1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/module.h> 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/skbuff.h> 12 #include <linux/netlink.h> 13 #include <linux/vmalloc.h> 14 #include <linux/rhashtable.h> 15 #include <linux/audit.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nfnetlink.h> 18 #include <linux/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_flow_table.h> 20 #include <net/netfilter/nf_tables_core.h> 21 #include <net/netfilter/nf_tables.h> 22 #include <net/netfilter/nf_tables_offload.h> 23 #include <net/net_namespace.h> 24 #include <net/sock.h> 25 26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) 27 28 unsigned int nf_tables_net_id __read_mostly; 29 30 static LIST_HEAD(nf_tables_expressions); 31 static LIST_HEAD(nf_tables_objects); 32 static LIST_HEAD(nf_tables_flowtables); 33 static LIST_HEAD(nf_tables_destroy_list); 34 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock); 35 36 enum { 37 NFT_VALIDATE_SKIP = 0, 38 NFT_VALIDATE_NEED, 39 NFT_VALIDATE_DO, 40 }; 41 42 static struct rhltable nft_objname_ht; 43 44 static u32 nft_chain_hash(const void *data, u32 len, u32 seed); 45 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed); 46 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *); 47 48 static u32 nft_objname_hash(const void *data, u32 len, u32 seed); 49 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed); 50 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *); 51 52 static const struct rhashtable_params nft_chain_ht_params = { 53 .head_offset = offsetof(struct nft_chain, rhlhead), 54 .key_offset = offsetof(struct nft_chain, name), 55 .hashfn = nft_chain_hash, 56 .obj_hashfn = nft_chain_hash_obj, 57 .obj_cmpfn = nft_chain_hash_cmp, 58 .automatic_shrinking = true, 59 }; 60 61 static const struct rhashtable_params nft_objname_ht_params = { 62 .head_offset = offsetof(struct nft_object, rhlhead), 63 .key_offset = offsetof(struct nft_object, key), 64 .hashfn = nft_objname_hash, 65 .obj_hashfn = nft_objname_hash_obj, 66 .obj_cmpfn = nft_objname_hash_cmp, 67 .automatic_shrinking = true, 68 }; 69 70 struct nft_audit_data { 71 struct nft_table *table; 72 int entries; 73 int op; 74 struct list_head list; 75 }; 76 77 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types 78 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, 79 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, 80 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, 81 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, 82 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, 83 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, 84 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, 85 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, 86 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, 87 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, 88 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, 89 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, 90 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, 91 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, 92 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, 93 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, 94 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, 95 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, 96 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, 97 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, 98 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, 99 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, 100 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, 101 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, 102 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 103 }; 104 105 static void nft_validate_state_update(struct net *net, u8 new_validate_state) 106 { 107 struct nftables_pernet *nft_net = nft_pernet(net); 108 109 switch (nft_net->validate_state) { 110 case NFT_VALIDATE_SKIP: 111 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); 112 break; 113 case NFT_VALIDATE_NEED: 114 break; 115 case NFT_VALIDATE_DO: 116 if (new_validate_state == NFT_VALIDATE_NEED) 117 return; 118 } 119 120 nft_net->validate_state = new_validate_state; 121 } 122 static void nf_tables_trans_destroy_work(struct work_struct *w); 123 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work); 124 125 static void nft_ctx_init(struct nft_ctx *ctx, 126 struct net *net, 127 const struct sk_buff *skb, 128 const struct nlmsghdr *nlh, 129 u8 family, 130 struct nft_table *table, 131 struct nft_chain *chain, 132 const struct nlattr * const *nla) 133 { 134 ctx->net = net; 135 ctx->family = family; 136 ctx->level = 0; 137 ctx->table = table; 138 ctx->chain = chain; 139 ctx->nla = nla; 140 ctx->portid = NETLINK_CB(skb).portid; 141 ctx->report = nlmsg_report(nlh); 142 ctx->flags = nlh->nlmsg_flags; 143 ctx->seq = nlh->nlmsg_seq; 144 } 145 146 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx, 147 int msg_type, u32 size, gfp_t gfp) 148 { 149 struct nft_trans *trans; 150 151 trans = kzalloc(sizeof(struct nft_trans) + size, gfp); 152 if (trans == NULL) 153 return NULL; 154 155 INIT_LIST_HEAD(&trans->list); 156 trans->msg_type = msg_type; 157 trans->ctx = *ctx; 158 159 return trans; 160 } 161 162 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, 163 int msg_type, u32 size) 164 { 165 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL); 166 } 167 168 static void nft_trans_destroy(struct nft_trans *trans) 169 { 170 list_del(&trans->list); 171 kfree(trans); 172 } 173 174 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) 175 { 176 struct nftables_pernet *nft_net; 177 struct net *net = ctx->net; 178 struct nft_trans *trans; 179 180 if (!nft_set_is_anonymous(set)) 181 return; 182 183 nft_net = nft_pernet(net); 184 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 185 switch (trans->msg_type) { 186 case NFT_MSG_NEWSET: 187 if (nft_trans_set(trans) == set) 188 nft_trans_set_bound(trans) = true; 189 break; 190 case NFT_MSG_NEWSETELEM: 191 if (nft_trans_elem_set(trans) == set) 192 nft_trans_elem_set_bound(trans) = true; 193 break; 194 } 195 } 196 } 197 198 static int nft_netdev_register_hooks(struct net *net, 199 struct list_head *hook_list) 200 { 201 struct nft_hook *hook; 202 int err, j; 203 204 j = 0; 205 list_for_each_entry(hook, hook_list, list) { 206 err = nf_register_net_hook(net, &hook->ops); 207 if (err < 0) 208 goto err_register; 209 210 j++; 211 } 212 return 0; 213 214 err_register: 215 list_for_each_entry(hook, hook_list, list) { 216 if (j-- <= 0) 217 break; 218 219 nf_unregister_net_hook(net, &hook->ops); 220 } 221 return err; 222 } 223 224 static void nft_netdev_unregister_hooks(struct net *net, 225 struct list_head *hook_list, 226 bool release_netdev) 227 { 228 struct nft_hook *hook, *next; 229 230 list_for_each_entry_safe(hook, next, hook_list, list) { 231 nf_unregister_net_hook(net, &hook->ops); 232 if (release_netdev) { 233 list_del(&hook->list); 234 kfree_rcu(hook, rcu); 235 } 236 } 237 } 238 239 static int nf_tables_register_hook(struct net *net, 240 const struct nft_table *table, 241 struct nft_chain *chain) 242 { 243 struct nft_base_chain *basechain; 244 const struct nf_hook_ops *ops; 245 246 if (table->flags & NFT_TABLE_F_DORMANT || 247 !nft_is_base_chain(chain)) 248 return 0; 249 250 basechain = nft_base_chain(chain); 251 ops = &basechain->ops; 252 253 if (basechain->type->ops_register) 254 return basechain->type->ops_register(net, ops); 255 256 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 257 return nft_netdev_register_hooks(net, &basechain->hook_list); 258 259 return nf_register_net_hook(net, &basechain->ops); 260 } 261 262 static void __nf_tables_unregister_hook(struct net *net, 263 const struct nft_table *table, 264 struct nft_chain *chain, 265 bool release_netdev) 266 { 267 struct nft_base_chain *basechain; 268 const struct nf_hook_ops *ops; 269 270 if (table->flags & NFT_TABLE_F_DORMANT || 271 !nft_is_base_chain(chain)) 272 return; 273 basechain = nft_base_chain(chain); 274 ops = &basechain->ops; 275 276 if (basechain->type->ops_unregister) 277 return basechain->type->ops_unregister(net, ops); 278 279 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 280 nft_netdev_unregister_hooks(net, &basechain->hook_list, 281 release_netdev); 282 else 283 nf_unregister_net_hook(net, &basechain->ops); 284 } 285 286 static void nf_tables_unregister_hook(struct net *net, 287 const struct nft_table *table, 288 struct nft_chain *chain) 289 { 290 return __nf_tables_unregister_hook(net, table, chain, false); 291 } 292 293 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans) 294 { 295 struct nftables_pernet *nft_net = nft_pernet(net); 296 297 list_add_tail(&trans->list, &nft_net->commit_list); 298 } 299 300 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 301 { 302 struct nft_trans *trans; 303 304 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 305 if (trans == NULL) 306 return -ENOMEM; 307 308 if (msg_type == NFT_MSG_NEWTABLE) 309 nft_activate_next(ctx->net, ctx->table); 310 311 nft_trans_commit_list_add_tail(ctx->net, trans); 312 return 0; 313 } 314 315 static int nft_deltable(struct nft_ctx *ctx) 316 { 317 int err; 318 319 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 320 if (err < 0) 321 return err; 322 323 nft_deactivate_next(ctx->net, ctx->table); 324 return err; 325 } 326 327 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 328 { 329 struct nft_trans *trans; 330 331 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 332 if (trans == NULL) 333 return ERR_PTR(-ENOMEM); 334 335 if (msg_type == NFT_MSG_NEWCHAIN) { 336 nft_activate_next(ctx->net, ctx->chain); 337 338 if (ctx->nla[NFTA_CHAIN_ID]) { 339 nft_trans_chain_id(trans) = 340 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID])); 341 } 342 } 343 344 nft_trans_commit_list_add_tail(ctx->net, trans); 345 return trans; 346 } 347 348 static int nft_delchain(struct nft_ctx *ctx) 349 { 350 struct nft_trans *trans; 351 352 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 353 if (IS_ERR(trans)) 354 return PTR_ERR(trans); 355 356 ctx->table->use--; 357 nft_deactivate_next(ctx->net, ctx->chain); 358 359 return 0; 360 } 361 362 static void nft_rule_expr_activate(const struct nft_ctx *ctx, 363 struct nft_rule *rule) 364 { 365 struct nft_expr *expr; 366 367 expr = nft_expr_first(rule); 368 while (nft_expr_more(rule, expr)) { 369 if (expr->ops->activate) 370 expr->ops->activate(ctx, expr); 371 372 expr = nft_expr_next(expr); 373 } 374 } 375 376 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx, 377 struct nft_rule *rule, 378 enum nft_trans_phase phase) 379 { 380 struct nft_expr *expr; 381 382 expr = nft_expr_first(rule); 383 while (nft_expr_more(rule, expr)) { 384 if (expr->ops->deactivate) 385 expr->ops->deactivate(ctx, expr, phase); 386 387 expr = nft_expr_next(expr); 388 } 389 } 390 391 static int 392 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 393 { 394 /* You cannot delete the same rule twice */ 395 if (nft_is_active_next(ctx->net, rule)) { 396 nft_deactivate_next(ctx->net, rule); 397 ctx->chain->use--; 398 return 0; 399 } 400 return -ENOENT; 401 } 402 403 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 404 struct nft_rule *rule) 405 { 406 struct nft_trans *trans; 407 408 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 409 if (trans == NULL) 410 return NULL; 411 412 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) { 413 nft_trans_rule_id(trans) = 414 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); 415 } 416 nft_trans_rule(trans) = rule; 417 nft_trans_commit_list_add_tail(ctx->net, trans); 418 419 return trans; 420 } 421 422 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 423 { 424 struct nft_flow_rule *flow; 425 struct nft_trans *trans; 426 int err; 427 428 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 429 if (trans == NULL) 430 return -ENOMEM; 431 432 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) { 433 flow = nft_flow_rule_create(ctx->net, rule); 434 if (IS_ERR(flow)) { 435 nft_trans_destroy(trans); 436 return PTR_ERR(flow); 437 } 438 439 nft_trans_flow_rule(trans) = flow; 440 } 441 442 err = nf_tables_delrule_deactivate(ctx, rule); 443 if (err < 0) { 444 nft_trans_destroy(trans); 445 return err; 446 } 447 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE); 448 449 return 0; 450 } 451 452 static int nft_delrule_by_chain(struct nft_ctx *ctx) 453 { 454 struct nft_rule *rule; 455 int err; 456 457 list_for_each_entry(rule, &ctx->chain->rules, list) { 458 if (!nft_is_active_next(ctx->net, rule)) 459 continue; 460 461 err = nft_delrule(ctx, rule); 462 if (err < 0) 463 return err; 464 } 465 return 0; 466 } 467 468 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 469 struct nft_set *set) 470 { 471 struct nft_trans *trans; 472 473 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 474 if (trans == NULL) 475 return -ENOMEM; 476 477 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) { 478 nft_trans_set_id(trans) = 479 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 480 nft_activate_next(ctx->net, set); 481 } 482 nft_trans_set(trans) = set; 483 nft_trans_commit_list_add_tail(ctx->net, trans); 484 485 return 0; 486 } 487 488 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set) 489 { 490 int err; 491 492 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 493 if (err < 0) 494 return err; 495 496 nft_deactivate_next(ctx->net, set); 497 ctx->table->use--; 498 499 return err; 500 } 501 502 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, 503 struct nft_object *obj) 504 { 505 struct nft_trans *trans; 506 507 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj)); 508 if (trans == NULL) 509 return -ENOMEM; 510 511 if (msg_type == NFT_MSG_NEWOBJ) 512 nft_activate_next(ctx->net, obj); 513 514 nft_trans_obj(trans) = obj; 515 nft_trans_commit_list_add_tail(ctx->net, trans); 516 517 return 0; 518 } 519 520 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj) 521 { 522 int err; 523 524 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj); 525 if (err < 0) 526 return err; 527 528 nft_deactivate_next(ctx->net, obj); 529 ctx->table->use--; 530 531 return err; 532 } 533 534 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, 535 struct nft_flowtable *flowtable) 536 { 537 struct nft_trans *trans; 538 539 trans = nft_trans_alloc(ctx, msg_type, 540 sizeof(struct nft_trans_flowtable)); 541 if (trans == NULL) 542 return -ENOMEM; 543 544 if (msg_type == NFT_MSG_NEWFLOWTABLE) 545 nft_activate_next(ctx->net, flowtable); 546 547 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 548 nft_trans_flowtable(trans) = flowtable; 549 nft_trans_commit_list_add_tail(ctx->net, trans); 550 551 return 0; 552 } 553 554 static int nft_delflowtable(struct nft_ctx *ctx, 555 struct nft_flowtable *flowtable) 556 { 557 int err; 558 559 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); 560 if (err < 0) 561 return err; 562 563 nft_deactivate_next(ctx->net, flowtable); 564 ctx->table->use--; 565 566 return err; 567 } 568 569 static void __nft_reg_track_clobber(struct nft_regs_track *track, u8 dreg) 570 { 571 int i; 572 573 for (i = track->regs[dreg].num_reg; i > 0; i--) 574 __nft_reg_track_cancel(track, dreg - i); 575 } 576 577 static void __nft_reg_track_update(struct nft_regs_track *track, 578 const struct nft_expr *expr, 579 u8 dreg, u8 num_reg) 580 { 581 track->regs[dreg].selector = expr; 582 track->regs[dreg].bitwise = NULL; 583 track->regs[dreg].num_reg = num_reg; 584 } 585 586 void nft_reg_track_update(struct nft_regs_track *track, 587 const struct nft_expr *expr, u8 dreg, u8 len) 588 { 589 unsigned int regcount; 590 int i; 591 592 __nft_reg_track_clobber(track, dreg); 593 594 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 595 for (i = 0; i < regcount; i++, dreg++) 596 __nft_reg_track_update(track, expr, dreg, i); 597 } 598 EXPORT_SYMBOL_GPL(nft_reg_track_update); 599 600 void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len) 601 { 602 unsigned int regcount; 603 int i; 604 605 __nft_reg_track_clobber(track, dreg); 606 607 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 608 for (i = 0; i < regcount; i++, dreg++) 609 __nft_reg_track_cancel(track, dreg); 610 } 611 EXPORT_SYMBOL_GPL(nft_reg_track_cancel); 612 613 void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg) 614 { 615 track->regs[dreg].selector = NULL; 616 track->regs[dreg].bitwise = NULL; 617 track->regs[dreg].num_reg = 0; 618 } 619 EXPORT_SYMBOL_GPL(__nft_reg_track_cancel); 620 621 /* 622 * Tables 623 */ 624 625 static struct nft_table *nft_table_lookup(const struct net *net, 626 const struct nlattr *nla, 627 u8 family, u8 genmask, u32 nlpid) 628 { 629 struct nftables_pernet *nft_net; 630 struct nft_table *table; 631 632 if (nla == NULL) 633 return ERR_PTR(-EINVAL); 634 635 nft_net = nft_pernet(net); 636 list_for_each_entry_rcu(table, &nft_net->tables, list, 637 lockdep_is_held(&nft_net->commit_mutex)) { 638 if (!nla_strcmp(nla, table->name) && 639 table->family == family && 640 nft_active_genmask(table, genmask)) { 641 if (nft_table_has_owner(table) && 642 nlpid && table->nlpid != nlpid) 643 return ERR_PTR(-EPERM); 644 645 return table; 646 } 647 } 648 649 return ERR_PTR(-ENOENT); 650 } 651 652 static struct nft_table *nft_table_lookup_byhandle(const struct net *net, 653 const struct nlattr *nla, 654 u8 genmask, u32 nlpid) 655 { 656 struct nftables_pernet *nft_net; 657 struct nft_table *table; 658 659 nft_net = nft_pernet(net); 660 list_for_each_entry(table, &nft_net->tables, list) { 661 if (be64_to_cpu(nla_get_be64(nla)) == table->handle && 662 nft_active_genmask(table, genmask)) { 663 if (nft_table_has_owner(table) && 664 nlpid && table->nlpid != nlpid) 665 return ERR_PTR(-EPERM); 666 667 return table; 668 } 669 } 670 671 return ERR_PTR(-ENOENT); 672 } 673 674 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 675 { 676 return ++table->hgenerator; 677 } 678 679 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; 680 681 static const struct nft_chain_type * 682 __nft_chain_type_get(u8 family, enum nft_chain_types type) 683 { 684 if (family >= NFPROTO_NUMPROTO || 685 type >= NFT_CHAIN_T_MAX) 686 return NULL; 687 688 return chain_type[family][type]; 689 } 690 691 static const struct nft_chain_type * 692 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) 693 { 694 const struct nft_chain_type *type; 695 int i; 696 697 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 698 type = __nft_chain_type_get(family, i); 699 if (!type) 700 continue; 701 if (!nla_strcmp(nla, type->name)) 702 return type; 703 } 704 return NULL; 705 } 706 707 struct nft_module_request { 708 struct list_head list; 709 char module[MODULE_NAME_LEN]; 710 bool done; 711 }; 712 713 #ifdef CONFIG_MODULES 714 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, 715 ...) 716 { 717 char module_name[MODULE_NAME_LEN]; 718 struct nftables_pernet *nft_net; 719 struct nft_module_request *req; 720 va_list args; 721 int ret; 722 723 va_start(args, fmt); 724 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); 725 va_end(args); 726 if (ret >= MODULE_NAME_LEN) 727 return 0; 728 729 nft_net = nft_pernet(net); 730 list_for_each_entry(req, &nft_net->module_list, list) { 731 if (!strcmp(req->module, module_name)) { 732 if (req->done) 733 return 0; 734 735 /* A request to load this module already exists. */ 736 return -EAGAIN; 737 } 738 } 739 740 req = kmalloc(sizeof(*req), GFP_KERNEL); 741 if (!req) 742 return -ENOMEM; 743 744 req->done = false; 745 strscpy(req->module, module_name, MODULE_NAME_LEN); 746 list_add_tail(&req->list, &nft_net->module_list); 747 748 return -EAGAIN; 749 } 750 EXPORT_SYMBOL_GPL(nft_request_module); 751 #endif 752 753 static void lockdep_nfnl_nft_mutex_not_held(void) 754 { 755 #ifdef CONFIG_PROVE_LOCKING 756 if (debug_locks) 757 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES)); 758 #endif 759 } 760 761 static const struct nft_chain_type * 762 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, 763 u8 family, bool autoload) 764 { 765 const struct nft_chain_type *type; 766 767 type = __nf_tables_chain_type_lookup(nla, family); 768 if (type != NULL) 769 return type; 770 771 lockdep_nfnl_nft_mutex_not_held(); 772 #ifdef CONFIG_MODULES 773 if (autoload) { 774 if (nft_request_module(net, "nft-chain-%u-%.*s", family, 775 nla_len(nla), 776 (const char *)nla_data(nla)) == -EAGAIN) 777 return ERR_PTR(-EAGAIN); 778 } 779 #endif 780 return ERR_PTR(-ENOENT); 781 } 782 783 static __be16 nft_base_seq(const struct net *net) 784 { 785 struct nftables_pernet *nft_net = nft_pernet(net); 786 787 return htons(nft_net->base_seq & 0xffff); 788 } 789 790 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 791 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 792 .len = NFT_TABLE_MAXNAMELEN - 1 }, 793 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 794 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, 795 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY, 796 .len = NFT_USERDATA_MAXLEN } 797 }; 798 799 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 800 u32 portid, u32 seq, int event, u32 flags, 801 int family, const struct nft_table *table) 802 { 803 struct nlmsghdr *nlh; 804 805 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 806 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 807 NFNETLINK_V0, nft_base_seq(net)); 808 if (!nlh) 809 goto nla_put_failure; 810 811 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 812 nla_put_be32(skb, NFTA_TABLE_FLAGS, 813 htonl(table->flags & NFT_TABLE_F_MASK)) || 814 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || 815 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), 816 NFTA_TABLE_PAD)) 817 goto nla_put_failure; 818 if (nft_table_has_owner(table) && 819 nla_put_be32(skb, NFTA_TABLE_OWNER, htonl(table->nlpid))) 820 goto nla_put_failure; 821 822 if (table->udata) { 823 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata)) 824 goto nla_put_failure; 825 } 826 827 nlmsg_end(skb, nlh); 828 return 0; 829 830 nla_put_failure: 831 nlmsg_trim(skb, nlh); 832 return -1; 833 } 834 835 struct nftnl_skb_parms { 836 bool report; 837 }; 838 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb)) 839 840 static void nft_notify_enqueue(struct sk_buff *skb, bool report, 841 struct list_head *notify_list) 842 { 843 NFT_CB(skb).report = report; 844 list_add_tail(&skb->list, notify_list); 845 } 846 847 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) 848 { 849 struct nftables_pernet *nft_net; 850 struct sk_buff *skb; 851 u16 flags = 0; 852 int err; 853 854 if (!ctx->report && 855 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 856 return; 857 858 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 859 if (skb == NULL) 860 goto err; 861 862 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 863 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 864 865 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 866 event, flags, ctx->family, ctx->table); 867 if (err < 0) { 868 kfree_skb(skb); 869 goto err; 870 } 871 872 nft_net = nft_pernet(ctx->net); 873 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 874 return; 875 err: 876 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 877 } 878 879 static int nf_tables_dump_tables(struct sk_buff *skb, 880 struct netlink_callback *cb) 881 { 882 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 883 struct nftables_pernet *nft_net; 884 const struct nft_table *table; 885 unsigned int idx = 0, s_idx = cb->args[0]; 886 struct net *net = sock_net(skb->sk); 887 int family = nfmsg->nfgen_family; 888 889 rcu_read_lock(); 890 nft_net = nft_pernet(net); 891 cb->seq = READ_ONCE(nft_net->base_seq); 892 893 list_for_each_entry_rcu(table, &nft_net->tables, list) { 894 if (family != NFPROTO_UNSPEC && family != table->family) 895 continue; 896 897 if (idx < s_idx) 898 goto cont; 899 if (idx > s_idx) 900 memset(&cb->args[1], 0, 901 sizeof(cb->args) - sizeof(cb->args[0])); 902 if (!nft_is_active(net, table)) 903 continue; 904 if (nf_tables_fill_table_info(skb, net, 905 NETLINK_CB(cb->skb).portid, 906 cb->nlh->nlmsg_seq, 907 NFT_MSG_NEWTABLE, NLM_F_MULTI, 908 table->family, table) < 0) 909 goto done; 910 911 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 912 cont: 913 idx++; 914 } 915 done: 916 rcu_read_unlock(); 917 cb->args[0] = idx; 918 return skb->len; 919 } 920 921 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb, 922 const struct nlmsghdr *nlh, 923 struct netlink_dump_control *c) 924 { 925 int err; 926 927 if (!try_module_get(THIS_MODULE)) 928 return -EINVAL; 929 930 rcu_read_unlock(); 931 err = netlink_dump_start(nlsk, skb, nlh, c); 932 rcu_read_lock(); 933 module_put(THIS_MODULE); 934 935 return err; 936 } 937 938 /* called with rcu_read_lock held */ 939 static int nf_tables_gettable(struct sk_buff *skb, const struct nfnl_info *info, 940 const struct nlattr * const nla[]) 941 { 942 struct netlink_ext_ack *extack = info->extack; 943 u8 genmask = nft_genmask_cur(info->net); 944 u8 family = info->nfmsg->nfgen_family; 945 const struct nft_table *table; 946 struct net *net = info->net; 947 struct sk_buff *skb2; 948 int err; 949 950 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 951 struct netlink_dump_control c = { 952 .dump = nf_tables_dump_tables, 953 .module = THIS_MODULE, 954 }; 955 956 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 957 } 958 959 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask, 0); 960 if (IS_ERR(table)) { 961 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]); 962 return PTR_ERR(table); 963 } 964 965 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 966 if (!skb2) 967 return -ENOMEM; 968 969 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 970 info->nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 971 0, family, table); 972 if (err < 0) 973 goto err_fill_table_info; 974 975 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 976 977 err_fill_table_info: 978 kfree_skb(skb2); 979 return err; 980 } 981 982 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) 983 { 984 struct nft_chain *chain; 985 u32 i = 0; 986 987 list_for_each_entry(chain, &table->chains, list) { 988 if (!nft_is_active_next(net, chain)) 989 continue; 990 if (!nft_is_base_chain(chain)) 991 continue; 992 993 if (cnt && i++ == cnt) 994 break; 995 996 nf_tables_unregister_hook(net, table, chain); 997 } 998 } 999 1000 static int nf_tables_table_enable(struct net *net, struct nft_table *table) 1001 { 1002 struct nft_chain *chain; 1003 int err, i = 0; 1004 1005 list_for_each_entry(chain, &table->chains, list) { 1006 if (!nft_is_active_next(net, chain)) 1007 continue; 1008 if (!nft_is_base_chain(chain)) 1009 continue; 1010 1011 err = nf_tables_register_hook(net, table, chain); 1012 if (err < 0) 1013 goto err_register_hooks; 1014 1015 i++; 1016 } 1017 return 0; 1018 1019 err_register_hooks: 1020 if (i) 1021 nft_table_disable(net, table, i); 1022 return err; 1023 } 1024 1025 static void nf_tables_table_disable(struct net *net, struct nft_table *table) 1026 { 1027 table->flags &= ~NFT_TABLE_F_DORMANT; 1028 nft_table_disable(net, table, 0); 1029 table->flags |= NFT_TABLE_F_DORMANT; 1030 } 1031 1032 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1) 1033 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0) 1034 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1) 1035 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ 1036 __NFT_TABLE_F_WAS_AWAKEN) 1037 1038 static int nf_tables_updtable(struct nft_ctx *ctx) 1039 { 1040 struct nft_trans *trans; 1041 u32 flags; 1042 int ret; 1043 1044 if (!ctx->nla[NFTA_TABLE_FLAGS]) 1045 return 0; 1046 1047 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 1048 if (flags & ~NFT_TABLE_F_MASK) 1049 return -EOPNOTSUPP; 1050 1051 if (flags == ctx->table->flags) 1052 return 0; 1053 1054 if ((nft_table_has_owner(ctx->table) && 1055 !(flags & NFT_TABLE_F_OWNER)) || 1056 (!nft_table_has_owner(ctx->table) && 1057 flags & NFT_TABLE_F_OWNER)) 1058 return -EOPNOTSUPP; 1059 1060 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 1061 sizeof(struct nft_trans_table)); 1062 if (trans == NULL) 1063 return -ENOMEM; 1064 1065 if ((flags & NFT_TABLE_F_DORMANT) && 1066 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 1067 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1068 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) 1069 ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN; 1070 } else if (!(flags & NFT_TABLE_F_DORMANT) && 1071 ctx->table->flags & NFT_TABLE_F_DORMANT) { 1072 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 1073 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) { 1074 ret = nf_tables_table_enable(ctx->net, ctx->table); 1075 if (ret < 0) 1076 goto err_register_hooks; 1077 1078 ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT; 1079 } 1080 } 1081 1082 nft_trans_table_update(trans) = true; 1083 nft_trans_commit_list_add_tail(ctx->net, trans); 1084 1085 return 0; 1086 1087 err_register_hooks: 1088 nft_trans_destroy(trans); 1089 return ret; 1090 } 1091 1092 static u32 nft_chain_hash(const void *data, u32 len, u32 seed) 1093 { 1094 const char *name = data; 1095 1096 return jhash(name, strlen(name), seed); 1097 } 1098 1099 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed) 1100 { 1101 const struct nft_chain *chain = data; 1102 1103 return nft_chain_hash(chain->name, 0, seed); 1104 } 1105 1106 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg, 1107 const void *ptr) 1108 { 1109 const struct nft_chain *chain = ptr; 1110 const char *name = arg->key; 1111 1112 return strcmp(chain->name, name); 1113 } 1114 1115 static u32 nft_objname_hash(const void *data, u32 len, u32 seed) 1116 { 1117 const struct nft_object_hash_key *k = data; 1118 1119 seed ^= hash_ptr(k->table, 32); 1120 1121 return jhash(k->name, strlen(k->name), seed); 1122 } 1123 1124 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed) 1125 { 1126 const struct nft_object *obj = data; 1127 1128 return nft_objname_hash(&obj->key, 0, seed); 1129 } 1130 1131 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg, 1132 const void *ptr) 1133 { 1134 const struct nft_object_hash_key *k = arg->key; 1135 const struct nft_object *obj = ptr; 1136 1137 if (obj->key.table != k->table) 1138 return -1; 1139 1140 return strcmp(obj->key.name, k->name); 1141 } 1142 1143 static bool nft_supported_family(u8 family) 1144 { 1145 return false 1146 #ifdef CONFIG_NF_TABLES_INET 1147 || family == NFPROTO_INET 1148 #endif 1149 #ifdef CONFIG_NF_TABLES_IPV4 1150 || family == NFPROTO_IPV4 1151 #endif 1152 #ifdef CONFIG_NF_TABLES_ARP 1153 || family == NFPROTO_ARP 1154 #endif 1155 #ifdef CONFIG_NF_TABLES_NETDEV 1156 || family == NFPROTO_NETDEV 1157 #endif 1158 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) 1159 || family == NFPROTO_BRIDGE 1160 #endif 1161 #ifdef CONFIG_NF_TABLES_IPV6 1162 || family == NFPROTO_IPV6 1163 #endif 1164 ; 1165 } 1166 1167 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 1168 const struct nlattr * const nla[]) 1169 { 1170 struct nftables_pernet *nft_net = nft_pernet(info->net); 1171 struct netlink_ext_ack *extack = info->extack; 1172 u8 genmask = nft_genmask_next(info->net); 1173 u8 family = info->nfmsg->nfgen_family; 1174 struct net *net = info->net; 1175 const struct nlattr *attr; 1176 struct nft_table *table; 1177 struct nft_ctx ctx; 1178 u32 flags = 0; 1179 int err; 1180 1181 if (!nft_supported_family(family)) 1182 return -EOPNOTSUPP; 1183 1184 lockdep_assert_held(&nft_net->commit_mutex); 1185 attr = nla[NFTA_TABLE_NAME]; 1186 table = nft_table_lookup(net, attr, family, genmask, 1187 NETLINK_CB(skb).portid); 1188 if (IS_ERR(table)) { 1189 if (PTR_ERR(table) != -ENOENT) 1190 return PTR_ERR(table); 1191 } else { 1192 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 1193 NL_SET_BAD_ATTR(extack, attr); 1194 return -EEXIST; 1195 } 1196 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 1197 return -EOPNOTSUPP; 1198 1199 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1200 1201 return nf_tables_updtable(&ctx); 1202 } 1203 1204 if (nla[NFTA_TABLE_FLAGS]) { 1205 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 1206 if (flags & ~NFT_TABLE_F_MASK) 1207 return -EOPNOTSUPP; 1208 } 1209 1210 err = -ENOMEM; 1211 table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT); 1212 if (table == NULL) 1213 goto err_kzalloc; 1214 1215 table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); 1216 if (table->name == NULL) 1217 goto err_strdup; 1218 1219 if (nla[NFTA_TABLE_USERDATA]) { 1220 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT); 1221 if (table->udata == NULL) 1222 goto err_table_udata; 1223 1224 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]); 1225 } 1226 1227 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params); 1228 if (err) 1229 goto err_chain_ht; 1230 1231 INIT_LIST_HEAD(&table->chains); 1232 INIT_LIST_HEAD(&table->sets); 1233 INIT_LIST_HEAD(&table->objects); 1234 INIT_LIST_HEAD(&table->flowtables); 1235 table->family = family; 1236 table->flags = flags; 1237 table->handle = ++nft_net->table_handle; 1238 if (table->flags & NFT_TABLE_F_OWNER) 1239 table->nlpid = NETLINK_CB(skb).portid; 1240 1241 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1242 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 1243 if (err < 0) 1244 goto err_trans; 1245 1246 list_add_tail_rcu(&table->list, &nft_net->tables); 1247 return 0; 1248 err_trans: 1249 rhltable_destroy(&table->chains_ht); 1250 err_chain_ht: 1251 kfree(table->udata); 1252 err_table_udata: 1253 kfree(table->name); 1254 err_strdup: 1255 kfree(table); 1256 err_kzalloc: 1257 return err; 1258 } 1259 1260 static int nft_flush_table(struct nft_ctx *ctx) 1261 { 1262 struct nft_flowtable *flowtable, *nft; 1263 struct nft_chain *chain, *nc; 1264 struct nft_object *obj, *ne; 1265 struct nft_set *set, *ns; 1266 int err; 1267 1268 list_for_each_entry(chain, &ctx->table->chains, list) { 1269 if (!nft_is_active_next(ctx->net, chain)) 1270 continue; 1271 1272 if (nft_chain_is_bound(chain)) 1273 continue; 1274 1275 ctx->chain = chain; 1276 1277 err = nft_delrule_by_chain(ctx); 1278 if (err < 0) 1279 goto out; 1280 } 1281 1282 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 1283 if (!nft_is_active_next(ctx->net, set)) 1284 continue; 1285 1286 if (nft_set_is_anonymous(set) && 1287 !list_empty(&set->bindings)) 1288 continue; 1289 1290 err = nft_delset(ctx, set); 1291 if (err < 0) 1292 goto out; 1293 } 1294 1295 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { 1296 if (!nft_is_active_next(ctx->net, flowtable)) 1297 continue; 1298 1299 err = nft_delflowtable(ctx, flowtable); 1300 if (err < 0) 1301 goto out; 1302 } 1303 1304 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { 1305 if (!nft_is_active_next(ctx->net, obj)) 1306 continue; 1307 1308 err = nft_delobj(ctx, obj); 1309 if (err < 0) 1310 goto out; 1311 } 1312 1313 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 1314 if (!nft_is_active_next(ctx->net, chain)) 1315 continue; 1316 1317 if (nft_chain_is_bound(chain)) 1318 continue; 1319 1320 ctx->chain = chain; 1321 1322 err = nft_delchain(ctx); 1323 if (err < 0) 1324 goto out; 1325 } 1326 1327 err = nft_deltable(ctx); 1328 out: 1329 return err; 1330 } 1331 1332 static int nft_flush(struct nft_ctx *ctx, int family) 1333 { 1334 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1335 const struct nlattr * const *nla = ctx->nla; 1336 struct nft_table *table, *nt; 1337 int err = 0; 1338 1339 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 1340 if (family != AF_UNSPEC && table->family != family) 1341 continue; 1342 1343 ctx->family = table->family; 1344 1345 if (!nft_is_active_next(ctx->net, table)) 1346 continue; 1347 1348 if (nft_table_has_owner(table) && table->nlpid != ctx->portid) 1349 continue; 1350 1351 if (nla[NFTA_TABLE_NAME] && 1352 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 1353 continue; 1354 1355 ctx->table = table; 1356 1357 err = nft_flush_table(ctx); 1358 if (err < 0) 1359 goto out; 1360 } 1361 out: 1362 return err; 1363 } 1364 1365 static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, 1366 const struct nlattr * const nla[]) 1367 { 1368 struct netlink_ext_ack *extack = info->extack; 1369 u8 genmask = nft_genmask_next(info->net); 1370 u8 family = info->nfmsg->nfgen_family; 1371 struct net *net = info->net; 1372 const struct nlattr *attr; 1373 struct nft_table *table; 1374 struct nft_ctx ctx; 1375 1376 nft_ctx_init(&ctx, net, skb, info->nlh, 0, NULL, NULL, nla); 1377 if (family == AF_UNSPEC || 1378 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) 1379 return nft_flush(&ctx, family); 1380 1381 if (nla[NFTA_TABLE_HANDLE]) { 1382 attr = nla[NFTA_TABLE_HANDLE]; 1383 table = nft_table_lookup_byhandle(net, attr, genmask, 1384 NETLINK_CB(skb).portid); 1385 } else { 1386 attr = nla[NFTA_TABLE_NAME]; 1387 table = nft_table_lookup(net, attr, family, genmask, 1388 NETLINK_CB(skb).portid); 1389 } 1390 1391 if (IS_ERR(table)) { 1392 NL_SET_BAD_ATTR(extack, attr); 1393 return PTR_ERR(table); 1394 } 1395 1396 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 1397 table->use > 0) 1398 return -EBUSY; 1399 1400 ctx.family = family; 1401 ctx.table = table; 1402 1403 return nft_flush_table(&ctx); 1404 } 1405 1406 static void nf_tables_table_destroy(struct nft_ctx *ctx) 1407 { 1408 if (WARN_ON(ctx->table->use > 0)) 1409 return; 1410 1411 rhltable_destroy(&ctx->table->chains_ht); 1412 kfree(ctx->table->name); 1413 kfree(ctx->table->udata); 1414 kfree(ctx->table); 1415 } 1416 1417 void nft_register_chain_type(const struct nft_chain_type *ctype) 1418 { 1419 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1420 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) { 1421 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1422 return; 1423 } 1424 chain_type[ctype->family][ctype->type] = ctype; 1425 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1426 } 1427 EXPORT_SYMBOL_GPL(nft_register_chain_type); 1428 1429 void nft_unregister_chain_type(const struct nft_chain_type *ctype) 1430 { 1431 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1432 chain_type[ctype->family][ctype->type] = NULL; 1433 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1434 } 1435 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 1436 1437 /* 1438 * Chains 1439 */ 1440 1441 static struct nft_chain * 1442 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask) 1443 { 1444 struct nft_chain *chain; 1445 1446 list_for_each_entry(chain, &table->chains, list) { 1447 if (chain->handle == handle && 1448 nft_active_genmask(chain, genmask)) 1449 return chain; 1450 } 1451 1452 return ERR_PTR(-ENOENT); 1453 } 1454 1455 static bool lockdep_commit_lock_is_held(const struct net *net) 1456 { 1457 #ifdef CONFIG_PROVE_LOCKING 1458 struct nftables_pernet *nft_net = nft_pernet(net); 1459 1460 return lockdep_is_held(&nft_net->commit_mutex); 1461 #else 1462 return true; 1463 #endif 1464 } 1465 1466 static struct nft_chain *nft_chain_lookup(struct net *net, 1467 struct nft_table *table, 1468 const struct nlattr *nla, u8 genmask) 1469 { 1470 char search[NFT_CHAIN_MAXNAMELEN + 1]; 1471 struct rhlist_head *tmp, *list; 1472 struct nft_chain *chain; 1473 1474 if (nla == NULL) 1475 return ERR_PTR(-EINVAL); 1476 1477 nla_strscpy(search, nla, sizeof(search)); 1478 1479 WARN_ON(!rcu_read_lock_held() && 1480 !lockdep_commit_lock_is_held(net)); 1481 1482 chain = ERR_PTR(-ENOENT); 1483 rcu_read_lock(); 1484 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params); 1485 if (!list) 1486 goto out_unlock; 1487 1488 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 1489 if (nft_active_genmask(chain, genmask)) 1490 goto out_unlock; 1491 } 1492 chain = ERR_PTR(-ENOENT); 1493 out_unlock: 1494 rcu_read_unlock(); 1495 return chain; 1496 } 1497 1498 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 1499 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING, 1500 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1501 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 1502 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 1503 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1504 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 1505 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 1506 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING, 1507 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 1508 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 1509 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 }, 1510 [NFTA_CHAIN_ID] = { .type = NLA_U32 }, 1511 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY, 1512 .len = NFT_USERDATA_MAXLEN }, 1513 }; 1514 1515 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 1516 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 1517 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 1518 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 1519 .len = IFNAMSIZ - 1 }, 1520 }; 1521 1522 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 1523 { 1524 struct nft_stats *cpu_stats, total; 1525 struct nlattr *nest; 1526 unsigned int seq; 1527 u64 pkts, bytes; 1528 int cpu; 1529 1530 if (!stats) 1531 return 0; 1532 1533 memset(&total, 0, sizeof(total)); 1534 for_each_possible_cpu(cpu) { 1535 cpu_stats = per_cpu_ptr(stats, cpu); 1536 do { 1537 seq = u64_stats_fetch_begin(&cpu_stats->syncp); 1538 pkts = cpu_stats->pkts; 1539 bytes = cpu_stats->bytes; 1540 } while (u64_stats_fetch_retry(&cpu_stats->syncp, seq)); 1541 total.pkts += pkts; 1542 total.bytes += bytes; 1543 } 1544 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS); 1545 if (nest == NULL) 1546 goto nla_put_failure; 1547 1548 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts), 1549 NFTA_COUNTER_PAD) || 1550 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 1551 NFTA_COUNTER_PAD)) 1552 goto nla_put_failure; 1553 1554 nla_nest_end(skb, nest); 1555 return 0; 1556 1557 nla_put_failure: 1558 return -ENOSPC; 1559 } 1560 1561 static int nft_dump_basechain_hook(struct sk_buff *skb, int family, 1562 const struct nft_base_chain *basechain) 1563 { 1564 const struct nf_hook_ops *ops = &basechain->ops; 1565 struct nft_hook *hook, *first = NULL; 1566 struct nlattr *nest, *nest_devs; 1567 int n = 0; 1568 1569 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK); 1570 if (nest == NULL) 1571 goto nla_put_failure; 1572 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 1573 goto nla_put_failure; 1574 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 1575 goto nla_put_failure; 1576 1577 if (nft_base_chain_netdev(family, ops->hooknum)) { 1578 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS); 1579 list_for_each_entry(hook, &basechain->hook_list, list) { 1580 if (!first) 1581 first = hook; 1582 1583 if (nla_put_string(skb, NFTA_DEVICE_NAME, 1584 hook->ops.dev->name)) 1585 goto nla_put_failure; 1586 n++; 1587 } 1588 nla_nest_end(skb, nest_devs); 1589 1590 if (n == 1 && 1591 nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name)) 1592 goto nla_put_failure; 1593 } 1594 nla_nest_end(skb, nest); 1595 1596 return 0; 1597 nla_put_failure: 1598 return -1; 1599 } 1600 1601 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 1602 u32 portid, u32 seq, int event, u32 flags, 1603 int family, const struct nft_table *table, 1604 const struct nft_chain *chain) 1605 { 1606 struct nlmsghdr *nlh; 1607 1608 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 1609 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 1610 NFNETLINK_V0, nft_base_seq(net)); 1611 if (!nlh) 1612 goto nla_put_failure; 1613 1614 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name)) 1615 goto nla_put_failure; 1616 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), 1617 NFTA_CHAIN_PAD)) 1618 goto nla_put_failure; 1619 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name)) 1620 goto nla_put_failure; 1621 1622 if (nft_is_base_chain(chain)) { 1623 const struct nft_base_chain *basechain = nft_base_chain(chain); 1624 struct nft_stats __percpu *stats; 1625 1626 if (nft_dump_basechain_hook(skb, family, basechain)) 1627 goto nla_put_failure; 1628 1629 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 1630 htonl(basechain->policy))) 1631 goto nla_put_failure; 1632 1633 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 1634 goto nla_put_failure; 1635 1636 stats = rcu_dereference_check(basechain->stats, 1637 lockdep_commit_lock_is_held(net)); 1638 if (nft_dump_stats(skb, stats)) 1639 goto nla_put_failure; 1640 } 1641 1642 if (chain->flags && 1643 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags))) 1644 goto nla_put_failure; 1645 1646 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 1647 goto nla_put_failure; 1648 1649 if (chain->udata && 1650 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata)) 1651 goto nla_put_failure; 1652 1653 nlmsg_end(skb, nlh); 1654 return 0; 1655 1656 nla_put_failure: 1657 nlmsg_trim(skb, nlh); 1658 return -1; 1659 } 1660 1661 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event) 1662 { 1663 struct nftables_pernet *nft_net; 1664 struct sk_buff *skb; 1665 u16 flags = 0; 1666 int err; 1667 1668 if (!ctx->report && 1669 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1670 return; 1671 1672 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1673 if (skb == NULL) 1674 goto err; 1675 1676 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 1677 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 1678 1679 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 1680 event, flags, ctx->family, ctx->table, 1681 ctx->chain); 1682 if (err < 0) { 1683 kfree_skb(skb); 1684 goto err; 1685 } 1686 1687 nft_net = nft_pernet(ctx->net); 1688 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 1689 return; 1690 err: 1691 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1692 } 1693 1694 static int nf_tables_dump_chains(struct sk_buff *skb, 1695 struct netlink_callback *cb) 1696 { 1697 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1698 unsigned int idx = 0, s_idx = cb->args[0]; 1699 struct net *net = sock_net(skb->sk); 1700 int family = nfmsg->nfgen_family; 1701 struct nftables_pernet *nft_net; 1702 const struct nft_table *table; 1703 const struct nft_chain *chain; 1704 1705 rcu_read_lock(); 1706 nft_net = nft_pernet(net); 1707 cb->seq = READ_ONCE(nft_net->base_seq); 1708 1709 list_for_each_entry_rcu(table, &nft_net->tables, list) { 1710 if (family != NFPROTO_UNSPEC && family != table->family) 1711 continue; 1712 1713 list_for_each_entry_rcu(chain, &table->chains, list) { 1714 if (idx < s_idx) 1715 goto cont; 1716 if (idx > s_idx) 1717 memset(&cb->args[1], 0, 1718 sizeof(cb->args) - sizeof(cb->args[0])); 1719 if (!nft_is_active(net, chain)) 1720 continue; 1721 if (nf_tables_fill_chain_info(skb, net, 1722 NETLINK_CB(cb->skb).portid, 1723 cb->nlh->nlmsg_seq, 1724 NFT_MSG_NEWCHAIN, 1725 NLM_F_MULTI, 1726 table->family, table, 1727 chain) < 0) 1728 goto done; 1729 1730 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1731 cont: 1732 idx++; 1733 } 1734 } 1735 done: 1736 rcu_read_unlock(); 1737 cb->args[0] = idx; 1738 return skb->len; 1739 } 1740 1741 /* called with rcu_read_lock held */ 1742 static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, 1743 const struct nlattr * const nla[]) 1744 { 1745 struct netlink_ext_ack *extack = info->extack; 1746 u8 genmask = nft_genmask_cur(info->net); 1747 u8 family = info->nfmsg->nfgen_family; 1748 const struct nft_chain *chain; 1749 struct net *net = info->net; 1750 struct nft_table *table; 1751 struct sk_buff *skb2; 1752 int err; 1753 1754 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1755 struct netlink_dump_control c = { 1756 .dump = nf_tables_dump_chains, 1757 .module = THIS_MODULE, 1758 }; 1759 1760 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 1761 } 1762 1763 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 0); 1764 if (IS_ERR(table)) { 1765 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 1766 return PTR_ERR(table); 1767 } 1768 1769 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask); 1770 if (IS_ERR(chain)) { 1771 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 1772 return PTR_ERR(chain); 1773 } 1774 1775 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 1776 if (!skb2) 1777 return -ENOMEM; 1778 1779 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 1780 info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 1781 0, family, table, chain); 1782 if (err < 0) 1783 goto err_fill_chain_info; 1784 1785 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 1786 1787 err_fill_chain_info: 1788 kfree_skb(skb2); 1789 return err; 1790 } 1791 1792 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 1793 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 1794 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 1795 }; 1796 1797 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 1798 { 1799 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 1800 struct nft_stats __percpu *newstats; 1801 struct nft_stats *stats; 1802 int err; 1803 1804 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr, 1805 nft_counter_policy, NULL); 1806 if (err < 0) 1807 return ERR_PTR(err); 1808 1809 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 1810 return ERR_PTR(-EINVAL); 1811 1812 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 1813 if (newstats == NULL) 1814 return ERR_PTR(-ENOMEM); 1815 1816 /* Restore old counters on this cpu, no problem. Per-cpu statistics 1817 * are not exposed to userspace. 1818 */ 1819 preempt_disable(); 1820 stats = this_cpu_ptr(newstats); 1821 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 1822 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 1823 preempt_enable(); 1824 1825 return newstats; 1826 } 1827 1828 static void nft_chain_stats_replace(struct nft_trans *trans) 1829 { 1830 struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain); 1831 1832 if (!nft_trans_chain_stats(trans)) 1833 return; 1834 1835 nft_trans_chain_stats(trans) = 1836 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans), 1837 lockdep_commit_lock_is_held(trans->ctx.net)); 1838 1839 if (!nft_trans_chain_stats(trans)) 1840 static_branch_inc(&nft_counters_enabled); 1841 } 1842 1843 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) 1844 { 1845 struct nft_rule_blob *g0 = rcu_dereference_raw(chain->blob_gen_0); 1846 struct nft_rule_blob *g1 = rcu_dereference_raw(chain->blob_gen_1); 1847 1848 if (g0 != g1) 1849 kvfree(g1); 1850 kvfree(g0); 1851 1852 /* should be NULL either via abort or via successful commit */ 1853 WARN_ON_ONCE(chain->blob_next); 1854 kvfree(chain->blob_next); 1855 } 1856 1857 void nf_tables_chain_destroy(struct nft_ctx *ctx) 1858 { 1859 struct nft_chain *chain = ctx->chain; 1860 struct nft_hook *hook, *next; 1861 1862 if (WARN_ON(chain->use > 0)) 1863 return; 1864 1865 /* no concurrent access possible anymore */ 1866 nf_tables_chain_free_chain_rules(chain); 1867 1868 if (nft_is_base_chain(chain)) { 1869 struct nft_base_chain *basechain = nft_base_chain(chain); 1870 1871 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 1872 list_for_each_entry_safe(hook, next, 1873 &basechain->hook_list, list) { 1874 list_del_rcu(&hook->list); 1875 kfree_rcu(hook, rcu); 1876 } 1877 } 1878 module_put(basechain->type->owner); 1879 if (rcu_access_pointer(basechain->stats)) { 1880 static_branch_dec(&nft_counters_enabled); 1881 free_percpu(rcu_dereference_raw(basechain->stats)); 1882 } 1883 kfree(chain->name); 1884 kfree(chain->udata); 1885 kfree(basechain); 1886 } else { 1887 kfree(chain->name); 1888 kfree(chain->udata); 1889 kfree(chain); 1890 } 1891 } 1892 1893 static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 1894 const struct nlattr *attr) 1895 { 1896 struct net_device *dev; 1897 char ifname[IFNAMSIZ]; 1898 struct nft_hook *hook; 1899 int err; 1900 1901 hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT); 1902 if (!hook) { 1903 err = -ENOMEM; 1904 goto err_hook_alloc; 1905 } 1906 1907 nla_strscpy(ifname, attr, IFNAMSIZ); 1908 /* nf_tables_netdev_event() is called under rtnl_mutex, this is 1909 * indirectly serializing all the other holders of the commit_mutex with 1910 * the rtnl_mutex. 1911 */ 1912 dev = __dev_get_by_name(net, ifname); 1913 if (!dev) { 1914 err = -ENOENT; 1915 goto err_hook_dev; 1916 } 1917 hook->ops.dev = dev; 1918 1919 return hook; 1920 1921 err_hook_dev: 1922 kfree(hook); 1923 err_hook_alloc: 1924 return ERR_PTR(err); 1925 } 1926 1927 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, 1928 const struct nft_hook *this) 1929 { 1930 struct nft_hook *hook; 1931 1932 list_for_each_entry(hook, hook_list, list) { 1933 if (this->ops.dev == hook->ops.dev) 1934 return hook; 1935 } 1936 1937 return NULL; 1938 } 1939 1940 static int nf_tables_parse_netdev_hooks(struct net *net, 1941 const struct nlattr *attr, 1942 struct list_head *hook_list) 1943 { 1944 struct nft_hook *hook, *next; 1945 const struct nlattr *tmp; 1946 int rem, n = 0, err; 1947 1948 nla_for_each_nested(tmp, attr, rem) { 1949 if (nla_type(tmp) != NFTA_DEVICE_NAME) { 1950 err = -EINVAL; 1951 goto err_hook; 1952 } 1953 1954 hook = nft_netdev_hook_alloc(net, tmp); 1955 if (IS_ERR(hook)) { 1956 err = PTR_ERR(hook); 1957 goto err_hook; 1958 } 1959 if (nft_hook_list_find(hook_list, hook)) { 1960 kfree(hook); 1961 err = -EEXIST; 1962 goto err_hook; 1963 } 1964 list_add_tail(&hook->list, hook_list); 1965 n++; 1966 1967 if (n == NFT_NETDEVICE_MAX) { 1968 err = -EFBIG; 1969 goto err_hook; 1970 } 1971 } 1972 1973 return 0; 1974 1975 err_hook: 1976 list_for_each_entry_safe(hook, next, hook_list, list) { 1977 list_del(&hook->list); 1978 kfree(hook); 1979 } 1980 return err; 1981 } 1982 1983 struct nft_chain_hook { 1984 u32 num; 1985 s32 priority; 1986 const struct nft_chain_type *type; 1987 struct list_head list; 1988 }; 1989 1990 static int nft_chain_parse_netdev(struct net *net, 1991 struct nlattr *tb[], 1992 struct list_head *hook_list) 1993 { 1994 struct nft_hook *hook; 1995 int err; 1996 1997 if (tb[NFTA_HOOK_DEV]) { 1998 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]); 1999 if (IS_ERR(hook)) 2000 return PTR_ERR(hook); 2001 2002 list_add_tail(&hook->list, hook_list); 2003 } else if (tb[NFTA_HOOK_DEVS]) { 2004 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS], 2005 hook_list); 2006 if (err < 0) 2007 return err; 2008 2009 if (list_empty(hook_list)) 2010 return -EINVAL; 2011 } else { 2012 return -EINVAL; 2013 } 2014 2015 return 0; 2016 } 2017 2018 static int nft_chain_parse_hook(struct net *net, 2019 const struct nlattr * const nla[], 2020 struct nft_chain_hook *hook, u8 family, 2021 struct netlink_ext_ack *extack, bool autoload) 2022 { 2023 struct nftables_pernet *nft_net = nft_pernet(net); 2024 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 2025 const struct nft_chain_type *type; 2026 int err; 2027 2028 lockdep_assert_held(&nft_net->commit_mutex); 2029 lockdep_nfnl_nft_mutex_not_held(); 2030 2031 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX, 2032 nla[NFTA_CHAIN_HOOK], 2033 nft_hook_policy, NULL); 2034 if (err < 0) 2035 return err; 2036 2037 if (ha[NFTA_HOOK_HOOKNUM] == NULL || 2038 ha[NFTA_HOOK_PRIORITY] == NULL) 2039 return -EINVAL; 2040 2041 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2042 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2043 2044 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT); 2045 if (!type) 2046 return -EOPNOTSUPP; 2047 2048 if (nla[NFTA_CHAIN_TYPE]) { 2049 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE], 2050 family, autoload); 2051 if (IS_ERR(type)) { 2052 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2053 return PTR_ERR(type); 2054 } 2055 } 2056 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num))) 2057 return -EOPNOTSUPP; 2058 2059 if (type->type == NFT_CHAIN_T_NAT && 2060 hook->priority <= NF_IP_PRI_CONNTRACK) 2061 return -EOPNOTSUPP; 2062 2063 if (!try_module_get(type->owner)) { 2064 if (nla[NFTA_CHAIN_TYPE]) 2065 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2066 return -ENOENT; 2067 } 2068 2069 hook->type = type; 2070 2071 INIT_LIST_HEAD(&hook->list); 2072 if (nft_base_chain_netdev(family, hook->num)) { 2073 err = nft_chain_parse_netdev(net, ha, &hook->list); 2074 if (err < 0) { 2075 module_put(type->owner); 2076 return err; 2077 } 2078 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) { 2079 module_put(type->owner); 2080 return -EOPNOTSUPP; 2081 } 2082 2083 return 0; 2084 } 2085 2086 static void nft_chain_release_hook(struct nft_chain_hook *hook) 2087 { 2088 struct nft_hook *h, *next; 2089 2090 list_for_each_entry_safe(h, next, &hook->list, list) { 2091 list_del(&h->list); 2092 kfree(h); 2093 } 2094 module_put(hook->type->owner); 2095 } 2096 2097 struct nft_rules_old { 2098 struct rcu_head h; 2099 struct nft_rule_blob *blob; 2100 }; 2101 2102 static void nft_last_rule(struct nft_rule_blob *blob, const void *ptr) 2103 { 2104 struct nft_rule_dp *prule; 2105 2106 prule = (struct nft_rule_dp *)ptr; 2107 prule->is_last = 1; 2108 /* blob size does not include the trailer rule */ 2109 } 2110 2111 static struct nft_rule_blob *nf_tables_chain_alloc_rules(unsigned int size) 2112 { 2113 struct nft_rule_blob *blob; 2114 2115 /* size must include room for the last rule */ 2116 if (size < offsetof(struct nft_rule_dp, data)) 2117 return NULL; 2118 2119 size += sizeof(struct nft_rule_blob) + sizeof(struct nft_rules_old); 2120 if (size > INT_MAX) 2121 return NULL; 2122 2123 blob = kvmalloc(size, GFP_KERNEL_ACCOUNT); 2124 if (!blob) 2125 return NULL; 2126 2127 blob->size = 0; 2128 nft_last_rule(blob, blob->data); 2129 2130 return blob; 2131 } 2132 2133 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family, 2134 const struct nft_chain_hook *hook, 2135 struct nft_chain *chain) 2136 { 2137 ops->pf = family; 2138 ops->hooknum = hook->num; 2139 ops->priority = hook->priority; 2140 ops->priv = chain; 2141 ops->hook = hook->type->hooks[ops->hooknum]; 2142 ops->hook_ops_type = NF_HOOK_OP_NF_TABLES; 2143 } 2144 2145 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, 2146 struct nft_chain_hook *hook, u32 flags) 2147 { 2148 struct nft_chain *chain; 2149 struct nft_hook *h; 2150 2151 basechain->type = hook->type; 2152 INIT_LIST_HEAD(&basechain->hook_list); 2153 chain = &basechain->chain; 2154 2155 if (nft_base_chain_netdev(family, hook->num)) { 2156 list_splice_init(&hook->list, &basechain->hook_list); 2157 list_for_each_entry(h, &basechain->hook_list, list) 2158 nft_basechain_hook_init(&h->ops, family, hook, chain); 2159 2160 basechain->ops.hooknum = hook->num; 2161 basechain->ops.priority = hook->priority; 2162 } else { 2163 nft_basechain_hook_init(&basechain->ops, family, hook, chain); 2164 } 2165 2166 chain->flags |= NFT_CHAIN_BASE | flags; 2167 basechain->policy = NF_ACCEPT; 2168 if (chain->flags & NFT_CHAIN_HW_OFFLOAD && 2169 !nft_chain_offload_support(basechain)) { 2170 list_splice_init(&basechain->hook_list, &hook->list); 2171 return -EOPNOTSUPP; 2172 } 2173 2174 flow_block_init(&basechain->flow_block); 2175 2176 return 0; 2177 } 2178 2179 static int nft_chain_add(struct nft_table *table, struct nft_chain *chain) 2180 { 2181 int err; 2182 2183 err = rhltable_insert_key(&table->chains_ht, chain->name, 2184 &chain->rhlhead, nft_chain_ht_params); 2185 if (err) 2186 return err; 2187 2188 list_add_tail_rcu(&chain->list, &table->chains); 2189 2190 return 0; 2191 } 2192 2193 static u64 chain_id; 2194 2195 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 2196 u8 policy, u32 flags, 2197 struct netlink_ext_ack *extack) 2198 { 2199 const struct nlattr * const *nla = ctx->nla; 2200 struct nft_table *table = ctx->table; 2201 struct nft_base_chain *basechain; 2202 struct net *net = ctx->net; 2203 char name[NFT_NAME_MAXLEN]; 2204 struct nft_rule_blob *blob; 2205 struct nft_trans *trans; 2206 struct nft_chain *chain; 2207 unsigned int data_size; 2208 int err; 2209 2210 if (table->use == UINT_MAX) 2211 return -EOVERFLOW; 2212 2213 if (nla[NFTA_CHAIN_HOOK]) { 2214 struct nft_stats __percpu *stats = NULL; 2215 struct nft_chain_hook hook; 2216 2217 if (flags & NFT_CHAIN_BINDING) 2218 return -EOPNOTSUPP; 2219 2220 err = nft_chain_parse_hook(net, nla, &hook, family, extack, 2221 true); 2222 if (err < 0) 2223 return err; 2224 2225 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT); 2226 if (basechain == NULL) { 2227 nft_chain_release_hook(&hook); 2228 return -ENOMEM; 2229 } 2230 chain = &basechain->chain; 2231 2232 if (nla[NFTA_CHAIN_COUNTERS]) { 2233 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2234 if (IS_ERR(stats)) { 2235 nft_chain_release_hook(&hook); 2236 kfree(basechain); 2237 return PTR_ERR(stats); 2238 } 2239 rcu_assign_pointer(basechain->stats, stats); 2240 } 2241 2242 err = nft_basechain_init(basechain, family, &hook, flags); 2243 if (err < 0) { 2244 nft_chain_release_hook(&hook); 2245 kfree(basechain); 2246 free_percpu(stats); 2247 return err; 2248 } 2249 if (stats) 2250 static_branch_inc(&nft_counters_enabled); 2251 } else { 2252 if (flags & NFT_CHAIN_BASE) 2253 return -EINVAL; 2254 if (flags & NFT_CHAIN_HW_OFFLOAD) 2255 return -EOPNOTSUPP; 2256 2257 chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT); 2258 if (chain == NULL) 2259 return -ENOMEM; 2260 2261 chain->flags = flags; 2262 } 2263 ctx->chain = chain; 2264 2265 INIT_LIST_HEAD(&chain->rules); 2266 chain->handle = nf_tables_alloc_handle(table); 2267 chain->table = table; 2268 2269 if (nla[NFTA_CHAIN_NAME]) { 2270 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2271 } else { 2272 if (!(flags & NFT_CHAIN_BINDING)) { 2273 err = -EINVAL; 2274 goto err_destroy_chain; 2275 } 2276 2277 snprintf(name, sizeof(name), "__chain%llu", ++chain_id); 2278 chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT); 2279 } 2280 2281 if (!chain->name) { 2282 err = -ENOMEM; 2283 goto err_destroy_chain; 2284 } 2285 2286 if (nla[NFTA_CHAIN_USERDATA]) { 2287 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT); 2288 if (chain->udata == NULL) { 2289 err = -ENOMEM; 2290 goto err_destroy_chain; 2291 } 2292 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]); 2293 } 2294 2295 data_size = offsetof(struct nft_rule_dp, data); /* last rule */ 2296 blob = nf_tables_chain_alloc_rules(data_size); 2297 if (!blob) { 2298 err = -ENOMEM; 2299 goto err_destroy_chain; 2300 } 2301 2302 RCU_INIT_POINTER(chain->blob_gen_0, blob); 2303 RCU_INIT_POINTER(chain->blob_gen_1, blob); 2304 2305 err = nf_tables_register_hook(net, table, chain); 2306 if (err < 0) 2307 goto err_destroy_chain; 2308 2309 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN); 2310 if (IS_ERR(trans)) { 2311 err = PTR_ERR(trans); 2312 goto err_unregister_hook; 2313 } 2314 2315 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET; 2316 if (nft_is_base_chain(chain)) 2317 nft_trans_chain_policy(trans) = policy; 2318 2319 err = nft_chain_add(table, chain); 2320 if (err < 0) { 2321 nft_trans_destroy(trans); 2322 goto err_unregister_hook; 2323 } 2324 2325 table->use++; 2326 2327 return 0; 2328 err_unregister_hook: 2329 nf_tables_unregister_hook(net, table, chain); 2330 err_destroy_chain: 2331 nf_tables_chain_destroy(ctx); 2332 2333 return err; 2334 } 2335 2336 static bool nft_hook_list_equal(struct list_head *hook_list1, 2337 struct list_head *hook_list2) 2338 { 2339 struct nft_hook *hook; 2340 int n = 0, m = 0; 2341 2342 n = 0; 2343 list_for_each_entry(hook, hook_list2, list) { 2344 if (!nft_hook_list_find(hook_list1, hook)) 2345 return false; 2346 2347 n++; 2348 } 2349 list_for_each_entry(hook, hook_list1, list) 2350 m++; 2351 2352 return n == m; 2353 } 2354 2355 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 2356 u32 flags, const struct nlattr *attr, 2357 struct netlink_ext_ack *extack) 2358 { 2359 const struct nlattr * const *nla = ctx->nla; 2360 struct nft_table *table = ctx->table; 2361 struct nft_chain *chain = ctx->chain; 2362 struct nft_base_chain *basechain; 2363 struct nft_stats *stats = NULL; 2364 struct nft_chain_hook hook; 2365 struct nf_hook_ops *ops; 2366 struct nft_trans *trans; 2367 int err; 2368 2369 if (chain->flags ^ flags) 2370 return -EOPNOTSUPP; 2371 2372 if (nla[NFTA_CHAIN_HOOK]) { 2373 if (!nft_is_base_chain(chain)) { 2374 NL_SET_BAD_ATTR(extack, attr); 2375 return -EEXIST; 2376 } 2377 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family, 2378 extack, false); 2379 if (err < 0) 2380 return err; 2381 2382 basechain = nft_base_chain(chain); 2383 if (basechain->type != hook.type) { 2384 nft_chain_release_hook(&hook); 2385 NL_SET_BAD_ATTR(extack, attr); 2386 return -EEXIST; 2387 } 2388 2389 if (nft_base_chain_netdev(ctx->family, hook.num)) { 2390 if (!nft_hook_list_equal(&basechain->hook_list, 2391 &hook.list)) { 2392 nft_chain_release_hook(&hook); 2393 NL_SET_BAD_ATTR(extack, attr); 2394 return -EEXIST; 2395 } 2396 } else { 2397 ops = &basechain->ops; 2398 if (ops->hooknum != hook.num || 2399 ops->priority != hook.priority) { 2400 nft_chain_release_hook(&hook); 2401 NL_SET_BAD_ATTR(extack, attr); 2402 return -EEXIST; 2403 } 2404 } 2405 nft_chain_release_hook(&hook); 2406 } 2407 2408 if (nla[NFTA_CHAIN_HANDLE] && 2409 nla[NFTA_CHAIN_NAME]) { 2410 struct nft_chain *chain2; 2411 2412 chain2 = nft_chain_lookup(ctx->net, table, 2413 nla[NFTA_CHAIN_NAME], genmask); 2414 if (!IS_ERR(chain2)) { 2415 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2416 return -EEXIST; 2417 } 2418 } 2419 2420 if (nla[NFTA_CHAIN_COUNTERS]) { 2421 if (!nft_is_base_chain(chain)) 2422 return -EOPNOTSUPP; 2423 2424 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2425 if (IS_ERR(stats)) 2426 return PTR_ERR(stats); 2427 } 2428 2429 err = -ENOMEM; 2430 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, 2431 sizeof(struct nft_trans_chain)); 2432 if (trans == NULL) 2433 goto err; 2434 2435 nft_trans_chain_stats(trans) = stats; 2436 nft_trans_chain_update(trans) = true; 2437 2438 if (nla[NFTA_CHAIN_POLICY]) 2439 nft_trans_chain_policy(trans) = policy; 2440 else 2441 nft_trans_chain_policy(trans) = -1; 2442 2443 if (nla[NFTA_CHAIN_HANDLE] && 2444 nla[NFTA_CHAIN_NAME]) { 2445 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 2446 struct nft_trans *tmp; 2447 char *name; 2448 2449 err = -ENOMEM; 2450 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2451 if (!name) 2452 goto err; 2453 2454 err = -EEXIST; 2455 list_for_each_entry(tmp, &nft_net->commit_list, list) { 2456 if (tmp->msg_type == NFT_MSG_NEWCHAIN && 2457 tmp->ctx.table == table && 2458 nft_trans_chain_update(tmp) && 2459 nft_trans_chain_name(tmp) && 2460 strcmp(name, nft_trans_chain_name(tmp)) == 0) { 2461 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2462 kfree(name); 2463 goto err; 2464 } 2465 } 2466 2467 nft_trans_chain_name(trans) = name; 2468 } 2469 nft_trans_commit_list_add_tail(ctx->net, trans); 2470 2471 return 0; 2472 err: 2473 free_percpu(stats); 2474 kfree(trans); 2475 return err; 2476 } 2477 2478 static struct nft_chain *nft_chain_lookup_byid(const struct net *net, 2479 const struct nft_table *table, 2480 const struct nlattr *nla) 2481 { 2482 struct nftables_pernet *nft_net = nft_pernet(net); 2483 u32 id = ntohl(nla_get_be32(nla)); 2484 struct nft_trans *trans; 2485 2486 list_for_each_entry(trans, &nft_net->commit_list, list) { 2487 struct nft_chain *chain = trans->ctx.chain; 2488 2489 if (trans->msg_type == NFT_MSG_NEWCHAIN && 2490 chain->table == table && 2491 id == nft_trans_chain_id(trans)) 2492 return chain; 2493 } 2494 return ERR_PTR(-ENOENT); 2495 } 2496 2497 static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, 2498 const struct nlattr * const nla[]) 2499 { 2500 struct nftables_pernet *nft_net = nft_pernet(info->net); 2501 struct netlink_ext_ack *extack = info->extack; 2502 u8 genmask = nft_genmask_next(info->net); 2503 u8 family = info->nfmsg->nfgen_family; 2504 struct nft_chain *chain = NULL; 2505 struct net *net = info->net; 2506 const struct nlattr *attr; 2507 struct nft_table *table; 2508 u8 policy = NF_ACCEPT; 2509 struct nft_ctx ctx; 2510 u64 handle = 0; 2511 u32 flags = 0; 2512 2513 lockdep_assert_held(&nft_net->commit_mutex); 2514 2515 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2516 NETLINK_CB(skb).portid); 2517 if (IS_ERR(table)) { 2518 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2519 return PTR_ERR(table); 2520 } 2521 2522 chain = NULL; 2523 attr = nla[NFTA_CHAIN_NAME]; 2524 2525 if (nla[NFTA_CHAIN_HANDLE]) { 2526 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 2527 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2528 if (IS_ERR(chain)) { 2529 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]); 2530 return PTR_ERR(chain); 2531 } 2532 attr = nla[NFTA_CHAIN_HANDLE]; 2533 } else if (nla[NFTA_CHAIN_NAME]) { 2534 chain = nft_chain_lookup(net, table, attr, genmask); 2535 if (IS_ERR(chain)) { 2536 if (PTR_ERR(chain) != -ENOENT) { 2537 NL_SET_BAD_ATTR(extack, attr); 2538 return PTR_ERR(chain); 2539 } 2540 chain = NULL; 2541 } 2542 } else if (!nla[NFTA_CHAIN_ID]) { 2543 return -EINVAL; 2544 } 2545 2546 if (nla[NFTA_CHAIN_POLICY]) { 2547 if (chain != NULL && 2548 !nft_is_base_chain(chain)) { 2549 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2550 return -EOPNOTSUPP; 2551 } 2552 2553 if (chain == NULL && 2554 nla[NFTA_CHAIN_HOOK] == NULL) { 2555 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 2556 return -EOPNOTSUPP; 2557 } 2558 2559 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 2560 switch (policy) { 2561 case NF_DROP: 2562 case NF_ACCEPT: 2563 break; 2564 default: 2565 return -EINVAL; 2566 } 2567 } 2568 2569 if (nla[NFTA_CHAIN_FLAGS]) 2570 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS])); 2571 else if (chain) 2572 flags = chain->flags; 2573 2574 if (flags & ~NFT_CHAIN_FLAGS) 2575 return -EOPNOTSUPP; 2576 2577 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2578 2579 if (chain != NULL) { 2580 if (chain->flags & NFT_CHAIN_BINDING) 2581 return -EINVAL; 2582 2583 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 2584 NL_SET_BAD_ATTR(extack, attr); 2585 return -EEXIST; 2586 } 2587 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 2588 return -EOPNOTSUPP; 2589 2590 flags |= chain->flags & NFT_CHAIN_BASE; 2591 return nf_tables_updchain(&ctx, genmask, policy, flags, attr, 2592 extack); 2593 } 2594 2595 return nf_tables_addchain(&ctx, family, genmask, policy, flags, extack); 2596 } 2597 2598 static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, 2599 const struct nlattr * const nla[]) 2600 { 2601 struct netlink_ext_ack *extack = info->extack; 2602 u8 genmask = nft_genmask_next(info->net); 2603 u8 family = info->nfmsg->nfgen_family; 2604 struct net *net = info->net; 2605 const struct nlattr *attr; 2606 struct nft_table *table; 2607 struct nft_chain *chain; 2608 struct nft_rule *rule; 2609 struct nft_ctx ctx; 2610 u64 handle; 2611 u32 use; 2612 int err; 2613 2614 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 2615 NETLINK_CB(skb).portid); 2616 if (IS_ERR(table)) { 2617 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2618 return PTR_ERR(table); 2619 } 2620 2621 if (nla[NFTA_CHAIN_HANDLE]) { 2622 attr = nla[NFTA_CHAIN_HANDLE]; 2623 handle = be64_to_cpu(nla_get_be64(attr)); 2624 chain = nft_chain_lookup_byhandle(table, handle, genmask); 2625 } else { 2626 attr = nla[NFTA_CHAIN_NAME]; 2627 chain = nft_chain_lookup(net, table, attr, genmask); 2628 } 2629 if (IS_ERR(chain)) { 2630 NL_SET_BAD_ATTR(extack, attr); 2631 return PTR_ERR(chain); 2632 } 2633 2634 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 2635 chain->use > 0) 2636 return -EBUSY; 2637 2638 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 2639 2640 use = chain->use; 2641 list_for_each_entry(rule, &chain->rules, list) { 2642 if (!nft_is_active_next(net, rule)) 2643 continue; 2644 use--; 2645 2646 err = nft_delrule(&ctx, rule); 2647 if (err < 0) 2648 return err; 2649 } 2650 2651 /* There are rules and elements that are still holding references to us, 2652 * we cannot do a recursive removal in this case. 2653 */ 2654 if (use > 0) { 2655 NL_SET_BAD_ATTR(extack, attr); 2656 return -EBUSY; 2657 } 2658 2659 return nft_delchain(&ctx); 2660 } 2661 2662 /* 2663 * Expressions 2664 */ 2665 2666 /** 2667 * nft_register_expr - register nf_tables expr type 2668 * @type: expr type 2669 * 2670 * Registers the expr type for use with nf_tables. Returns zero on 2671 * success or a negative errno code otherwise. 2672 */ 2673 int nft_register_expr(struct nft_expr_type *type) 2674 { 2675 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2676 if (type->family == NFPROTO_UNSPEC) 2677 list_add_tail_rcu(&type->list, &nf_tables_expressions); 2678 else 2679 list_add_rcu(&type->list, &nf_tables_expressions); 2680 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2681 return 0; 2682 } 2683 EXPORT_SYMBOL_GPL(nft_register_expr); 2684 2685 /** 2686 * nft_unregister_expr - unregister nf_tables expr type 2687 * @type: expr type 2688 * 2689 * Unregisters the expr typefor use with nf_tables. 2690 */ 2691 void nft_unregister_expr(struct nft_expr_type *type) 2692 { 2693 nfnl_lock(NFNL_SUBSYS_NFTABLES); 2694 list_del_rcu(&type->list); 2695 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 2696 } 2697 EXPORT_SYMBOL_GPL(nft_unregister_expr); 2698 2699 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 2700 struct nlattr *nla) 2701 { 2702 const struct nft_expr_type *type, *candidate = NULL; 2703 2704 list_for_each_entry(type, &nf_tables_expressions, list) { 2705 if (!nla_strcmp(nla, type->name)) { 2706 if (!type->family && !candidate) 2707 candidate = type; 2708 else if (type->family == family) 2709 candidate = type; 2710 } 2711 } 2712 return candidate; 2713 } 2714 2715 #ifdef CONFIG_MODULES 2716 static int nft_expr_type_request_module(struct net *net, u8 family, 2717 struct nlattr *nla) 2718 { 2719 if (nft_request_module(net, "nft-expr-%u-%.*s", family, 2720 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN) 2721 return -EAGAIN; 2722 2723 return 0; 2724 } 2725 #endif 2726 2727 static const struct nft_expr_type *nft_expr_type_get(struct net *net, 2728 u8 family, 2729 struct nlattr *nla) 2730 { 2731 const struct nft_expr_type *type; 2732 2733 if (nla == NULL) 2734 return ERR_PTR(-EINVAL); 2735 2736 type = __nft_expr_type_get(family, nla); 2737 if (type != NULL && try_module_get(type->owner)) 2738 return type; 2739 2740 lockdep_nfnl_nft_mutex_not_held(); 2741 #ifdef CONFIG_MODULES 2742 if (type == NULL) { 2743 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN) 2744 return ERR_PTR(-EAGAIN); 2745 2746 if (nft_request_module(net, "nft-expr-%.*s", 2747 nla_len(nla), 2748 (char *)nla_data(nla)) == -EAGAIN) 2749 return ERR_PTR(-EAGAIN); 2750 } 2751 #endif 2752 return ERR_PTR(-ENOENT); 2753 } 2754 2755 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 2756 [NFTA_EXPR_NAME] = { .type = NLA_STRING, 2757 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 2758 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 2759 }; 2760 2761 static int nf_tables_fill_expr_info(struct sk_buff *skb, 2762 const struct nft_expr *expr, bool reset) 2763 { 2764 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 2765 goto nla_put_failure; 2766 2767 if (expr->ops->dump) { 2768 struct nlattr *data = nla_nest_start_noflag(skb, 2769 NFTA_EXPR_DATA); 2770 if (data == NULL) 2771 goto nla_put_failure; 2772 if (expr->ops->dump(skb, expr, reset) < 0) 2773 goto nla_put_failure; 2774 nla_nest_end(skb, data); 2775 } 2776 2777 return skb->len; 2778 2779 nla_put_failure: 2780 return -1; 2781 }; 2782 2783 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 2784 const struct nft_expr *expr, bool reset) 2785 { 2786 struct nlattr *nest; 2787 2788 nest = nla_nest_start_noflag(skb, attr); 2789 if (!nest) 2790 goto nla_put_failure; 2791 if (nf_tables_fill_expr_info(skb, expr, reset) < 0) 2792 goto nla_put_failure; 2793 nla_nest_end(skb, nest); 2794 return 0; 2795 2796 nla_put_failure: 2797 return -1; 2798 } 2799 2800 struct nft_expr_info { 2801 const struct nft_expr_ops *ops; 2802 const struct nlattr *attr; 2803 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 2804 }; 2805 2806 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 2807 const struct nlattr *nla, 2808 struct nft_expr_info *info) 2809 { 2810 const struct nft_expr_type *type; 2811 const struct nft_expr_ops *ops; 2812 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 2813 int err; 2814 2815 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 2816 nft_expr_policy, NULL); 2817 if (err < 0) 2818 return err; 2819 2820 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]); 2821 if (IS_ERR(type)) 2822 return PTR_ERR(type); 2823 2824 if (tb[NFTA_EXPR_DATA]) { 2825 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 2826 tb[NFTA_EXPR_DATA], 2827 type->policy, NULL); 2828 if (err < 0) 2829 goto err1; 2830 } else 2831 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 2832 2833 if (type->select_ops != NULL) { 2834 ops = type->select_ops(ctx, 2835 (const struct nlattr * const *)info->tb); 2836 if (IS_ERR(ops)) { 2837 err = PTR_ERR(ops); 2838 #ifdef CONFIG_MODULES 2839 if (err == -EAGAIN) 2840 if (nft_expr_type_request_module(ctx->net, 2841 ctx->family, 2842 tb[NFTA_EXPR_NAME]) != -EAGAIN) 2843 err = -ENOENT; 2844 #endif 2845 goto err1; 2846 } 2847 } else 2848 ops = type->ops; 2849 2850 info->attr = nla; 2851 info->ops = ops; 2852 2853 return 0; 2854 2855 err1: 2856 module_put(type->owner); 2857 return err; 2858 } 2859 2860 int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, 2861 struct nft_expr_info *info) 2862 { 2863 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 2864 const struct nft_expr_type *type; 2865 int err; 2866 2867 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 2868 nft_expr_policy, NULL); 2869 if (err < 0) 2870 return err; 2871 2872 if (!tb[NFTA_EXPR_DATA]) 2873 return -EINVAL; 2874 2875 type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); 2876 if (!type) 2877 return -ENOENT; 2878 2879 if (!type->inner_ops) 2880 return -EOPNOTSUPP; 2881 2882 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 2883 tb[NFTA_EXPR_DATA], 2884 type->policy, NULL); 2885 if (err < 0) 2886 goto err_nla_parse; 2887 2888 info->attr = nla; 2889 info->ops = type->inner_ops; 2890 2891 return 0; 2892 2893 err_nla_parse: 2894 return err; 2895 } 2896 2897 static int nf_tables_newexpr(const struct nft_ctx *ctx, 2898 const struct nft_expr_info *expr_info, 2899 struct nft_expr *expr) 2900 { 2901 const struct nft_expr_ops *ops = expr_info->ops; 2902 int err; 2903 2904 expr->ops = ops; 2905 if (ops->init) { 2906 err = ops->init(ctx, expr, (const struct nlattr **)expr_info->tb); 2907 if (err < 0) 2908 goto err1; 2909 } 2910 2911 return 0; 2912 err1: 2913 expr->ops = NULL; 2914 return err; 2915 } 2916 2917 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 2918 struct nft_expr *expr) 2919 { 2920 const struct nft_expr_type *type = expr->ops->type; 2921 2922 if (expr->ops->destroy) 2923 expr->ops->destroy(ctx, expr); 2924 module_put(type->owner); 2925 } 2926 2927 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 2928 const struct nlattr *nla) 2929 { 2930 struct nft_expr_info expr_info; 2931 struct nft_expr *expr; 2932 struct module *owner; 2933 int err; 2934 2935 err = nf_tables_expr_parse(ctx, nla, &expr_info); 2936 if (err < 0) 2937 goto err_expr_parse; 2938 2939 err = -EOPNOTSUPP; 2940 if (!(expr_info.ops->type->flags & NFT_EXPR_STATEFUL)) 2941 goto err_expr_stateful; 2942 2943 err = -ENOMEM; 2944 expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT); 2945 if (expr == NULL) 2946 goto err_expr_stateful; 2947 2948 err = nf_tables_newexpr(ctx, &expr_info, expr); 2949 if (err < 0) 2950 goto err_expr_new; 2951 2952 return expr; 2953 err_expr_new: 2954 kfree(expr); 2955 err_expr_stateful: 2956 owner = expr_info.ops->type->owner; 2957 if (expr_info.ops->type->release_ops) 2958 expr_info.ops->type->release_ops(expr_info.ops); 2959 2960 module_put(owner); 2961 err_expr_parse: 2962 return ERR_PTR(err); 2963 } 2964 2965 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) 2966 { 2967 int err; 2968 2969 if (src->ops->clone) { 2970 dst->ops = src->ops; 2971 err = src->ops->clone(dst, src); 2972 if (err < 0) 2973 return err; 2974 } else { 2975 memcpy(dst, src, src->ops->size); 2976 } 2977 2978 __module_get(src->ops->type->owner); 2979 2980 return 0; 2981 } 2982 2983 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 2984 { 2985 nf_tables_expr_destroy(ctx, expr); 2986 kfree(expr); 2987 } 2988 2989 /* 2990 * Rules 2991 */ 2992 2993 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain, 2994 u64 handle) 2995 { 2996 struct nft_rule *rule; 2997 2998 // FIXME: this sucks 2999 list_for_each_entry_rcu(rule, &chain->rules, list) { 3000 if (handle == rule->handle) 3001 return rule; 3002 } 3003 3004 return ERR_PTR(-ENOENT); 3005 } 3006 3007 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain, 3008 const struct nlattr *nla) 3009 { 3010 if (nla == NULL) 3011 return ERR_PTR(-EINVAL); 3012 3013 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla))); 3014 } 3015 3016 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 3017 [NFTA_RULE_TABLE] = { .type = NLA_STRING, 3018 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3019 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 3020 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 3021 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 3022 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED }, 3023 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 3024 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 3025 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 3026 .len = NFT_USERDATA_MAXLEN }, 3027 [NFTA_RULE_ID] = { .type = NLA_U32 }, 3028 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 }, 3029 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 }, 3030 }; 3031 3032 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 3033 u32 portid, u32 seq, int event, 3034 u32 flags, int family, 3035 const struct nft_table *table, 3036 const struct nft_chain *chain, 3037 const struct nft_rule *rule, u64 handle, 3038 bool reset) 3039 { 3040 struct nlmsghdr *nlh; 3041 const struct nft_expr *expr, *next; 3042 struct nlattr *list; 3043 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 3044 3045 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, 3046 nft_base_seq(net)); 3047 if (!nlh) 3048 goto nla_put_failure; 3049 3050 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 3051 goto nla_put_failure; 3052 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 3053 goto nla_put_failure; 3054 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle), 3055 NFTA_RULE_PAD)) 3056 goto nla_put_failure; 3057 3058 if (event != NFT_MSG_DELRULE && handle) { 3059 if (nla_put_be64(skb, NFTA_RULE_POSITION, cpu_to_be64(handle), 3060 NFTA_RULE_PAD)) 3061 goto nla_put_failure; 3062 } 3063 3064 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 3065 nft_flow_rule_stats(chain, rule); 3066 3067 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS); 3068 if (list == NULL) 3069 goto nla_put_failure; 3070 nft_rule_for_each_expr(expr, next, rule) { 3071 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 3072 goto nla_put_failure; 3073 } 3074 nla_nest_end(skb, list); 3075 3076 if (rule->udata) { 3077 struct nft_userdata *udata = nft_userdata(rule); 3078 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 3079 udata->data) < 0) 3080 goto nla_put_failure; 3081 } 3082 3083 nlmsg_end(skb, nlh); 3084 return 0; 3085 3086 nla_put_failure: 3087 nlmsg_trim(skb, nlh); 3088 return -1; 3089 } 3090 3091 static void nf_tables_rule_notify(const struct nft_ctx *ctx, 3092 const struct nft_rule *rule, int event) 3093 { 3094 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3095 const struct nft_rule *prule; 3096 struct sk_buff *skb; 3097 u64 handle = 0; 3098 u16 flags = 0; 3099 int err; 3100 3101 if (!ctx->report && 3102 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 3103 return; 3104 3105 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3106 if (skb == NULL) 3107 goto err; 3108 3109 if (event == NFT_MSG_NEWRULE && 3110 !list_is_first(&rule->list, &ctx->chain->rules) && 3111 !list_is_last(&rule->list, &ctx->chain->rules)) { 3112 prule = list_prev_entry(rule, list); 3113 handle = prule->handle; 3114 } 3115 if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) 3116 flags |= NLM_F_APPEND; 3117 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 3118 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 3119 3120 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 3121 event, flags, ctx->family, ctx->table, 3122 ctx->chain, rule, handle, false); 3123 if (err < 0) { 3124 kfree_skb(skb); 3125 goto err; 3126 } 3127 3128 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 3129 return; 3130 err: 3131 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 3132 } 3133 3134 struct nft_rule_dump_ctx { 3135 char *table; 3136 char *chain; 3137 }; 3138 3139 static int __nf_tables_dump_rules(struct sk_buff *skb, 3140 unsigned int *idx, 3141 struct netlink_callback *cb, 3142 const struct nft_table *table, 3143 const struct nft_chain *chain, 3144 bool reset) 3145 { 3146 struct net *net = sock_net(skb->sk); 3147 const struct nft_rule *rule, *prule; 3148 unsigned int s_idx = cb->args[0]; 3149 u64 handle; 3150 3151 prule = NULL; 3152 list_for_each_entry_rcu(rule, &chain->rules, list) { 3153 if (!nft_is_active(net, rule)) 3154 goto cont_skip; 3155 if (*idx < s_idx) 3156 goto cont; 3157 if (*idx > s_idx) { 3158 memset(&cb->args[1], 0, 3159 sizeof(cb->args) - sizeof(cb->args[0])); 3160 } 3161 if (prule) 3162 handle = prule->handle; 3163 else 3164 handle = 0; 3165 3166 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 3167 cb->nlh->nlmsg_seq, 3168 NFT_MSG_NEWRULE, 3169 NLM_F_MULTI | NLM_F_APPEND, 3170 table->family, 3171 table, chain, rule, handle, reset) < 0) 3172 return 1; 3173 3174 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 3175 cont: 3176 prule = rule; 3177 cont_skip: 3178 (*idx)++; 3179 } 3180 return 0; 3181 } 3182 3183 static int nf_tables_dump_rules(struct sk_buff *skb, 3184 struct netlink_callback *cb) 3185 { 3186 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3187 const struct nft_rule_dump_ctx *ctx = cb->data; 3188 struct nft_table *table; 3189 const struct nft_chain *chain; 3190 unsigned int idx = 0; 3191 struct net *net = sock_net(skb->sk); 3192 int family = nfmsg->nfgen_family; 3193 struct nftables_pernet *nft_net; 3194 bool reset = false; 3195 3196 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3197 reset = true; 3198 3199 rcu_read_lock(); 3200 nft_net = nft_pernet(net); 3201 cb->seq = READ_ONCE(nft_net->base_seq); 3202 3203 list_for_each_entry_rcu(table, &nft_net->tables, list) { 3204 if (family != NFPROTO_UNSPEC && family != table->family) 3205 continue; 3206 3207 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0) 3208 continue; 3209 3210 if (ctx && ctx->table && ctx->chain) { 3211 struct rhlist_head *list, *tmp; 3212 3213 list = rhltable_lookup(&table->chains_ht, ctx->chain, 3214 nft_chain_ht_params); 3215 if (!list) 3216 goto done; 3217 3218 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 3219 if (!nft_is_active(net, chain)) 3220 continue; 3221 __nf_tables_dump_rules(skb, &idx, 3222 cb, table, chain, reset); 3223 break; 3224 } 3225 goto done; 3226 } 3227 3228 list_for_each_entry_rcu(chain, &table->chains, list) { 3229 if (__nf_tables_dump_rules(skb, &idx, 3230 cb, table, chain, reset)) 3231 goto done; 3232 } 3233 3234 if (ctx && ctx->table) 3235 break; 3236 } 3237 done: 3238 rcu_read_unlock(); 3239 3240 cb->args[0] = idx; 3241 return skb->len; 3242 } 3243 3244 static int nf_tables_dump_rules_start(struct netlink_callback *cb) 3245 { 3246 const struct nlattr * const *nla = cb->data; 3247 struct nft_rule_dump_ctx *ctx = NULL; 3248 3249 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) { 3250 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC); 3251 if (!ctx) 3252 return -ENOMEM; 3253 3254 if (nla[NFTA_RULE_TABLE]) { 3255 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE], 3256 GFP_ATOMIC); 3257 if (!ctx->table) { 3258 kfree(ctx); 3259 return -ENOMEM; 3260 } 3261 } 3262 if (nla[NFTA_RULE_CHAIN]) { 3263 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN], 3264 GFP_ATOMIC); 3265 if (!ctx->chain) { 3266 kfree(ctx->table); 3267 kfree(ctx); 3268 return -ENOMEM; 3269 } 3270 } 3271 } 3272 3273 cb->data = ctx; 3274 return 0; 3275 } 3276 3277 static int nf_tables_dump_rules_done(struct netlink_callback *cb) 3278 { 3279 struct nft_rule_dump_ctx *ctx = cb->data; 3280 3281 if (ctx) { 3282 kfree(ctx->table); 3283 kfree(ctx->chain); 3284 kfree(ctx); 3285 } 3286 return 0; 3287 } 3288 3289 /* called with rcu_read_lock held */ 3290 static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, 3291 const struct nlattr * const nla[]) 3292 { 3293 struct netlink_ext_ack *extack = info->extack; 3294 u8 genmask = nft_genmask_cur(info->net); 3295 u8 family = info->nfmsg->nfgen_family; 3296 const struct nft_chain *chain; 3297 const struct nft_rule *rule; 3298 struct net *net = info->net; 3299 struct nft_table *table; 3300 struct sk_buff *skb2; 3301 bool reset = false; 3302 int err; 3303 3304 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3305 struct netlink_dump_control c = { 3306 .start= nf_tables_dump_rules_start, 3307 .dump = nf_tables_dump_rules, 3308 .done = nf_tables_dump_rules_done, 3309 .module = THIS_MODULE, 3310 .data = (void *)nla, 3311 }; 3312 3313 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 3314 } 3315 3316 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0); 3317 if (IS_ERR(table)) { 3318 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3319 return PTR_ERR(table); 3320 } 3321 3322 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask); 3323 if (IS_ERR(chain)) { 3324 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3325 return PTR_ERR(chain); 3326 } 3327 3328 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 3329 if (IS_ERR(rule)) { 3330 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3331 return PTR_ERR(rule); 3332 } 3333 3334 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 3335 if (!skb2) 3336 return -ENOMEM; 3337 3338 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET) 3339 reset = true; 3340 3341 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid, 3342 info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 3343 family, table, chain, rule, 0, reset); 3344 if (err < 0) 3345 goto err_fill_rule_info; 3346 3347 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 3348 3349 err_fill_rule_info: 3350 kfree_skb(skb2); 3351 return err; 3352 } 3353 3354 static void nf_tables_rule_destroy(const struct nft_ctx *ctx, 3355 struct nft_rule *rule) 3356 { 3357 struct nft_expr *expr, *next; 3358 3359 /* 3360 * Careful: some expressions might not be initialized in case this 3361 * is called on error from nf_tables_newrule(). 3362 */ 3363 expr = nft_expr_first(rule); 3364 while (nft_expr_more(rule, expr)) { 3365 next = nft_expr_next(expr); 3366 nf_tables_expr_destroy(ctx, expr); 3367 expr = next; 3368 } 3369 kfree(rule); 3370 } 3371 3372 void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) 3373 { 3374 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); 3375 nf_tables_rule_destroy(ctx, rule); 3376 } 3377 3378 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) 3379 { 3380 struct nft_expr *expr, *last; 3381 const struct nft_data *data; 3382 struct nft_rule *rule; 3383 int err; 3384 3385 if (ctx->level == NFT_JUMP_STACK_SIZE) 3386 return -EMLINK; 3387 3388 list_for_each_entry(rule, &chain->rules, list) { 3389 if (!nft_is_active_next(ctx->net, rule)) 3390 continue; 3391 3392 nft_rule_for_each_expr(expr, last, rule) { 3393 if (!expr->ops->validate) 3394 continue; 3395 3396 err = expr->ops->validate(ctx, expr, &data); 3397 if (err < 0) 3398 return err; 3399 } 3400 3401 cond_resched(); 3402 } 3403 3404 return 0; 3405 } 3406 EXPORT_SYMBOL_GPL(nft_chain_validate); 3407 3408 static int nft_table_validate(struct net *net, const struct nft_table *table) 3409 { 3410 struct nft_chain *chain; 3411 struct nft_ctx ctx = { 3412 .net = net, 3413 .family = table->family, 3414 }; 3415 int err; 3416 3417 list_for_each_entry(chain, &table->chains, list) { 3418 if (!nft_is_base_chain(chain)) 3419 continue; 3420 3421 ctx.chain = chain; 3422 err = nft_chain_validate(&ctx, chain); 3423 if (err < 0) 3424 return err; 3425 } 3426 3427 return 0; 3428 } 3429 3430 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 3431 const struct nft_chain *chain, 3432 const struct nlattr *nla); 3433 3434 #define NFT_RULE_MAXEXPRS 128 3435 3436 static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 3437 const struct nlattr * const nla[]) 3438 { 3439 struct nftables_pernet *nft_net = nft_pernet(info->net); 3440 struct netlink_ext_ack *extack = info->extack; 3441 unsigned int size, i, n, ulen = 0, usize = 0; 3442 u8 genmask = nft_genmask_next(info->net); 3443 struct nft_rule *rule, *old_rule = NULL; 3444 struct nft_expr_info *expr_info = NULL; 3445 u8 family = info->nfmsg->nfgen_family; 3446 struct nft_flow_rule *flow = NULL; 3447 struct net *net = info->net; 3448 struct nft_userdata *udata; 3449 struct nft_table *table; 3450 struct nft_chain *chain; 3451 struct nft_trans *trans; 3452 u64 handle, pos_handle; 3453 struct nft_expr *expr; 3454 struct nft_ctx ctx; 3455 struct nlattr *tmp; 3456 int err, rem; 3457 3458 lockdep_assert_held(&nft_net->commit_mutex); 3459 3460 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 3461 NETLINK_CB(skb).portid); 3462 if (IS_ERR(table)) { 3463 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3464 return PTR_ERR(table); 3465 } 3466 3467 if (nla[NFTA_RULE_CHAIN]) { 3468 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 3469 genmask); 3470 if (IS_ERR(chain)) { 3471 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3472 return PTR_ERR(chain); 3473 } 3474 if (nft_chain_is_bound(chain)) 3475 return -EOPNOTSUPP; 3476 3477 } else if (nla[NFTA_RULE_CHAIN_ID]) { 3478 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID]); 3479 if (IS_ERR(chain)) { 3480 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]); 3481 return PTR_ERR(chain); 3482 } 3483 } else { 3484 return -EINVAL; 3485 } 3486 3487 if (nla[NFTA_RULE_HANDLE]) { 3488 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 3489 rule = __nft_rule_lookup(chain, handle); 3490 if (IS_ERR(rule)) { 3491 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3492 return PTR_ERR(rule); 3493 } 3494 3495 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 3496 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3497 return -EEXIST; 3498 } 3499 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 3500 old_rule = rule; 3501 else 3502 return -EOPNOTSUPP; 3503 } else { 3504 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE) || 3505 info->nlh->nlmsg_flags & NLM_F_REPLACE) 3506 return -EINVAL; 3507 handle = nf_tables_alloc_handle(table); 3508 3509 if (chain->use == UINT_MAX) 3510 return -EOVERFLOW; 3511 3512 if (nla[NFTA_RULE_POSITION]) { 3513 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 3514 old_rule = __nft_rule_lookup(chain, pos_handle); 3515 if (IS_ERR(old_rule)) { 3516 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); 3517 return PTR_ERR(old_rule); 3518 } 3519 } else if (nla[NFTA_RULE_POSITION_ID]) { 3520 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]); 3521 if (IS_ERR(old_rule)) { 3522 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); 3523 return PTR_ERR(old_rule); 3524 } 3525 } 3526 } 3527 3528 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3529 3530 n = 0; 3531 size = 0; 3532 if (nla[NFTA_RULE_EXPRESSIONS]) { 3533 expr_info = kvmalloc_array(NFT_RULE_MAXEXPRS, 3534 sizeof(struct nft_expr_info), 3535 GFP_KERNEL); 3536 if (!expr_info) 3537 return -ENOMEM; 3538 3539 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 3540 err = -EINVAL; 3541 if (nla_type(tmp) != NFTA_LIST_ELEM) 3542 goto err_release_expr; 3543 if (n == NFT_RULE_MAXEXPRS) 3544 goto err_release_expr; 3545 err = nf_tables_expr_parse(&ctx, tmp, &expr_info[n]); 3546 if (err < 0) { 3547 NL_SET_BAD_ATTR(extack, tmp); 3548 goto err_release_expr; 3549 } 3550 size += expr_info[n].ops->size; 3551 n++; 3552 } 3553 } 3554 /* Check for overflow of dlen field */ 3555 err = -EFBIG; 3556 if (size >= 1 << 12) 3557 goto err_release_expr; 3558 3559 if (nla[NFTA_RULE_USERDATA]) { 3560 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 3561 if (ulen > 0) 3562 usize = sizeof(struct nft_userdata) + ulen; 3563 } 3564 3565 err = -ENOMEM; 3566 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT); 3567 if (rule == NULL) 3568 goto err_release_expr; 3569 3570 nft_activate_next(net, rule); 3571 3572 rule->handle = handle; 3573 rule->dlen = size; 3574 rule->udata = ulen ? 1 : 0; 3575 3576 if (ulen) { 3577 udata = nft_userdata(rule); 3578 udata->len = ulen - 1; 3579 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 3580 } 3581 3582 expr = nft_expr_first(rule); 3583 for (i = 0; i < n; i++) { 3584 err = nf_tables_newexpr(&ctx, &expr_info[i], expr); 3585 if (err < 0) { 3586 NL_SET_BAD_ATTR(extack, expr_info[i].attr); 3587 goto err_release_rule; 3588 } 3589 3590 if (expr_info[i].ops->validate) 3591 nft_validate_state_update(net, NFT_VALIDATE_NEED); 3592 3593 expr_info[i].ops = NULL; 3594 expr = nft_expr_next(expr); 3595 } 3596 3597 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { 3598 flow = nft_flow_rule_create(net, rule); 3599 if (IS_ERR(flow)) { 3600 err = PTR_ERR(flow); 3601 goto err_release_rule; 3602 } 3603 } 3604 3605 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) { 3606 err = nft_delrule(&ctx, old_rule); 3607 if (err < 0) 3608 goto err_destroy_flow_rule; 3609 3610 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 3611 if (trans == NULL) { 3612 err = -ENOMEM; 3613 goto err_destroy_flow_rule; 3614 } 3615 list_add_tail_rcu(&rule->list, &old_rule->list); 3616 } else { 3617 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 3618 if (!trans) { 3619 err = -ENOMEM; 3620 goto err_destroy_flow_rule; 3621 } 3622 3623 if (info->nlh->nlmsg_flags & NLM_F_APPEND) { 3624 if (old_rule) 3625 list_add_rcu(&rule->list, &old_rule->list); 3626 else 3627 list_add_tail_rcu(&rule->list, &chain->rules); 3628 } else { 3629 if (old_rule) 3630 list_add_tail_rcu(&rule->list, &old_rule->list); 3631 else 3632 list_add_rcu(&rule->list, &chain->rules); 3633 } 3634 } 3635 kvfree(expr_info); 3636 chain->use++; 3637 3638 if (flow) 3639 nft_trans_flow_rule(trans) = flow; 3640 3641 if (nft_net->validate_state == NFT_VALIDATE_DO) 3642 return nft_table_validate(net, table); 3643 3644 return 0; 3645 3646 err_destroy_flow_rule: 3647 if (flow) 3648 nft_flow_rule_destroy(flow); 3649 err_release_rule: 3650 nf_tables_rule_release(&ctx, rule); 3651 err_release_expr: 3652 for (i = 0; i < n; i++) { 3653 if (expr_info[i].ops) { 3654 module_put(expr_info[i].ops->type->owner); 3655 if (expr_info[i].ops->type->release_ops) 3656 expr_info[i].ops->type->release_ops(expr_info[i].ops); 3657 } 3658 } 3659 kvfree(expr_info); 3660 3661 return err; 3662 } 3663 3664 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 3665 const struct nft_chain *chain, 3666 const struct nlattr *nla) 3667 { 3668 struct nftables_pernet *nft_net = nft_pernet(net); 3669 u32 id = ntohl(nla_get_be32(nla)); 3670 struct nft_trans *trans; 3671 3672 list_for_each_entry(trans, &nft_net->commit_list, list) { 3673 struct nft_rule *rule = nft_trans_rule(trans); 3674 3675 if (trans->msg_type == NFT_MSG_NEWRULE && 3676 trans->ctx.chain == chain && 3677 id == nft_trans_rule_id(trans)) 3678 return rule; 3679 } 3680 return ERR_PTR(-ENOENT); 3681 } 3682 3683 static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 3684 const struct nlattr * const nla[]) 3685 { 3686 struct netlink_ext_ack *extack = info->extack; 3687 u8 genmask = nft_genmask_next(info->net); 3688 u8 family = info->nfmsg->nfgen_family; 3689 struct nft_chain *chain = NULL; 3690 struct net *net = info->net; 3691 struct nft_table *table; 3692 struct nft_rule *rule; 3693 struct nft_ctx ctx; 3694 int err = 0; 3695 3696 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 3697 NETLINK_CB(skb).portid); 3698 if (IS_ERR(table)) { 3699 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3700 return PTR_ERR(table); 3701 } 3702 3703 if (nla[NFTA_RULE_CHAIN]) { 3704 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 3705 genmask); 3706 if (IS_ERR(chain)) { 3707 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3708 return PTR_ERR(chain); 3709 } 3710 if (nft_chain_is_bound(chain)) 3711 return -EOPNOTSUPP; 3712 } 3713 3714 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3715 3716 if (chain) { 3717 if (nla[NFTA_RULE_HANDLE]) { 3718 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); 3719 if (IS_ERR(rule)) { 3720 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3721 return PTR_ERR(rule); 3722 } 3723 3724 err = nft_delrule(&ctx, rule); 3725 } else if (nla[NFTA_RULE_ID]) { 3726 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); 3727 if (IS_ERR(rule)) { 3728 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); 3729 return PTR_ERR(rule); 3730 } 3731 3732 err = nft_delrule(&ctx, rule); 3733 } else { 3734 err = nft_delrule_by_chain(&ctx); 3735 } 3736 } else { 3737 list_for_each_entry(chain, &table->chains, list) { 3738 if (!nft_is_active_next(net, chain)) 3739 continue; 3740 3741 ctx.chain = chain; 3742 err = nft_delrule_by_chain(&ctx); 3743 if (err < 0) 3744 break; 3745 } 3746 } 3747 3748 return err; 3749 } 3750 3751 /* 3752 * Sets 3753 */ 3754 static const struct nft_set_type *nft_set_types[] = { 3755 &nft_set_hash_fast_type, 3756 &nft_set_hash_type, 3757 &nft_set_rhash_type, 3758 &nft_set_bitmap_type, 3759 &nft_set_rbtree_type, 3760 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML) 3761 &nft_set_pipapo_avx2_type, 3762 #endif 3763 &nft_set_pipapo_type, 3764 }; 3765 3766 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ 3767 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \ 3768 NFT_SET_EVAL) 3769 3770 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags) 3771 { 3772 return (flags & type->features) == (flags & NFT_SET_FEATURES); 3773 } 3774 3775 /* 3776 * Select a set implementation based on the data characteristics and the 3777 * given policy. The total memory use might not be known if no size is 3778 * given, in that case the amount of memory per element is used. 3779 */ 3780 static const struct nft_set_ops * 3781 nft_select_set_ops(const struct nft_ctx *ctx, 3782 const struct nlattr * const nla[], 3783 const struct nft_set_desc *desc, 3784 enum nft_set_policies policy) 3785 { 3786 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3787 const struct nft_set_ops *ops, *bops; 3788 struct nft_set_estimate est, best; 3789 const struct nft_set_type *type; 3790 u32 flags = 0; 3791 int i; 3792 3793 lockdep_assert_held(&nft_net->commit_mutex); 3794 lockdep_nfnl_nft_mutex_not_held(); 3795 3796 if (nla[NFTA_SET_FLAGS] != NULL) 3797 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 3798 3799 bops = NULL; 3800 best.size = ~0; 3801 best.lookup = ~0; 3802 best.space = ~0; 3803 3804 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) { 3805 type = nft_set_types[i]; 3806 ops = &type->ops; 3807 3808 if (!nft_set_ops_candidate(type, flags)) 3809 continue; 3810 if (!ops->estimate(desc, flags, &est)) 3811 continue; 3812 3813 switch (policy) { 3814 case NFT_SET_POL_PERFORMANCE: 3815 if (est.lookup < best.lookup) 3816 break; 3817 if (est.lookup == best.lookup && 3818 est.space < best.space) 3819 break; 3820 continue; 3821 case NFT_SET_POL_MEMORY: 3822 if (!desc->size) { 3823 if (est.space < best.space) 3824 break; 3825 if (est.space == best.space && 3826 est.lookup < best.lookup) 3827 break; 3828 } else if (est.size < best.size || !bops) { 3829 break; 3830 } 3831 continue; 3832 default: 3833 break; 3834 } 3835 3836 bops = ops; 3837 best = est; 3838 } 3839 3840 if (bops != NULL) 3841 return bops; 3842 3843 return ERR_PTR(-EOPNOTSUPP); 3844 } 3845 3846 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 3847 [NFTA_SET_TABLE] = { .type = NLA_STRING, 3848 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3849 [NFTA_SET_NAME] = { .type = NLA_STRING, 3850 .len = NFT_SET_MAXNAMELEN - 1 }, 3851 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 3852 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 3853 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 3854 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 3855 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 3856 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 3857 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 3858 [NFTA_SET_ID] = { .type = NLA_U32 }, 3859 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 3860 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 3861 [NFTA_SET_USERDATA] = { .type = NLA_BINARY, 3862 .len = NFT_USERDATA_MAXLEN }, 3863 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, 3864 [NFTA_SET_HANDLE] = { .type = NLA_U64 }, 3865 [NFTA_SET_EXPR] = { .type = NLA_NESTED }, 3866 [NFTA_SET_EXPRESSIONS] = { .type = NLA_NESTED }, 3867 }; 3868 3869 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 3870 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 3871 [NFTA_SET_DESC_CONCAT] = { .type = NLA_NESTED }, 3872 }; 3873 3874 static struct nft_set *nft_set_lookup(const struct nft_table *table, 3875 const struct nlattr *nla, u8 genmask) 3876 { 3877 struct nft_set *set; 3878 3879 if (nla == NULL) 3880 return ERR_PTR(-EINVAL); 3881 3882 list_for_each_entry_rcu(set, &table->sets, list) { 3883 if (!nla_strcmp(nla, set->name) && 3884 nft_active_genmask(set, genmask)) 3885 return set; 3886 } 3887 return ERR_PTR(-ENOENT); 3888 } 3889 3890 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, 3891 const struct nlattr *nla, 3892 u8 genmask) 3893 { 3894 struct nft_set *set; 3895 3896 list_for_each_entry(set, &table->sets, list) { 3897 if (be64_to_cpu(nla_get_be64(nla)) == set->handle && 3898 nft_active_genmask(set, genmask)) 3899 return set; 3900 } 3901 return ERR_PTR(-ENOENT); 3902 } 3903 3904 static struct nft_set *nft_set_lookup_byid(const struct net *net, 3905 const struct nft_table *table, 3906 const struct nlattr *nla, u8 genmask) 3907 { 3908 struct nftables_pernet *nft_net = nft_pernet(net); 3909 u32 id = ntohl(nla_get_be32(nla)); 3910 struct nft_trans *trans; 3911 3912 list_for_each_entry(trans, &nft_net->commit_list, list) { 3913 if (trans->msg_type == NFT_MSG_NEWSET) { 3914 struct nft_set *set = nft_trans_set(trans); 3915 3916 if (id == nft_trans_set_id(trans) && 3917 set->table == table && 3918 nft_active_genmask(set, genmask)) 3919 return set; 3920 } 3921 } 3922 return ERR_PTR(-ENOENT); 3923 } 3924 3925 struct nft_set *nft_set_lookup_global(const struct net *net, 3926 const struct nft_table *table, 3927 const struct nlattr *nla_set_name, 3928 const struct nlattr *nla_set_id, 3929 u8 genmask) 3930 { 3931 struct nft_set *set; 3932 3933 set = nft_set_lookup(table, nla_set_name, genmask); 3934 if (IS_ERR(set)) { 3935 if (!nla_set_id) 3936 return set; 3937 3938 set = nft_set_lookup_byid(net, table, nla_set_id, genmask); 3939 } 3940 return set; 3941 } 3942 EXPORT_SYMBOL_GPL(nft_set_lookup_global); 3943 3944 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 3945 const char *name) 3946 { 3947 const struct nft_set *i; 3948 const char *p; 3949 unsigned long *inuse; 3950 unsigned int n = 0, min = 0; 3951 3952 p = strchr(name, '%'); 3953 if (p != NULL) { 3954 if (p[1] != 'd' || strchr(p + 2, '%')) 3955 return -EINVAL; 3956 3957 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 3958 if (inuse == NULL) 3959 return -ENOMEM; 3960 cont: 3961 list_for_each_entry(i, &ctx->table->sets, list) { 3962 int tmp; 3963 3964 if (!nft_is_active_next(ctx->net, i)) 3965 continue; 3966 if (!sscanf(i->name, name, &tmp)) 3967 continue; 3968 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 3969 continue; 3970 3971 set_bit(tmp - min, inuse); 3972 } 3973 3974 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 3975 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 3976 min += BITS_PER_BYTE * PAGE_SIZE; 3977 memset(inuse, 0, PAGE_SIZE); 3978 goto cont; 3979 } 3980 free_page((unsigned long)inuse); 3981 } 3982 3983 set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n); 3984 if (!set->name) 3985 return -ENOMEM; 3986 3987 list_for_each_entry(i, &ctx->table->sets, list) { 3988 if (!nft_is_active_next(ctx->net, i)) 3989 continue; 3990 if (!strcmp(set->name, i->name)) { 3991 kfree(set->name); 3992 set->name = NULL; 3993 return -ENFILE; 3994 } 3995 } 3996 return 0; 3997 } 3998 3999 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) 4000 { 4001 u64 ms = be64_to_cpu(nla_get_be64(nla)); 4002 u64 max = (u64)(~((u64)0)); 4003 4004 max = div_u64(max, NSEC_PER_MSEC); 4005 if (ms >= max) 4006 return -ERANGE; 4007 4008 ms *= NSEC_PER_MSEC; 4009 *result = nsecs_to_jiffies64(ms); 4010 return 0; 4011 } 4012 4013 __be64 nf_jiffies64_to_msecs(u64 input) 4014 { 4015 return cpu_to_be64(jiffies64_to_msecs(input)); 4016 } 4017 4018 static int nf_tables_fill_set_concat(struct sk_buff *skb, 4019 const struct nft_set *set) 4020 { 4021 struct nlattr *concat, *field; 4022 int i; 4023 4024 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT); 4025 if (!concat) 4026 return -ENOMEM; 4027 4028 for (i = 0; i < set->field_count; i++) { 4029 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 4030 if (!field) 4031 return -ENOMEM; 4032 4033 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN, 4034 htonl(set->field_len[i]))) 4035 return -ENOMEM; 4036 4037 nla_nest_end(skb, field); 4038 } 4039 4040 nla_nest_end(skb, concat); 4041 4042 return 0; 4043 } 4044 4045 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 4046 const struct nft_set *set, u16 event, u16 flags) 4047 { 4048 struct nlmsghdr *nlh; 4049 u32 portid = ctx->portid; 4050 struct nlattr *nest; 4051 u32 seq = ctx->seq; 4052 int i; 4053 4054 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 4055 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 4056 NFNETLINK_V0, nft_base_seq(ctx->net)); 4057 if (!nlh) 4058 goto nla_put_failure; 4059 4060 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 4061 goto nla_put_failure; 4062 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 4063 goto nla_put_failure; 4064 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), 4065 NFTA_SET_PAD)) 4066 goto nla_put_failure; 4067 if (set->flags != 0) 4068 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 4069 goto nla_put_failure; 4070 4071 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 4072 goto nla_put_failure; 4073 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 4074 goto nla_put_failure; 4075 if (set->flags & NFT_SET_MAP) { 4076 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 4077 goto nla_put_failure; 4078 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 4079 goto nla_put_failure; 4080 } 4081 if (set->flags & NFT_SET_OBJECT && 4082 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype))) 4083 goto nla_put_failure; 4084 4085 if (set->timeout && 4086 nla_put_be64(skb, NFTA_SET_TIMEOUT, 4087 nf_jiffies64_to_msecs(set->timeout), 4088 NFTA_SET_PAD)) 4089 goto nla_put_failure; 4090 if (set->gc_int && 4091 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int))) 4092 goto nla_put_failure; 4093 4094 if (set->policy != NFT_SET_POL_PERFORMANCE) { 4095 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 4096 goto nla_put_failure; 4097 } 4098 4099 if (set->udata && 4100 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) 4101 goto nla_put_failure; 4102 4103 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC); 4104 if (!nest) 4105 goto nla_put_failure; 4106 if (set->size && 4107 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size))) 4108 goto nla_put_failure; 4109 4110 if (set->field_count > 1 && 4111 nf_tables_fill_set_concat(skb, set)) 4112 goto nla_put_failure; 4113 4114 nla_nest_end(skb, nest); 4115 4116 if (set->num_exprs == 1) { 4117 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR); 4118 if (nf_tables_fill_expr_info(skb, set->exprs[0], false) < 0) 4119 goto nla_put_failure; 4120 4121 nla_nest_end(skb, nest); 4122 } else if (set->num_exprs > 1) { 4123 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPRESSIONS); 4124 if (nest == NULL) 4125 goto nla_put_failure; 4126 4127 for (i = 0; i < set->num_exprs; i++) { 4128 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 4129 set->exprs[i], false) < 0) 4130 goto nla_put_failure; 4131 } 4132 nla_nest_end(skb, nest); 4133 } 4134 4135 nlmsg_end(skb, nlh); 4136 return 0; 4137 4138 nla_put_failure: 4139 nlmsg_trim(skb, nlh); 4140 return -1; 4141 } 4142 4143 static void nf_tables_set_notify(const struct nft_ctx *ctx, 4144 const struct nft_set *set, int event, 4145 gfp_t gfp_flags) 4146 { 4147 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4148 u32 portid = ctx->portid; 4149 struct sk_buff *skb; 4150 u16 flags = 0; 4151 int err; 4152 4153 if (!ctx->report && 4154 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 4155 return; 4156 4157 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 4158 if (skb == NULL) 4159 goto err; 4160 4161 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 4162 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 4163 4164 err = nf_tables_fill_set(skb, ctx, set, event, flags); 4165 if (err < 0) { 4166 kfree_skb(skb); 4167 goto err; 4168 } 4169 4170 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 4171 return; 4172 err: 4173 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 4174 } 4175 4176 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 4177 { 4178 const struct nft_set *set; 4179 unsigned int idx, s_idx = cb->args[0]; 4180 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 4181 struct net *net = sock_net(skb->sk); 4182 struct nft_ctx *ctx = cb->data, ctx_set; 4183 struct nftables_pernet *nft_net; 4184 4185 if (cb->args[1]) 4186 return skb->len; 4187 4188 rcu_read_lock(); 4189 nft_net = nft_pernet(net); 4190 cb->seq = READ_ONCE(nft_net->base_seq); 4191 4192 list_for_each_entry_rcu(table, &nft_net->tables, list) { 4193 if (ctx->family != NFPROTO_UNSPEC && 4194 ctx->family != table->family) 4195 continue; 4196 4197 if (ctx->table && ctx->table != table) 4198 continue; 4199 4200 if (cur_table) { 4201 if (cur_table != table) 4202 continue; 4203 4204 cur_table = NULL; 4205 } 4206 idx = 0; 4207 list_for_each_entry_rcu(set, &table->sets, list) { 4208 if (idx < s_idx) 4209 goto cont; 4210 if (!nft_is_active(net, set)) 4211 goto cont; 4212 4213 ctx_set = *ctx; 4214 ctx_set.table = table; 4215 ctx_set.family = table->family; 4216 4217 if (nf_tables_fill_set(skb, &ctx_set, set, 4218 NFT_MSG_NEWSET, 4219 NLM_F_MULTI) < 0) { 4220 cb->args[0] = idx; 4221 cb->args[2] = (unsigned long) table; 4222 goto done; 4223 } 4224 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 4225 cont: 4226 idx++; 4227 } 4228 if (s_idx) 4229 s_idx = 0; 4230 } 4231 cb->args[1] = 1; 4232 done: 4233 rcu_read_unlock(); 4234 return skb->len; 4235 } 4236 4237 static int nf_tables_dump_sets_start(struct netlink_callback *cb) 4238 { 4239 struct nft_ctx *ctx_dump = NULL; 4240 4241 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC); 4242 if (ctx_dump == NULL) 4243 return -ENOMEM; 4244 4245 cb->data = ctx_dump; 4246 return 0; 4247 } 4248 4249 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 4250 { 4251 kfree(cb->data); 4252 return 0; 4253 } 4254 4255 /* called with rcu_read_lock held */ 4256 static int nf_tables_getset(struct sk_buff *skb, const struct nfnl_info *info, 4257 const struct nlattr * const nla[]) 4258 { 4259 struct netlink_ext_ack *extack = info->extack; 4260 u8 genmask = nft_genmask_cur(info->net); 4261 u8 family = info->nfmsg->nfgen_family; 4262 struct nft_table *table = NULL; 4263 struct net *net = info->net; 4264 const struct nft_set *set; 4265 struct sk_buff *skb2; 4266 struct nft_ctx ctx; 4267 int err; 4268 4269 if (nla[NFTA_SET_TABLE]) { 4270 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 4271 genmask, 0); 4272 if (IS_ERR(table)) { 4273 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4274 return PTR_ERR(table); 4275 } 4276 } 4277 4278 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4279 4280 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 4281 struct netlink_dump_control c = { 4282 .start = nf_tables_dump_sets_start, 4283 .dump = nf_tables_dump_sets, 4284 .done = nf_tables_dump_sets_done, 4285 .data = &ctx, 4286 .module = THIS_MODULE, 4287 }; 4288 4289 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4290 } 4291 4292 /* Only accept unspec with dump */ 4293 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 4294 return -EAFNOSUPPORT; 4295 if (!nla[NFTA_SET_TABLE]) 4296 return -EINVAL; 4297 4298 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 4299 if (IS_ERR(set)) 4300 return PTR_ERR(set); 4301 4302 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 4303 if (skb2 == NULL) 4304 return -ENOMEM; 4305 4306 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 4307 if (err < 0) 4308 goto err_fill_set_info; 4309 4310 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 4311 4312 err_fill_set_info: 4313 kfree_skb(skb2); 4314 return err; 4315 } 4316 4317 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = { 4318 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 }, 4319 }; 4320 4321 static int nft_set_desc_concat_parse(const struct nlattr *attr, 4322 struct nft_set_desc *desc) 4323 { 4324 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1]; 4325 u32 len; 4326 int err; 4327 4328 if (desc->field_count >= ARRAY_SIZE(desc->field_len)) 4329 return -E2BIG; 4330 4331 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, 4332 nft_concat_policy, NULL); 4333 if (err < 0) 4334 return err; 4335 4336 if (!tb[NFTA_SET_FIELD_LEN]) 4337 return -EINVAL; 4338 4339 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); 4340 if (!len || len > U8_MAX) 4341 return -EINVAL; 4342 4343 desc->field_len[desc->field_count++] = len; 4344 4345 return 0; 4346 } 4347 4348 static int nft_set_desc_concat(struct nft_set_desc *desc, 4349 const struct nlattr *nla) 4350 { 4351 struct nlattr *attr; 4352 u32 num_regs = 0; 4353 int rem, err, i; 4354 4355 nla_for_each_nested(attr, nla, rem) { 4356 if (nla_type(attr) != NFTA_LIST_ELEM) 4357 return -EINVAL; 4358 4359 err = nft_set_desc_concat_parse(attr, desc); 4360 if (err < 0) 4361 return err; 4362 } 4363 4364 for (i = 0; i < desc->field_count; i++) 4365 num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); 4366 4367 if (num_regs > NFT_REG32_COUNT) 4368 return -E2BIG; 4369 4370 return 0; 4371 } 4372 4373 static int nf_tables_set_desc_parse(struct nft_set_desc *desc, 4374 const struct nlattr *nla) 4375 { 4376 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 4377 int err; 4378 4379 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla, 4380 nft_set_desc_policy, NULL); 4381 if (err < 0) 4382 return err; 4383 4384 if (da[NFTA_SET_DESC_SIZE] != NULL) 4385 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 4386 if (da[NFTA_SET_DESC_CONCAT]) 4387 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]); 4388 4389 return err; 4390 } 4391 4392 static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 4393 const struct nlattr * const nla[]) 4394 { 4395 u32 ktype, dtype, flags, policy, gc_int, objtype; 4396 struct netlink_ext_ack *extack = info->extack; 4397 u8 genmask = nft_genmask_next(info->net); 4398 u8 family = info->nfmsg->nfgen_family; 4399 const struct nft_set_ops *ops; 4400 struct nft_expr *expr = NULL; 4401 struct net *net = info->net; 4402 struct nft_set_desc desc; 4403 struct nft_table *table; 4404 unsigned char *udata; 4405 struct nft_set *set; 4406 struct nft_ctx ctx; 4407 size_t alloc_size; 4408 u64 timeout; 4409 char *name; 4410 int err, i; 4411 u16 udlen; 4412 u64 size; 4413 4414 if (nla[NFTA_SET_TABLE] == NULL || 4415 nla[NFTA_SET_NAME] == NULL || 4416 nla[NFTA_SET_KEY_LEN] == NULL || 4417 nla[NFTA_SET_ID] == NULL) 4418 return -EINVAL; 4419 4420 memset(&desc, 0, sizeof(desc)); 4421 4422 ktype = NFT_DATA_VALUE; 4423 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 4424 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 4425 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 4426 return -EINVAL; 4427 } 4428 4429 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 4430 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 4431 return -EINVAL; 4432 4433 flags = 0; 4434 if (nla[NFTA_SET_FLAGS] != NULL) { 4435 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 4436 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 4437 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 4438 NFT_SET_MAP | NFT_SET_EVAL | 4439 NFT_SET_OBJECT | NFT_SET_CONCAT | NFT_SET_EXPR)) 4440 return -EOPNOTSUPP; 4441 /* Only one of these operations is supported */ 4442 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) == 4443 (NFT_SET_MAP | NFT_SET_OBJECT)) 4444 return -EOPNOTSUPP; 4445 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == 4446 (NFT_SET_EVAL | NFT_SET_OBJECT)) 4447 return -EOPNOTSUPP; 4448 } 4449 4450 dtype = 0; 4451 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 4452 if (!(flags & NFT_SET_MAP)) 4453 return -EINVAL; 4454 4455 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 4456 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 4457 dtype != NFT_DATA_VERDICT) 4458 return -EINVAL; 4459 4460 if (dtype != NFT_DATA_VERDICT) { 4461 if (nla[NFTA_SET_DATA_LEN] == NULL) 4462 return -EINVAL; 4463 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 4464 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 4465 return -EINVAL; 4466 } else 4467 desc.dlen = sizeof(struct nft_verdict); 4468 } else if (flags & NFT_SET_MAP) 4469 return -EINVAL; 4470 4471 if (nla[NFTA_SET_OBJ_TYPE] != NULL) { 4472 if (!(flags & NFT_SET_OBJECT)) 4473 return -EINVAL; 4474 4475 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE])); 4476 if (objtype == NFT_OBJECT_UNSPEC || 4477 objtype > NFT_OBJECT_MAX) 4478 return -EOPNOTSUPP; 4479 } else if (flags & NFT_SET_OBJECT) 4480 return -EINVAL; 4481 else 4482 objtype = NFT_OBJECT_UNSPEC; 4483 4484 timeout = 0; 4485 if (nla[NFTA_SET_TIMEOUT] != NULL) { 4486 if (!(flags & NFT_SET_TIMEOUT)) 4487 return -EINVAL; 4488 4489 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout); 4490 if (err) 4491 return err; 4492 } 4493 gc_int = 0; 4494 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 4495 if (!(flags & NFT_SET_TIMEOUT)) 4496 return -EINVAL; 4497 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 4498 } 4499 4500 policy = NFT_SET_POL_PERFORMANCE; 4501 if (nla[NFTA_SET_POLICY] != NULL) 4502 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 4503 4504 if (nla[NFTA_SET_DESC] != NULL) { 4505 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); 4506 if (err < 0) 4507 return err; 4508 4509 if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT)) 4510 return -EINVAL; 4511 } else if (flags & NFT_SET_CONCAT) { 4512 return -EINVAL; 4513 } 4514 4515 if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS]) 4516 desc.expr = true; 4517 4518 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask, 4519 NETLINK_CB(skb).portid); 4520 if (IS_ERR(table)) { 4521 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4522 return PTR_ERR(table); 4523 } 4524 4525 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4526 4527 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask); 4528 if (IS_ERR(set)) { 4529 if (PTR_ERR(set) != -ENOENT) { 4530 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4531 return PTR_ERR(set); 4532 } 4533 } else { 4534 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 4535 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 4536 return -EEXIST; 4537 } 4538 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 4539 return -EOPNOTSUPP; 4540 4541 return 0; 4542 } 4543 4544 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE)) 4545 return -ENOENT; 4546 4547 ops = nft_select_set_ops(&ctx, nla, &desc, policy); 4548 if (IS_ERR(ops)) 4549 return PTR_ERR(ops); 4550 4551 udlen = 0; 4552 if (nla[NFTA_SET_USERDATA]) 4553 udlen = nla_len(nla[NFTA_SET_USERDATA]); 4554 4555 size = 0; 4556 if (ops->privsize != NULL) 4557 size = ops->privsize(nla, &desc); 4558 alloc_size = sizeof(*set) + size + udlen; 4559 if (alloc_size < size || alloc_size > INT_MAX) 4560 return -ENOMEM; 4561 set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT); 4562 if (!set) 4563 return -ENOMEM; 4564 4565 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT); 4566 if (!name) { 4567 err = -ENOMEM; 4568 goto err_set_name; 4569 } 4570 4571 err = nf_tables_set_alloc_name(&ctx, set, name); 4572 kfree(name); 4573 if (err < 0) 4574 goto err_set_name; 4575 4576 udata = NULL; 4577 if (udlen) { 4578 udata = set->data + size; 4579 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen); 4580 } 4581 4582 INIT_LIST_HEAD(&set->bindings); 4583 INIT_LIST_HEAD(&set->catchall_list); 4584 set->table = table; 4585 write_pnet(&set->net, net); 4586 set->ops = ops; 4587 set->ktype = ktype; 4588 set->klen = desc.klen; 4589 set->dtype = dtype; 4590 set->objtype = objtype; 4591 set->dlen = desc.dlen; 4592 set->flags = flags; 4593 set->size = desc.size; 4594 set->policy = policy; 4595 set->udlen = udlen; 4596 set->udata = udata; 4597 set->timeout = timeout; 4598 set->gc_int = gc_int; 4599 4600 set->field_count = desc.field_count; 4601 for (i = 0; i < desc.field_count; i++) 4602 set->field_len[i] = desc.field_len[i]; 4603 4604 err = ops->init(set, &desc, nla); 4605 if (err < 0) 4606 goto err_set_init; 4607 4608 if (nla[NFTA_SET_EXPR]) { 4609 expr = nft_set_elem_expr_alloc(&ctx, set, nla[NFTA_SET_EXPR]); 4610 if (IS_ERR(expr)) { 4611 err = PTR_ERR(expr); 4612 goto err_set_expr_alloc; 4613 } 4614 set->exprs[0] = expr; 4615 set->num_exprs++; 4616 } else if (nla[NFTA_SET_EXPRESSIONS]) { 4617 struct nft_expr *expr; 4618 struct nlattr *tmp; 4619 int left; 4620 4621 if (!(flags & NFT_SET_EXPR)) { 4622 err = -EINVAL; 4623 goto err_set_expr_alloc; 4624 } 4625 i = 0; 4626 nla_for_each_nested(tmp, nla[NFTA_SET_EXPRESSIONS], left) { 4627 if (i == NFT_SET_EXPR_MAX) { 4628 err = -E2BIG; 4629 goto err_set_expr_alloc; 4630 } 4631 if (nla_type(tmp) != NFTA_LIST_ELEM) { 4632 err = -EINVAL; 4633 goto err_set_expr_alloc; 4634 } 4635 expr = nft_set_elem_expr_alloc(&ctx, set, tmp); 4636 if (IS_ERR(expr)) { 4637 err = PTR_ERR(expr); 4638 goto err_set_expr_alloc; 4639 } 4640 set->exprs[i++] = expr; 4641 set->num_exprs++; 4642 } 4643 } 4644 4645 set->handle = nf_tables_alloc_handle(table); 4646 4647 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 4648 if (err < 0) 4649 goto err_set_expr_alloc; 4650 4651 list_add_tail_rcu(&set->list, &table->sets); 4652 table->use++; 4653 return 0; 4654 4655 err_set_expr_alloc: 4656 for (i = 0; i < set->num_exprs; i++) 4657 nft_expr_destroy(&ctx, set->exprs[i]); 4658 4659 ops->destroy(set); 4660 err_set_init: 4661 kfree(set->name); 4662 err_set_name: 4663 kvfree(set); 4664 return err; 4665 } 4666 4667 struct nft_set_elem_catchall { 4668 struct list_head list; 4669 struct rcu_head rcu; 4670 void *elem; 4671 }; 4672 4673 static void nft_set_catchall_destroy(const struct nft_ctx *ctx, 4674 struct nft_set *set) 4675 { 4676 struct nft_set_elem_catchall *next, *catchall; 4677 4678 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 4679 list_del_rcu(&catchall->list); 4680 nft_set_elem_destroy(set, catchall->elem, true); 4681 kfree_rcu(catchall, rcu); 4682 } 4683 } 4684 4685 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 4686 { 4687 int i; 4688 4689 if (WARN_ON(set->use > 0)) 4690 return; 4691 4692 for (i = 0; i < set->num_exprs; i++) 4693 nft_expr_destroy(ctx, set->exprs[i]); 4694 4695 set->ops->destroy(set); 4696 nft_set_catchall_destroy(ctx, set); 4697 kfree(set->name); 4698 kvfree(set); 4699 } 4700 4701 static int nf_tables_delset(struct sk_buff *skb, const struct nfnl_info *info, 4702 const struct nlattr * const nla[]) 4703 { 4704 struct netlink_ext_ack *extack = info->extack; 4705 u8 genmask = nft_genmask_next(info->net); 4706 u8 family = info->nfmsg->nfgen_family; 4707 struct net *net = info->net; 4708 const struct nlattr *attr; 4709 struct nft_table *table; 4710 struct nft_set *set; 4711 struct nft_ctx ctx; 4712 4713 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 4714 return -EAFNOSUPPORT; 4715 4716 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 4717 genmask, NETLINK_CB(skb).portid); 4718 if (IS_ERR(table)) { 4719 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 4720 return PTR_ERR(table); 4721 } 4722 4723 if (nla[NFTA_SET_HANDLE]) { 4724 attr = nla[NFTA_SET_HANDLE]; 4725 set = nft_set_lookup_byhandle(table, attr, genmask); 4726 } else { 4727 attr = nla[NFTA_SET_NAME]; 4728 set = nft_set_lookup(table, attr, genmask); 4729 } 4730 4731 if (IS_ERR(set)) { 4732 NL_SET_BAD_ATTR(extack, attr); 4733 return PTR_ERR(set); 4734 } 4735 if (set->use || 4736 (info->nlh->nlmsg_flags & NLM_F_NONREC && 4737 atomic_read(&set->nelems) > 0)) { 4738 NL_SET_BAD_ATTR(extack, attr); 4739 return -EBUSY; 4740 } 4741 4742 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 4743 4744 return nft_delset(&ctx, set); 4745 } 4746 4747 static int nft_validate_register_store(const struct nft_ctx *ctx, 4748 enum nft_registers reg, 4749 const struct nft_data *data, 4750 enum nft_data_types type, 4751 unsigned int len); 4752 4753 static int nft_setelem_data_validate(const struct nft_ctx *ctx, 4754 struct nft_set *set, 4755 struct nft_set_elem *elem) 4756 { 4757 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 4758 enum nft_registers dreg; 4759 4760 dreg = nft_type_to_reg(set->dtype); 4761 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 4762 set->dtype == NFT_DATA_VERDICT ? 4763 NFT_DATA_VERDICT : NFT_DATA_VALUE, 4764 set->dlen); 4765 } 4766 4767 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 4768 struct nft_set *set, 4769 const struct nft_set_iter *iter, 4770 struct nft_set_elem *elem) 4771 { 4772 return nft_setelem_data_validate(ctx, set, elem); 4773 } 4774 4775 static int nft_set_catchall_bind_check(const struct nft_ctx *ctx, 4776 struct nft_set *set) 4777 { 4778 u8 genmask = nft_genmask_next(ctx->net); 4779 struct nft_set_elem_catchall *catchall; 4780 struct nft_set_elem elem; 4781 struct nft_set_ext *ext; 4782 int ret = 0; 4783 4784 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 4785 ext = nft_set_elem_ext(set, catchall->elem); 4786 if (!nft_set_elem_active(ext, genmask)) 4787 continue; 4788 4789 elem.priv = catchall->elem; 4790 ret = nft_setelem_data_validate(ctx, set, &elem); 4791 if (ret < 0) 4792 break; 4793 } 4794 4795 return ret; 4796 } 4797 4798 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 4799 struct nft_set_binding *binding) 4800 { 4801 struct nft_set_binding *i; 4802 struct nft_set_iter iter; 4803 4804 if (set->use == UINT_MAX) 4805 return -EOVERFLOW; 4806 4807 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set)) 4808 return -EBUSY; 4809 4810 if (binding->flags & NFT_SET_MAP) { 4811 /* If the set is already bound to the same chain all 4812 * jumps are already validated for that chain. 4813 */ 4814 list_for_each_entry(i, &set->bindings, list) { 4815 if (i->flags & NFT_SET_MAP && 4816 i->chain == binding->chain) 4817 goto bind; 4818 } 4819 4820 iter.genmask = nft_genmask_next(ctx->net); 4821 iter.skip = 0; 4822 iter.count = 0; 4823 iter.err = 0; 4824 iter.fn = nf_tables_bind_check_setelem; 4825 4826 set->ops->walk(ctx, set, &iter); 4827 if (!iter.err) 4828 iter.err = nft_set_catchall_bind_check(ctx, set); 4829 4830 if (iter.err < 0) 4831 return iter.err; 4832 } 4833 bind: 4834 binding->chain = ctx->chain; 4835 list_add_tail_rcu(&binding->list, &set->bindings); 4836 nft_set_trans_bind(ctx, set); 4837 set->use++; 4838 4839 return 0; 4840 } 4841 EXPORT_SYMBOL_GPL(nf_tables_bind_set); 4842 4843 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 4844 struct nft_set_binding *binding, bool event) 4845 { 4846 list_del_rcu(&binding->list); 4847 4848 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { 4849 list_del_rcu(&set->list); 4850 if (event) 4851 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, 4852 GFP_KERNEL); 4853 } 4854 } 4855 4856 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, 4857 struct nft_set_binding *binding, 4858 enum nft_trans_phase phase) 4859 { 4860 switch (phase) { 4861 case NFT_TRANS_PREPARE: 4862 set->use--; 4863 return; 4864 case NFT_TRANS_ABORT: 4865 case NFT_TRANS_RELEASE: 4866 set->use--; 4867 fallthrough; 4868 default: 4869 nf_tables_unbind_set(ctx, set, binding, 4870 phase == NFT_TRANS_COMMIT); 4871 } 4872 } 4873 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set); 4874 4875 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set) 4876 { 4877 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) 4878 nft_set_destroy(ctx, set); 4879 } 4880 EXPORT_SYMBOL_GPL(nf_tables_destroy_set); 4881 4882 const struct nft_set_ext_type nft_set_ext_types[] = { 4883 [NFT_SET_EXT_KEY] = { 4884 .align = __alignof__(u32), 4885 }, 4886 [NFT_SET_EXT_DATA] = { 4887 .align = __alignof__(u32), 4888 }, 4889 [NFT_SET_EXT_EXPRESSIONS] = { 4890 .align = __alignof__(struct nft_set_elem_expr), 4891 }, 4892 [NFT_SET_EXT_OBJREF] = { 4893 .len = sizeof(struct nft_object *), 4894 .align = __alignof__(struct nft_object *), 4895 }, 4896 [NFT_SET_EXT_FLAGS] = { 4897 .len = sizeof(u8), 4898 .align = __alignof__(u8), 4899 }, 4900 [NFT_SET_EXT_TIMEOUT] = { 4901 .len = sizeof(u64), 4902 .align = __alignof__(u64), 4903 }, 4904 [NFT_SET_EXT_EXPIRATION] = { 4905 .len = sizeof(u64), 4906 .align = __alignof__(u64), 4907 }, 4908 [NFT_SET_EXT_USERDATA] = { 4909 .len = sizeof(struct nft_userdata), 4910 .align = __alignof__(struct nft_userdata), 4911 }, 4912 [NFT_SET_EXT_KEY_END] = { 4913 .align = __alignof__(u32), 4914 }, 4915 }; 4916 4917 /* 4918 * Set elements 4919 */ 4920 4921 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 4922 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 4923 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 4924 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 4925 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 4926 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 }, 4927 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 4928 .len = NFT_USERDATA_MAXLEN }, 4929 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, 4930 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING, 4931 .len = NFT_OBJ_MAXNAMELEN - 1 }, 4932 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED }, 4933 [NFTA_SET_ELEM_EXPRESSIONS] = { .type = NLA_NESTED }, 4934 }; 4935 4936 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 4937 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING, 4938 .len = NFT_TABLE_MAXNAMELEN - 1 }, 4939 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING, 4940 .len = NFT_SET_MAXNAMELEN - 1 }, 4941 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED }, 4942 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 4943 }; 4944 4945 static int nft_set_elem_expr_dump(struct sk_buff *skb, 4946 const struct nft_set *set, 4947 const struct nft_set_ext *ext) 4948 { 4949 struct nft_set_elem_expr *elem_expr; 4950 u32 size, num_exprs = 0; 4951 struct nft_expr *expr; 4952 struct nlattr *nest; 4953 4954 elem_expr = nft_set_ext_expr(ext); 4955 nft_setelem_expr_foreach(expr, elem_expr, size) 4956 num_exprs++; 4957 4958 if (num_exprs == 1) { 4959 expr = nft_setelem_expr_at(elem_expr, 0); 4960 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, false) < 0) 4961 return -1; 4962 4963 return 0; 4964 } else if (num_exprs > 1) { 4965 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_EXPRESSIONS); 4966 if (nest == NULL) 4967 goto nla_put_failure; 4968 4969 nft_setelem_expr_foreach(expr, elem_expr, size) { 4970 expr = nft_setelem_expr_at(elem_expr, size); 4971 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, false) < 0) 4972 goto nla_put_failure; 4973 } 4974 nla_nest_end(skb, nest); 4975 } 4976 return 0; 4977 4978 nla_put_failure: 4979 return -1; 4980 } 4981 4982 static int nf_tables_fill_setelem(struct sk_buff *skb, 4983 const struct nft_set *set, 4984 const struct nft_set_elem *elem) 4985 { 4986 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 4987 unsigned char *b = skb_tail_pointer(skb); 4988 struct nlattr *nest; 4989 4990 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 4991 if (nest == NULL) 4992 goto nla_put_failure; 4993 4994 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 4995 nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 4996 NFT_DATA_VALUE, set->klen) < 0) 4997 goto nla_put_failure; 4998 4999 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 5000 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext), 5001 NFT_DATA_VALUE, set->klen) < 0) 5002 goto nla_put_failure; 5003 5004 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 5005 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 5006 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, 5007 set->dlen) < 0) 5008 goto nla_put_failure; 5009 5010 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && 5011 nft_set_elem_expr_dump(skb, set, ext)) 5012 goto nla_put_failure; 5013 5014 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 5015 nla_put_string(skb, NFTA_SET_ELEM_OBJREF, 5016 (*nft_set_ext_obj(ext))->key.name) < 0) 5017 goto nla_put_failure; 5018 5019 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 5020 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 5021 htonl(*nft_set_ext_flags(ext)))) 5022 goto nla_put_failure; 5023 5024 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) && 5025 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, 5026 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)), 5027 NFTA_SET_ELEM_PAD)) 5028 goto nla_put_failure; 5029 5030 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 5031 u64 expires, now = get_jiffies_64(); 5032 5033 expires = *nft_set_ext_expiration(ext); 5034 if (time_before64(now, expires)) 5035 expires -= now; 5036 else 5037 expires = 0; 5038 5039 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 5040 nf_jiffies64_to_msecs(expires), 5041 NFTA_SET_ELEM_PAD)) 5042 goto nla_put_failure; 5043 } 5044 5045 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 5046 struct nft_userdata *udata; 5047 5048 udata = nft_set_ext_userdata(ext); 5049 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 5050 udata->len + 1, udata->data)) 5051 goto nla_put_failure; 5052 } 5053 5054 nla_nest_end(skb, nest); 5055 return 0; 5056 5057 nla_put_failure: 5058 nlmsg_trim(skb, b); 5059 return -EMSGSIZE; 5060 } 5061 5062 struct nft_set_dump_args { 5063 const struct netlink_callback *cb; 5064 struct nft_set_iter iter; 5065 struct sk_buff *skb; 5066 }; 5067 5068 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 5069 struct nft_set *set, 5070 const struct nft_set_iter *iter, 5071 struct nft_set_elem *elem) 5072 { 5073 struct nft_set_dump_args *args; 5074 5075 args = container_of(iter, struct nft_set_dump_args, iter); 5076 return nf_tables_fill_setelem(args->skb, set, elem); 5077 } 5078 5079 struct nft_set_dump_ctx { 5080 const struct nft_set *set; 5081 struct nft_ctx ctx; 5082 }; 5083 5084 static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb, 5085 const struct nft_set *set) 5086 { 5087 struct nft_set_elem_catchall *catchall; 5088 u8 genmask = nft_genmask_cur(net); 5089 struct nft_set_elem elem; 5090 struct nft_set_ext *ext; 5091 int ret = 0; 5092 5093 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5094 ext = nft_set_elem_ext(set, catchall->elem); 5095 if (!nft_set_elem_active(ext, genmask) || 5096 nft_set_elem_expired(ext)) 5097 continue; 5098 5099 elem.priv = catchall->elem; 5100 ret = nf_tables_fill_setelem(skb, set, &elem); 5101 break; 5102 } 5103 5104 return ret; 5105 } 5106 5107 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 5108 { 5109 struct nft_set_dump_ctx *dump_ctx = cb->data; 5110 struct net *net = sock_net(skb->sk); 5111 struct nftables_pernet *nft_net; 5112 struct nft_table *table; 5113 struct nft_set *set; 5114 struct nft_set_dump_args args; 5115 bool set_found = false; 5116 struct nlmsghdr *nlh; 5117 struct nlattr *nest; 5118 u32 portid, seq; 5119 int event; 5120 5121 rcu_read_lock(); 5122 nft_net = nft_pernet(net); 5123 cb->seq = READ_ONCE(nft_net->base_seq); 5124 5125 list_for_each_entry_rcu(table, &nft_net->tables, list) { 5126 if (dump_ctx->ctx.family != NFPROTO_UNSPEC && 5127 dump_ctx->ctx.family != table->family) 5128 continue; 5129 5130 if (table != dump_ctx->ctx.table) 5131 continue; 5132 5133 list_for_each_entry_rcu(set, &table->sets, list) { 5134 if (set == dump_ctx->set) { 5135 set_found = true; 5136 break; 5137 } 5138 } 5139 break; 5140 } 5141 5142 if (!set_found) { 5143 rcu_read_unlock(); 5144 return -ENOENT; 5145 } 5146 5147 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM); 5148 portid = NETLINK_CB(cb->skb).portid; 5149 seq = cb->nlh->nlmsg_seq; 5150 5151 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, 5152 table->family, NFNETLINK_V0, nft_base_seq(net)); 5153 if (!nlh) 5154 goto nla_put_failure; 5155 5156 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) 5157 goto nla_put_failure; 5158 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 5159 goto nla_put_failure; 5160 5161 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5162 if (nest == NULL) 5163 goto nla_put_failure; 5164 5165 args.cb = cb; 5166 args.skb = skb; 5167 args.iter.genmask = nft_genmask_cur(net); 5168 args.iter.skip = cb->args[0]; 5169 args.iter.count = 0; 5170 args.iter.err = 0; 5171 args.iter.fn = nf_tables_dump_setelem; 5172 set->ops->walk(&dump_ctx->ctx, set, &args.iter); 5173 5174 if (!args.iter.err && args.iter.count == cb->args[0]) 5175 args.iter.err = nft_set_catchall_dump(net, skb, set); 5176 rcu_read_unlock(); 5177 5178 nla_nest_end(skb, nest); 5179 nlmsg_end(skb, nlh); 5180 5181 if (args.iter.err && args.iter.err != -EMSGSIZE) 5182 return args.iter.err; 5183 if (args.iter.count == cb->args[0]) 5184 return 0; 5185 5186 cb->args[0] = args.iter.count; 5187 return skb->len; 5188 5189 nla_put_failure: 5190 rcu_read_unlock(); 5191 return -ENOSPC; 5192 } 5193 5194 static int nf_tables_dump_set_start(struct netlink_callback *cb) 5195 { 5196 struct nft_set_dump_ctx *dump_ctx = cb->data; 5197 5198 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC); 5199 5200 return cb->data ? 0 : -ENOMEM; 5201 } 5202 5203 static int nf_tables_dump_set_done(struct netlink_callback *cb) 5204 { 5205 kfree(cb->data); 5206 return 0; 5207 } 5208 5209 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 5210 const struct nft_ctx *ctx, u32 seq, 5211 u32 portid, int event, u16 flags, 5212 const struct nft_set *set, 5213 const struct nft_set_elem *elem) 5214 { 5215 struct nlmsghdr *nlh; 5216 struct nlattr *nest; 5217 int err; 5218 5219 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 5220 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 5221 NFNETLINK_V0, nft_base_seq(ctx->net)); 5222 if (!nlh) 5223 goto nla_put_failure; 5224 5225 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 5226 goto nla_put_failure; 5227 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 5228 goto nla_put_failure; 5229 5230 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 5231 if (nest == NULL) 5232 goto nla_put_failure; 5233 5234 err = nf_tables_fill_setelem(skb, set, elem); 5235 if (err < 0) 5236 goto nla_put_failure; 5237 5238 nla_nest_end(skb, nest); 5239 5240 nlmsg_end(skb, nlh); 5241 return 0; 5242 5243 nla_put_failure: 5244 nlmsg_trim(skb, nlh); 5245 return -1; 5246 } 5247 5248 static int nft_setelem_parse_flags(const struct nft_set *set, 5249 const struct nlattr *attr, u32 *flags) 5250 { 5251 if (attr == NULL) 5252 return 0; 5253 5254 *flags = ntohl(nla_get_be32(attr)); 5255 if (*flags & ~(NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5256 return -EOPNOTSUPP; 5257 if (!(set->flags & NFT_SET_INTERVAL) && 5258 *flags & NFT_SET_ELEM_INTERVAL_END) 5259 return -EINVAL; 5260 if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == 5261 (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 5262 return -EINVAL; 5263 5264 return 0; 5265 } 5266 5267 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set, 5268 struct nft_data *key, struct nlattr *attr) 5269 { 5270 struct nft_data_desc desc = { 5271 .type = NFT_DATA_VALUE, 5272 .size = NFT_DATA_VALUE_MAXLEN, 5273 .len = set->klen, 5274 }; 5275 5276 return nft_data_init(ctx, key, &desc, attr); 5277 } 5278 5279 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, 5280 struct nft_data_desc *desc, 5281 struct nft_data *data, 5282 struct nlattr *attr) 5283 { 5284 u32 dtype; 5285 5286 if (set->dtype == NFT_DATA_VERDICT) 5287 dtype = NFT_DATA_VERDICT; 5288 else 5289 dtype = NFT_DATA_VALUE; 5290 5291 desc->type = dtype; 5292 desc->size = NFT_DATA_VALUE_MAXLEN; 5293 desc->len = set->dlen; 5294 desc->flags = NFT_DATA_DESC_SETELEM; 5295 5296 return nft_data_init(ctx, data, desc, attr); 5297 } 5298 5299 static void *nft_setelem_catchall_get(const struct net *net, 5300 const struct nft_set *set) 5301 { 5302 struct nft_set_elem_catchall *catchall; 5303 u8 genmask = nft_genmask_cur(net); 5304 struct nft_set_ext *ext; 5305 void *priv = NULL; 5306 5307 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5308 ext = nft_set_elem_ext(set, catchall->elem); 5309 if (!nft_set_elem_active(ext, genmask) || 5310 nft_set_elem_expired(ext)) 5311 continue; 5312 5313 priv = catchall->elem; 5314 break; 5315 } 5316 5317 return priv; 5318 } 5319 5320 static int nft_setelem_get(struct nft_ctx *ctx, struct nft_set *set, 5321 struct nft_set_elem *elem, u32 flags) 5322 { 5323 void *priv; 5324 5325 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 5326 priv = set->ops->get(ctx->net, set, elem, flags); 5327 if (IS_ERR(priv)) 5328 return PTR_ERR(priv); 5329 } else { 5330 priv = nft_setelem_catchall_get(ctx->net, set); 5331 if (!priv) 5332 return -ENOENT; 5333 } 5334 elem->priv = priv; 5335 5336 return 0; 5337 } 5338 5339 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, 5340 const struct nlattr *attr) 5341 { 5342 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 5343 struct nft_set_elem elem; 5344 struct sk_buff *skb; 5345 uint32_t flags = 0; 5346 int err; 5347 5348 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 5349 nft_set_elem_policy, NULL); 5350 if (err < 0) 5351 return err; 5352 5353 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 5354 if (err < 0) 5355 return err; 5356 5357 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 5358 return -EINVAL; 5359 5360 if (nla[NFTA_SET_ELEM_KEY]) { 5361 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 5362 nla[NFTA_SET_ELEM_KEY]); 5363 if (err < 0) 5364 return err; 5365 } 5366 5367 if (nla[NFTA_SET_ELEM_KEY_END]) { 5368 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 5369 nla[NFTA_SET_ELEM_KEY_END]); 5370 if (err < 0) 5371 return err; 5372 } 5373 5374 err = nft_setelem_get(ctx, set, &elem, flags); 5375 if (err < 0) 5376 return err; 5377 5378 err = -ENOMEM; 5379 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 5380 if (skb == NULL) 5381 return err; 5382 5383 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, 5384 NFT_MSG_NEWSETELEM, 0, set, &elem); 5385 if (err < 0) 5386 goto err_fill_setelem; 5387 5388 return nfnetlink_unicast(skb, ctx->net, ctx->portid); 5389 5390 err_fill_setelem: 5391 kfree_skb(skb); 5392 return err; 5393 } 5394 5395 /* called with rcu_read_lock held */ 5396 static int nf_tables_getsetelem(struct sk_buff *skb, 5397 const struct nfnl_info *info, 5398 const struct nlattr * const nla[]) 5399 { 5400 struct netlink_ext_ack *extack = info->extack; 5401 u8 genmask = nft_genmask_cur(info->net); 5402 u8 family = info->nfmsg->nfgen_family; 5403 struct net *net = info->net; 5404 struct nft_table *table; 5405 struct nft_set *set; 5406 struct nlattr *attr; 5407 struct nft_ctx ctx; 5408 int rem, err = 0; 5409 5410 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 5411 genmask, NETLINK_CB(skb).portid); 5412 if (IS_ERR(table)) { 5413 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 5414 return PTR_ERR(table); 5415 } 5416 5417 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 5418 if (IS_ERR(set)) 5419 return PTR_ERR(set); 5420 5421 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5422 5423 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 5424 struct netlink_dump_control c = { 5425 .start = nf_tables_dump_set_start, 5426 .dump = nf_tables_dump_set, 5427 .done = nf_tables_dump_set_done, 5428 .module = THIS_MODULE, 5429 }; 5430 struct nft_set_dump_ctx dump_ctx = { 5431 .set = set, 5432 .ctx = ctx, 5433 }; 5434 5435 c.data = &dump_ctx; 5436 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 5437 } 5438 5439 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 5440 return -EINVAL; 5441 5442 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 5443 err = nft_get_set_elem(&ctx, set, attr); 5444 if (err < 0) { 5445 NL_SET_BAD_ATTR(extack, attr); 5446 break; 5447 } 5448 } 5449 5450 return err; 5451 } 5452 5453 static void nf_tables_setelem_notify(const struct nft_ctx *ctx, 5454 const struct nft_set *set, 5455 const struct nft_set_elem *elem, 5456 int event) 5457 { 5458 struct nftables_pernet *nft_net; 5459 struct net *net = ctx->net; 5460 u32 portid = ctx->portid; 5461 struct sk_buff *skb; 5462 u16 flags = 0; 5463 int err; 5464 5465 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 5466 return; 5467 5468 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 5469 if (skb == NULL) 5470 goto err; 5471 5472 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 5473 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 5474 5475 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 5476 set, elem); 5477 if (err < 0) { 5478 kfree_skb(skb); 5479 goto err; 5480 } 5481 5482 nft_net = nft_pernet(net); 5483 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 5484 return; 5485 err: 5486 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 5487 } 5488 5489 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx, 5490 int msg_type, 5491 struct nft_set *set) 5492 { 5493 struct nft_trans *trans; 5494 5495 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem)); 5496 if (trans == NULL) 5497 return NULL; 5498 5499 nft_trans_elem_set(trans) = set; 5500 return trans; 5501 } 5502 5503 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, 5504 const struct nft_set *set, 5505 const struct nlattr *attr) 5506 { 5507 struct nft_expr *expr; 5508 int err; 5509 5510 expr = nft_expr_init(ctx, attr); 5511 if (IS_ERR(expr)) 5512 return expr; 5513 5514 err = -EOPNOTSUPP; 5515 if (expr->ops->type->flags & NFT_EXPR_GC) { 5516 if (set->flags & NFT_SET_TIMEOUT) 5517 goto err_set_elem_expr; 5518 if (!set->ops->gc_init) 5519 goto err_set_elem_expr; 5520 set->ops->gc_init(set); 5521 } 5522 5523 return expr; 5524 5525 err_set_elem_expr: 5526 nft_expr_destroy(ctx, expr); 5527 return ERR_PTR(err); 5528 } 5529 5530 static int nft_set_ext_check(const struct nft_set_ext_tmpl *tmpl, u8 id, u32 len) 5531 { 5532 len += nft_set_ext_types[id].len; 5533 if (len > tmpl->ext_len[id] || 5534 len > U8_MAX) 5535 return -1; 5536 5537 return 0; 5538 } 5539 5540 static int nft_set_ext_memcpy(const struct nft_set_ext_tmpl *tmpl, u8 id, 5541 void *to, const void *from, u32 len) 5542 { 5543 if (nft_set_ext_check(tmpl, id, len) < 0) 5544 return -1; 5545 5546 memcpy(to, from, len); 5547 5548 return 0; 5549 } 5550 5551 void *nft_set_elem_init(const struct nft_set *set, 5552 const struct nft_set_ext_tmpl *tmpl, 5553 const u32 *key, const u32 *key_end, 5554 const u32 *data, u64 timeout, u64 expiration, gfp_t gfp) 5555 { 5556 struct nft_set_ext *ext; 5557 void *elem; 5558 5559 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 5560 if (elem == NULL) 5561 return ERR_PTR(-ENOMEM); 5562 5563 ext = nft_set_elem_ext(set, elem); 5564 nft_set_ext_init(ext, tmpl); 5565 5566 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 5567 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY, 5568 nft_set_ext_key(ext), key, set->klen) < 0) 5569 goto err_ext_check; 5570 5571 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 5572 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY_END, 5573 nft_set_ext_key_end(ext), key_end, set->klen) < 0) 5574 goto err_ext_check; 5575 5576 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 5577 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_DATA, 5578 nft_set_ext_data(ext), data, set->dlen) < 0) 5579 goto err_ext_check; 5580 5581 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 5582 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration; 5583 if (expiration == 0) 5584 *nft_set_ext_expiration(ext) += timeout; 5585 } 5586 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) 5587 *nft_set_ext_timeout(ext) = timeout; 5588 5589 return elem; 5590 5591 err_ext_check: 5592 kfree(elem); 5593 5594 return ERR_PTR(-EINVAL); 5595 } 5596 5597 static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 5598 struct nft_expr *expr) 5599 { 5600 if (expr->ops->destroy_clone) { 5601 expr->ops->destroy_clone(ctx, expr); 5602 module_put(expr->ops->type->owner); 5603 } else { 5604 nf_tables_expr_destroy(ctx, expr); 5605 } 5606 } 5607 5608 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 5609 struct nft_set_elem_expr *elem_expr) 5610 { 5611 struct nft_expr *expr; 5612 u32 size; 5613 5614 nft_setelem_expr_foreach(expr, elem_expr, size) 5615 __nft_set_elem_expr_destroy(ctx, expr); 5616 } 5617 5618 void nft_set_elem_destroy(const struct nft_set *set, void *elem, 5619 bool destroy_expr) 5620 { 5621 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 5622 struct nft_ctx ctx = { 5623 .net = read_pnet(&set->net), 5624 .family = set->table->family, 5625 }; 5626 5627 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE); 5628 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 5629 nft_data_release(nft_set_ext_data(ext), set->dtype); 5630 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 5631 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext)); 5632 5633 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 5634 (*nft_set_ext_obj(ext))->use--; 5635 kfree(elem); 5636 } 5637 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 5638 5639 /* Only called from commit path, nft_setelem_data_deactivate() already deals 5640 * with the refcounting from the preparation phase. 5641 */ 5642 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, 5643 const struct nft_set *set, void *elem) 5644 { 5645 struct nft_set_ext *ext = nft_set_elem_ext(set, elem); 5646 5647 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 5648 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 5649 5650 kfree(elem); 5651 } 5652 5653 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 5654 struct nft_expr *expr_array[]) 5655 { 5656 struct nft_expr *expr; 5657 int err, i, k; 5658 5659 for (i = 0; i < set->num_exprs; i++) { 5660 expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT); 5661 if (!expr) 5662 goto err_expr; 5663 5664 err = nft_expr_clone(expr, set->exprs[i]); 5665 if (err < 0) { 5666 kfree(expr); 5667 goto err_expr; 5668 } 5669 expr_array[i] = expr; 5670 } 5671 5672 return 0; 5673 5674 err_expr: 5675 for (k = i - 1; k >= 0; k--) 5676 nft_expr_destroy(ctx, expr_array[k]); 5677 5678 return -ENOMEM; 5679 } 5680 5681 static int nft_set_elem_expr_setup(struct nft_ctx *ctx, 5682 const struct nft_set_ext_tmpl *tmpl, 5683 const struct nft_set_ext *ext, 5684 struct nft_expr *expr_array[], 5685 u32 num_exprs) 5686 { 5687 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 5688 u32 len = sizeof(struct nft_set_elem_expr); 5689 struct nft_expr *expr; 5690 int i, err; 5691 5692 if (num_exprs == 0) 5693 return 0; 5694 5695 for (i = 0; i < num_exprs; i++) 5696 len += expr_array[i]->ops->size; 5697 5698 if (nft_set_ext_check(tmpl, NFT_SET_EXT_EXPRESSIONS, len) < 0) 5699 return -EINVAL; 5700 5701 for (i = 0; i < num_exprs; i++) { 5702 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 5703 err = nft_expr_clone(expr, expr_array[i]); 5704 if (err < 0) 5705 goto err_elem_expr_setup; 5706 5707 elem_expr->size += expr_array[i]->ops->size; 5708 nft_expr_destroy(ctx, expr_array[i]); 5709 expr_array[i] = NULL; 5710 } 5711 5712 return 0; 5713 5714 err_elem_expr_setup: 5715 for (; i < num_exprs; i++) { 5716 nft_expr_destroy(ctx, expr_array[i]); 5717 expr_array[i] = NULL; 5718 } 5719 5720 return -ENOMEM; 5721 } 5722 5723 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, 5724 const struct nft_set *set) 5725 { 5726 struct nft_set_elem_catchall *catchall; 5727 u8 genmask = nft_genmask_cur(net); 5728 struct nft_set_ext *ext; 5729 5730 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 5731 ext = nft_set_elem_ext(set, catchall->elem); 5732 if (nft_set_elem_active(ext, genmask) && 5733 !nft_set_elem_expired(ext)) 5734 return ext; 5735 } 5736 5737 return NULL; 5738 } 5739 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup); 5740 5741 void *nft_set_catchall_gc(const struct nft_set *set) 5742 { 5743 struct nft_set_elem_catchall *catchall, *next; 5744 struct nft_set_ext *ext; 5745 void *elem = NULL; 5746 5747 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 5748 ext = nft_set_elem_ext(set, catchall->elem); 5749 5750 if (!nft_set_elem_expired(ext) || 5751 nft_set_elem_mark_busy(ext)) 5752 continue; 5753 5754 elem = catchall->elem; 5755 list_del_rcu(&catchall->list); 5756 kfree_rcu(catchall, rcu); 5757 break; 5758 } 5759 5760 return elem; 5761 } 5762 EXPORT_SYMBOL_GPL(nft_set_catchall_gc); 5763 5764 static int nft_setelem_catchall_insert(const struct net *net, 5765 struct nft_set *set, 5766 const struct nft_set_elem *elem, 5767 struct nft_set_ext **pext) 5768 { 5769 struct nft_set_elem_catchall *catchall; 5770 u8 genmask = nft_genmask_next(net); 5771 struct nft_set_ext *ext; 5772 5773 list_for_each_entry(catchall, &set->catchall_list, list) { 5774 ext = nft_set_elem_ext(set, catchall->elem); 5775 if (nft_set_elem_active(ext, genmask)) { 5776 *pext = ext; 5777 return -EEXIST; 5778 } 5779 } 5780 5781 catchall = kmalloc(sizeof(*catchall), GFP_KERNEL); 5782 if (!catchall) 5783 return -ENOMEM; 5784 5785 catchall->elem = elem->priv; 5786 list_add_tail_rcu(&catchall->list, &set->catchall_list); 5787 5788 return 0; 5789 } 5790 5791 static int nft_setelem_insert(const struct net *net, 5792 struct nft_set *set, 5793 const struct nft_set_elem *elem, 5794 struct nft_set_ext **ext, unsigned int flags) 5795 { 5796 int ret; 5797 5798 if (flags & NFT_SET_ELEM_CATCHALL) 5799 ret = nft_setelem_catchall_insert(net, set, elem, ext); 5800 else 5801 ret = set->ops->insert(net, set, elem, ext); 5802 5803 return ret; 5804 } 5805 5806 static bool nft_setelem_is_catchall(const struct nft_set *set, 5807 const struct nft_set_elem *elem) 5808 { 5809 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5810 5811 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 5812 *nft_set_ext_flags(ext) & NFT_SET_ELEM_CATCHALL) 5813 return true; 5814 5815 return false; 5816 } 5817 5818 static void nft_setelem_activate(struct net *net, struct nft_set *set, 5819 struct nft_set_elem *elem) 5820 { 5821 struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 5822 5823 if (nft_setelem_is_catchall(set, elem)) { 5824 nft_set_elem_change_active(net, set, ext); 5825 nft_set_elem_clear_busy(ext); 5826 } else { 5827 set->ops->activate(net, set, elem); 5828 } 5829 } 5830 5831 static int nft_setelem_catchall_deactivate(const struct net *net, 5832 struct nft_set *set, 5833 struct nft_set_elem *elem) 5834 { 5835 struct nft_set_elem_catchall *catchall; 5836 struct nft_set_ext *ext; 5837 5838 list_for_each_entry(catchall, &set->catchall_list, list) { 5839 ext = nft_set_elem_ext(set, catchall->elem); 5840 if (!nft_is_active(net, ext) || 5841 nft_set_elem_mark_busy(ext)) 5842 continue; 5843 5844 kfree(elem->priv); 5845 elem->priv = catchall->elem; 5846 nft_set_elem_change_active(net, set, ext); 5847 return 0; 5848 } 5849 5850 return -ENOENT; 5851 } 5852 5853 static int __nft_setelem_deactivate(const struct net *net, 5854 struct nft_set *set, 5855 struct nft_set_elem *elem) 5856 { 5857 void *priv; 5858 5859 priv = set->ops->deactivate(net, set, elem); 5860 if (!priv) 5861 return -ENOENT; 5862 5863 kfree(elem->priv); 5864 elem->priv = priv; 5865 set->ndeact++; 5866 5867 return 0; 5868 } 5869 5870 static int nft_setelem_deactivate(const struct net *net, 5871 struct nft_set *set, 5872 struct nft_set_elem *elem, u32 flags) 5873 { 5874 int ret; 5875 5876 if (flags & NFT_SET_ELEM_CATCHALL) 5877 ret = nft_setelem_catchall_deactivate(net, set, elem); 5878 else 5879 ret = __nft_setelem_deactivate(net, set, elem); 5880 5881 return ret; 5882 } 5883 5884 static void nft_setelem_catchall_remove(const struct net *net, 5885 const struct nft_set *set, 5886 const struct nft_set_elem *elem) 5887 { 5888 struct nft_set_elem_catchall *catchall, *next; 5889 5890 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 5891 if (catchall->elem == elem->priv) { 5892 list_del_rcu(&catchall->list); 5893 kfree_rcu(catchall, rcu); 5894 break; 5895 } 5896 } 5897 } 5898 5899 static void nft_setelem_remove(const struct net *net, 5900 const struct nft_set *set, 5901 const struct nft_set_elem *elem) 5902 { 5903 if (nft_setelem_is_catchall(set, elem)) 5904 nft_setelem_catchall_remove(net, set, elem); 5905 else 5906 set->ops->remove(net, set, elem); 5907 } 5908 5909 static bool nft_setelem_valid_key_end(const struct nft_set *set, 5910 struct nlattr **nla, u32 flags) 5911 { 5912 if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) == 5913 (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { 5914 if (flags & NFT_SET_ELEM_INTERVAL_END) 5915 return false; 5916 5917 if (nla[NFTA_SET_ELEM_KEY_END] && 5918 flags & NFT_SET_ELEM_CATCHALL) 5919 return false; 5920 } else { 5921 if (nla[NFTA_SET_ELEM_KEY_END]) 5922 return false; 5923 } 5924 5925 return true; 5926 } 5927 5928 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 5929 const struct nlattr *attr, u32 nlmsg_flags) 5930 { 5931 struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {}; 5932 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 5933 u8 genmask = nft_genmask_next(ctx->net); 5934 u32 flags = 0, size = 0, num_exprs = 0; 5935 struct nft_set_ext_tmpl tmpl; 5936 struct nft_set_ext *ext, *ext2; 5937 struct nft_set_elem elem; 5938 struct nft_set_binding *binding; 5939 struct nft_object *obj = NULL; 5940 struct nft_userdata *udata; 5941 struct nft_data_desc desc; 5942 enum nft_registers dreg; 5943 struct nft_trans *trans; 5944 u64 timeout; 5945 u64 expiration; 5946 int err, i; 5947 u8 ulen; 5948 5949 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 5950 nft_set_elem_policy, NULL); 5951 if (err < 0) 5952 return err; 5953 5954 nft_set_ext_prepare(&tmpl); 5955 5956 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 5957 if (err < 0) 5958 return err; 5959 5960 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 5961 return -EINVAL; 5962 5963 if (flags != 0) { 5964 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 5965 if (err < 0) 5966 return err; 5967 } 5968 5969 if (set->flags & NFT_SET_MAP) { 5970 if (nla[NFTA_SET_ELEM_DATA] == NULL && 5971 !(flags & NFT_SET_ELEM_INTERVAL_END)) 5972 return -EINVAL; 5973 } else { 5974 if (nla[NFTA_SET_ELEM_DATA] != NULL) 5975 return -EINVAL; 5976 } 5977 5978 if (set->flags & NFT_SET_OBJECT) { 5979 if (!nla[NFTA_SET_ELEM_OBJREF] && 5980 !(flags & NFT_SET_ELEM_INTERVAL_END)) 5981 return -EINVAL; 5982 } else { 5983 if (nla[NFTA_SET_ELEM_OBJREF]) 5984 return -EINVAL; 5985 } 5986 5987 if (!nft_setelem_valid_key_end(set, nla, flags)) 5988 return -EINVAL; 5989 5990 if ((flags & NFT_SET_ELEM_INTERVAL_END) && 5991 (nla[NFTA_SET_ELEM_DATA] || 5992 nla[NFTA_SET_ELEM_OBJREF] || 5993 nla[NFTA_SET_ELEM_TIMEOUT] || 5994 nla[NFTA_SET_ELEM_EXPIRATION] || 5995 nla[NFTA_SET_ELEM_USERDATA] || 5996 nla[NFTA_SET_ELEM_EXPR] || 5997 nla[NFTA_SET_ELEM_KEY_END] || 5998 nla[NFTA_SET_ELEM_EXPRESSIONS])) 5999 return -EINVAL; 6000 6001 timeout = 0; 6002 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 6003 if (!(set->flags & NFT_SET_TIMEOUT)) 6004 return -EINVAL; 6005 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT], 6006 &timeout); 6007 if (err) 6008 return err; 6009 } else if (set->flags & NFT_SET_TIMEOUT && 6010 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6011 timeout = set->timeout; 6012 } 6013 6014 expiration = 0; 6015 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) { 6016 if (!(set->flags & NFT_SET_TIMEOUT)) 6017 return -EINVAL; 6018 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION], 6019 &expiration); 6020 if (err) 6021 return err; 6022 } 6023 6024 if (nla[NFTA_SET_ELEM_EXPR]) { 6025 struct nft_expr *expr; 6026 6027 if (set->num_exprs && set->num_exprs != 1) 6028 return -EOPNOTSUPP; 6029 6030 expr = nft_set_elem_expr_alloc(ctx, set, 6031 nla[NFTA_SET_ELEM_EXPR]); 6032 if (IS_ERR(expr)) 6033 return PTR_ERR(expr); 6034 6035 expr_array[0] = expr; 6036 num_exprs = 1; 6037 6038 if (set->num_exprs && set->exprs[0]->ops != expr->ops) { 6039 err = -EOPNOTSUPP; 6040 goto err_set_elem_expr; 6041 } 6042 } else if (nla[NFTA_SET_ELEM_EXPRESSIONS]) { 6043 struct nft_expr *expr; 6044 struct nlattr *tmp; 6045 int left; 6046 6047 i = 0; 6048 nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) { 6049 if (i == NFT_SET_EXPR_MAX || 6050 (set->num_exprs && set->num_exprs == i)) { 6051 err = -E2BIG; 6052 goto err_set_elem_expr; 6053 } 6054 if (nla_type(tmp) != NFTA_LIST_ELEM) { 6055 err = -EINVAL; 6056 goto err_set_elem_expr; 6057 } 6058 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 6059 if (IS_ERR(expr)) { 6060 err = PTR_ERR(expr); 6061 goto err_set_elem_expr; 6062 } 6063 expr_array[i] = expr; 6064 num_exprs++; 6065 6066 if (set->num_exprs && expr->ops != set->exprs[i]->ops) { 6067 err = -EOPNOTSUPP; 6068 goto err_set_elem_expr; 6069 } 6070 i++; 6071 } 6072 if (set->num_exprs && set->num_exprs != i) { 6073 err = -EOPNOTSUPP; 6074 goto err_set_elem_expr; 6075 } 6076 } else if (set->num_exprs > 0 && 6077 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 6078 err = nft_set_elem_expr_clone(ctx, set, expr_array); 6079 if (err < 0) 6080 goto err_set_elem_expr_clone; 6081 6082 num_exprs = set->num_exprs; 6083 } 6084 6085 if (nla[NFTA_SET_ELEM_KEY]) { 6086 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6087 nla[NFTA_SET_ELEM_KEY]); 6088 if (err < 0) 6089 goto err_set_elem_expr; 6090 6091 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 6092 if (err < 0) 6093 goto err_parse_key; 6094 } 6095 6096 if (nla[NFTA_SET_ELEM_KEY_END]) { 6097 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6098 nla[NFTA_SET_ELEM_KEY_END]); 6099 if (err < 0) 6100 goto err_parse_key; 6101 6102 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 6103 if (err < 0) 6104 goto err_parse_key_end; 6105 } 6106 6107 if (timeout > 0) { 6108 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); 6109 if (err < 0) 6110 goto err_parse_key_end; 6111 6112 if (timeout != set->timeout) { 6113 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 6114 if (err < 0) 6115 goto err_parse_key_end; 6116 } 6117 } 6118 6119 if (num_exprs) { 6120 for (i = 0; i < num_exprs; i++) 6121 size += expr_array[i]->ops->size; 6122 6123 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, 6124 sizeof(struct nft_set_elem_expr) + size); 6125 if (err < 0) 6126 goto err_parse_key_end; 6127 } 6128 6129 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { 6130 obj = nft_obj_lookup(ctx->net, ctx->table, 6131 nla[NFTA_SET_ELEM_OBJREF], 6132 set->objtype, genmask); 6133 if (IS_ERR(obj)) { 6134 err = PTR_ERR(obj); 6135 goto err_parse_key_end; 6136 } 6137 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); 6138 if (err < 0) 6139 goto err_parse_key_end; 6140 } 6141 6142 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 6143 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val, 6144 nla[NFTA_SET_ELEM_DATA]); 6145 if (err < 0) 6146 goto err_parse_key_end; 6147 6148 dreg = nft_type_to_reg(set->dtype); 6149 list_for_each_entry(binding, &set->bindings, list) { 6150 struct nft_ctx bind_ctx = { 6151 .net = ctx->net, 6152 .family = ctx->family, 6153 .table = ctx->table, 6154 .chain = (struct nft_chain *)binding->chain, 6155 }; 6156 6157 if (!(binding->flags & NFT_SET_MAP)) 6158 continue; 6159 6160 err = nft_validate_register_store(&bind_ctx, dreg, 6161 &elem.data.val, 6162 desc.type, desc.len); 6163 if (err < 0) 6164 goto err_parse_data; 6165 6166 if (desc.type == NFT_DATA_VERDICT && 6167 (elem.data.val.verdict.code == NFT_GOTO || 6168 elem.data.val.verdict.code == NFT_JUMP)) 6169 nft_validate_state_update(ctx->net, 6170 NFT_VALIDATE_NEED); 6171 } 6172 6173 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); 6174 if (err < 0) 6175 goto err_parse_data; 6176 } 6177 6178 /* The full maximum length of userdata can exceed the maximum 6179 * offset value (U8_MAX) for following extensions, therefor it 6180 * must be the last extension added. 6181 */ 6182 ulen = 0; 6183 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 6184 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 6185 if (ulen > 0) { 6186 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 6187 ulen); 6188 if (err < 0) 6189 goto err_parse_data; 6190 } 6191 } 6192 6193 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 6194 elem.key_end.val.data, elem.data.val.data, 6195 timeout, expiration, GFP_KERNEL_ACCOUNT); 6196 if (IS_ERR(elem.priv)) { 6197 err = PTR_ERR(elem.priv); 6198 goto err_parse_data; 6199 } 6200 6201 ext = nft_set_elem_ext(set, elem.priv); 6202 if (flags) 6203 *nft_set_ext_flags(ext) = flags; 6204 6205 if (ulen > 0) { 6206 if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) { 6207 err = -EINVAL; 6208 goto err_elem_userdata; 6209 } 6210 udata = nft_set_ext_userdata(ext); 6211 udata->len = ulen - 1; 6212 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 6213 } 6214 if (obj) { 6215 *nft_set_ext_obj(ext) = obj; 6216 obj->use++; 6217 } 6218 err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs); 6219 if (err < 0) 6220 goto err_elem_free; 6221 6222 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 6223 if (trans == NULL) { 6224 err = -ENOMEM; 6225 goto err_elem_free; 6226 } 6227 6228 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK; 6229 6230 err = nft_setelem_insert(ctx->net, set, &elem, &ext2, flags); 6231 if (err) { 6232 if (err == -EEXIST) { 6233 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ 6234 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || 6235 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ 6236 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) 6237 goto err_element_clash; 6238 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6239 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && 6240 memcmp(nft_set_ext_data(ext), 6241 nft_set_ext_data(ext2), set->dlen) != 0) || 6242 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 6243 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) && 6244 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) 6245 goto err_element_clash; 6246 else if (!(nlmsg_flags & NLM_F_EXCL)) 6247 err = 0; 6248 } else if (err == -ENOTEMPTY) { 6249 /* ENOTEMPTY reports overlapping between this element 6250 * and an existing one. 6251 */ 6252 err = -EEXIST; 6253 } 6254 goto err_element_clash; 6255 } 6256 6257 if (!(flags & NFT_SET_ELEM_CATCHALL) && set->size && 6258 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) { 6259 err = -ENFILE; 6260 goto err_set_full; 6261 } 6262 6263 nft_trans_elem(trans) = elem; 6264 nft_trans_commit_list_add_tail(ctx->net, trans); 6265 return 0; 6266 6267 err_set_full: 6268 nft_setelem_remove(ctx->net, set, &elem); 6269 err_element_clash: 6270 kfree(trans); 6271 err_elem_free: 6272 if (obj) 6273 obj->use--; 6274 err_elem_userdata: 6275 nf_tables_set_elem_destroy(ctx, set, elem.priv); 6276 err_parse_data: 6277 if (nla[NFTA_SET_ELEM_DATA] != NULL) 6278 nft_data_release(&elem.data.val, desc.type); 6279 err_parse_key_end: 6280 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 6281 err_parse_key: 6282 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 6283 err_set_elem_expr: 6284 for (i = 0; i < num_exprs && expr_array[i]; i++) 6285 nft_expr_destroy(ctx, expr_array[i]); 6286 err_set_elem_expr_clone: 6287 return err; 6288 } 6289 6290 static int nf_tables_newsetelem(struct sk_buff *skb, 6291 const struct nfnl_info *info, 6292 const struct nlattr * const nla[]) 6293 { 6294 struct nftables_pernet *nft_net = nft_pernet(info->net); 6295 struct netlink_ext_ack *extack = info->extack; 6296 u8 genmask = nft_genmask_next(info->net); 6297 u8 family = info->nfmsg->nfgen_family; 6298 struct net *net = info->net; 6299 const struct nlattr *attr; 6300 struct nft_table *table; 6301 struct nft_set *set; 6302 struct nft_ctx ctx; 6303 int rem, err; 6304 6305 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 6306 return -EINVAL; 6307 6308 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6309 genmask, NETLINK_CB(skb).portid); 6310 if (IS_ERR(table)) { 6311 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6312 return PTR_ERR(table); 6313 } 6314 6315 set = nft_set_lookup_global(net, table, nla[NFTA_SET_ELEM_LIST_SET], 6316 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask); 6317 if (IS_ERR(set)) 6318 return PTR_ERR(set); 6319 6320 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 6321 return -EBUSY; 6322 6323 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6324 6325 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6326 err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags); 6327 if (err < 0) { 6328 NL_SET_BAD_ATTR(extack, attr); 6329 return err; 6330 } 6331 } 6332 6333 if (nft_net->validate_state == NFT_VALIDATE_DO) 6334 return nft_table_validate(net, table); 6335 6336 return 0; 6337 } 6338 6339 /** 6340 * nft_data_hold - hold a nft_data item 6341 * 6342 * @data: struct nft_data to release 6343 * @type: type of data 6344 * 6345 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded, 6346 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and 6347 * NFT_GOTO verdicts. This function must be called on active data objects 6348 * from the second phase of the commit protocol. 6349 */ 6350 void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 6351 { 6352 struct nft_chain *chain; 6353 struct nft_rule *rule; 6354 6355 if (type == NFT_DATA_VERDICT) { 6356 switch (data->verdict.code) { 6357 case NFT_JUMP: 6358 case NFT_GOTO: 6359 chain = data->verdict.chain; 6360 chain->use++; 6361 6362 if (!nft_chain_is_bound(chain)) 6363 break; 6364 6365 chain->table->use++; 6366 list_for_each_entry(rule, &chain->rules, list) 6367 chain->use++; 6368 6369 nft_chain_add(chain->table, chain); 6370 break; 6371 } 6372 } 6373 } 6374 6375 static void nft_setelem_data_activate(const struct net *net, 6376 const struct nft_set *set, 6377 struct nft_set_elem *elem) 6378 { 6379 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6380 6381 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6382 nft_data_hold(nft_set_ext_data(ext), set->dtype); 6383 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6384 (*nft_set_ext_obj(ext))->use++; 6385 } 6386 6387 static void nft_setelem_data_deactivate(const struct net *net, 6388 const struct nft_set *set, 6389 struct nft_set_elem *elem) 6390 { 6391 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 6392 6393 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6394 nft_data_release(nft_set_ext_data(ext), set->dtype); 6395 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6396 (*nft_set_ext_obj(ext))->use--; 6397 } 6398 6399 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 6400 const struct nlattr *attr) 6401 { 6402 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6403 struct nft_set_ext_tmpl tmpl; 6404 struct nft_set_elem elem; 6405 struct nft_set_ext *ext; 6406 struct nft_trans *trans; 6407 u32 flags = 0; 6408 int err; 6409 6410 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6411 nft_set_elem_policy, NULL); 6412 if (err < 0) 6413 return err; 6414 6415 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6416 if (err < 0) 6417 return err; 6418 6419 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 6420 return -EINVAL; 6421 6422 if (!nft_setelem_valid_key_end(set, nla, flags)) 6423 return -EINVAL; 6424 6425 nft_set_ext_prepare(&tmpl); 6426 6427 if (flags != 0) { 6428 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 6429 if (err < 0) 6430 return err; 6431 } 6432 6433 if (nla[NFTA_SET_ELEM_KEY]) { 6434 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6435 nla[NFTA_SET_ELEM_KEY]); 6436 if (err < 0) 6437 return err; 6438 6439 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 6440 if (err < 0) 6441 goto fail_elem; 6442 } 6443 6444 if (nla[NFTA_SET_ELEM_KEY_END]) { 6445 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6446 nla[NFTA_SET_ELEM_KEY_END]); 6447 if (err < 0) 6448 goto fail_elem; 6449 6450 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 6451 if (err < 0) 6452 goto fail_elem_key_end; 6453 } 6454 6455 err = -ENOMEM; 6456 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 6457 elem.key_end.val.data, NULL, 0, 0, 6458 GFP_KERNEL_ACCOUNT); 6459 if (IS_ERR(elem.priv)) { 6460 err = PTR_ERR(elem.priv); 6461 goto fail_elem_key_end; 6462 } 6463 6464 ext = nft_set_elem_ext(set, elem.priv); 6465 if (flags) 6466 *nft_set_ext_flags(ext) = flags; 6467 6468 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 6469 if (trans == NULL) 6470 goto fail_trans; 6471 6472 err = nft_setelem_deactivate(ctx->net, set, &elem, flags); 6473 if (err < 0) 6474 goto fail_ops; 6475 6476 nft_setelem_data_deactivate(ctx->net, set, &elem); 6477 6478 nft_trans_elem(trans) = elem; 6479 nft_trans_commit_list_add_tail(ctx->net, trans); 6480 return 0; 6481 6482 fail_ops: 6483 kfree(trans); 6484 fail_trans: 6485 kfree(elem.priv); 6486 fail_elem_key_end: 6487 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 6488 fail_elem: 6489 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 6490 return err; 6491 } 6492 6493 static int nft_setelem_flush(const struct nft_ctx *ctx, 6494 struct nft_set *set, 6495 const struct nft_set_iter *iter, 6496 struct nft_set_elem *elem) 6497 { 6498 struct nft_trans *trans; 6499 int err; 6500 6501 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 6502 sizeof(struct nft_trans_elem), GFP_ATOMIC); 6503 if (!trans) 6504 return -ENOMEM; 6505 6506 if (!set->ops->flush(ctx->net, set, elem->priv)) { 6507 err = -ENOENT; 6508 goto err1; 6509 } 6510 set->ndeact++; 6511 6512 nft_setelem_data_deactivate(ctx->net, set, elem); 6513 nft_trans_elem_set(trans) = set; 6514 nft_trans_elem(trans) = *elem; 6515 nft_trans_commit_list_add_tail(ctx->net, trans); 6516 6517 return 0; 6518 err1: 6519 kfree(trans); 6520 return err; 6521 } 6522 6523 static int __nft_set_catchall_flush(const struct nft_ctx *ctx, 6524 struct nft_set *set, 6525 struct nft_set_elem *elem) 6526 { 6527 struct nft_trans *trans; 6528 6529 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM, 6530 sizeof(struct nft_trans_elem), GFP_KERNEL); 6531 if (!trans) 6532 return -ENOMEM; 6533 6534 nft_setelem_data_deactivate(ctx->net, set, elem); 6535 nft_trans_elem_set(trans) = set; 6536 nft_trans_elem(trans) = *elem; 6537 nft_trans_commit_list_add_tail(ctx->net, trans); 6538 6539 return 0; 6540 } 6541 6542 static int nft_set_catchall_flush(const struct nft_ctx *ctx, 6543 struct nft_set *set) 6544 { 6545 u8 genmask = nft_genmask_next(ctx->net); 6546 struct nft_set_elem_catchall *catchall; 6547 struct nft_set_elem elem; 6548 struct nft_set_ext *ext; 6549 int ret = 0; 6550 6551 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6552 ext = nft_set_elem_ext(set, catchall->elem); 6553 if (!nft_set_elem_active(ext, genmask) || 6554 nft_set_elem_mark_busy(ext)) 6555 continue; 6556 6557 elem.priv = catchall->elem; 6558 ret = __nft_set_catchall_flush(ctx, set, &elem); 6559 if (ret < 0) 6560 break; 6561 } 6562 6563 return ret; 6564 } 6565 6566 static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) 6567 { 6568 struct nft_set_iter iter = { 6569 .genmask = genmask, 6570 .fn = nft_setelem_flush, 6571 }; 6572 6573 set->ops->walk(ctx, set, &iter); 6574 if (!iter.err) 6575 iter.err = nft_set_catchall_flush(ctx, set); 6576 6577 return iter.err; 6578 } 6579 6580 static int nf_tables_delsetelem(struct sk_buff *skb, 6581 const struct nfnl_info *info, 6582 const struct nlattr * const nla[]) 6583 { 6584 struct netlink_ext_ack *extack = info->extack; 6585 u8 genmask = nft_genmask_next(info->net); 6586 u8 family = info->nfmsg->nfgen_family; 6587 struct net *net = info->net; 6588 const struct nlattr *attr; 6589 struct nft_table *table; 6590 struct nft_set *set; 6591 struct nft_ctx ctx; 6592 int rem, err = 0; 6593 6594 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6595 genmask, NETLINK_CB(skb).portid); 6596 if (IS_ERR(table)) { 6597 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6598 return PTR_ERR(table); 6599 } 6600 6601 set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 6602 if (IS_ERR(set)) 6603 return PTR_ERR(set); 6604 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) 6605 return -EBUSY; 6606 6607 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6608 6609 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6610 return nft_set_flush(&ctx, set, genmask); 6611 6612 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6613 err = nft_del_setelem(&ctx, set, attr); 6614 if (err < 0) { 6615 NL_SET_BAD_ATTR(extack, attr); 6616 break; 6617 } 6618 } 6619 return err; 6620 } 6621 6622 void nft_set_gc_batch_release(struct rcu_head *rcu) 6623 { 6624 struct nft_set_gc_batch *gcb; 6625 unsigned int i; 6626 6627 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu); 6628 for (i = 0; i < gcb->head.cnt; i++) 6629 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true); 6630 kfree(gcb); 6631 } 6632 6633 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set, 6634 gfp_t gfp) 6635 { 6636 struct nft_set_gc_batch *gcb; 6637 6638 gcb = kzalloc(sizeof(*gcb), gfp); 6639 if (gcb == NULL) 6640 return gcb; 6641 gcb->head.set = set; 6642 return gcb; 6643 } 6644 6645 /* 6646 * Stateful objects 6647 */ 6648 6649 /** 6650 * nft_register_obj- register nf_tables stateful object type 6651 * @obj_type: object type 6652 * 6653 * Registers the object type for use with nf_tables. Returns zero on 6654 * success or a negative errno code otherwise. 6655 */ 6656 int nft_register_obj(struct nft_object_type *obj_type) 6657 { 6658 if (obj_type->type == NFT_OBJECT_UNSPEC) 6659 return -EINVAL; 6660 6661 nfnl_lock(NFNL_SUBSYS_NFTABLES); 6662 list_add_rcu(&obj_type->list, &nf_tables_objects); 6663 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 6664 return 0; 6665 } 6666 EXPORT_SYMBOL_GPL(nft_register_obj); 6667 6668 /** 6669 * nft_unregister_obj - unregister nf_tables object type 6670 * @obj_type: object type 6671 * 6672 * Unregisters the object type for use with nf_tables. 6673 */ 6674 void nft_unregister_obj(struct nft_object_type *obj_type) 6675 { 6676 nfnl_lock(NFNL_SUBSYS_NFTABLES); 6677 list_del_rcu(&obj_type->list); 6678 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 6679 } 6680 EXPORT_SYMBOL_GPL(nft_unregister_obj); 6681 6682 struct nft_object *nft_obj_lookup(const struct net *net, 6683 const struct nft_table *table, 6684 const struct nlattr *nla, u32 objtype, 6685 u8 genmask) 6686 { 6687 struct nft_object_hash_key k = { .table = table }; 6688 char search[NFT_OBJ_MAXNAMELEN]; 6689 struct rhlist_head *tmp, *list; 6690 struct nft_object *obj; 6691 6692 nla_strscpy(search, nla, sizeof(search)); 6693 k.name = search; 6694 6695 WARN_ON_ONCE(!rcu_read_lock_held() && 6696 !lockdep_commit_lock_is_held(net)); 6697 6698 rcu_read_lock(); 6699 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params); 6700 if (!list) 6701 goto out; 6702 6703 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) { 6704 if (objtype == obj->ops->type->type && 6705 nft_active_genmask(obj, genmask)) { 6706 rcu_read_unlock(); 6707 return obj; 6708 } 6709 } 6710 out: 6711 rcu_read_unlock(); 6712 return ERR_PTR(-ENOENT); 6713 } 6714 EXPORT_SYMBOL_GPL(nft_obj_lookup); 6715 6716 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table, 6717 const struct nlattr *nla, 6718 u32 objtype, u8 genmask) 6719 { 6720 struct nft_object *obj; 6721 6722 list_for_each_entry(obj, &table->objects, list) { 6723 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && 6724 objtype == obj->ops->type->type && 6725 nft_active_genmask(obj, genmask)) 6726 return obj; 6727 } 6728 return ERR_PTR(-ENOENT); 6729 } 6730 6731 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 6732 [NFTA_OBJ_TABLE] = { .type = NLA_STRING, 6733 .len = NFT_TABLE_MAXNAMELEN - 1 }, 6734 [NFTA_OBJ_NAME] = { .type = NLA_STRING, 6735 .len = NFT_OBJ_MAXNAMELEN - 1 }, 6736 [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, 6737 [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, 6738 [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, 6739 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY, 6740 .len = NFT_USERDATA_MAXLEN }, 6741 }; 6742 6743 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 6744 const struct nft_object_type *type, 6745 const struct nlattr *attr) 6746 { 6747 struct nlattr **tb; 6748 const struct nft_object_ops *ops; 6749 struct nft_object *obj; 6750 int err = -ENOMEM; 6751 6752 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL); 6753 if (!tb) 6754 goto err1; 6755 6756 if (attr) { 6757 err = nla_parse_nested_deprecated(tb, type->maxattr, attr, 6758 type->policy, NULL); 6759 if (err < 0) 6760 goto err2; 6761 } else { 6762 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); 6763 } 6764 6765 if (type->select_ops) { 6766 ops = type->select_ops(ctx, (const struct nlattr * const *)tb); 6767 if (IS_ERR(ops)) { 6768 err = PTR_ERR(ops); 6769 goto err2; 6770 } 6771 } else { 6772 ops = type->ops; 6773 } 6774 6775 err = -ENOMEM; 6776 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT); 6777 if (!obj) 6778 goto err2; 6779 6780 err = ops->init(ctx, (const struct nlattr * const *)tb, obj); 6781 if (err < 0) 6782 goto err3; 6783 6784 obj->ops = ops; 6785 6786 kfree(tb); 6787 return obj; 6788 err3: 6789 kfree(obj); 6790 err2: 6791 kfree(tb); 6792 err1: 6793 return ERR_PTR(err); 6794 } 6795 6796 static int nft_object_dump(struct sk_buff *skb, unsigned int attr, 6797 struct nft_object *obj, bool reset) 6798 { 6799 struct nlattr *nest; 6800 6801 nest = nla_nest_start_noflag(skb, attr); 6802 if (!nest) 6803 goto nla_put_failure; 6804 if (obj->ops->dump(skb, obj, reset) < 0) 6805 goto nla_put_failure; 6806 nla_nest_end(skb, nest); 6807 return 0; 6808 6809 nla_put_failure: 6810 return -1; 6811 } 6812 6813 static const struct nft_object_type *__nft_obj_type_get(u32 objtype) 6814 { 6815 const struct nft_object_type *type; 6816 6817 list_for_each_entry(type, &nf_tables_objects, list) { 6818 if (objtype == type->type) 6819 return type; 6820 } 6821 return NULL; 6822 } 6823 6824 static const struct nft_object_type * 6825 nft_obj_type_get(struct net *net, u32 objtype) 6826 { 6827 const struct nft_object_type *type; 6828 6829 type = __nft_obj_type_get(objtype); 6830 if (type != NULL && try_module_get(type->owner)) 6831 return type; 6832 6833 lockdep_nfnl_nft_mutex_not_held(); 6834 #ifdef CONFIG_MODULES 6835 if (type == NULL) { 6836 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN) 6837 return ERR_PTR(-EAGAIN); 6838 } 6839 #endif 6840 return ERR_PTR(-ENOENT); 6841 } 6842 6843 static int nf_tables_updobj(const struct nft_ctx *ctx, 6844 const struct nft_object_type *type, 6845 const struct nlattr *attr, 6846 struct nft_object *obj) 6847 { 6848 struct nft_object *newobj; 6849 struct nft_trans *trans; 6850 int err = -ENOMEM; 6851 6852 if (!try_module_get(type->owner)) 6853 return -ENOENT; 6854 6855 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, 6856 sizeof(struct nft_trans_obj)); 6857 if (!trans) 6858 goto err_trans; 6859 6860 newobj = nft_obj_init(ctx, type, attr); 6861 if (IS_ERR(newobj)) { 6862 err = PTR_ERR(newobj); 6863 goto err_free_trans; 6864 } 6865 6866 nft_trans_obj(trans) = obj; 6867 nft_trans_obj_update(trans) = true; 6868 nft_trans_obj_newobj(trans) = newobj; 6869 nft_trans_commit_list_add_tail(ctx->net, trans); 6870 6871 return 0; 6872 6873 err_free_trans: 6874 kfree(trans); 6875 err_trans: 6876 module_put(type->owner); 6877 return err; 6878 } 6879 6880 static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, 6881 const struct nlattr * const nla[]) 6882 { 6883 struct netlink_ext_ack *extack = info->extack; 6884 u8 genmask = nft_genmask_next(info->net); 6885 u8 family = info->nfmsg->nfgen_family; 6886 const struct nft_object_type *type; 6887 struct net *net = info->net; 6888 struct nft_table *table; 6889 struct nft_object *obj; 6890 struct nft_ctx ctx; 6891 u32 objtype; 6892 int err; 6893 6894 if (!nla[NFTA_OBJ_TYPE] || 6895 !nla[NFTA_OBJ_NAME] || 6896 !nla[NFTA_OBJ_DATA]) 6897 return -EINVAL; 6898 6899 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 6900 NETLINK_CB(skb).portid); 6901 if (IS_ERR(table)) { 6902 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 6903 return PTR_ERR(table); 6904 } 6905 6906 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 6907 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 6908 if (IS_ERR(obj)) { 6909 err = PTR_ERR(obj); 6910 if (err != -ENOENT) { 6911 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 6912 return err; 6913 } 6914 } else { 6915 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 6916 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 6917 return -EEXIST; 6918 } 6919 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 6920 return -EOPNOTSUPP; 6921 6922 type = __nft_obj_type_get(objtype); 6923 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6924 6925 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); 6926 } 6927 6928 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 6929 6930 type = nft_obj_type_get(net, objtype); 6931 if (IS_ERR(type)) 6932 return PTR_ERR(type); 6933 6934 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]); 6935 if (IS_ERR(obj)) { 6936 err = PTR_ERR(obj); 6937 goto err_init; 6938 } 6939 obj->key.table = table; 6940 obj->handle = nf_tables_alloc_handle(table); 6941 6942 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT); 6943 if (!obj->key.name) { 6944 err = -ENOMEM; 6945 goto err_strdup; 6946 } 6947 6948 if (nla[NFTA_OBJ_USERDATA]) { 6949 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL); 6950 if (obj->udata == NULL) 6951 goto err_userdata; 6952 6953 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]); 6954 } 6955 6956 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj); 6957 if (err < 0) 6958 goto err_trans; 6959 6960 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead, 6961 nft_objname_ht_params); 6962 if (err < 0) 6963 goto err_obj_ht; 6964 6965 list_add_tail_rcu(&obj->list, &table->objects); 6966 table->use++; 6967 return 0; 6968 err_obj_ht: 6969 /* queued in transaction log */ 6970 INIT_LIST_HEAD(&obj->list); 6971 return err; 6972 err_trans: 6973 kfree(obj->udata); 6974 err_userdata: 6975 kfree(obj->key.name); 6976 err_strdup: 6977 if (obj->ops->destroy) 6978 obj->ops->destroy(&ctx, obj); 6979 kfree(obj); 6980 err_init: 6981 module_put(type->owner); 6982 return err; 6983 } 6984 6985 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 6986 u32 portid, u32 seq, int event, u32 flags, 6987 int family, const struct nft_table *table, 6988 struct nft_object *obj, bool reset) 6989 { 6990 struct nlmsghdr *nlh; 6991 6992 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 6993 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 6994 NFNETLINK_V0, nft_base_seq(net)); 6995 if (!nlh) 6996 goto nla_put_failure; 6997 6998 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || 6999 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || 7000 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || 7001 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || 7002 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) || 7003 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), 7004 NFTA_OBJ_PAD)) 7005 goto nla_put_failure; 7006 7007 if (obj->udata && 7008 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata)) 7009 goto nla_put_failure; 7010 7011 nlmsg_end(skb, nlh); 7012 return 0; 7013 7014 nla_put_failure: 7015 nlmsg_trim(skb, nlh); 7016 return -1; 7017 } 7018 7019 struct nft_obj_filter { 7020 char *table; 7021 u32 type; 7022 }; 7023 7024 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) 7025 { 7026 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 7027 const struct nft_table *table; 7028 unsigned int idx = 0, s_idx = cb->args[0]; 7029 struct nft_obj_filter *filter = cb->data; 7030 struct net *net = sock_net(skb->sk); 7031 int family = nfmsg->nfgen_family; 7032 struct nftables_pernet *nft_net; 7033 struct nft_object *obj; 7034 bool reset = false; 7035 7036 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7037 reset = true; 7038 7039 rcu_read_lock(); 7040 nft_net = nft_pernet(net); 7041 cb->seq = READ_ONCE(nft_net->base_seq); 7042 7043 list_for_each_entry_rcu(table, &nft_net->tables, list) { 7044 if (family != NFPROTO_UNSPEC && family != table->family) 7045 continue; 7046 7047 list_for_each_entry_rcu(obj, &table->objects, list) { 7048 if (!nft_is_active(net, obj)) 7049 goto cont; 7050 if (idx < s_idx) 7051 goto cont; 7052 if (idx > s_idx) 7053 memset(&cb->args[1], 0, 7054 sizeof(cb->args) - sizeof(cb->args[0])); 7055 if (filter && filter->table && 7056 strcmp(filter->table, table->name)) 7057 goto cont; 7058 if (filter && 7059 filter->type != NFT_OBJECT_UNSPEC && 7060 obj->ops->type->type != filter->type) 7061 goto cont; 7062 if (reset) { 7063 char *buf = kasprintf(GFP_ATOMIC, 7064 "%s:%u", 7065 table->name, 7066 nft_net->base_seq); 7067 7068 audit_log_nfcfg(buf, 7069 family, 7070 obj->handle, 7071 AUDIT_NFT_OP_OBJ_RESET, 7072 GFP_ATOMIC); 7073 kfree(buf); 7074 } 7075 7076 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, 7077 cb->nlh->nlmsg_seq, 7078 NFT_MSG_NEWOBJ, 7079 NLM_F_MULTI | NLM_F_APPEND, 7080 table->family, table, 7081 obj, reset) < 0) 7082 goto done; 7083 7084 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 7085 cont: 7086 idx++; 7087 } 7088 } 7089 done: 7090 rcu_read_unlock(); 7091 7092 cb->args[0] = idx; 7093 return skb->len; 7094 } 7095 7096 static int nf_tables_dump_obj_start(struct netlink_callback *cb) 7097 { 7098 const struct nlattr * const *nla = cb->data; 7099 struct nft_obj_filter *filter = NULL; 7100 7101 if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) { 7102 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 7103 if (!filter) 7104 return -ENOMEM; 7105 7106 if (nla[NFTA_OBJ_TABLE]) { 7107 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC); 7108 if (!filter->table) { 7109 kfree(filter); 7110 return -ENOMEM; 7111 } 7112 } 7113 7114 if (nla[NFTA_OBJ_TYPE]) 7115 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7116 } 7117 7118 cb->data = filter; 7119 return 0; 7120 } 7121 7122 static int nf_tables_dump_obj_done(struct netlink_callback *cb) 7123 { 7124 struct nft_obj_filter *filter = cb->data; 7125 7126 if (filter) { 7127 kfree(filter->table); 7128 kfree(filter); 7129 } 7130 7131 return 0; 7132 } 7133 7134 /* called with rcu_read_lock held */ 7135 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, 7136 const struct nlattr * const nla[]) 7137 { 7138 struct netlink_ext_ack *extack = info->extack; 7139 u8 genmask = nft_genmask_cur(info->net); 7140 u8 family = info->nfmsg->nfgen_family; 7141 const struct nft_table *table; 7142 struct net *net = info->net; 7143 struct nft_object *obj; 7144 struct sk_buff *skb2; 7145 bool reset = false; 7146 u32 objtype; 7147 int err; 7148 7149 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 7150 struct netlink_dump_control c = { 7151 .start = nf_tables_dump_obj_start, 7152 .dump = nf_tables_dump_obj, 7153 .done = nf_tables_dump_obj_done, 7154 .module = THIS_MODULE, 7155 .data = (void *)nla, 7156 }; 7157 7158 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 7159 } 7160 7161 if (!nla[NFTA_OBJ_NAME] || 7162 !nla[NFTA_OBJ_TYPE]) 7163 return -EINVAL; 7164 7165 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0); 7166 if (IS_ERR(table)) { 7167 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7168 return PTR_ERR(table); 7169 } 7170 7171 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7172 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 7173 if (IS_ERR(obj)) { 7174 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 7175 return PTR_ERR(obj); 7176 } 7177 7178 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 7179 if (!skb2) 7180 return -ENOMEM; 7181 7182 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) 7183 reset = true; 7184 7185 if (reset) { 7186 const struct nftables_pernet *nft_net; 7187 char *buf; 7188 7189 nft_net = nft_pernet(net); 7190 buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq); 7191 7192 audit_log_nfcfg(buf, 7193 family, 7194 obj->handle, 7195 AUDIT_NFT_OP_OBJ_RESET, 7196 GFP_ATOMIC); 7197 kfree(buf); 7198 } 7199 7200 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid, 7201 info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 7202 family, table, obj, reset); 7203 if (err < 0) 7204 goto err_fill_obj_info; 7205 7206 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 7207 7208 err_fill_obj_info: 7209 kfree_skb(skb2); 7210 return err; 7211 } 7212 7213 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) 7214 { 7215 if (obj->ops->destroy) 7216 obj->ops->destroy(ctx, obj); 7217 7218 module_put(obj->ops->type->owner); 7219 kfree(obj->key.name); 7220 kfree(obj->udata); 7221 kfree(obj); 7222 } 7223 7224 static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info, 7225 const struct nlattr * const nla[]) 7226 { 7227 struct netlink_ext_ack *extack = info->extack; 7228 u8 genmask = nft_genmask_next(info->net); 7229 u8 family = info->nfmsg->nfgen_family; 7230 struct net *net = info->net; 7231 const struct nlattr *attr; 7232 struct nft_table *table; 7233 struct nft_object *obj; 7234 struct nft_ctx ctx; 7235 u32 objtype; 7236 7237 if (!nla[NFTA_OBJ_TYPE] || 7238 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) 7239 return -EINVAL; 7240 7241 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 7242 NETLINK_CB(skb).portid); 7243 if (IS_ERR(table)) { 7244 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 7245 return PTR_ERR(table); 7246 } 7247 7248 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 7249 if (nla[NFTA_OBJ_HANDLE]) { 7250 attr = nla[NFTA_OBJ_HANDLE]; 7251 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask); 7252 } else { 7253 attr = nla[NFTA_OBJ_NAME]; 7254 obj = nft_obj_lookup(net, table, attr, objtype, genmask); 7255 } 7256 7257 if (IS_ERR(obj)) { 7258 NL_SET_BAD_ATTR(extack, attr); 7259 return PTR_ERR(obj); 7260 } 7261 if (obj->use > 0) { 7262 NL_SET_BAD_ATTR(extack, attr); 7263 return -EBUSY; 7264 } 7265 7266 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7267 7268 return nft_delobj(&ctx, obj); 7269 } 7270 7271 void nft_obj_notify(struct net *net, const struct nft_table *table, 7272 struct nft_object *obj, u32 portid, u32 seq, int event, 7273 u16 flags, int family, int report, gfp_t gfp) 7274 { 7275 struct nftables_pernet *nft_net = nft_pernet(net); 7276 struct sk_buff *skb; 7277 int err; 7278 char *buf = kasprintf(gfp, "%s:%u", 7279 table->name, nft_net->base_seq); 7280 7281 audit_log_nfcfg(buf, 7282 family, 7283 obj->handle, 7284 event == NFT_MSG_NEWOBJ ? 7285 AUDIT_NFT_OP_OBJ_REGISTER : 7286 AUDIT_NFT_OP_OBJ_UNREGISTER, 7287 gfp); 7288 kfree(buf); 7289 7290 if (!report && 7291 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 7292 return; 7293 7294 skb = nlmsg_new(NLMSG_GOODSIZE, gfp); 7295 if (skb == NULL) 7296 goto err; 7297 7298 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 7299 flags & (NLM_F_CREATE | NLM_F_EXCL), 7300 family, table, obj, false); 7301 if (err < 0) { 7302 kfree_skb(skb); 7303 goto err; 7304 } 7305 7306 nft_notify_enqueue(skb, report, &nft_net->notify_list); 7307 return; 7308 err: 7309 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 7310 } 7311 EXPORT_SYMBOL_GPL(nft_obj_notify); 7312 7313 static void nf_tables_obj_notify(const struct nft_ctx *ctx, 7314 struct nft_object *obj, int event) 7315 { 7316 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, 7317 ctx->flags, ctx->family, ctx->report, GFP_KERNEL); 7318 } 7319 7320 /* 7321 * Flow tables 7322 */ 7323 void nft_register_flowtable_type(struct nf_flowtable_type *type) 7324 { 7325 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7326 list_add_tail_rcu(&type->list, &nf_tables_flowtables); 7327 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7328 } 7329 EXPORT_SYMBOL_GPL(nft_register_flowtable_type); 7330 7331 void nft_unregister_flowtable_type(struct nf_flowtable_type *type) 7332 { 7333 nfnl_lock(NFNL_SUBSYS_NFTABLES); 7334 list_del_rcu(&type->list); 7335 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 7336 } 7337 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); 7338 7339 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 7340 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, 7341 .len = NFT_NAME_MAXLEN - 1 }, 7342 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, 7343 .len = NFT_NAME_MAXLEN - 1 }, 7344 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, 7345 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, 7346 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 }, 7347 }; 7348 7349 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table, 7350 const struct nlattr *nla, u8 genmask) 7351 { 7352 struct nft_flowtable *flowtable; 7353 7354 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 7355 if (!nla_strcmp(nla, flowtable->name) && 7356 nft_active_genmask(flowtable, genmask)) 7357 return flowtable; 7358 } 7359 return ERR_PTR(-ENOENT); 7360 } 7361 EXPORT_SYMBOL_GPL(nft_flowtable_lookup); 7362 7363 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, 7364 struct nft_flowtable *flowtable, 7365 enum nft_trans_phase phase) 7366 { 7367 switch (phase) { 7368 case NFT_TRANS_PREPARE: 7369 case NFT_TRANS_ABORT: 7370 case NFT_TRANS_RELEASE: 7371 flowtable->use--; 7372 fallthrough; 7373 default: 7374 return; 7375 } 7376 } 7377 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable); 7378 7379 static struct nft_flowtable * 7380 nft_flowtable_lookup_byhandle(const struct nft_table *table, 7381 const struct nlattr *nla, u8 genmask) 7382 { 7383 struct nft_flowtable *flowtable; 7384 7385 list_for_each_entry(flowtable, &table->flowtables, list) { 7386 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && 7387 nft_active_genmask(flowtable, genmask)) 7388 return flowtable; 7389 } 7390 return ERR_PTR(-ENOENT); 7391 } 7392 7393 struct nft_flowtable_hook { 7394 u32 num; 7395 int priority; 7396 struct list_head list; 7397 }; 7398 7399 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { 7400 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, 7401 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, 7402 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, 7403 }; 7404 7405 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx, 7406 const struct nlattr *attr, 7407 struct nft_flowtable_hook *flowtable_hook, 7408 struct nft_flowtable *flowtable, bool add) 7409 { 7410 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; 7411 struct nft_hook *hook; 7412 int hooknum, priority; 7413 int err; 7414 7415 INIT_LIST_HEAD(&flowtable_hook->list); 7416 7417 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr, 7418 nft_flowtable_hook_policy, NULL); 7419 if (err < 0) 7420 return err; 7421 7422 if (add) { 7423 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || 7424 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) 7425 return -EINVAL; 7426 7427 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 7428 if (hooknum != NF_NETDEV_INGRESS) 7429 return -EOPNOTSUPP; 7430 7431 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 7432 7433 flowtable_hook->priority = priority; 7434 flowtable_hook->num = hooknum; 7435 } else { 7436 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) { 7437 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 7438 if (hooknum != flowtable->hooknum) 7439 return -EOPNOTSUPP; 7440 } 7441 7442 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 7443 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 7444 if (priority != flowtable->data.priority) 7445 return -EOPNOTSUPP; 7446 } 7447 7448 flowtable_hook->priority = flowtable->data.priority; 7449 flowtable_hook->num = flowtable->hooknum; 7450 } 7451 7452 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) { 7453 err = nf_tables_parse_netdev_hooks(ctx->net, 7454 tb[NFTA_FLOWTABLE_HOOK_DEVS], 7455 &flowtable_hook->list); 7456 if (err < 0) 7457 return err; 7458 } 7459 7460 list_for_each_entry(hook, &flowtable_hook->list, list) { 7461 hook->ops.pf = NFPROTO_NETDEV; 7462 hook->ops.hooknum = flowtable_hook->num; 7463 hook->ops.priority = flowtable_hook->priority; 7464 hook->ops.priv = &flowtable->data; 7465 hook->ops.hook = flowtable->data.type->hook; 7466 } 7467 7468 return err; 7469 } 7470 7471 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) 7472 { 7473 const struct nf_flowtable_type *type; 7474 7475 list_for_each_entry(type, &nf_tables_flowtables, list) { 7476 if (family == type->family) 7477 return type; 7478 } 7479 return NULL; 7480 } 7481 7482 static const struct nf_flowtable_type * 7483 nft_flowtable_type_get(struct net *net, u8 family) 7484 { 7485 const struct nf_flowtable_type *type; 7486 7487 type = __nft_flowtable_type_get(family); 7488 if (type != NULL && try_module_get(type->owner)) 7489 return type; 7490 7491 lockdep_nfnl_nft_mutex_not_held(); 7492 #ifdef CONFIG_MODULES 7493 if (type == NULL) { 7494 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN) 7495 return ERR_PTR(-EAGAIN); 7496 } 7497 #endif 7498 return ERR_PTR(-ENOENT); 7499 } 7500 7501 /* Only called from error and netdev event paths. */ 7502 static void nft_unregister_flowtable_hook(struct net *net, 7503 struct nft_flowtable *flowtable, 7504 struct nft_hook *hook) 7505 { 7506 nf_unregister_net_hook(net, &hook->ops); 7507 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 7508 FLOW_BLOCK_UNBIND); 7509 } 7510 7511 static void __nft_unregister_flowtable_net_hooks(struct net *net, 7512 struct list_head *hook_list, 7513 bool release_netdev) 7514 { 7515 struct nft_hook *hook, *next; 7516 7517 list_for_each_entry_safe(hook, next, hook_list, list) { 7518 nf_unregister_net_hook(net, &hook->ops); 7519 if (release_netdev) { 7520 list_del(&hook->list); 7521 kfree_rcu(hook, rcu); 7522 } 7523 } 7524 } 7525 7526 static void nft_unregister_flowtable_net_hooks(struct net *net, 7527 struct list_head *hook_list) 7528 { 7529 __nft_unregister_flowtable_net_hooks(net, hook_list, false); 7530 } 7531 7532 static int nft_register_flowtable_net_hooks(struct net *net, 7533 struct nft_table *table, 7534 struct list_head *hook_list, 7535 struct nft_flowtable *flowtable) 7536 { 7537 struct nft_hook *hook, *hook2, *next; 7538 struct nft_flowtable *ft; 7539 int err, i = 0; 7540 7541 list_for_each_entry(hook, hook_list, list) { 7542 list_for_each_entry(ft, &table->flowtables, list) { 7543 if (!nft_is_active_next(net, ft)) 7544 continue; 7545 7546 list_for_each_entry(hook2, &ft->hook_list, list) { 7547 if (hook->ops.dev == hook2->ops.dev && 7548 hook->ops.pf == hook2->ops.pf) { 7549 err = -EEXIST; 7550 goto err_unregister_net_hooks; 7551 } 7552 } 7553 } 7554 7555 err = flowtable->data.type->setup(&flowtable->data, 7556 hook->ops.dev, 7557 FLOW_BLOCK_BIND); 7558 if (err < 0) 7559 goto err_unregister_net_hooks; 7560 7561 err = nf_register_net_hook(net, &hook->ops); 7562 if (err < 0) { 7563 flowtable->data.type->setup(&flowtable->data, 7564 hook->ops.dev, 7565 FLOW_BLOCK_UNBIND); 7566 goto err_unregister_net_hooks; 7567 } 7568 7569 i++; 7570 } 7571 7572 return 0; 7573 7574 err_unregister_net_hooks: 7575 list_for_each_entry_safe(hook, next, hook_list, list) { 7576 if (i-- <= 0) 7577 break; 7578 7579 nft_unregister_flowtable_hook(net, flowtable, hook); 7580 list_del_rcu(&hook->list); 7581 kfree_rcu(hook, rcu); 7582 } 7583 7584 return err; 7585 } 7586 7587 static void nft_flowtable_hooks_destroy(struct list_head *hook_list) 7588 { 7589 struct nft_hook *hook, *next; 7590 7591 list_for_each_entry_safe(hook, next, hook_list, list) { 7592 list_del_rcu(&hook->list); 7593 kfree_rcu(hook, rcu); 7594 } 7595 } 7596 7597 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, 7598 struct nft_flowtable *flowtable) 7599 { 7600 const struct nlattr * const *nla = ctx->nla; 7601 struct nft_flowtable_hook flowtable_hook; 7602 struct nft_hook *hook, *next; 7603 struct nft_trans *trans; 7604 bool unregister = false; 7605 u32 flags; 7606 int err; 7607 7608 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK], 7609 &flowtable_hook, flowtable, false); 7610 if (err < 0) 7611 return err; 7612 7613 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 7614 if (nft_hook_list_find(&flowtable->hook_list, hook)) { 7615 list_del(&hook->list); 7616 kfree(hook); 7617 } 7618 } 7619 7620 if (nla[NFTA_FLOWTABLE_FLAGS]) { 7621 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 7622 if (flags & ~NFT_FLOWTABLE_MASK) { 7623 err = -EOPNOTSUPP; 7624 goto err_flowtable_update_hook; 7625 } 7626 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ 7627 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) { 7628 err = -EOPNOTSUPP; 7629 goto err_flowtable_update_hook; 7630 } 7631 } else { 7632 flags = flowtable->data.flags; 7633 } 7634 7635 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, 7636 &flowtable_hook.list, flowtable); 7637 if (err < 0) 7638 goto err_flowtable_update_hook; 7639 7640 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE, 7641 sizeof(struct nft_trans_flowtable)); 7642 if (!trans) { 7643 unregister = true; 7644 err = -ENOMEM; 7645 goto err_flowtable_update_hook; 7646 } 7647 7648 nft_trans_flowtable_flags(trans) = flags; 7649 nft_trans_flowtable(trans) = flowtable; 7650 nft_trans_flowtable_update(trans) = true; 7651 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 7652 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans)); 7653 7654 nft_trans_commit_list_add_tail(ctx->net, trans); 7655 7656 return 0; 7657 7658 err_flowtable_update_hook: 7659 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 7660 if (unregister) 7661 nft_unregister_flowtable_hook(ctx->net, flowtable, hook); 7662 list_del_rcu(&hook->list); 7663 kfree_rcu(hook, rcu); 7664 } 7665 7666 return err; 7667 7668 } 7669 7670 static int nf_tables_newflowtable(struct sk_buff *skb, 7671 const struct nfnl_info *info, 7672 const struct nlattr * const nla[]) 7673 { 7674 struct netlink_ext_ack *extack = info->extack; 7675 struct nft_flowtable_hook flowtable_hook; 7676 u8 genmask = nft_genmask_next(info->net); 7677 u8 family = info->nfmsg->nfgen_family; 7678 const struct nf_flowtable_type *type; 7679 struct nft_flowtable *flowtable; 7680 struct nft_hook *hook, *next; 7681 struct net *net = info->net; 7682 struct nft_table *table; 7683 struct nft_ctx ctx; 7684 int err; 7685 7686 if (!nla[NFTA_FLOWTABLE_TABLE] || 7687 !nla[NFTA_FLOWTABLE_NAME] || 7688 !nla[NFTA_FLOWTABLE_HOOK]) 7689 return -EINVAL; 7690 7691 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 7692 genmask, NETLINK_CB(skb).portid); 7693 if (IS_ERR(table)) { 7694 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 7695 return PTR_ERR(table); 7696 } 7697 7698 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 7699 genmask); 7700 if (IS_ERR(flowtable)) { 7701 err = PTR_ERR(flowtable); 7702 if (err != -ENOENT) { 7703 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 7704 return err; 7705 } 7706 } else { 7707 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 7708 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 7709 return -EEXIST; 7710 } 7711 7712 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7713 7714 return nft_flowtable_update(&ctx, info->nlh, flowtable); 7715 } 7716 7717 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7718 7719 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT); 7720 if (!flowtable) 7721 return -ENOMEM; 7722 7723 flowtable->table = table; 7724 flowtable->handle = nf_tables_alloc_handle(table); 7725 INIT_LIST_HEAD(&flowtable->hook_list); 7726 7727 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT); 7728 if (!flowtable->name) { 7729 err = -ENOMEM; 7730 goto err1; 7731 } 7732 7733 type = nft_flowtable_type_get(net, family); 7734 if (IS_ERR(type)) { 7735 err = PTR_ERR(type); 7736 goto err2; 7737 } 7738 7739 if (nla[NFTA_FLOWTABLE_FLAGS]) { 7740 flowtable->data.flags = 7741 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 7742 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { 7743 err = -EOPNOTSUPP; 7744 goto err3; 7745 } 7746 } 7747 7748 write_pnet(&flowtable->data.net, net); 7749 flowtable->data.type = type; 7750 err = type->init(&flowtable->data); 7751 if (err < 0) 7752 goto err3; 7753 7754 err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK], 7755 &flowtable_hook, flowtable, true); 7756 if (err < 0) 7757 goto err4; 7758 7759 list_splice(&flowtable_hook.list, &flowtable->hook_list); 7760 flowtable->data.priority = flowtable_hook.priority; 7761 flowtable->hooknum = flowtable_hook.num; 7762 7763 err = nft_register_flowtable_net_hooks(ctx.net, table, 7764 &flowtable->hook_list, 7765 flowtable); 7766 if (err < 0) { 7767 nft_flowtable_hooks_destroy(&flowtable->hook_list); 7768 goto err4; 7769 } 7770 7771 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); 7772 if (err < 0) 7773 goto err5; 7774 7775 list_add_tail_rcu(&flowtable->list, &table->flowtables); 7776 table->use++; 7777 7778 return 0; 7779 err5: 7780 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 7781 nft_unregister_flowtable_hook(net, flowtable, hook); 7782 list_del_rcu(&hook->list); 7783 kfree_rcu(hook, rcu); 7784 } 7785 err4: 7786 flowtable->data.type->free(&flowtable->data); 7787 err3: 7788 module_put(type->owner); 7789 err2: 7790 kfree(flowtable->name); 7791 err1: 7792 kfree(flowtable); 7793 return err; 7794 } 7795 7796 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook) 7797 { 7798 struct nft_hook *this, *next; 7799 7800 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) { 7801 list_del(&this->list); 7802 kfree(this); 7803 } 7804 } 7805 7806 static int nft_delflowtable_hook(struct nft_ctx *ctx, 7807 struct nft_flowtable *flowtable) 7808 { 7809 const struct nlattr * const *nla = ctx->nla; 7810 struct nft_flowtable_hook flowtable_hook; 7811 LIST_HEAD(flowtable_del_list); 7812 struct nft_hook *this, *hook; 7813 struct nft_trans *trans; 7814 int err; 7815 7816 err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK], 7817 &flowtable_hook, flowtable, false); 7818 if (err < 0) 7819 return err; 7820 7821 list_for_each_entry(this, &flowtable_hook.list, list) { 7822 hook = nft_hook_list_find(&flowtable->hook_list, this); 7823 if (!hook) { 7824 err = -ENOENT; 7825 goto err_flowtable_del_hook; 7826 } 7827 list_move(&hook->list, &flowtable_del_list); 7828 } 7829 7830 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE, 7831 sizeof(struct nft_trans_flowtable)); 7832 if (!trans) { 7833 err = -ENOMEM; 7834 goto err_flowtable_del_hook; 7835 } 7836 7837 nft_trans_flowtable(trans) = flowtable; 7838 nft_trans_flowtable_update(trans) = true; 7839 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 7840 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans)); 7841 nft_flowtable_hook_release(&flowtable_hook); 7842 7843 nft_trans_commit_list_add_tail(ctx->net, trans); 7844 7845 return 0; 7846 7847 err_flowtable_del_hook: 7848 list_splice(&flowtable_del_list, &flowtable->hook_list); 7849 nft_flowtable_hook_release(&flowtable_hook); 7850 7851 return err; 7852 } 7853 7854 static int nf_tables_delflowtable(struct sk_buff *skb, 7855 const struct nfnl_info *info, 7856 const struct nlattr * const nla[]) 7857 { 7858 struct netlink_ext_ack *extack = info->extack; 7859 u8 genmask = nft_genmask_next(info->net); 7860 u8 family = info->nfmsg->nfgen_family; 7861 struct nft_flowtable *flowtable; 7862 struct net *net = info->net; 7863 const struct nlattr *attr; 7864 struct nft_table *table; 7865 struct nft_ctx ctx; 7866 7867 if (!nla[NFTA_FLOWTABLE_TABLE] || 7868 (!nla[NFTA_FLOWTABLE_NAME] && 7869 !nla[NFTA_FLOWTABLE_HANDLE])) 7870 return -EINVAL; 7871 7872 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 7873 genmask, NETLINK_CB(skb).portid); 7874 if (IS_ERR(table)) { 7875 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 7876 return PTR_ERR(table); 7877 } 7878 7879 if (nla[NFTA_FLOWTABLE_HANDLE]) { 7880 attr = nla[NFTA_FLOWTABLE_HANDLE]; 7881 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask); 7882 } else { 7883 attr = nla[NFTA_FLOWTABLE_NAME]; 7884 flowtable = nft_flowtable_lookup(table, attr, genmask); 7885 } 7886 7887 if (IS_ERR(flowtable)) { 7888 NL_SET_BAD_ATTR(extack, attr); 7889 return PTR_ERR(flowtable); 7890 } 7891 7892 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7893 7894 if (nla[NFTA_FLOWTABLE_HOOK]) 7895 return nft_delflowtable_hook(&ctx, flowtable); 7896 7897 if (flowtable->use > 0) { 7898 NL_SET_BAD_ATTR(extack, attr); 7899 return -EBUSY; 7900 } 7901 7902 return nft_delflowtable(&ctx, flowtable); 7903 } 7904 7905 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 7906 u32 portid, u32 seq, int event, 7907 u32 flags, int family, 7908 struct nft_flowtable *flowtable, 7909 struct list_head *hook_list) 7910 { 7911 struct nlattr *nest, *nest_devs; 7912 struct nft_hook *hook; 7913 struct nlmsghdr *nlh; 7914 7915 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 7916 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 7917 NFNETLINK_V0, nft_base_seq(net)); 7918 if (!nlh) 7919 goto nla_put_failure; 7920 7921 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || 7922 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || 7923 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || 7924 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), 7925 NFTA_FLOWTABLE_PAD) || 7926 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) 7927 goto nla_put_failure; 7928 7929 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK); 7930 if (!nest) 7931 goto nla_put_failure; 7932 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || 7933 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority))) 7934 goto nla_put_failure; 7935 7936 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS); 7937 if (!nest_devs) 7938 goto nla_put_failure; 7939 7940 list_for_each_entry_rcu(hook, hook_list, list) { 7941 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name)) 7942 goto nla_put_failure; 7943 } 7944 nla_nest_end(skb, nest_devs); 7945 nla_nest_end(skb, nest); 7946 7947 nlmsg_end(skb, nlh); 7948 return 0; 7949 7950 nla_put_failure: 7951 nlmsg_trim(skb, nlh); 7952 return -1; 7953 } 7954 7955 struct nft_flowtable_filter { 7956 char *table; 7957 }; 7958 7959 static int nf_tables_dump_flowtable(struct sk_buff *skb, 7960 struct netlink_callback *cb) 7961 { 7962 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 7963 struct nft_flowtable_filter *filter = cb->data; 7964 unsigned int idx = 0, s_idx = cb->args[0]; 7965 struct net *net = sock_net(skb->sk); 7966 int family = nfmsg->nfgen_family; 7967 struct nft_flowtable *flowtable; 7968 struct nftables_pernet *nft_net; 7969 const struct nft_table *table; 7970 7971 rcu_read_lock(); 7972 nft_net = nft_pernet(net); 7973 cb->seq = READ_ONCE(nft_net->base_seq); 7974 7975 list_for_each_entry_rcu(table, &nft_net->tables, list) { 7976 if (family != NFPROTO_UNSPEC && family != table->family) 7977 continue; 7978 7979 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 7980 if (!nft_is_active(net, flowtable)) 7981 goto cont; 7982 if (idx < s_idx) 7983 goto cont; 7984 if (idx > s_idx) 7985 memset(&cb->args[1], 0, 7986 sizeof(cb->args) - sizeof(cb->args[0])); 7987 if (filter && filter->table && 7988 strcmp(filter->table, table->name)) 7989 goto cont; 7990 7991 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, 7992 cb->nlh->nlmsg_seq, 7993 NFT_MSG_NEWFLOWTABLE, 7994 NLM_F_MULTI | NLM_F_APPEND, 7995 table->family, 7996 flowtable, 7997 &flowtable->hook_list) < 0) 7998 goto done; 7999 8000 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 8001 cont: 8002 idx++; 8003 } 8004 } 8005 done: 8006 rcu_read_unlock(); 8007 8008 cb->args[0] = idx; 8009 return skb->len; 8010 } 8011 8012 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb) 8013 { 8014 const struct nlattr * const *nla = cb->data; 8015 struct nft_flowtable_filter *filter = NULL; 8016 8017 if (nla[NFTA_FLOWTABLE_TABLE]) { 8018 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 8019 if (!filter) 8020 return -ENOMEM; 8021 8022 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], 8023 GFP_ATOMIC); 8024 if (!filter->table) { 8025 kfree(filter); 8026 return -ENOMEM; 8027 } 8028 } 8029 8030 cb->data = filter; 8031 return 0; 8032 } 8033 8034 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) 8035 { 8036 struct nft_flowtable_filter *filter = cb->data; 8037 8038 if (!filter) 8039 return 0; 8040 8041 kfree(filter->table); 8042 kfree(filter); 8043 8044 return 0; 8045 } 8046 8047 /* called with rcu_read_lock held */ 8048 static int nf_tables_getflowtable(struct sk_buff *skb, 8049 const struct nfnl_info *info, 8050 const struct nlattr * const nla[]) 8051 { 8052 u8 genmask = nft_genmask_cur(info->net); 8053 u8 family = info->nfmsg->nfgen_family; 8054 struct nft_flowtable *flowtable; 8055 const struct nft_table *table; 8056 struct net *net = info->net; 8057 struct sk_buff *skb2; 8058 int err; 8059 8060 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8061 struct netlink_dump_control c = { 8062 .start = nf_tables_dump_flowtable_start, 8063 .dump = nf_tables_dump_flowtable, 8064 .done = nf_tables_dump_flowtable_done, 8065 .module = THIS_MODULE, 8066 .data = (void *)nla, 8067 }; 8068 8069 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8070 } 8071 8072 if (!nla[NFTA_FLOWTABLE_NAME]) 8073 return -EINVAL; 8074 8075 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 8076 genmask, 0); 8077 if (IS_ERR(table)) 8078 return PTR_ERR(table); 8079 8080 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME], 8081 genmask); 8082 if (IS_ERR(flowtable)) 8083 return PTR_ERR(flowtable); 8084 8085 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8086 if (!skb2) 8087 return -ENOMEM; 8088 8089 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, 8090 info->nlh->nlmsg_seq, 8091 NFT_MSG_NEWFLOWTABLE, 0, family, 8092 flowtable, &flowtable->hook_list); 8093 if (err < 0) 8094 goto err_fill_flowtable_info; 8095 8096 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 8097 8098 err_fill_flowtable_info: 8099 kfree_skb(skb2); 8100 return err; 8101 } 8102 8103 static void nf_tables_flowtable_notify(struct nft_ctx *ctx, 8104 struct nft_flowtable *flowtable, 8105 struct list_head *hook_list, 8106 int event) 8107 { 8108 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 8109 struct sk_buff *skb; 8110 u16 flags = 0; 8111 int err; 8112 8113 if (!ctx->report && 8114 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 8115 return; 8116 8117 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8118 if (skb == NULL) 8119 goto err; 8120 8121 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 8122 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 8123 8124 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, 8125 ctx->seq, event, flags, 8126 ctx->family, flowtable, hook_list); 8127 if (err < 0) { 8128 kfree_skb(skb); 8129 goto err; 8130 } 8131 8132 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 8133 return; 8134 err: 8135 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 8136 } 8137 8138 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 8139 { 8140 struct nft_hook *hook, *next; 8141 8142 flowtable->data.type->free(&flowtable->data); 8143 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 8144 flowtable->data.type->setup(&flowtable->data, hook->ops.dev, 8145 FLOW_BLOCK_UNBIND); 8146 list_del_rcu(&hook->list); 8147 kfree(hook); 8148 } 8149 kfree(flowtable->name); 8150 module_put(flowtable->data.type->owner); 8151 kfree(flowtable); 8152 } 8153 8154 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 8155 u32 portid, u32 seq) 8156 { 8157 struct nftables_pernet *nft_net = nft_pernet(net); 8158 struct nlmsghdr *nlh; 8159 char buf[TASK_COMM_LEN]; 8160 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); 8161 8162 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, 8163 NFNETLINK_V0, nft_base_seq(net)); 8164 if (!nlh) 8165 goto nla_put_failure; 8166 8167 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) || 8168 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || 8169 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) 8170 goto nla_put_failure; 8171 8172 nlmsg_end(skb, nlh); 8173 return 0; 8174 8175 nla_put_failure: 8176 nlmsg_trim(skb, nlh); 8177 return -EMSGSIZE; 8178 } 8179 8180 static void nft_flowtable_event(unsigned long event, struct net_device *dev, 8181 struct nft_flowtable *flowtable) 8182 { 8183 struct nft_hook *hook; 8184 8185 list_for_each_entry(hook, &flowtable->hook_list, list) { 8186 if (hook->ops.dev != dev) 8187 continue; 8188 8189 /* flow_offload_netdev_event() cleans up entries for us. */ 8190 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook); 8191 list_del_rcu(&hook->list); 8192 kfree_rcu(hook, rcu); 8193 break; 8194 } 8195 } 8196 8197 static int nf_tables_flowtable_event(struct notifier_block *this, 8198 unsigned long event, void *ptr) 8199 { 8200 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 8201 struct nft_flowtable *flowtable; 8202 struct nftables_pernet *nft_net; 8203 struct nft_table *table; 8204 struct net *net; 8205 8206 if (event != NETDEV_UNREGISTER) 8207 return 0; 8208 8209 net = dev_net(dev); 8210 nft_net = nft_pernet(net); 8211 mutex_lock(&nft_net->commit_mutex); 8212 list_for_each_entry(table, &nft_net->tables, list) { 8213 list_for_each_entry(flowtable, &table->flowtables, list) { 8214 nft_flowtable_event(event, dev, flowtable); 8215 } 8216 } 8217 mutex_unlock(&nft_net->commit_mutex); 8218 8219 return NOTIFY_DONE; 8220 } 8221 8222 static struct notifier_block nf_tables_flowtable_notifier = { 8223 .notifier_call = nf_tables_flowtable_event, 8224 }; 8225 8226 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, 8227 int event) 8228 { 8229 struct nlmsghdr *nlh = nlmsg_hdr(skb); 8230 struct sk_buff *skb2; 8231 int err; 8232 8233 if (!nlmsg_report(nlh) && 8234 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 8235 return; 8236 8237 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 8238 if (skb2 == NULL) 8239 goto err; 8240 8241 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 8242 nlh->nlmsg_seq); 8243 if (err < 0) { 8244 kfree_skb(skb2); 8245 goto err; 8246 } 8247 8248 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8249 nlmsg_report(nlh), GFP_KERNEL); 8250 return; 8251 err: 8252 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 8253 -ENOBUFS); 8254 } 8255 8256 static int nf_tables_getgen(struct sk_buff *skb, const struct nfnl_info *info, 8257 const struct nlattr * const nla[]) 8258 { 8259 struct sk_buff *skb2; 8260 int err; 8261 8262 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8263 if (skb2 == NULL) 8264 return -ENOMEM; 8265 8266 err = nf_tables_fill_gen_info(skb2, info->net, NETLINK_CB(skb).portid, 8267 info->nlh->nlmsg_seq); 8268 if (err < 0) 8269 goto err_fill_gen_info; 8270 8271 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 8272 8273 err_fill_gen_info: 8274 kfree_skb(skb2); 8275 return err; 8276 } 8277 8278 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 8279 [NFT_MSG_NEWTABLE] = { 8280 .call = nf_tables_newtable, 8281 .type = NFNL_CB_BATCH, 8282 .attr_count = NFTA_TABLE_MAX, 8283 .policy = nft_table_policy, 8284 }, 8285 [NFT_MSG_GETTABLE] = { 8286 .call = nf_tables_gettable, 8287 .type = NFNL_CB_RCU, 8288 .attr_count = NFTA_TABLE_MAX, 8289 .policy = nft_table_policy, 8290 }, 8291 [NFT_MSG_DELTABLE] = { 8292 .call = nf_tables_deltable, 8293 .type = NFNL_CB_BATCH, 8294 .attr_count = NFTA_TABLE_MAX, 8295 .policy = nft_table_policy, 8296 }, 8297 [NFT_MSG_NEWCHAIN] = { 8298 .call = nf_tables_newchain, 8299 .type = NFNL_CB_BATCH, 8300 .attr_count = NFTA_CHAIN_MAX, 8301 .policy = nft_chain_policy, 8302 }, 8303 [NFT_MSG_GETCHAIN] = { 8304 .call = nf_tables_getchain, 8305 .type = NFNL_CB_RCU, 8306 .attr_count = NFTA_CHAIN_MAX, 8307 .policy = nft_chain_policy, 8308 }, 8309 [NFT_MSG_DELCHAIN] = { 8310 .call = nf_tables_delchain, 8311 .type = NFNL_CB_BATCH, 8312 .attr_count = NFTA_CHAIN_MAX, 8313 .policy = nft_chain_policy, 8314 }, 8315 [NFT_MSG_NEWRULE] = { 8316 .call = nf_tables_newrule, 8317 .type = NFNL_CB_BATCH, 8318 .attr_count = NFTA_RULE_MAX, 8319 .policy = nft_rule_policy, 8320 }, 8321 [NFT_MSG_GETRULE] = { 8322 .call = nf_tables_getrule, 8323 .type = NFNL_CB_RCU, 8324 .attr_count = NFTA_RULE_MAX, 8325 .policy = nft_rule_policy, 8326 }, 8327 [NFT_MSG_GETRULE_RESET] = { 8328 .call = nf_tables_getrule, 8329 .type = NFNL_CB_RCU, 8330 .attr_count = NFTA_RULE_MAX, 8331 .policy = nft_rule_policy, 8332 }, 8333 [NFT_MSG_DELRULE] = { 8334 .call = nf_tables_delrule, 8335 .type = NFNL_CB_BATCH, 8336 .attr_count = NFTA_RULE_MAX, 8337 .policy = nft_rule_policy, 8338 }, 8339 [NFT_MSG_NEWSET] = { 8340 .call = nf_tables_newset, 8341 .type = NFNL_CB_BATCH, 8342 .attr_count = NFTA_SET_MAX, 8343 .policy = nft_set_policy, 8344 }, 8345 [NFT_MSG_GETSET] = { 8346 .call = nf_tables_getset, 8347 .type = NFNL_CB_RCU, 8348 .attr_count = NFTA_SET_MAX, 8349 .policy = nft_set_policy, 8350 }, 8351 [NFT_MSG_DELSET] = { 8352 .call = nf_tables_delset, 8353 .type = NFNL_CB_BATCH, 8354 .attr_count = NFTA_SET_MAX, 8355 .policy = nft_set_policy, 8356 }, 8357 [NFT_MSG_NEWSETELEM] = { 8358 .call = nf_tables_newsetelem, 8359 .type = NFNL_CB_BATCH, 8360 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8361 .policy = nft_set_elem_list_policy, 8362 }, 8363 [NFT_MSG_GETSETELEM] = { 8364 .call = nf_tables_getsetelem, 8365 .type = NFNL_CB_RCU, 8366 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8367 .policy = nft_set_elem_list_policy, 8368 }, 8369 [NFT_MSG_DELSETELEM] = { 8370 .call = nf_tables_delsetelem, 8371 .type = NFNL_CB_BATCH, 8372 .attr_count = NFTA_SET_ELEM_LIST_MAX, 8373 .policy = nft_set_elem_list_policy, 8374 }, 8375 [NFT_MSG_GETGEN] = { 8376 .call = nf_tables_getgen, 8377 .type = NFNL_CB_RCU, 8378 }, 8379 [NFT_MSG_NEWOBJ] = { 8380 .call = nf_tables_newobj, 8381 .type = NFNL_CB_BATCH, 8382 .attr_count = NFTA_OBJ_MAX, 8383 .policy = nft_obj_policy, 8384 }, 8385 [NFT_MSG_GETOBJ] = { 8386 .call = nf_tables_getobj, 8387 .type = NFNL_CB_RCU, 8388 .attr_count = NFTA_OBJ_MAX, 8389 .policy = nft_obj_policy, 8390 }, 8391 [NFT_MSG_DELOBJ] = { 8392 .call = nf_tables_delobj, 8393 .type = NFNL_CB_BATCH, 8394 .attr_count = NFTA_OBJ_MAX, 8395 .policy = nft_obj_policy, 8396 }, 8397 [NFT_MSG_GETOBJ_RESET] = { 8398 .call = nf_tables_getobj, 8399 .type = NFNL_CB_RCU, 8400 .attr_count = NFTA_OBJ_MAX, 8401 .policy = nft_obj_policy, 8402 }, 8403 [NFT_MSG_NEWFLOWTABLE] = { 8404 .call = nf_tables_newflowtable, 8405 .type = NFNL_CB_BATCH, 8406 .attr_count = NFTA_FLOWTABLE_MAX, 8407 .policy = nft_flowtable_policy, 8408 }, 8409 [NFT_MSG_GETFLOWTABLE] = { 8410 .call = nf_tables_getflowtable, 8411 .type = NFNL_CB_RCU, 8412 .attr_count = NFTA_FLOWTABLE_MAX, 8413 .policy = nft_flowtable_policy, 8414 }, 8415 [NFT_MSG_DELFLOWTABLE] = { 8416 .call = nf_tables_delflowtable, 8417 .type = NFNL_CB_BATCH, 8418 .attr_count = NFTA_FLOWTABLE_MAX, 8419 .policy = nft_flowtable_policy, 8420 }, 8421 }; 8422 8423 static int nf_tables_validate(struct net *net) 8424 { 8425 struct nftables_pernet *nft_net = nft_pernet(net); 8426 struct nft_table *table; 8427 8428 switch (nft_net->validate_state) { 8429 case NFT_VALIDATE_SKIP: 8430 break; 8431 case NFT_VALIDATE_NEED: 8432 nft_validate_state_update(net, NFT_VALIDATE_DO); 8433 fallthrough; 8434 case NFT_VALIDATE_DO: 8435 list_for_each_entry(table, &nft_net->tables, list) { 8436 if (nft_table_validate(net, table) < 0) 8437 return -EAGAIN; 8438 } 8439 break; 8440 } 8441 8442 return 0; 8443 } 8444 8445 /* a drop policy has to be deferred until all rules have been activated, 8446 * otherwise a large ruleset that contains a drop-policy base chain will 8447 * cause all packets to get dropped until the full transaction has been 8448 * processed. 8449 * 8450 * We defer the drop policy until the transaction has been finalized. 8451 */ 8452 static void nft_chain_commit_drop_policy(struct nft_trans *trans) 8453 { 8454 struct nft_base_chain *basechain; 8455 8456 if (nft_trans_chain_policy(trans) != NF_DROP) 8457 return; 8458 8459 if (!nft_is_base_chain(trans->ctx.chain)) 8460 return; 8461 8462 basechain = nft_base_chain(trans->ctx.chain); 8463 basechain->policy = NF_DROP; 8464 } 8465 8466 static void nft_chain_commit_update(struct nft_trans *trans) 8467 { 8468 struct nft_base_chain *basechain; 8469 8470 if (nft_trans_chain_name(trans)) { 8471 rhltable_remove(&trans->ctx.table->chains_ht, 8472 &trans->ctx.chain->rhlhead, 8473 nft_chain_ht_params); 8474 swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); 8475 rhltable_insert_key(&trans->ctx.table->chains_ht, 8476 trans->ctx.chain->name, 8477 &trans->ctx.chain->rhlhead, 8478 nft_chain_ht_params); 8479 } 8480 8481 if (!nft_is_base_chain(trans->ctx.chain)) 8482 return; 8483 8484 nft_chain_stats_replace(trans); 8485 8486 basechain = nft_base_chain(trans->ctx.chain); 8487 8488 switch (nft_trans_chain_policy(trans)) { 8489 case NF_DROP: 8490 case NF_ACCEPT: 8491 basechain->policy = nft_trans_chain_policy(trans); 8492 break; 8493 } 8494 } 8495 8496 static void nft_obj_commit_update(struct nft_trans *trans) 8497 { 8498 struct nft_object *newobj; 8499 struct nft_object *obj; 8500 8501 obj = nft_trans_obj(trans); 8502 newobj = nft_trans_obj_newobj(trans); 8503 8504 if (obj->ops->update) 8505 obj->ops->update(obj, newobj); 8506 8507 nft_obj_destroy(&trans->ctx, newobj); 8508 } 8509 8510 static void nft_commit_release(struct nft_trans *trans) 8511 { 8512 switch (trans->msg_type) { 8513 case NFT_MSG_DELTABLE: 8514 nf_tables_table_destroy(&trans->ctx); 8515 break; 8516 case NFT_MSG_NEWCHAIN: 8517 free_percpu(nft_trans_chain_stats(trans)); 8518 kfree(nft_trans_chain_name(trans)); 8519 break; 8520 case NFT_MSG_DELCHAIN: 8521 nf_tables_chain_destroy(&trans->ctx); 8522 break; 8523 case NFT_MSG_DELRULE: 8524 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 8525 break; 8526 case NFT_MSG_DELSET: 8527 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 8528 break; 8529 case NFT_MSG_DELSETELEM: 8530 nf_tables_set_elem_destroy(&trans->ctx, 8531 nft_trans_elem_set(trans), 8532 nft_trans_elem(trans).priv); 8533 break; 8534 case NFT_MSG_DELOBJ: 8535 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 8536 break; 8537 case NFT_MSG_DELFLOWTABLE: 8538 if (nft_trans_flowtable_update(trans)) 8539 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 8540 else 8541 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 8542 break; 8543 } 8544 8545 if (trans->put_net) 8546 put_net(trans->ctx.net); 8547 8548 kfree(trans); 8549 } 8550 8551 static void nf_tables_trans_destroy_work(struct work_struct *w) 8552 { 8553 struct nft_trans *trans, *next; 8554 LIST_HEAD(head); 8555 8556 spin_lock(&nf_tables_destroy_list_lock); 8557 list_splice_init(&nf_tables_destroy_list, &head); 8558 spin_unlock(&nf_tables_destroy_list_lock); 8559 8560 if (list_empty(&head)) 8561 return; 8562 8563 synchronize_rcu(); 8564 8565 list_for_each_entry_safe(trans, next, &head, list) { 8566 list_del(&trans->list); 8567 nft_commit_release(trans); 8568 } 8569 } 8570 8571 void nf_tables_trans_destroy_flush_work(void) 8572 { 8573 flush_work(&trans_destroy_work); 8574 } 8575 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); 8576 8577 static bool nft_expr_reduce(struct nft_regs_track *track, 8578 const struct nft_expr *expr) 8579 { 8580 return false; 8581 } 8582 8583 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain) 8584 { 8585 const struct nft_expr *expr, *last; 8586 struct nft_regs_track track = {}; 8587 unsigned int size, data_size; 8588 void *data, *data_boundary; 8589 struct nft_rule_dp *prule; 8590 struct nft_rule *rule; 8591 8592 /* already handled or inactive chain? */ 8593 if (chain->blob_next || !nft_is_active_next(net, chain)) 8594 return 0; 8595 8596 data_size = 0; 8597 list_for_each_entry(rule, &chain->rules, list) { 8598 if (nft_is_active_next(net, rule)) { 8599 data_size += sizeof(*prule) + rule->dlen; 8600 if (data_size > INT_MAX) 8601 return -ENOMEM; 8602 } 8603 } 8604 data_size += offsetof(struct nft_rule_dp, data); /* last rule */ 8605 8606 chain->blob_next = nf_tables_chain_alloc_rules(data_size); 8607 if (!chain->blob_next) 8608 return -ENOMEM; 8609 8610 data = (void *)chain->blob_next->data; 8611 data_boundary = data + data_size; 8612 size = 0; 8613 8614 list_for_each_entry(rule, &chain->rules, list) { 8615 if (!nft_is_active_next(net, rule)) 8616 continue; 8617 8618 prule = (struct nft_rule_dp *)data; 8619 data += offsetof(struct nft_rule_dp, data); 8620 if (WARN_ON_ONCE(data > data_boundary)) 8621 return -ENOMEM; 8622 8623 size = 0; 8624 track.last = nft_expr_last(rule); 8625 nft_rule_for_each_expr(expr, last, rule) { 8626 track.cur = expr; 8627 8628 if (nft_expr_reduce(&track, expr)) { 8629 expr = track.cur; 8630 continue; 8631 } 8632 8633 if (WARN_ON_ONCE(data + expr->ops->size > data_boundary)) 8634 return -ENOMEM; 8635 8636 memcpy(data + size, expr, expr->ops->size); 8637 size += expr->ops->size; 8638 } 8639 if (WARN_ON_ONCE(size >= 1 << 12)) 8640 return -ENOMEM; 8641 8642 prule->handle = rule->handle; 8643 prule->dlen = size; 8644 prule->is_last = 0; 8645 8646 data += size; 8647 size = 0; 8648 chain->blob_next->size += (unsigned long)(data - (void *)prule); 8649 } 8650 8651 prule = (struct nft_rule_dp *)data; 8652 data += offsetof(struct nft_rule_dp, data); 8653 if (WARN_ON_ONCE(data > data_boundary)) 8654 return -ENOMEM; 8655 8656 nft_last_rule(chain->blob_next, prule); 8657 8658 return 0; 8659 } 8660 8661 static void nf_tables_commit_chain_prepare_cancel(struct net *net) 8662 { 8663 struct nftables_pernet *nft_net = nft_pernet(net); 8664 struct nft_trans *trans, *next; 8665 8666 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 8667 struct nft_chain *chain = trans->ctx.chain; 8668 8669 if (trans->msg_type == NFT_MSG_NEWRULE || 8670 trans->msg_type == NFT_MSG_DELRULE) { 8671 kvfree(chain->blob_next); 8672 chain->blob_next = NULL; 8673 } 8674 } 8675 } 8676 8677 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h) 8678 { 8679 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h); 8680 8681 kvfree(o->blob); 8682 } 8683 8684 static void nf_tables_commit_chain_free_rules_old(struct nft_rule_blob *blob) 8685 { 8686 struct nft_rules_old *old; 8687 8688 /* rcu_head is after end marker */ 8689 old = (void *)blob + sizeof(*blob) + blob->size; 8690 old->blob = blob; 8691 8692 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old); 8693 } 8694 8695 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain) 8696 { 8697 struct nft_rule_blob *g0, *g1; 8698 bool next_genbit; 8699 8700 next_genbit = nft_gencursor_next(net); 8701 8702 g0 = rcu_dereference_protected(chain->blob_gen_0, 8703 lockdep_commit_lock_is_held(net)); 8704 g1 = rcu_dereference_protected(chain->blob_gen_1, 8705 lockdep_commit_lock_is_held(net)); 8706 8707 /* No changes to this chain? */ 8708 if (chain->blob_next == NULL) { 8709 /* chain had no change in last or next generation */ 8710 if (g0 == g1) 8711 return; 8712 /* 8713 * chain had no change in this generation; make sure next 8714 * one uses same rules as current generation. 8715 */ 8716 if (next_genbit) { 8717 rcu_assign_pointer(chain->blob_gen_1, g0); 8718 nf_tables_commit_chain_free_rules_old(g1); 8719 } else { 8720 rcu_assign_pointer(chain->blob_gen_0, g1); 8721 nf_tables_commit_chain_free_rules_old(g0); 8722 } 8723 8724 return; 8725 } 8726 8727 if (next_genbit) 8728 rcu_assign_pointer(chain->blob_gen_1, chain->blob_next); 8729 else 8730 rcu_assign_pointer(chain->blob_gen_0, chain->blob_next); 8731 8732 chain->blob_next = NULL; 8733 8734 if (g0 == g1) 8735 return; 8736 8737 if (next_genbit) 8738 nf_tables_commit_chain_free_rules_old(g1); 8739 else 8740 nf_tables_commit_chain_free_rules_old(g0); 8741 } 8742 8743 static void nft_obj_del(struct nft_object *obj) 8744 { 8745 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params); 8746 list_del_rcu(&obj->list); 8747 } 8748 8749 void nft_chain_del(struct nft_chain *chain) 8750 { 8751 struct nft_table *table = chain->table; 8752 8753 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead, 8754 nft_chain_ht_params)); 8755 list_del_rcu(&chain->list); 8756 } 8757 8758 static void nf_tables_module_autoload_cleanup(struct net *net) 8759 { 8760 struct nftables_pernet *nft_net = nft_pernet(net); 8761 struct nft_module_request *req, *next; 8762 8763 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 8764 list_for_each_entry_safe(req, next, &nft_net->module_list, list) { 8765 WARN_ON_ONCE(!req->done); 8766 list_del(&req->list); 8767 kfree(req); 8768 } 8769 } 8770 8771 static void nf_tables_commit_release(struct net *net) 8772 { 8773 struct nftables_pernet *nft_net = nft_pernet(net); 8774 struct nft_trans *trans; 8775 8776 /* all side effects have to be made visible. 8777 * For example, if a chain named 'foo' has been deleted, a 8778 * new transaction must not find it anymore. 8779 * 8780 * Memory reclaim happens asynchronously from work queue 8781 * to prevent expensive synchronize_rcu() in commit phase. 8782 */ 8783 if (list_empty(&nft_net->commit_list)) { 8784 nf_tables_module_autoload_cleanup(net); 8785 mutex_unlock(&nft_net->commit_mutex); 8786 return; 8787 } 8788 8789 trans = list_last_entry(&nft_net->commit_list, 8790 struct nft_trans, list); 8791 get_net(trans->ctx.net); 8792 WARN_ON_ONCE(trans->put_net); 8793 8794 trans->put_net = true; 8795 spin_lock(&nf_tables_destroy_list_lock); 8796 list_splice_tail_init(&nft_net->commit_list, &nf_tables_destroy_list); 8797 spin_unlock(&nf_tables_destroy_list_lock); 8798 8799 nf_tables_module_autoload_cleanup(net); 8800 schedule_work(&trans_destroy_work); 8801 8802 mutex_unlock(&nft_net->commit_mutex); 8803 } 8804 8805 static void nft_commit_notify(struct net *net, u32 portid) 8806 { 8807 struct nftables_pernet *nft_net = nft_pernet(net); 8808 struct sk_buff *batch_skb = NULL, *nskb, *skb; 8809 unsigned char *data; 8810 int len; 8811 8812 list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) { 8813 if (!batch_skb) { 8814 new_batch: 8815 batch_skb = skb; 8816 len = NLMSG_GOODSIZE - skb->len; 8817 list_del(&skb->list); 8818 continue; 8819 } 8820 len -= skb->len; 8821 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) { 8822 data = skb_put(batch_skb, skb->len); 8823 memcpy(data, skb->data, skb->len); 8824 list_del(&skb->list); 8825 kfree_skb(skb); 8826 continue; 8827 } 8828 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 8829 NFT_CB(batch_skb).report, GFP_KERNEL); 8830 goto new_batch; 8831 } 8832 8833 if (batch_skb) { 8834 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 8835 NFT_CB(batch_skb).report, GFP_KERNEL); 8836 } 8837 8838 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 8839 } 8840 8841 static int nf_tables_commit_audit_alloc(struct list_head *adl, 8842 struct nft_table *table) 8843 { 8844 struct nft_audit_data *adp; 8845 8846 list_for_each_entry(adp, adl, list) { 8847 if (adp->table == table) 8848 return 0; 8849 } 8850 adp = kzalloc(sizeof(*adp), GFP_KERNEL); 8851 if (!adp) 8852 return -ENOMEM; 8853 adp->table = table; 8854 list_add(&adp->list, adl); 8855 return 0; 8856 } 8857 8858 static void nf_tables_commit_audit_free(struct list_head *adl) 8859 { 8860 struct nft_audit_data *adp, *adn; 8861 8862 list_for_each_entry_safe(adp, adn, adl, list) { 8863 list_del(&adp->list); 8864 kfree(adp); 8865 } 8866 } 8867 8868 static void nf_tables_commit_audit_collect(struct list_head *adl, 8869 struct nft_table *table, u32 op) 8870 { 8871 struct nft_audit_data *adp; 8872 8873 list_for_each_entry(adp, adl, list) { 8874 if (adp->table == table) 8875 goto found; 8876 } 8877 WARN_ONCE(1, "table=%s not expected in commit list", table->name); 8878 return; 8879 found: 8880 adp->entries++; 8881 if (!adp->op || adp->op > op) 8882 adp->op = op; 8883 } 8884 8885 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22) 8886 8887 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation) 8888 { 8889 struct nft_audit_data *adp, *adn; 8890 char aubuf[AUNFTABLENAMELEN]; 8891 8892 list_for_each_entry_safe(adp, adn, adl, list) { 8893 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name, 8894 generation); 8895 audit_log_nfcfg(aubuf, adp->table->family, adp->entries, 8896 nft2audit_op[adp->op], GFP_KERNEL); 8897 list_del(&adp->list); 8898 kfree(adp); 8899 } 8900 } 8901 8902 static int nf_tables_commit(struct net *net, struct sk_buff *skb) 8903 { 8904 struct nftables_pernet *nft_net = nft_pernet(net); 8905 struct nft_trans *trans, *next; 8906 struct nft_trans_elem *te; 8907 struct nft_chain *chain; 8908 struct nft_table *table; 8909 unsigned int base_seq; 8910 LIST_HEAD(adl); 8911 int err; 8912 8913 if (list_empty(&nft_net->commit_list)) { 8914 mutex_unlock(&nft_net->commit_mutex); 8915 return 0; 8916 } 8917 8918 /* 0. Validate ruleset, otherwise roll back for error reporting. */ 8919 if (nf_tables_validate(net) < 0) 8920 return -EAGAIN; 8921 8922 err = nft_flow_rule_offload_commit(net); 8923 if (err < 0) 8924 return err; 8925 8926 /* 1. Allocate space for next generation rules_gen_X[] */ 8927 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 8928 int ret; 8929 8930 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); 8931 if (ret) { 8932 nf_tables_commit_chain_prepare_cancel(net); 8933 nf_tables_commit_audit_free(&adl); 8934 return ret; 8935 } 8936 if (trans->msg_type == NFT_MSG_NEWRULE || 8937 trans->msg_type == NFT_MSG_DELRULE) { 8938 chain = trans->ctx.chain; 8939 8940 ret = nf_tables_commit_chain_prepare(net, chain); 8941 if (ret < 0) { 8942 nf_tables_commit_chain_prepare_cancel(net); 8943 nf_tables_commit_audit_free(&adl); 8944 return ret; 8945 } 8946 } 8947 } 8948 8949 /* step 2. Make rules_gen_X visible to packet path */ 8950 list_for_each_entry(table, &nft_net->tables, list) { 8951 list_for_each_entry(chain, &table->chains, list) 8952 nf_tables_commit_chain(net, chain); 8953 } 8954 8955 /* 8956 * Bump generation counter, invalidate any dump in progress. 8957 * Cannot fail after this point. 8958 */ 8959 base_seq = READ_ONCE(nft_net->base_seq); 8960 while (++base_seq == 0) 8961 ; 8962 8963 WRITE_ONCE(nft_net->base_seq, base_seq); 8964 8965 /* step 3. Start new generation, rules_gen_X now in use. */ 8966 net->nft.gencursor = nft_gencursor_next(net); 8967 8968 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 8969 nf_tables_commit_audit_collect(&adl, trans->ctx.table, 8970 trans->msg_type); 8971 switch (trans->msg_type) { 8972 case NFT_MSG_NEWTABLE: 8973 if (nft_trans_table_update(trans)) { 8974 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 8975 nft_trans_destroy(trans); 8976 break; 8977 } 8978 if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT) 8979 nf_tables_table_disable(net, trans->ctx.table); 8980 8981 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 8982 } else { 8983 nft_clear(net, trans->ctx.table); 8984 } 8985 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE); 8986 nft_trans_destroy(trans); 8987 break; 8988 case NFT_MSG_DELTABLE: 8989 list_del_rcu(&trans->ctx.table->list); 8990 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE); 8991 break; 8992 case NFT_MSG_NEWCHAIN: 8993 if (nft_trans_chain_update(trans)) { 8994 nft_chain_commit_update(trans); 8995 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN); 8996 /* trans destroyed after rcu grace period */ 8997 } else { 8998 nft_chain_commit_drop_policy(trans); 8999 nft_clear(net, trans->ctx.chain); 9000 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN); 9001 nft_trans_destroy(trans); 9002 } 9003 break; 9004 case NFT_MSG_DELCHAIN: 9005 nft_chain_del(trans->ctx.chain); 9006 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN); 9007 nf_tables_unregister_hook(trans->ctx.net, 9008 trans->ctx.table, 9009 trans->ctx.chain); 9010 break; 9011 case NFT_MSG_NEWRULE: 9012 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 9013 nf_tables_rule_notify(&trans->ctx, 9014 nft_trans_rule(trans), 9015 NFT_MSG_NEWRULE); 9016 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9017 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9018 9019 nft_trans_destroy(trans); 9020 break; 9021 case NFT_MSG_DELRULE: 9022 list_del_rcu(&nft_trans_rule(trans)->list); 9023 nf_tables_rule_notify(&trans->ctx, 9024 nft_trans_rule(trans), 9025 NFT_MSG_DELRULE); 9026 nft_rule_expr_deactivate(&trans->ctx, 9027 nft_trans_rule(trans), 9028 NFT_TRANS_COMMIT); 9029 9030 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9031 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9032 break; 9033 case NFT_MSG_NEWSET: 9034 nft_clear(net, nft_trans_set(trans)); 9035 /* This avoids hitting -EBUSY when deleting the table 9036 * from the transaction. 9037 */ 9038 if (nft_set_is_anonymous(nft_trans_set(trans)) && 9039 !list_empty(&nft_trans_set(trans)->bindings)) 9040 trans->ctx.table->use--; 9041 9042 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 9043 NFT_MSG_NEWSET, GFP_KERNEL); 9044 nft_trans_destroy(trans); 9045 break; 9046 case NFT_MSG_DELSET: 9047 list_del_rcu(&nft_trans_set(trans)->list); 9048 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans), 9049 NFT_MSG_DELSET, GFP_KERNEL); 9050 break; 9051 case NFT_MSG_NEWSETELEM: 9052 te = (struct nft_trans_elem *)trans->data; 9053 9054 nft_setelem_activate(net, te->set, &te->elem); 9055 nf_tables_setelem_notify(&trans->ctx, te->set, 9056 &te->elem, 9057 NFT_MSG_NEWSETELEM); 9058 nft_trans_destroy(trans); 9059 break; 9060 case NFT_MSG_DELSETELEM: 9061 te = (struct nft_trans_elem *)trans->data; 9062 9063 nf_tables_setelem_notify(&trans->ctx, te->set, 9064 &te->elem, 9065 NFT_MSG_DELSETELEM); 9066 nft_setelem_remove(net, te->set, &te->elem); 9067 if (!nft_setelem_is_catchall(te->set, &te->elem)) { 9068 atomic_dec(&te->set->nelems); 9069 te->set->ndeact--; 9070 } 9071 break; 9072 case NFT_MSG_NEWOBJ: 9073 if (nft_trans_obj_update(trans)) { 9074 nft_obj_commit_update(trans); 9075 nf_tables_obj_notify(&trans->ctx, 9076 nft_trans_obj(trans), 9077 NFT_MSG_NEWOBJ); 9078 } else { 9079 nft_clear(net, nft_trans_obj(trans)); 9080 nf_tables_obj_notify(&trans->ctx, 9081 nft_trans_obj(trans), 9082 NFT_MSG_NEWOBJ); 9083 nft_trans_destroy(trans); 9084 } 9085 break; 9086 case NFT_MSG_DELOBJ: 9087 nft_obj_del(nft_trans_obj(trans)); 9088 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans), 9089 NFT_MSG_DELOBJ); 9090 break; 9091 case NFT_MSG_NEWFLOWTABLE: 9092 if (nft_trans_flowtable_update(trans)) { 9093 nft_trans_flowtable(trans)->data.flags = 9094 nft_trans_flowtable_flags(trans); 9095 nf_tables_flowtable_notify(&trans->ctx, 9096 nft_trans_flowtable(trans), 9097 &nft_trans_flowtable_hooks(trans), 9098 NFT_MSG_NEWFLOWTABLE); 9099 list_splice(&nft_trans_flowtable_hooks(trans), 9100 &nft_trans_flowtable(trans)->hook_list); 9101 } else { 9102 nft_clear(net, nft_trans_flowtable(trans)); 9103 nf_tables_flowtable_notify(&trans->ctx, 9104 nft_trans_flowtable(trans), 9105 &nft_trans_flowtable(trans)->hook_list, 9106 NFT_MSG_NEWFLOWTABLE); 9107 } 9108 nft_trans_destroy(trans); 9109 break; 9110 case NFT_MSG_DELFLOWTABLE: 9111 if (nft_trans_flowtable_update(trans)) { 9112 nf_tables_flowtable_notify(&trans->ctx, 9113 nft_trans_flowtable(trans), 9114 &nft_trans_flowtable_hooks(trans), 9115 NFT_MSG_DELFLOWTABLE); 9116 nft_unregister_flowtable_net_hooks(net, 9117 &nft_trans_flowtable_hooks(trans)); 9118 } else { 9119 list_del_rcu(&nft_trans_flowtable(trans)->list); 9120 nf_tables_flowtable_notify(&trans->ctx, 9121 nft_trans_flowtable(trans), 9122 &nft_trans_flowtable(trans)->hook_list, 9123 NFT_MSG_DELFLOWTABLE); 9124 nft_unregister_flowtable_net_hooks(net, 9125 &nft_trans_flowtable(trans)->hook_list); 9126 } 9127 break; 9128 } 9129 } 9130 9131 nft_commit_notify(net, NETLINK_CB(skb).portid); 9132 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 9133 nf_tables_commit_audit_log(&adl, nft_net->base_seq); 9134 nf_tables_commit_release(net); 9135 9136 return 0; 9137 } 9138 9139 static void nf_tables_module_autoload(struct net *net) 9140 { 9141 struct nftables_pernet *nft_net = nft_pernet(net); 9142 struct nft_module_request *req, *next; 9143 LIST_HEAD(module_list); 9144 9145 list_splice_init(&nft_net->module_list, &module_list); 9146 mutex_unlock(&nft_net->commit_mutex); 9147 list_for_each_entry_safe(req, next, &module_list, list) { 9148 request_module("%s", req->module); 9149 req->done = true; 9150 } 9151 mutex_lock(&nft_net->commit_mutex); 9152 list_splice(&module_list, &nft_net->module_list); 9153 } 9154 9155 static void nf_tables_abort_release(struct nft_trans *trans) 9156 { 9157 switch (trans->msg_type) { 9158 case NFT_MSG_NEWTABLE: 9159 nf_tables_table_destroy(&trans->ctx); 9160 break; 9161 case NFT_MSG_NEWCHAIN: 9162 nf_tables_chain_destroy(&trans->ctx); 9163 break; 9164 case NFT_MSG_NEWRULE: 9165 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); 9166 break; 9167 case NFT_MSG_NEWSET: 9168 nft_set_destroy(&trans->ctx, nft_trans_set(trans)); 9169 break; 9170 case NFT_MSG_NEWSETELEM: 9171 nft_set_elem_destroy(nft_trans_elem_set(trans), 9172 nft_trans_elem(trans).priv, true); 9173 break; 9174 case NFT_MSG_NEWOBJ: 9175 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans)); 9176 break; 9177 case NFT_MSG_NEWFLOWTABLE: 9178 if (nft_trans_flowtable_update(trans)) 9179 nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 9180 else 9181 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 9182 break; 9183 } 9184 kfree(trans); 9185 } 9186 9187 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 9188 { 9189 struct nftables_pernet *nft_net = nft_pernet(net); 9190 struct nft_trans *trans, *next; 9191 struct nft_trans_elem *te; 9192 9193 if (action == NFNL_ABORT_VALIDATE && 9194 nf_tables_validate(net) < 0) 9195 return -EAGAIN; 9196 9197 list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, 9198 list) { 9199 switch (trans->msg_type) { 9200 case NFT_MSG_NEWTABLE: 9201 if (nft_trans_table_update(trans)) { 9202 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) { 9203 nft_trans_destroy(trans); 9204 break; 9205 } 9206 if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) { 9207 nf_tables_table_disable(net, trans->ctx.table); 9208 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT; 9209 } else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) { 9210 trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT; 9211 } 9212 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE; 9213 nft_trans_destroy(trans); 9214 } else { 9215 list_del_rcu(&trans->ctx.table->list); 9216 } 9217 break; 9218 case NFT_MSG_DELTABLE: 9219 nft_clear(trans->ctx.net, trans->ctx.table); 9220 nft_trans_destroy(trans); 9221 break; 9222 case NFT_MSG_NEWCHAIN: 9223 if (nft_trans_chain_update(trans)) { 9224 free_percpu(nft_trans_chain_stats(trans)); 9225 kfree(nft_trans_chain_name(trans)); 9226 nft_trans_destroy(trans); 9227 } else { 9228 if (nft_chain_is_bound(trans->ctx.chain)) { 9229 nft_trans_destroy(trans); 9230 break; 9231 } 9232 trans->ctx.table->use--; 9233 nft_chain_del(trans->ctx.chain); 9234 nf_tables_unregister_hook(trans->ctx.net, 9235 trans->ctx.table, 9236 trans->ctx.chain); 9237 } 9238 break; 9239 case NFT_MSG_DELCHAIN: 9240 trans->ctx.table->use++; 9241 nft_clear(trans->ctx.net, trans->ctx.chain); 9242 nft_trans_destroy(trans); 9243 break; 9244 case NFT_MSG_NEWRULE: 9245 trans->ctx.chain->use--; 9246 list_del_rcu(&nft_trans_rule(trans)->list); 9247 nft_rule_expr_deactivate(&trans->ctx, 9248 nft_trans_rule(trans), 9249 NFT_TRANS_ABORT); 9250 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9251 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9252 break; 9253 case NFT_MSG_DELRULE: 9254 trans->ctx.chain->use++; 9255 nft_clear(trans->ctx.net, nft_trans_rule(trans)); 9256 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans)); 9257 if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) 9258 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 9259 9260 nft_trans_destroy(trans); 9261 break; 9262 case NFT_MSG_NEWSET: 9263 trans->ctx.table->use--; 9264 if (nft_trans_set_bound(trans)) { 9265 nft_trans_destroy(trans); 9266 break; 9267 } 9268 list_del_rcu(&nft_trans_set(trans)->list); 9269 break; 9270 case NFT_MSG_DELSET: 9271 trans->ctx.table->use++; 9272 nft_clear(trans->ctx.net, nft_trans_set(trans)); 9273 nft_trans_destroy(trans); 9274 break; 9275 case NFT_MSG_NEWSETELEM: 9276 if (nft_trans_elem_set_bound(trans)) { 9277 nft_trans_destroy(trans); 9278 break; 9279 } 9280 te = (struct nft_trans_elem *)trans->data; 9281 nft_setelem_remove(net, te->set, &te->elem); 9282 if (!nft_setelem_is_catchall(te->set, &te->elem)) 9283 atomic_dec(&te->set->nelems); 9284 break; 9285 case NFT_MSG_DELSETELEM: 9286 te = (struct nft_trans_elem *)trans->data; 9287 9288 nft_setelem_data_activate(net, te->set, &te->elem); 9289 nft_setelem_activate(net, te->set, &te->elem); 9290 if (!nft_setelem_is_catchall(te->set, &te->elem)) 9291 te->set->ndeact--; 9292 9293 nft_trans_destroy(trans); 9294 break; 9295 case NFT_MSG_NEWOBJ: 9296 if (nft_trans_obj_update(trans)) { 9297 nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); 9298 nft_trans_destroy(trans); 9299 } else { 9300 trans->ctx.table->use--; 9301 nft_obj_del(nft_trans_obj(trans)); 9302 } 9303 break; 9304 case NFT_MSG_DELOBJ: 9305 trans->ctx.table->use++; 9306 nft_clear(trans->ctx.net, nft_trans_obj(trans)); 9307 nft_trans_destroy(trans); 9308 break; 9309 case NFT_MSG_NEWFLOWTABLE: 9310 if (nft_trans_flowtable_update(trans)) { 9311 nft_unregister_flowtable_net_hooks(net, 9312 &nft_trans_flowtable_hooks(trans)); 9313 } else { 9314 trans->ctx.table->use--; 9315 list_del_rcu(&nft_trans_flowtable(trans)->list); 9316 nft_unregister_flowtable_net_hooks(net, 9317 &nft_trans_flowtable(trans)->hook_list); 9318 } 9319 break; 9320 case NFT_MSG_DELFLOWTABLE: 9321 if (nft_trans_flowtable_update(trans)) { 9322 list_splice(&nft_trans_flowtable_hooks(trans), 9323 &nft_trans_flowtable(trans)->hook_list); 9324 } else { 9325 trans->ctx.table->use++; 9326 nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); 9327 } 9328 nft_trans_destroy(trans); 9329 break; 9330 } 9331 } 9332 9333 synchronize_rcu(); 9334 9335 list_for_each_entry_safe_reverse(trans, next, 9336 &nft_net->commit_list, list) { 9337 list_del(&trans->list); 9338 nf_tables_abort_release(trans); 9339 } 9340 9341 if (action == NFNL_ABORT_AUTOLOAD) 9342 nf_tables_module_autoload(net); 9343 else 9344 nf_tables_module_autoload_cleanup(net); 9345 9346 return 0; 9347 } 9348 9349 static void nf_tables_cleanup(struct net *net) 9350 { 9351 nft_validate_state_update(net, NFT_VALIDATE_SKIP); 9352 } 9353 9354 static int nf_tables_abort(struct net *net, struct sk_buff *skb, 9355 enum nfnl_abort_action action) 9356 { 9357 struct nftables_pernet *nft_net = nft_pernet(net); 9358 int ret = __nf_tables_abort(net, action); 9359 9360 mutex_unlock(&nft_net->commit_mutex); 9361 9362 return ret; 9363 } 9364 9365 static bool nf_tables_valid_genid(struct net *net, u32 genid) 9366 { 9367 struct nftables_pernet *nft_net = nft_pernet(net); 9368 bool genid_ok; 9369 9370 mutex_lock(&nft_net->commit_mutex); 9371 9372 genid_ok = genid == 0 || nft_net->base_seq == genid; 9373 if (!genid_ok) 9374 mutex_unlock(&nft_net->commit_mutex); 9375 9376 /* else, commit mutex has to be released by commit or abort function */ 9377 return genid_ok; 9378 } 9379 9380 static const struct nfnetlink_subsystem nf_tables_subsys = { 9381 .name = "nf_tables", 9382 .subsys_id = NFNL_SUBSYS_NFTABLES, 9383 .cb_count = NFT_MSG_MAX, 9384 .cb = nf_tables_cb, 9385 .commit = nf_tables_commit, 9386 .abort = nf_tables_abort, 9387 .cleanup = nf_tables_cleanup, 9388 .valid_genid = nf_tables_valid_genid, 9389 .owner = THIS_MODULE, 9390 }; 9391 9392 int nft_chain_validate_dependency(const struct nft_chain *chain, 9393 enum nft_chain_types type) 9394 { 9395 const struct nft_base_chain *basechain; 9396 9397 if (nft_is_base_chain(chain)) { 9398 basechain = nft_base_chain(chain); 9399 if (basechain->type->type != type) 9400 return -EOPNOTSUPP; 9401 } 9402 return 0; 9403 } 9404 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 9405 9406 int nft_chain_validate_hooks(const struct nft_chain *chain, 9407 unsigned int hook_flags) 9408 { 9409 struct nft_base_chain *basechain; 9410 9411 if (nft_is_base_chain(chain)) { 9412 basechain = nft_base_chain(chain); 9413 9414 if ((1 << basechain->ops.hooknum) & hook_flags) 9415 return 0; 9416 9417 return -EOPNOTSUPP; 9418 } 9419 9420 return 0; 9421 } 9422 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 9423 9424 /* 9425 * Loop detection - walk through the ruleset beginning at the destination chain 9426 * of a new jump until either the source chain is reached (loop) or all 9427 * reachable chains have been traversed. 9428 * 9429 * The loop check is performed whenever a new jump verdict is added to an 9430 * expression or verdict map or a verdict map is bound to a new chain. 9431 */ 9432 9433 static int nf_tables_check_loops(const struct nft_ctx *ctx, 9434 const struct nft_chain *chain); 9435 9436 static int nft_check_loops(const struct nft_ctx *ctx, 9437 const struct nft_set_ext *ext) 9438 { 9439 const struct nft_data *data; 9440 int ret; 9441 9442 data = nft_set_ext_data(ext); 9443 switch (data->verdict.code) { 9444 case NFT_JUMP: 9445 case NFT_GOTO: 9446 ret = nf_tables_check_loops(ctx, data->verdict.chain); 9447 break; 9448 default: 9449 ret = 0; 9450 break; 9451 } 9452 9453 return ret; 9454 } 9455 9456 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, 9457 struct nft_set *set, 9458 const struct nft_set_iter *iter, 9459 struct nft_set_elem *elem) 9460 { 9461 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 9462 9463 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 9464 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 9465 return 0; 9466 9467 return nft_check_loops(ctx, ext); 9468 } 9469 9470 static int nft_set_catchall_loops(const struct nft_ctx *ctx, 9471 struct nft_set *set) 9472 { 9473 u8 genmask = nft_genmask_next(ctx->net); 9474 struct nft_set_elem_catchall *catchall; 9475 struct nft_set_ext *ext; 9476 int ret = 0; 9477 9478 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 9479 ext = nft_set_elem_ext(set, catchall->elem); 9480 if (!nft_set_elem_active(ext, genmask)) 9481 continue; 9482 9483 ret = nft_check_loops(ctx, ext); 9484 if (ret < 0) 9485 return ret; 9486 } 9487 9488 return ret; 9489 } 9490 9491 static int nf_tables_check_loops(const struct nft_ctx *ctx, 9492 const struct nft_chain *chain) 9493 { 9494 const struct nft_rule *rule; 9495 const struct nft_expr *expr, *last; 9496 struct nft_set *set; 9497 struct nft_set_binding *binding; 9498 struct nft_set_iter iter; 9499 9500 if (ctx->chain == chain) 9501 return -ELOOP; 9502 9503 list_for_each_entry(rule, &chain->rules, list) { 9504 nft_rule_for_each_expr(expr, last, rule) { 9505 struct nft_immediate_expr *priv; 9506 const struct nft_data *data; 9507 int err; 9508 9509 if (strcmp(expr->ops->type->name, "immediate")) 9510 continue; 9511 9512 priv = nft_expr_priv(expr); 9513 if (priv->dreg != NFT_REG_VERDICT) 9514 continue; 9515 9516 data = &priv->data; 9517 switch (data->verdict.code) { 9518 case NFT_JUMP: 9519 case NFT_GOTO: 9520 err = nf_tables_check_loops(ctx, 9521 data->verdict.chain); 9522 if (err < 0) 9523 return err; 9524 break; 9525 default: 9526 break; 9527 } 9528 } 9529 } 9530 9531 list_for_each_entry(set, &ctx->table->sets, list) { 9532 if (!nft_is_active_next(ctx->net, set)) 9533 continue; 9534 if (!(set->flags & NFT_SET_MAP) || 9535 set->dtype != NFT_DATA_VERDICT) 9536 continue; 9537 9538 list_for_each_entry(binding, &set->bindings, list) { 9539 if (!(binding->flags & NFT_SET_MAP) || 9540 binding->chain != chain) 9541 continue; 9542 9543 iter.genmask = nft_genmask_next(ctx->net); 9544 iter.skip = 0; 9545 iter.count = 0; 9546 iter.err = 0; 9547 iter.fn = nf_tables_loop_check_setelem; 9548 9549 set->ops->walk(ctx, set, &iter); 9550 if (!iter.err) 9551 iter.err = nft_set_catchall_loops(ctx, set); 9552 9553 if (iter.err < 0) 9554 return iter.err; 9555 } 9556 } 9557 9558 return 0; 9559 } 9560 9561 /** 9562 * nft_parse_u32_check - fetch u32 attribute and check for maximum value 9563 * 9564 * @attr: netlink attribute to fetch value from 9565 * @max: maximum value to be stored in dest 9566 * @dest: pointer to the variable 9567 * 9568 * Parse, check and store a given u32 netlink attribute into variable. 9569 * This function returns -ERANGE if the value goes over maximum value. 9570 * Otherwise a 0 is returned and the attribute value is stored in the 9571 * destination variable. 9572 */ 9573 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 9574 { 9575 u32 val; 9576 9577 val = ntohl(nla_get_be32(attr)); 9578 if (val > max) 9579 return -ERANGE; 9580 9581 *dest = val; 9582 return 0; 9583 } 9584 EXPORT_SYMBOL_GPL(nft_parse_u32_check); 9585 9586 static int nft_parse_register(const struct nlattr *attr, u32 *preg) 9587 { 9588 unsigned int reg; 9589 9590 reg = ntohl(nla_get_be32(attr)); 9591 switch (reg) { 9592 case NFT_REG_VERDICT...NFT_REG_4: 9593 *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; 9594 break; 9595 case NFT_REG32_00...NFT_REG32_15: 9596 *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 9597 break; 9598 default: 9599 return -ERANGE; 9600 } 9601 9602 return 0; 9603 } 9604 9605 /** 9606 * nft_dump_register - dump a register value to a netlink attribute 9607 * 9608 * @skb: socket buffer 9609 * @attr: attribute number 9610 * @reg: register number 9611 * 9612 * Construct a netlink attribute containing the register number. For 9613 * compatibility reasons, register numbers being a multiple of 4 are 9614 * translated to the corresponding 128 bit register numbers. 9615 */ 9616 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 9617 { 9618 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 9619 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 9620 else 9621 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 9622 9623 return nla_put_be32(skb, attr, htonl(reg)); 9624 } 9625 EXPORT_SYMBOL_GPL(nft_dump_register); 9626 9627 static int nft_validate_register_load(enum nft_registers reg, unsigned int len) 9628 { 9629 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 9630 return -EINVAL; 9631 if (len == 0) 9632 return -EINVAL; 9633 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data)) 9634 return -ERANGE; 9635 9636 return 0; 9637 } 9638 9639 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len) 9640 { 9641 u32 reg; 9642 int err; 9643 9644 err = nft_parse_register(attr, ®); 9645 if (err < 0) 9646 return err; 9647 9648 err = nft_validate_register_load(reg, len); 9649 if (err < 0) 9650 return err; 9651 9652 *sreg = reg; 9653 return 0; 9654 } 9655 EXPORT_SYMBOL_GPL(nft_parse_register_load); 9656 9657 static int nft_validate_register_store(const struct nft_ctx *ctx, 9658 enum nft_registers reg, 9659 const struct nft_data *data, 9660 enum nft_data_types type, 9661 unsigned int len) 9662 { 9663 int err; 9664 9665 switch (reg) { 9666 case NFT_REG_VERDICT: 9667 if (type != NFT_DATA_VERDICT) 9668 return -EINVAL; 9669 9670 if (data != NULL && 9671 (data->verdict.code == NFT_GOTO || 9672 data->verdict.code == NFT_JUMP)) { 9673 err = nf_tables_check_loops(ctx, data->verdict.chain); 9674 if (err < 0) 9675 return err; 9676 } 9677 9678 return 0; 9679 default: 9680 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 9681 return -EINVAL; 9682 if (len == 0) 9683 return -EINVAL; 9684 if (reg * NFT_REG32_SIZE + len > 9685 sizeof_field(struct nft_regs, data)) 9686 return -ERANGE; 9687 9688 if (data != NULL && type != NFT_DATA_VALUE) 9689 return -EINVAL; 9690 return 0; 9691 } 9692 } 9693 9694 int nft_parse_register_store(const struct nft_ctx *ctx, 9695 const struct nlattr *attr, u8 *dreg, 9696 const struct nft_data *data, 9697 enum nft_data_types type, unsigned int len) 9698 { 9699 int err; 9700 u32 reg; 9701 9702 err = nft_parse_register(attr, ®); 9703 if (err < 0) 9704 return err; 9705 9706 err = nft_validate_register_store(ctx, reg, data, type, len); 9707 if (err < 0) 9708 return err; 9709 9710 *dreg = reg; 9711 return 0; 9712 } 9713 EXPORT_SYMBOL_GPL(nft_parse_register_store); 9714 9715 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 9716 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 9717 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 9718 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 9719 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 }, 9720 }; 9721 9722 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 9723 struct nft_data_desc *desc, const struct nlattr *nla) 9724 { 9725 u8 genmask = nft_genmask_next(ctx->net); 9726 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 9727 struct nft_chain *chain; 9728 int err; 9729 9730 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla, 9731 nft_verdict_policy, NULL); 9732 if (err < 0) 9733 return err; 9734 9735 if (!tb[NFTA_VERDICT_CODE]) 9736 return -EINVAL; 9737 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 9738 9739 switch (data->verdict.code) { 9740 default: 9741 switch (data->verdict.code & NF_VERDICT_MASK) { 9742 case NF_ACCEPT: 9743 case NF_DROP: 9744 case NF_QUEUE: 9745 break; 9746 default: 9747 return -EINVAL; 9748 } 9749 fallthrough; 9750 case NFT_CONTINUE: 9751 case NFT_BREAK: 9752 case NFT_RETURN: 9753 break; 9754 case NFT_JUMP: 9755 case NFT_GOTO: 9756 if (tb[NFTA_VERDICT_CHAIN]) { 9757 chain = nft_chain_lookup(ctx->net, ctx->table, 9758 tb[NFTA_VERDICT_CHAIN], 9759 genmask); 9760 } else if (tb[NFTA_VERDICT_CHAIN_ID]) { 9761 chain = nft_chain_lookup_byid(ctx->net, ctx->table, 9762 tb[NFTA_VERDICT_CHAIN_ID]); 9763 if (IS_ERR(chain)) 9764 return PTR_ERR(chain); 9765 } else { 9766 return -EINVAL; 9767 } 9768 9769 if (IS_ERR(chain)) 9770 return PTR_ERR(chain); 9771 if (nft_is_base_chain(chain)) 9772 return -EOPNOTSUPP; 9773 if (nft_chain_is_bound(chain)) 9774 return -EINVAL; 9775 if (desc->flags & NFT_DATA_DESC_SETELEM && 9776 chain->flags & NFT_CHAIN_BINDING) 9777 return -EINVAL; 9778 9779 chain->use++; 9780 data->verdict.chain = chain; 9781 break; 9782 } 9783 9784 desc->len = sizeof(data->verdict); 9785 9786 return 0; 9787 } 9788 9789 static void nft_verdict_uninit(const struct nft_data *data) 9790 { 9791 struct nft_chain *chain; 9792 struct nft_rule *rule; 9793 9794 switch (data->verdict.code) { 9795 case NFT_JUMP: 9796 case NFT_GOTO: 9797 chain = data->verdict.chain; 9798 chain->use--; 9799 9800 if (!nft_chain_is_bound(chain)) 9801 break; 9802 9803 chain->table->use--; 9804 list_for_each_entry(rule, &chain->rules, list) 9805 chain->use--; 9806 9807 nft_chain_del(chain); 9808 break; 9809 } 9810 } 9811 9812 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v) 9813 { 9814 struct nlattr *nest; 9815 9816 nest = nla_nest_start_noflag(skb, type); 9817 if (!nest) 9818 goto nla_put_failure; 9819 9820 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code))) 9821 goto nla_put_failure; 9822 9823 switch (v->code) { 9824 case NFT_JUMP: 9825 case NFT_GOTO: 9826 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 9827 v->chain->name)) 9828 goto nla_put_failure; 9829 } 9830 nla_nest_end(skb, nest); 9831 return 0; 9832 9833 nla_put_failure: 9834 return -1; 9835 } 9836 9837 static int nft_value_init(const struct nft_ctx *ctx, 9838 struct nft_data *data, struct nft_data_desc *desc, 9839 const struct nlattr *nla) 9840 { 9841 unsigned int len; 9842 9843 len = nla_len(nla); 9844 if (len == 0) 9845 return -EINVAL; 9846 if (len > desc->size) 9847 return -EOVERFLOW; 9848 if (desc->len) { 9849 if (len != desc->len) 9850 return -EINVAL; 9851 } else { 9852 desc->len = len; 9853 } 9854 9855 nla_memcpy(data->data, nla, len); 9856 9857 return 0; 9858 } 9859 9860 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 9861 unsigned int len) 9862 { 9863 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 9864 } 9865 9866 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 9867 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 9868 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 9869 }; 9870 9871 /** 9872 * nft_data_init - parse nf_tables data netlink attributes 9873 * 9874 * @ctx: context of the expression using the data 9875 * @data: destination struct nft_data 9876 * @desc: data description 9877 * @nla: netlink attribute containing data 9878 * 9879 * Parse the netlink data attributes and initialize a struct nft_data. 9880 * The type and length of data are returned in the data description. 9881 * 9882 * The caller can indicate that it only wants to accept data of type 9883 * NFT_DATA_VALUE by passing NULL for the ctx argument. 9884 */ 9885 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, 9886 struct nft_data_desc *desc, const struct nlattr *nla) 9887 { 9888 struct nlattr *tb[NFTA_DATA_MAX + 1]; 9889 int err; 9890 9891 if (WARN_ON_ONCE(!desc->size)) 9892 return -EINVAL; 9893 9894 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla, 9895 nft_data_policy, NULL); 9896 if (err < 0) 9897 return err; 9898 9899 if (tb[NFTA_DATA_VALUE]) { 9900 if (desc->type != NFT_DATA_VALUE) 9901 return -EINVAL; 9902 9903 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]); 9904 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) { 9905 if (desc->type != NFT_DATA_VERDICT) 9906 return -EINVAL; 9907 9908 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 9909 } else { 9910 err = -EINVAL; 9911 } 9912 9913 return err; 9914 } 9915 EXPORT_SYMBOL_GPL(nft_data_init); 9916 9917 /** 9918 * nft_data_release - release a nft_data item 9919 * 9920 * @data: struct nft_data to release 9921 * @type: type of data 9922 * 9923 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 9924 * all others need to be released by calling this function. 9925 */ 9926 void nft_data_release(const struct nft_data *data, enum nft_data_types type) 9927 { 9928 if (type < NFT_DATA_VERDICT) 9929 return; 9930 switch (type) { 9931 case NFT_DATA_VERDICT: 9932 return nft_verdict_uninit(data); 9933 default: 9934 WARN_ON(1); 9935 } 9936 } 9937 EXPORT_SYMBOL_GPL(nft_data_release); 9938 9939 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 9940 enum nft_data_types type, unsigned int len) 9941 { 9942 struct nlattr *nest; 9943 int err; 9944 9945 nest = nla_nest_start_noflag(skb, attr); 9946 if (nest == NULL) 9947 return -1; 9948 9949 switch (type) { 9950 case NFT_DATA_VALUE: 9951 err = nft_value_dump(skb, data, len); 9952 break; 9953 case NFT_DATA_VERDICT: 9954 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict); 9955 break; 9956 default: 9957 err = -EINVAL; 9958 WARN_ON(1); 9959 } 9960 9961 nla_nest_end(skb, nest); 9962 return err; 9963 } 9964 EXPORT_SYMBOL_GPL(nft_data_dump); 9965 9966 int __nft_release_basechain(struct nft_ctx *ctx) 9967 { 9968 struct nft_rule *rule, *nr; 9969 9970 if (WARN_ON(!nft_is_base_chain(ctx->chain))) 9971 return 0; 9972 9973 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain); 9974 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { 9975 list_del(&rule->list); 9976 ctx->chain->use--; 9977 nf_tables_rule_release(ctx, rule); 9978 } 9979 nft_chain_del(ctx->chain); 9980 ctx->table->use--; 9981 nf_tables_chain_destroy(ctx); 9982 9983 return 0; 9984 } 9985 EXPORT_SYMBOL_GPL(__nft_release_basechain); 9986 9987 static void __nft_release_hook(struct net *net, struct nft_table *table) 9988 { 9989 struct nft_flowtable *flowtable; 9990 struct nft_chain *chain; 9991 9992 list_for_each_entry(chain, &table->chains, list) 9993 __nf_tables_unregister_hook(net, table, chain, true); 9994 list_for_each_entry(flowtable, &table->flowtables, list) 9995 __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list, 9996 true); 9997 } 9998 9999 static void __nft_release_hooks(struct net *net) 10000 { 10001 struct nftables_pernet *nft_net = nft_pernet(net); 10002 struct nft_table *table; 10003 10004 list_for_each_entry(table, &nft_net->tables, list) { 10005 if (nft_table_has_owner(table)) 10006 continue; 10007 10008 __nft_release_hook(net, table); 10009 } 10010 } 10011 10012 static void __nft_release_table(struct net *net, struct nft_table *table) 10013 { 10014 struct nft_flowtable *flowtable, *nf; 10015 struct nft_chain *chain, *nc; 10016 struct nft_object *obj, *ne; 10017 struct nft_rule *rule, *nr; 10018 struct nft_set *set, *ns; 10019 struct nft_ctx ctx = { 10020 .net = net, 10021 .family = NFPROTO_NETDEV, 10022 }; 10023 10024 ctx.family = table->family; 10025 ctx.table = table; 10026 list_for_each_entry(chain, &table->chains, list) { 10027 ctx.chain = chain; 10028 list_for_each_entry_safe(rule, nr, &chain->rules, list) { 10029 list_del(&rule->list); 10030 chain->use--; 10031 nf_tables_rule_release(&ctx, rule); 10032 } 10033 } 10034 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 10035 list_del(&flowtable->list); 10036 table->use--; 10037 nf_tables_flowtable_destroy(flowtable); 10038 } 10039 list_for_each_entry_safe(set, ns, &table->sets, list) { 10040 list_del(&set->list); 10041 table->use--; 10042 nft_set_destroy(&ctx, set); 10043 } 10044 list_for_each_entry_safe(obj, ne, &table->objects, list) { 10045 nft_obj_del(obj); 10046 table->use--; 10047 nft_obj_destroy(&ctx, obj); 10048 } 10049 list_for_each_entry_safe(chain, nc, &table->chains, list) { 10050 ctx.chain = chain; 10051 nft_chain_del(chain); 10052 table->use--; 10053 nf_tables_chain_destroy(&ctx); 10054 } 10055 nf_tables_table_destroy(&ctx); 10056 } 10057 10058 static void __nft_release_tables(struct net *net) 10059 { 10060 struct nftables_pernet *nft_net = nft_pernet(net); 10061 struct nft_table *table, *nt; 10062 10063 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 10064 if (nft_table_has_owner(table)) 10065 continue; 10066 10067 list_del(&table->list); 10068 10069 __nft_release_table(net, table); 10070 } 10071 } 10072 10073 static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, 10074 void *ptr) 10075 { 10076 struct nft_table *table, *to_delete[8]; 10077 struct nftables_pernet *nft_net; 10078 struct netlink_notify *n = ptr; 10079 struct net *net = n->net; 10080 unsigned int deleted; 10081 bool restart = false; 10082 10083 if (event != NETLINK_URELEASE || n->protocol != NETLINK_NETFILTER) 10084 return NOTIFY_DONE; 10085 10086 nft_net = nft_pernet(net); 10087 deleted = 0; 10088 mutex_lock(&nft_net->commit_mutex); 10089 if (!list_empty(&nf_tables_destroy_list)) 10090 rcu_barrier(); 10091 again: 10092 list_for_each_entry(table, &nft_net->tables, list) { 10093 if (nft_table_has_owner(table) && 10094 n->portid == table->nlpid) { 10095 __nft_release_hook(net, table); 10096 list_del_rcu(&table->list); 10097 to_delete[deleted++] = table; 10098 if (deleted >= ARRAY_SIZE(to_delete)) 10099 break; 10100 } 10101 } 10102 if (deleted) { 10103 restart = deleted >= ARRAY_SIZE(to_delete); 10104 synchronize_rcu(); 10105 while (deleted) 10106 __nft_release_table(net, to_delete[--deleted]); 10107 10108 if (restart) 10109 goto again; 10110 } 10111 mutex_unlock(&nft_net->commit_mutex); 10112 10113 return NOTIFY_DONE; 10114 } 10115 10116 static struct notifier_block nft_nl_notifier = { 10117 .notifier_call = nft_rcv_nl_event, 10118 }; 10119 10120 static int __net_init nf_tables_init_net(struct net *net) 10121 { 10122 struct nftables_pernet *nft_net = nft_pernet(net); 10123 10124 INIT_LIST_HEAD(&nft_net->tables); 10125 INIT_LIST_HEAD(&nft_net->commit_list); 10126 INIT_LIST_HEAD(&nft_net->module_list); 10127 INIT_LIST_HEAD(&nft_net->notify_list); 10128 mutex_init(&nft_net->commit_mutex); 10129 nft_net->base_seq = 1; 10130 nft_net->validate_state = NFT_VALIDATE_SKIP; 10131 10132 return 0; 10133 } 10134 10135 static void __net_exit nf_tables_pre_exit_net(struct net *net) 10136 { 10137 struct nftables_pernet *nft_net = nft_pernet(net); 10138 10139 mutex_lock(&nft_net->commit_mutex); 10140 __nft_release_hooks(net); 10141 mutex_unlock(&nft_net->commit_mutex); 10142 } 10143 10144 static void __net_exit nf_tables_exit_net(struct net *net) 10145 { 10146 struct nftables_pernet *nft_net = nft_pernet(net); 10147 10148 mutex_lock(&nft_net->commit_mutex); 10149 if (!list_empty(&nft_net->commit_list) || 10150 !list_empty(&nft_net->module_list)) 10151 __nf_tables_abort(net, NFNL_ABORT_NONE); 10152 __nft_release_tables(net); 10153 mutex_unlock(&nft_net->commit_mutex); 10154 WARN_ON_ONCE(!list_empty(&nft_net->tables)); 10155 WARN_ON_ONCE(!list_empty(&nft_net->module_list)); 10156 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 10157 } 10158 10159 static struct pernet_operations nf_tables_net_ops = { 10160 .init = nf_tables_init_net, 10161 .pre_exit = nf_tables_pre_exit_net, 10162 .exit = nf_tables_exit_net, 10163 .id = &nf_tables_net_id, 10164 .size = sizeof(struct nftables_pernet), 10165 }; 10166 10167 static int __init nf_tables_module_init(void) 10168 { 10169 int err; 10170 10171 err = register_pernet_subsys(&nf_tables_net_ops); 10172 if (err < 0) 10173 return err; 10174 10175 err = nft_chain_filter_init(); 10176 if (err < 0) 10177 goto err_chain_filter; 10178 10179 err = nf_tables_core_module_init(); 10180 if (err < 0) 10181 goto err_core_module; 10182 10183 err = register_netdevice_notifier(&nf_tables_flowtable_notifier); 10184 if (err < 0) 10185 goto err_netdev_notifier; 10186 10187 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params); 10188 if (err < 0) 10189 goto err_rht_objname; 10190 10191 err = nft_offload_init(); 10192 if (err < 0) 10193 goto err_offload; 10194 10195 err = netlink_register_notifier(&nft_nl_notifier); 10196 if (err < 0) 10197 goto err_netlink_notifier; 10198 10199 /* must be last */ 10200 err = nfnetlink_subsys_register(&nf_tables_subsys); 10201 if (err < 0) 10202 goto err_nfnl_subsys; 10203 10204 nft_chain_route_init(); 10205 10206 return err; 10207 10208 err_nfnl_subsys: 10209 netlink_unregister_notifier(&nft_nl_notifier); 10210 err_netlink_notifier: 10211 nft_offload_exit(); 10212 err_offload: 10213 rhltable_destroy(&nft_objname_ht); 10214 err_rht_objname: 10215 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 10216 err_netdev_notifier: 10217 nf_tables_core_module_exit(); 10218 err_core_module: 10219 nft_chain_filter_fini(); 10220 err_chain_filter: 10221 unregister_pernet_subsys(&nf_tables_net_ops); 10222 return err; 10223 } 10224 10225 static void __exit nf_tables_module_exit(void) 10226 { 10227 nfnetlink_subsys_unregister(&nf_tables_subsys); 10228 netlink_unregister_notifier(&nft_nl_notifier); 10229 nft_offload_exit(); 10230 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 10231 nft_chain_filter_fini(); 10232 nft_chain_route_fini(); 10233 unregister_pernet_subsys(&nf_tables_net_ops); 10234 cancel_work_sync(&trans_destroy_work); 10235 rcu_barrier(); 10236 rhltable_destroy(&nft_objname_ht); 10237 nf_tables_core_module_exit(); 10238 } 10239 10240 module_init(nf_tables_module_init); 10241 module_exit(nf_tables_module_exit); 10242 10243 MODULE_LICENSE("GPL"); 10244 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 10245 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 10246