1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org> 4 * 5 * This software has been sponsored by Sophos Astaro <http://www.sophos.com> 6 */ 7 8 #include <linux/kernel.h> 9 #include <linux/init.h> 10 #include <linux/module.h> 11 #include <linux/netlink.h> 12 #include <linux/netfilter.h> 13 #include <linux/netfilter/nfnetlink.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <linux/netfilter/nf_tables_compat.h> 16 #include <linux/netfilter/x_tables.h> 17 #include <linux/netfilter_ipv4/ip_tables.h> 18 #include <linux/netfilter_ipv6/ip6_tables.h> 19 #include <linux/netfilter_bridge/ebtables.h> 20 #include <linux/netfilter_arp/arp_tables.h> 21 #include <net/netfilter/nf_tables.h> 22 23 /* Used for matches where *info is larger than X byte */ 24 #define NFT_MATCH_LARGE_THRESH 192 25 26 struct nft_xt_match_priv { 27 void *info; 28 }; 29 30 static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, 31 const char *tablename) 32 { 33 enum nft_chain_types type = NFT_CHAIN_T_DEFAULT; 34 const struct nft_chain *chain = ctx->chain; 35 const struct nft_base_chain *basechain; 36 37 if (!tablename || 38 !nft_is_base_chain(chain)) 39 return 0; 40 41 basechain = nft_base_chain(chain); 42 if (strcmp(tablename, "nat") == 0) { 43 if (ctx->family != NFPROTO_BRIDGE) 44 type = NFT_CHAIN_T_NAT; 45 if (basechain->type->type != type) 46 return -EINVAL; 47 } 48 49 return 0; 50 } 51 52 union nft_entry { 53 struct ipt_entry e4; 54 struct ip6t_entry e6; 55 struct ebt_entry ebt; 56 struct arpt_entry arp; 57 }; 58 59 static inline void 60 nft_compat_set_par(struct xt_action_param *par, 61 const struct nft_pktinfo *pkt, 62 const void *xt, const void *xt_info) 63 { 64 par->state = pkt->state; 65 par->thoff = nft_thoff(pkt); 66 par->fragoff = pkt->fragoff; 67 par->target = xt; 68 par->targinfo = xt_info; 69 par->hotdrop = false; 70 } 71 72 static void nft_target_eval_xt(const struct nft_expr *expr, 73 struct nft_regs *regs, 74 const struct nft_pktinfo *pkt) 75 { 76 void *info = nft_expr_priv(expr); 77 struct xt_target *target = expr->ops->data; 78 struct sk_buff *skb = pkt->skb; 79 struct xt_action_param xt; 80 int ret; 81 82 nft_compat_set_par(&xt, pkt, target, info); 83 84 ret = target->target(skb, &xt); 85 86 if (xt.hotdrop) 87 ret = NF_DROP; 88 89 switch (ret) { 90 case XT_CONTINUE: 91 regs->verdict.code = NFT_CONTINUE; 92 break; 93 default: 94 regs->verdict.code = ret; 95 break; 96 } 97 } 98 99 static void nft_target_eval_bridge(const struct nft_expr *expr, 100 struct nft_regs *regs, 101 const struct nft_pktinfo *pkt) 102 { 103 void *info = nft_expr_priv(expr); 104 struct xt_target *target = expr->ops->data; 105 struct sk_buff *skb = pkt->skb; 106 struct xt_action_param xt; 107 int ret; 108 109 nft_compat_set_par(&xt, pkt, target, info); 110 111 ret = target->target(skb, &xt); 112 113 if (xt.hotdrop) 114 ret = NF_DROP; 115 116 switch (ret) { 117 case EBT_ACCEPT: 118 regs->verdict.code = NF_ACCEPT; 119 break; 120 case EBT_DROP: 121 regs->verdict.code = NF_DROP; 122 break; 123 case EBT_CONTINUE: 124 regs->verdict.code = NFT_CONTINUE; 125 break; 126 case EBT_RETURN: 127 regs->verdict.code = NFT_RETURN; 128 break; 129 default: 130 regs->verdict.code = ret; 131 break; 132 } 133 } 134 135 static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { 136 [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, 137 [NFTA_TARGET_REV] = { .type = NLA_U32 }, 138 [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, 139 }; 140 141 static void 142 nft_target_set_tgchk_param(struct xt_tgchk_param *par, 143 const struct nft_ctx *ctx, 144 struct xt_target *target, void *info, 145 union nft_entry *entry, u16 proto, bool inv) 146 { 147 par->net = ctx->net; 148 par->table = ctx->table->name; 149 switch (ctx->family) { 150 case AF_INET: 151 entry->e4.ip.proto = proto; 152 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; 153 break; 154 case AF_INET6: 155 if (proto) 156 entry->e6.ipv6.flags |= IP6T_F_PROTO; 157 158 entry->e6.ipv6.proto = proto; 159 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; 160 break; 161 case NFPROTO_BRIDGE: 162 entry->ebt.ethproto = (__force __be16)proto; 163 entry->ebt.invflags = inv ? EBT_IPROTO : 0; 164 break; 165 case NFPROTO_ARP: 166 break; 167 } 168 par->entryinfo = entry; 169 par->target = target; 170 par->targinfo = info; 171 if (nft_is_base_chain(ctx->chain)) { 172 const struct nft_base_chain *basechain = 173 nft_base_chain(ctx->chain); 174 const struct nf_hook_ops *ops = &basechain->ops; 175 176 par->hook_mask = 1 << ops->hooknum; 177 } else { 178 par->hook_mask = 0; 179 } 180 par->family = ctx->family; 181 par->nft_compat = true; 182 } 183 184 static void target_compat_from_user(struct xt_target *t, void *in, void *out) 185 { 186 int pad; 187 188 memcpy(out, in, t->targetsize); 189 pad = XT_ALIGN(t->targetsize) - t->targetsize; 190 if (pad > 0) 191 memset(out + t->targetsize, 0, pad); 192 } 193 194 static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = { 195 [NFTA_RULE_COMPAT_PROTO] = { .type = NLA_U32 }, 196 [NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 }, 197 }; 198 199 static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) 200 { 201 struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; 202 u32 flags; 203 int err; 204 205 err = nla_parse_nested_deprecated(tb, NFTA_RULE_COMPAT_MAX, attr, 206 nft_rule_compat_policy, NULL); 207 if (err < 0) 208 return err; 209 210 if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS]) 211 return -EINVAL; 212 213 flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS])); 214 if (flags & ~NFT_RULE_COMPAT_F_MASK) 215 return -EINVAL; 216 if (flags & NFT_RULE_COMPAT_F_INV) 217 *inv = true; 218 219 *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); 220 return 0; 221 } 222 223 static void nft_compat_wait_for_destructors(void) 224 { 225 /* xtables matches or targets can have side effects, e.g. 226 * creation/destruction of /proc files. 227 * The xt ->destroy functions are run asynchronously from 228 * work queue. If we have pending invocations we thus 229 * need to wait for those to finish. 230 */ 231 nf_tables_trans_destroy_flush_work(); 232 } 233 234 static int 235 nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 236 const struct nlattr * const tb[]) 237 { 238 void *info = nft_expr_priv(expr); 239 struct xt_target *target = expr->ops->data; 240 struct xt_tgchk_param par; 241 size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); 242 u16 proto = 0; 243 bool inv = false; 244 union nft_entry e = {}; 245 int ret; 246 247 target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info); 248 249 if (ctx->nla[NFTA_RULE_COMPAT]) { 250 ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); 251 if (ret < 0) 252 return ret; 253 } 254 255 nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); 256 257 nft_compat_wait_for_destructors(); 258 259 ret = xt_check_target(&par, size, proto, inv); 260 if (ret < 0) 261 return ret; 262 263 /* The standard target cannot be used */ 264 if (!target->target) 265 return -EINVAL; 266 267 return 0; 268 } 269 270 static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr) 271 { 272 module_put(me); 273 kfree(expr->ops); 274 } 275 276 static void 277 nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) 278 { 279 struct xt_target *target = expr->ops->data; 280 void *info = nft_expr_priv(expr); 281 struct module *me = target->me; 282 struct xt_tgdtor_param par; 283 284 par.net = ctx->net; 285 par.target = target; 286 par.targinfo = info; 287 par.family = ctx->family; 288 if (par.target->destroy != NULL) 289 par.target->destroy(&par); 290 291 __nft_mt_tg_destroy(me, expr); 292 } 293 294 static int nft_extension_dump_info(struct sk_buff *skb, int attr, 295 const void *info, 296 unsigned int size, unsigned int user_size) 297 { 298 unsigned int info_size, aligned_size = XT_ALIGN(size); 299 struct nlattr *nla; 300 301 nla = nla_reserve(skb, attr, aligned_size); 302 if (!nla) 303 return -1; 304 305 info_size = user_size ? : size; 306 memcpy(nla_data(nla), info, info_size); 307 memset(nla_data(nla) + info_size, 0, aligned_size - info_size); 308 309 return 0; 310 } 311 312 static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr) 313 { 314 const struct xt_target *target = expr->ops->data; 315 void *info = nft_expr_priv(expr); 316 317 if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) || 318 nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) || 319 nft_extension_dump_info(skb, NFTA_TARGET_INFO, info, 320 target->targetsize, target->usersize)) 321 goto nla_put_failure; 322 323 return 0; 324 325 nla_put_failure: 326 return -1; 327 } 328 329 static int nft_target_validate(const struct nft_ctx *ctx, 330 const struct nft_expr *expr, 331 const struct nft_data **data) 332 { 333 struct xt_target *target = expr->ops->data; 334 unsigned int hook_mask = 0; 335 int ret; 336 337 if (nft_is_base_chain(ctx->chain)) { 338 const struct nft_base_chain *basechain = 339 nft_base_chain(ctx->chain); 340 const struct nf_hook_ops *ops = &basechain->ops; 341 342 hook_mask = 1 << ops->hooknum; 343 if (target->hooks && !(hook_mask & target->hooks)) 344 return -EINVAL; 345 346 ret = nft_compat_chain_validate_dependency(ctx, target->table); 347 if (ret < 0) 348 return ret; 349 } 350 return 0; 351 } 352 353 static void __nft_match_eval(const struct nft_expr *expr, 354 struct nft_regs *regs, 355 const struct nft_pktinfo *pkt, 356 void *info) 357 { 358 struct xt_match *match = expr->ops->data; 359 struct sk_buff *skb = pkt->skb; 360 struct xt_action_param xt; 361 bool ret; 362 363 nft_compat_set_par(&xt, pkt, match, info); 364 365 ret = match->match(skb, &xt); 366 367 if (xt.hotdrop) { 368 regs->verdict.code = NF_DROP; 369 return; 370 } 371 372 switch (ret ? 1 : 0) { 373 case 1: 374 regs->verdict.code = NFT_CONTINUE; 375 break; 376 case 0: 377 regs->verdict.code = NFT_BREAK; 378 break; 379 } 380 } 381 382 static void nft_match_large_eval(const struct nft_expr *expr, 383 struct nft_regs *regs, 384 const struct nft_pktinfo *pkt) 385 { 386 struct nft_xt_match_priv *priv = nft_expr_priv(expr); 387 388 __nft_match_eval(expr, regs, pkt, priv->info); 389 } 390 391 static void nft_match_eval(const struct nft_expr *expr, 392 struct nft_regs *regs, 393 const struct nft_pktinfo *pkt) 394 { 395 __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr)); 396 } 397 398 static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { 399 [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, 400 [NFTA_MATCH_REV] = { .type = NLA_U32 }, 401 [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, 402 }; 403 404 /* struct xt_mtchk_param and xt_tgchk_param look very similar */ 405 static void 406 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, 407 struct xt_match *match, void *info, 408 union nft_entry *entry, u16 proto, bool inv) 409 { 410 par->net = ctx->net; 411 par->table = ctx->table->name; 412 switch (ctx->family) { 413 case AF_INET: 414 entry->e4.ip.proto = proto; 415 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; 416 break; 417 case AF_INET6: 418 if (proto) 419 entry->e6.ipv6.flags |= IP6T_F_PROTO; 420 421 entry->e6.ipv6.proto = proto; 422 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; 423 break; 424 case NFPROTO_BRIDGE: 425 entry->ebt.ethproto = (__force __be16)proto; 426 entry->ebt.invflags = inv ? EBT_IPROTO : 0; 427 break; 428 case NFPROTO_ARP: 429 break; 430 } 431 par->entryinfo = entry; 432 par->match = match; 433 par->matchinfo = info; 434 if (nft_is_base_chain(ctx->chain)) { 435 const struct nft_base_chain *basechain = 436 nft_base_chain(ctx->chain); 437 const struct nf_hook_ops *ops = &basechain->ops; 438 439 par->hook_mask = 1 << ops->hooknum; 440 } else { 441 par->hook_mask = 0; 442 } 443 par->family = ctx->family; 444 par->nft_compat = true; 445 } 446 447 static void match_compat_from_user(struct xt_match *m, void *in, void *out) 448 { 449 int pad; 450 451 memcpy(out, in, m->matchsize); 452 pad = XT_ALIGN(m->matchsize) - m->matchsize; 453 if (pad > 0) 454 memset(out + m->matchsize, 0, pad); 455 } 456 457 static int 458 __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 459 const struct nlattr * const tb[], 460 void *info) 461 { 462 struct xt_match *match = expr->ops->data; 463 struct xt_mtchk_param par; 464 size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); 465 u16 proto = 0; 466 bool inv = false; 467 union nft_entry e = {}; 468 int ret; 469 470 match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info); 471 472 if (ctx->nla[NFTA_RULE_COMPAT]) { 473 ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); 474 if (ret < 0) 475 return ret; 476 } 477 478 nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); 479 480 nft_compat_wait_for_destructors(); 481 482 return xt_check_match(&par, size, proto, inv); 483 } 484 485 static int 486 nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 487 const struct nlattr * const tb[]) 488 { 489 return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr)); 490 } 491 492 static int 493 nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 494 const struct nlattr * const tb[]) 495 { 496 struct nft_xt_match_priv *priv = nft_expr_priv(expr); 497 struct xt_match *m = expr->ops->data; 498 int ret; 499 500 priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); 501 if (!priv->info) 502 return -ENOMEM; 503 504 ret = __nft_match_init(ctx, expr, tb, priv->info); 505 if (ret) 506 kfree(priv->info); 507 return ret; 508 } 509 510 static void 511 __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, 512 void *info) 513 { 514 struct xt_match *match = expr->ops->data; 515 struct module *me = match->me; 516 struct xt_mtdtor_param par; 517 518 par.net = ctx->net; 519 par.match = match; 520 par.matchinfo = info; 521 par.family = ctx->family; 522 if (par.match->destroy != NULL) 523 par.match->destroy(&par); 524 525 __nft_mt_tg_destroy(me, expr); 526 } 527 528 static void 529 nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) 530 { 531 __nft_match_destroy(ctx, expr, nft_expr_priv(expr)); 532 } 533 534 static void 535 nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) 536 { 537 struct nft_xt_match_priv *priv = nft_expr_priv(expr); 538 539 __nft_match_destroy(ctx, expr, priv->info); 540 kfree(priv->info); 541 } 542 543 static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, 544 void *info) 545 { 546 struct xt_match *match = expr->ops->data; 547 548 if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) || 549 nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) || 550 nft_extension_dump_info(skb, NFTA_MATCH_INFO, info, 551 match->matchsize, match->usersize)) 552 goto nla_put_failure; 553 554 return 0; 555 556 nla_put_failure: 557 return -1; 558 } 559 560 static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr) 561 { 562 return __nft_match_dump(skb, expr, nft_expr_priv(expr)); 563 } 564 565 static int nft_match_large_dump(struct sk_buff *skb, const struct nft_expr *e) 566 { 567 struct nft_xt_match_priv *priv = nft_expr_priv(e); 568 569 return __nft_match_dump(skb, e, priv->info); 570 } 571 572 static int nft_match_validate(const struct nft_ctx *ctx, 573 const struct nft_expr *expr, 574 const struct nft_data **data) 575 { 576 struct xt_match *match = expr->ops->data; 577 unsigned int hook_mask = 0; 578 int ret; 579 580 if (nft_is_base_chain(ctx->chain)) { 581 const struct nft_base_chain *basechain = 582 nft_base_chain(ctx->chain); 583 const struct nf_hook_ops *ops = &basechain->ops; 584 585 hook_mask = 1 << ops->hooknum; 586 if (match->hooks && !(hook_mask & match->hooks)) 587 return -EINVAL; 588 589 ret = nft_compat_chain_validate_dependency(ctx, match->table); 590 if (ret < 0) 591 return ret; 592 } 593 return 0; 594 } 595 596 static int 597 nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, 598 int event, u16 family, const char *name, 599 int rev, int target) 600 { 601 struct nlmsghdr *nlh; 602 unsigned int flags = portid ? NLM_F_MULTI : 0; 603 604 event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event); 605 nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, 606 NFNETLINK_V0, 0); 607 if (!nlh) 608 goto nlmsg_failure; 609 610 if (nla_put_string(skb, NFTA_COMPAT_NAME, name) || 611 nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) || 612 nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target))) 613 goto nla_put_failure; 614 615 nlmsg_end(skb, nlh); 616 return skb->len; 617 618 nlmsg_failure: 619 nla_put_failure: 620 nlmsg_cancel(skb, nlh); 621 return -1; 622 } 623 624 static int nfnl_compat_get_rcu(struct sk_buff *skb, 625 const struct nfnl_info *info, 626 const struct nlattr * const tb[]) 627 { 628 u8 family = info->nfmsg->nfgen_family; 629 const char *name, *fmt; 630 struct sk_buff *skb2; 631 int ret = 0, target; 632 u32 rev; 633 634 if (tb[NFTA_COMPAT_NAME] == NULL || 635 tb[NFTA_COMPAT_REV] == NULL || 636 tb[NFTA_COMPAT_TYPE] == NULL) 637 return -EINVAL; 638 639 name = nla_data(tb[NFTA_COMPAT_NAME]); 640 rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV])); 641 target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE])); 642 643 switch(family) { 644 case AF_INET: 645 fmt = "ipt_%s"; 646 break; 647 case AF_INET6: 648 fmt = "ip6t_%s"; 649 break; 650 case NFPROTO_BRIDGE: 651 fmt = "ebt_%s"; 652 break; 653 case NFPROTO_ARP: 654 fmt = "arpt_%s"; 655 break; 656 default: 657 pr_err("nft_compat: unsupported protocol %d\n", family); 658 return -EINVAL; 659 } 660 661 if (!try_module_get(THIS_MODULE)) 662 return -EINVAL; 663 664 rcu_read_unlock(); 665 try_then_request_module(xt_find_revision(family, name, rev, target, &ret), 666 fmt, name); 667 if (ret < 0) 668 goto out_put; 669 670 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 671 if (skb2 == NULL) { 672 ret = -ENOMEM; 673 goto out_put; 674 } 675 676 /* include the best revision for this extension in the message */ 677 if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid, 678 info->nlh->nlmsg_seq, 679 NFNL_MSG_TYPE(info->nlh->nlmsg_type), 680 NFNL_MSG_COMPAT_GET, 681 family, name, ret, target) <= 0) { 682 kfree_skb(skb2); 683 goto out_put; 684 } 685 686 ret = netlink_unicast(info->sk, skb2, NETLINK_CB(skb).portid, 687 MSG_DONTWAIT); 688 if (ret > 0) 689 ret = 0; 690 out_put: 691 rcu_read_lock(); 692 module_put(THIS_MODULE); 693 return ret == -EAGAIN ? -ENOBUFS : ret; 694 } 695 696 static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = { 697 [NFTA_COMPAT_NAME] = { .type = NLA_NUL_STRING, 698 .len = NFT_COMPAT_NAME_MAX-1 }, 699 [NFTA_COMPAT_REV] = { .type = NLA_U32 }, 700 [NFTA_COMPAT_TYPE] = { .type = NLA_U32 }, 701 }; 702 703 static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = { 704 [NFNL_MSG_COMPAT_GET] = { 705 .call = nfnl_compat_get_rcu, 706 .type = NFNL_CB_RCU, 707 .attr_count = NFTA_COMPAT_MAX, 708 .policy = nfnl_compat_policy_get 709 }, 710 }; 711 712 static const struct nfnetlink_subsystem nfnl_compat_subsys = { 713 .name = "nft-compat", 714 .subsys_id = NFNL_SUBSYS_NFT_COMPAT, 715 .cb_count = NFNL_MSG_COMPAT_MAX, 716 .cb = nfnl_nft_compat_cb, 717 }; 718 719 static struct nft_expr_type nft_match_type; 720 721 static const struct nft_expr_ops * 722 nft_match_select_ops(const struct nft_ctx *ctx, 723 const struct nlattr * const tb[]) 724 { 725 struct nft_expr_ops *ops; 726 struct xt_match *match; 727 unsigned int matchsize; 728 char *mt_name; 729 u32 rev, family; 730 int err; 731 732 if (tb[NFTA_MATCH_NAME] == NULL || 733 tb[NFTA_MATCH_REV] == NULL || 734 tb[NFTA_MATCH_INFO] == NULL) 735 return ERR_PTR(-EINVAL); 736 737 mt_name = nla_data(tb[NFTA_MATCH_NAME]); 738 rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); 739 family = ctx->family; 740 741 match = xt_request_find_match(family, mt_name, rev); 742 if (IS_ERR(match)) 743 return ERR_PTR(-ENOENT); 744 745 if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) { 746 err = -EINVAL; 747 goto err; 748 } 749 750 ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); 751 if (!ops) { 752 err = -ENOMEM; 753 goto err; 754 } 755 756 ops->type = &nft_match_type; 757 ops->eval = nft_match_eval; 758 ops->init = nft_match_init; 759 ops->destroy = nft_match_destroy; 760 ops->dump = nft_match_dump; 761 ops->validate = nft_match_validate; 762 ops->data = match; 763 764 matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); 765 if (matchsize > NFT_MATCH_LARGE_THRESH) { 766 matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); 767 768 ops->eval = nft_match_large_eval; 769 ops->init = nft_match_large_init; 770 ops->destroy = nft_match_large_destroy; 771 ops->dump = nft_match_large_dump; 772 } 773 774 ops->size = matchsize; 775 776 return ops; 777 err: 778 module_put(match->me); 779 return ERR_PTR(err); 780 } 781 782 static void nft_match_release_ops(const struct nft_expr_ops *ops) 783 { 784 struct xt_match *match = ops->data; 785 786 module_put(match->me); 787 kfree(ops); 788 } 789 790 static struct nft_expr_type nft_match_type __read_mostly = { 791 .name = "match", 792 .select_ops = nft_match_select_ops, 793 .release_ops = nft_match_release_ops, 794 .policy = nft_match_policy, 795 .maxattr = NFTA_MATCH_MAX, 796 .owner = THIS_MODULE, 797 }; 798 799 static struct nft_expr_type nft_target_type; 800 801 static const struct nft_expr_ops * 802 nft_target_select_ops(const struct nft_ctx *ctx, 803 const struct nlattr * const tb[]) 804 { 805 struct nft_expr_ops *ops; 806 struct xt_target *target; 807 char *tg_name; 808 u32 rev, family; 809 int err; 810 811 if (tb[NFTA_TARGET_NAME] == NULL || 812 tb[NFTA_TARGET_REV] == NULL || 813 tb[NFTA_TARGET_INFO] == NULL) 814 return ERR_PTR(-EINVAL); 815 816 tg_name = nla_data(tb[NFTA_TARGET_NAME]); 817 rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); 818 family = ctx->family; 819 820 if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || 821 strcmp(tg_name, XT_STANDARD_TARGET) == 0 || 822 strcmp(tg_name, "standard") == 0) 823 return ERR_PTR(-EINVAL); 824 825 target = xt_request_find_target(family, tg_name, rev); 826 if (IS_ERR(target)) 827 return ERR_PTR(-ENOENT); 828 829 if (!target->target) { 830 err = -EINVAL; 831 goto err; 832 } 833 834 if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) { 835 err = -EINVAL; 836 goto err; 837 } 838 839 ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); 840 if (!ops) { 841 err = -ENOMEM; 842 goto err; 843 } 844 845 ops->type = &nft_target_type; 846 ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); 847 ops->init = nft_target_init; 848 ops->destroy = nft_target_destroy; 849 ops->dump = nft_target_dump; 850 ops->validate = nft_target_validate; 851 ops->data = target; 852 853 if (family == NFPROTO_BRIDGE) 854 ops->eval = nft_target_eval_bridge; 855 else 856 ops->eval = nft_target_eval_xt; 857 858 return ops; 859 err: 860 module_put(target->me); 861 return ERR_PTR(err); 862 } 863 864 static void nft_target_release_ops(const struct nft_expr_ops *ops) 865 { 866 struct xt_target *target = ops->data; 867 868 module_put(target->me); 869 kfree(ops); 870 } 871 872 static struct nft_expr_type nft_target_type __read_mostly = { 873 .name = "target", 874 .select_ops = nft_target_select_ops, 875 .release_ops = nft_target_release_ops, 876 .policy = nft_target_policy, 877 .maxattr = NFTA_TARGET_MAX, 878 .owner = THIS_MODULE, 879 }; 880 881 static int __init nft_compat_module_init(void) 882 { 883 int ret; 884 885 ret = nft_register_expr(&nft_match_type); 886 if (ret < 0) 887 return ret; 888 889 ret = nft_register_expr(&nft_target_type); 890 if (ret < 0) 891 goto err_match; 892 893 ret = nfnetlink_subsys_register(&nfnl_compat_subsys); 894 if (ret < 0) { 895 pr_err("nft_compat: cannot register with nfnetlink.\n"); 896 goto err_target; 897 } 898 899 return ret; 900 err_target: 901 nft_unregister_expr(&nft_target_type); 902 err_match: 903 nft_unregister_expr(&nft_match_type); 904 return ret; 905 } 906 907 static void __exit nft_compat_module_exit(void) 908 { 909 nfnetlink_subsys_unregister(&nfnl_compat_subsys); 910 nft_unregister_expr(&nft_target_type); 911 nft_unregister_expr(&nft_match_type); 912 } 913 914 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); 915 916 module_init(nft_compat_module_init); 917 module_exit(nft_compat_module_exit); 918 919 MODULE_LICENSE("GPL"); 920 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); 921 MODULE_ALIAS_NFT_EXPR("match"); 922 MODULE_ALIAS_NFT_EXPR("target"); 923 MODULE_DESCRIPTION("x_tables over nftables support"); 924