1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015 Patrick McHardy <kaber@trash.net> 4 */ 5 6 #include <linux/kernel.h> 7 #include <linux/module.h> 8 #include <linux/init.h> 9 #include <linux/netlink.h> 10 #include <linux/netfilter.h> 11 #include <linux/netfilter/nf_tables.h> 12 #include <net/netfilter/nf_tables.h> 13 #include <net/netfilter/nf_tables_core.h> 14 15 struct nft_dynset { 16 struct nft_set *set; 17 struct nft_set_ext_tmpl tmpl; 18 enum nft_dynset_ops op:8; 19 u8 sreg_key; 20 u8 sreg_data; 21 bool invert; 22 bool expr; 23 u8 num_exprs; 24 u64 timeout; 25 struct nft_expr *expr_array[NFT_SET_EXPR_MAX]; 26 struct nft_set_binding binding; 27 }; 28 29 static int nft_dynset_expr_setup(const struct nft_dynset *priv, 30 const struct nft_set_ext *ext) 31 { 32 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 33 struct nft_expr *expr; 34 int i; 35 36 for (i = 0; i < priv->num_exprs; i++) { 37 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 38 if (nft_expr_clone(expr, priv->expr_array[i]) < 0) 39 return -1; 40 41 elem_expr->size += priv->expr_array[i]->ops->size; 42 } 43 44 return 0; 45 } 46 47 static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr, 48 struct nft_regs *regs) 49 { 50 const struct nft_dynset *priv = nft_expr_priv(expr); 51 struct nft_set_ext *ext; 52 u64 timeout; 53 void *elem; 54 55 if (!atomic_add_unless(&set->nelems, 1, set->size)) 56 return NULL; 57 58 timeout = priv->timeout ? : set->timeout; 59 elem = nft_set_elem_init(set, &priv->tmpl, 60 ®s->data[priv->sreg_key], NULL, 61 ®s->data[priv->sreg_data], 62 timeout, 0, GFP_ATOMIC); 63 if (elem == NULL) 64 goto err1; 65 66 ext = nft_set_elem_ext(set, elem); 67 if (priv->num_exprs && nft_dynset_expr_setup(priv, ext) < 0) 68 goto err2; 69 70 return elem; 71 72 err2: 73 nft_set_elem_destroy(set, elem, false); 74 err1: 75 if (set->size) 76 atomic_dec(&set->nelems); 77 return NULL; 78 } 79 80 void nft_dynset_eval(const struct nft_expr *expr, 81 struct nft_regs *regs, const struct nft_pktinfo *pkt) 82 { 83 const struct nft_dynset *priv = nft_expr_priv(expr); 84 struct nft_set *set = priv->set; 85 const struct nft_set_ext *ext; 86 u64 timeout; 87 88 if (priv->op == NFT_DYNSET_OP_DELETE) { 89 set->ops->delete(set, ®s->data[priv->sreg_key]); 90 return; 91 } 92 93 if (set->ops->update(set, ®s->data[priv->sreg_key], nft_dynset_new, 94 expr, regs, &ext)) { 95 if (priv->op == NFT_DYNSET_OP_UPDATE && 96 nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) { 97 timeout = priv->timeout ? : set->timeout; 98 *nft_set_ext_expiration(ext) = get_jiffies_64() + timeout; 99 } 100 101 nft_set_elem_update_expr(ext, regs, pkt); 102 103 if (priv->invert) 104 regs->verdict.code = NFT_BREAK; 105 return; 106 } 107 108 if (!priv->invert) 109 regs->verdict.code = NFT_BREAK; 110 } 111 112 static void nft_dynset_ext_add_expr(struct nft_dynset *priv) 113 { 114 u8 size = 0; 115 int i; 116 117 for (i = 0; i < priv->num_exprs; i++) 118 size += priv->expr_array[i]->ops->size; 119 120 nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_EXPRESSIONS, 121 sizeof(struct nft_set_elem_expr) + size); 122 } 123 124 static struct nft_expr * 125 nft_dynset_expr_alloc(const struct nft_ctx *ctx, const struct nft_set *set, 126 const struct nlattr *attr, int pos) 127 { 128 struct nft_expr *expr; 129 int err; 130 131 expr = nft_set_elem_expr_alloc(ctx, set, attr); 132 if (IS_ERR(expr)) 133 return expr; 134 135 if (set->exprs[pos] && set->exprs[pos]->ops != expr->ops) { 136 err = -EOPNOTSUPP; 137 goto err_dynset_expr; 138 } 139 140 return expr; 141 142 err_dynset_expr: 143 nft_expr_destroy(ctx, expr); 144 return ERR_PTR(err); 145 } 146 147 static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = { 148 [NFTA_DYNSET_SET_NAME] = { .type = NLA_STRING, 149 .len = NFT_SET_MAXNAMELEN - 1 }, 150 [NFTA_DYNSET_SET_ID] = { .type = NLA_U32 }, 151 [NFTA_DYNSET_OP] = { .type = NLA_U32 }, 152 [NFTA_DYNSET_SREG_KEY] = { .type = NLA_U32 }, 153 [NFTA_DYNSET_SREG_DATA] = { .type = NLA_U32 }, 154 [NFTA_DYNSET_TIMEOUT] = { .type = NLA_U64 }, 155 [NFTA_DYNSET_EXPR] = { .type = NLA_NESTED }, 156 [NFTA_DYNSET_FLAGS] = { .type = NLA_U32 }, 157 [NFTA_DYNSET_EXPRESSIONS] = { .type = NLA_NESTED }, 158 }; 159 160 static int nft_dynset_init(const struct nft_ctx *ctx, 161 const struct nft_expr *expr, 162 const struct nlattr * const tb[]) 163 { 164 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 165 struct nft_dynset *priv = nft_expr_priv(expr); 166 u8 genmask = nft_genmask_next(ctx->net); 167 struct nft_set *set; 168 u64 timeout; 169 int err, i; 170 171 lockdep_assert_held(&nft_net->commit_mutex); 172 173 if (tb[NFTA_DYNSET_SET_NAME] == NULL || 174 tb[NFTA_DYNSET_OP] == NULL || 175 tb[NFTA_DYNSET_SREG_KEY] == NULL) 176 return -EINVAL; 177 178 if (tb[NFTA_DYNSET_FLAGS]) { 179 u32 flags = ntohl(nla_get_be32(tb[NFTA_DYNSET_FLAGS])); 180 if (flags & ~(NFT_DYNSET_F_INV | NFT_DYNSET_F_EXPR)) 181 return -EOPNOTSUPP; 182 if (flags & NFT_DYNSET_F_INV) 183 priv->invert = true; 184 if (flags & NFT_DYNSET_F_EXPR) 185 priv->expr = true; 186 } 187 188 set = nft_set_lookup_global(ctx->net, ctx->table, 189 tb[NFTA_DYNSET_SET_NAME], 190 tb[NFTA_DYNSET_SET_ID], genmask); 191 if (IS_ERR(set)) 192 return PTR_ERR(set); 193 194 if (set->ops->update == NULL) 195 return -EOPNOTSUPP; 196 197 if (set->flags & NFT_SET_CONSTANT) 198 return -EBUSY; 199 200 priv->op = ntohl(nla_get_be32(tb[NFTA_DYNSET_OP])); 201 switch (priv->op) { 202 case NFT_DYNSET_OP_ADD: 203 case NFT_DYNSET_OP_DELETE: 204 break; 205 case NFT_DYNSET_OP_UPDATE: 206 if (!(set->flags & NFT_SET_TIMEOUT)) 207 return -EOPNOTSUPP; 208 break; 209 default: 210 return -EOPNOTSUPP; 211 } 212 213 timeout = 0; 214 if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { 215 if (!(set->flags & NFT_SET_TIMEOUT)) 216 return -EOPNOTSUPP; 217 218 err = nf_msecs_to_jiffies64(tb[NFTA_DYNSET_TIMEOUT], &timeout); 219 if (err) 220 return err; 221 } 222 223 err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_KEY], &priv->sreg_key, 224 set->klen); 225 if (err < 0) 226 return err; 227 228 if (tb[NFTA_DYNSET_SREG_DATA] != NULL) { 229 if (!(set->flags & NFT_SET_MAP)) 230 return -EOPNOTSUPP; 231 if (set->dtype == NFT_DATA_VERDICT) 232 return -EOPNOTSUPP; 233 234 err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_DATA], 235 &priv->sreg_data, set->dlen); 236 if (err < 0) 237 return err; 238 } else if (set->flags & NFT_SET_MAP) 239 return -EINVAL; 240 241 if ((tb[NFTA_DYNSET_EXPR] || tb[NFTA_DYNSET_EXPRESSIONS]) && 242 !(set->flags & NFT_SET_EVAL)) 243 return -EINVAL; 244 245 if (tb[NFTA_DYNSET_EXPR]) { 246 struct nft_expr *dynset_expr; 247 248 dynset_expr = nft_dynset_expr_alloc(ctx, set, 249 tb[NFTA_DYNSET_EXPR], 0); 250 if (IS_ERR(dynset_expr)) 251 return PTR_ERR(dynset_expr); 252 253 priv->num_exprs++; 254 priv->expr_array[0] = dynset_expr; 255 256 if (set->num_exprs > 1 || 257 (set->num_exprs == 1 && 258 dynset_expr->ops != set->exprs[0]->ops)) { 259 err = -EOPNOTSUPP; 260 goto err_expr_free; 261 } 262 } else if (tb[NFTA_DYNSET_EXPRESSIONS]) { 263 struct nft_expr *dynset_expr; 264 struct nlattr *tmp; 265 int left; 266 267 if (!priv->expr) 268 return -EINVAL; 269 270 i = 0; 271 nla_for_each_nested(tmp, tb[NFTA_DYNSET_EXPRESSIONS], left) { 272 if (i == NFT_SET_EXPR_MAX) { 273 err = -E2BIG; 274 goto err_expr_free; 275 } 276 if (nla_type(tmp) != NFTA_LIST_ELEM) { 277 err = -EINVAL; 278 goto err_expr_free; 279 } 280 dynset_expr = nft_dynset_expr_alloc(ctx, set, tmp, i); 281 if (IS_ERR(dynset_expr)) { 282 err = PTR_ERR(dynset_expr); 283 goto err_expr_free; 284 } 285 priv->expr_array[i] = dynset_expr; 286 priv->num_exprs++; 287 288 if (set->num_exprs && 289 dynset_expr->ops != set->exprs[i]->ops) { 290 err = -EOPNOTSUPP; 291 goto err_expr_free; 292 } 293 i++; 294 } 295 if (set->num_exprs && set->num_exprs != i) { 296 err = -EOPNOTSUPP; 297 goto err_expr_free; 298 } 299 } else if (set->num_exprs > 0) { 300 err = nft_set_elem_expr_clone(ctx, set, priv->expr_array); 301 if (err < 0) 302 return err; 303 304 priv->num_exprs = set->num_exprs; 305 } 306 307 nft_set_ext_prepare(&priv->tmpl); 308 nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen); 309 if (set->flags & NFT_SET_MAP) 310 nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_DATA, set->dlen); 311 312 if (priv->num_exprs) 313 nft_dynset_ext_add_expr(priv); 314 315 if (set->flags & NFT_SET_TIMEOUT) { 316 if (timeout || set->timeout) { 317 nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT); 318 nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION); 319 } 320 } 321 322 priv->timeout = timeout; 323 324 err = nf_tables_bind_set(ctx, set, &priv->binding); 325 if (err < 0) 326 goto err_expr_free; 327 328 if (set->size == 0) 329 set->size = 0xffff; 330 331 priv->set = set; 332 return 0; 333 334 err_expr_free: 335 for (i = 0; i < priv->num_exprs; i++) 336 nft_expr_destroy(ctx, priv->expr_array[i]); 337 return err; 338 } 339 340 static void nft_dynset_deactivate(const struct nft_ctx *ctx, 341 const struct nft_expr *expr, 342 enum nft_trans_phase phase) 343 { 344 struct nft_dynset *priv = nft_expr_priv(expr); 345 346 nf_tables_deactivate_set(ctx, priv->set, &priv->binding, phase); 347 } 348 349 static void nft_dynset_activate(const struct nft_ctx *ctx, 350 const struct nft_expr *expr) 351 { 352 struct nft_dynset *priv = nft_expr_priv(expr); 353 354 priv->set->use++; 355 } 356 357 static void nft_dynset_destroy(const struct nft_ctx *ctx, 358 const struct nft_expr *expr) 359 { 360 struct nft_dynset *priv = nft_expr_priv(expr); 361 int i; 362 363 for (i = 0; i < priv->num_exprs; i++) 364 nft_expr_destroy(ctx, priv->expr_array[i]); 365 366 nf_tables_destroy_set(ctx, priv->set); 367 } 368 369 static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) 370 { 371 const struct nft_dynset *priv = nft_expr_priv(expr); 372 u32 flags = priv->invert ? NFT_DYNSET_F_INV : 0; 373 int i; 374 375 if (nft_dump_register(skb, NFTA_DYNSET_SREG_KEY, priv->sreg_key)) 376 goto nla_put_failure; 377 if (priv->set->flags & NFT_SET_MAP && 378 nft_dump_register(skb, NFTA_DYNSET_SREG_DATA, priv->sreg_data)) 379 goto nla_put_failure; 380 if (nla_put_be32(skb, NFTA_DYNSET_OP, htonl(priv->op))) 381 goto nla_put_failure; 382 if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name)) 383 goto nla_put_failure; 384 if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, 385 nf_jiffies64_to_msecs(priv->timeout), 386 NFTA_DYNSET_PAD)) 387 goto nla_put_failure; 388 if (priv->set->num_exprs == 0) { 389 if (priv->num_exprs == 1) { 390 if (nft_expr_dump(skb, NFTA_DYNSET_EXPR, 391 priv->expr_array[0])) 392 goto nla_put_failure; 393 } else if (priv->num_exprs > 1) { 394 struct nlattr *nest; 395 396 nest = nla_nest_start_noflag(skb, NFTA_DYNSET_EXPRESSIONS); 397 if (!nest) 398 goto nla_put_failure; 399 400 for (i = 0; i < priv->num_exprs; i++) { 401 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 402 priv->expr_array[i])) 403 goto nla_put_failure; 404 } 405 nla_nest_end(skb, nest); 406 } 407 } 408 if (nla_put_be32(skb, NFTA_DYNSET_FLAGS, htonl(flags))) 409 goto nla_put_failure; 410 return 0; 411 412 nla_put_failure: 413 return -1; 414 } 415 416 static const struct nft_expr_ops nft_dynset_ops = { 417 .type = &nft_dynset_type, 418 .size = NFT_EXPR_SIZE(sizeof(struct nft_dynset)), 419 .eval = nft_dynset_eval, 420 .init = nft_dynset_init, 421 .destroy = nft_dynset_destroy, 422 .activate = nft_dynset_activate, 423 .deactivate = nft_dynset_deactivate, 424 .dump = nft_dynset_dump, 425 }; 426 427 struct nft_expr_type nft_dynset_type __read_mostly = { 428 .name = "dynset", 429 .ops = &nft_dynset_ops, 430 .policy = nft_dynset_policy, 431 .maxattr = NFTA_DYNSET_MAX, 432 .owner = THIS_MODULE, 433 }; 434