(info->net); 3883 u8 family = info->nfmsg->nfgen_family; 3884 struct nft_chain *chain = NULL; 3885 struct net *net = info->net; 3886 struct nft_table *table; 3887 struct nft_rule *rule; 3888 struct nft_ctx ctx; 3889 int err = 0; 3890 3891 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 3892 NETLINK_CB(skb).portid); 3893 if (IS_ERR(table)) { 3894 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3895 return PTR_ERR(table); 3896 } 3897 3898 if (nla[NFTA_RULE_CHAIN]) { 3899 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 3900 genmask); 3901 if (IS_ERR(chain)) { 3902 if (PTR_ERR(chain) == -ENOENT && 3903 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 3904 return 0; 3905 3906 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3907 return PTR_ERR(chain); 3908 } 3909 if (nft_chain_is_bound(chain)) 3910 return -EOPNOTSUPP; 3911 } 3912 3913 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3914 3915 if (chain) { 3916 if (nla[NFTA_RULE_HANDLE]) { 3917 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 3918 if (IS_ERR(rule)) { 3919 if (PTR_ERR(rule) == -ENOENT && 3920 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 3921 return 0; 3922 3923 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3924 return PTR_ERR(rule); 3925 } 3926 3927 err = nft_delrule(&ctx, rule); 3928 } else if (nla[NFTA_RULE_ID]) { 3929 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); 3930 if (IS_ERR(rule)) { 3931 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); 3932 return PTR_ERR(rule); 3933 } 3934 3935 err = nft_delrule(&ctx, rule); 3936 } else { 3937 err = nft_delrule_by_chain(&ctx); 3938 } 3939 } else { 3940 list_for_each_entry(chain, &table->chains, list) { 3941 if (!nft_is_active_next(net, chain)) 3942 continue; 3943 3944 ctx.chain = chain; 3945 err = nft_delrule_by_chain(&ctx); 3946 if (err < 0) 3947 break; 3948 } 3949 } 3950 3951 return err; 3952 } 3953 3954 /* 3955 * Sets 3956 */ 3957 static const struct nft_set_type *nft_set_types[] = { 3958 &nft_set_hash_fast_type, 3959 &nft_set_hash_type, 3960 &nft_set_rhash_type, 3961 &nft_set_bitmap_type, 3962 &nft_set_rbtree_type, 3963 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML) 3964 &nft_set_pipapo_avx2_type, 3965 #endif 3966 &nft_set_pipapo_type, 3967 }; 3968 3969 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ 3970 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \ 3971 NFT_SET_EVAL) 3972 3973 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags) 3974 { 3975 return (flags & type->features) == (flags & NFT_SET_FEATURES); 3976 } 3977 3978 /* 3979 * Select a set implementation based on the data characteristics and the 3980 * given policy. The total memory use might not be known if no size is 3981 * given, in that case the amount of memory per element is used. 3982 */ 3983 static const struct nft_set_ops * 3984 nft_select_set_ops(const struct nft_ctx *ctx, 3985 const struct nlattr * const nla[], 3986 const struct nft_set_desc *desc) 3987 { 3988 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3989 const struct nft_set_ops *ops, *bops; 3990 struct nft_set_estimate est, best; 3991 const struct nft_set_type *type; 3992 u32 flags = 0; 3993 int i; 3994 3995 lockdep_assert_held(&nft_net->commit_mutex); 3996 lockdep_nfnl_nft_mutex_not_held(); 3997 3998 if (nla[NFTA_SET_FLAGS] != NULL) 3999 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 4000 4001 bops = NULL; 4002 best.size = ~0; 4003 best.lookup = ~0; 4004 best.space = ~0; 4005 4006 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) { 4007 type = nft_set_types[i]; 4008 ops = &type->ops; 4009 4010 if (!nft_set_ops_candidate(type, flags)) 4011 continue; 4012 if (!ops->estimate(desc, flags, &est)) 4013 continue; 4014 4015 switch (desc->policy) { 4016 case NFT_SET_POL_PERFORMANCE: 4017 if (est.lookup < best.lookup) 4018 break; 4019 if (est.lookup == best.lookup && 4020 est.space < best.space) 4021 break; 4022 continue; 4023 case NFT_SET_POL_MEMORY: 4024 if (!desc->size) { 4025 if (est.space < best.space) 4026 break; 4027 if (est.space == best.space && 4028 est.lookup < best.lookup) 4029 break; 4030 } else if (est.size < best.size || !bops) { 4031 break; 4032 } 4033 continue; 4034 default: 4035 break; 4036 } 4037 4038 bops = ops; 4039 best = est; 4040 } 4041 4042 if (bops != NULL) 4043 return bops; 4044 4045 return ERR_PTR(-EOPNOTSUPP); 4046 } 4047 4048 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 4049 [NFTA_SET_TABLE] = { .type = NLA_STRING, 4050 .len = NFT_TABLE_MAXNAMELEN - 1 }, 4051 [NFTA_SET_NAME] = { .type = NLA_STRING, 4052 .len = NFT_SET_MAXNAMELEN - 1 }, 4053 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 4054 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 4055 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 4056 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 4057 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 4058 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 4059 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 4060 [NFTA_SET_ID] = { .type = NLA_U32 }, 4061 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 4062 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 4063 [NFTA_SET_USERDATA] = { .type = NLA_BINARY, 4064 .len = NFT_USERDATA_MAXLEN }, 4065 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, 4066 [NFTA_SET_HANDLE] = { .type = NLA_U64 }, 4067 [NFTA_SET_EXPR] = { .type = NLA_NESTED }, 4068 [NFTA_SET_EXPRESSIONS] = { .type = NLA_NESTED }, 4069 }; 4070 4071 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 4072 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 4073 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED }, 4074 }; 4075 4076 static struct nft_set *nft_set_lookup(const struct nft_table *table, 4077 const struct nlattr *nla, u8 genmask) 4078 { 4079 struct nft_set *set; 4080 4081 if (nla == NULL) 4082 return ERR_PTR(-EINVAL); 4083 4084 list_for_each_entry_rcu(set, &table->sets, list) { 4085 if (!nla_strcmp(nla, set->name) && 4086 nft_active_genmask(set, genmask)) 4087 return set; 4088 } 4089 return ERR_PTR(-ENOENT); 4090 } 4091 4092 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, 4093 const struct nlattr *nla, 4094 u8 genmask) 4095 { 4096 struct nft_set *set; 4097 4098 list_for_each_entry(set, &table->sets, list) { 4099 if (be64_to_cpu(nla_get_be64(nla)) == set->handle && 4100 nft_active_genmask(set, genmask)) 4101 return set; 4102 } 4103 return ERR_PTR(-ENOENT); 4104 } 4105 4106 static struct nft_set *nft_set_lookup_byid(const struct net *net, 4107 const struct nft_table *table, 4108 const struct nlattr *nla, u8 genmask) 4109 { 4110 struct nftables_pernet *nft_net = nft_pernet(net); 4111 u32 id = ntohl(nla_get_be32(nla)); 4112 struct nft_trans *trans; 4113 4114 list_for_each_entry(trans, &nft_net->commit_list, list) { 4115 if (trans->msg_type == NFT_MSG_NEWSET) { 4116 struct nft_set *set = nft_trans_set(trans); 4117 4118 if (id == nft_trans_set_id(trans) && 4119 set->table == table && 4120 nft_active_genmask(set, genmask)) 4121 return set; 4122 } 4123 } 4124 return ERR_PTR(-ENOENT); 4125 } 4126 4127 struct nft_set *nft_set_lookup_global(const struct net *net, 4128 const struct nft_table *table, 4129 const struct nlattr *nla_set_name, 4130 const struct nlattr *nla_set_id, 4131 u8 genmask) 4132 { 4133 struct nft_set *set; 4134 4135 set = nft_set_lookup(table, nla_set_name, genmask); 4136 if (IS_ERR(set)) { 4137 if (!nla_set_id) 4138 return set; 4139 4140 set = nft_set_lookup_byid(net, table, nla_set_id, genmask); 4141 } 4142 return set; 4143 } 4144 EXPORT_SYMBOL_GPL(nft_set_lookup_global); 4145 4146 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 4147 const char *name) 4148 { 4149 const struct nft_set *i; 4150 const char *p; 4151 unsigned long *inuse; 4152 unsigned int n = 0, min = 0; 4153 4154 p = strchr(name, '%'); 4155 if (p != NULL) { 4156 if (p[1] != 'd' || strchr(p + 2, '%')) 4157 return -EINVAL; 4158 4159 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 4160 if (inuse == NULL) 4161 return -ENOMEM; 4162 cont: 4163 list_for_each_entry(i, &ctx->table->sets, list) { 4164 int tmp; 4165 4166 if (!nft_is_active_next(ctx->net, i)) 4167 continue; 4168 if (!sscanf(i->name, name, &tmp)) 4169 continue; 4170 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 4171 continue; 4172 4173 set_bit(tmp - min, inuse); 4174 } 4175 4176 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 4177 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 4178 min += BITS_PER_BYTE * PAGE_SIZE; 4179 memset(inuse, 0, PAGE_SIZE); 4180 goto cont; 4181 } 4182 free_page((unsigned long)inuse); 4183 } 4184 4185 set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n); 4186 if (!set->name) 4187 return -ENOMEM; 4188 4189 list_for_each_entry(i, &ctx->table->sets, list) { 4190 if (!nft_is_active_next(ctx->net, i)) 4191 continue; 4192 if (!strcmp(set->name, i->name)) { 4193 kfree(set->name); 4194 set->name = NULL; 4195 return -ENFILE; 4196 } 4197 } 4198 return 0; 4199 } 4200 4201 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) 4202 { 4203 u64 ms = be64_to_cpu(nla_get_be64(nla)); 4204 u64 max = (u64)(~((u64)0)); 4205 4206 max = div_u64(max, NSEC_PER_MSEC); 4207 if (ms >= max) 4208 return -ERANGE; 4209 4210 ms *= NSEC_PER_MSEC; 4211 *result = nsecs_to_jiffies64(ms); 4212 return 0; 4213 } 4214 4215 __be64 nf_jiffies64_to_msecs(u64 input) 4216 { 4217 return cpu_to_be64(jiffies64_to_msecs(input)); 4218 } 4219 4220 static int nf_tables_fill_set_concat(struct sk_buff *skb, 4221 const struct nft_set *set) 4222 { 4223 struct nlattr *concat, *field; 4224 int i; 4225 4226 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT); 4227 if (!concat) 4228 return -ENOMEM; 4229 4230 for (i = 0; i < set->field_count; i++) { 4231 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 4232 if (!field) 4233 return -ENOMEM; 4234 4235 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN, 4236 htonl(set->field_len[i]))) 4237 return -ENOMEM; 4238 4239 nla_nest_end(skb, field); 4240 } 4241 4242 nla_nest_end(skb, concat); 4243 4244 return 0; 4245 } 4246 4247 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 4248 const struct nft_set *set, u16 event, u16 flags) 4249 { 4250 u64 timeout = READ_ONCE(set->timeout); 4251 u32 gc_int = READ_ONCE(set->gc_int); 4252 u32 portid = ctx->portid; 4253 struct nlmsghdr *nlh; 4254 struct nlattr *nest; 4255 u32 seq = ctx->seq; 4256 int i; 4257 4258 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 4259 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 4260 NFNETLINK_V0, nft_base_seq(ctx->net)); 4261 if (!nlh) 4262 goto nla_put_failure; 4263 4264 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 4265 goto nla_put_failure; 4266 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 4267 goto nla_put_failure; 4268 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), 4269 NFTA_SET_PAD)) 4270 goto nla_put_failure; 4271 4272 if (event == NFT_MSG_DELSET) { 4273 nlmsg_end(skb, nlh); 4274 return 0; 4275 } 4276 4277 if (set->flags != 0) 4278 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 4279 goto nla_put_failure; 4280 4281 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 4282 goto nla_put_failure; 4283 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 4284 goto nla_put_failure; 4285 if (set->flags & NFT_SET_MAP) { 4286 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 4287 goto nla_put_failure; 4288 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 4289 goto nla_put_failure; 4290 } 4291 if (set->flags & NFT_SET_OBJECT && 4292 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype))) 4293 goto nla_put_failure; 4294 4295 if (timeout && 4296 nla_put_be64(skb, NFTA_SET_TIMEOUT, 4297 nf_jiffies64_to_msecs(timeout), 4298 NFTA_SET_PAD)) 4299 goto nla_put_failure; 4300 if (gc_int && 4301 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(gc_int))) 4302 goto nla_put_failure; 4303 4304 if (set->policy != NFT_SET_POL_PERFORMANCE) { 4305 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 4306 goto nla_put_failure; 4307 } 4308 4309 if (set->udata && 4310 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) 4311 goto nla_put_failure; 4312 4313 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC); 4314 if (!nest) 4315 goto nla_put_failure; 4316 if (set->size && 4317 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) 4318 goto nla_put_failure; 4319 4320 if (set->field_count > 1 && 4321 nf_tables_fill_set_concat(skb, set)) 4322 goto nla_put_failure; 4323 4324 nla_nest_end(skb, nest); 4325 4326 if (set->num_exprs == 1) { 4327 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR); 4328 if (nf_tables_fill_expr_info(skb, set->exprs[0], false) < 0) 4329 goto nla_put_failure; 4330 4331 nla_nest_end(skb, nest); 4332 } else if (set->num_exprs > 1) { 4333 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPRESSIONS); 4334 if (nest == NULL) 4335 goto nla_put_failure; 4336 4337 for (i = 0; i < set->num_exprs; i++) { 4338 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 4339 set->exprs[i], false) < 0) 4340 goto nla_put_failure; 4341 } 4342 nla_nest_end(skb, nest); 4343 } 4344 4345 nlmsg_end(skb, nlh); 4346 return 0; 4347 4348 nla_put_failure: 4349 nlmsg_trim(skb, nlh); 4350 return -1; 4351 } 4352 4353 static void nf_tables_set_notify(const struct nft_ctx *ctx, 4354 const struct nft_set *set, int event, 4355 gfp_t gfp_flags) 4356 { 4357 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4358 u32 portid = ctx->portid; 4359 struct sk_buff *skb; 4360 u16 flags = 0; 4361 int err; 4362 4363 if (!ctx->report && 4364 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 4365 return; 4366 4367 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 4368 if (skb == NULL) 4369 goto err; 4370 4371 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 4372 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 4373 4374 err = nf_tables_fill_set(skb, ctx, set, event, flags); 4375 if (err < 0) { 4376 kfree_skb(skb); 4377 goto err; 4378 } 4379 4380 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 4381 return; 4382 err: 4383 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 4384 } 4385 4386 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 4387 { 4388 const struct nft_set *set; 4389 unsigned int idx, s_idx = cb->args[0]; 4390 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 4391 struct net *net = sock_net(skb->sk); 4392 struct nft_ctx *ctx = cb->data, ctx_set; 4393 struct nftables_pernet *nft_net; 4394 4395 if (cb->args[1]) 4396 return skb->len; 4397 4398 rcu_read_lock(); 4399 nft_net = nft_pernet(net); 4400 cb->seq = READ_ONCE(nft_net->base_seq); 4401 4402 list_for_each_entry_rcu(table, &nft_net->tables, list) { 4403 if (ctx->family != NFPROTO_UNSPEC && 4404 ctx->family != table->family) 4405 continue; 4406 4407 if (ctx->table && ctx->table != table) 4408 continue; 4409 4410 if (cur_table) { 4411 if (cur_table != table) 4412 continue; 4413 4414 cur_table = NULL; 4415 } 4416 idx = 0; 4417 list_for_each_entry_rcu(set, &table->sets, list) { 4418 if (idx < s_idx) 4419 goto cont; 4420 if (!nft_is_active(net, set)) 4421 goto cont; 4422 4423 ctx_set = *ctx; 4424 ctx_set.table = table; 4425 ctx_set.family = table->family; 4426 4427 if (nf_tables_fill_set(skb, &ctx_set, set, 4428 NFT_MSG_NEWSET, 4429 NLM_F_MULTI) < 0) { 4430 cb->args[0] = idx; 4431 cb->args[2] = (unsigned long) table; 4432 goto done; 4433 } 4434 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 4435 cont: 4436 idx++; 4437 } 4438 if (s_idx) 4439 s_idx = 0; 4440 } 4441 cb->args[1] = 1; 4442 done: 4443 rcu_read_unlock(); 4444 return skb->len; 4445 } 4446 4447 static int nf_tables_dump_sets_start(struct netlink_callback *cb) 4448 { 4449 struct nft_ctx *ctx_dump = NULL; 4450 4451 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC); 4452 if (ctx_dump == NULL) 4453 return -ENOMEM; 4454 4455 cb->data = ctx_dump; 4456 return 0; 4457 } 4458 4459 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 4460 { 4461 kfree(cb->data); 4462 return 0; 4463 } 4464 4465 /* called with rcu_read_lock held */ 4466 static int nf_tables_getset(struct sk_buff *skb, const struct nfnl_info *info, 4467 const struct nlattr * const nla[]) 4468 { 4469 struct netlink_ext_ack *extack = info->extack; 4470 u8 genmask = nft_genmask_cur(info->net); 4471 u8 family = info->nfmsg->nfgen_family; 4472 struct nft_table *table = NULL; 4473 struct net *net = info->net; 4474 const struct nft_set *set; 4475 struct sk_buff *skb2; 4476 struct nft_ctx ctx; 4477 int err; 4478 4479 if (nla[NFTA_SET_TABLE]) { 4480 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 4481 genmask, 0); 4482 if (IS_ERR(table)) { 4483 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4484 return PTR_ERR(table); 4485 } 4486 } 4487 4488 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4489 4490 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 4491 struct netlink_dump_control c = { 4492 .start = nf_tables_dump_sets_start, 4493 .dump = nf_tables_dump_sets, 4494 .done = nf_tables_dump_sets_done, 4495 .data = &ctx, 4496 .module = THIS_MODULE, 4497 }; 4498 4499 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4500 } 4501 4502 /* Only accept unspec with dump */ 4503 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 4504 return -EAFNOSUPPORT; 4505 if (!nla[NFTA_SET_TABLE]) 4506 return -EINVAL; 4507 4508 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 4509 if (IS_ERR(set)) 4510 return PTR_ERR(set); 4511 4512 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 4513 if (skb2 == NULL) 4514 return -ENOMEM; 4515 4516 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 4517 if (err < 0) 4518 goto err_fill_set_info; 4519 4520 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 4521 4522 err_fill_set_info: 4523 kfree_skb(skb2); 4524 return err; 4525 } 4526 4527 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = { 4528 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 }, 4529 }; 4530 4531 static int nft_set_desc_concat_parse(const struct nlattr *attr, 4532 struct nft_set_desc *desc) 4533 { 4534 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1]; 4535 u32 len; 4536 int err; 4537 4538 if (desc->field_count >= ARRAY_SIZE(desc->field_len)) 4539 return -E2BIG; 4540 4541 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, 4542 nft_concat_policy, NULL); 4543 if (err < 0) 4544 return err; 4545 4546 if (!tb[NFTA_SET_FIELD_LEN]) 4547 return -EINVAL; 4548 4549 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); 4550 if (!len || len > U8_MAX) 4551 return -EINVAL; 4552 4553 desc->field_len[desc->field_count++] = len; 4554 4555 return 0; 4556 } 4557 4558 static int nft_set_desc_concat(struct nft_set_desc *desc, 4559 const struct nlattr *nla) 4560 { 4561 struct nlattr *attr; 4562 u32 num_regs = 0; 4563 int rem, err, i; 4564 4565 nla_for_each_nested(attr, nla, rem) { 4566 if (nla_type(attr) != NFTA_LIST_ELEM) 4567 return -EINVAL; 4568 4569 err = nft_set_desc_concat_parse(attr, desc); 4570 if (err < 0) 4571 return err; 4572 } 4573 4574 for (i = 0; i < desc->field_count; i++) 4575 num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); 4576 4577 if (num_regs > NFT_REG32_COUNT) 4578 return -E2BIG; 4579 4580 return 0; 4581 } 4582 4583 static int nf_tables_set_desc_parse(struct nft_set_desc *desc, 4584 const struct nlattr *nla) 4585 { 4586 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 4587 int err; 4588 4589 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla, 4590 nft_set_desc_policy, NULL); 4591 if (err < 0) 4592 return err; 4593 4594 if (da[NFTA_SET_DESC_SIZE] != NULL) 4595 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 4596 if (da[NFTA_SET_DESC_CONCAT]) 4597 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]); 4598 4599 return err; 4600 } 4601 4602 static int nft_set_expr_alloc(struct nft_ctx *ctx, struct nft_set *set, 4603 const struct nlattr * const *nla, 4604 struct nft_expr **exprs, int *num_exprs, 4605 u32 flags) 4606 { 4607 struct nft_expr *expr; 4608 int err, i; 4609 4610 if (nla[NFTA_SET_EXPR]) { 4611 expr = nft_set_elem_expr_alloc(ctx, set, nla[NFTA_SET_EXPR]); 4612 if (IS_ERR(expr)) { 4613 err = PTR_ERR(expr); 4614 goto err_set_expr_alloc; 4615 } 4616 exprs[0] = expr; 4617 (*num_exprs)++; 4618 } else if (nla[NFTA_SET_EXPRESSIONS]) { 4619 struct nlattr *tmp; 4620 int left; 4621 4622 if (!(flags & NFT_SET_EXPR)) { 4623 err = -EINVAL; 4624 goto err_set_expr_alloc; 4625 } 4626 i = 0; 4627 nla_for_each_nested(tmp, nla[NFTA_SET_EXPRESSIONS], left) { 4628 if (i == NFT_SET_EXPR_MAX) { 4629 err = -E2BIG; 4630 goto err_set_expr_alloc; 4631 } 4632 if (nla_type(tmp) != NFTA_LIST_ELEM) { 4633 err = -EINVAL; 4634 goto err_set_expr_alloc; 4635 } 4636 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 4637 if (IS_ERR(expr)) { 4638 err = PTR_ERR(expr); 4639 goto err_set_expr_alloc; 4640 } 4641 exprs[i++] = expr; 4642 (*num_exprs)++; 4643 } 4644 } 4645 4646 return 0; 4647 4648 err_set_expr_alloc: 4649 for (i = 0; i < *num_exprs; i++) 4650 nft_expr_destroy(ctx, exprs[i]); 4651 4652 return err; 4653 } 4654 4655 static bool nft_set_is_same(const struct nft_set *set, 4656 const struct nft_set_desc *desc, 4657 struct nft_expr *exprs[], u32 num_exprs, u32 flags) 4658 { 4659 int i; 4660 4661 if (set->ktype != desc->ktype || 4662 set->dtype != desc->dtype || 4663 set->flags != flags || 4664 set->klen != desc->klen || 4665 set->dlen != desc->dlen || 4666 set->field_count != desc->field_count || 4667 set->num_exprs != num_exprs) 4668 return false; 4669 4670 for (i = 0; i < desc->field_count; i++) { 4671 if (set->field_len[i] != desc->field_len[i]) 4672 return false; 4673 } 4674 4675 for (i = 0; i < num_exprs; i++) { 4676 if (set->exprs[i]->ops != exprs[i]->ops) 4677 return false; 4678 } 4679 4680 return true; 4681 } 4682 4683 static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 4684 const struct nlattr * const nla[]) 4685 { 4686 struct netlink_ext_ack *extack = info->extack; 4687 u8 genmask = nft_genmask_next(info->net); 4688 u8 family = info->nfmsg->nfgen_family; 4689 const struct nft_set_ops *ops; 4690 struct net *net = info->net; 4691 struct nft_set_desc desc; 4692 struct nft_table *table; 4693 unsigned char *udata; 4694 struct nft_set *set; 4695 struct nft_ctx ctx; 4696 size_t alloc_size; 4697 int num_exprs = 0; 4698 char *name; 4699 int err, i; 4700 u16 udlen; 4701 u32 flags; 4702 u64 size; 4703 4704 if (nla[NFTA_SET_TABLE] == NULL || 4705 nla[NFTA_SET_NAME] == NULL || 4706 nla[NFTA_SET_KEY_LEN] == NULL || 4707 nla[NFTA_SET_ID] == NULL) 4708 return -EINVAL; 4709 4710 memset(&desc, 0, sizeof(desc)); 4711 4712 desc.ktype = NFT_DATA_VALUE; 4713 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 4714 desc.ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 4715 if ((desc.ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 4716 return -EINVAL; 4717 } 4718 4719 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 4720 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 4721 return -EINVAL; 4722 4723 flags = 0; 4724 if (nla[NFTA_SET_FLAGS] != NULL) { 4725 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 4726 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 4727 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 4728 NFT_SET_MAP | NFT_SET_EVAL | 4729 NFT_SET_OBJECT | NFT_SET_CONCAT | NFT_SET_EXPR)) 4730 return -EOPNOTSUPP; 4731 /* Only one of these operations is supported */ 4732 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) == 4733 (NFT_SET_MAP | NFT_SET_OBJECT)) 4734 return -EOPNOTSUPP; 4735 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == 4736 (NFT_SET_EVAL | NFT_SET_OBJECT)) 4737 return -EOPNOTSUPP; 4738 } 4739 4740 desc.dtype = 0; 4741 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 4742 if (!(flags & NFT_SET_MAP)) 4743 return -EINVAL; 4744 4745 desc.dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 4746 if ((desc.dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 4747 desc.dtype != NFT_DATA_VERDICT) 4748 return -EINVAL; 4749 4750 if (desc.dtype != NFT_DATA_VERDICT) { 4751 if (nla[NFTA_SET_DATA_LEN] == NULL) 4752 return -EINVAL; 4753 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 4754 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 4755 return -EINVAL; 4756 } else 4757 desc.dlen = sizeof(struct nft_verdict); 4758 } else if (flags & NFT_SET_MAP) 4759 return -EINVAL; 4760 4761 if (nla[NFTA_SET_OBJ_TYPE] != NULL) { 4762 if (!(flags & NFT_SET_OBJECT)) 4763 return -EINVAL; 4764 4765 desc.objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE])); 4766 if (desc.objtype == NFT_OBJECT_UNSPEC || 4767 desc.objtype > NFT_OBJECT_MAX) 4768 return -EOPNOTSUPP; 4769 } else if (flags & NFT_SET_OBJECT) 4770 return -EINVAL; 4771 else 4772 desc.objtype = NFT_OBJECT_UNSPEC; 4773 4774 desc.timeout = 0; 4775 if (nla[NFTA_SET_TIMEOUT] != NULL) { 4776 if (!(flags & NFT_SET_TIMEOUT)) 4777 return -EINVAL; 4778 4779 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &desc.timeout); 4780 if (err) 4781 return err; 4782 } 4783 desc.gc_int = 0; 4784 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 4785 if (!(flags & NFT_SET_TIMEOUT)) 4786 return -EINVAL; 4787 desc.gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 4788 } 4789 4790 desc.policy = NFT_SET_POL_PERFORMANCE; 4791 if (nla[NFTA_SET_POLICY] != NULL) 4792 desc.policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 4793 4794 if (nla[NFTA_SET_DESC] != NULL) { 4795 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); 4796 if (err < 0) 4797 return err; 4798 4799 if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT)) 4800 return -EINVAL; 4801 } else if (flags & NFT_SET_CONCAT) { 4802 return -EINVAL; 4803 } 4804 4805 if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS]) 4806 desc.expr = true; 4807 4808 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask, 4809 NETLINK_CB(skb).portid); 4810 if (IS_ERR(table)) { 4811 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4812 return PTR_ERR(table); 4813 } 4814 4815 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4816 4817 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 4818 if (IS_ERR(set)) { 4819 if (PTR_ERR(set) != -ENOENT) { 4820 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4821 return PTR_ERR(set); 4822 } 4823 } else { 4824 struct nft_expr *exprs[NFT_SET_EXPR_MAX] = {}; 4825 4826 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 4827 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4828 return -EEXIST; 4829 } 4830 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 4831 return -EOPNOTSUPP; 4832 4833 err = nft_set_expr_alloc(&ctx, set, nla, exprs, &num_exprs, flags); 4834 if (err < 0) 4835 return err; 4836 4837 err = 0; 4838 if (!nft_set_is_same(set, &desc, exprs, num_exprs, flags)) { 4839 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4840 err = -EEXIST; 4841 } 4842 4843 for (i = 0; i < num_exprs; i++) 4844 nft_expr_destroy(&ctx, exprs[i]); 4845 4846 if (err < 0) 4847 return err; 4848 4849 return __nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set, &desc); 4850 } 4851 4852 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE)) 4853 return -ENOENT; 4854 4855 ops = nft_select_set_ops(&ctx, nla, &desc); 4856 if (IS_ERR(ops)) 4857 return PTR_ERR(ops); 4858 4859 udlen = 0; 4860 if (nla[NFTA_SET_USERDATA]) 4861 udlen = nla_len(nla[NFTA_SET_USERDATA]); 4862 4863 size = 0; 4864 if (ops->privsize != NULL) 4865 size = ops->privsize(nla, &desc); 4866 alloc_size = sizeof(*set) + size + udlen; 4867 if (alloc_size < size || alloc_size > INT_MAX) 4868 return -ENOMEM; 4869 set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT); 4870 if (!set) 4871 return -ENOMEM; 4872 4873 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT); 4874 if (!name) { 4875 err = -ENOMEM; 4876 goto err_set_name; 4877 } 4878 4879 err = nf_tables_set_alloc_name(&ctx, set, name); 4880 kfree(name); 4881 if (err < 0) 4882 goto err_set_name; 4883 4884 udata = NULL; 4885 if (udlen) { 4886 udata = set->data + size; 4887 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen); 4888 } 4889 4890 INIT_LIST_HEAD(&set->bindings); 4891 INIT_LIST_HEAD(&set->catchall_list); 4892 set->table = table; 4893 write_pnet(&set->net, net); 4894 set->ops = ops; 4895 set->ktype = desc.ktype; 4896 set->klen = desc.klen; 4897 set->dtype = desc.dtype; 4898 set->objtype = desc.objtype; 4899 set->dlen = desc.dlen; 4900 set->flags = flags; 4901 set->size = desc.size; 4902 set->policy = desc.policy; 4903 set->udlen = udlen; 4904 set->udata = udata; 4905 set->timeout = desc.timeout; 4906 set->gc_int = desc.gc_int; 4907 4908 set->field_count = desc.field_count; 4909 for (i = 0; i < desc.field_count; i++) 4910 set->field_len[i] = desc.field_len[i]; 4911 4912 err = ops->init(set, &desc, nla); 4913 if (err < 0) 4914 goto err_set_init; 4915 4916 err = nft_set_expr_alloc(&ctx, set, nla, set->exprs, &num_exprs, flags); 4917 if (err < 0) 4918 goto err_set_destroy; 4919 4920 set->num_exprs = num_exprs; 4921 set->handle = nf_tables_alloc_handle(table); 4922 4923 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 4924 if (err < 0) 4925 goto err_set_expr_alloc; 4926 4927 list_add_tail_rcu(&set->list, &table->sets); 4928 table->use++; 4929 return 0; 4930 4931 err_set_expr_alloc: 4932 for (i = 0; i < set->num_exprs; i++) 4933 nft_expr_destroy(&ctx, set->exprs[i]); 4934 err_set_destroy: 4935 ops->destroy(set); 4936 err_set_init: 4937 kfree(set->name); 4938 err_set_name: 4939 kvfree(set); 4940 return err; 4941 } 4942 4943 static void nft_set_catchall_destroy(const struct nft_ctx *ctx, 4944 struct nft_set *set) 4945 { 4946 struct nft_set_elem_catchall *next, *catchall; 4947 4948 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 4949 list_del_rcu(&catchall->list); 4950 nft_set_elem_destroy(set, catchall->elem, true); 4951 kfree_rcu(catchall, rcu); 4952 } 4953 } 4954 4955 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 4956 { 4957 int i; 4958 4959 if (WARN_ON(set->use > 0)) 4960 return; 4961 4962 for (i = 0; i < set->num_exprs; i++) 4963 nft_expr_destroy(ctx, set->exprs[i]); 4964 4965 set->ops->destroy(set); 4966 nft_set_catchall_destroy(ctx, set); 4967 kfree(set->name); 4968 kvfree(set); 4969 } 4970 4971 static int nf_tables_delset(struct sk_buff *skb, const struct nfnl_info *info, 4972 const struct nlattr * const nla[]) 4973 { 4974 struct netlink_ext_ack *extack = info->extack; 4975 u8 genmask = nft_genmask_next(info->net); 4976 u8 family = info->nfmsg->nfgen_family; 4977 struct net *net = info->net; 4978 const struct nlattr *attr; 4979 struct nft_table *table; 4980 struct nft_set *set; 4981 struct nft_ctx ctx; 4982 4983 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 4984 return -EAFNOSUPPORT; 4985 4986 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 4987 genmask, NETLINK_CB(skb).portid); 4988 if (IS_ERR(table)) { 4989 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4990 return PTR_ERR(table); 4991 } 4992 4993 if (nla[NFTA_SET_HANDLE]) { 4994 attr = nla[NFTA_SET_HANDLE]; 4995 set = nft_set_lookup_byhandle(table, attr, genmask); 4996 } else { 4997 attr = nla[NFTA_SET_NAME]; 4998 set = nft_set_lookup(table, attr, genmask); 4999 } 5000 5001 if (IS_ERR(set)) { 5002 if (PTR_ERR(set) == -ENOENT && 5003 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSET) 5004 return 0; 5005 5006 NL_SET_BAD_ATTR(extack, attr); 5007 return PTR_ERR(set); 5008 } 5009 if (set->use || 5010 (info->nlh->nlmsg_flags & NLM_F_NONREC && 5011 atomic_read(&set->nelems) > 0)) { 5012 NL_SET_BAD_ATTR(extack, attr); 5013 return -EBUSY; 5014 } 5015 5016 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5017 5018 return nft_delset(&ctx, set); 5019 } 5020 5021 static int nft_validate_register_store(const struct nft_ctx *ctx, 5022 enum nft_registers reg, 5023 const struct nft_data *data, 5024 enum nft_data_types type, 5025 unsigned int len); 5026 5027 static int nft_setelem_data_validate(const struct nft_ctx *ctx, 5028 struct nft_set *set, 5029 struct nft_set_elem *elem) 5030 { 5031 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5032 enum nft_registers dreg; 5033 5034 dreg = nft_type_to_reg(set->dtype); 5035 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 5036 set->dtype == NFT_DATA_VERDICT ? 5037 NFT_DATA_VERDICT : NFT_DATA_VALUE, 5038 set->dlen); 5039 } 5040 5041 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 5042 struct nft_set *set, 5043 const struct nft_set_iter *iter, 5044 struct nft_set_elem *elem) 5045 { 5046 return nft_setelem_data_validate(ctx, set, elem); 5047 } 5048 5049 static int nft_set_catchall_bind_check(const struct nft_ctx *ctx, 5050 struct nft_set *set) 5051 { 5052 u8 genmask = nft_genmask_next(ctx->net); 5053 struct nft_set_elem_catchall *catchall; 5054 struct nft_set_elem elem; 5055 struct nft_set_ext *ext; 5056 int ret = 0; 5057 5058 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5059 ext = nft_set_elem_ext(set, catchall->elem); 5060 if (!nft_set_elem_active(ext, genmask)) 5061 continue; 5062 5063 elem.priv = catchall->elem; 5064 ret = nft_setelem_data_validate(ctx, set, &elem); 5065 if (ret < 0) 5066 break; 5067 } 5068 5069 return ret; 5070 } 5071 5072 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 5073 struct nft_set_binding *binding) 5074 { 5075 struct nft_set_binding *i; 5076 struct nft_set_iter iter; 5077 5078 if (set->use == UINT_MAX) 5079 return -EOVERFLOW; 5080 5081 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5082 return -EBUSY; 5083 5084 if (binding->flags & NFT_SET_MAP) { 5085 /* If the set is already bound to the same chain all 5086 * jumps are already validated for that chain. 5087 */ 5088 list_for_each_entry(i, &set->bindings, list) { 5089 if (i->flags & NFT_SET_MAP && 5090 i->chain == binding->chain) 5091 goto bind; 5092 } 5093 5094 iter.genmask = nft_genmask_next(ctx->net); 5095 iter.skip = 0; 5096 iter.count = 0; 5097 iter.err = 0; 5098 iter.fn = nf_tables_bind_check_setelem; 5099 5100 set->ops->walk(ctx, set, &iter); 5101 if (!iter.err) 5102 iter.err = nft_set_catchall_bind_check(ctx, set); 5103 5104 if (iter.err < 0) 5105 return iter.err; 5106 } 5107 bind: 5108 binding->chain = ctx->chain; 5109 list_add_tail_rcu(&binding->list, &set->bindings); 5110 nft_set_trans_bind(ctx, set); 5111 set->use++; 5112 5113 return 0; 5114 } 5115 EXPORT_SYMBOL_GPL(nf_tables_bind_set); 5116 5117 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 5118 struct nft_set_binding *binding, bool event) 5119 { 5120 list_del_rcu(&binding->list); 5121 5122 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { 5123 list_del_rcu(&set->list); 5124 if (event) 5125 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, 5126 GFP_KERNEL); 5127 } 5128 } 5129 5130 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) 5131 { 5132 if (nft_set_is_anonymous(set)) 5133 nft_clear(ctx->net, set); 5134 5135 set->use++; 5136 } 5137 EXPORT_SYMBOL_GPL(nf_tables_activate_set); 5138 5139 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, 5140 struct nft_set_binding *binding, 5141 enum nft_trans_phase phase) 5142 { 5143 switch (phase) { 5144 case NFT_TRANS_PREPARE: 5145 if (nft_set_is_anonymous(set)) 5146 nft_deactivate_next(ctx->net, set); 5147 5148 set->use--; 5149 return; 5150 case NFT_TRANS_ABORT: 5151 case NFT_TRANS_RELEASE: 5152 set->use--; 5153 fallthrough; 5154 default: 5155 nf_tables_unbind_set(ctx, set, binding, 5156 phase == NFT_TRANS_COMMIT); 5157 } 5158 } 5159 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set); 5160 5161 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set) 5162 { 5163 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5164 nft_set_destroy(ctx, set); 5165 } 5166 EXPORT_SYMBOL_GPL(nf_tables_destroy_set); 5167 5168 const struct nft_set_ext_type nft_set_ext_types[] = { 5169 [NFT_SET_EXT_KEY] = { 5170 .align = __alignof__(u32), 5171 }, 5172 [NFT_SET_EXT_DATA] = { 5173 .align = __alignof__(u32), 5174 }, 5175 [NFT_SET_EXT_EXPRESSIONS] = { 5176 .align = __alignof__(struct nft_set_elem_expr), 5177 }, 5178 [NFT_SET_EXT_OBJREF] = { 5179 .len = sizeof(struct nft_object *), 5180 .align = __alignof__(struct nft_object *), 5181 }, 5182 [NFT_SET_EXT_FLAGS] = { 5183 .len = sizeof(u8), 5184 .align = __alignof__(u8), 5185 }, 5186 [NFT_SET_EXT_TIMEOUT] = { 5187 .len = sizeof(u64), 5188 .align = __alignof__(u64), 5189 }, 5190 [NFT_SET_EXT_EXPIRATION] = { 5191 .len = sizeof(u64), 5192 .align = __alignof__(u64), 5193 }, 5194 [NFT_SET_EXT_USERDATA] = { 5195 .len = sizeof(struct nft_userdata), 5196 .align = __alignof__(struct nft_userdata), 5197 }, 5198 [NFT_SET_EXT_KEY_END] = { 5199 .align = __alignof__(u32), 5200 }, 5201 }; 5202 5203 /* 5204 * Set elements 5205 */ 5206 5207 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 5208 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 5209 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 5210 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 5211 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 5212 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 }, 5213 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 5214 .len = NFT_USERDATA_MAXLEN }, 5215 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, 5216 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING, 5217 .len = NFT_OBJ_MAXNAMELEN - 1 }, 5218 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED }, 5219 [NFTA_SET_ELEM_EXPRESSIONS] = { .type = NLA_NESTED }, 5220 }; 5221 5222 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 5223 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING, 5224 .len = NFT_TABLE_MAXNAMELEN - 1 }, 5225 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING, 5226 .len = NFT_SET_MAXNAMELEN - 1 }, 5227 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED }, 5228 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 5229 }; 5230 5231 static int nft_set_elem_expr_dump(struct sk_buff *skb, 5232 const struct nft_set *set, 5233 const struct nft_set_ext *ext) 5234 { 5235 struct nft_set_elem_expr *elem_expr; 5236 u32 size, num_exprs = 0; 5237 struct nft_expr *expr; 5238 struct nlattr *nest; 5239 5240 elem_expr = nft_set_ext_expr(ext); 5241 nft_setelem_expr_foreach(expr, elem_expr, size) 5242 num_exprs++; 5243 5244 if (num_exprs == 1) { 5245 expr = nft_setelem_expr_at(elem_expr, 0); 5246 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, false) < 0) 5247 return -1; 5248 5249 return 0; 5250 } else if (num_exprs > 1) { 5251 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_EXPRESSIONS); 5252 if (nest == NULL) 5253 goto nla_put_failure; 5254 5255 nft_setelem_expr_foreach(expr, elem_expr, size) { 5256 expr = nft_setelem_expr_at(elem_expr, size); 5257 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, false) < 0) 5258 goto nla_put_failure; 5259 } 5260 nla_nest_end(skb, nest); 5261 } 5262 return 0; 5263 5264 nla_put_failure: 5265 return -1; 5266 } 5267 5268 static int nf_tables_fill_setelem(struct sk_buff *skb, 5269 const struct nft_set *set, 5270 const struct nft_set_elem *elem) 5271 { 5272 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5273 unsigned char *b = skb_tail_pointer(skb); 5274 struct nlattr *nest; 5275 5276 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 5277 if (nest == NULL) 5278 goto nla_put_failure; 5279 5280 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 5281 nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 5282 NFT_DATA_VALUE, set->klen) < 0) 5283 goto nla_put_failure; 5284 5285 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 5286 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext), 5287 NFT_DATA_VALUE, set->klen) < 0) 5288 goto nla_put_failure; 5289 5290 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 5291 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 5292 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, 5293 set->dlen) < 0) 5294 goto nla_put_failure; 5295 5296 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && 5297 nft_set_elem_expr_dump(skb, set, ext)) 5298 goto nla_put_failure; 5299 5300 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 5301 nla_put_string(skb, NFTA_SET_ELEM_OBJREF, 5302 (*nft_set_ext_obj(ext))->key.name) < 0) 5303 goto nla_put_failure; 5304 5305 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 5306 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 5307 htonl(*nft_set_ext_flags(ext)))) 5308 goto nla_put_failure; 5309 5310 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) && 5311 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, 5312 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)), 5313 NFTA_SET_ELEM_PAD)) 5314 goto nla_put_failure; 5315 5316 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 5317 u64 expires, now = get_jiffies_64(); 5318 5319 expires = *nft_set_ext_expiration(ext); 5320 if (time_before64(now, expires)) 5321 expires -= now; 5322 else 5323 expires = 0; 5324 5325 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 5326 nf_jiffies64_to_msecs(expires), 5327 NFTA_SET_ELEM_PAD)) 5328 goto nla_put_failure; 5329 } 5330 5331 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 5332 struct nft_userdata *udata; 5333 5334 udata = nft_set_ext_userdata(ext); 5335 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 5336 udata->len + 1, udata->data)) 5337 goto nla_put_failure; 5338 } 5339 5340 nla_nest_end(skb, nest); 5341 return 0; 5342 5343 nla_put_failure: 5344 nlmsg_trim(skb, b); 5345 return -EMSGSIZE; 5346 } 5347 5348 struct nft_set_dump_args { 5349 const struct netlink_callback *cb; 5350 struct nft_set_iter iter; 5351 struct sk_buff *skb; 5352 }; 5353 5354 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 5355 struct nft_set *set, 5356 const struct nft_set_iter *iter, 5357 struct nft_set_elem *elem) 5358 { 5359 struct nft_set_dump_args *args; 5360 5361 args = container_of(iter, struct nft_set_dump_args, iter); 5362 return nf_tables_fill_setelem(args->skb, set, elem); 5363 } 5364 5365 struct nft_set_dump_ctx { 5366 const struct nft_set *set; 5367 struct nft_ctx ctx; 5368 }; 5369 5370 static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb, 5371 const struct nft_set *set) 5372 { 5373 struct nft_set_elem_catchall *catchall; 5374 u8 genmask = nft_genmask_cur(net); 5375 struct nft_set_elem elem; 5376 struct nft_set_ext *ext; 5377 int ret = 0; 5378 5379 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5380 ext = nft_set_elem_ext(set, catchall->elem); 5381 if (!nft_set_elem_active(ext, genmask) || 5382 nft_set_elem_expired(ext)) 5383 continue; 5384 5385 elem.priv = catchall->elem; 5386 ret = nf_tables_fill_setelem(skb, set, &elem); 5387 break; 5388 } 5389 5390 return ret; 5391 } 5392 5393 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 5394 { 5395 struct nft_set_dump_ctx *dump_ctx = cb->data; 5396 struct net *net = sock_net(skb->sk); 5397 struct nftables_pernet *nft_net; 5398 struct nft_table *table; 5399 struct nft_set *set; 5400 struct nft_set_dump_args args; 5401 bool set_found = false; 5402 struct nlmsghdr *nlh; 5403 struct nlattr *nest; 5404 u32 portid, seq; 5405 int event; 5406 5407 rcu_read_lock(); 5408 nft_net = nft_pernet(net); 5409 cb->seq = READ_ONCE(nft_net->base_seq); 5410 5411 list_for_each_entry_rcu(table, &nft_net->tables, list) { 5412 if (dump_ctx->ctx.family != NFPROTO_UNSPEC && 5413 dump_ctx->ctx.family != table->family) 5414 continue; 5415 5416 if (table != dump_ctx->ctx.table) 5417 continue; 5418 5419 list_for_each_entry_rcu(set, &table->sets, list) { 5420 if (set == dump_ctx->set) { 5421 set_found = true; 5422 break; 5423 } 5424 } 5425 break; 5426 } 5427 5428 if (!set_found) { 5429 rcu_read_unlock(); 5430 return -ENOENT; 5431 } 5432 5433 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM); 5434 portid = NETLINK_CB(cb->skb).portid; 5435 seq = cb->nlh->nlmsg_seq; 5436 5437 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, 5438 table->family, NFNETLINK_V0, nft_base_seq(net)); 5439 if (!nlh) 5440 goto nla_put_failure; 5441 5442 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) 5443 goto nla_put_failure; 5444 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 5445 goto nla_put_failure; 5446 5447 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5448 if (nest == NULL) 5449 goto nla_put_failure; 5450 5451 args.cb = cb; 5452 args.skb = skb; 5453 args.iter.genmask = nft_genmask_cur(net); 5454 args.iter.skip = cb->args[0]; 5455 args.iter.count = 0; 5456 args.iter.err = 0; 5457 args.iter.fn = nf_tables_dump_setelem; 5458 set->ops->walk(&dump_ctx->ctx, set, &args.iter); 5459 5460 if (!args.iter.err && args.iter.count == cb->args[0]) 5461 args.iter.err = nft_set_catchall_dump(net, skb, set); 5462 rcu_read_unlock(); 5463 5464 nla_nest_end(skb, nest); 5465 nlmsg_end(skb, nlh); 5466 5467 if (args.iter.err && args.iter.err != -EMSGSIZE) 5468 return args.iter.err; 5469 if (args.iter.count == cb->args[0]) 5470 return 0; 5471 5472 cb->args[0] = args.iter.count; 5473 return skb->len; 5474 5475 nla_put_failure: 5476 rcu_read_unlock(); 5477 return -ENOSPC; 5478 } 5479 5480 static int nf_tables_dump_set_start(struct netlink_callback *cb) 5481 { 5482 struct nft_set_dump_ctx *dump_ctx = cb->data; 5483 5484 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC); 5485 5486 return cb->data ? 0 : -ENOMEM; 5487 } 5488 5489 static int nf_tables_dump_set_done(struct netlink_callback *cb) 5490 { 5491 kfree(cb->data); 5492 return 0; 5493 } 5494 5495 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 5496 const struct nft_ctx *ctx, u32 seq, 5497 u32 portid, int event, u16 flags, 5498 const struct nft_set *set, 5499 const struct nft_set_elem *elem) 5500 { 5501 struct nlmsghdr *nlh; 5502 struct nlattr *nest; 5503 int err; 5504 5505 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 5506 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 5507 NFNETLINK_V0, nft_base_seq(ctx->net)); 5508 if (!nlh) 5509 goto nla_put_failure; 5510 5511 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 5512 goto nla_put_failure; 5513 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 5514 goto nla_put_failure; 5515 5516 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5517 if (nest == NULL) 5518 goto nla_put_failure; 5519 5520 err = nf_tables_fill_setelem(skb, set, elem); 5521 if (err < 0) 5522 goto nla_put_failure; 5523 5524 nla_nest_end(skb, nest); 5525 5526 nlmsg_end(skb, nlh); 5527 return 0; 5528 5529 nla_put_failure: 5530 nlmsg_trim(skb, nlh); 5531 return -1; 5532 } 5533 5534 static int nft_setelem_parse_flags(const struct nft_set *set, 5535 const struct nlattr *attr, u32 *flags) 5536 { 5537 if (attr == NULL) 5538 return 0; 5539 5540 *flags = ntohl(nla_get_be32(attr)); 5541 if (*flags & ~(NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5542 return -EOPNOTSUPP; 5543 if (!(set->flags & NFT_SET_INTERVAL) && 5544 *flags & NFT_SET_ELEM_INTERVAL_END) 5545 return -EINVAL; 5546 if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == 5547 (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5548 return -EINVAL; 5549 5550 return 0; 5551 } 5552 5553 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set, 5554 struct nft_data *key, struct nlattr *attr) 5555 { 5556 struct nft_data_desc desc = { 5557 .type = NFT_DATA_VALUE, 5558 .size = NFT_DATA_VALUE_MAXLEN, 5559 .len = set->klen, 5560 }; 5561 5562 return nft_data_init(ctx, key, &desc, attr); 5563 } 5564 5565 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, 5566 struct nft_data_desc *desc, 5567 struct nft_data *data, 5568 struct nlattr *attr) 5569 { 5570 u32 dtype; 5571 5572 if (set->dtype == NFT_DATA_VERDICT) 5573 dtype = NFT_DATA_VERDICT; 5574 else 5575 dtype = NFT_DATA_VALUE; 5576 5577 desc->type = dtype; 5578 desc->size = NFT_DATA_VALUE_MAXLEN; 5579 desc->len = set->dlen; 5580 desc->flags = NFT_DATA_DESC_SETELEM; 5581 5582 return nft_data_init(ctx, data, desc, attr); 5583 } 5584 5585 static void *nft_setelem_catchall_get(const struct net *net, 5586 const struct nft_set *set) 5587 { 5588 struct nft_set_elem_catchall *catchall; 5589 u8 genmask = nft_genmask_cur(net); 5590 struct nft_set_ext *ext; 5591 void *priv = NULL; 5592 5593 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5594 ext = nft_set_elem_ext(set, catchall->elem); 5595 if (!nft_set_elem_active(ext, genmask) || 5596 nft_set_elem_expired(ext)) 5597 continue; 5598 5599 priv = catchall->elem; 5600 break; 5601 } 5602 5603 return priv; 5604 } 5605 5606 static int nft_setelem_get(struct nft_ctx *ctx, struct nft_set *set, 5607 struct nft_set_elem *elem, u32 flags) 5608 { 5609 void *priv; 5610 5611 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 5612 priv = set->ops->get(ctx->net, set, elem, flags); 5613 if (IS_ERR(priv)) 5614 return PTR_ERR(priv); 5615 } else { 5616 priv = nft_setelem_catchall_get(ctx->net, set); 5617 if (!priv) 5618 return -ENOENT; 5619 } 5620 elem->priv = priv; 5621 5622 return 0; 5623 } 5624 5625 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, 5626 const struct nlattr *attr) 5627 { 5628 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 5629 struct nft_set_elem elem; 5630 struct sk_buff *skb; 5631 uint32_t flags = 0; 5632 int err; 5633 5634 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 5635 nft_set_elem_policy, NULL); 5636 if (err < 0) 5637 return err; 5638 5639 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 5640 if (err < 0) 5641 return err; 5642 5643 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 5644 return -EINVAL; 5645 5646 if (nla[NFTA_SET_ELEM_KEY]) { 5647 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 5648 nla[NFTA_SET_ELEM_KEY]); 5649 if (err < 0) 5650 return err; 5651 } 5652 5653 if (nla[NFTA_SET_ELEM_KEY_END]) { 5654 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 5655 nla[NFTA_SET_ELEM_KEY_END]); 5656 if (err < 0) 5657 return err; 5658 } 5659 5660 err = nft_setelem_get(ctx, set, &elem, flags); 5661 if (err < 0) 5662 return err; 5663 5664 err = -ENOMEM; 5665 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 5666 if (skb == NULL) 5667 return err; 5668 5669 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, 5670 NFT_MSG_NEWSETELEM, 0, set, &elem); 5671 if (err < 0) 5672 goto err_fill_setelem; 5673 5674 return nfnetlink_unicast(skb, ctx->net, ctx->portid); 5675 5676 err_fill_setelem: 5677 kfree_skb(skb); 5678 return err; 5679 } 5680 5681 /* called with rcu_read_lock held */ 5682 static int nf_tables_getsetelem(struct sk_buff *skb, 5683 const struct nfnl_info *info, 5684 const struct nlattr * const nla[]) 5685 { 5686 struct netlink_ext_ack *extack = info->extack; 5687 u8 genmask = nft_genmask_cur(info->net); 5688 u8 family = info->nfmsg->nfgen_family; 5689 struct net *net = info->net; 5690 struct nft_table *table; 5691 struct nft_set *set; 5692 struct nlattr *attr; 5693 struct nft_ctx ctx; 5694 int rem, err = 0; 5695 5696 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 5697 genmask, 0); 5698 if (IS_ERR(table)) { 5699 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 5700 return PTR_ERR(table); 5701 } 5702 5703 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 5704 if (IS_ERR(set)) 5705 return PTR_ERR(set); 5706 5707 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5708 5709 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 5710 struct netlink_dump_control c = { 5711 .start = nf_tables_dump_set_start, 5712 .dump = nf_tables_dump_set, 5713 .done = nf_tables_dump_set_done, 5714 .module = THIS_MODULE, 5715 }; 5716 struct nft_set_dump_ctx dump_ctx = { 5717 .set = set, 5718 .ctx = ctx, 5719 }; 5720 5721 c.data = &dump_ctx; 5722 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 5723 } 5724 5725 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 5726 return -EINVAL; 5727 5728 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 5729 err = nft_get_set_elem(&ctx, set, attr); 5730 if (err < 0) { 5731 NL_SET_BAD_ATTR(extack, attr); 5732 break; 5733 } 5734 } 5735 5736 return err; 5737 } 5738 5739 static void nf_tables_setelem_notify(const struct nft_ctx *ctx, 5740 const struct nft_set *set, 5741 const struct nft_set_elem *elem, 5742 int event) 5743 { 5744 struct nftables_pernet *nft_net; 5745 struct net *net = ctx->net; 5746 u32 portid = ctx->portid; 5747 struct sk_buff *skb; 5748 u16 flags = 0; 5749 int err; 5750 5751 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 5752 return; 5753 5754 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 5755 if (skb == NULL) 5756 goto err; 5757 5758 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 5759 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 5760 5761 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 5762 set, elem); 5763 if (err < 0) { 5764 kfree_skb(skb); 5765 goto err; 5766 } 5767 5768 nft_net = nft_pernet(net); 5769 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 5770 return; 5771 err: 5772 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 5773 } 5774 5775 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx, 5776 int msg_type, 5777 struct nft_set *set) 5778 { 5779 struct nft_trans *trans; 5780 5781 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem)); 5782 if (trans == NULL) 5783 return NULL; 5784 5785 nft_trans_elem_set(trans) = set; 5786 return trans; 5787 } 5788 5789 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, 5790 const struct nft_set *set, 5791 const struct nlattr *attr) 5792 { 5793 struct nft_expr *expr; 5794 int err; 5795 5796 expr = nft_expr_init(ctx, attr); 5797 if (IS_ERR(expr)) 5798 return expr; 5799 5800 err = -EOPNOTSUPP; 5801 if (expr->ops->type->flags & NFT_EXPR_GC) { 5802 if (set->flags & NFT_SET_TIMEOUT) 5803 goto err_set_elem_expr; 5804 if (!set->ops->gc_init) 5805 goto err_set_elem_expr; 5806 set->ops->gc_init(set); 5807 } 5808 5809 return expr; 5810 5811 err_set_elem_expr: 5812 nft_expr_destroy(ctx, expr); 5813 return ERR_PTR(err); 5814 } 5815 5816 static int nft_set_ext_check(const struct nft_set_ext_tmpl *tmpl, u8 id, u32 len) 5817 { 5818 len += nft_set_ext_types[id].len; 5819 if (len > tmpl->ext_len[id] || 5820 len > U8_MAX) 5821 return -1; 5822 5823 return 0; 5824 } 5825 5826 static int nft_set_ext_memcpy(const struct nft_set_ext_tmpl *tmpl, u8 id, 5827 void *to, const void *from, u32 len) 5828 { 5829 if (nft_set_ext_check(tmpl, id, len) < 0) 5830 return -1; 5831 5832 memcpy(to, from, len); 5833 5834 return 0; 5835 } 5836 5837 void *nft_set_elem_init(const struct nft_set *set, 5838 const struct nft_set_ext_tmpl *tmpl, 5839 const u32 *key, const u32 *key_end, 5840 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp) 5841 { 5842 struct nft_set_ext *ext; 5843 void *elem; 5844 5845 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 5846 if (elem == NULL) 5847 return ERR_PTR(-ENOMEM); 5848 5849 ext = nft_set_elem_ext(set, elem); 5850 nft_set_ext_init(ext, tmpl); 5851 5852 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 5853 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY, 5854 nft_set_ext_key(ext), key, set->klen) < 0) 5855 goto err_ext_check; 5856 5857 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 5858 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY_END, 5859 nft_set_ext_key_end(ext), key_end, set->klen) < 0) 5860 goto err_ext_check; 5861 5862 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 5863 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_DATA, 5864 nft_set_ext_data(ext), data, set->dlen) < 0) 5865 goto err_ext_check; 5866 5867 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 5868 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration; 5869 if (expiration == 0) 5870 *nft_set_ext_expiration(ext) += timeout; 5871 } 5872 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) 5873 *nft_set_ext_timeout(ext) = timeout; 5874 5875 return elem; 5876 5877 err_ext_check: 5878 kfree(elem); 5879 5880 return ERR_PTR(-EINVAL); 5881 } 5882 5883 static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 5884 struct nft_expr *expr) 5885 { 5886 if (expr->ops->destroy_clone) { 5887 expr->ops->destroy_clone(ctx, expr); 5888 module_put(expr->ops->type->owner); 5889 } else { 5890 nf_tables_expr_destroy(ctx, expr); 5891 } 5892 } 5893 5894 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 5895 struct nft_set_elem_expr *elem_expr) 5896 { 5897 struct nft_expr *expr; 5898 u32 size; 5899 5900 nft_setelem_expr_foreach(expr, elem_expr, size) 5901 __nft_set_elem_expr_destroy(ctx, expr); 5902 } 5903 5904 void nft_set_elem_destroy(const struct nft_set *set, void *elem, 5905 bool destroy_expr) 5906 { 5907 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 5908 struct nft_ctx ctx = { 5909 .net = read_pnet(&set->net), 5910 .family = set->table->family, 5911 }; 5912 5913 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE); 5914 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 5915 nft_data_release(nft_set_ext_data(ext), set->dtype); 5916 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 5917 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext)); 5918 5919 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 5920 (*nft_set_ext_obj(ext))->use--; 5921 kfree(elem); 5922 } 5923 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 5924 5925 /* Only called from commit path, nft_setelem_data_deactivate() already deals 5926 * with the refcounting from the preparation phase. 5927 */ 5928 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, 5929 const struct nft_set *set, void *elem) 5930 { 5931 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 5932 5933 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 5934 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 5935 5936 kfree(elem); 5937 } 5938 5939 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 5940 struct nft_expr *expr_array[]) 5941 { 5942 struct nft_expr *expr; 5943 int err, i, k; 5944 5945 for (i = 0; i < set->num_exprs; i++) { 5946 expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT); 5947 if (!expr) 5948 goto err_expr; 5949 5950 err = nft_expr_clone(expr, set->exprs[i]); 5951 if (err < 0) { 5952 kfree(expr); 5953 goto err_expr; 5954 } 5955 expr_array[i] = expr; 5956 } 5957 5958 return 0; 5959 5960 err_expr: 5961 for (k = i - 1; k >= 0; k--) 5962 nft_expr_destroy(ctx, expr_array[k]); 5963 5964 return -ENOMEM; 5965 } 5966 5967 static int nft_set_elem_expr_setup(struct nft_ctx *ctx, 5968 const struct nft_set_ext_tmpl *tmpl, 5969 const struct nft_set_ext *ext, 5970 struct nft_expr *expr_array[], 5971 u32 num_exprs) 5972 { 5973 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 5974 u32 len = sizeof(struct nft_set_elem_expr); 5975 struct nft_expr *expr; 5976 int i, err; 5977 5978 if (num_exprs == 0) 5979 return 0; 5980 5981 for (i = 0; i < num_exprs; i++) 5982 len += expr_array[i]->ops->size; 5983 5984 if (nft_set_ext_check(tmpl, NFT_SET_EXT_EXPRESSIONS, len) < 0) 5985 return -EINVAL; 5986 5987 for (i = 0; i < num_exprs; i++) { 5988 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 5989 err = nft_expr_clone(expr, expr_array[i]); 5990 if (err < 0) 5991 goto err_elem_expr_setup; 5992 5993 elem_expr->size += expr_array[i]->ops->size; 5994 nft_expr_destroy(ctx, expr_array[i]); 5995 expr_array[i] = NULL; 5996 } 5997 5998 return 0; 5999 6000 err_elem_expr_setup: 6001 for (; i < num_exprs; i++) { 6002 nft_expr_destroy(ctx, expr_array[i]); 6003 expr_array[i] = NULL; 6004 } 6005 6006 return -ENOMEM; 6007 } 6008 6009 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, 6010 const struct nft_set *set) 6011 { 6012 struct nft_set_elem_catchall *catchall; 6013 u8 genmask = nft_genmask_cur(net); 6014 struct nft_set_ext *ext; 6015 6016 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6017 ext = nft_set_elem_ext(set, catchall->elem); 6018 if (nft_set_elem_active(ext, genmask) && 6019 !nft_set_elem_expired(ext)) 6020 return ext; 6021 } 6022 6023 return NULL; 6024 } 6025 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup); 6026 6027 void *nft_set_catchall_gc(const struct nft_set *set) 6028 { 6029 struct nft_set_elem_catchall *catchall, *next; 6030 struct nft_set_ext *ext; 6031 void *elem = NULL; 6032 6033 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 6034 ext = nft_set_elem_ext(set, catchall->elem); 6035 6036 if (!nft_set_elem_expired(ext) || 6037 nft_set_elem_mark_busy(ext)) 6038 continue; 6039 6040 elem = catchall->elem; 6041 list_del_rcu(&catchall->list); 6042 kfree_rcu(catchall, rcu); 6043 break; 6044 } 6045 6046 return elem; 6047 } 6048 EXPORT_SYMBOL_GPL(nft_set_catchall_gc); 6049 6050 static int nft_setelem_catchall_insert(const struct net *net, 6051 struct nft_set *set, 6052 const struct nft_set_elem *elem, 6053 struct nft_set_ext **pext) 6054 { 6055 struct nft_set_elem_catchall *catchall; 6056 u8 genmask = nft_genmask_next(net); 6057 struct nft_set_ext *ext; 6058 6059 list_for_each_entry(catchall, &set->catchall_list, list) { 6060 ext = nft_set_elem_ext(set, catchall->elem); 6061 if (nft_set_elem_active(ext, genmask)) { 6062 *pext = ext; 6063 return -EEXIST; 6064 } 6065 } 6066 6067 catchall = kmalloc(sizeof(*catchall), GFP_KERNEL); 6068 if (!catchall) 6069 return -ENOMEM; 6070 6071 catchall->elem = elem->priv; 6072 list_add_tail_rcu(&catchall->list, &set->catchall_list); 6073 6074 return 0; 6075 } 6076 6077 static int nft_setelem_insert(const struct net *net, 6078 struct nft_set *set, 6079 const struct nft_set_elem *elem, 6080 struct nft_set_ext **ext, unsigned int flags) 6081 { 6082 int ret; 6083 6084 if (flags & NFT_SET_ELEM_CATCHALL) 6085 ret = nft_setelem_catchall_insert(net, set, elem, ext); 6086 else 6087 ret = set->ops->insert(net, set, elem, ext); 6088 6089 return ret; 6090 } 6091 6092 static bool nft_setelem_is_catchall(const struct nft_set *set, 6093 const struct nft_set_elem *elem) 6094 { 6095 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6096 6097 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 6098 *nft_set_ext_flags(ext) & NFT_SET_ELEM_CATCHALL) 6099 return true; 6100 6101 return false; 6102 } 6103 6104 static void nft_setelem_activate(struct net *net, struct nft_set *set, 6105 struct nft_set_elem *elem) 6106 { 6107 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6108 6109 if (nft_setelem_is_catchall(set, elem)) { 6110 nft_set_elem_change_active(net, set, ext); 6111 nft_set_elem_clear_busy(ext); 6112 } else { 6113 set->ops->activate(net, set, elem); 6114 } 6115 } 6116 6117 static int nft_setelem_catchall_deactivate(const struct net *net, 6118 struct nft_set *set, 6119 struct nft_set_elem *elem) 6120 { 6121 struct nft_set_elem_catchall *catchall; 6122 struct nft_set_ext *ext; 6123 6124 list_for_each_entry(catchall, &set->catchall_list, list) { 6125 ext = nft_set_elem_ext(set, catchall->elem); 6126 if (!nft_is_active(net, ext) || 6127 nft_set_elem_mark_busy(ext)) 6128 continue; 6129 6130 kfree(elem->priv); 6131 elem->priv = catchall->elem; 6132 nft_set_elem_change_active(net, set, ext); 6133 return 0; 6134 } 6135 6136 return -ENOENT; 6137 } 6138 6139 static int __nft_setelem_deactivate(const struct net *net, 6140 struct nft_set *set, 6141 struct nft_set_elem *elem) 6142 { 6143 void *priv; 6144 6145 priv = set->ops->deactivate(net, set, elem); 6146 if (!priv) 6147 return -ENOENT; 6148 6149 kfree(elem->priv); 6150 elem->priv = priv; 6151 set->ndeact++; 6152 6153 return 0; 6154 } 6155 6156 static int nft_setelem_deactivate(const struct net *net, 6157 struct nft_set *set, 6158 struct nft_set_elem *elem, u32 flags) 6159 { 6160 int ret; 6161 6162 if (flags & NFT_SET_ELEM_CATCHALL) 6163 ret = nft_setelem_catchall_deactivate(net, set, elem); 6164 else 6165 ret = __nft_setelem_deactivate(net, set, elem); 6166 6167 return ret; 6168 } 6169 6170 static void nft_setelem_catchall_remove(const struct net *net, 6171 const struct nft_set *set, 6172 const struct nft_set_elem *elem) 6173 { 6174 struct nft_set_elem_catchall *catchall, *next; 6175 6176 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 6177 if (catchall->elem == elem->priv) { 6178 list_del_rcu(&catchall->list); 6179 kfree_rcu(catchall, rcu); 6180 break; 6181 } 6182 } 6183 } 6184 6185 static void nft_setelem_remove(const struct net *net, 6186 const struct nft_set *set, 6187 const struct nft_set_elem *elem) 6188 { 6189 if (nft_setelem_is_catchall(set, elem)) 6190 nft_setelem_catchall_remove(net, set, elem); 6191 else 6192 set->ops->remove(net, set, elem); 6193 } 6194 6195 static bool nft_setelem_valid_key_end(const struct nft_set *set, 6196 struct nlattr **nla, u32 flags) 6197 { 6198 if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) == 6199 (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { 6200 if (flags & NFT_SET_ELEM_INTERVAL_END) 6201 return false; 6202 6203 if (nla[NFTA_SET_ELEM_KEY_END] && 6204 flags & NFT_SET_ELEM_CATCHALL) 6205 return false; 6206 } else { 6207 if (nla[NFTA_SET_ELEM_KEY_END]) 6208 return false; 6209 } 6210 6211 return true; 6212 } 6213 6214 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 6215 const struct nlattr *attr, u32 nlmsg_flags) 6216 { 6217 struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {}; 6218 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6219 u8 genmask = nft_genmask_next(ctx->net); 6220 u32 flags = 0, size = 0, num_exprs = 0; 6221 struct nft_set_ext_tmpl tmpl; 6222 struct nft_set_ext *ext, *ext2; 6223 struct nft_set_elem elem; 6224 struct nft_set_binding *binding; 6225 struct nft_object *obj = NULL; 6226 struct nft_userdata *udata; 6227 struct nft_data_desc desc; 6228 enum nft_registers dreg; 6229 struct nft_trans *trans; 6230 u64 timeout; 6231 u64 expiration; 6232 int err, i; 6233 u8 ulen; 6234 6235 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6236 nft_set_elem_policy, NULL); 6237 if (err < 0) 6238 return err; 6239 6240 nft_set_ext_prepare(&tmpl); 6241 6242 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6243 if (err < 0) 6244 return err; 6245 6246 if (((flags & NFT_SET_ELEM_CATCHALL) && nla[NFTA_SET_ELEM_KEY]) || 6247 (!(flags & NFT_SET_ELEM_CATCHALL) && !nla[NFTA_SET_ELEM_KEY])) 6248 return -EINVAL; 6249 6250 if (flags != 0) { 6251 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 6252 if (err < 0) 6253 return err; 6254 } 6255 6256 if (set->flags & NFT_SET_MAP) { 6257 if (nla[NFTA_SET_ELEM_DATA] == NULL && 6258 !(flags & NFT_SET_ELEM_INTERVAL_END)) 6259 return -EINVAL; 6260 } else { 6261 if (nla[NFTA_SET_ELEM_DATA] != NULL) 6262 return -EINVAL; 6263 } 6264 6265 if (set->flags & NFT_SET_OBJECT) { 6266 if (!nla[NFTA_SET_ELEM_OBJREF] && 6267 !(flags & NFT_SET_ELEM_INTERVAL_END)) 6268 return -EINVAL; 6269 } else { 6270 if (nla[NFTA_SET_ELEM_OBJREF]) 6271 return -EINVAL; 6272 } 6273 6274 if (!nft_setelem_valid_key_end(set, nla, flags)) 6275 return -EINVAL; 6276 6277 if ((flags & NFT_SET_ELEM_INTERVAL_END) && 6278 (nla[NFTA_SET_ELEM_DATA] || 6279 nla[NFTA_SET_ELEM_OBJREF] || 6280 nla[NFTA_SET_ELEM_TIMEOUT] || 6281 nla[NFTA_SET_ELEM_EXPIRATION] || 6282 nla[NFTA_SET_ELEM_USERDATA] || 6283 nla[NFTA_SET_ELEM_EXPR] || 6284 nla[NFTA_SET_ELEM_KEY_END] || 6285 nla[NFTA_SET_ELEM_EXPRESSIONS])) 6286 return -EINVAL; 6287 6288 timeout = 0; 6289 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 6290 if (!(set->flags & NFT_SET_TIMEOUT)) 6291 return -EINVAL; 6292 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT], 6293 &timeout); 6294 if (err) 6295 return err; 6296 } else if (set->flags & NFT_SET_TIMEOUT && 6297 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6298 timeout = READ_ONCE(set->timeout); 6299 } 6300 6301 expiration = 0; 6302 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) { 6303 if (!(set->flags & NFT_SET_TIMEOUT)) 6304 return -EINVAL; 6305 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION], 6306 &expiration); 6307 if (err) 6308 return err; 6309 } 6310 6311 if (nla[NFTA_SET_ELEM_EXPR]) { 6312 struct nft_expr *expr; 6313 6314 if (set->num_exprs && set->num_exprs != 1) 6315 return -EOPNOTSUPP; 6316 6317 expr = nft_set_elem_expr_alloc(ctx, set, 6318 nla[NFTA_SET_ELEM_EXPR]); 6319 if (IS_ERR(expr)) 6320 return PTR_ERR(expr); 6321 6322 expr_array[0] = expr; 6323 num_exprs = 1; 6324 6325 if (set->num_exprs && set->exprs[0]->ops != expr->ops) { 6326 err = -EOPNOTSUPP; 6327 goto err_set_elem_expr; 6328 } 6329 } else if (nla[NFTA_SET_ELEM_EXPRESSIONS]) { 6330 struct nft_expr *expr; 6331 struct nlattr *tmp; 6332 int left; 6333 6334 i = 0; 6335 nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) { 6336 if (i == NFT_SET_EXPR_MAX || 6337 (set->num_exprs && set->num_exprs == i)) { 6338 err = -E2BIG; 6339 goto err_set_elem_expr; 6340 } 6341 if (nla_type(tmp) != NFTA_LIST_ELEM) { 6342 err = -EINVAL; 6343 goto err_set_elem_expr; 6344 } 6345 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 6346 if (IS_ERR(expr)) { 6347 err = PTR_ERR(expr); 6348 goto err_set_elem_expr; 6349 } 6350 expr_array[i] = expr; 6351 num_exprs++; 6352 6353 if (set->num_exprs && expr->ops != set->exprs[i]->ops) { 6354 err = -EOPNOTSUPP; 6355 goto err_set_elem_expr; 6356 } 6357 i++; 6358 } 6359 if (set->num_exprs && set->num_exprs != i) { 6360 err = -EOPNOTSUPP; 6361 goto err_set_elem_expr; 6362 } 6363 } else if (set->num_exprs > 0 && 6364 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6365 err = nft_set_elem_expr_clone(ctx, set, expr_array); 6366 if (err < 0) 6367 goto err_set_elem_expr_clone; 6368 6369 num_exprs = set->num_exprs; 6370 } 6371 6372 if (nla[NFTA_SET_ELEM_KEY]) { 6373 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6374 nla[NFTA_SET_ELEM_KEY]); 6375 if (err < 0) 6376 goto err_set_elem_expr; 6377 6378 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 6379 if (err < 0) 6380 goto err_parse_key; 6381 } 6382 6383 if (nla[NFTA_SET_ELEM_KEY_END]) { 6384 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6385 nla[NFTA_SET_ELEM_KEY_END]); 6386 if (err < 0) 6387 goto err_parse_key; 6388 6389 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 6390 if (err < 0) 6391 goto err_parse_key_end; 6392 } 6393 6394 if (timeout > 0) { 6395 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); 6396 if (err < 0) 6397 goto err_parse_key_end; 6398 6399 if (timeout != READ_ONCE(set->timeout)) { 6400 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 6401 if (err < 0) 6402 goto err_parse_key_end; 6403 } 6404 } 6405 6406 if (num_exprs) { 6407 for (i = 0; i < num_exprs; i++) 6408 size += expr_array[i]->ops->size; 6409 6410 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, 6411 sizeof(struct nft_set_elem_expr) + size); 6412 if (err < 0) 6413 goto err_parse_key_end; 6414 } 6415 6416 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { 6417 obj = nft_obj_lookup(ctx->net, ctx->table, 6418 nla[NFTA_SET_ELEM_OBJREF], 6419 set->objtype, genmask); 6420 if (IS_ERR(obj)) { 6421 err = PTR_ERR(obj); 6422 goto err_parse_key_end; 6423 } 6424 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); 6425 if (err < 0) 6426 goto err_parse_key_end; 6427 } 6428 6429 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 6430 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val, 6431 nla[NFTA_SET_ELEM_DATA]); 6432 if (err < 0) 6433 goto err_parse_key_end; 6434 6435 dreg = nft_type_to_reg(set->dtype); 6436 list_for_each_entry(binding, &set->bindings, list) { 6437 struct nft_ctx bind_ctx = { 6438 .net = ctx->net, 6439 .family = ctx->family, 6440 .table = ctx->table, 6441 .chain = (struct nft_chain *)binding->chain, 6442 }; 6443 6444 if (!(binding->flags & NFT_SET_MAP)) 6445 continue; 6446 6447 err = nft_validate_register_store(&bind_ctx, dreg, 6448 &elem.data.val, 6449 desc.type, desc.len); 6450 if (err < 0) 6451 goto err_parse_data; 6452 6453 if (desc.type == NFT_DATA_VERDICT && 6454 (elem.data.val.verdict.code == NFT_GOTO || 6455 elem.data.val.verdict.code == NFT_JUMP)) 6456 nft_validate_state_update(ctx->table, 6457 NFT_VALIDATE_NEED); 6458 } 6459 6460 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); 6461 if (err < 0) 6462 goto err_parse_data; 6463 } 6464 6465 /* The full maximum length of userdata can exceed the maximum 6466 * offset value (U8_MAX) for following extensions, therefor it 6467 * must be the last extension added. 6468 */ 6469 ulen = 0; 6470 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 6471 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 6472 if (ulen > 0) { 6473 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 6474 ulen); 6475 if (err < 0) 6476 goto err_parse_data; 6477 } 6478 } 6479 6480 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 6481 elem.key_end.val.data, elem.data.val.data, 6482 timeout, expiration, GFP_KERNEL_ACCOUNT); 6483 if (IS_ERR(elem.priv)) { 6484 err = PTR_ERR(elem.priv); 6485 goto err_parse_data; 6486 } 6487 6488 ext = nft_set_elem_ext(set, elem.priv); 6489 if (flags) 6490 *nft_set_ext_flags(ext) = flags; 6491 6492 if (ulen > 0) { 6493 if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) { 6494 err = -EINVAL; 6495 goto err_elem_userdata; 6496 } 6497 udata = nft_set_ext_userdata(ext); 6498 udata->len = ulen - 1; 6499 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 6500 } 6501 if (obj) { 6502 *nft_set_ext_obj(ext) = obj; 6503 obj->use++; 6504 } 6505 err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs); 6506 if (err < 0) 6507 goto err_elem_free; 6508 6509 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 6510 if (trans == NULL) { 6511 err = -ENOMEM; 6512 goto err_elem_free; 6513 } 6514 6515 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK; 6516 6517 err = nft_setelem_insert(ctx->net, set, &elem, &ext2, flags); 6518 if (err) { 6519 if (err == -EEXIST) { 6520 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ 6521 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || 6522 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ 6523 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) 6524 goto err_element_clash; 6525 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6526 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && 6527 memcmp(nft_set_ext_data(ext), 6528 nft_set_ext_data(ext2), set->dlen) != 0) || 6529 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 6530 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) && 6531 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) 6532 goto err_element_clash; 6533 else if (!(nlmsg_flags & NLM_F_EXCL)) 6534 err = 0; 6535 } else if (err == -ENOTEMPTY) { 6536 /* ENOTEMPTY reports overlapping between this element 6537 * and an existing one. 6538 */ 6539 err = -EEXIST; 6540 } 6541 goto err_element_clash; 6542 } 6543 6544 if (!(flags & NFT_SET_ELEM_CATCHALL) && set->size && 6545 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) { 6546 err = -ENFILE; 6547 goto err_set_full; 6548 } 6549 6550 nft_trans_elem(trans) = elem; 6551 nft_trans_commit_list_add_tail(ctx->net, trans); 6552 return 0; 6553 6554 err_set_full: 6555 nft_setelem_remove(ctx->net, set, &elem); 6556 err_element_clash: 6557 kfree(trans); 6558 err_elem_free: 6559 if (obj) 6560 obj->use--; 6561 err_elem_userdata: 6562 nf_tables_set_elem_destroy(ctx, set, elem.priv); 6563 err_parse_data: 6564 if (nla[NFTA_SET_ELEM_DATA] != NULL) 6565 nft_data_release(&elem.data.val, desc.type); 6566 err_parse_key_end: 6567 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 6568 err_parse_key: 6569 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 6570 err_set_elem_expr: 6571 for (i = 0; i < num_exprs && expr_array[i]; i++) 6572 nft_expr_destroy(ctx, expr_array[i]); 6573 err_set_elem_expr_clone: 6574 return err; 6575 } 6576 6577 static int nf_tables_newsetelem(struct sk_buff *skb, 6578 const struct nfnl_info *info, 6579 const struct nlattr * const nla[]) 6580 { 6581 struct netlink_ext_ack *extack = info->extack; 6582 u8 genmask = nft_genmask_next(info->net); 6583 u8 family = info->nfmsg->nfgen_family; 6584 struct net *net = info->net; 6585 const struct nlattr *attr; 6586 struct nft_table *table; 6587 struct nft_set *set; 6588 struct nft_ctx ctx; 6589 int rem, err; 6590 6591 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 6592 return -EINVAL; 6593 6594 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6595 genmask, NETLINK_CB(skb).portid); 6596 if (IS_ERR(table)) { 6597 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6598 return PTR_ERR(table); 6599 } 6600 6601 set = nft_set_lookup_global(net, table, nla[NFTA_SET_ELEM_LIST_SET], 6602 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask); 6603 if (IS_ERR(set)) 6604 return PTR_ERR(set); 6605 6606 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 6607 return -EBUSY; 6608 6609 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6610 6611 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6612 err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags); 6613 if (err < 0) { 6614 NL_SET_BAD_ATTR(extack, attr); 6615 return err; 6616 } 6617 } 6618 6619 if (table->validate_state == NFT_VALIDATE_DO) 6620 return nft_table_validate(net, table); 6621 6622 return 0; 6623 } 6624 6625 /** 6626 * nft_data_hold - hold a nft_data item 6627 * 6628 * @data: struct nft_data to release 6629 * @type: type of data 6630 * 6631 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded, 6632 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and 6633 * NFT_GOTO verdicts. This function must be called on active data objects 6634 * from the second phase of the commit protocol. 6635 */ 6636 void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 6637 { 6638 struct nft_chain *chain; 6639 struct nft_rule *rule; 6640 6641 if (type == NFT_DATA_VERDICT) { 6642 switch (data->verdict.code) { 6643 case NFT_JUMP: 6644 case NFT_GOTO: 6645 chain = data->verdict.chain; 6646 chain->use++; 6647 6648 if (!nft_chain_is_bound(chain)) 6649 break; 6650 6651 chain->table->use++; 6652 list_for_each_entry(rule, &chain->rules, list) 6653 chain->use++; 6654 6655 nft_chain_add(chain->table, chain); 6656 break; 6657 } 6658 } 6659 } 6660 6661 static void nft_setelem_data_activate(const struct net *net, 6662 const struct nft_set *set, 6663 struct nft_set_elem *elem) 6664 { 6665 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6666 6667 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6668 nft_data_hold(nft_set_ext_data(ext), set->dtype); 6669 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6670 (*nft_set_ext_obj(ext))->use++; 6671 } 6672 6673 static void nft_setelem_data_deactivate(const struct net *net, 6674 const struct nft_set *set, 6675 struct nft_set_elem *elem) 6676 { 6677 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6678 6679 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6680 nft_data_release(nft_set_ext_data(ext), set->dtype); 6681 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6682 (*nft_set_ext_obj(ext))->use--; 6683 } 6684 6685 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 6686 const struct nlattr *attr) 6687 { 6688 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6689 struct nft_set_ext_tmpl tmpl; 6690 struct nft_set_elem elem; 6691 struct nft_set_ext *ext; 6692 struct nft_trans *trans; 6693 u32 flags = 0; 6694 int err; 6695 6696 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6697 nft_set_elem_policy, NULL); 6698 if (err < 0) 6699 return err; 6700 6701 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6702 if (err < 0) 6703 return err; 6704 6705 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 6706 return -EINVAL; 6707 6708 if (!nft_setelem_valid_key_end(set, nla, flags)) 6709 return -EINVAL; 6710 6711 nft_set_ext_prepare(&tmpl); 6712 6713 if (flags != 0) { 6714 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 6715 if (err < 0) 6716 return err; 6717 } 6718 6719 if (nla[NFTA_SET_ELEM_KEY]) { 6720 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6721 nla[NFTA_SET_ELEM_KEY]); 6722 if (err < 0) 6723 return err; 6724 6725 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 6726 if (err < 0) 6727 goto fail_elem; 6728 } 6729 6730 if (nla[NFTA_SET_ELEM_KEY_END]) { 6731 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6732 nla[NFTA_SET_ELEM_KEY_END]); 6733 if (err < 0) 6734 goto fail_elem; 6735 6736 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 6737 if (err < 0) 6738 goto fail_elem_key_end; 6739 } 6740 6741 err = -ENOMEM; 6742 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 6743 elem.key_end.val.data, NULL, 0, 0, 6744 GFP_KERNEL_ACCOUNT); 6745 if (IS_ERR(elem.priv)) { 6746 err = PTR_ERR(elem.priv); 6747 goto fail_elem_key_end; 6748 } 6749 6750 ext = nft_set_elem_ext(set, elem.priv); 6751 if (flags) 6752 *nft_set_ext_flags(ext) = flags; 6753 6754 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 6755 if (trans == NULL) 6756 goto fail_trans; 6757 6758 err = nft_setelem_deactivate(ctx->net, set, &elem, flags); 6759 if (err < 0) 6760 goto fail_ops; 6761 6762 nft_setelem_data_deactivate(ctx->net, set, &elem); 6763 6764 nft_trans_elem(trans) = elem; 6765 nft_trans_commit_list_add_tail(ctx->net, trans); 6766 return 0; 6767 6768 fail_ops: 6769 kfree(trans); 6770 fail_trans: 6771 kfree(elem.priv); 6772 fail_elem_key_end: 6773 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 6774 fail_elem: 6775 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 6776 return err; 6777 } 6778 6779 static int nft_setelem_flush(const struct nft_ctx *ctx, 6780 struct nft_set *set, 6781 const struct nft_set_iter *iter, 6782 struct nft_set_elem *elem) 6783 { 6784 struct nft_trans *trans; 6785 int err; 6786 6787 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 6788 sizeof(struct nft_trans_elem), GFP_ATOMIC); 6789 if (!trans) 6790 return -ENOMEM; 6791 6792 if (!set->ops->flush(ctx->net, set, elem->priv)) { 6793 err = -ENOENT; 6794 goto err1; 6795 } 6796 set->ndeact++; 6797 6798 nft_setelem_data_deactivate(ctx->net, set, elem); 6799 nft_trans_elem_set(trans) = set; 6800 nft_trans_elem(trans) = *elem; 6801 nft_trans_commit_list_add_tail(ctx->net, trans); 6802 6803 return 0; 6804 err1: 6805 kfree(trans); 6806 return err; 6807 } 6808 6809 static int __nft_set_catchall_flush(const struct nft_ctx *ctx, 6810 struct nft_set *set, 6811 struct nft_set_elem *elem) 6812 { 6813 struct nft_trans *trans; 6814 6815 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 6816 sizeof(struct nft_trans_elem), GFP_KERNEL); 6817 if (!trans) 6818 return -ENOMEM; 6819 6820 nft_setelem_data_deactivate(ctx->net, set, elem); 6821 nft_trans_elem_set(trans) = set; 6822 nft_trans_elem(trans) = *elem; 6823 nft_trans_commit_list_add_tail(ctx->net, trans); 6824 6825 return 0; 6826 } 6827 6828 static int nft_set_catchall_flush(const struct nft_ctx *ctx, 6829 struct nft_set *set) 6830 { 6831 u8 genmask = nft_genmask_next(ctx->net); 6832 struct nft_set_elem_catchall *catchall; 6833 struct nft_set_elem elem; 6834 struct nft_set_ext *ext; 6835 int ret = 0; 6836 6837 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6838 ext = nft_set_elem_ext(set, catchall->elem); 6839 if (!nft_set_elem_active(ext, genmask) || 6840 nft_set_elem_mark_busy(ext)) 6841 continue; 6842 6843 elem.priv = catchall->elem; 6844 ret = __nft_set_catchall_flush(ctx, set, &elem); 6845 if (ret < 0) 6846 break; 6847 } 6848 6849 return ret; 6850 } 6851 6852 static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) 6853 { 6854 struct nft_set_iter iter = { 6855 .genmask = genmask, 6856 .fn = nft_setelem_flush, 6857 }; 6858 6859 set->ops->walk(ctx, set, &iter); 6860 if (!iter.err) 6861 iter.err = nft_set_catchall_flush(ctx, set); 6862 6863 return iter.err; 6864 } 6865 6866 static int nf_tables_delsetelem(struct sk_buff *skb, 6867 const struct nfnl_info *info, 6868 const struct nlattr * const nla[]) 6869 { 6870 struct netlink_ext_ack *extack = info->extack; 6871 u8 genmask = nft_genmask_next(info->net); 6872 u8 family = info->nfmsg->nfgen_family; 6873 struct net *net = info->net; 6874 const struct nlattr *attr; 6875 struct nft_table *table; 6876 struct nft_set *set; 6877 struct nft_ctx ctx; 6878 int rem, err = 0; 6879 6880 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6881 genmask, NETLINK_CB(skb).portid); 6882 if (IS_ERR(table)) { 6883 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6884 return PTR_ERR(table); 6885 } 6886 6887 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 6888 if (IS_ERR(set)) 6889 return PTR_ERR(set); 6890 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 6891 return -EBUSY; 6892 6893 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6894 6895 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6896 return nft_set_flush(&ctx, set, genmask); 6897 6898 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6899 err = nft_del_setelem(&ctx, set, attr); 6900 if (err == -ENOENT && 6901 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSETELEM) 6902 continue; 6903 6904 if (err < 0) { 6905 NL_SET_BAD_ATTR(extack, attr); 6906 break; 6907 } 6908 } 6909 return err; 6910 } 6911 6912 void nft_set_gc_batch_release(struct rcu_head *rcu) 6913 { 6914 struct nft_set_gc_batch *gcb; 6915 unsigned int i; 6916 6917 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu); 6918 for (i = 0; i < gcb->head.cnt; i++) 6919 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true); 6920 kfree(gcb); 6921 } 6922 6923 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set, 6924 gfp_t gfp) 6925 { 6926 struct nft_set_gc_batch *gcb; 6927 6928 gcb = kzalloc(sizeof(*gcb), gfp); 6929 if (gcb == NULL) 6930 return gcb; 6931 gcb->head.set = set; 6932 return gcb; 6933 } 6934 6935 /* 6936 * Stateful objects 6937 */ 6938 6939 /** 6940 * nft_register_obj- register nf_tables stateful object type 6941 * @obj_type: object type 6942 * 6943 * Registers the object type for use with nf_tables. Returns zero on 6944 * success or a negative errno code otherwise. 6945 */ 6946 int nft_register_obj(struct nft_object_type *obj_type) 6947 { 6948 if (obj_type->type == NFT_OBJECT_UNSPEC) 6949 return -EINVAL; 6950 6951 nfnl_lock(NFNL_SUBSYS_NFTABLES); 6952 list_add_rcu(&obj_type->list, &nf_tables_objects); 6953 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 6954 return 0; 6955 } 6956 EXPORT_SYMBOL_GPL(nft_register_obj); 6957 6958 /** 6959 * nft_unregister_obj - unregister nf_tables object type 6960 * @obj_type: object type 6961 * 6962 * Unregisters the object type for use with nf_tables. 6963 */ 6964 void nft_unregister_obj(struct nft_object_type *obj_type) 6965 { 6966 nfnl_lock(NFNL_SUBSYS_NFTABLES); 6967 list_del_rcu(&obj_type->list); 6968 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 6969 } 6970 EXPORT_SYMBOL_GPL(nft_unregister_obj); 6971 6972 struct nft_object *nft_obj_lookup(const struct net *net, 6973 const struct nft_table *table, 6974 const struct nlattr *nla, u32 objtype, 6975 u8 genmask) 6976 { 6977 struct nft_object_hash_key k = { .table = table }; 6978 char search[NFT_OBJ_MAXNAMELEN]; 6979 struct rhlist_head *tmp, *list; 6980 struct nft_object *obj; 6981 6982 nla_strscpy(search, nla, sizeof(search)); 6983 k.name = search; 6984 6985 WARN_ON_ONCE(!rcu_read_lock_held() && 6986 !lockdep_commit_lock_is_held(net)); 6987 6988 rcu_read_lock(); 6989 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params); 6990 if (!list) 6991 goto out; 6992 6993 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) { 6994 if (objtype == obj->ops->type->type && 6995 nft_active_genmask(obj, genmask)) { 6996 rcu_read_unlock(); 6997 return obj; 6998 } 6999 } 7000 out: 7001 rcu_read_unlock(); 7002 return ERR_PTR(-ENOENT); 7003 } 7004 EXPORT_SYMBOL_GPL(nft_obj_lookup); 7005 7006 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table, 7007 const struct nlattr *nla, 7008 u32 objtype, u8 genmask) 7009 { 7010 struct nft_object *obj; 7011 7012 list_for_each_entry(obj, &table->objects, list) { 7013 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && 7014 objtype == obj->ops->type->type && 7015 nft_active_genmask(obj, genmask)) 7016 return obj; 7017 } 7018 return ERR_PTR(-ENOENT); 7019 } 7020 7021 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 7022 [NFTA_OBJ_TABLE] = { .type = NLA_STRING, 7023 .len = NFT_TABLE_MAXNAMELEN - 1 }, 7024 [NFTA_OBJ_NAME] = { .type = NLA_STRING, 7025 .len = NFT_OBJ_MAXNAMELEN - 1 }, 7026 [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, 7027 [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, 7028 [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, 7029 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY, 7030 .len = NFT_USERDATA_MAXLEN }, 7031 }; 7032 7033 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 7034 const struct nft_object_type *type, 7035 const struct nlattr *attr) 7036 { 7037 struct nlattr **tb; 7038 const struct nft_object_ops *ops; 7039 struct nft_object *obj; 7040 int err = -ENOMEM; 7041 7042 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL); 7043 if (!tb) 7044 goto err1; 7045 7046 if (attr) { 7047 err = nla_parse_nested_deprecated(tb, type->maxattr, attr, 7048 type->policy, NULL); 7049 if (err < 0) 7050 goto err2; 7051 } else { 7052 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); 7053 } 7054 7055 if (type->select_ops) { 7056 ops = type->select_ops(ctx, (const struct nlattr * const *)tb); 7057 if (IS_ERR(ops)) { 7058 err = PTR_ERR(ops); 7059 goto err2; 7060 } 7061 } else { 7062 ops = type->ops; 7063 } 7064 7065 err = -ENOMEM; 7066 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT); 7067 if (!obj) 7068 goto err2; 7069 7070 err = ops->init(ctx, (const struct nlattr * const *)tb, obj); 7071 if (err < 0) 7072 goto err3; 7073 7074 obj->ops = ops; 7075 7076 kfree(tb); 7077 return obj; 7078 err3: 7079 kfree(obj); 7080 err2: 7081 kfree(tb); 7082 err1: 7083 return ERR_PTR(err); 7084 } 7085 7086 static int nft_object_dump(struct sk_buff *skb, unsigned int attr, 7087 struct nft_object *obj, bool reset) 7088 { 7089 struct nlattr *nest; 7090 7091 nest = nla_nest_start_noflag(skb, attr); 7092 if (!nest) 7093 goto nla_put_failure; 7094 if (obj->ops->dump(skb, obj, reset) < 0) 7095 goto nla_put_failure; 7096 nla_nest_end(skb, nest); 7097 return 0; 7098 7099 nla_put_failure: 7100 return -1; 7101 } 7102 7103 static const struct nft_object_type *__nft_obj_type_get(u32 objtype) 7104 { 7105 const struct nft_object_type *type; 7106 7107 list_for_each_entry(type, &nf_tables_objects, list) { 7108 if (objtype == type->type) 7109 return type; 7110 } 7111 return NULL; 7112 } 7113 7114 static const struct nft_object_type * 7115 nft_obj_type_get(struct net *net, u32 objtype) 7116 { 7117 const struct nft_object_type *type; 7118 7119 type = __nft_obj_type_get(objtype); 7120 if (type != NULL && try_module_get(type->owner)) 7121 return type; 7122 7123 lockdep_nfnl_nft_mutex_not_held(); 7124 #ifdef CONFIG_MODULES 7125 if (type == NULL) { 7126 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN) 7127 return ERR_PTR(-EAGAIN); 7128 } 7129 #endif 7130 return ERR_PTR(-ENOENT); 7131 } 7132 7133 static int nf_tables_updobj(const struct nft_ctx *ctx, 7134 const struct nft_object_type *type, 7135 const struct nlattr *attr, 7136 struct nft_object *obj) 7137 { 7138 struct nft_object *newobj; 7139 struct nft_trans *trans; 7140 int err = -ENOMEM; 7141 7142 if (!try_module_get(type->owner)) 7143 return -ENOENT; 7144 7145 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, 7146 sizeof(struct nft_trans_obj)); 7147 if (!trans) 7148 goto err_trans; 7149 7150 newobj = nft_obj_init(ctx, type, attr); 7151 if (IS_ERR(newobj)) { 7152 err = PTR_ERR(newobj); 7153 goto err_free_trans; 7154 } 7155 7156 nft_trans_obj(trans) = obj; 7157 nft_trans_obj_update(trans) = true; 7158 nft_trans_obj_newobj(trans) = newobj; 7159 nft_trans_commit_list_add_tail(ctx->net, trans); 7160 7161 return 0; 7162 7163 err_free_trans: 7164 kfree(trans); 7165 err_trans: 7166 module_put(type->owner); 7167 return err; 7168 } 7169 7170 static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, 7171 const struct nlattr * const nla[]) 7172 { 7173 struct netlink_ext_ack *extack = info->extack; 7174 u8 genmask = nft_genmask_next(info->net); 7175 u8 family = info->nfmsg->nfgen_family; 7176 const struct nft_object_type *type; 7177 struct net *net = info->net; 7178 struct nft_table *table; 7179 struct nft_object *obj; 7180 struct nft_ctx ctx; 7181 u32 objtype; 7182 int err; 7183 7184 if (!nla[NFTA_OBJ_TYPE] || 7185 !nla[NFTA_OBJ_NAME] || 7186 !nla[NFTA_OBJ_DATA]) 7187 return -EINVAL; 7188 7189 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 7190 NETLINK_CB(skb).portid); 7191 if (IS_ERR(table)) { 7192 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7193 return PTR_ERR(table); 7194 } 7195 7196 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7197 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 7198 if (IS_ERR(obj)) { 7199 err = PTR_ERR(obj); 7200 if (err != -ENOENT) { 7201 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7202 return err; 7203 } 7204 } else { 7205 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 7206 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7207 return -EEXIST; 7208 } 7209 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 7210 return -EOPNOTSUPP; 7211 7212 type = __nft_obj_type_get(objtype); 7213 if (WARN_ON_ONCE(!type)) 7214 return -ENOENT; 7215 7216 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7217 7218 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); 7219 } 7220 7221 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7222 7223 type = nft_obj_type_get(net, objtype); 7224 if (IS_ERR(type)) 7225 return PTR_ERR(type); 7226 7227 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]); 7228 if (IS_ERR(obj)) { 7229 err = PTR_ERR(obj); 7230 goto err_init; 7231 } 7232 obj->key.table = table; 7233 obj->handle = nf_tables_alloc_handle(table); 7234 7235 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT); 7236 if (!obj->key.name) { 7237 err = -ENOMEM; 7238 goto err_strdup; 7239 } 7240 7241 if (nla[NFTA_OBJ_USERDATA]) { 7242 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL_ACCOUNT); 7243 if (obj->udata == NULL) 7244 goto err_userdata; 7245 7246 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]); 7247 } 7248 7249 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj); 7250 if (err < 0) 7251 goto err_trans; 7252 7253 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead, 7254 nft_objname_ht_params); 7255 if (err < 0) 7256 goto err_obj_ht; 7257 7258 list_add_tail_rcu(&obj->list, &table->objects); 7259 table->use++; 7260 return 0; 7261 err_obj_ht: 7262 /* queued in transaction log */ 7263 INIT_LIST_HEAD(&obj->list); 7264 return err; 7265 err_trans: 7266 kfree(obj->udata); 7267 err_userdata: 7268 kfree(obj->key.name); 7269 err_strdup: 7270 if (obj->ops->destroy) 7271 obj->ops->destroy(&ctx, obj); 7272 kfree(obj); 7273 err_init: 7274 module_put(type->owner); 7275 return err; 7276 } 7277 7278 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 7279 u32 portid, u32 seq, int event, u32 flags, 7280 int family, const struct nft_table *table, 7281 struct nft_object *obj, bool reset) 7282 { 7283 struct nlmsghdr *nlh; 7284 7285 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 7286 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 7287 NFNETLINK_V0, nft_base_seq(net)); 7288 if (!nlh) 7289 goto nla_put_failure; 7290 7291 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || 7292 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || 7293 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), 7294 NFTA_OBJ_PAD)) 7295 goto nla_put_failure; 7296 7297 if (event == NFT_MSG_DELOBJ) { 7298 nlmsg_end(skb, nlh); 7299 return 0; 7300 } 7301 7302 if (nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || 7303 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || 7304 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset)) 7305 goto nla_put_failure; 7306 7307 if (obj->udata && 7308 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata)) 7309 goto nla_put_failure; 7310 7311 nlmsg_end(skb, nlh); 7312 return 0; 7313 7314 nla_put_failure: 7315 nlmsg_trim(skb, nlh); 7316 return -1; 7317 } 7318 7319 struct nft_obj_filter { 7320 char *table; 7321 u32 type; 7322 }; 7323 7324 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) 7325 { 7326 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 7327 const struct nft_table *table; 7328 unsigned int idx = 0, s_idx = cb->args[0]; 7329 struct nft_obj_filter *filter = cb->data; 7330 struct net *net = sock_net(skb->sk); 7331 int family = nfmsg->nfgen_family; 7332 struct nftables_pernet *nft_net; 7333 struct nft_object *obj; 7334 bool reset = false; 7335 7336 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7337 reset = true; 7338 7339 rcu_read_lock(); 7340 nft_net = nft_pernet(net); 7341 cb->seq = READ_ONCE(nft_net->base_seq); 7342 7343 list_for_each_entry_rcu(table, &nft_net->tables, list) { 7344 if (family != NFPROTO_UNSPEC && family != table->family) 7345 continue; 7346 7347 list_for_each_entry_rcu(obj, &table->objects, list) { 7348 if (!nft_is_active(net, obj)) 7349 goto cont; 7350 if (idx < s_idx) 7351 goto cont; 7352 if (idx > s_idx) 7353 memset(&cb->args[1], 0, 7354 sizeof(cb->args) - sizeof(cb->args[0])); 7355 if (filter && filter->table && 7356 strcmp(filter->table, table->name)) 7357 goto cont; 7358 if (filter && 7359 filter->type != NFT_OBJECT_UNSPEC && 7360 obj->ops->type->type != filter->type) 7361 goto cont; 7362 if (reset) { 7363 char *buf = kasprintf(GFP_ATOMIC, 7364 "%s:%u", 7365 table->name, 7366 nft_net->base_seq); 7367 7368 audit_log_nfcfg(buf, 7369 family, 7370 obj->handle, 7371 AUDIT_NFT_OP_OBJ_RESET, 7372 GFP_ATOMIC); 7373 kfree(buf); 7374 } 7375 7376 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, 7377 cb->nlh->nlmsg_seq, 7378 NFT_MSG_NEWOBJ, 7379 NLM_F_MULTI | NLM_F_APPEND, 7380 table->family, table, 7381 obj, reset) < 0) 7382 goto done; 7383 7384 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 7385 cont: 7386 idx++; 7387 } 7388 } 7389 done: 7390 rcu_read_unlock(); 7391 7392 cb->args[0] = idx; 7393 return skb->len; 7394 } 7395 7396 static int nf_tables_dump_obj_start(struct netlink_callback *cb) 7397 { 7398 const struct nlattr * const *nla = cb->data; 7399 struct nft_obj_filter *filter = NULL; 7400 7401 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) { 7402 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 7403 if (!filter) 7404 return -ENOMEM; 7405 7406 if (nla[NFTA_OBJ_TABLE]) { 7407 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC); 7408 if (!filter->table) { 7409 kfree(filter); 7410 return -ENOMEM; 7411 } 7412 } 7413 7414 if (nla[NFTA_OBJ_TYPE]) 7415 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7416 } 7417 7418 cb->data = filter; 7419 return 0; 7420 } 7421 7422 static int nf_tables_dump_obj_done(struct netlink_callback *cb) 7423 { 7424 struct nft_obj_filter *filter = cb->data; 7425 7426 if (filter) { 7427 kfree(filter->table); 7428 kfree(filter); 7429 } 7430 7431 return 0; 7432 } 7433 7434 /* called with rcu_read_lock held */ 7435 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, 7436 const struct nlattr * const nla[]) 7437 { 7438 struct netlink_ext_ack *extack = info->extack; 7439 u8 genmask = nft_genmask_cur(info->net); 7440 u8 family = info->nfmsg->nfgen_family; 7441 const struct nft_table *table; 7442 struct net *net = info->net; 7443 struct nft_object *obj; 7444 struct sk_buff *skb2; 7445 bool reset = false; 7446 u32 objtype; 7447 int err; 7448 7449 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 7450 struct netlink_dump_control c = { 7451 .start = nf_tables_dump_obj_start, 7452 .dump = nf_tables_dump_obj, 7453 .done = nf_tables_dump_obj_done, 7454 .module = THIS_MODULE, 7455 .data = (void *)nla, 7456 }; 7457 7458 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 7459 } 7460 7461 if (!nla[NFTA_OBJ_NAME] || 7462 !nla[NFTA_OBJ_TYPE]) 7463 return -EINVAL; 7464 7465 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0); 7466 if (IS_ERR(table)) { 7467 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7468 return PTR_ERR(table); 7469 } 7470 7471 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7472 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 7473 if (IS_ERR(obj)) { 7474 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7475 return PTR_ERR(obj); 7476 } 7477 7478 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 7479 if (!skb2) 7480 return -ENOMEM; 7481 7482 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7483 reset = true; 7484 7485 if (reset) { 7486 const struct nftables_pernet *nft_net; 7487 char *buf; 7488 7489 nft_net = nft_pernet(net); 7490 buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq); 7491 7492 audit_log_nfcfg(buf, 7493 family, 7494 obj->handle, 7495 AUDIT_NFT_OP_OBJ_RESET, 7496 GFP_ATOMIC); 7497 kfree(buf); 7498 } 7499 7500 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid, 7501 info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 7502 family, table, obj, reset); 7503 if (err < 0) 7504 goto err_fill_obj_info; 7505 7506 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 7507 7508 err_fill_obj_info: 7509 kfree_skb(skb2); 7510 return err; 7511 } 7512 7513 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) 7514 { 7515 if (obj->ops->destroy) 7516 obj->ops->destroy(ctx, obj); 7517 7518 module_put(obj->ops->type->owner); 7519 kfree(obj->key.name); 7520 kfree(obj->udata); 7521 kfree(obj); 7522 } 7523 7524 static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info, 7525 const struct nlattr * const nla[]) 7526 { 7527 struct netlink_ext_ack *extack = info->extack; 7528 u8 genmask = nft_genmask_next(info->net); 7529 u8 family = info->nfmsg->nfgen_family; 7530 struct net *net = info->net; 7531 const struct nlattr *attr; 7532 struct nft_table *table; 7533 struct nft_object *obj; 7534 struct nft_ctx ctx; 7535 u32 objtype; 7536 7537 if (!nla[NFTA_OBJ_TYPE] || 7538 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) 7539 return -EINVAL; 7540 7541 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 7542 NETLINK_CB(skb).portid); 7543 if (IS_ERR(table)) { 7544 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7545 return PTR_ERR(table); 7546 } 7547 7548 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7549 if (nla[NFTA_OBJ_HANDLE]) { 7550 attr = nla[NFTA_OBJ_HANDLE]; 7551 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask); 7552 } else { 7553 attr = nla[NFTA_OBJ_NAME]; 7554 obj = nft_obj_lookup(net, table, attr, objtype, genmask); 7555 } 7556 7557 if (IS_ERR(obj)) { 7558 if (PTR_ERR(obj) == -ENOENT && 7559 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYOBJ) 7560 return 0; 7561 7562 NL_SET_BAD_ATTR(extack, attr); 7563 return PTR_ERR(obj); 7564 } 7565 if (obj->use > 0) { 7566 NL_SET_BAD_ATTR(extack, attr); 7567 return -EBUSY; 7568 } 7569 7570 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7571 7572 return nft_delobj(&ctx, obj); 7573 } 7574 7575 void nft_obj_notify(struct net *net, const struct nft_table *table, 7576 struct nft_object *obj, u32 portid, u32 seq, int event, 7577 u16 flags, int family, int report, gfp_t gfp) 7578 { 7579 struct nftables_pernet *nft_net = nft_pernet(net); 7580 struct sk_buff *skb; 7581 int err; 7582 char *buf = kasprintf(gfp, "%s:%u", 7583 table->name, nft_net->base_seq); 7584 7585 audit_log_nfcfg(buf, 7586 family, 7587 obj->handle, 7588 event == NFT_MSG_NEWOBJ ? 7589 AUDIT_NFT_OP_OBJ_REGISTER : 7590 AUDIT_NFT_OP_OBJ_UNREGISTER, 7591 gfp); 7592 kfree(buf); 7593 7594 if (!report && 7595 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 7596 return; 7597 7598 skb = nlmsg_new(NLMSG_GOODSIZE, gfp); 7599 if (skb == NULL) 7600 goto err; 7601 7602 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 7603 flags & (NLM_F_CREATE | NLM_F_EXCL), 7604 family, table, obj, false); 7605 if (err < 0) { 7606 kfree_skb(skb); 7607 goto err; 7608 } 7609 7610 nft_notify_enqueue(skb, report, &nft_net->notify_list); 7611 return; 7612 err: 7613 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 7614 } 7615 EXPORT_SYMBOL_GPL(nft_obj_notify); 7616 7617 static void nf_tables_obj_notify(const struct nft_ctx *ctx, 7618 struct nft_object *obj, int event) 7619 { 7620 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, 7621 ctx->flags, ctx->family, ctx->report, GFP_KERNEL); 7622 } 7623 7624 /* 7625 * Flow tables 7626 */ 7627 void nft_register_flowtable_type(struct nf_flowtable_type *type) 7628 { 7629 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7630 list_add_tail_rcu(&type->list, &nf_tables_flowtables); 7631 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7632 } 7633 EXPORT_SYMBOL_GPL(nft_register_flowtable_type); 7634 7635 void nft_unregister_flowtable_type(struct nf_flowtable_type *type) 7636 { 7637 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7638 list_del_rcu(&type->list); 7639 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7640 } 7641 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); 7642 7643 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 7644 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, 7645 .len = NFT_NAME_MAXLEN - 1 }, 7646 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, 7647 .len = NFT_NAME_MAXLEN - 1 }, 7648 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, 7649 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, 7650 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 }, 7651 }; 7652 7653 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table, 7654 const struct nlattr *nla, u8 genmask) 7655 { 7656 struct nft_flowtable *flowtable; 7657 7658 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 7659 if (!nla_strcmp(nla, flowtable->name) && 7660 nft_active_genmask(flowtable, genmask)) 7661 return flowtable; 7662 } 7663 return ERR_PTR(-ENOENT); 7664 } 7665 EXPORT_SYMBOL_GPL(nft_flowtable_lookup); 7666 7667 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, 7668 struct nft_flowtable *flowtable, 7669 enum nft_trans_phase phase) 7670 { 7671 switch (phase) { 7672 case NFT_TRANS_PREPARE: 7673 case NFT_TRANS_ABORT: 7674 case NFT_TRANS_RELEASE: 7675 flowtable->use--; 7676 fallthrough; 7677 default: 7678 return; 7679 } 7680 } 7681 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable); 7682 7683 static struct nft_flowtable * 7684 nft_flowtable_lookup_byhandle(const struct nft_table *table, 7685 const struct nlattr *nla, u8 genmask) 7686 { 7687 struct nft_flowtable *flowtable; 7688 7689 list_for_each_entry(flowtable, &table->flowtables, list) { 7690 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && 7691 nft_active_genmask(flowtable, genmask)) 7692 return flowtable; 7693 } 7694 return ERR_PTR(-ENOENT); 7695 } 7696 7697 struct nft_flowtable_hook { 7698 u32 num; 7699 int priority; 7700 struct list_head list; 7701 }; 7702 7703 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { 7704 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, 7705 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, 7706 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, 7707 }; 7708 7709 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx, 7710 const struct nlattr * const nla[], 7711 struct nft_flowtable_hook *flowtable_hook, 7712 struct nft_flowtable *flowtable, 7713 struct netlink_ext_ack *extack, bool add) 7714 { 7715 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; 7716 struct nft_hook *hook; 7717 int hooknum, priority; 7718 int err; 7719 7720 INIT_LIST_HEAD(&flowtable_hook->list); 7721 7722 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, 7723 nla[NFTA_FLOWTABLE_HOOK], 7724 nft_flowtable_hook_policy, NULL); 7725 if (err < 0) 7726 return err; 7727 7728 if (add) { 7729 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || 7730 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 7731 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 7732 return -ENOENT; 7733 } 7734 7735 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 7736 if (hooknum != NF_NETDEV_INGRESS) 7737 return -EOPNOTSUPP; 7738 7739 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 7740 7741 flowtable_hook->priority = priority; 7742 flowtable_hook->num = hooknum; 7743 } else { 7744 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) { 7745 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 7746 if (hooknum != flowtable->hooknum) 7747 return -EOPNOTSUPP; 7748 } 7749 7750 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 7751 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 7752 if (priority != flowtable->data.priority) 7753 return -EOPNOTSUPP; 7754 } 7755 7756 flowtable_hook->priority = flowtable->data.priority; 7757 flowtable_hook->num = flowtable->hooknum; 7758 } 7759 7760 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) { 7761 err = nf_tables_parse_netdev_hooks(ctx->net, 7762 tb[NFTA_FLOWTABLE_HOOK_DEVS], 7763 &flowtable_hook->list, 7764 extack); 7765 if (err < 0) 7766 return err; 7767 } 7768 7769 list_for_each_entry(hook, &flowtable_hook->list, list) { 7770 hook->ops.pf = NFPROTO_NETDEV; 7771 hook->ops.hooknum = flowtable_hook->num; 7772 hook->ops.priority = flowtable_hook->priority; 7773 hook->ops.priv = &flowtable->data; 7774 hook->ops.hook = flowtable->data.type->hook; 7775 } 7776 7777 return err; 7778 } 7779 7780 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) 7781 { 7782 const struct nf_flowtable_type *type; 7783 7784 list_for_each_entry(type, &nf_tables_flowtables, list) { 7785 if (family == type->family) 7786 return type; 7787 } 7788 return NULL; 7789 } 7790 7791 static const struct nf_flowtable_type * 7792 nft_flowtable_type_get(struct net *net, u8 family) 7793 { 7794 const struct nf_flowtable_type *type; 7795 7796 type = __nft_flowtable_type_get(family); 7797 if (type != NULL && try_module_get(type->owner)) 7798 return type; 7799 7800 lockdep_nfnl_nft_mutex_not_held(); 7801 #ifdef CONFIG_MODULES 7802 if (type == NULL) { 7803 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN) 7804 return ERR_PTR(-EAGAIN); 7805 } 7806 #endif 7807 return ERR_PTR(-ENOENT); 7808 } 7809 7810 /* Only called from error and netdev event paths. */ 7811 static void nft_unregister_flowtable_hook(struct net *net, 7812 struct nft_flowtable *flowtable, 7813 struct nft_hook *hook) 7814 { 7815 nf_unregister_net_hook(net, &hook->ops); 7816 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 7817 FLOW_BLOCK_UNBIND); 7818 } 7819 7820 static void __nft_unregister_flowtable_net_hooks(struct net *net, 7821 struct list_head *hook_list, 7822 bool release_netdev) 7823 { 7824 struct nft_hook *hook, *next; 7825 7826 list_for_each_entry_safe(hook, next, hook_list, list) { 7827 nf_unregister_net_hook(net, &hook->ops); 7828 if (release_netdev) { 7829 list_del(&hook->list); 7830 kfree_rcu(hook, rcu); 7831 } 7832 } 7833 } 7834 7835 static void nft_unregister_flowtable_net_hooks(struct net *net, 7836 struct list_head *hook_list) 7837 { 7838 __nft_unregister_flowtable_net_hooks(net, hook_list, false); 7839 } 7840 7841 static int nft_register_flowtable_net_hooks(struct net *net, 7842 struct nft_table *table, 7843 struct list_head *hook_list, 7844 struct nft_flowtable *flowtable) 7845 { 7846 struct nft_hook *hook, *hook2, *next; 7847 struct nft_flowtable *ft; 7848 int err, i = 0; 7849 7850 list_for_each_entry(hook, hook_list, list) { 7851 list_for_each_entry(ft, &table->flowtables, list) { 7852 if (!nft_is_active_next(net, ft)) 7853 continue; 7854 7855 list_for_each_entry(hook2, &ft->hook_list, list) { 7856 if (hook->ops.dev == hook2->ops.dev && 7857 hook->ops.pf == hook2->ops.pf) { 7858 err = -EEXIST; 7859 goto err_unregister_net_hooks; 7860 } 7861 } 7862 } 7863 7864 err = flowtable->data.type->setup(&flowtable->data, 7865 hook->ops.dev, 7866 FLOW_BLOCK_BIND); 7867 if (err < 0) 7868 goto err_unregister_net_hooks; 7869 7870 err = nf_register_net_hook(net, &hook->ops); 7871 if (err < 0) { 7872 flowtable->data.type->setup(&flowtable->data, 7873 hook->ops.dev, 7874 FLOW_BLOCK_UNBIND); 7875 goto err_unregister_net_hooks; 7876 } 7877 7878 i++; 7879 } 7880 7881 return 0; 7882 7883 err_unregister_net_hooks: 7884 list_for_each_entry_safe(hook, next, hook_list, list) { 7885 if (i-- <= 0) 7886 break; 7887 7888 nft_unregister_flowtable_hook(net, flowtable, hook); 7889 list_del_rcu(&hook->list); 7890 kfree_rcu(hook, rcu); 7891 } 7892 7893 return err; 7894 } 7895 7896 static void nft_hooks_destroy(struct list_head *hook_list) 7897 { 7898 struct nft_hook *hook, *next; 7899 7900 list_for_each_entry_safe(hook, next, hook_list, list) { 7901 list_del_rcu(&hook->list); 7902 kfree_rcu(hook, rcu); 7903 } 7904 } 7905 7906 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, 7907 struct nft_flowtable *flowtable, 7908 struct netlink_ext_ack *extack) 7909 { 7910 const struct nlattr * const *nla = ctx->nla; 7911 struct nft_flowtable_hook flowtable_hook; 7912 struct nft_hook *hook, *next; 7913 struct nft_trans *trans; 7914 bool unregister = false; 7915 u32 flags; 7916 int err; 7917 7918 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 7919 extack, false); 7920 if (err < 0) 7921 return err; 7922 7923 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 7924 if (nft_hook_list_find(&flowtable->hook_list, hook)) { 7925 list_del(&hook->list); 7926 kfree(hook); 7927 } 7928 } 7929 7930 if (nla[NFTA_FLOWTABLE_FLAGS]) { 7931 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 7932 if (flags & ~NFT_FLOWTABLE_MASK) { 7933 err = -EOPNOTSUPP; 7934 goto err_flowtable_update_hook; 7935 } 7936 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ 7937 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) { 7938 err = -EOPNOTSUPP; 7939 goto err_flowtable_update_hook; 7940 } 7941 } else { 7942 flags = flowtable->data.flags; 7943 } 7944 7945 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, 7946 &flowtable_hook.list, flowtable); 7947 if (err < 0) 7948 goto err_flowtable_update_hook; 7949 7950 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE, 7951 sizeof(struct nft_trans_flowtable)); 7952 if (!trans) { 7953 unregister = true; 7954 err = -ENOMEM; 7955 goto err_flowtable_update_hook; 7956 } 7957 7958 nft_trans_flowtable_flags(trans) = flags; 7959 nft_trans_flowtable(trans) = flowtable; 7960 nft_trans_flowtable_update(trans) = true; 7961 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 7962 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans)); 7963 7964 nft_trans_commit_list_add_tail(ctx->net, trans); 7965 7966 return 0; 7967 7968 err_flowtable_update_hook: 7969 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 7970 if (unregister) 7971 nft_unregister_flowtable_hook(ctx->net, flowtable, hook); 7972 list_del_rcu(&hook->list); 7973 kfree_rcu(hook, rcu); 7974 } 7975 7976 return err; 7977 7978 } 7979 7980 static int nf_tables_newflowtable(struct sk_buff *skb, 7981 const struct nfnl_info *info, 7982 const struct nlattr * const nla[]) 7983 { 7984 struct netlink_ext_ack *extack = info->extack; 7985 struct nft_flowtable_hook flowtable_hook; 7986 u8 genmask = nft_genmask_next(info->net); 7987 u8 family = info->nfmsg->nfgen_family; 7988 const struct nf_flowtable_type *type; 7989 struct nft_flowtable *flowtable; 7990 struct nft_hook *hook, *next; 7991 struct net *net = info->net; 7992 struct nft_table *table; 7993 struct nft_ctx ctx; 7994 int err; 7995 7996 if (!nla[NFTA_FLOWTABLE_TABLE] || 7997 !nla[NFTA_FLOWTABLE_NAME] || 7998 !nla[NFTA_FLOWTABLE_HOOK]) 7999 return -EINVAL; 8000 8001 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8002 genmask, NETLINK_CB(skb).portid); 8003 if (IS_ERR(table)) { 8004 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 8005 return PTR_ERR(table); 8006 } 8007 8008 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 8009 genmask); 8010 if (IS_ERR(flowtable)) { 8011 err = PTR_ERR(flowtable); 8012 if (err != -ENOENT) { 8013 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8014 return err; 8015 } 8016 } else { 8017 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 8018 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8019 return -EEXIST; 8020 } 8021 8022 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8023 8024 return nft_flowtable_update(&ctx, info->nlh, flowtable, extack); 8025 } 8026 8027 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8028 8029 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT); 8030 if (!flowtable) 8031 return -ENOMEM; 8032 8033 flowtable->table = table; 8034 flowtable->handle = nf_tables_alloc_handle(table); 8035 INIT_LIST_HEAD(&flowtable->hook_list); 8036 8037 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT); 8038 if (!flowtable->name) { 8039 err = -ENOMEM; 8040 goto err1; 8041 } 8042 8043 type = nft_flowtable_type_get(net, family); 8044 if (IS_ERR(type)) { 8045 err = PTR_ERR(type); 8046 goto err2; 8047 } 8048 8049 if (nla[NFTA_FLOWTABLE_FLAGS]) { 8050 flowtable->data.flags = 8051 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 8052 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { 8053 err = -EOPNOTSUPP; 8054 goto err3; 8055 } 8056 } 8057 8058 write_pnet(&flowtable->data.net, net); 8059 flowtable->data.type = type; 8060 err = type->init(&flowtable->data); 8061 if (err < 0) 8062 goto err3; 8063 8064 err = nft_flowtable_parse_hook(&ctx, nla, &flowtable_hook, flowtable, 8065 extack, true); 8066 if (err < 0) 8067 goto err4; 8068 8069 list_splice(&flowtable_hook.list, &flowtable->hook_list); 8070 flowtable->data.priority = flowtable_hook.priority; 8071 flowtable->hooknum = flowtable_hook.num; 8072 8073 err = nft_register_flowtable_net_hooks(ctx.net, table, 8074 &flowtable->hook_list, 8075 flowtable); 8076 if (err < 0) { 8077 nft_hooks_destroy(&flowtable->hook_list); 8078 goto err4; 8079 } 8080 8081 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); 8082 if (err < 0) 8083 goto err5; 8084 8085 list_add_tail_rcu(&flowtable->list, &table->flowtables); 8086 table->use++; 8087 8088 return 0; 8089 err5: 8090 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 8091 nft_unregister_flowtable_hook(net, flowtable, hook); 8092 list_del_rcu(&hook->list); 8093 kfree_rcu(hook, rcu); 8094 } 8095 err4: 8096 flowtable->data.type->free(&flowtable->data); 8097 err3: 8098 module_put(type->owner); 8099 err2: 8100 kfree(flowtable->name); 8101 err1: 8102 kfree(flowtable); 8103 return err; 8104 } 8105 8106 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook) 8107 { 8108 struct nft_hook *this, *next; 8109 8110 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) { 8111 list_del(&this->list); 8112 kfree(this); 8113 } 8114 } 8115 8116 static int nft_delflowtable_hook(struct nft_ctx *ctx, 8117 struct nft_flowtable *flowtable, 8118 struct netlink_ext_ack *extack) 8119 { 8120 const struct nlattr * const *nla = ctx->nla; 8121 struct nft_flowtable_hook flowtable_hook; 8122 LIST_HEAD(flowtable_del_list); 8123 struct nft_hook *this, *hook; 8124 struct nft_trans *trans; 8125 int err; 8126 8127 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 8128 extack, false); 8129 if (err < 0) 8130 return err; 8131 8132 list_for_each_entry(this, &flowtable_hook.list, list) { 8133 hook = nft_hook_list_find(&flowtable->hook_list, this); 8134 if (!hook) { 8135 err = -ENOENT; 8136 goto err_flowtable_del_hook; 8137 } 8138 list_move(&hook->list, &flowtable_del_list); 8139 } 8140 8141 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE, 8142 sizeof(struct nft_trans_flowtable)); 8143 if (!trans) { 8144 err = -ENOMEM; 8145 goto err_flowtable_del_hook; 8146 } 8147 8148 nft_trans_flowtable(trans) = flowtable; 8149 nft_trans_flowtable_update(trans) = true; 8150 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 8151 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans)); 8152 nft_flowtable_hook_release(&flowtable_hook); 8153 8154 nft_trans_commit_list_add_tail(ctx->net, trans); 8155 8156 return 0; 8157 8158 err_flowtable_del_hook: 8159 list_splice(&flowtable_del_list, &flowtable->hook_list); 8160 nft_flowtable_hook_release(&flowtable_hook); 8161 8162 return err; 8163 } 8164 8165 static int nf_tables_delflowtable(struct sk_buff *skb, 8166 const struct nfnl_info *info, 8167 const struct nlattr * const nla[]) 8168 { 8169 struct netlink_ext_ack *extack = info->extack; 8170 u8 genmask = nft_genmask_next(info->net); 8171 u8 family = info->nfmsg->nfgen_family; 8172 struct nft_flowtable *flowtable; 8173 struct net *net = info->net; 8174 const struct nlattr *attr; 8175 struct nft_table *table; 8176 struct nft_ctx ctx; 8177 8178 if (!nla[NFTA_FLOWTABLE_TABLE] || 8179 (!nla[NFTA_FLOWTABLE_NAME] && 8180 !nla[NFTA_FLOWTABLE_HANDLE])) 8181 return -EINVAL; 8182 8183 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8184 genmask, NETLINK_CB(skb).portid); 8185 if (IS_ERR(table)) { 8186 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 8187 return PTR_ERR(table); 8188 } 8189 8190 if (nla[NFTA_FLOWTABLE_HANDLE]) { 8191 attr = nla[NFTA_FLOWTABLE_HANDLE]; 8192 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask); 8193 } else { 8194 attr = nla[NFTA_FLOWTABLE_NAME]; 8195 flowtable = nft_flowtable_lookup(table, attr, genmask); 8196 } 8197 8198 if (IS_ERR(flowtable)) { 8199 if (PTR_ERR(flowtable) == -ENOENT && 8200 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYFLOWTABLE) 8201 return 0; 8202 8203 NL_SET_BAD_ATTR(extack, attr); 8204 return PTR_ERR(flowtable); 8205 } 8206 8207 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8208 8209 if (nla[NFTA_FLOWTABLE_HOOK]) 8210 return nft_delflowtable_hook(&ctx, flowtable, extack); 8211 8212 if (flowtable->use > 0) { 8213 NL_SET_BAD_ATTR(extack, attr); 8214 return -EBUSY; 8215 } 8216 8217 return nft_delflowtable(&ctx, flowtable); 8218 } 8219 8220 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 8221 u32 portid, u32 seq, int event, 8222 u32 flags, int family, 8223 struct nft_flowtable *flowtable, 8224 struct list_head *hook_list) 8225 { 8226 struct nlattr *nest, *nest_devs; 8227 struct nft_hook *hook; 8228 struct nlmsghdr *nlh; 8229 8230 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 8231 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 8232 NFNETLINK_V0, nft_base_seq(net)); 8233 if (!nlh) 8234 goto nla_put_failure; 8235 8236 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || 8237 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || 8238 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), 8239 NFTA_FLOWTABLE_PAD)) 8240 goto nla_put_failure; 8241 8242 if (event == NFT_MSG_DELFLOWTABLE && !hook_list) { 8243 nlmsg_end(skb, nlh); 8244 return 0; 8245 } 8246 8247 if (nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || 8248 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) 8249 goto nla_put_failure; 8250 8251 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK); 8252 if (!nest) 8253 goto nla_put_failure; 8254 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || 8255 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority))) 8256 goto nla_put_failure; 8257 8258 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS); 8259 if (!nest_devs) 8260 goto nla_put_failure; 8261 8262 if (!hook_list) 8263 hook_list = &flowtable->hook_list; 8264 8265 list_for_each_entry_rcu(hook, hook_list, list) { 8266 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name)) 8267 goto nla_put_failure; 8268 } 8269 nla_nest_end(skb, nest_devs); 8270 nla_nest_end(skb, nest); 8271 8272 nlmsg_end(skb, nlh); 8273 return 0; 8274 8275 nla_put_failure: 8276 nlmsg_trim(skb, nlh); 8277 return -1; 8278 } 8279 8280 struct nft_flowtable_filter { 8281 char *table; 8282 }; 8283 8284 static int nf_tables_dump_flowtable(struct sk_buff *skb, 8285 struct netlink_callback *cb) 8286 { 8287 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 8288 struct nft_flowtable_filter *filter = cb->data; 8289 unsigned int idx = 0, s_idx = cb->args[0]; 8290 struct net *net = sock_net(skb->sk); 8291 int family = nfmsg->nfgen_family; 8292 struct nft_flowtable *flowtable; 8293 struct nftables_pernet *nft_net; 8294 const struct nft_table *table; 8295 8296 rcu_read_lock(); 8297 nft_net = nft_pernet(net); 8298 cb->seq = READ_ONCE(nft_net->base_seq); 8299 8300 list_for_each_entry_rcu(table, &nft_net->tables, list) { 8301 if (family != NFPROTO_UNSPEC && family != table->family) 8302 continue; 8303 8304 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 8305 if (!nft_is_active(net, flowtable)) 8306 goto cont; 8307 if (idx < s_idx) 8308 goto cont; 8309 if (idx > s_idx) 8310 memset(&cb->args[1], 0, 8311 sizeof(cb->args) - sizeof(cb->args[0])); 8312 if (filter && filter->table && 8313 strcmp(filter->table, table->name)) 8314 goto cont; 8315 8316 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, 8317 cb->nlh->nlmsg_seq, 8318 NFT_MSG_NEWFLOWTABLE, 8319 NLM_F_MULTI | NLM_F_APPEND, 8320 table->family, 8321 flowtable, NULL) < 0) 8322 goto done; 8323 8324 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 8325 cont: 8326 idx++; 8327 } 8328 } 8329 done: 8330 rcu_read_unlock(); 8331 8332 cb->args[0] = idx; 8333 return skb->len; 8334 } 8335 8336 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb) 8337 { 8338 const struct nlattr * const *nla = cb->data; 8339 struct nft_flowtable_filter *filter = NULL; 8340 8341 if (nla[NFTA_FLOWTABLE_TABLE]) { 8342 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 8343 if (!filter) 8344 return -ENOMEM; 8345 8346 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], 8347 GFP_ATOMIC); 8348 if (!filter->table) { 8349 kfree(filter); 8350 return -ENOMEM; 8351 } 8352 } 8353 8354 cb->data = filter; 8355 return 0; 8356 } 8357 8358 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) 8359 { 8360 struct nft_flowtable_filter *filter = cb->data; 8361 8362 if (!filter) 8363 return 0; 8364 8365 kfree(filter->table); 8366 kfree(filter); 8367 8368 return 0; 8369 } 8370 8371 /* called with rcu_read_lock held */ 8372 static int nf_tables_getflowtable(struct sk_buff *skb, 8373 const struct nfnl_info *info, 8374 const struct nlattr * const nla[]) 8375 { 8376 u8 genmask = nft_genmask_cur(info->net); 8377 u8 family = info->nfmsg->nfgen_family; 8378 struct nft_flowtable *flowtable; 8379 const struct nft_table *table; 8380 struct net *net = info->net; 8381 struct sk_buff *skb2; 8382 int err; 8383 8384 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8385 struct netlink_dump_control c = { 8386 .start = nf_tables_dump_flowtable_start, 8387 .dump = nf_tables_dump_flowtable, 8388 .done = nf_tables_dump_flowtable_done, 8389 .module = THIS_MODULE, 8390 .data = (void *)nla, 8391 }; 8392 8393 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8394 } 8395 8396 if (!nla[NFTA_FLOWTABLE_NAME]) 8397 return -EINVAL; 8398 8399 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8400 genmask, 0); 8401 if (IS_ERR(table)) 8402 return PTR_ERR(table); 8403 8404 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 8405 genmask); 8406 if (IS_ERR(flowtable)) 8407 return PTR_ERR(flowtable); 8408 8409 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8410 if (!skb2) 8411 return -ENOMEM; 8412 8413 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, 8414 info->nlh->nlmsg_seq, 8415 NFT_MSG_NEWFLOWTABLE, 0, family, 8416 flowtable, NULL); 8417 if (err < 0) 8418 goto err_fill_flowtable_info; 8419 8420 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 8421 8422 err_fill_flowtable_info: 8423 kfree_skb(skb2); 8424 return err; 8425 } 8426 8427 static void nf_tables_flowtable_notify(struct nft_ctx *ctx, 8428 struct nft_flowtable *flowtable, 8429 struct list_head *hook_list, int event) 8430 { 8431 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 8432 struct sk_buff *skb; 8433 u16 flags = 0; 8434 int err; 8435 8436 if (!ctx->report && 8437 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 8438 return; 8439 8440 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8441 if (skb == NULL) 8442 goto err; 8443 8444 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 8445 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 8446 8447 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, 8448 ctx->seq, event, flags, 8449 ctx->family, flowtable, hook_list); 8450 if (err < 0) { 8451 kfree_skb(skb); 8452 goto err; 8453 } 8454 8455 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 8456 return; 8457 err: 8458 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 8459 } 8460 8461 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 8462 { 8463 struct nft_hook *hook, *next; 8464 8465 flowtable->data.type->free(&flowtable->data); 8466 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 8467 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 8468 FLOW_BLOCK_UNBIND); 8469 list_del_rcu(&hook->list); 8470 kfree(hook); 8471 } 8472 kfree(flowtable->name); 8473 module_put(flowtable->data.type->owner); 8474 kfree(flowtable); 8475 } 8476 8477 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 8478 u32 portid, u32 seq) 8479 { 8480 struct nftables_pernet *nft_net = nft_pernet(net); 8481 struct nlmsghdr *nlh; 8482 char buf[TASK_COMM_LEN]; 8483 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); 8484 8485 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, 8486 NFNETLINK_V0, nft_base_seq(net)); 8487 if (!nlh) 8488 goto nla_put_failure; 8489 8490 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) || 8491 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || 8492 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) 8493 goto nla_put_failure; 8494 8495 nlmsg_end(skb, nlh); 8496 return 0; 8497 8498 nla_put_failure: 8499 nlmsg_trim(skb, nlh); 8500 return -EMSGSIZE; 8501 } 8502 8503 static void nft_flowtable_event(unsigned long event, struct net_device *dev, 8504 struct nft_flowtable *flowtable) 8505 { 8506 struct nft_hook *hook; 8507 8508 list_for_each_entry(hook, &flowtable->hook_list, list) { 8509 if (hook->ops.dev != dev) 8510 continue; 8511 8512 /* flow_offload_netdev_event() cleans up entries for us. */ 8513 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook); 8514 list_del_rcu(&hook->list); 8515 kfree_rcu(hook, rcu); 8516 break; 8517 } 8518 } 8519 8520 static int nf_tables_flowtable_event(struct notifier_block *this, 8521 unsigned long event, void *ptr) 8522 { 8523 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 8524 struct nft_flowtable *flowtable; 8525 struct nftables_pernet *nft_net; 8526 struct nft_table *table; 8527 struct net *net; 8528 8529 if (event != NETDEV_UNREGISTER) 8530 return 0; 8531 8532 net = dev_net(dev); 8533 nft_net = nft_pernet(net); 8534 mutex_lock(&nft_net->commit_mutex); 8535 list_for_each_entry(table, &nft_net->tables, list) { 8536 list_for_each_entry(flowtable, &table->flowtables, list) { 8537 nft_flowtable_event(event, dev, flowtable); 8538 } 8539 } 8540 mutex_unlock(&nft_net->commit_mutex); 8541 8542 return NOTIFY_DONE; 8543 } 8544 8545 static struct notifier_block nf_tables_flowtable_notifier = { 8546 .notifier_call = nf_tables_flowtable_event, 8547 }; 8548 8549 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, 8550 int event) 8551 { 8552 struct nlmsghdr *nlh = nlmsg_hdr(skb); 8553 struct sk_buff *skb2; 8554 int err; 8555 8556 if (!nlmsg_report(nlh) && 8557 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 8558 return; 8559 8560 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8561 if (skb2 == NULL) 8562 goto err; 8563 8564 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 8565 nlh->nlmsg_seq); 8566 if (err < 0) { 8567 kfree_skb(skb2); 8568 goto err; 8569 } 8570 8571 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8572 nlmsg_report(nlh), GFP_KERNEL); 8573 return; 8574 err: 8575 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8576 -ENOBUFS); 8577 } 8578 8579 static int nf_tables_getgen(struct sk_buff *skb, const struct nfnl_info *info, 8580 const struct nlattr * const nla[]) 8581 { 8582 struct sk_buff *skb2; 8583 int err; 8584 8585 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8586 if (skb2 == NULL) 8587 return -ENOMEM; 8588 8589 err = nf_tables_fill_gen_info(skb2, info->net, NETLINK_CB(skb).portid, 8590 info->nlh->nlmsg_seq); 8591 if (err < 0) 8592 goto err_fill_gen_info; 8593 8594 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 8595 8596 err_fill_gen_info: 8597 kfree_skb(skb2); 8598 return err; 8599 } 8600 8601 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 8602 [NFT_MSG_NEWTABLE] = { 8603 .call = nf_tables_newtable, 8604 .type = NFNL_CB_BATCH, 8605 .attr_count = NFTA_TABLE_MAX, 8606 .policy = nft_table_policy, 8607 }, 8608 [NFT_MSG_GETTABLE] = { 8609 .call = nf_tables_gettable, 8610 .type = NFNL_CB_RCU, 8611 .attr_count = NFTA_TABLE_MAX, 8612 .policy = nft_table_policy, 8613 }, 8614 [NFT_MSG_DELTABLE] = { 8615 .call = nf_tables_deltable, 8616 .type = NFNL_CB_BATCH, 8617 .attr_count = NFTA_TABLE_MAX, 8618 .policy = nft_table_policy, 8619 }, 8620 [NFT_MSG_DESTROYTABLE] = { 8621 .call = nf_tables_deltable, 8622 .type = NFNL_CB_BATCH, 8623 .attr_count = NFTA_TABLE_MAX, 8624 .policy = nft_table_policy, 8625 }, 8626 [NFT_MSG_NEWCHAIN] = { 8627 .call = nf_tables_newchain, 8628 .type = NFNL_CB_BATCH, 8629 .attr_count = NFTA_CHAIN_MAX, 8630 .policy = nft_chain_policy, 8631 }, 8632 [NFT_MSG_GETCHAIN] = { 8633 .call = nf_tables_getchain, 8634 .type = NFNL_CB_RCU, 8635 .attr_count = NFTA_CHAIN_MAX, 8636 .policy = nft_chain_policy, 8637 }, 8638 [NFT_MSG_DELCHAIN] = { 8639 .call = nf_tables_delchain, 8640 .type = NFNL_CB_BATCH, 8641 .attr_count = NFTA_CHAIN_MAX, 8642 .policy = nft_chain_policy, 8643 }, 8644 [NFT_MSG_DESTROYCHAIN] = { 8645 .call = nf_tables_delchain, 8646 .type = NFNL_CB_BATCH, 8647 .attr_count = NFTA_CHAIN_MAX, 8648 .policy = nft_chain_policy, 8649 }, 8650 [NFT_MSG_NEWRULE] = { 8651 .call = nf_tables_newrule, 8652 .type = NFNL_CB_BATCH, 8653 .attr_count = NFTA_RULE_MAX, 8654 .policy = nft_rule_policy, 8655 }, 8656 [NFT_MSG_GETRULE] = { 8657 .call = nf_tables_getrule, 8658 .type = NFNL_CB_RCU, 8659 .attr_count = NFTA_RULE_MAX, 8660 .policy = nft_rule_policy, 8661 }, 8662 [NFT_MSG_GETRULE_RESET] = { 8663 .call = nf_tables_getrule, 8664 .type = NFNL_CB_RCU, 8665 .attr_count = NFTA_RULE_MAX, 8666 .policy = nft_rule_policy, 8667 }, 8668 [NFT_MSG_DELRULE] = { 8669 .call = nf_tables_delrule, 8670 .type = NFNL_CB_BATCH, 8671 .attr_count = NFTA_RULE_MAX, 8672 .policy = nft_rule_policy, 8673 }, 8674 [NFT_MSG_DESTROYRULE] = { 8675 .call = nf_tables_delrule, 8676 .type = NFNL_CB_BATCH, 8677 .attr_count = NFTA_RULE_MAX, 8678 .policy = nft_rule_policy, 8679 }, 8680 [NFT_MSG_NEWSET] = { 8681 .call = nf_tables_newset, 8682 .type = NFNL_CB_BATCH, 8683 .attr_count = NFTA_SET_MAX, 8684 .policy = nft_set_policy, 8685 }, 8686 [NFT_MSG_GETSET] = { 8687 .call = nf_tables_getset, 8688 .type = NFNL_CB_RCU, 8689 .attr_count = NFTA_SET_MAX, 8690 .policy = nft_set_policy, 8691 }, 8692 [NFT_MSG_DELSET] = { 8693 .call = nf_tables_delset, 8694 .type = NFNL_CB_BATCH, 8695 .attr_count = NFTA_SET_MAX, 8696 .policy = nft_set_policy, 8697 }, 8698 [NFT_MSG_DESTROYSET] = { 8699 .call = nf_tables_delset, 8700 .type = NFNL_CB_BATCH, 8701 .attr_count = NFTA_SET_MAX, 8702 .policy = nft_set_policy, 8703 }, 8704 [NFT_MSG_NEWSETELEM] = { 8705 .call = nf_tables_newsetelem, 8706 .type = NFNL_CB_BATCH, 8707 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8708 .policy = nft_set_elem_list_policy, 8709 }, 8710 [NFT_MSG_GETSETELEM] = { 8711 .call = nf_tables_getsetelem, 8712 .type = NFNL_CB_RCU, 8713 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8714 .policy = nft_set_elem_list_policy, 8715 }, 8716 [NFT_MSG_DELSETELEM] = { 8717 .call = nf_tables_delsetelem, 8718 .type = NFNL_CB_BATCH, 8719 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8720 .policy = nft_set_elem_list_policy, 8721 }, 8722 [NFT_MSG_DESTROYSETELEM] = { 8723 .call = nf_tables_delsetelem, 8724 .type = NFNL_CB_BATCH, 8725 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8726 .policy = nft_set_elem_list_policy, 8727 }, 8728 [NFT_MSG_GETGEN] = { 8729 .call = nf_tables_getgen, 8730 .type = NFNL_CB_RCU, 8731 }, 8732 [NFT_MSG_NEWOBJ] = { 8733 .call = nf_tables_newobj, 8734 .type = NFNL_CB_BATCH, 8735 .attr_count = NFTA_OBJ_MAX, 8736 .policy = nft_obj_policy, 8737 }, 8738 [NFT_MSG_GETOBJ] = { 8739 .call = nf_tables_getobj, 8740 .type = NFNL_CB_RCU, 8741 .attr_count = NFTA_OBJ_MAX, 8742 .policy = nft_obj_policy, 8743 }, 8744 [NFT_MSG_DELOBJ] = { 8745 .call = nf_tables_delobj, 8746 .type = NFNL_CB_BATCH, 8747 .attr_count = NFTA_OBJ_MAX, 8748 .policy = nft_obj_policy, 8749 }, 8750 [NFT_MSG_DESTROYOBJ] = { 8751 .call = nf_tables_delobj, 8752 .type = NFNL_CB_BATCH, 8753 .attr_count = NFTA_OBJ_MAX, 8754 .policy = nft_obj_policy, 8755 }, 8756 [NFT_MSG_GETOBJ_RESET] = { 8757 .call = nf_tables_getobj, 8758 .type = NFNL_CB_RCU, 8759 .attr_count = NFTA_OBJ_MAX, 8760 .policy = nft_obj_policy, 8761 }, 8762 [NFT_MSG_NEWFLOWTABLE] = { 8763 .call = nf_tables_newflowtable, 8764 .type = NFNL_CB_BATCH, 8765 .attr_count = NFTA_FLOWTABLE_MAX, 8766 .policy = nft_flowtable_policy, 8767 }, 8768 [NFT_MSG_GETFLOWTABLE] = { 8769 .call = nf_tables_getflowtable, 8770 .type = NFNL_CB_RCU, 8771 .attr_count = NFTA_FLOWTABLE_MAX, 8772 .policy = nft_flowtable_policy, 8773 }, 8774 [NFT_MSG_DELFLOWTABLE] = { 8775 .call = nf_tables_delflowtable, 8776 .type = NFNL_CB_BATCH, 8777 .attr_count = NFTA_FLOWTABLE_MAX, 8778 .policy = nft_flowtable_policy, 8779 }, 8780 [NFT_MSG_DESTROYFLOWTABLE] = { 8781 .call = nf_tables_delflowtable, 8782 .type = NFNL_CB_BATCH, 8783 .attr_count = NFTA_FLOWTABLE_MAX, 8784 .policy = nft_flowtable_policy, 8785 }, 8786 }; 8787 8788 static int nf_tables_validate(struct net *net) 8789 { 8790 struct nftables_pernet *nft_net = nft_pernet(net); 8791 struct nft_table *table; 8792 8793 list_for_each_entry(table, &nft_net->tables, list) { 8794 switch (table->validate_state) { 8795 case NFT_VALIDATE_SKIP: 8796 continue; 8797 case NFT_VALIDATE_NEED: 8798 nft_validate_state_update(table, NFT_VALIDATE_DO); 8799 fallthrough; 8800 case NFT_VALIDATE_DO: 8801 if (nft_table_validate(net, table) < 0) 8802 return -EAGAIN; 8803 8804 nft_validate_state_update(table, NFT_VALIDATE_SKIP); 8805 } 8806 8807 break; 8808 } 8809 8810 return 0; 8811 } 8812 8813 /* a drop policy has to be deferred until all rules have been activated, 8814 * otherwise a large ruleset that contains a drop-policy base chain will 8815 * cause all packets to get dropped until the full transaction has been 8816 * processed. 8817 * 8818 * We defer the drop policy until the transaction has been finalized. 8819 */ 8820 static void nft_chain_commit_drop_policy(struct nft_trans *trans) 8821 { 8822 struct nft_base_chain *basechain; 8823 8824 if (nft_trans_chain_policy(trans) != NF_DROP) 8825 return; 8826 8827 if (!nft_is_base_chain(trans->ctx.chain)) 8828 return; 8829 8830 basechain = nft_base_chain(trans->ctx.chain); 8831 basechain->policy = NF_DROP; 8832 } 8833 8834 static void nft_chain_commit_update(struct nft_trans *trans) 8835 { 8836 struct nft_base_chain *basechain; 8837 8838 if (nft_trans_chain_name(trans)) { 8839 rhltable_remove(&trans->ctx.table->chains_ht, 8840 &trans->ctx.chain->rhlhead, 8841 nft_chain_ht_params); 8842 swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); 8843 rhltable_insert_key(&trans->ctx.table->chains_ht, 8844 trans->ctx.chain->name, 8845 &trans->ctx.chain->rhlhead, 8846 nft_chain_ht_params); 8847 } 8848 8849 if (!nft_is_base_chain(trans->ctx.chain)) 8850 return; 8851 8852 nft_chain_stats_replace(trans); 8853 8854 basechain = nft_base_chain(trans->ctx.chain); 8855 8856 switch (nft_trans_chain_policy(trans)) { 8857 case NF_DROP: 8858 case NF_ACCEPT: 8859 basechain->policy = nft_trans_chain_policy(trans); 8860 break; 8861 } 8862 } 8863 8864 static void nft_obj_commit_update(struct nft_trans *trans) 8865 { 8866 struct nft_object *newobj; 8867 struct nft_object *obj; 8868 8869 obj = nft_trans_obj(trans); 8870 newobj = nft_trans_obj_newobj(trans); 8871 8872 if (obj->ops->update) 8873 obj->ops->update(obj, newobj); 8874 8875 nft_obj_destroy(&trans->ctx, newobj); 8876 } 8877 8878 static void nft_commit_release(struct nft_trans *trans) 8879 { 8880 switch (trans->msg_type) { 8881 case NFT_MSG_DELTABLE: 8882 case NFT_MSG_DESTROYTABLE: 8883 nf_tables_table_destroy(&trans->ctx); 8884 break; 8885 case NFT_MSG_NEWCHAIN: 8886 free_percpu(nft_trans_chain_stats(trans)); 8887 kfree(nft_trans_chain_name(trans)); 8888 break; 8889 case NFT_MSG_DELCHAIN: 8890 case NFT_MSG_DESTROYCHAIN: 8891 if (nft_trans_chain_update(trans)) 8892 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 8893 else 8894 nf_tables_chain_destroy(&trans->ctx); 8895 break; 8896 case NFT_MSG_DELRULE: 8897 case NFT_MSG_DESTROYRULE: 8898 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 8899 break; 8900 case NFT_MSG_DELSET: 8901 case NFT_MSG_DESTROYSET: 8902 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 8903 break; 8904 case NFT_MSG_DELSETELEM: 8905 case NFT_MSG_DESTROYSETELEM: 8906 nf_tables_set_elem_destroy(&trans->ctx, 8907 nft_trans_elem_set(trans), 8908 nft_trans_elem(trans).priv); 8909 break; 8910 case NFT_MSG_DELOBJ: 8911 case NFT_MSG_DESTROYOBJ: 8912 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 8913 break; 8914 case NFT_MSG_DELFLOWTABLE: 8915 case NFT_MSG_DESTROYFLOWTABLE: 8916 if (nft_trans_flowtable_update(trans)) 8917 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 8918 else 8919 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 8920 break; 8921 } 8922 8923 if (trans->put_net) 8924 put_net(trans->ctx.net); 8925 8926 kfree(trans); 8927 } 8928 8929 static void nf_tables_trans_destroy_work(struct work_struct *w) 8930 { 8931 struct nft_trans *trans, *next; 8932 LIST_HEAD(head); 8933 8934 spin_lock(&nf_tables_destroy_list_lock); 8935 list_splice_init(&nf_tables_destroy_list, &head); 8936 spin_unlock(&nf_tables_destroy_list_lock); 8937 8938 if (list_empty(&head)) 8939 return; 8940 8941 synchronize_rcu(); 8942 8943 list_for_each_entry_safe(trans, next, &head, list) { 8944 list_del(&trans->list); 8945 nft_commit_release(trans); 8946 } 8947 } 8948 8949 void nf_tables_trans_destroy_flush_work(void) 8950 { 8951 flush_work(&trans_destroy_work); 8952 } 8953 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); 8954 8955 static bool nft_expr_reduce(struct nft_regs_track *track, 8956 const struct nft_expr *expr) 8957 { 8958 return false; 8959 } 8960 8961 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain) 8962 { 8963 const struct nft_expr *expr, *last; 8964 struct nft_regs_track track = {}; 8965 unsigned int size, data_size; 8966 void *data, *data_boundary; 8967 struct nft_rule_dp *prule; 8968 struct nft_rule *rule; 8969 8970 /* already handled or inactive chain? */ 8971 if (chain->blob_next || !nft_is_active_next(net, chain)) 8972 return 0; 8973 8974 data_size = 0; 8975 list_for_each_entry(rule, &chain->rules, list) { 8976 if (nft_is_active_next(net, rule)) { 8977 data_size += sizeof(*prule) + rule->dlen; 8978 if (data_size > INT_MAX) 8979 return -ENOMEM; 8980 } 8981 } 8982 8983 chain->blob_next = nf_tables_chain_alloc_rules(chain, data_size); 8984 if (!chain->blob_next) 8985 return -ENOMEM; 8986 8987 data = (void *)chain->blob_next->data; 8988 data_boundary = data + data_size; 8989 size = 0; 8990 8991 list_for_each_entry(rule, &chain->rules, list) { 8992 if (!nft_is_active_next(net, rule)) 8993 continue; 8994 8995 prule = (struct nft_rule_dp *)data; 8996 data += offsetof(struct nft_rule_dp, data); 8997 if (WARN_ON_ONCE(data > data_boundary)) 8998 return -ENOMEM; 8999 9000 size = 0; 9001 track.last = nft_expr_last(rule); 9002 nft_rule_for_each_expr(expr, last, rule) { 9003 track.cur = expr; 9004 9005 if (nft_expr_reduce(&track, expr)) { 9006 expr = track.cur; 9007 continue; 9008 } 9009 9010 if (WARN_ON_ONCE(data + expr->ops->size > data_boundary)) 9011 return -ENOMEM; 9012 9013 memcpy(data + size, expr, expr->ops->size); 9014 size += expr->ops->size; 9015 } 9016 if (WARN_ON_ONCE(size >= 1 << 12)) 9017 return -ENOMEM; 9018 9019 prule->handle = rule->handle; 9020 prule->dlen = size; 9021 prule->is_last = 0; 9022 9023 data += size; 9024 size = 0; 9025 chain->blob_next->size += (unsigned long)(data - (void *)prule); 9026 } 9027 9028 if (WARN_ON_ONCE(data > data_boundary)) 9029 return -ENOMEM; 9030 9031 prule = (struct nft_rule_dp *)data; 9032 nft_last_rule(chain, prule); 9033 9034 return 0; 9035 } 9036 9037 static void nf_tables_commit_chain_prepare_cancel(struct net *net) 9038 { 9039 struct nftables_pernet *nft_net = nft_pernet(net); 9040 struct nft_trans *trans, *next; 9041 9042 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9043 struct nft_chain *chain = trans->ctx.chain; 9044 9045 if (trans->msg_type == NFT_MSG_NEWRULE || 9046 trans->msg_type == NFT_MSG_DELRULE) { 9047 kvfree(chain->blob_next); 9048 chain->blob_next = NULL; 9049 } 9050 } 9051 } 9052 9053 static void __nf_tables_commit_chain_free_rules(struct rcu_head *h) 9054 { 9055 struct nft_rule_dp_last *l = container_of(h, struct nft_rule_dp_last, h); 9056 9057 kvfree(l->blob); 9058 } 9059 9060 static void nf_tables_commit_chain_free_rules_old(struct nft_rule_blob *blob) 9061 { 9062 struct nft_rule_dp_last *last; 9063 9064 /* last rule trailer is after end marker */ 9065 last = (void *)blob + sizeof(*blob) + blob->size; 9066 last->blob = blob; 9067 9068 call_rcu(&last->h, __nf_tables_commit_chain_free_rules); 9069 } 9070 9071 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain) 9072 { 9073 struct nft_rule_blob *g0, *g1; 9074 bool next_genbit; 9075 9076 next_genbit = nft_gencursor_next(net); 9077 9078 g0 = rcu_dereference_protected(chain->blob_gen_0, 9079 lockdep_commit_lock_is_held(net)); 9080 g1 = rcu_dereference_protected(chain->blob_gen_1, 9081 lockdep_commit_lock_is_held(net)); 9082 9083 /* No changes to this chain? */ 9084 if (chain->blob_next == NULL) { 9085 /* chain had no change in last or next generation */ 9086 if (g0 == g1) 9087 return; 9088 /* 9089 * chain had no change in this generation; make sure next 9090 * one uses same rules as current generation. 9091 */ 9092 if (next_genbit) { 9093 rcu_assign_pointer(chain->blob_gen_1, g0); 9094 nf_tables_commit_chain_free_rules_old(g1); 9095 } else { 9096 rcu_assign_pointer(chain->blob_gen_0, g1); 9097 nf_tables_commit_chain_free_rules_old(g0); 9098 } 9099 9100 return; 9101 } 9102 9103 if (next_genbit) 9104 rcu_assign_pointer(chain->blob_gen_1, chain->blob_next); 9105 else 9106 rcu_assign_pointer(chain->blob_gen_0, chain->blob_next); 9107 9108 chain->blob_next = NULL; 9109 9110 if (g0 == g1) 9111 return; 9112 9113 if (next_genbit) 9114 nf_tables_commit_chain_free_rules_old(g1); 9115 else 9116 nf_tables_commit_chain_free_rules_old(g0); 9117 } 9118 9119 static void nft_obj_del(struct nft_object *obj) 9120 { 9121 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params); 9122 list_del_rcu(&obj->list); 9123 } 9124 9125 void nft_chain_del(struct nft_chain *chain) 9126 { 9127 struct nft_table *table = chain->table; 9128 9129 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead, 9130 nft_chain_ht_params)); 9131 list_del_rcu(&chain->list); 9132 } 9133 9134 static void nf_tables_module_autoload_cleanup(struct net *net) 9135 { 9136 struct nftables_pernet *nft_net = nft_pernet(net); 9137 struct nft_module_request *req, *next; 9138 9139 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 9140 list_for_each_entry_safe(req, next, &nft_net->module_list, list) { 9141 WARN_ON_ONCE(!req->done); 9142 list_del(&req->list); 9143 kfree(req); 9144 } 9145 } 9146 9147 static void nf_tables_commit_release(struct net *net) 9148 { 9149 struct nftables_pernet *nft_net = nft_pernet(net); 9150 struct nft_trans *trans; 9151 9152 /* all side effects have to be made visible. 9153 * For example, if a chain named 'foo' has been deleted, a 9154 * new transaction must not find it anymore. 9155 * 9156 * Memory reclaim happens asynchronously from work queue 9157 * to prevent expensive synchronize_rcu() in commit phase. 9158 */ 9159 if (list_empty(&nft_net->commit_list)) { 9160 nf_tables_module_autoload_cleanup(net); 9161 mutex_unlock(&nft_net->commit_mutex); 9162 return; 9163 } 9164 9165 trans = list_last_entry(&nft_net->commit_list, 9166 struct nft_trans, list); 9167 get_net(trans->ctx.net); 9168 WARN_ON_ONCE(trans->put_net); 9169 9170 trans->put_net = true; 9171 spin_lock(&nf_tables_destroy_list_lock); 9172 list_splice_tail_init(&nft_net->commit_list, &nf_tables_destroy_list); 9173 spin_unlock(&nf_tables_destroy_list_lock); 9174 9175 nf_tables_module_autoload_cleanup(net); 9176 schedule_work(&trans_destroy_work); 9177 9178 mutex_unlock(&nft_net->commit_mutex); 9179 } 9180 9181 static void nft_commit_notify(struct net *net, u32 portid) 9182 { 9183 struct nftables_pernet *nft_net = nft_pernet(net); 9184 struct sk_buff *batch_skb = NULL, *nskb, *skb; 9185 unsigned char *data; 9186 int len; 9187 9188 list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) { 9189 if (!batch_skb) { 9190 new_batch: 9191 batch_skb = skb; 9192 len = NLMSG_GOODSIZE - skb->len; 9193 list_del(&skb->list); 9194 continue; 9195 } 9196 len -= skb->len; 9197 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) { 9198 data = skb_put(batch_skb, skb->len); 9199 memcpy(data, skb->data, skb->len); 9200 list_del(&skb->list); 9201 kfree_skb(skb); 9202 continue; 9203 } 9204 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 9205 NFT_CB(batch_skb).report, GFP_KERNEL); 9206 goto new_batch; 9207 } 9208 9209 if (batch_skb) { 9210 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 9211 NFT_CB(batch_skb).report, GFP_KERNEL); 9212 } 9213 9214 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 9215 } 9216 9217 static int nf_tables_commit_audit_alloc(struct list_head *adl, 9218 struct nft_table *table) 9219 { 9220 struct nft_audit_data *adp; 9221 9222 list_for_each_entry(adp, adl, list) { 9223 if (adp->table == table) 9224 return 0; 9225 } 9226 adp = kzalloc(sizeof(*adp), GFP_KERNEL); 9227 if (!adp) 9228 return -ENOMEM; 9229 adp->table = table; 9230 list_add(&adp->list, adl); 9231 return 0; 9232 } 9233 9234 static void nf_tables_commit_audit_free(struct list_head *adl) 9235 { 9236 struct nft_audit_data *adp, *adn; 9237 9238 list_for_each_entry_safe(adp, adn, adl, list) { 9239 list_del(&adp->list); 9240 kfree(adp); 9241 } 9242 } 9243 9244 static void nf_tables_commit_audit_collect(struct list_head *adl, 9245 struct nft_table *table, u32 op) 9246 { 9247 struct nft_audit_data *adp; 9248 9249 list_for_each_entry(adp, adl, list) { 9250 if (adp->table == table) 9251 goto found; 9252 } 9253 WARN_ONCE(1, "table=%s not expected in commit list", table->name); 9254 return; 9255 found: 9256 adp->entries++; 9257 if (!adp->op || adp->op > op) 9258 adp->op = op; 9259 } 9260 9261 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22) 9262 9263 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation) 9264 { 9265 struct nft_audit_data *adp, *adn; 9266 char aubuf[AUNFTABLENAMELEN]; 9267 9268 list_for_each_entry_safe(adp, adn, adl, list) { 9269 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name, 9270 generation); 9271 audit_log_nfcfg(aubuf, adp->table->family, adp->entries, 9272 nft2audit_op[adp->op], GFP_KERNEL); 9273 list_del(&adp->list); 9274 kfree(adp); 9275 } 9276 } 9277 9278 static int nf_tables_commit(struct net *net, struct sk_buff *skb) 9279 { 9280 struct nftables_pernet *nft_net = nft_pernet(net); 9281 struct nft_trans *trans, *next; 9282 struct nft_trans_elem *te; 9283 struct nft_chain *chain; 9284 struct nft_table *table; 9285 unsigned int base_seq; 9286 LIST_HEAD(adl); 9287 int err; 9288 9289 if (list_empty(&nft_net->commit_list)) { 9290 mutex_unlock(&nft_net->commit_mutex); 9291 return 0; 9292 } 9293 9294 /* 0. Validate ruleset, otherwise roll back for error reporting. */ 9295 if (nf_tables_validate(net) < 0) 9296 return -EAGAIN; 9297 9298 err = nft_flow_rule_offload_commit(net); 9299 if (err < 0) 9300 return err; 9301 9302 /* 1. Allocate space for next generation rules_gen_X[] */ 9303 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9304 int ret; 9305 9306 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); 9307 if (ret) { 9308 nf_tables_commit_chain_prepare_cancel(net); 9309 nf_tables_commit_audit_free(&adl); 9310 return ret; 9311 } 9312 if (trans->msg_type == NFT_MSG_NEWRULE || 9313 trans->msg_type == NFT_MSG_DELRULE) { 9314 chain = trans->ctx.chain; 9315 9316 ret = nf_tables_commit_chain_prepare(net, chain); 9317 if (ret < 0) { 9318 nf_tables_commit_chain_prepare_cancel(net); 9319 nf_tables_commit_audit_free(&adl); 9320 return ret; 9321 } 9322 } 9323 } 9324 9325 /* step 2. Make rules_gen_X visible to packet path */ 9326 list_for_each_entry(table, &nft_net->tables, list) { 9327 list_for_each_entry(chain, &table->chains, list) 9328 nf_tables_commit_chain(net, chain); 9329 } 9330 9331 /* 9332 * Bump generation counter, invalidate any dump in progress. 9333 * Cannot fail after this point. 9334 */ 9335 base_seq = READ_ONCE(nft_net->base_seq); 9336 while (++base_seq == 0) 9337 ; 9338 9339 WRITE_ONCE(nft_net->base_seq, base_seq); 9340 9341 /* step 3. Start new generation, rules_gen_X now in use. */ 9342 net->nft.gencursor = nft_gencursor_next(net); 9343 9344 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 9345 nf_tables_commit_audit_collect(&adl, trans->ctx.table, 9346 trans->msg_type); 9347 switch (trans->msg_type) { 9348 case NFT_MSG_NEWTABLE: 9349 if (nft_trans_table_update(trans)) { 9350 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 9351 nft_trans_destroy(trans); 9352 break; 9353 } 9354 if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT) 9355 nf_tables_table_disable(net, trans->ctx.table); 9356 9357 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 9358 } else { 9359 nft_clear(net, trans->ctx.table); 9360 } 9361 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE); 9362 nft_trans_destroy(trans); 9363 break; 9364 case NFT_MSG_DELTABLE: 9365 case NFT_MSG_DESTROYTABLE: 9366 list_del_rcu(&trans->ctx.table->list); 9367 nf_tables_table_notify(&trans->ctx, trans->msg_type); 9368 break; 9369 case NFT_MSG_NEWCHAIN: 9370 if (nft_trans_chain_update(trans)) { 9371 nft_chain_commit_update(trans); 9372 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, 9373 &nft_trans_chain_hooks(trans)); 9374 list_splice(&nft_trans_chain_hooks(trans), 9375 &nft_trans_basechain(trans)->hook_list); 9376 /* trans destroyed after rcu grace period */ 9377 } else { 9378 nft_chain_commit_drop_policy(trans); 9379 nft_clear(net, trans->ctx.chain); 9380 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, NULL); 9381 nft_trans_destroy(trans); 9382 } 9383 break; 9384 case NFT_MSG_DELCHAIN: 9385 case NFT_MSG_DESTROYCHAIN: 9386 if (nft_trans_chain_update(trans)) { 9387 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, 9388 &nft_trans_chain_hooks(trans)); 9389 nft_netdev_unregister_hooks(net, 9390 &nft_trans_chain_hooks(trans), 9391 true); 9392 } else { 9393 nft_chain_del(trans->ctx.chain); 9394 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, 9395 NULL); 9396 nf_tables_unregister_hook(trans->ctx.net, 9397 trans->ctx.table, 9398 trans->ctx.chain); 9399 } 9400 break; 9401 case NFT_MSG_NEWRULE: 9402 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 9403 nf_tables_rule_notify(&trans->ctx, 9404 nft_trans_rule(trans), 9405 NFT_MSG_NEWRULE); 9406 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9407 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9408 9409 nft_trans_destroy(trans); 9410 break; 9411 case NFT_MSG_DELRULE: 9412 case NFT_MSG_DESTROYRULE: 9413 list_del_rcu(&nft_trans_rule(trans)->list); 9414 nf_tables_rule_notify(&trans->ctx, 9415 nft_trans_rule(trans), 9416 trans->msg_type); 9417 nft_rule_expr_deactivate(&trans->ctx, 9418 nft_trans_rule(trans), 9419 NFT_TRANS_COMMIT); 9420 9421 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9422 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9423 break; 9424 case NFT_MSG_NEWSET: 9425 if (nft_trans_set_update(trans)) { 9426 struct nft_set *set = nft_trans_set(trans); 9427 9428 WRITE_ONCE(set->timeout, nft_trans_set_timeout(trans)); 9429 WRITE_ONCE(set->gc_int, nft_trans_set_gc_int(trans)); 9430 } else { 9431 nft_clear(net, nft_trans_set(trans)); 9432 /* This avoids hitting -EBUSY when deleting the table 9433 * from the transaction. 9434 */ 9435 if (nft_set_is_anonymous(nft_trans_set(trans)) && 9436 !list_empty(&nft_trans_set(trans)->bindings)) 9437 trans->ctx.table->use--; 9438 } 9439 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 9440 NFT_MSG_NEWSET, GFP_KERNEL); 9441 nft_trans_destroy(trans); 9442 break; 9443 case NFT_MSG_DELSET: 9444 case NFT_MSG_DESTROYSET: 9445 list_del_rcu(&nft_trans_set(trans)->list); 9446 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 9447 trans->msg_type, GFP_KERNEL); 9448 break; 9449 case NFT_MSG_NEWSETELEM: 9450 te = (struct nft_trans_elem *)trans->data; 9451 9452 nft_setelem_activate(net, te->set, &te->elem); 9453 nf_tables_setelem_notify(&trans->ctx, te->set, 9454 &te->elem, 9455 NFT_MSG_NEWSETELEM); 9456 nft_trans_destroy(trans); 9457 break; 9458 case NFT_MSG_DELSETELEM: 9459 case NFT_MSG_DESTROYSETELEM: 9460 te = (struct nft_trans_elem *)trans->data; 9461 9462 nf_tables_setelem_notify(&trans->ctx, te->set, 9463 &te->elem, 9464 trans->msg_type); 9465 nft_setelem_remove(net, te->set, &te->elem); 9466 if (!nft_setelem_is_catchall(te->set, &te->elem)) { 9467 atomic_dec(&te->set->nelems); 9468 te->set->ndeact--; 9469 } 9470 break; 9471 case NFT_MSG_NEWOBJ: 9472 if (nft_trans_obj_update(trans)) { 9473 nft_obj_commit_update(trans); 9474 nf_tables_obj_notify(&trans->ctx, 9475 nft_trans_obj(trans), 9476 NFT_MSG_NEWOBJ); 9477 } else { 9478 nft_clear(net, nft_trans_obj(trans)); 9479 nf_tables_obj_notify(&trans->ctx, 9480 nft_trans_obj(trans), 9481 NFT_MSG_NEWOBJ); 9482 nft_trans_destroy(trans); 9483 } 9484 break; 9485 case NFT_MSG_DELOBJ: 9486 case NFT_MSG_DESTROYOBJ: 9487 nft_obj_del(nft_trans_obj(trans)); 9488 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans), 9489 trans->msg_type); 9490 break; 9491 case NFT_MSG_NEWFLOWTABLE: 9492 if (nft_trans_flowtable_update(trans)) { 9493 nft_trans_flowtable(trans)->data.flags = 9494 nft_trans_flowtable_flags(trans); 9495 nf_tables_flowtable_notify(&trans->ctx, 9496 nft_trans_flowtable(trans), 9497 &nft_trans_flowtable_hooks(trans), 9498 NFT_MSG_NEWFLOWTABLE); 9499 list_splice(&nft_trans_flowtable_hooks(trans), 9500 &nft_trans_flowtable(trans)->hook_list); 9501 } else { 9502 nft_clear(net, nft_trans_flowtable(trans)); 9503 nf_tables_flowtable_notify(&trans->ctx, 9504 nft_trans_flowtable(trans), 9505 NULL, 9506 NFT_MSG_NEWFLOWTABLE); 9507 } 9508 nft_trans_destroy(trans); 9509 break; 9510 case NFT_MSG_DELFLOWTABLE: 9511 case NFT_MSG_DESTROYFLOWTABLE: 9512 if (nft_trans_flowtable_update(trans)) { 9513 nf_tables_flowtable_notify(&trans->ctx, 9514 nft_trans_flowtable(trans), 9515 &nft_trans_flowtable_hooks(trans), 9516 trans->msg_type); 9517 nft_unregister_flowtable_net_hooks(net, 9518 &nft_trans_flowtable_hooks(trans)); 9519 } else { 9520 list_del_rcu(&nft_trans_flowtable(trans)->list); 9521 nf_tables_flowtable_notify(&trans->ctx, 9522 nft_trans_flowtable(trans), 9523 NULL, 9524 trans->msg_type); 9525 nft_unregister_flowtable_net_hooks(net, 9526 &nft_trans_flowtable(trans)->hook_list); 9527 } 9528 break; 9529 } 9530 } 9531 9532 nft_commit_notify(net, NETLINK_CB(skb).portid); 9533 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 9534 nf_tables_commit_audit_log(&adl, nft_net->base_seq); 9535 nf_tables_commit_release(net); 9536 9537 return 0; 9538 } 9539 9540 static void nf_tables_module_autoload(struct net *net) 9541 { 9542 struct nftables_pernet *nft_net = nft_pernet(net); 9543 struct nft_module_request *req, *next; 9544 LIST_HEAD(module_list); 9545 9546 list_splice_init(&nft_net->module_list, &module_list); 9547 mutex_unlock(&nft_net->commit_mutex); 9548 list_for_each_entry_safe(req, next, &module_list, list) { 9549 request_module("%s", req->module); 9550 req->done = true; 9551 } 9552 mutex_lock(&nft_net->commit_mutex); 9553 list_splice(&module_list, &nft_net->module_list); 9554 } 9555 9556 static void nf_tables_abort_release(struct nft_trans *trans) 9557 { 9558 switch (trans->msg_type) { 9559 case NFT_MSG_NEWTABLE: 9560 nf_tables_table_destroy(&trans->ctx); 9561 break; 9562 case NFT_MSG_NEWCHAIN: 9563 if (nft_trans_chain_update(trans)) 9564 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 9565 else 9566 nf_tables_chain_destroy(&trans->ctx); 9567 break; 9568 case NFT_MSG_NEWRULE: 9569 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 9570 break; 9571 case NFT_MSG_NEWSET: 9572 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 9573 break; 9574 case NFT_MSG_NEWSETELEM: 9575 nft_set_elem_destroy(nft_trans_elem_set(trans), 9576 nft_trans_elem(trans).priv, true); 9577 break; 9578 case NFT_MSG_NEWOBJ: 9579 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 9580 break; 9581 case NFT_MSG_NEWFLOWTABLE: 9582 if (nft_trans_flowtable_update(trans)) 9583 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 9584 else 9585 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 9586 break; 9587 } 9588 kfree(trans); 9589 } 9590 9591 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 9592 { 9593 struct nftables_pernet *nft_net = nft_pernet(net); 9594 struct nft_trans *trans, *next; 9595 struct nft_trans_elem *te; 9596 9597 if (action == NFNL_ABORT_VALIDATE && 9598 nf_tables_validate(net) < 0) 9599 return -EAGAIN; 9600 9601 list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, 9602 list) { 9603 switch (trans->msg_type) { 9604 case NFT_MSG_NEWTABLE: 9605 if (nft_trans_table_update(trans)) { 9606 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 9607 nft_trans_destroy(trans); 9608 break; 9609 } 9610 if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) { 9611 nf_tables_table_disable(net, trans->ctx.table); 9612 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 9613 } else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) { 9614 trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT; 9615 } 9616 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 9617 nft_trans_destroy(trans); 9618 } else { 9619 list_del_rcu(&trans->ctx.table->list); 9620 } 9621 break; 9622 case NFT_MSG_DELTABLE: 9623 case NFT_MSG_DESTROYTABLE: 9624 nft_clear(trans->ctx.net, trans->ctx.table); 9625 nft_trans_destroy(trans); 9626 break; 9627 case NFT_MSG_NEWCHAIN: 9628 if (nft_trans_chain_update(trans)) { 9629 nft_netdev_unregister_hooks(net, 9630 &nft_trans_chain_hooks(trans), 9631 true); 9632 free_percpu(nft_trans_chain_stats(trans)); 9633 kfree(nft_trans_chain_name(trans)); 9634 nft_trans_destroy(trans); 9635 } else { 9636 if (nft_chain_is_bound(trans->ctx.chain)) { 9637 nft_trans_destroy(trans); 9638 break; 9639 } 9640 trans->ctx.table->use--; 9641 nft_chain_del(trans->ctx.chain); 9642 nf_tables_unregister_hook(trans->ctx.net, 9643 trans->ctx.table, 9644 trans->ctx.chain); 9645 } 9646 break; 9647 case NFT_MSG_DELCHAIN: 9648 case NFT_MSG_DESTROYCHAIN: 9649 if (nft_trans_chain_update(trans)) { 9650 list_splice(&nft_trans_chain_hooks(trans), 9651 &nft_trans_basechain(trans)->hook_list); 9652 } else { 9653 trans->ctx.table->use++; 9654 nft_clear(trans->ctx.net, trans->ctx.chain); 9655 } 9656 nft_trans_destroy(trans); 9657 break; 9658 case NFT_MSG_NEWRULE: 9659 trans->ctx.chain->use--; 9660 list_del_rcu(&nft_trans_rule(trans)->list); 9661 nft_rule_expr_deactivate(&trans->ctx, 9662 nft_trans_rule(trans), 9663 NFT_TRANS_ABORT); 9664 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9665 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9666 break; 9667 case NFT_MSG_DELRULE: 9668 case NFT_MSG_DESTROYRULE: 9669 trans->ctx.chain->use++; 9670 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 9671 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans)); 9672 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9673 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9674 9675 nft_trans_destroy(trans); 9676 break; 9677 case NFT_MSG_NEWSET: 9678 if (nft_trans_set_update(trans)) { 9679 nft_trans_destroy(trans); 9680 break; 9681 } 9682 trans->ctx.table->use--; 9683 if (nft_trans_set_bound(trans)) { 9684 nft_trans_destroy(trans); 9685 break; 9686 } 9687 list_del_rcu(&nft_trans_set(trans)->list); 9688 break; 9689 case NFT_MSG_DELSET: 9690 case NFT_MSG_DESTROYSET: 9691 trans->ctx.table->use++; 9692 nft_clear(trans->ctx.net, nft_trans_set(trans)); 9693 nft_trans_destroy(trans); 9694 break; 9695 case NFT_MSG_NEWSETELEM: 9696 if (nft_trans_elem_set_bound(trans)) { 9697 nft_trans_destroy(trans); 9698 break; 9699 } 9700 te = (struct nft_trans_elem *)trans->data; 9701 nft_setelem_remove(net, te->set, &te->elem); 9702 if (!nft_setelem_is_catchall(te->set, &te->elem)) 9703 atomic_dec(&te->set->nelems); 9704 break; 9705 case NFT_MSG_DELSETELEM: 9706 case NFT_MSG_DESTROYSETELEM: 9707 te = (struct nft_trans_elem *)trans->data; 9708 9709 nft_setelem_data_activate(net, te->set, &te->elem); 9710 nft_setelem_activate(net, te->set, &te->elem); 9711 if (!nft_setelem_is_catchall(te->set, &te->elem)) 9712 te->set->ndeact--; 9713 9714 nft_trans_destroy(trans); 9715 break; 9716 case NFT_MSG_NEWOBJ: 9717 if (nft_trans_obj_update(trans)) { 9718 nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); 9719 nft_trans_destroy(trans); 9720 } else { 9721 trans->ctx.table->use--; 9722 nft_obj_del(nft_trans_obj(trans)); 9723 } 9724 break; 9725 case NFT_MSG_DELOBJ: 9726 case NFT_MSG_DESTROYOBJ: 9727 trans->ctx.table->use++; 9728 nft_clear(trans->ctx.net, nft_trans_obj(trans)); 9729 nft_trans_destroy(trans); 9730 break; 9731 case NFT_MSG_NEWFLOWTABLE: 9732 if (nft_trans_flowtable_update(trans)) { 9733 nft_unregister_flowtable_net_hooks(net, 9734 &nft_trans_flowtable_hooks(trans)); 9735 } else { 9736 trans->ctx.table->use--; 9737 list_del_rcu(&nft_trans_flowtable(trans)->list); 9738 nft_unregister_flowtable_net_hooks(net, 9739 &nft_trans_flowtable(trans)->hook_list); 9740 } 9741 break; 9742 case NFT_MSG_DELFLOWTABLE: 9743 case NFT_MSG_DESTROYFLOWTABLE: 9744 if (nft_trans_flowtable_update(trans)) { 9745 list_splice(&nft_trans_flowtable_hooks(trans), 9746 &nft_trans_flowtable(trans)->hook_list); 9747 } else { 9748 trans->ctx.table->use++; 9749 nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); 9750 } 9751 nft_trans_destroy(trans); 9752 break; 9753 } 9754 } 9755 9756 synchronize_rcu(); 9757 9758 list_for_each_entry_safe_reverse(trans, next, 9759 &nft_net->commit_list, list) { 9760 list_del(&trans->list); 9761 nf_tables_abort_release(trans); 9762 } 9763 9764 if (action == NFNL_ABORT_AUTOLOAD) 9765 nf_tables_module_autoload(net); 9766 else 9767 nf_tables_module_autoload_cleanup(net); 9768 9769 return 0; 9770 } 9771 9772 static int nf_tables_abort(struct net *net, struct sk_buff *skb, 9773 enum nfnl_abort_action action) 9774 { 9775 struct nftables_pernet *nft_net = nft_pernet(net); 9776 int ret = __nf_tables_abort(net, action); 9777 9778 mutex_unlock(&nft_net->commit_mutex); 9779 9780 return ret; 9781 } 9782 9783 static bool nf_tables_valid_genid(struct net *net, u32 genid) 9784 { 9785 struct nftables_pernet *nft_net = nft_pernet(net); 9786 bool genid_ok; 9787 9788 mutex_lock(&nft_net->commit_mutex); 9789 9790 genid_ok = genid == 0 || nft_net->base_seq == genid; 9791 if (!genid_ok) 9792 mutex_unlock(&nft_net->commit_mutex); 9793 9794 /* else, commit mutex has to be released by commit or abort function */ 9795 return genid_ok; 9796 } 9797 9798 static const struct nfnetlink_subsystem nf_tables_subsys = { 9799 .name = "nf_tables", 9800 .subsys_id = NFNL_SUBSYS_NFTABLES, 9801 .cb_count = NFT_MSG_MAX, 9802 .cb = nf_tables_cb, 9803 .commit = nf_tables_commit, 9804 .abort = nf_tables_abort, 9805 .valid_genid = nf_tables_valid_genid, 9806 .owner = THIS_MODULE, 9807 }; 9808 9809 int nft_chain_validate_dependency(const struct nft_chain *chain, 9810 enum nft_chain_types type) 9811 { 9812 const struct nft_base_chain *basechain; 9813 9814 if (nft_is_base_chain(chain)) { 9815 basechain = nft_base_chain(chain); 9816 if (basechain->type->type != type) 9817 return -EOPNOTSUPP; 9818 } 9819 return 0; 9820 } 9821 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 9822 9823 int nft_chain_validate_hooks(const struct nft_chain *chain, 9824 unsigned int hook_flags) 9825 { 9826 struct nft_base_chain *basechain; 9827 9828 if (nft_is_base_chain(chain)) { 9829 basechain = nft_base_chain(chain); 9830 9831 if ((1 << basechain->ops.hooknum) & hook_flags) 9832 return 0; 9833 9834 return -EOPNOTSUPP; 9835 } 9836 9837 return 0; 9838 } 9839 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 9840 9841 /* 9842 * Loop detection - walk through the ruleset beginning at the destination chain 9843 * of a new jump until either the source chain is reached (loop) or all 9844 * reachable chains have been traversed. 9845 * 9846 * The loop check is performed whenever a new jump verdict is added to an 9847 * expression or verdict map or a verdict map is bound to a new chain. 9848 */ 9849 9850 static int nf_tables_check_loops(const struct nft_ctx *ctx, 9851 const struct nft_chain *chain); 9852 9853 static int nft_check_loops(const struct nft_ctx *ctx, 9854 const struct nft_set_ext *ext) 9855 { 9856 const struct nft_data *data; 9857 int ret; 9858 9859 data = nft_set_ext_data(ext); 9860 switch (data->verdict.code) { 9861 case NFT_JUMP: 9862 case NFT_GOTO: 9863 ret = nf_tables_check_loops(ctx, data->verdict.chain); 9864 break; 9865 default: 9866 ret = 0; 9867 break; 9868 } 9869 9870 return ret; 9871 } 9872 9873 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, 9874 struct nft_set *set, 9875 const struct nft_set_iter *iter, 9876 struct nft_set_elem *elem) 9877 { 9878 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 9879 9880 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 9881 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 9882 return 0; 9883 9884 return nft_check_loops(ctx, ext); 9885 } 9886 9887 static int nft_set_catchall_loops(const struct nft_ctx *ctx, 9888 struct nft_set *set) 9889 { 9890 u8 genmask = nft_genmask_next(ctx->net); 9891 struct nft_set_elem_catchall *catchall; 9892 struct nft_set_ext *ext; 9893 int ret = 0; 9894 9895 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 9896 ext = nft_set_elem_ext(set, catchall->elem); 9897 if (!nft_set_elem_active(ext, genmask)) 9898 continue; 9899 9900 ret = nft_check_loops(ctx, ext); 9901 if (ret < 0) 9902 return ret; 9903 } 9904 9905 return ret; 9906 } 9907 9908 static int nf_tables_check_loops(const struct nft_ctx *ctx, 9909 const struct nft_chain *chain) 9910 { 9911 const struct nft_rule *rule; 9912 const struct nft_expr *expr, *last; 9913 struct nft_set *set; 9914 struct nft_set_binding *binding; 9915 struct nft_set_iter iter; 9916 9917 if (ctx->chain == chain) 9918 return -ELOOP; 9919 9920 list_for_each_entry(rule, &chain->rules, list) { 9921 nft_rule_for_each_expr(expr, last, rule) { 9922 struct nft_immediate_expr *priv; 9923 const struct nft_data *data; 9924 int err; 9925 9926 if (strcmp(expr->ops->type->name, "immediate")) 9927 continue; 9928 9929 priv = nft_expr_priv(expr); 9930 if (priv->dreg != NFT_REG_VERDICT) 9931 continue; 9932 9933 data = &priv->data; 9934 switch (data->verdict.code) { 9935 case NFT_JUMP: 9936 case NFT_GOTO: 9937 err = nf_tables_check_loops(ctx, 9938 data->verdict.chain); 9939 if (err < 0) 9940 return err; 9941 break; 9942 default: 9943 break; 9944 } 9945 } 9946 } 9947 9948 list_for_each_entry(set, &ctx->table->sets, list) { 9949 if (!nft_is_active_next(ctx->net, set)) 9950 continue; 9951 if (!(set->flags & NFT_SET_MAP) || 9952 set->dtype != NFT_DATA_VERDICT) 9953 continue; 9954 9955 list_for_each_entry(binding, &set->bindings, list) { 9956 if (!(binding->flags & NFT_SET_MAP) || 9957 binding->chain != chain) 9958 continue; 9959 9960 iter.genmask = nft_genmask_next(ctx->net); 9961 iter.skip = 0; 9962 iter.count = 0; 9963 iter.err = 0; 9964 iter.fn = nf_tables_loop_check_setelem; 9965 9966 set->ops->walk(ctx, set, &iter); 9967 if (!iter.err) 9968 iter.err = nft_set_catchall_loops(ctx, set); 9969 9970 if (iter.err < 0) 9971 return iter.err; 9972 } 9973 } 9974 9975 return 0; 9976 } 9977 9978 /** 9979 * nft_parse_u32_check - fetch u32 attribute and check for maximum value 9980 * 9981 * @attr: netlink attribute to fetch value from 9982 * @max: maximum value to be stored in dest 9983 * @dest: pointer to the variable 9984 * 9985 * Parse, check and store a given u32 netlink attribute into variable. 9986 * This function returns -ERANGE if the value goes over maximum value. 9987 * Otherwise a 0 is returned and the attribute value is stored in the 9988 * destination variable. 9989 */ 9990 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 9991 { 9992 u32 val; 9993 9994 val = ntohl(nla_get_be32(attr)); 9995 if (val > max) 9996 return -ERANGE; 9997 9998 *dest = val; 9999 return 0; 10000 } 10001 EXPORT_SYMBOL_GPL(nft_parse_u32_check); 10002 10003 static int nft_parse_register(const struct nlattr *attr, u32 *preg) 10004 { 10005 unsigned int reg; 10006 10007 reg = ntohl(nla_get_be32(attr)); 10008 switch (reg) { 10009 case NFT_REG_VERDICT...NFT_REG_4: 10010 *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; 10011 break; 10012 case NFT_REG32_00...NFT_REG32_15: 10013 *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 10014 break; 10015 default: 10016 return -ERANGE; 10017 } 10018 10019 return 0; 10020 } 10021 10022 /** 10023 * nft_dump_register - dump a register value to a netlink attribute 10024 * 10025 * @skb: socket buffer 10026 * @attr: attribute number 10027 * @reg: register number 10028 * 10029 * Construct a netlink attribute containing the register number. For 10030 * compatibility reasons, register numbers being a multiple of 4 are 10031 * translated to the corresponding 128 bit register numbers. 10032 */ 10033 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 10034 { 10035 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 10036 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 10037 else 10038 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 10039 10040 return nla_put_be32(skb, attr, htonl(reg)); 10041 } 10042 EXPORT_SYMBOL_GPL(nft_dump_register); 10043 10044 static int nft_validate_register_load(enum nft_registers reg, unsigned int len) 10045 { 10046 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 10047 return -EINVAL; 10048 if (len == 0) 10049 return -EINVAL; 10050 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data)) 10051 return -ERANGE; 10052 10053 return 0; 10054 } 10055 10056 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len) 10057 { 10058 u32 reg; 10059 int err; 10060 10061 err = nft_parse_register(attr, ®); 10062 if (err < 0) 10063 return err; 10064 10065 err = nft_validate_register_load(reg, len); 10066 if (err < 0) 10067 return err; 10068 10069 *sreg = reg; 10070 return 0; 10071 } 10072 EXPORT_SYMBOL_GPL(nft_parse_register_load); 10073 10074 static int nft_validate_register_store(const struct nft_ctx *ctx, 10075 enum nft_registers reg, 10076 const struct nft_data *data, 10077 enum nft_data_types type, 10078 unsigned int len) 10079 { 10080 int err; 10081 10082 switch (reg) { 10083 case NFT_REG_VERDICT: 10084 if (type != NFT_DATA_VERDICT) 10085 return -EINVAL; 10086 10087 if (data != NULL && 10088 (data->verdict.code == NFT_GOTO || 10089 data->verdict.code == NFT_JUMP)) { 10090 err = nf_tables_check_loops(ctx, data->verdict.chain); 10091 if (err < 0) 10092 return err; 10093 } 10094 10095 return 0; 10096 default: 10097 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 10098 return -EINVAL; 10099 if (len == 0) 10100 return -EINVAL; 10101 if (reg * NFT_REG32_SIZE + len > 10102 sizeof_field(struct nft_regs, data)) 10103 return -ERANGE; 10104 10105 if (data != NULL && type != NFT_DATA_VALUE) 10106 return -EINVAL; 10107 return 0; 10108 } 10109 } 10110 10111 int nft_parse_register_store(const struct nft_ctx *ctx, 10112 const struct nlattr *attr, u8 *dreg, 10113 const struct nft_data *data, 10114 enum nft_data_types type, unsigned int len) 10115 { 10116 int err; 10117 u32 reg; 10118 10119 err = nft_parse_register(attr, ®); 10120 if (err < 0) 10121 return err; 10122 10123 err = nft_validate_register_store(ctx, reg, data, type, len); 10124 if (err < 0) 10125 return err; 10126 10127 *dreg = reg; 10128 return 0; 10129 } 10130 EXPORT_SYMBOL_GPL(nft_parse_register_store); 10131 10132 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 10133 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 10134 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 10135 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 10136 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 }, 10137 }; 10138 10139 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 10140 struct nft_data_desc *desc, const struct nlattr *nla) 10141 { 10142 u8 genmask = nft_genmask_next(ctx->net); 10143 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 10144 struct nft_chain *chain; 10145 int err; 10146 10147 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla, 10148 nft_verdict_policy, NULL); 10149 if (err < 0) 10150 return err; 10151 10152 if (!tb[NFTA_VERDICT_CODE]) 10153 return -EINVAL; 10154 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 10155 10156 switch (data->verdict.code) { 10157 default: 10158 switch (data->verdict.code & NF_VERDICT_MASK) { 10159 case NF_ACCEPT: 10160 case NF_DROP: 10161 case NF_QUEUE: 10162 break; 10163 default: 10164 return -EINVAL; 10165 } 10166 fallthrough; 10167 case NFT_CONTINUE: 10168 case NFT_BREAK: 10169 case NFT_RETURN: 10170 break; 10171 case NFT_JUMP: 10172 case NFT_GOTO: 10173 if (tb[NFTA_VERDICT_CHAIN]) { 10174 chain = nft_chain_lookup(ctx->net, ctx->table, 10175 tb[NFTA_VERDICT_CHAIN], 10176 genmask); 10177 } else if (tb[NFTA_VERDICT_CHAIN_ID]) { 10178 chain = nft_chain_lookup_byid(ctx->net, ctx->table, 10179 tb[NFTA_VERDICT_CHAIN_ID]); 10180 if (IS_ERR(chain)) 10181 return PTR_ERR(chain); 10182 } else { 10183 return -EINVAL; 10184 } 10185 10186 if (IS_ERR(chain)) 10187 return PTR_ERR(chain); 10188 if (nft_is_base_chain(chain)) 10189 return -EOPNOTSUPP; 10190 if (nft_chain_is_bound(chain)) 10191 return -EINVAL; 10192 if (desc->flags & NFT_DATA_DESC_SETELEM && 10193 chain->flags & NFT_CHAIN_BINDING) 10194 return -EINVAL; 10195 10196 chain->use++; 10197 data->verdict.chain = chain; 10198 break; 10199 } 10200 10201 desc->len = sizeof(data->verdict); 10202 10203 return 0; 10204 } 10205 10206 static void nft_verdict_uninit(const struct nft_data *data) 10207 { 10208 struct nft_chain *chain; 10209 struct nft_rule *rule; 10210 10211 switch (data->verdict.code) { 10212 case NFT_JUMP: 10213 case NFT_GOTO: 10214 chain = data->verdict.chain; 10215 chain->use--; 10216 10217 if (!nft_chain_is_bound(chain)) 10218 break; 10219 10220 chain->table->use--; 10221 list_for_each_entry(rule, &chain->rules, list) 10222 chain->use--; 10223 10224 nft_chain_del(chain); 10225 break; 10226 } 10227 } 10228 10229 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v) 10230 { 10231 struct nlattr *nest; 10232 10233 nest = nla_nest_start_noflag(skb, type); 10234 if (!nest) 10235 goto nla_put_failure; 10236 10237 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code))) 10238 goto nla_put_failure; 10239 10240 switch (v->code) { 10241 case NFT_JUMP: 10242 case NFT_GOTO: 10243 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 10244 v->chain->name)) 10245 goto nla_put_failure; 10246 } 10247 nla_nest_end(skb, nest); 10248 return 0; 10249 10250 nla_put_failure: 10251 return -1; 10252 } 10253 10254 static int nft_value_init(const struct nft_ctx *ctx, 10255 struct nft_data *data, struct nft_data_desc *desc, 10256 const struct nlattr *nla) 10257 { 10258 unsigned int len; 10259 10260 len = nla_len(nla); 10261 if (len == 0) 10262 return -EINVAL; 10263 if (len > desc->size) 10264 return -EOVERFLOW; 10265 if (desc->len) { 10266 if (len != desc->len) 10267 return -EINVAL; 10268 } else { 10269 desc->len = len; 10270 } 10271 10272 nla_memcpy(data->data, nla, len); 10273 10274 return 0; 10275 } 10276 10277 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 10278 unsigned int len) 10279 { 10280 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 10281 } 10282 10283 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 10284 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 10285 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 10286 }; 10287 10288 /** 10289 * nft_data_init - parse nf_tables data netlink attributes 10290 * 10291 * @ctx: context of the expression using the data 10292 * @data: destination struct nft_data 10293 * @desc: data description 10294 * @nla: netlink attribute containing data 10295 * 10296 * Parse the netlink data attributes and initialize a struct nft_data. 10297 * The type and length of data are returned in the data description. 10298 * 10299 * The caller can indicate that it only wants to accept data of type 10300 * NFT_DATA_VALUE by passing NULL for the ctx argument. 10301 */ 10302 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, 10303 struct nft_data_desc *desc, const struct nlattr *nla) 10304 { 10305 struct nlattr *tb[NFTA_DATA_MAX + 1]; 10306 int err; 10307 10308 if (WARN_ON_ONCE(!desc->size)) 10309 return -EINVAL; 10310 10311 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla, 10312 nft_data_policy, NULL); 10313 if (err < 0) 10314 return err; 10315 10316 if (tb[NFTA_DATA_VALUE]) { 10317 if (desc->type != NFT_DATA_VALUE) 10318 return -EINVAL; 10319 10320 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]); 10321 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) { 10322 if (desc->type != NFT_DATA_VERDICT) 10323 return -EINVAL; 10324 10325 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 10326 } else { 10327 err = -EINVAL; 10328 } 10329 10330 return err; 10331 } 10332 EXPORT_SYMBOL_GPL(nft_data_init); 10333 10334 /** 10335 * nft_data_release - release a nft_data item 10336 * 10337 * @data: struct nft_data to release 10338 * @type: type of data 10339 * 10340 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 10341 * all others need to be released by calling this function. 10342 */ 10343 void nft_data_release(const struct nft_data *data, enum nft_data_types type) 10344 { 10345 if (type < NFT_DATA_VERDICT) 10346 return; 10347 switch (type) { 10348 case NFT_DATA_VERDICT: 10349 return nft_verdict_uninit(data); 10350 default: 10351 WARN_ON(1); 10352 } 10353 } 10354 EXPORT_SYMBOL_GPL(nft_data_release); 10355 10356 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 10357 enum nft_data_types type, unsigned int len) 10358 { 10359 struct nlattr *nest; 10360 int err; 10361 10362 nest = nla_nest_start_noflag(skb, attr); 10363 if (nest == NULL) 10364 return -1; 10365 10366 switch (type) { 10367 case NFT_DATA_VALUE: 10368 err = nft_value_dump(skb, data, len); 10369 break; 10370 case NFT_DATA_VERDICT: 10371 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict); 10372 break; 10373 default: 10374 err = -EINVAL; 10375 WARN_ON(1); 10376 } 10377 10378 nla_nest_end(skb, nest); 10379 return err; 10380 } 10381 EXPORT_SYMBOL_GPL(nft_data_dump); 10382 10383 int __nft_release_basechain(struct nft_ctx *ctx) 10384 { 10385 struct nft_rule *rule, *nr; 10386 10387 if (WARN_ON(!nft_is_base_chain(ctx->chain))) 10388 return 0; 10389 10390 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); 10391 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { 10392 list_del(&rule->list); 10393 ctx->chain->use--; 10394 nf_tables_rule_release(ctx, rule); 10395 } 10396 nft_chain_del(ctx->chain); 10397 ctx->table->use--; 10398 nf_tables_chain_destroy(ctx); 10399 10400 return 0; 10401 } 10402 EXPORT_SYMBOL_GPL(__nft_release_basechain); 10403 10404 static void __nft_release_hook(struct net *net, struct nft_table *table) 10405 { 10406 struct nft_flowtable *flowtable; 10407 struct nft_chain *chain; 10408 10409 list_for_each_entry(chain, &table->chains, list) 10410 __nf_tables_unregister_hook(net, table, chain, true); 10411 list_for_each_entry(flowtable, &table->flowtables, list) 10412 __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list, 10413 true); 10414 } 10415 10416 static void __nft_release_hooks(struct net *net) 10417 { 10418 struct nftables_pernet *nft_net = nft_pernet(net); 10419 struct nft_table *table; 10420 10421 list_for_each_entry(table, &nft_net->tables, list) { 10422 if (nft_table_has_owner(table)) 10423 continue; 10424 10425 __nft_release_hook(net, table); 10426 } 10427 } 10428 10429 static void __nft_release_table(struct net *net, struct nft_table *table) 10430 { 10431 struct nft_flowtable *flowtable, *nf; 10432 struct nft_chain *chain, *nc; 10433 struct nft_object *obj, *ne; 10434 struct nft_rule *rule, *nr; 10435 struct nft_set *set, *ns; 10436 struct nft_ctx ctx = { 10437 .net = net, 10438 .family = NFPROTO_NETDEV, 10439 }; 10440 10441 ctx.family = table->family; 10442 ctx.table = table; 10443 list_for_each_entry(chain, &table->chains, list) { 10444 ctx.chain = chain; 10445 list_for_each_entry_safe(rule, nr, &chain->rules, list) { 10446 list_del(&rule->list); 10447 chain->use--; 10448 nf_tables_rule_release(&ctx, rule); 10449 } 10450 } 10451 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 10452 list_del(&flowtable->list); 10453 table->use--; 10454 nf_tables_flowtable_destroy(flowtable); 10455 } 10456 list_for_each_entry_safe(set, ns, &table->sets, list) { 10457 list_del(&set->list); 10458 table->use--; 10459 nft_set_destroy(&ctx, set); 10460 } 10461 list_for_each_entry_safe(obj, ne, &table->objects, list) { 10462 nft_obj_del(obj); 10463 table->use--; 10464 nft_obj_destroy(&ctx, obj); 10465 } 10466 list_for_each_entry_safe(chain, nc, &table->chains, list) { 10467 ctx.chain = chain; 10468 nft_chain_del(chain); 10469 table->use--; 10470 nf_tables_chain_destroy(&ctx); 10471 } 10472 nf_tables_table_destroy(&ctx); 10473 } 10474 10475 static void __nft_release_tables(struct net *net) 10476 { 10477 struct nftables_pernet *nft_net = nft_pernet(net); 10478 struct nft_table *table, *nt; 10479 10480 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 10481 if (nft_table_has_owner(table)) 10482 continue; 10483 10484 list_del(&table->list); 10485 10486 __nft_release_table(net, table); 10487 } 10488 } 10489 10490 static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, 10491 void *ptr) 10492 { 10493 struct nft_table *table, *to_delete[8]; 10494 struct nftables_pernet *nft_net; 10495 struct netlink_notify *n = ptr; 10496 struct net *net = n->net; 10497 unsigned int deleted; 10498 bool restart = false; 10499 10500 if (event != NETLINK_URELEASE || n->protocol != NETLINK_NETFILTER) 10501 return NOTIFY_DONE; 10502 10503 nft_net = nft_pernet(net); 10504 deleted = 0; 10505 mutex_lock(&nft_net->commit_mutex); 10506 if (!list_empty(&nf_tables_destroy_list)) 10507 rcu_barrier(); 10508 again: 10509 list_for_each_entry(table, &nft_net->tables, list) { 10510 if (nft_table_has_owner(table) && 10511 n->portid == table->nlpid) { 10512 __nft_release_hook(net, table); 10513 list_del_rcu(&table->list); 10514 to_delete[deleted++] = table; 10515 if (deleted >= ARRAY_SIZE(to_delete)) 10516 break; 10517 } 10518 } 10519 if (deleted) { 10520 restart = deleted >= ARRAY_SIZE(to_delete); 10521 synchronize_rcu(); 10522 while (deleted) 10523 __nft_release_table(net, to_delete[--deleted]); 10524 10525 if (restart) 10526 goto again; 10527 } 10528 mutex_unlock(&nft_net->commit_mutex); 10529 10530 return NOTIFY_DONE; 10531 } 10532 10533 static struct notifier_block nft_nl_notifier = { 10534 .notifier_call = nft_rcv_nl_event, 10535 }; 10536 10537 static int __net_init nf_tables_init_net(struct net *net) 10538 { 10539 struct nftables_pernet *nft_net = nft_pernet(net); 10540 10541 INIT_LIST_HEAD(&nft_net->tables); 10542 INIT_LIST_HEAD(&nft_net->commit_list); 10543 INIT_LIST_HEAD(&nft_net->module_list); 10544 INIT_LIST_HEAD(&nft_net->notify_list); 10545 mutex_init(&nft_net->commit_mutex); 10546 nft_net->base_seq = 1; 10547 10548 return 0; 10549 } 10550 10551 static void __net_exit nf_tables_pre_exit_net(struct net *net) 10552 { 10553 struct nftables_pernet *nft_net = nft_pernet(net); 10554 10555 mutex_lock(&nft_net->commit_mutex); 10556 __nft_release_hooks(net); 10557 mutex_unlock(&nft_net->commit_mutex); 10558 } 10559 10560 static void __net_exit nf_tables_exit_net(struct net *net) 10561 { 10562 struct nftables_pernet *nft_net = nft_pernet(net); 10563 10564 mutex_lock(&nft_net->commit_mutex); 10565 if (!list_empty(&nft_net->commit_list) || 10566 !list_empty(&nft_net->module_list)) 10567 __nf_tables_abort(net, NFNL_ABORT_NONE); 10568 __nft_release_tables(net); 10569 mutex_unlock(&nft_net->commit_mutex); 10570 WARN_ON_ONCE(!list_empty(&nft_net->tables)); 10571 WARN_ON_ONCE(!list_empty(&nft_net->module_list)); 10572 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 10573 } 10574 10575 static struct pernet_operations nf_tables_net_ops = { 10576 .init = nf_tables_init_net, 10577 .pre_exit = nf_tables_pre_exit_net, 10578 .exit = nf_tables_exit_net, 10579 .id = &nf_tables_net_id, 10580 .size = sizeof(struct nftables_pernet), 10581 }; 10582 10583 static int __init nf_tables_module_init(void) 10584 { 10585 int err; 10586 10587 err = register_pernet_subsys(&nf_tables_net_ops); 10588 if (err < 0) 10589 return err; 10590 10591 err = nft_chain_filter_init(); 10592 if (err < 0) 10593 goto err_chain_filter; 10594 10595 err = nf_tables_core_module_init(); 10596 if (err < 0) 10597 goto err_core_module; 10598 10599 err = register_netdevice_notifier(&nf_tables_flowtable_notifier); 10600 if (err < 0) 10601 goto err_netdev_notifier; 10602 10603 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params); 10604 if (err < 0) 10605 goto err_rht_objname; 10606 10607 err = nft_offload_init(); 10608 if (err < 0) 10609 goto err_offload; 10610 10611 err = netlink_register_notifier(&nft_nl_notifier); 10612 if (err < 0) 10613 goto err_netlink_notifier; 10614 10615 /* must be last */ 10616 err = nfnetlink_subsys_register(&nf_tables_subsys); 10617 if (err < 0) 10618 goto err_nfnl_subsys; 10619 10620 nft_chain_route_init(); 10621 10622 return err; 10623 10624 err_nfnl_subsys: 10625 netlink_unregister_notifier(&nft_nl_notifier); 10626 err_netlink_notifier: 10627 nft_offload_exit(); 10628 err_offload: 10629 rhltable_destroy(&nft_objname_ht); 10630 err_rht_objname: 10631 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 10632 err_netdev_notifier: 10633 nf_tables_core_module_exit(); 10634 err_core_module: 10635 nft_chain_filter_fini(); 10636 err_chain_filter: 10637 unregister_pernet_subsys(&nf_tables_net_ops); 10638 return err; 10639 } 10640 10641 static void __exit nf_tables_module_exit(void) 10642 { 10643 nfnetlink_subsys_unregister(&nf_tables_subsys); 10644 netlink_unregister_notifier(&nft_nl_notifier); 10645 nft_offload_exit(); 10646 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 10647 nft_chain_filter_fini(); 10648 nft_chain_route_fini(); 10649 unregister_pernet_subsys(&nf_tables_net_ops); 10650 cancel_work_sync(&trans_destroy_work); 10651 rcu_barrier(); 10652 rhltable_destroy(&nft_objname_ht); 10653 nf_tables_core_module_exit(); 10654 } 10655 10656 module_init(nf_tables_module_init); 10657 module_exit(nf_tables_module_exit); 10658 10659 MODULE_LICENSE("GPL"); 10660 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 10661 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 10662